Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6
[linux-2.6] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/types.h>
69 #include <linux/major.h>
70 #include <linux/errno.h>
71 #include <linux/signal.h>
72 #include <linux/fcntl.h>
73 #include <linux/sched.h>
74 #include <linux/interrupt.h>
75 #include <linux/tty.h>
76 #include <linux/tty_driver.h>
77 #include <linux/tty_flip.h>
78 #include <linux/devpts_fs.h>
79 #include <linux/file.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/smp_lock.h>
92 #include <linux/device.h>
93 #include <linux/idr.h>
94 #include <linux/wait.h>
95 #include <linux/bitops.h>
96 #include <linux/delay.h>
97
98 #include <asm/uaccess.h>
99 #include <asm/system.h>
100
101 #include <linux/kbd_kern.h>
102 #include <linux/vt_kern.h>
103 #include <linux/selection.h>
104
105 #include <linux/kmod.h>
106
107 #undef TTY_DEBUG_HANGUP
108
109 #define TTY_PARANOIA_CHECK 1
110 #define CHECK_TTY_COUNT 1
111
112 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
113         .c_iflag = ICRNL | IXON,
114         .c_oflag = OPOST | ONLCR,
115         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
116         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
117                    ECHOCTL | ECHOKE | IEXTEN,
118         .c_cc = INIT_C_CC,
119         .c_ispeed = 38400,
120         .c_ospeed = 38400
121 };
122
123 EXPORT_SYMBOL(tty_std_termios);
124
125 /* This list gets poked at by procfs and various bits of boot up code. This
126    could do with some rationalisation such as pulling the tty proc function
127    into this file */
128    
129 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
130
131 /* Mutex to protect creating and releasing a tty. This is shared with
132    vt.c for deeply disgusting hack reasons */
133 DEFINE_MUTEX(tty_mutex);
134 EXPORT_SYMBOL(tty_mutex);
135
136 #ifdef CONFIG_UNIX98_PTYS
137 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
138 extern int pty_limit;           /* Config limit on Unix98 ptys */
139 static DEFINE_IDR(allocated_ptys);
140 static DECLARE_MUTEX(allocated_ptys_lock);
141 static int ptmx_open(struct inode *, struct file *);
142 #endif
143
144 static void initialize_tty_struct(struct tty_struct *tty);
145
146 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
147 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
148 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
149 static unsigned int tty_poll(struct file *, poll_table *);
150 static int tty_open(struct inode *, struct file *);
151 static int tty_release(struct inode *, struct file *);
152 int tty_ioctl(struct inode * inode, struct file * file,
153               unsigned int cmd, unsigned long arg);
154 #ifdef CONFIG_COMPAT
155 static long tty_compat_ioctl(struct file * file, unsigned int cmd,
156                                 unsigned long arg);
157 #else
158 #define tty_compat_ioctl NULL
159 #endif
160 static int tty_fasync(int fd, struct file * filp, int on);
161 static void release_tty(struct tty_struct *tty, int idx);
162 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
163 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
164
165 /**
166  *      alloc_tty_struct        -       allocate a tty object
167  *
168  *      Return a new empty tty structure. The data fields have not
169  *      been initialized in any way but has been zeroed
170  *
171  *      Locking: none
172  */
173
174 static struct tty_struct *alloc_tty_struct(void)
175 {
176         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
177 }
178
179 static void tty_buffer_free_all(struct tty_struct *);
180
181 /**
182  *      free_tty_struct         -       free a disused tty
183  *      @tty: tty struct to free
184  *
185  *      Free the write buffers, tty queue and tty memory itself.
186  *
187  *      Locking: none. Must be called after tty is definitely unused
188  */
189
190 static inline void free_tty_struct(struct tty_struct *tty)
191 {
192         kfree(tty->write_buf);
193         tty_buffer_free_all(tty);
194         kfree(tty);
195 }
196
197 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
198
199 /**
200  *      tty_name        -       return tty naming
201  *      @tty: tty structure
202  *      @buf: buffer for output
203  *
204  *      Convert a tty structure into a name. The name reflects the kernel
205  *      naming policy and if udev is in use may not reflect user space
206  *
207  *      Locking: none
208  */
209
210 char *tty_name(struct tty_struct *tty, char *buf)
211 {
212         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
213                 strcpy(buf, "NULL tty");
214         else
215                 strcpy(buf, tty->name);
216         return buf;
217 }
218
219 EXPORT_SYMBOL(tty_name);
220
221 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
222                               const char *routine)
223 {
224 #ifdef TTY_PARANOIA_CHECK
225         if (!tty) {
226                 printk(KERN_WARNING
227                         "null TTY for (%d:%d) in %s\n",
228                         imajor(inode), iminor(inode), routine);
229                 return 1;
230         }
231         if (tty->magic != TTY_MAGIC) {
232                 printk(KERN_WARNING
233                         "bad magic number for tty struct (%d:%d) in %s\n",
234                         imajor(inode), iminor(inode), routine);
235                 return 1;
236         }
237 #endif
238         return 0;
239 }
240
241 static int check_tty_count(struct tty_struct *tty, const char *routine)
242 {
243 #ifdef CHECK_TTY_COUNT
244         struct list_head *p;
245         int count = 0;
246         
247         file_list_lock();
248         list_for_each(p, &tty->tty_files) {
249                 count++;
250         }
251         file_list_unlock();
252         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
253             tty->driver->subtype == PTY_TYPE_SLAVE &&
254             tty->link && tty->link->count)
255                 count++;
256         if (tty->count != count) {
257                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
258                                     "!= #fd's(%d) in %s\n",
259                        tty->name, tty->count, count, routine);
260                 return count;
261         }
262 #endif
263         return 0;
264 }
265
266 /*
267  * Tty buffer allocation management
268  */
269
270 /**
271  *      tty_buffer_free_all             -       free buffers used by a tty
272  *      @tty: tty to free from
273  *
274  *      Remove all the buffers pending on a tty whether queued with data
275  *      or in the free ring. Must be called when the tty is no longer in use
276  *
277  *      Locking: none
278  */
279
280 static void tty_buffer_free_all(struct tty_struct *tty)
281 {
282         struct tty_buffer *thead;
283         while((thead = tty->buf.head) != NULL) {
284                 tty->buf.head = thead->next;
285                 kfree(thead);
286         }
287         while((thead = tty->buf.free) != NULL) {
288                 tty->buf.free = thead->next;
289                 kfree(thead);
290         }
291         tty->buf.tail = NULL;
292         tty->buf.memory_used = 0;
293 }
294
295 /**
296  *      tty_buffer_init         -       prepare a tty buffer structure
297  *      @tty: tty to initialise
298  *
299  *      Set up the initial state of the buffer management for a tty device.
300  *      Must be called before the other tty buffer functions are used.
301  *
302  *      Locking: none
303  */
304
305 static void tty_buffer_init(struct tty_struct *tty)
306 {
307         spin_lock_init(&tty->buf.lock);
308         tty->buf.head = NULL;
309         tty->buf.tail = NULL;
310         tty->buf.free = NULL;
311         tty->buf.memory_used = 0;
312 }
313
314 /**
315  *      tty_buffer_alloc        -       allocate a tty buffer
316  *      @tty: tty device
317  *      @size: desired size (characters)
318  *
319  *      Allocate a new tty buffer to hold the desired number of characters.
320  *      Return NULL if out of memory or the allocation would exceed the
321  *      per device queue
322  *
323  *      Locking: Caller must hold tty->buf.lock
324  */
325
326 static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
327 {
328         struct tty_buffer *p;
329
330         if (tty->buf.memory_used + size > 65536)
331                 return NULL;
332         p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
333         if(p == NULL)
334                 return NULL;
335         p->used = 0;
336         p->size = size;
337         p->next = NULL;
338         p->commit = 0;
339         p->read = 0;
340         p->char_buf_ptr = (char *)(p->data);
341         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
342         tty->buf.memory_used += size;
343         return p;
344 }
345
346 /**
347  *      tty_buffer_free         -       free a tty buffer
348  *      @tty: tty owning the buffer
349  *      @b: the buffer to free
350  *
351  *      Free a tty buffer, or add it to the free list according to our
352  *      internal strategy
353  *
354  *      Locking: Caller must hold tty->buf.lock
355  */
356
357 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
358 {
359         /* Dumb strategy for now - should keep some stats */
360         tty->buf.memory_used -= b->size;
361         WARN_ON(tty->buf.memory_used < 0);
362
363         if(b->size >= 512)
364                 kfree(b);
365         else {
366                 b->next = tty->buf.free;
367                 tty->buf.free = b;
368         }
369 }
370
371 /**
372  *      __tty_buffer_flush              -       flush full tty buffers
373  *      @tty: tty to flush
374  *
375  *      flush all the buffers containing receive data. Caller must
376  *      hold the buffer lock and must have ensured no parallel flush to
377  *      ldisc is running.
378  *
379  *      Locking: Caller must hold tty->buf.lock
380  */
381
382 static void __tty_buffer_flush(struct tty_struct *tty)
383 {
384         struct tty_buffer *thead;
385
386         while((thead = tty->buf.head) != NULL) {
387                 tty->buf.head = thead->next;
388                 tty_buffer_free(tty, thead);
389         }
390         tty->buf.tail = NULL;
391 }
392
393 /**
394  *      tty_buffer_flush                -       flush full tty buffers
395  *      @tty: tty to flush
396  *
397  *      flush all the buffers containing receive data. If the buffer is
398  *      being processed by flush_to_ldisc then we defer the processing
399  *      to that function
400  *
401  *      Locking: none
402  */
403
404 static void tty_buffer_flush(struct tty_struct *tty)
405 {
406         unsigned long flags;
407         spin_lock_irqsave(&tty->buf.lock, flags);
408
409         /* If the data is being pushed to the tty layer then we can't
410            process it here. Instead set a flag and the flush_to_ldisc
411            path will process the flush request before it exits */
412         if (test_bit(TTY_FLUSHING, &tty->flags)) {
413                 set_bit(TTY_FLUSHPENDING, &tty->flags);
414                 spin_unlock_irqrestore(&tty->buf.lock, flags);
415                 wait_event(tty->read_wait,
416                                 test_bit(TTY_FLUSHPENDING, &tty->flags) == 0);
417                 return;
418         } else
419                 __tty_buffer_flush(tty);
420         spin_unlock_irqrestore(&tty->buf.lock, flags);
421 }
422
423 /**
424  *      tty_buffer_find         -       find a free tty buffer
425  *      @tty: tty owning the buffer
426  *      @size: characters wanted
427  *
428  *      Locate an existing suitable tty buffer or if we are lacking one then
429  *      allocate a new one. We round our buffers off in 256 character chunks
430  *      to get better allocation behaviour.
431  *
432  *      Locking: Caller must hold tty->buf.lock
433  */
434
435 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
436 {
437         struct tty_buffer **tbh = &tty->buf.free;
438         while((*tbh) != NULL) {
439                 struct tty_buffer *t = *tbh;
440                 if(t->size >= size) {
441                         *tbh = t->next;
442                         t->next = NULL;
443                         t->used = 0;
444                         t->commit = 0;
445                         t->read = 0;
446                         tty->buf.memory_used += t->size;
447                         return t;
448                 }
449                 tbh = &((*tbh)->next);
450         }
451         /* Round the buffer size out */
452         size = (size + 0xFF) & ~ 0xFF;
453         return tty_buffer_alloc(tty, size);
454         /* Should possibly check if this fails for the largest buffer we
455            have queued and recycle that ? */
456 }
457
458 /**
459  *      tty_buffer_request_room         -       grow tty buffer if needed
460  *      @tty: tty structure
461  *      @size: size desired
462  *
463  *      Make at least size bytes of linear space available for the tty
464  *      buffer. If we fail return the size we managed to find.
465  *
466  *      Locking: Takes tty->buf.lock
467  */
468 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
469 {
470         struct tty_buffer *b, *n;
471         int left;
472         unsigned long flags;
473
474         spin_lock_irqsave(&tty->buf.lock, flags);
475
476         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
477            remove this conditional if its worth it. This would be invisible
478            to the callers */
479         if ((b = tty->buf.tail) != NULL)
480                 left = b->size - b->used;
481         else
482                 left = 0;
483
484         if (left < size) {
485                 /* This is the slow path - looking for new buffers to use */
486                 if ((n = tty_buffer_find(tty, size)) != NULL) {
487                         if (b != NULL) {
488                                 b->next = n;
489                                 b->commit = b->used;
490                         } else
491                                 tty->buf.head = n;
492                         tty->buf.tail = n;
493                 } else
494                         size = left;
495         }
496
497         spin_unlock_irqrestore(&tty->buf.lock, flags);
498         return size;
499 }
500 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
501
502 /**
503  *      tty_insert_flip_string  -       Add characters to the tty buffer
504  *      @tty: tty structure
505  *      @chars: characters
506  *      @size: size
507  *
508  *      Queue a series of bytes to the tty buffering. All the characters
509  *      passed are marked as without error. Returns the number added.
510  *
511  *      Locking: Called functions may take tty->buf.lock
512  */
513
514 int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
515                                 size_t size)
516 {
517         int copied = 0;
518         do {
519                 int space = tty_buffer_request_room(tty, size - copied);
520                 struct tty_buffer *tb = tty->buf.tail;
521                 /* If there is no space then tb may be NULL */
522                 if(unlikely(space == 0))
523                         break;
524                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
525                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
526                 tb->used += space;
527                 copied += space;
528                 chars += space;
529                 /* There is a small chance that we need to split the data over
530                    several buffers. If this is the case we must loop */
531         } while (unlikely(size > copied));
532         return copied;
533 }
534 EXPORT_SYMBOL(tty_insert_flip_string);
535
536 /**
537  *      tty_insert_flip_string_flags    -       Add characters to the tty buffer
538  *      @tty: tty structure
539  *      @chars: characters
540  *      @flags: flag bytes
541  *      @size: size
542  *
543  *      Queue a series of bytes to the tty buffering. For each character
544  *      the flags array indicates the status of the character. Returns the
545  *      number added.
546  *
547  *      Locking: Called functions may take tty->buf.lock
548  */
549
550 int tty_insert_flip_string_flags(struct tty_struct *tty,
551                 const unsigned char *chars, const char *flags, size_t size)
552 {
553         int copied = 0;
554         do {
555                 int space = tty_buffer_request_room(tty, size - copied);
556                 struct tty_buffer *tb = tty->buf.tail;
557                 /* If there is no space then tb may be NULL */
558                 if(unlikely(space == 0))
559                         break;
560                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
561                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
562                 tb->used += space;
563                 copied += space;
564                 chars += space;
565                 flags += space;
566                 /* There is a small chance that we need to split the data over
567                    several buffers. If this is the case we must loop */
568         } while (unlikely(size > copied));
569         return copied;
570 }
571 EXPORT_SYMBOL(tty_insert_flip_string_flags);
572
573 /**
574  *      tty_schedule_flip       -       push characters to ldisc
575  *      @tty: tty to push from
576  *
577  *      Takes any pending buffers and transfers their ownership to the
578  *      ldisc side of the queue. It then schedules those characters for
579  *      processing by the line discipline.
580  *
581  *      Locking: Takes tty->buf.lock
582  */
583
584 void tty_schedule_flip(struct tty_struct *tty)
585 {
586         unsigned long flags;
587         spin_lock_irqsave(&tty->buf.lock, flags);
588         if (tty->buf.tail != NULL)
589                 tty->buf.tail->commit = tty->buf.tail->used;
590         spin_unlock_irqrestore(&tty->buf.lock, flags);
591         schedule_delayed_work(&tty->buf.work, 1);
592 }
593 EXPORT_SYMBOL(tty_schedule_flip);
594
595 /**
596  *      tty_prepare_flip_string         -       make room for characters
597  *      @tty: tty
598  *      @chars: return pointer for character write area
599  *      @size: desired size
600  *
601  *      Prepare a block of space in the buffer for data. Returns the length
602  *      available and buffer pointer to the space which is now allocated and
603  *      accounted for as ready for normal characters. This is used for drivers
604  *      that need their own block copy routines into the buffer. There is no
605  *      guarantee the buffer is a DMA target!
606  *
607  *      Locking: May call functions taking tty->buf.lock
608  */
609
610 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
611 {
612         int space = tty_buffer_request_room(tty, size);
613         if (likely(space)) {
614                 struct tty_buffer *tb = tty->buf.tail;
615                 *chars = tb->char_buf_ptr + tb->used;
616                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
617                 tb->used += space;
618         }
619         return space;
620 }
621
622 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
623
624 /**
625  *      tty_prepare_flip_string_flags   -       make room for characters
626  *      @tty: tty
627  *      @chars: return pointer for character write area
628  *      @flags: return pointer for status flag write area
629  *      @size: desired size
630  *
631  *      Prepare a block of space in the buffer for data. Returns the length
632  *      available and buffer pointer to the space which is now allocated and
633  *      accounted for as ready for characters. This is used for drivers
634  *      that need their own block copy routines into the buffer. There is no
635  *      guarantee the buffer is a DMA target!
636  *
637  *      Locking: May call functions taking tty->buf.lock
638  */
639
640 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
641 {
642         int space = tty_buffer_request_room(tty, size);
643         if (likely(space)) {
644                 struct tty_buffer *tb = tty->buf.tail;
645                 *chars = tb->char_buf_ptr + tb->used;
646                 *flags = tb->flag_buf_ptr + tb->used;
647                 tb->used += space;
648         }
649         return space;
650 }
651
652 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
653
654
655
656 /**
657  *      tty_set_termios_ldisc           -       set ldisc field
658  *      @tty: tty structure
659  *      @num: line discipline number
660  *
661  *      This is probably overkill for real world processors but
662  *      they are not on hot paths so a little discipline won't do 
663  *      any harm.
664  *
665  *      Locking: takes termios_mutex
666  */
667  
668 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
669 {
670         mutex_lock(&tty->termios_mutex);
671         tty->termios->c_line = num;
672         mutex_unlock(&tty->termios_mutex);
673 }
674
675 /*
676  *      This guards the refcounted line discipline lists. The lock
677  *      must be taken with irqs off because there are hangup path
678  *      callers who will do ldisc lookups and cannot sleep.
679  */
680  
681 static DEFINE_SPINLOCK(tty_ldisc_lock);
682 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
683 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
684
685 /**
686  *      tty_register_ldisc      -       install a line discipline
687  *      @disc: ldisc number
688  *      @new_ldisc: pointer to the ldisc object
689  *
690  *      Installs a new line discipline into the kernel. The discipline
691  *      is set up as unreferenced and then made available to the kernel
692  *      from this point onwards.
693  *
694  *      Locking:
695  *              takes tty_ldisc_lock to guard against ldisc races
696  */
697
698 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
699 {
700         unsigned long flags;
701         int ret = 0;
702         
703         if (disc < N_TTY || disc >= NR_LDISCS)
704                 return -EINVAL;
705         
706         spin_lock_irqsave(&tty_ldisc_lock, flags);
707         tty_ldiscs[disc] = *new_ldisc;
708         tty_ldiscs[disc].num = disc;
709         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
710         tty_ldiscs[disc].refcount = 0;
711         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
712         
713         return ret;
714 }
715 EXPORT_SYMBOL(tty_register_ldisc);
716
717 /**
718  *      tty_unregister_ldisc    -       unload a line discipline
719  *      @disc: ldisc number
720  *      @new_ldisc: pointer to the ldisc object
721  *
722  *      Remove a line discipline from the kernel providing it is not
723  *      currently in use.
724  *
725  *      Locking:
726  *              takes tty_ldisc_lock to guard against ldisc races
727  */
728
729 int tty_unregister_ldisc(int disc)
730 {
731         unsigned long flags;
732         int ret = 0;
733
734         if (disc < N_TTY || disc >= NR_LDISCS)
735                 return -EINVAL;
736
737         spin_lock_irqsave(&tty_ldisc_lock, flags);
738         if (tty_ldiscs[disc].refcount)
739                 ret = -EBUSY;
740         else
741                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
742         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
743
744         return ret;
745 }
746 EXPORT_SYMBOL(tty_unregister_ldisc);
747
748 /**
749  *      tty_ldisc_get           -       take a reference to an ldisc
750  *      @disc: ldisc number
751  *
752  *      Takes a reference to a line discipline. Deals with refcounts and
753  *      module locking counts. Returns NULL if the discipline is not available.
754  *      Returns a pointer to the discipline and bumps the ref count if it is
755  *      available
756  *
757  *      Locking:
758  *              takes tty_ldisc_lock to guard against ldisc races
759  */
760
761 struct tty_ldisc *tty_ldisc_get(int disc)
762 {
763         unsigned long flags;
764         struct tty_ldisc *ld;
765
766         if (disc < N_TTY || disc >= NR_LDISCS)
767                 return NULL;
768         
769         spin_lock_irqsave(&tty_ldisc_lock, flags);
770
771         ld = &tty_ldiscs[disc];
772         /* Check the entry is defined */
773         if(ld->flags & LDISC_FLAG_DEFINED)
774         {
775                 /* If the module is being unloaded we can't use it */
776                 if (!try_module_get(ld->owner))
777                         ld = NULL;
778                 else /* lock it */
779                         ld->refcount++;
780         }
781         else
782                 ld = NULL;
783         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
784         return ld;
785 }
786
787 EXPORT_SYMBOL_GPL(tty_ldisc_get);
788
789 /**
790  *      tty_ldisc_put           -       drop ldisc reference
791  *      @disc: ldisc number
792  *
793  *      Drop a reference to a line discipline. Manage refcounts and
794  *      module usage counts
795  *
796  *      Locking:
797  *              takes tty_ldisc_lock to guard against ldisc races
798  */
799
800 void tty_ldisc_put(int disc)
801 {
802         struct tty_ldisc *ld;
803         unsigned long flags;
804         
805         BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
806                 
807         spin_lock_irqsave(&tty_ldisc_lock, flags);
808         ld = &tty_ldiscs[disc];
809         BUG_ON(ld->refcount == 0);
810         ld->refcount--;
811         module_put(ld->owner);
812         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
813 }
814         
815 EXPORT_SYMBOL_GPL(tty_ldisc_put);
816
817 /**
818  *      tty_ldisc_assign        -       set ldisc on a tty
819  *      @tty: tty to assign
820  *      @ld: line discipline
821  *
822  *      Install an instance of a line discipline into a tty structure. The
823  *      ldisc must have a reference count above zero to ensure it remains/
824  *      The tty instance refcount starts at zero.
825  *
826  *      Locking:
827  *              Caller must hold references
828  */
829
830 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
831 {
832         tty->ldisc = *ld;
833         tty->ldisc.refcount = 0;
834 }
835
836 /**
837  *      tty_ldisc_try           -       internal helper
838  *      @tty: the tty
839  *
840  *      Make a single attempt to grab and bump the refcount on
841  *      the tty ldisc. Return 0 on failure or 1 on success. This is
842  *      used to implement both the waiting and non waiting versions
843  *      of tty_ldisc_ref
844  *
845  *      Locking: takes tty_ldisc_lock
846  */
847
848 static int tty_ldisc_try(struct tty_struct *tty)
849 {
850         unsigned long flags;
851         struct tty_ldisc *ld;
852         int ret = 0;
853         
854         spin_lock_irqsave(&tty_ldisc_lock, flags);
855         ld = &tty->ldisc;
856         if(test_bit(TTY_LDISC, &tty->flags))
857         {
858                 ld->refcount++;
859                 ret = 1;
860         }
861         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
862         return ret;
863 }
864
865 /**
866  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
867  *      @tty: tty device
868  *
869  *      Dereference the line discipline for the terminal and take a 
870  *      reference to it. If the line discipline is in flux then 
871  *      wait patiently until it changes.
872  *
873  *      Note: Must not be called from an IRQ/timer context. The caller
874  *      must also be careful not to hold other locks that will deadlock
875  *      against a discipline change, such as an existing ldisc reference
876  *      (which we check for)
877  *
878  *      Locking: call functions take tty_ldisc_lock
879  */
880  
881 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
882 {
883         /* wait_event is a macro */
884         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
885         if(tty->ldisc.refcount == 0)
886                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
887         return &tty->ldisc;
888 }
889
890 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
891
892 /**
893  *      tty_ldisc_ref           -       get the tty ldisc
894  *      @tty: tty device
895  *
896  *      Dereference the line discipline for the terminal and take a 
897  *      reference to it. If the line discipline is in flux then 
898  *      return NULL. Can be called from IRQ and timer functions.
899  *
900  *      Locking: called functions take tty_ldisc_lock
901  */
902  
903 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
904 {
905         if(tty_ldisc_try(tty))
906                 return &tty->ldisc;
907         return NULL;
908 }
909
910 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
911
912 /**
913  *      tty_ldisc_deref         -       free a tty ldisc reference
914  *      @ld: reference to free up
915  *
916  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
917  *      be called in IRQ context.
918  *
919  *      Locking: takes tty_ldisc_lock
920  */
921  
922 void tty_ldisc_deref(struct tty_ldisc *ld)
923 {
924         unsigned long flags;
925
926         BUG_ON(ld == NULL);
927                 
928         spin_lock_irqsave(&tty_ldisc_lock, flags);
929         if(ld->refcount == 0)
930                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
931         else
932                 ld->refcount--;
933         if(ld->refcount == 0)
934                 wake_up(&tty_ldisc_wait);
935         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
936 }
937
938 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
939
940 /**
941  *      tty_ldisc_enable        -       allow ldisc use
942  *      @tty: terminal to activate ldisc on
943  *
944  *      Set the TTY_LDISC flag when the line discipline can be called
945  *      again. Do neccessary wakeups for existing sleepers.
946  *
947  *      Note: nobody should set this bit except via this function. Clearing
948  *      directly is allowed.
949  */
950
951 static void tty_ldisc_enable(struct tty_struct *tty)
952 {
953         set_bit(TTY_LDISC, &tty->flags);
954         wake_up(&tty_ldisc_wait);
955 }
956         
957 /**
958  *      tty_set_ldisc           -       set line discipline
959  *      @tty: the terminal to set
960  *      @ldisc: the line discipline
961  *
962  *      Set the discipline of a tty line. Must be called from a process
963  *      context.
964  *
965  *      Locking: takes tty_ldisc_lock.
966  *               called functions take termios_mutex
967  */
968  
969 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
970 {
971         int retval = 0;
972         struct tty_ldisc o_ldisc;
973         char buf[64];
974         int work;
975         unsigned long flags;
976         struct tty_ldisc *ld;
977         struct tty_struct *o_tty;
978
979         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
980                 return -EINVAL;
981
982 restart:
983
984         ld = tty_ldisc_get(ldisc);
985         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
986         /* Cyrus Durgin <cider@speakeasy.org> */
987         if (ld == NULL) {
988                 request_module("tty-ldisc-%d", ldisc);
989                 ld = tty_ldisc_get(ldisc);
990         }
991         if (ld == NULL)
992                 return -EINVAL;
993
994         /*
995          *      Problem: What do we do if this blocks ?
996          */
997
998         tty_wait_until_sent(tty, 0);
999
1000         if (tty->ldisc.num == ldisc) {
1001                 tty_ldisc_put(ldisc);
1002                 return 0;
1003         }
1004
1005         /*
1006          *      No more input please, we are switching. The new ldisc
1007          *      will update this value in the ldisc open function
1008          */
1009
1010         tty->receive_room = 0;
1011
1012         o_ldisc = tty->ldisc;
1013         o_tty = tty->link;
1014
1015         /*
1016          *      Make sure we don't change while someone holds a
1017          *      reference to the line discipline. The TTY_LDISC bit
1018          *      prevents anyone taking a reference once it is clear.
1019          *      We need the lock to avoid racing reference takers.
1020          */
1021
1022         spin_lock_irqsave(&tty_ldisc_lock, flags);
1023         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
1024                 if(tty->ldisc.refcount) {
1025                         /* Free the new ldisc we grabbed. Must drop the lock
1026                            first. */
1027                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1028                         tty_ldisc_put(ldisc);
1029                         /*
1030                          * There are several reasons we may be busy, including
1031                          * random momentary I/O traffic. We must therefore
1032                          * retry. We could distinguish between blocking ops
1033                          * and retries if we made tty_ldisc_wait() smarter. That
1034                          * is up for discussion.
1035                          */
1036                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
1037                                 return -ERESTARTSYS;
1038                         goto restart;
1039                 }
1040                 if(o_tty && o_tty->ldisc.refcount) {
1041                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1042                         tty_ldisc_put(ldisc);
1043                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
1044                                 return -ERESTARTSYS;
1045                         goto restart;
1046                 }
1047         }
1048
1049         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
1050
1051         if (!test_bit(TTY_LDISC, &tty->flags)) {
1052                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1053                 tty_ldisc_put(ldisc);
1054                 ld = tty_ldisc_ref_wait(tty);
1055                 tty_ldisc_deref(ld);
1056                 goto restart;
1057         }
1058
1059         clear_bit(TTY_LDISC, &tty->flags);
1060         if (o_tty)
1061                 clear_bit(TTY_LDISC, &o_tty->flags);
1062         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1063
1064         /*
1065          *      From this point on we know nobody has an ldisc
1066          *      usage reference, nor can they obtain one until
1067          *      we say so later on.
1068          */
1069
1070         work = cancel_delayed_work(&tty->buf.work);
1071         /*
1072          * Wait for ->hangup_work and ->buf.work handlers to terminate
1073          */
1074          
1075         flush_scheduled_work();
1076         /* Shutdown the current discipline. */
1077         if (tty->ldisc.close)
1078                 (tty->ldisc.close)(tty);
1079
1080         /* Now set up the new line discipline. */
1081         tty_ldisc_assign(tty, ld);
1082         tty_set_termios_ldisc(tty, ldisc);
1083         if (tty->ldisc.open)
1084                 retval = (tty->ldisc.open)(tty);
1085         if (retval < 0) {
1086                 tty_ldisc_put(ldisc);
1087                 /* There is an outstanding reference here so this is safe */
1088                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
1089                 tty_set_termios_ldisc(tty, tty->ldisc.num);
1090                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
1091                         tty_ldisc_put(o_ldisc.num);
1092                         /* This driver is always present */
1093                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1094                         tty_set_termios_ldisc(tty, N_TTY);
1095                         if (tty->ldisc.open) {
1096                                 int r = tty->ldisc.open(tty);
1097
1098                                 if (r < 0)
1099                                         panic("Couldn't open N_TTY ldisc for "
1100                                               "%s --- error %d.",
1101                                               tty_name(tty, buf), r);
1102                         }
1103                 }
1104         }
1105         /* At this point we hold a reference to the new ldisc and a
1106            a reference to the old ldisc. If we ended up flipping back
1107            to the existing ldisc we have two references to it */
1108         
1109         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
1110                 tty->driver->set_ldisc(tty);
1111                 
1112         tty_ldisc_put(o_ldisc.num);
1113         
1114         /*
1115          *      Allow ldisc referencing to occur as soon as the driver
1116          *      ldisc callback completes.
1117          */
1118          
1119         tty_ldisc_enable(tty);
1120         if (o_tty)
1121                 tty_ldisc_enable(o_tty);
1122         
1123         /* Restart it in case no characters kick it off. Safe if
1124            already running */
1125         if (work)
1126                 schedule_delayed_work(&tty->buf.work, 1);
1127         return retval;
1128 }
1129
1130 /**
1131  *      get_tty_driver          -       find device of a tty
1132  *      @dev_t: device identifier
1133  *      @index: returns the index of the tty
1134  *
1135  *      This routine returns a tty driver structure, given a device number
1136  *      and also passes back the index number.
1137  *
1138  *      Locking: caller must hold tty_mutex
1139  */
1140
1141 static struct tty_driver *get_tty_driver(dev_t device, int *index)
1142 {
1143         struct tty_driver *p;
1144
1145         list_for_each_entry(p, &tty_drivers, tty_drivers) {
1146                 dev_t base = MKDEV(p->major, p->minor_start);
1147                 if (device < base || device >= base + p->num)
1148                         continue;
1149                 *index = device - base;
1150                 return p;
1151         }
1152         return NULL;
1153 }
1154
1155 /**
1156  *      tty_check_change        -       check for POSIX terminal changes
1157  *      @tty: tty to check
1158  *
1159  *      If we try to write to, or set the state of, a terminal and we're
1160  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
1161  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
1162  *
1163  *      Locking: none
1164  */
1165
1166 int tty_check_change(struct tty_struct * tty)
1167 {
1168         if (current->signal->tty != tty)
1169                 return 0;
1170         if (!tty->pgrp) {
1171                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
1172                 return 0;
1173         }
1174         if (task_pgrp(current) == tty->pgrp)
1175                 return 0;
1176         if (is_ignored(SIGTTOU))
1177                 return 0;
1178         if (is_current_pgrp_orphaned())
1179                 return -EIO;
1180         kill_pgrp(task_pgrp(current), SIGTTOU, 1);
1181         set_thread_flag(TIF_SIGPENDING);
1182         return -ERESTARTSYS;
1183 }
1184
1185 EXPORT_SYMBOL(tty_check_change);
1186
1187 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
1188                                 size_t count, loff_t *ppos)
1189 {
1190         return 0;
1191 }
1192
1193 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
1194                                  size_t count, loff_t *ppos)
1195 {
1196         return -EIO;
1197 }
1198
1199 /* No kernel lock held - none needed ;) */
1200 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
1201 {
1202         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
1203 }
1204
1205 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
1206                              unsigned int cmd, unsigned long arg)
1207 {
1208         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
1209 }
1210
1211 static long hung_up_tty_compat_ioctl(struct file * file,
1212                                      unsigned int cmd, unsigned long arg)
1213 {
1214         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
1215 }
1216
1217 static const struct file_operations tty_fops = {
1218         .llseek         = no_llseek,
1219         .read           = tty_read,
1220         .write          = tty_write,
1221         .poll           = tty_poll,
1222         .ioctl          = tty_ioctl,
1223         .compat_ioctl   = tty_compat_ioctl,
1224         .open           = tty_open,
1225         .release        = tty_release,
1226         .fasync         = tty_fasync,
1227 };
1228
1229 #ifdef CONFIG_UNIX98_PTYS
1230 static const struct file_operations ptmx_fops = {
1231         .llseek         = no_llseek,
1232         .read           = tty_read,
1233         .write          = tty_write,
1234         .poll           = tty_poll,
1235         .ioctl          = tty_ioctl,
1236         .compat_ioctl   = tty_compat_ioctl,
1237         .open           = ptmx_open,
1238         .release        = tty_release,
1239         .fasync         = tty_fasync,
1240 };
1241 #endif
1242
1243 static const struct file_operations console_fops = {
1244         .llseek         = no_llseek,
1245         .read           = tty_read,
1246         .write          = redirected_tty_write,
1247         .poll           = tty_poll,
1248         .ioctl          = tty_ioctl,
1249         .compat_ioctl   = tty_compat_ioctl,
1250         .open           = tty_open,
1251         .release        = tty_release,
1252         .fasync         = tty_fasync,
1253 };
1254
1255 static const struct file_operations hung_up_tty_fops = {
1256         .llseek         = no_llseek,
1257         .read           = hung_up_tty_read,
1258         .write          = hung_up_tty_write,
1259         .poll           = hung_up_tty_poll,
1260         .ioctl          = hung_up_tty_ioctl,
1261         .compat_ioctl   = hung_up_tty_compat_ioctl,
1262         .release        = tty_release,
1263 };
1264
1265 static DEFINE_SPINLOCK(redirect_lock);
1266 static struct file *redirect;
1267
1268 /**
1269  *      tty_wakeup      -       request more data
1270  *      @tty: terminal
1271  *
1272  *      Internal and external helper for wakeups of tty. This function
1273  *      informs the line discipline if present that the driver is ready
1274  *      to receive more output data.
1275  */
1276  
1277 void tty_wakeup(struct tty_struct *tty)
1278 {
1279         struct tty_ldisc *ld;
1280         
1281         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
1282                 ld = tty_ldisc_ref(tty);
1283                 if(ld) {
1284                         if(ld->write_wakeup)
1285                                 ld->write_wakeup(tty);
1286                         tty_ldisc_deref(ld);
1287                 }
1288         }
1289         wake_up_interruptible(&tty->write_wait);
1290 }
1291
1292 EXPORT_SYMBOL_GPL(tty_wakeup);
1293
1294 /**
1295  *      tty_ldisc_flush -       flush line discipline queue
1296  *      @tty: tty
1297  *
1298  *      Flush the line discipline queue (if any) for this tty. If there
1299  *      is no line discipline active this is a no-op.
1300  */
1301  
1302 void tty_ldisc_flush(struct tty_struct *tty)
1303 {
1304         struct tty_ldisc *ld = tty_ldisc_ref(tty);
1305         if(ld) {
1306                 if(ld->flush_buffer)
1307                         ld->flush_buffer(tty);
1308                 tty_ldisc_deref(ld);
1309         }
1310         tty_buffer_flush(tty);
1311 }
1312
1313 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
1314
1315 /**
1316  *      tty_reset_termios       -       reset terminal state
1317  *      @tty: tty to reset
1318  *
1319  *      Restore a terminal to the driver default state
1320  */
1321
1322 static void tty_reset_termios(struct tty_struct *tty)
1323 {
1324         mutex_lock(&tty->termios_mutex);
1325         *tty->termios = tty->driver->init_termios;
1326         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1327         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1328         mutex_unlock(&tty->termios_mutex);
1329 }
1330         
1331 /**
1332  *      do_tty_hangup           -       actual handler for hangup events
1333  *      @work: tty device
1334  *
1335  *      This can be called by the "eventd" kernel thread.  That is process
1336  *      synchronous but doesn't hold any locks, so we need to make sure we
1337  *      have the appropriate locks for what we're doing.
1338  *
1339  *      The hangup event clears any pending redirections onto the hung up
1340  *      device. It ensures future writes will error and it does the needed
1341  *      line discipline hangup and signal delivery. The tty object itself
1342  *      remains intact.
1343  *
1344  *      Locking:
1345  *              BKL
1346  *                redirect lock for undoing redirection
1347  *                file list lock for manipulating list of ttys
1348  *                tty_ldisc_lock from called functions
1349  *                termios_mutex resetting termios data
1350  *                tasklist_lock to walk task list for hangup event
1351  *                  ->siglock to protect ->signal/->sighand
1352  */
1353 static void do_tty_hangup(struct work_struct *work)
1354 {
1355         struct tty_struct *tty =
1356                 container_of(work, struct tty_struct, hangup_work);
1357         struct file * cons_filp = NULL;
1358         struct file *filp, *f = NULL;
1359         struct task_struct *p;
1360         struct tty_ldisc *ld;
1361         int    closecount = 0, n;
1362
1363         if (!tty)
1364                 return;
1365
1366         /* inuse_filps is protected by the single kernel lock */
1367         lock_kernel();
1368
1369         spin_lock(&redirect_lock);
1370         if (redirect && redirect->private_data == tty) {
1371                 f = redirect;
1372                 redirect = NULL;
1373         }
1374         spin_unlock(&redirect_lock);
1375         
1376         check_tty_count(tty, "do_tty_hangup");
1377         file_list_lock();
1378         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1379         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1380                 if (filp->f_op->write == redirected_tty_write)
1381                         cons_filp = filp;
1382                 if (filp->f_op->write != tty_write)
1383                         continue;
1384                 closecount++;
1385                 tty_fasync(-1, filp, 0);        /* can't block */
1386                 filp->f_op = &hung_up_tty_fops;
1387         }
1388         file_list_unlock();
1389         
1390         /* FIXME! What are the locking issues here? This may me overdoing things..
1391          * this question is especially important now that we've removed the irqlock. */
1392
1393         ld = tty_ldisc_ref(tty);
1394         if(ld != NULL)  /* We may have no line discipline at this point */
1395         {
1396                 if (ld->flush_buffer)
1397                         ld->flush_buffer(tty);
1398                 if (tty->driver->flush_buffer)
1399                         tty->driver->flush_buffer(tty);
1400                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1401                     ld->write_wakeup)
1402                         ld->write_wakeup(tty);
1403                 if (ld->hangup)
1404                         ld->hangup(tty);
1405         }
1406
1407         /* FIXME: Once we trust the LDISC code better we can wait here for
1408            ldisc completion and fix the driver call race */
1409            
1410         wake_up_interruptible(&tty->write_wait);
1411         wake_up_interruptible(&tty->read_wait);
1412
1413         /*
1414          * Shutdown the current line discipline, and reset it to
1415          * N_TTY.
1416          */
1417         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1418                 tty_reset_termios(tty);
1419         
1420         /* Defer ldisc switch */
1421         /* tty_deferred_ldisc_switch(N_TTY);
1422         
1423           This should get done automatically when the port closes and
1424           tty_release is called */
1425         
1426         read_lock(&tasklist_lock);
1427         if (tty->session) {
1428                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
1429                         spin_lock_irq(&p->sighand->siglock);
1430                         if (p->signal->tty == tty)
1431                                 p->signal->tty = NULL;
1432                         if (!p->signal->leader) {
1433                                 spin_unlock_irq(&p->sighand->siglock);
1434                                 continue;
1435                         }
1436                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1437                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1438                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
1439                         if (tty->pgrp)
1440                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
1441                         spin_unlock_irq(&p->sighand->siglock);
1442                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
1443         }
1444         read_unlock(&tasklist_lock);
1445
1446         tty->flags = 0;
1447         put_pid(tty->session);
1448         put_pid(tty->pgrp);
1449         tty->session = NULL;
1450         tty->pgrp = NULL;
1451         tty->ctrl_status = 0;
1452         /*
1453          *      If one of the devices matches a console pointer, we
1454          *      cannot just call hangup() because that will cause
1455          *      tty->count and state->count to go out of sync.
1456          *      So we just call close() the right number of times.
1457          */
1458         if (cons_filp) {
1459                 if (tty->driver->close)
1460                         for (n = 0; n < closecount; n++)
1461                                 tty->driver->close(tty, cons_filp);
1462         } else if (tty->driver->hangup)
1463                 (tty->driver->hangup)(tty);
1464                 
1465         /* We don't want to have driver/ldisc interactions beyond
1466            the ones we did here. The driver layer expects no
1467            calls after ->hangup() from the ldisc side. However we
1468            can't yet guarantee all that */
1469
1470         set_bit(TTY_HUPPED, &tty->flags);
1471         if (ld) {
1472                 tty_ldisc_enable(tty);
1473                 tty_ldisc_deref(ld);
1474         }
1475         unlock_kernel();
1476         if (f)
1477                 fput(f);
1478 }
1479
1480 /**
1481  *      tty_hangup              -       trigger a hangup event
1482  *      @tty: tty to hangup
1483  *
1484  *      A carrier loss (virtual or otherwise) has occurred on this like
1485  *      schedule a hangup sequence to run after this event.
1486  */
1487
1488 void tty_hangup(struct tty_struct * tty)
1489 {
1490 #ifdef TTY_DEBUG_HANGUP
1491         char    buf[64];
1492         
1493         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1494 #endif
1495         schedule_work(&tty->hangup_work);
1496 }
1497
1498 EXPORT_SYMBOL(tty_hangup);
1499
1500 /**
1501  *      tty_vhangup             -       process vhangup
1502  *      @tty: tty to hangup
1503  *
1504  *      The user has asked via system call for the terminal to be hung up.
1505  *      We do this synchronously so that when the syscall returns the process
1506  *      is complete. That guarantee is neccessary for security reasons.
1507  */
1508
1509 void tty_vhangup(struct tty_struct * tty)
1510 {
1511 #ifdef TTY_DEBUG_HANGUP
1512         char    buf[64];
1513
1514         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1515 #endif
1516         do_tty_hangup(&tty->hangup_work);
1517 }
1518 EXPORT_SYMBOL(tty_vhangup);
1519
1520 /**
1521  *      tty_hung_up_p           -       was tty hung up
1522  *      @filp: file pointer of tty
1523  *
1524  *      Return true if the tty has been subject to a vhangup or a carrier
1525  *      loss
1526  */
1527
1528 int tty_hung_up_p(struct file * filp)
1529 {
1530         return (filp->f_op == &hung_up_tty_fops);
1531 }
1532
1533 EXPORT_SYMBOL(tty_hung_up_p);
1534
1535 /**
1536  * is_tty       -       checker whether file is a TTY
1537  */
1538 int is_tty(struct file *filp)
1539 {
1540         return filp->f_op->read == tty_read
1541                 || filp->f_op->read == hung_up_tty_read;
1542 }
1543
1544 static void session_clear_tty(struct pid *session)
1545 {
1546         struct task_struct *p;
1547         do_each_pid_task(session, PIDTYPE_SID, p) {
1548                 proc_clear_tty(p);
1549         } while_each_pid_task(session, PIDTYPE_SID, p);
1550 }
1551
1552 /**
1553  *      disassociate_ctty       -       disconnect controlling tty
1554  *      @on_exit: true if exiting so need to "hang up" the session
1555  *
1556  *      This function is typically called only by the session leader, when
1557  *      it wants to disassociate itself from its controlling tty.
1558  *
1559  *      It performs the following functions:
1560  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1561  *      (2)  Clears the tty from being controlling the session
1562  *      (3)  Clears the controlling tty for all processes in the
1563  *              session group.
1564  *
1565  *      The argument on_exit is set to 1 if called when a process is
1566  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
1567  *
1568  *      Locking:
1569  *              BKL is taken for hysterical raisins
1570  *                tty_mutex is taken to protect tty
1571  *                ->siglock is taken to protect ->signal/->sighand
1572  *                tasklist_lock is taken to walk process list for sessions
1573  *                  ->siglock is taken to protect ->signal/->sighand
1574  */
1575
1576 void disassociate_ctty(int on_exit)
1577 {
1578         struct tty_struct *tty;
1579         struct pid *tty_pgrp = NULL;
1580
1581         lock_kernel();
1582
1583         mutex_lock(&tty_mutex);
1584         tty = get_current_tty();
1585         if (tty) {
1586                 tty_pgrp = get_pid(tty->pgrp);
1587                 mutex_unlock(&tty_mutex);
1588                 /* XXX: here we race, there is nothing protecting tty */
1589                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1590                         tty_vhangup(tty);
1591         } else if (on_exit) {
1592                 struct pid *old_pgrp;
1593                 spin_lock_irq(&current->sighand->siglock);
1594                 old_pgrp = current->signal->tty_old_pgrp;
1595                 current->signal->tty_old_pgrp = NULL;
1596                 spin_unlock_irq(&current->sighand->siglock);
1597                 if (old_pgrp) {
1598                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
1599                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
1600                         put_pid(old_pgrp);
1601                 }
1602                 mutex_unlock(&tty_mutex);
1603                 unlock_kernel();        
1604                 return;
1605         }
1606         if (tty_pgrp) {
1607                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
1608                 if (!on_exit)
1609                         kill_pgrp(tty_pgrp, SIGCONT, on_exit);
1610                 put_pid(tty_pgrp);
1611         }
1612
1613         spin_lock_irq(&current->sighand->siglock);
1614         put_pid(current->signal->tty_old_pgrp);
1615         current->signal->tty_old_pgrp = NULL;
1616         spin_unlock_irq(&current->sighand->siglock);
1617
1618         mutex_lock(&tty_mutex);
1619         /* It is possible that do_tty_hangup has free'd this tty */
1620         tty = get_current_tty();
1621         if (tty) {
1622                 put_pid(tty->session);
1623                 put_pid(tty->pgrp);
1624                 tty->session = NULL;
1625                 tty->pgrp = NULL;
1626         } else {
1627 #ifdef TTY_DEBUG_HANGUP
1628                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
1629                        " = NULL", tty);
1630 #endif
1631         }
1632         mutex_unlock(&tty_mutex);
1633
1634         /* Now clear signal->tty under the lock */
1635         read_lock(&tasklist_lock);
1636         session_clear_tty(task_session(current));
1637         read_unlock(&tasklist_lock);
1638         unlock_kernel();
1639 }
1640
1641 /**
1642  *
1643  *      no_tty  - Ensure the current process does not have a controlling tty
1644  */
1645 void no_tty(void)
1646 {
1647         struct task_struct *tsk = current;
1648         if (tsk->signal->leader)
1649                 disassociate_ctty(0);
1650         proc_clear_tty(tsk);
1651 }
1652
1653
1654 /**
1655  *      stop_tty        -       propagate flow control
1656  *      @tty: tty to stop
1657  *
1658  *      Perform flow control to the driver. For PTY/TTY pairs we
1659  *      must also propagate the TIOCKPKT status. May be called
1660  *      on an already stopped device and will not re-call the driver
1661  *      method.
1662  *
1663  *      This functionality is used by both the line disciplines for
1664  *      halting incoming flow and by the driver. It may therefore be
1665  *      called from any context, may be under the tty atomic_write_lock
1666  *      but not always.
1667  *
1668  *      Locking:
1669  *              Broken. Relies on BKL which is unsafe here.
1670  */
1671
1672 void stop_tty(struct tty_struct *tty)
1673 {
1674         if (tty->stopped)
1675                 return;
1676         tty->stopped = 1;
1677         if (tty->link && tty->link->packet) {
1678                 tty->ctrl_status &= ~TIOCPKT_START;
1679                 tty->ctrl_status |= TIOCPKT_STOP;
1680                 wake_up_interruptible(&tty->link->read_wait);
1681         }
1682         if (tty->driver->stop)
1683                 (tty->driver->stop)(tty);
1684 }
1685
1686 EXPORT_SYMBOL(stop_tty);
1687
1688 /**
1689  *      start_tty       -       propagate flow control
1690  *      @tty: tty to start
1691  *
1692  *      Start a tty that has been stopped if at all possible. Perform
1693  *      any neccessary wakeups and propagate the TIOCPKT status. If this
1694  *      is the tty was previous stopped and is being started then the
1695  *      driver start method is invoked and the line discipline woken.
1696  *
1697  *      Locking:
1698  *              Broken. Relies on BKL which is unsafe here.
1699  */
1700
1701 void start_tty(struct tty_struct *tty)
1702 {
1703         if (!tty->stopped || tty->flow_stopped)
1704                 return;
1705         tty->stopped = 0;
1706         if (tty->link && tty->link->packet) {
1707                 tty->ctrl_status &= ~TIOCPKT_STOP;
1708                 tty->ctrl_status |= TIOCPKT_START;
1709                 wake_up_interruptible(&tty->link->read_wait);
1710         }
1711         if (tty->driver->start)
1712                 (tty->driver->start)(tty);
1713
1714         /* If we have a running line discipline it may need kicking */
1715         tty_wakeup(tty);
1716 }
1717
1718 EXPORT_SYMBOL(start_tty);
1719
1720 /**
1721  *      tty_read        -       read method for tty device files
1722  *      @file: pointer to tty file
1723  *      @buf: user buffer
1724  *      @count: size of user buffer
1725  *      @ppos: unused
1726  *
1727  *      Perform the read system call function on this terminal device. Checks
1728  *      for hung up devices before calling the line discipline method.
1729  *
1730  *      Locking:
1731  *              Locks the line discipline internally while needed
1732  *              For historical reasons the line discipline read method is
1733  *      invoked under the BKL. This will go away in time so do not rely on it
1734  *      in new code. Multiple read calls may be outstanding in parallel.
1735  */
1736
1737 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1738                         loff_t *ppos)
1739 {
1740         int i;
1741         struct tty_struct * tty;
1742         struct inode *inode;
1743         struct tty_ldisc *ld;
1744
1745         tty = (struct tty_struct *)file->private_data;
1746         inode = file->f_path.dentry->d_inode;
1747         if (tty_paranoia_check(tty, inode, "tty_read"))
1748                 return -EIO;
1749         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1750                 return -EIO;
1751
1752         /* We want to wait for the line discipline to sort out in this
1753            situation */
1754         ld = tty_ldisc_ref_wait(tty);
1755         lock_kernel();
1756         if (ld->read)
1757                 i = (ld->read)(tty,file,buf,count);
1758         else
1759                 i = -EIO;
1760         tty_ldisc_deref(ld);
1761         unlock_kernel();
1762         if (i > 0)
1763                 inode->i_atime = current_fs_time(inode->i_sb);
1764         return i;
1765 }
1766
1767 void tty_write_unlock(struct tty_struct *tty)
1768 {
1769         mutex_unlock(&tty->atomic_write_lock);
1770         wake_up_interruptible(&tty->write_wait);
1771 }
1772
1773 int tty_write_lock(struct tty_struct *tty, int ndelay)
1774 {
1775         if (!mutex_trylock(&tty->atomic_write_lock)) {
1776                 if (ndelay)
1777                         return -EAGAIN;
1778                 if (mutex_lock_interruptible(&tty->atomic_write_lock))
1779                         return -ERESTARTSYS;
1780         }
1781         return 0;
1782 }
1783
1784 /*
1785  * Split writes up in sane blocksizes to avoid
1786  * denial-of-service type attacks
1787  */
1788 static inline ssize_t do_tty_write(
1789         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1790         struct tty_struct *tty,
1791         struct file *file,
1792         const char __user *buf,
1793         size_t count)
1794 {
1795         ssize_t ret, written = 0;
1796         unsigned int chunk;
1797         
1798         ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
1799         if (ret < 0)
1800                 return ret;
1801
1802         /*
1803          * We chunk up writes into a temporary buffer. This
1804          * simplifies low-level drivers immensely, since they
1805          * don't have locking issues and user mode accesses.
1806          *
1807          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1808          * big chunk-size..
1809          *
1810          * The default chunk-size is 2kB, because the NTTY
1811          * layer has problems with bigger chunks. It will
1812          * claim to be able to handle more characters than
1813          * it actually does.
1814          *
1815          * FIXME: This can probably go away now except that 64K chunks
1816          * are too likely to fail unless switched to vmalloc...
1817          */
1818         chunk = 2048;
1819         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1820                 chunk = 65536;
1821         if (count < chunk)
1822                 chunk = count;
1823
1824         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1825         if (tty->write_cnt < chunk) {
1826                 unsigned char *buf;
1827
1828                 if (chunk < 1024)
1829                         chunk = 1024;
1830
1831                 buf = kmalloc(chunk, GFP_KERNEL);
1832                 if (!buf) {
1833                         ret = -ENOMEM;
1834                         goto out;
1835                 }
1836                 kfree(tty->write_buf);
1837                 tty->write_cnt = chunk;
1838                 tty->write_buf = buf;
1839         }
1840
1841         /* Do the write .. */
1842         for (;;) {
1843                 size_t size = count;
1844                 if (size > chunk)
1845                         size = chunk;
1846                 ret = -EFAULT;
1847                 if (copy_from_user(tty->write_buf, buf, size))
1848                         break;
1849                 lock_kernel();
1850                 ret = write(tty, file, tty->write_buf, size);
1851                 unlock_kernel();
1852                 if (ret <= 0)
1853                         break;
1854                 written += ret;
1855                 buf += ret;
1856                 count -= ret;
1857                 if (!count)
1858                         break;
1859                 ret = -ERESTARTSYS;
1860                 if (signal_pending(current))
1861                         break;
1862                 cond_resched();
1863         }
1864         if (written) {
1865                 struct inode *inode = file->f_path.dentry->d_inode;
1866                 inode->i_mtime = current_fs_time(inode->i_sb);
1867                 ret = written;
1868         }
1869 out:
1870         tty_write_unlock(tty);
1871         return ret;
1872 }
1873
1874
1875 /**
1876  *      tty_write               -       write method for tty device file
1877  *      @file: tty file pointer
1878  *      @buf: user data to write
1879  *      @count: bytes to write
1880  *      @ppos: unused
1881  *
1882  *      Write data to a tty device via the line discipline.
1883  *
1884  *      Locking:
1885  *              Locks the line discipline as required
1886  *              Writes to the tty driver are serialized by the atomic_write_lock
1887  *      and are then processed in chunks to the device. The line discipline
1888  *      write method will not be involked in parallel for each device
1889  *              The line discipline write method is called under the big
1890  *      kernel lock for historical reasons. New code should not rely on this.
1891  */
1892
1893 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1894                          loff_t *ppos)
1895 {
1896         struct tty_struct * tty;
1897         struct inode *inode = file->f_path.dentry->d_inode;
1898         ssize_t ret;
1899         struct tty_ldisc *ld;
1900         
1901         tty = (struct tty_struct *)file->private_data;
1902         if (tty_paranoia_check(tty, inode, "tty_write"))
1903                 return -EIO;
1904         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1905                 return -EIO;
1906
1907         ld = tty_ldisc_ref_wait(tty);           
1908         if (!ld->write)
1909                 ret = -EIO;
1910         else
1911                 ret = do_tty_write(ld->write, tty, file, buf, count);
1912         tty_ldisc_deref(ld);
1913         return ret;
1914 }
1915
1916 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1917                          loff_t *ppos)
1918 {
1919         struct file *p = NULL;
1920
1921         spin_lock(&redirect_lock);
1922         if (redirect) {
1923                 get_file(redirect);
1924                 p = redirect;
1925         }
1926         spin_unlock(&redirect_lock);
1927
1928         if (p) {
1929                 ssize_t res;
1930                 res = vfs_write(p, buf, count, &p->f_pos);
1931                 fput(p);
1932                 return res;
1933         }
1934
1935         return tty_write(file, buf, count, ppos);
1936 }
1937
1938 static char ptychar[] = "pqrstuvwxyzabcde";
1939
1940 /**
1941  *      pty_line_name   -       generate name for a pty
1942  *      @driver: the tty driver in use
1943  *      @index: the minor number
1944  *      @p: output buffer of at least 6 bytes
1945  *
1946  *      Generate a name from a driver reference and write it to the output
1947  *      buffer.
1948  *
1949  *      Locking: None
1950  */
1951 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1952 {
1953         int i = index + driver->name_base;
1954         /* ->name is initialized to "ttyp", but "tty" is expected */
1955         sprintf(p, "%s%c%x",
1956                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1957                         ptychar[i >> 4 & 0xf], i & 0xf);
1958 }
1959
1960 /**
1961  *      pty_line_name   -       generate name for a tty
1962  *      @driver: the tty driver in use
1963  *      @index: the minor number
1964  *      @p: output buffer of at least 7 bytes
1965  *
1966  *      Generate a name from a driver reference and write it to the output
1967  *      buffer.
1968  *
1969  *      Locking: None
1970  */
1971 static void tty_line_name(struct tty_driver *driver, int index, char *p)
1972 {
1973         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1974 }
1975
1976 /**
1977  *      init_dev                -       initialise a tty device
1978  *      @driver: tty driver we are opening a device on
1979  *      @idx: device index
1980  *      @tty: returned tty structure
1981  *
1982  *      Prepare a tty device. This may not be a "new" clean device but
1983  *      could also be an active device. The pty drivers require special
1984  *      handling because of this.
1985  *
1986  *      Locking:
1987  *              The function is called under the tty_mutex, which
1988  *      protects us from the tty struct or driver itself going away.
1989  *
1990  *      On exit the tty device has the line discipline attached and
1991  *      a reference count of 1. If a pair was created for pty/tty use
1992  *      and the other was a pty master then it too has a reference count of 1.
1993  *
1994  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1995  * failed open.  The new code protects the open with a mutex, so it's
1996  * really quite straightforward.  The mutex locking can probably be
1997  * relaxed for the (most common) case of reopening a tty.
1998  */
1999
2000 static int init_dev(struct tty_driver *driver, int idx,
2001         struct tty_struct **ret_tty)
2002 {
2003         struct tty_struct *tty, *o_tty;
2004         struct ktermios *tp, **tp_loc, *o_tp, **o_tp_loc;
2005         struct ktermios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
2006         int retval = 0;
2007
2008         /* check whether we're reopening an existing tty */
2009         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
2010                 tty = devpts_get_tty(idx);
2011                 /*
2012                  * If we don't have a tty here on a slave open, it's because
2013                  * the master already started the close process and there's
2014                  * no relation between devpts file and tty anymore.
2015                  */
2016                 if (!tty && driver->subtype == PTY_TYPE_SLAVE) {
2017                         retval = -EIO;
2018                         goto end_init;
2019                 }
2020                 /*
2021                  * It's safe from now on because init_dev() is called with
2022                  * tty_mutex held and release_dev() won't change tty->count
2023                  * or tty->flags without having to grab tty_mutex
2024                  */
2025                 if (tty && driver->subtype == PTY_TYPE_MASTER)
2026                         tty = tty->link;
2027         } else {
2028                 tty = driver->ttys[idx];
2029         }
2030         if (tty) goto fast_track;
2031
2032         /*
2033          * First time open is complex, especially for PTY devices.
2034          * This code guarantees that either everything succeeds and the
2035          * TTY is ready for operation, or else the table slots are vacated
2036          * and the allocated memory released.  (Except that the termios 
2037          * and locked termios may be retained.)
2038          */
2039
2040         if (!try_module_get(driver->owner)) {
2041                 retval = -ENODEV;
2042                 goto end_init;
2043         }
2044
2045         o_tty = NULL;
2046         tp = o_tp = NULL;
2047         ltp = o_ltp = NULL;
2048
2049         tty = alloc_tty_struct();
2050         if(!tty)
2051                 goto fail_no_mem;
2052         initialize_tty_struct(tty);
2053         tty->driver = driver;
2054         tty->index = idx;
2055         tty_line_name(driver, idx, tty->name);
2056
2057         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
2058                 tp_loc = &tty->termios;
2059                 ltp_loc = &tty->termios_locked;
2060         } else {
2061                 tp_loc = &driver->termios[idx];
2062                 ltp_loc = &driver->termios_locked[idx];
2063         }
2064
2065         if (!*tp_loc) {
2066                 tp = (struct ktermios *) kmalloc(sizeof(struct ktermios),
2067                                                 GFP_KERNEL);
2068                 if (!tp)
2069                         goto free_mem_out;
2070                 *tp = driver->init_termios;
2071         }
2072
2073         if (!*ltp_loc) {
2074                 ltp = kzalloc(sizeof(struct ktermios), GFP_KERNEL);
2075                 if (!ltp)
2076                         goto free_mem_out;
2077         }
2078
2079         if (driver->type == TTY_DRIVER_TYPE_PTY) {
2080                 o_tty = alloc_tty_struct();
2081                 if (!o_tty)
2082                         goto free_mem_out;
2083                 initialize_tty_struct(o_tty);
2084                 o_tty->driver = driver->other;
2085                 o_tty->index = idx;
2086                 tty_line_name(driver->other, idx, o_tty->name);
2087
2088                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
2089                         o_tp_loc = &o_tty->termios;
2090                         o_ltp_loc = &o_tty->termios_locked;
2091                 } else {
2092                         o_tp_loc = &driver->other->termios[idx];
2093                         o_ltp_loc = &driver->other->termios_locked[idx];
2094                 }
2095
2096                 if (!*o_tp_loc) {
2097                         o_tp = (struct ktermios *)
2098                                 kmalloc(sizeof(struct ktermios), GFP_KERNEL);
2099                         if (!o_tp)
2100                                 goto free_mem_out;
2101                         *o_tp = driver->other->init_termios;
2102                 }
2103
2104                 if (!*o_ltp_loc) {
2105                         o_ltp = kzalloc(sizeof(struct ktermios), GFP_KERNEL);
2106                         if (!o_ltp)
2107                                 goto free_mem_out;
2108                 }
2109
2110                 /*
2111                  * Everything allocated ... set up the o_tty structure.
2112                  */
2113                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
2114                         driver->other->ttys[idx] = o_tty;
2115                 }
2116                 if (!*o_tp_loc)
2117                         *o_tp_loc = o_tp;
2118                 if (!*o_ltp_loc)
2119                         *o_ltp_loc = o_ltp;
2120                 o_tty->termios = *o_tp_loc;
2121                 o_tty->termios_locked = *o_ltp_loc;
2122                 driver->other->refcount++;
2123                 if (driver->subtype == PTY_TYPE_MASTER)
2124                         o_tty->count++;
2125
2126                 /* Establish the links in both directions */
2127                 tty->link   = o_tty;
2128                 o_tty->link = tty;
2129         }
2130
2131         /* 
2132          * All structures have been allocated, so now we install them.
2133          * Failures after this point use release_tty to clean up, so
2134          * there's no need to null out the local pointers.
2135          */
2136         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2137                 driver->ttys[idx] = tty;
2138         }
2139         
2140         if (!*tp_loc)
2141                 *tp_loc = tp;
2142         if (!*ltp_loc)
2143                 *ltp_loc = ltp;
2144         tty->termios = *tp_loc;
2145         tty->termios_locked = *ltp_loc;
2146         /* Compatibility until drivers always set this */
2147         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
2148         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
2149         driver->refcount++;
2150         tty->count++;
2151
2152         /* 
2153          * Structures all installed ... call the ldisc open routines.
2154          * If we fail here just call release_tty to clean up.  No need
2155          * to decrement the use counts, as release_tty doesn't care.
2156          */
2157
2158         if (tty->ldisc.open) {
2159                 retval = (tty->ldisc.open)(tty);
2160                 if (retval)
2161                         goto release_mem_out;
2162         }
2163         if (o_tty && o_tty->ldisc.open) {
2164                 retval = (o_tty->ldisc.open)(o_tty);
2165                 if (retval) {
2166                         if (tty->ldisc.close)
2167                                 (tty->ldisc.close)(tty);
2168                         goto release_mem_out;
2169                 }
2170                 tty_ldisc_enable(o_tty);
2171         }
2172         tty_ldisc_enable(tty);
2173         goto success;
2174
2175         /*
2176          * This fast open can be used if the tty is already open.
2177          * No memory is allocated, and the only failures are from
2178          * attempting to open a closing tty or attempting multiple
2179          * opens on a pty master.
2180          */
2181 fast_track:
2182         if (test_bit(TTY_CLOSING, &tty->flags)) {
2183                 retval = -EIO;
2184                 goto end_init;
2185         }
2186         if (driver->type == TTY_DRIVER_TYPE_PTY &&
2187             driver->subtype == PTY_TYPE_MASTER) {
2188                 /*
2189                  * special case for PTY masters: only one open permitted, 
2190                  * and the slave side open count is incremented as well.
2191                  */
2192                 if (tty->count) {
2193                         retval = -EIO;
2194                         goto end_init;
2195                 }
2196                 tty->link->count++;
2197         }
2198         tty->count++;
2199         tty->driver = driver; /* N.B. why do this every time?? */
2200
2201         /* FIXME */
2202         if(!test_bit(TTY_LDISC, &tty->flags))
2203                 printk(KERN_ERR "init_dev but no ldisc\n");
2204 success:
2205         *ret_tty = tty;
2206         
2207         /* All paths come through here to release the mutex */
2208 end_init:
2209         return retval;
2210
2211         /* Release locally allocated memory ... nothing placed in slots */
2212 free_mem_out:
2213         kfree(o_tp);
2214         if (o_tty)
2215                 free_tty_struct(o_tty);
2216         kfree(ltp);
2217         kfree(tp);
2218         free_tty_struct(tty);
2219
2220 fail_no_mem:
2221         module_put(driver->owner);
2222         retval = -ENOMEM;
2223         goto end_init;
2224
2225         /* call the tty release_tty routine to clean out this slot */
2226 release_mem_out:
2227         if (printk_ratelimit())
2228                 printk(KERN_INFO "init_dev: ldisc open failed, "
2229                                  "clearing slot %d\n", idx);
2230         release_tty(tty, idx);
2231         goto end_init;
2232 }
2233
2234 /**
2235  *      release_one_tty         -       release tty structure memory
2236  *
2237  *      Releases memory associated with a tty structure, and clears out the
2238  *      driver table slots. This function is called when a device is no longer
2239  *      in use. It also gets called when setup of a device fails.
2240  *
2241  *      Locking:
2242  *              tty_mutex - sometimes only
2243  *              takes the file list lock internally when working on the list
2244  *      of ttys that the driver keeps.
2245  *              FIXME: should we require tty_mutex is held here ??
2246  */
2247 static void release_one_tty(struct tty_struct *tty, int idx)
2248 {
2249         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
2250         struct ktermios *tp;
2251
2252         if (!devpts)
2253                 tty->driver->ttys[idx] = NULL;
2254
2255         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
2256                 tp = tty->termios;
2257                 if (!devpts)
2258                         tty->driver->termios[idx] = NULL;
2259                 kfree(tp);
2260
2261                 tp = tty->termios_locked;
2262                 if (!devpts)
2263                         tty->driver->termios_locked[idx] = NULL;
2264                 kfree(tp);
2265         }
2266
2267
2268         tty->magic = 0;
2269         tty->driver->refcount--;
2270
2271         file_list_lock();
2272         list_del_init(&tty->tty_files);
2273         file_list_unlock();
2274
2275         free_tty_struct(tty);
2276 }
2277
2278 /**
2279  *      release_tty             -       release tty structure memory
2280  *
2281  *      Release both @tty and a possible linked partner (think pty pair),
2282  *      and decrement the refcount of the backing module.
2283  *
2284  *      Locking:
2285  *              tty_mutex - sometimes only
2286  *              takes the file list lock internally when working on the list
2287  *      of ttys that the driver keeps.
2288  *              FIXME: should we require tty_mutex is held here ??
2289  */
2290 static void release_tty(struct tty_struct *tty, int idx)
2291 {
2292         struct tty_driver *driver = tty->driver;
2293
2294         if (tty->link)
2295                 release_one_tty(tty->link, idx);
2296         release_one_tty(tty, idx);
2297         module_put(driver->owner);
2298 }
2299
2300 /*
2301  * Even releasing the tty structures is a tricky business.. We have
2302  * to be very careful that the structures are all released at the
2303  * same time, as interrupts might otherwise get the wrong pointers.
2304  *
2305  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
2306  * lead to double frees or releasing memory still in use.
2307  */
2308 static void release_dev(struct file * filp)
2309 {
2310         struct tty_struct *tty, *o_tty;
2311         int     pty_master, tty_closing, o_tty_closing, do_sleep;
2312         int     devpts;
2313         int     idx;
2314         char    buf[64];
2315         unsigned long flags;
2316         
2317         tty = (struct tty_struct *)filp->private_data;
2318         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "release_dev"))
2319                 return;
2320
2321         check_tty_count(tty, "release_dev");
2322
2323         tty_fasync(-1, filp, 0);
2324
2325         idx = tty->index;
2326         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2327                       tty->driver->subtype == PTY_TYPE_MASTER);
2328         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
2329         o_tty = tty->link;
2330
2331 #ifdef TTY_PARANOIA_CHECK
2332         if (idx < 0 || idx >= tty->driver->num) {
2333                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
2334                                   "free (%s)\n", tty->name);
2335                 return;
2336         }
2337         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2338                 if (tty != tty->driver->ttys[idx]) {
2339                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
2340                                "for (%s)\n", idx, tty->name);
2341                         return;
2342                 }
2343                 if (tty->termios != tty->driver->termios[idx]) {
2344                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
2345                                "for (%s)\n",
2346                                idx, tty->name);
2347                         return;
2348                 }
2349                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
2350                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
2351                                "termios_locked for (%s)\n",
2352                                idx, tty->name);
2353                         return;
2354                 }
2355         }
2356 #endif
2357
2358 #ifdef TTY_DEBUG_HANGUP
2359         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
2360                tty_name(tty, buf), tty->count);
2361 #endif
2362
2363 #ifdef TTY_PARANOIA_CHECK
2364         if (tty->driver->other &&
2365              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2366                 if (o_tty != tty->driver->other->ttys[idx]) {
2367                         printk(KERN_DEBUG "release_dev: other->table[%d] "
2368                                           "not o_tty for (%s)\n",
2369                                idx, tty->name);
2370                         return;
2371                 }
2372                 if (o_tty->termios != tty->driver->other->termios[idx]) {
2373                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
2374                                           "not o_termios for (%s)\n",
2375                                idx, tty->name);
2376                         return;
2377                 }
2378                 if (o_tty->termios_locked != 
2379                       tty->driver->other->termios_locked[idx]) {
2380                         printk(KERN_DEBUG "release_dev: other->termios_locked["
2381                                           "%d] not o_termios_locked for (%s)\n",
2382                                idx, tty->name);
2383                         return;
2384                 }
2385                 if (o_tty->link != tty) {
2386                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
2387                         return;
2388                 }
2389         }
2390 #endif
2391         if (tty->driver->close)
2392                 tty->driver->close(tty, filp);
2393
2394         /*
2395          * Sanity check: if tty->count is going to zero, there shouldn't be
2396          * any waiters on tty->read_wait or tty->write_wait.  We test the
2397          * wait queues and kick everyone out _before_ actually starting to
2398          * close.  This ensures that we won't block while releasing the tty
2399          * structure.
2400          *
2401          * The test for the o_tty closing is necessary, since the master and
2402          * slave sides may close in any order.  If the slave side closes out
2403          * first, its count will be one, since the master side holds an open.
2404          * Thus this test wouldn't be triggered at the time the slave closes,
2405          * so we do it now.
2406          *
2407          * Note that it's possible for the tty to be opened again while we're
2408          * flushing out waiters.  By recalculating the closing flags before
2409          * each iteration we avoid any problems.
2410          */
2411         while (1) {
2412                 /* Guard against races with tty->count changes elsewhere and
2413                    opens on /dev/tty */
2414                    
2415                 mutex_lock(&tty_mutex);
2416                 tty_closing = tty->count <= 1;
2417                 o_tty_closing = o_tty &&
2418                         (o_tty->count <= (pty_master ? 1 : 0));
2419                 do_sleep = 0;
2420
2421                 if (tty_closing) {
2422                         if (waitqueue_active(&tty->read_wait)) {
2423                                 wake_up(&tty->read_wait);
2424                                 do_sleep++;
2425                         }
2426                         if (waitqueue_active(&tty->write_wait)) {
2427                                 wake_up(&tty->write_wait);
2428                                 do_sleep++;
2429                         }
2430                 }
2431                 if (o_tty_closing) {
2432                         if (waitqueue_active(&o_tty->read_wait)) {
2433                                 wake_up(&o_tty->read_wait);
2434                                 do_sleep++;
2435                         }
2436                         if (waitqueue_active(&o_tty->write_wait)) {
2437                                 wake_up(&o_tty->write_wait);
2438                                 do_sleep++;
2439                         }
2440                 }
2441                 if (!do_sleep)
2442                         break;
2443
2444                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
2445                                     "active!\n", tty_name(tty, buf));
2446                 mutex_unlock(&tty_mutex);
2447                 schedule();
2448         }       
2449
2450         /*
2451          * The closing flags are now consistent with the open counts on 
2452          * both sides, and we've completed the last operation that could 
2453          * block, so it's safe to proceed with closing.
2454          */
2455         if (pty_master) {
2456                 if (--o_tty->count < 0) {
2457                         printk(KERN_WARNING "release_dev: bad pty slave count "
2458                                             "(%d) for %s\n",
2459                                o_tty->count, tty_name(o_tty, buf));
2460                         o_tty->count = 0;
2461                 }
2462         }
2463         if (--tty->count < 0) {
2464                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
2465                        tty->count, tty_name(tty, buf));
2466                 tty->count = 0;
2467         }
2468         
2469         /*
2470          * We've decremented tty->count, so we need to remove this file
2471          * descriptor off the tty->tty_files list; this serves two
2472          * purposes:
2473          *  - check_tty_count sees the correct number of file descriptors
2474          *    associated with this tty.
2475          *  - do_tty_hangup no longer sees this file descriptor as
2476          *    something that needs to be handled for hangups.
2477          */
2478         file_kill(filp);
2479         filp->private_data = NULL;
2480
2481         /*
2482          * Perform some housekeeping before deciding whether to return.
2483          *
2484          * Set the TTY_CLOSING flag if this was the last open.  In the
2485          * case of a pty we may have to wait around for the other side
2486          * to close, and TTY_CLOSING makes sure we can't be reopened.
2487          */
2488         if(tty_closing)
2489                 set_bit(TTY_CLOSING, &tty->flags);
2490         if(o_tty_closing)
2491                 set_bit(TTY_CLOSING, &o_tty->flags);
2492
2493         /*
2494          * If _either_ side is closing, make sure there aren't any
2495          * processes that still think tty or o_tty is their controlling
2496          * tty.
2497          */
2498         if (tty_closing || o_tty_closing) {
2499                 read_lock(&tasklist_lock);
2500                 session_clear_tty(tty->session);
2501                 if (o_tty)
2502                         session_clear_tty(o_tty->session);
2503                 read_unlock(&tasklist_lock);
2504         }
2505
2506         mutex_unlock(&tty_mutex);
2507
2508         /* check whether both sides are closing ... */
2509         if (!tty_closing || (o_tty && !o_tty_closing))
2510                 return;
2511         
2512 #ifdef TTY_DEBUG_HANGUP
2513         printk(KERN_DEBUG "freeing tty structure...");
2514 #endif
2515         /*
2516          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
2517          * kill any delayed work. As this is the final close it does not
2518          * race with the set_ldisc code path.
2519          */
2520         clear_bit(TTY_LDISC, &tty->flags);
2521         cancel_delayed_work(&tty->buf.work);
2522
2523         /*
2524          * Wait for ->hangup_work and ->buf.work handlers to terminate
2525          */
2526          
2527         flush_scheduled_work();
2528         
2529         /*
2530          * Wait for any short term users (we know they are just driver
2531          * side waiters as the file is closing so user count on the file
2532          * side is zero.
2533          */
2534         spin_lock_irqsave(&tty_ldisc_lock, flags);
2535         while(tty->ldisc.refcount)
2536         {
2537                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
2538                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
2539                 spin_lock_irqsave(&tty_ldisc_lock, flags);
2540         }
2541         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
2542         /*
2543          * Shutdown the current line discipline, and reset it to N_TTY.
2544          * N.B. why reset ldisc when we're releasing the memory??
2545          *
2546          * FIXME: this MUST get fixed for the new reflocking
2547          */
2548         if (tty->ldisc.close)
2549                 (tty->ldisc.close)(tty);
2550         tty_ldisc_put(tty->ldisc.num);
2551         
2552         /*
2553          *      Switch the line discipline back
2554          */
2555         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2556         tty_set_termios_ldisc(tty,N_TTY); 
2557         if (o_tty) {
2558                 /* FIXME: could o_tty be in setldisc here ? */
2559                 clear_bit(TTY_LDISC, &o_tty->flags);
2560                 if (o_tty->ldisc.close)
2561                         (o_tty->ldisc.close)(o_tty);
2562                 tty_ldisc_put(o_tty->ldisc.num);
2563                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
2564                 tty_set_termios_ldisc(o_tty,N_TTY); 
2565         }
2566         /*
2567          * The release_tty function takes care of the details of clearing
2568          * the slots and preserving the termios structure.
2569          */
2570         release_tty(tty, idx);
2571
2572 #ifdef CONFIG_UNIX98_PTYS
2573         /* Make this pty number available for reallocation */
2574         if (devpts) {
2575                 down(&allocated_ptys_lock);
2576                 idr_remove(&allocated_ptys, idx);
2577                 up(&allocated_ptys_lock);
2578         }
2579 #endif
2580
2581 }
2582
2583 /**
2584  *      tty_open                -       open a tty device
2585  *      @inode: inode of device file
2586  *      @filp: file pointer to tty
2587  *
2588  *      tty_open and tty_release keep up the tty count that contains the
2589  *      number of opens done on a tty. We cannot use the inode-count, as
2590  *      different inodes might point to the same tty.
2591  *
2592  *      Open-counting is needed for pty masters, as well as for keeping
2593  *      track of serial lines: DTR is dropped when the last close happens.
2594  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
2595  *
2596  *      The termios state of a pty is reset on first open so that
2597  *      settings don't persist across reuse.
2598  *
2599  *      Locking: tty_mutex protects tty, get_tty_driver and init_dev work.
2600  *               tty->count should protect the rest.
2601  *               ->siglock protects ->signal/->sighand
2602  */
2603
2604 static int tty_open(struct inode * inode, struct file * filp)
2605 {
2606         struct tty_struct *tty;
2607         int noctty, retval;
2608         struct tty_driver *driver;
2609         int index;
2610         dev_t device = inode->i_rdev;
2611         unsigned short saved_flags = filp->f_flags;
2612
2613         nonseekable_open(inode, filp);
2614         
2615 retry_open:
2616         noctty = filp->f_flags & O_NOCTTY;
2617         index  = -1;
2618         retval = 0;
2619         
2620         mutex_lock(&tty_mutex);
2621
2622         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2623                 tty = get_current_tty();
2624                 if (!tty) {
2625                         mutex_unlock(&tty_mutex);
2626                         return -ENXIO;
2627                 }
2628                 driver = tty->driver;
2629                 index = tty->index;
2630                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2631                 /* noctty = 1; */
2632                 goto got_driver;
2633         }
2634 #ifdef CONFIG_VT
2635         if (device == MKDEV(TTY_MAJOR,0)) {
2636                 extern struct tty_driver *console_driver;
2637                 driver = console_driver;
2638                 index = fg_console;
2639                 noctty = 1;
2640                 goto got_driver;
2641         }
2642 #endif
2643         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2644                 driver = console_device(&index);
2645                 if (driver) {
2646                         /* Don't let /dev/console block */
2647                         filp->f_flags |= O_NONBLOCK;
2648                         noctty = 1;
2649                         goto got_driver;
2650                 }
2651                 mutex_unlock(&tty_mutex);
2652                 return -ENODEV;
2653         }
2654
2655         driver = get_tty_driver(device, &index);
2656         if (!driver) {
2657                 mutex_unlock(&tty_mutex);
2658                 return -ENODEV;
2659         }
2660 got_driver:
2661         retval = init_dev(driver, index, &tty);
2662         mutex_unlock(&tty_mutex);
2663         if (retval)
2664                 return retval;
2665
2666         filp->private_data = tty;
2667         file_move(filp, &tty->tty_files);
2668         check_tty_count(tty, "tty_open");
2669         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2670             tty->driver->subtype == PTY_TYPE_MASTER)
2671                 noctty = 1;
2672 #ifdef TTY_DEBUG_HANGUP
2673         printk(KERN_DEBUG "opening %s...", tty->name);
2674 #endif
2675         if (!retval) {
2676                 if (tty->driver->open)
2677                         retval = tty->driver->open(tty, filp);
2678                 else
2679                         retval = -ENODEV;
2680         }
2681         filp->f_flags = saved_flags;
2682
2683         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2684                 retval = -EBUSY;
2685
2686         if (retval) {
2687 #ifdef TTY_DEBUG_HANGUP
2688                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2689                        tty->name);
2690 #endif
2691                 release_dev(filp);
2692                 if (retval != -ERESTARTSYS)
2693                         return retval;
2694                 if (signal_pending(current))
2695                         return retval;
2696                 schedule();
2697                 /*
2698                  * Need to reset f_op in case a hangup happened.
2699                  */
2700                 if (filp->f_op == &hung_up_tty_fops)
2701                         filp->f_op = &tty_fops;
2702                 goto retry_open;
2703         }
2704
2705         mutex_lock(&tty_mutex);
2706         spin_lock_irq(&current->sighand->siglock);
2707         if (!noctty &&
2708             current->signal->leader &&
2709             !current->signal->tty &&
2710             tty->session == NULL)
2711                 __proc_set_tty(current, tty);
2712         spin_unlock_irq(&current->sighand->siglock);
2713         mutex_unlock(&tty_mutex);
2714         tty_audit_opening();
2715         return 0;
2716 }
2717
2718 #ifdef CONFIG_UNIX98_PTYS
2719 /**
2720  *      ptmx_open               -       open a unix 98 pty master
2721  *      @inode: inode of device file
2722  *      @filp: file pointer to tty
2723  *
2724  *      Allocate a unix98 pty master device from the ptmx driver.
2725  *
2726  *      Locking: tty_mutex protects theinit_dev work. tty->count should
2727                 protect the rest.
2728  *              allocated_ptys_lock handles the list of free pty numbers
2729  */
2730
2731 static int ptmx_open(struct inode * inode, struct file * filp)
2732 {
2733         struct tty_struct *tty;
2734         int retval;
2735         int index;
2736         int idr_ret;
2737
2738         nonseekable_open(inode, filp);
2739
2740         /* find a device that is not in use. */
2741         down(&allocated_ptys_lock);
2742         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2743                 up(&allocated_ptys_lock);
2744                 return -ENOMEM;
2745         }
2746         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2747         if (idr_ret < 0) {
2748                 up(&allocated_ptys_lock);
2749                 if (idr_ret == -EAGAIN)
2750                         return -ENOMEM;
2751                 return -EIO;
2752         }
2753         if (index >= pty_limit) {
2754                 idr_remove(&allocated_ptys, index);
2755                 up(&allocated_ptys_lock);
2756                 return -EIO;
2757         }
2758         up(&allocated_ptys_lock);
2759
2760         mutex_lock(&tty_mutex);
2761         retval = init_dev(ptm_driver, index, &tty);
2762         mutex_unlock(&tty_mutex);
2763         
2764         if (retval)
2765                 goto out;
2766
2767         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2768         filp->private_data = tty;
2769         file_move(filp, &tty->tty_files);
2770
2771         retval = -ENOMEM;
2772         if (devpts_pty_new(tty->link))
2773                 goto out1;
2774
2775         check_tty_count(tty, "tty_open");
2776         retval = ptm_driver->open(tty, filp);
2777         if (!retval) {
2778                 tty_audit_opening();
2779                 return 0;
2780         }
2781 out1:
2782         release_dev(filp);
2783         return retval;
2784 out:
2785         down(&allocated_ptys_lock);
2786         idr_remove(&allocated_ptys, index);
2787         up(&allocated_ptys_lock);
2788         return retval;
2789 }
2790 #endif
2791
2792 /**
2793  *      tty_release             -       vfs callback for close
2794  *      @inode: inode of tty
2795  *      @filp: file pointer for handle to tty
2796  *
2797  *      Called the last time each file handle is closed that references
2798  *      this tty. There may however be several such references.
2799  *
2800  *      Locking:
2801  *              Takes bkl. See release_dev
2802  */
2803
2804 static int tty_release(struct inode * inode, struct file * filp)
2805 {
2806         lock_kernel();
2807         release_dev(filp);
2808         unlock_kernel();
2809         return 0;
2810 }
2811
2812 /**
2813  *      tty_poll        -       check tty status
2814  *      @filp: file being polled
2815  *      @wait: poll wait structures to update
2816  *
2817  *      Call the line discipline polling method to obtain the poll
2818  *      status of the device.
2819  *
2820  *      Locking: locks called line discipline but ldisc poll method
2821  *      may be re-entered freely by other callers.
2822  */
2823
2824 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2825 {
2826         struct tty_struct * tty;
2827         struct tty_ldisc *ld;
2828         int ret = 0;
2829
2830         tty = (struct tty_struct *)filp->private_data;
2831         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2832                 return 0;
2833                 
2834         ld = tty_ldisc_ref_wait(tty);
2835         if (ld->poll)
2836                 ret = (ld->poll)(tty, filp, wait);
2837         tty_ldisc_deref(ld);
2838         return ret;
2839 }
2840
2841 static int tty_fasync(int fd, struct file * filp, int on)
2842 {
2843         struct tty_struct * tty;
2844         int retval;
2845
2846         tty = (struct tty_struct *)filp->private_data;
2847         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2848                 return 0;
2849         
2850         retval = fasync_helper(fd, filp, on, &tty->fasync);
2851         if (retval <= 0)
2852                 return retval;
2853
2854         if (on) {
2855                 enum pid_type type;
2856                 struct pid *pid;
2857                 if (!waitqueue_active(&tty->read_wait))
2858                         tty->minimum_to_wake = 1;
2859                 if (tty->pgrp) {
2860                         pid = tty->pgrp;
2861                         type = PIDTYPE_PGID;
2862                 } else {
2863                         pid = task_pid(current);
2864                         type = PIDTYPE_PID;
2865                 }
2866                 retval = __f_setown(filp, pid, type, 0);
2867                 if (retval)
2868                         return retval;
2869         } else {
2870                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2871                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2872         }
2873         return 0;
2874 }
2875
2876 /**
2877  *      tiocsti                 -       fake input character
2878  *      @tty: tty to fake input into
2879  *      @p: pointer to character
2880  *
2881  *      Fake input to a tty device. Does the neccessary locking and
2882  *      input management.
2883  *
2884  *      FIXME: does not honour flow control ??
2885  *
2886  *      Locking:
2887  *              Called functions take tty_ldisc_lock
2888  *              current->signal->tty check is safe without locks
2889  *
2890  *      FIXME: may race normal receive processing
2891  */
2892
2893 static int tiocsti(struct tty_struct *tty, char __user *p)
2894 {
2895         char ch, mbz = 0;
2896         struct tty_ldisc *ld;
2897         
2898         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2899                 return -EPERM;
2900         if (get_user(ch, p))
2901                 return -EFAULT;
2902         ld = tty_ldisc_ref_wait(tty);
2903         ld->receive_buf(tty, &ch, &mbz, 1);
2904         tty_ldisc_deref(ld);
2905         return 0;
2906 }
2907
2908 /**
2909  *      tiocgwinsz              -       implement window query ioctl
2910  *      @tty; tty
2911  *      @arg: user buffer for result
2912  *
2913  *      Copies the kernel idea of the window size into the user buffer.
2914  *
2915  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2916  *              is consistent.
2917  */
2918
2919 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2920 {
2921         int err;
2922
2923         mutex_lock(&tty->termios_mutex);
2924         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2925         mutex_unlock(&tty->termios_mutex);
2926
2927         return err ? -EFAULT: 0;
2928 }
2929
2930 /**
2931  *      tiocswinsz              -       implement window size set ioctl
2932  *      @tty; tty
2933  *      @arg: user buffer for result
2934  *
2935  *      Copies the user idea of the window size to the kernel. Traditionally
2936  *      this is just advisory information but for the Linux console it
2937  *      actually has driver level meaning and triggers a VC resize.
2938  *
2939  *      Locking:
2940  *              Called function use the console_sem is used to ensure we do
2941  *      not try and resize the console twice at once.
2942  *              The tty->termios_mutex is used to ensure we don't double
2943  *      resize and get confused. Lock order - tty->termios_mutex before
2944  *      console sem
2945  */
2946
2947 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2948         struct winsize __user * arg)
2949 {
2950         struct winsize tmp_ws;
2951
2952         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2953                 return -EFAULT;
2954
2955         mutex_lock(&tty->termios_mutex);
2956         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2957                 goto done;
2958
2959 #ifdef CONFIG_VT
2960         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2961                 if (vc_lock_resize(tty->driver_data, tmp_ws.ws_col,
2962                                         tmp_ws.ws_row)) {
2963                         mutex_unlock(&tty->termios_mutex);
2964                         return -ENXIO;
2965                 }
2966         }
2967 #endif
2968         if (tty->pgrp)
2969                 kill_pgrp(tty->pgrp, SIGWINCH, 1);
2970         if ((real_tty->pgrp != tty->pgrp) && real_tty->pgrp)
2971                 kill_pgrp(real_tty->pgrp, SIGWINCH, 1);
2972         tty->winsize = tmp_ws;
2973         real_tty->winsize = tmp_ws;
2974 done:
2975         mutex_unlock(&tty->termios_mutex);
2976         return 0;
2977 }
2978
2979 /**
2980  *      tioccons        -       allow admin to move logical console
2981  *      @file: the file to become console
2982  *
2983  *      Allow the adminstrator to move the redirected console device
2984  *
2985  *      Locking: uses redirect_lock to guard the redirect information
2986  */
2987
2988 static int tioccons(struct file *file)
2989 {
2990         if (!capable(CAP_SYS_ADMIN))
2991                 return -EPERM;
2992         if (file->f_op->write == redirected_tty_write) {
2993                 struct file *f;
2994                 spin_lock(&redirect_lock);
2995                 f = redirect;
2996                 redirect = NULL;
2997                 spin_unlock(&redirect_lock);
2998                 if (f)
2999                         fput(f);
3000                 return 0;
3001         }
3002         spin_lock(&redirect_lock);
3003         if (redirect) {
3004                 spin_unlock(&redirect_lock);
3005                 return -EBUSY;
3006         }
3007         get_file(file);
3008         redirect = file;
3009         spin_unlock(&redirect_lock);
3010         return 0;
3011 }
3012
3013 /**
3014  *      fionbio         -       non blocking ioctl
3015  *      @file: file to set blocking value
3016  *      @p: user parameter
3017  *
3018  *      Historical tty interfaces had a blocking control ioctl before
3019  *      the generic functionality existed. This piece of history is preserved
3020  *      in the expected tty API of posix OS's.
3021  *
3022  *      Locking: none, the open fle handle ensures it won't go away.
3023  */
3024
3025 static int fionbio(struct file *file, int __user *p)
3026 {
3027         int nonblock;
3028
3029         if (get_user(nonblock, p))
3030                 return -EFAULT;
3031
3032         if (nonblock)
3033                 file->f_flags |= O_NONBLOCK;
3034         else
3035                 file->f_flags &= ~O_NONBLOCK;
3036         return 0;
3037 }
3038
3039 /**
3040  *      tiocsctty       -       set controlling tty
3041  *      @tty: tty structure
3042  *      @arg: user argument
3043  *
3044  *      This ioctl is used to manage job control. It permits a session
3045  *      leader to set this tty as the controlling tty for the session.
3046  *
3047  *      Locking:
3048  *              Takes tty_mutex() to protect tty instance
3049  *              Takes tasklist_lock internally to walk sessions
3050  *              Takes ->siglock() when updating signal->tty
3051  */
3052
3053 static int tiocsctty(struct tty_struct *tty, int arg)
3054 {
3055         int ret = 0;
3056         if (current->signal->leader && (task_session(current) == tty->session))
3057                 return ret;
3058
3059         mutex_lock(&tty_mutex);
3060         /*
3061          * The process must be a session leader and
3062          * not have a controlling tty already.
3063          */
3064         if (!current->signal->leader || current->signal->tty) {
3065                 ret = -EPERM;
3066                 goto unlock;
3067         }
3068
3069         if (tty->session) {
3070                 /*
3071                  * This tty is already the controlling
3072                  * tty for another session group!
3073                  */
3074                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
3075                         /*
3076                          * Steal it away
3077                          */
3078                         read_lock(&tasklist_lock);
3079                         session_clear_tty(tty->session);
3080                         read_unlock(&tasklist_lock);
3081                 } else {
3082                         ret = -EPERM;
3083                         goto unlock;
3084                 }
3085         }
3086         proc_set_tty(current, tty);
3087 unlock:
3088         mutex_unlock(&tty_mutex);
3089         return ret;
3090 }
3091
3092 /**
3093  *      tiocgpgrp               -       get process group
3094  *      @tty: tty passed by user
3095  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
3096  *      @p: returned pid
3097  *
3098  *      Obtain the process group of the tty. If there is no process group
3099  *      return an error.
3100  *
3101  *      Locking: none. Reference to current->signal->tty is safe.
3102  */
3103
3104 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3105 {
3106         /*
3107          * (tty == real_tty) is a cheap way of
3108          * testing if the tty is NOT a master pty.
3109          */
3110         if (tty == real_tty && current->signal->tty != real_tty)
3111                 return -ENOTTY;
3112         return put_user(pid_nr(real_tty->pgrp), p);
3113 }
3114
3115 /**
3116  *      tiocspgrp               -       attempt to set process group
3117  *      @tty: tty passed by user
3118  *      @real_tty: tty side device matching tty passed by user
3119  *      @p: pid pointer
3120  *
3121  *      Set the process group of the tty to the session passed. Only
3122  *      permitted where the tty session is our session.
3123  *
3124  *      Locking: None
3125  */
3126
3127 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3128 {
3129         struct pid *pgrp;
3130         pid_t pgrp_nr;
3131         int retval = tty_check_change(real_tty);
3132
3133         if (retval == -EIO)
3134                 return -ENOTTY;
3135         if (retval)
3136                 return retval;
3137         if (!current->signal->tty ||
3138             (current->signal->tty != real_tty) ||
3139             (real_tty->session != task_session(current)))
3140                 return -ENOTTY;
3141         if (get_user(pgrp_nr, p))
3142                 return -EFAULT;
3143         if (pgrp_nr < 0)
3144                 return -EINVAL;
3145         rcu_read_lock();
3146         pgrp = find_pid(pgrp_nr);
3147         retval = -ESRCH;
3148         if (!pgrp)
3149                 goto out_unlock;
3150         retval = -EPERM;
3151         if (session_of_pgrp(pgrp) != task_session(current))
3152                 goto out_unlock;
3153         retval = 0;
3154         put_pid(real_tty->pgrp);
3155         real_tty->pgrp = get_pid(pgrp);
3156 out_unlock:
3157         rcu_read_unlock();
3158         return retval;
3159 }
3160
3161 /**
3162  *      tiocgsid                -       get session id
3163  *      @tty: tty passed by user
3164  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
3165  *      @p: pointer to returned session id
3166  *
3167  *      Obtain the session id of the tty. If there is no session
3168  *      return an error.
3169  *
3170  *      Locking: none. Reference to current->signal->tty is safe.
3171  */
3172
3173 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3174 {
3175         /*
3176          * (tty == real_tty) is a cheap way of
3177          * testing if the tty is NOT a master pty.
3178         */
3179         if (tty == real_tty && current->signal->tty != real_tty)
3180                 return -ENOTTY;
3181         if (!real_tty->session)
3182                 return -ENOTTY;
3183         return put_user(pid_nr(real_tty->session), p);
3184 }
3185
3186 /**
3187  *      tiocsetd        -       set line discipline
3188  *      @tty: tty device
3189  *      @p: pointer to user data
3190  *
3191  *      Set the line discipline according to user request.
3192  *
3193  *      Locking: see tty_set_ldisc, this function is just a helper
3194  */
3195
3196 static int tiocsetd(struct tty_struct *tty, int __user *p)
3197 {
3198         int ldisc;
3199
3200         if (get_user(ldisc, p))
3201                 return -EFAULT;
3202         return tty_set_ldisc(tty, ldisc);
3203 }
3204
3205 /**
3206  *      send_break      -       performed time break
3207  *      @tty: device to break on
3208  *      @duration: timeout in mS
3209  *
3210  *      Perform a timed break on hardware that lacks its own driver level
3211  *      timed break functionality.
3212  *
3213  *      Locking:
3214  *              atomic_write_lock serializes
3215  *
3216  */
3217
3218 static int send_break(struct tty_struct *tty, unsigned int duration)
3219 {
3220         if (tty_write_lock(tty, 0) < 0)
3221                 return -EINTR;
3222         tty->driver->break_ctl(tty, -1);
3223         if (!signal_pending(current))
3224                 msleep_interruptible(duration);
3225         tty->driver->break_ctl(tty, 0);
3226         tty_write_unlock(tty);
3227         if (signal_pending(current))
3228                 return -EINTR;
3229         return 0;
3230 }
3231
3232 /**
3233  *      tiocmget                -       get modem status
3234  *      @tty: tty device
3235  *      @file: user file pointer
3236  *      @p: pointer to result
3237  *
3238  *      Obtain the modem status bits from the tty driver if the feature
3239  *      is supported. Return -EINVAL if it is not available.
3240  *
3241  *      Locking: none (up to the driver)
3242  */
3243
3244 static int tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
3245 {
3246         int retval = -EINVAL;
3247
3248         if (tty->driver->tiocmget) {
3249                 retval = tty->driver->tiocmget(tty, file);
3250
3251                 if (retval >= 0)
3252                         retval = put_user(retval, p);
3253         }
3254         return retval;
3255 }
3256
3257 /**
3258  *      tiocmset                -       set modem status
3259  *      @tty: tty device
3260  *      @file: user file pointer
3261  *      @cmd: command - clear bits, set bits or set all
3262  *      @p: pointer to desired bits
3263  *
3264  *      Set the modem status bits from the tty driver if the feature
3265  *      is supported. Return -EINVAL if it is not available.
3266  *
3267  *      Locking: none (up to the driver)
3268  */
3269
3270 static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
3271              unsigned __user *p)
3272 {
3273         int retval = -EINVAL;
3274
3275         if (tty->driver->tiocmset) {
3276                 unsigned int set, clear, val;
3277
3278                 retval = get_user(val, p);
3279                 if (retval)
3280                         return retval;
3281
3282                 set = clear = 0;
3283                 switch (cmd) {
3284                 case TIOCMBIS:
3285                         set = val;
3286                         break;
3287                 case TIOCMBIC:
3288                         clear = val;
3289                         break;
3290                 case TIOCMSET:
3291                         set = val;
3292                         clear = ~val;
3293                         break;
3294                 }
3295
3296                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
3297                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
3298
3299                 retval = tty->driver->tiocmset(tty, file, set, clear);
3300         }
3301         return retval;
3302 }
3303
3304 /*
3305  * Split this up, as gcc can choke on it otherwise..
3306  */
3307 int tty_ioctl(struct inode * inode, struct file * file,
3308               unsigned int cmd, unsigned long arg)
3309 {
3310         struct tty_struct *tty, *real_tty;
3311         void __user *p = (void __user *)arg;
3312         int retval;
3313         struct tty_ldisc *ld;
3314         
3315         tty = (struct tty_struct *)file->private_data;
3316         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
3317                 return -EINVAL;
3318
3319         /* CHECKME: is this safe as one end closes ? */
3320
3321         real_tty = tty;
3322         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
3323             tty->driver->subtype == PTY_TYPE_MASTER)
3324                 real_tty = tty->link;
3325
3326         /*
3327          * Break handling by driver
3328          */
3329         if (!tty->driver->break_ctl) {
3330                 switch(cmd) {
3331                 case TIOCSBRK:
3332                 case TIOCCBRK:
3333                         if (tty->driver->ioctl)
3334                                 return tty->driver->ioctl(tty, file, cmd, arg);
3335                         return -EINVAL;
3336                         
3337                 /* These two ioctl's always return success; even if */
3338                 /* the driver doesn't support them. */
3339                 case TCSBRK:
3340                 case TCSBRKP:
3341                         if (!tty->driver->ioctl)
3342                                 return 0;
3343                         retval = tty->driver->ioctl(tty, file, cmd, arg);
3344                         if (retval == -ENOIOCTLCMD)
3345                                 retval = 0;
3346                         return retval;
3347                 }
3348         }
3349
3350         /*
3351          * Factor out some common prep work
3352          */
3353         switch (cmd) {
3354         case TIOCSETD:
3355         case TIOCSBRK:
3356         case TIOCCBRK:
3357         case TCSBRK:
3358         case TCSBRKP:                   
3359                 retval = tty_check_change(tty);
3360                 if (retval)
3361                         return retval;
3362                 if (cmd != TIOCCBRK) {
3363                         tty_wait_until_sent(tty, 0);
3364                         if (signal_pending(current))
3365                                 return -EINTR;
3366                 }
3367                 break;
3368         }
3369
3370         switch (cmd) {
3371                 case TIOCSTI:
3372                         return tiocsti(tty, p);
3373                 case TIOCGWINSZ:
3374                         return tiocgwinsz(tty, p);
3375                 case TIOCSWINSZ:
3376                         return tiocswinsz(tty, real_tty, p);
3377                 case TIOCCONS:
3378                         return real_tty!=tty ? -EINVAL : tioccons(file);
3379                 case FIONBIO:
3380                         return fionbio(file, p);
3381                 case TIOCEXCL:
3382                         set_bit(TTY_EXCLUSIVE, &tty->flags);
3383                         return 0;
3384                 case TIOCNXCL:
3385                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
3386                         return 0;
3387                 case TIOCNOTTY:
3388                         if (current->signal->tty != tty)
3389                                 return -ENOTTY;
3390                         no_tty();
3391                         return 0;
3392                 case TIOCSCTTY:
3393                         return tiocsctty(tty, arg);
3394                 case TIOCGPGRP:
3395                         return tiocgpgrp(tty, real_tty, p);
3396                 case TIOCSPGRP:
3397                         return tiocspgrp(tty, real_tty, p);
3398                 case TIOCGSID:
3399                         return tiocgsid(tty, real_tty, p);
3400                 case TIOCGETD:
3401                         /* FIXME: check this is ok */
3402                         return put_user(tty->ldisc.num, (int __user *)p);
3403                 case TIOCSETD:
3404                         return tiocsetd(tty, p);
3405 #ifdef CONFIG_VT
3406                 case TIOCLINUX:
3407                         return tioclinux(tty, arg);
3408 #endif
3409                 /*
3410                  * Break handling
3411                  */
3412                 case TIOCSBRK:  /* Turn break on, unconditionally */
3413                         tty->driver->break_ctl(tty, -1);
3414                         return 0;
3415                         
3416                 case TIOCCBRK:  /* Turn break off, unconditionally */
3417                         tty->driver->break_ctl(tty, 0);
3418                         return 0;
3419                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
3420                         /* non-zero arg means wait for all output data
3421                          * to be sent (performed above) but don't send break.
3422                          * This is used by the tcdrain() termios function.
3423                          */
3424                         if (!arg)
3425                                 return send_break(tty, 250);
3426                         return 0;
3427                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
3428                         return send_break(tty, arg ? arg*100 : 250);
3429
3430                 case TIOCMGET:
3431                         return tty_tiocmget(tty, file, p);
3432
3433                 case TIOCMSET:
3434                 case TIOCMBIC:
3435                 case TIOCMBIS:
3436                         return tty_tiocmset(tty, file, cmd, p);
3437                 case TCFLSH:
3438                         switch (arg) {
3439                         case TCIFLUSH:
3440                         case TCIOFLUSH:
3441                                 /* flush tty buffer and allow ldisc to process ioctl */
3442                                 tty_buffer_flush(tty);
3443                                 break;
3444                         }
3445                         break;
3446         }
3447         if (tty->driver->ioctl) {
3448                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
3449                 if (retval != -ENOIOCTLCMD)
3450                         return retval;
3451         }
3452         ld = tty_ldisc_ref_wait(tty);
3453         retval = -EINVAL;
3454         if (ld->ioctl) {
3455                 retval = ld->ioctl(tty, file, cmd, arg);
3456                 if (retval == -ENOIOCTLCMD)
3457                         retval = -EINVAL;
3458         }
3459         tty_ldisc_deref(ld);
3460         return retval;
3461 }
3462
3463 #ifdef CONFIG_COMPAT
3464 static long tty_compat_ioctl(struct file * file, unsigned int cmd,
3465                                 unsigned long arg)
3466 {
3467         struct inode *inode = file->f_dentry->d_inode;
3468         struct tty_struct *tty = file->private_data;
3469         struct tty_ldisc *ld;
3470         int retval = -ENOIOCTLCMD;
3471
3472         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
3473                 return -EINVAL;
3474
3475         if (tty->driver->compat_ioctl) {
3476                 retval = (tty->driver->compat_ioctl)(tty, file, cmd, arg);
3477                 if (retval != -ENOIOCTLCMD)
3478                         return retval;
3479         }
3480
3481         ld = tty_ldisc_ref_wait(tty);
3482         if (ld->compat_ioctl)
3483                 retval = ld->compat_ioctl(tty, file, cmd, arg);
3484         tty_ldisc_deref(ld);
3485
3486         return retval;
3487 }
3488 #endif
3489
3490 /*
3491  * This implements the "Secure Attention Key" ---  the idea is to
3492  * prevent trojan horses by killing all processes associated with this
3493  * tty when the user hits the "Secure Attention Key".  Required for
3494  * super-paranoid applications --- see the Orange Book for more details.
3495  * 
3496  * This code could be nicer; ideally it should send a HUP, wait a few
3497  * seconds, then send a INT, and then a KILL signal.  But you then
3498  * have to coordinate with the init process, since all processes associated
3499  * with the current tty must be dead before the new getty is allowed
3500  * to spawn.
3501  *
3502  * Now, if it would be correct ;-/ The current code has a nasty hole -
3503  * it doesn't catch files in flight. We may send the descriptor to ourselves
3504  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
3505  *
3506  * Nasty bug: do_SAK is being called in interrupt context.  This can
3507  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
3508  */
3509 void __do_SAK(struct tty_struct *tty)
3510 {
3511 #ifdef TTY_SOFT_SAK
3512         tty_hangup(tty);
3513 #else
3514         struct task_struct *g, *p;
3515         struct pid *session;
3516         int             i;
3517         struct file     *filp;
3518         struct fdtable *fdt;
3519         
3520         if (!tty)
3521                 return;
3522         session = tty->session;
3523         
3524         tty_ldisc_flush(tty);
3525
3526         if (tty->driver->flush_buffer)
3527                 tty->driver->flush_buffer(tty);
3528         
3529         read_lock(&tasklist_lock);
3530         /* Kill the entire session */
3531         do_each_pid_task(session, PIDTYPE_SID, p) {
3532                 printk(KERN_NOTICE "SAK: killed process %d"
3533                         " (%s): process_session(p)==tty->session\n",
3534                         p->pid, p->comm);
3535                 send_sig(SIGKILL, p, 1);
3536         } while_each_pid_task(session, PIDTYPE_SID, p);
3537         /* Now kill any processes that happen to have the
3538          * tty open.
3539          */
3540         do_each_thread(g, p) {
3541                 if (p->signal->tty == tty) {
3542                         printk(KERN_NOTICE "SAK: killed process %d"
3543                             " (%s): process_session(p)==tty->session\n",
3544                             p->pid, p->comm);
3545                         send_sig(SIGKILL, p, 1);
3546                         continue;
3547                 }
3548                 task_lock(p);
3549                 if (p->files) {
3550                         /*
3551                          * We don't take a ref to the file, so we must
3552                          * hold ->file_lock instead.
3553                          */
3554                         spin_lock(&p->files->file_lock);
3555                         fdt = files_fdtable(p->files);
3556                         for (i=0; i < fdt->max_fds; i++) {
3557                                 filp = fcheck_files(p->files, i);
3558                                 if (!filp)
3559                                         continue;
3560                                 if (filp->f_op->read == tty_read &&
3561                                     filp->private_data == tty) {
3562                                         printk(KERN_NOTICE "SAK: killed process %d"
3563                                             " (%s): fd#%d opened to the tty\n",
3564                                             p->pid, p->comm, i);
3565                                         force_sig(SIGKILL, p);
3566                                         break;
3567                                 }
3568                         }
3569                         spin_unlock(&p->files->file_lock);
3570                 }
3571                 task_unlock(p);
3572         } while_each_thread(g, p);
3573         read_unlock(&tasklist_lock);
3574 #endif
3575 }
3576
3577 static void do_SAK_work(struct work_struct *work)
3578 {
3579         struct tty_struct *tty =
3580                 container_of(work, struct tty_struct, SAK_work);
3581         __do_SAK(tty);
3582 }
3583
3584 /*
3585  * The tq handling here is a little racy - tty->SAK_work may already be queued.
3586  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3587  * the values which we write to it will be identical to the values which it
3588  * already has. --akpm
3589  */
3590 void do_SAK(struct tty_struct *tty)
3591 {
3592         if (!tty)
3593                 return;
3594         schedule_work(&tty->SAK_work);
3595 }
3596
3597 EXPORT_SYMBOL(do_SAK);
3598
3599 /**
3600  *      flush_to_ldisc
3601  *      @work: tty structure passed from work queue.
3602  *
3603  *      This routine is called out of the software interrupt to flush data
3604  *      from the buffer chain to the line discipline.
3605  *
3606  *      Locking: holds tty->buf.lock to guard buffer list. Drops the lock
3607  *      while invoking the line discipline receive_buf method. The
3608  *      receive_buf method is single threaded for each tty instance.
3609  */
3610  
3611 static void flush_to_ldisc(struct work_struct *work)
3612 {
3613         struct tty_struct *tty =
3614                 container_of(work, struct tty_struct, buf.work.work);
3615         unsigned long   flags;
3616         struct tty_ldisc *disc;
3617         struct tty_buffer *tbuf, *head;
3618         char *char_buf;
3619         unsigned char *flag_buf;
3620
3621         disc = tty_ldisc_ref(tty);
3622         if (disc == NULL)       /*  !TTY_LDISC */
3623                 return;
3624
3625         spin_lock_irqsave(&tty->buf.lock, flags);
3626         set_bit(TTY_FLUSHING, &tty->flags);     /* So we know a flush is running */
3627         head = tty->buf.head;
3628         if (head != NULL) {
3629                 tty->buf.head = NULL;
3630                 for (;;) {
3631                         int count = head->commit - head->read;
3632                         if (!count) {
3633                                 if (head->next == NULL)
3634                                         break;
3635                                 tbuf = head;
3636                                 head = head->next;
3637                                 tty_buffer_free(tty, tbuf);
3638                                 continue;
3639                         }
3640                         /* Ldisc or user is trying to flush the buffers
3641                            we are feeding to the ldisc, stop feeding the
3642                            line discipline as we want to empty the queue */
3643                         if (test_bit(TTY_FLUSHPENDING, &tty->flags))
3644                                 break;
3645                         if (!tty->receive_room) {
3646                                 schedule_delayed_work(&tty->buf.work, 1);
3647                                 break;
3648                         }
3649                         if (count > tty->receive_room)
3650                                 count = tty->receive_room;
3651                         char_buf = head->char_buf_ptr + head->read;
3652                         flag_buf = head->flag_buf_ptr + head->read;
3653                         head->read += count;
3654                         spin_unlock_irqrestore(&tty->buf.lock, flags);
3655                         disc->receive_buf(tty, char_buf, flag_buf, count);
3656                         spin_lock_irqsave(&tty->buf.lock, flags);
3657                 }
3658                 /* Restore the queue head */
3659                 tty->buf.head = head;
3660         }
3661         /* We may have a deferred request to flush the input buffer,
3662            if so pull the chain under the lock and empty the queue */
3663         if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
3664                 __tty_buffer_flush(tty);
3665                 clear_bit(TTY_FLUSHPENDING, &tty->flags);
3666                 wake_up(&tty->read_wait);
3667         }
3668         clear_bit(TTY_FLUSHING, &tty->flags);
3669         spin_unlock_irqrestore(&tty->buf.lock, flags);
3670
3671         tty_ldisc_deref(disc);
3672 }
3673
3674 /**
3675  *      tty_flip_buffer_push    -       terminal
3676  *      @tty: tty to push
3677  *
3678  *      Queue a push of the terminal flip buffers to the line discipline. This
3679  *      function must not be called from IRQ context if tty->low_latency is set.
3680  *
3681  *      In the event of the queue being busy for flipping the work will be
3682  *      held off and retried later.
3683  *
3684  *      Locking: tty buffer lock. Driver locks in low latency mode.
3685  */
3686
3687 void tty_flip_buffer_push(struct tty_struct *tty)
3688 {
3689         unsigned long flags;
3690         spin_lock_irqsave(&tty->buf.lock, flags);
3691         if (tty->buf.tail != NULL)
3692                 tty->buf.tail->commit = tty->buf.tail->used;
3693         spin_unlock_irqrestore(&tty->buf.lock, flags);
3694
3695         if (tty->low_latency)
3696                 flush_to_ldisc(&tty->buf.work.work);
3697         else
3698                 schedule_delayed_work(&tty->buf.work, 1);
3699 }
3700
3701 EXPORT_SYMBOL(tty_flip_buffer_push);
3702
3703
3704 /**
3705  *      initialize_tty_struct
3706  *      @tty: tty to initialize
3707  *
3708  *      This subroutine initializes a tty structure that has been newly
3709  *      allocated.
3710  *
3711  *      Locking: none - tty in question must not be exposed at this point
3712  */
3713
3714 static void initialize_tty_struct(struct tty_struct *tty)
3715 {
3716         memset(tty, 0, sizeof(struct tty_struct));
3717         tty->magic = TTY_MAGIC;
3718         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
3719         tty->session = NULL;
3720         tty->pgrp = NULL;
3721         tty->overrun_time = jiffies;
3722         tty->buf.head = tty->buf.tail = NULL;
3723         tty_buffer_init(tty);
3724         INIT_DELAYED_WORK(&tty->buf.work, flush_to_ldisc);
3725         init_MUTEX(&tty->buf.pty_sem);
3726         mutex_init(&tty->termios_mutex);
3727         init_waitqueue_head(&tty->write_wait);
3728         init_waitqueue_head(&tty->read_wait);
3729         INIT_WORK(&tty->hangup_work, do_tty_hangup);
3730         mutex_init(&tty->atomic_read_lock);
3731         mutex_init(&tty->atomic_write_lock);
3732         spin_lock_init(&tty->read_lock);
3733         INIT_LIST_HEAD(&tty->tty_files);
3734         INIT_WORK(&tty->SAK_work, do_SAK_work);
3735 }
3736
3737 /*
3738  * The default put_char routine if the driver did not define one.
3739  */
3740
3741 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
3742 {
3743         tty->driver->write(tty, &ch, 1);
3744 }
3745
3746 static struct class *tty_class;
3747
3748 /**
3749  *      tty_register_device - register a tty device
3750  *      @driver: the tty driver that describes the tty device
3751  *      @index: the index in the tty driver for this tty device
3752  *      @device: a struct device that is associated with this tty device.
3753  *              This field is optional, if there is no known struct device
3754  *              for this tty device it can be set to NULL safely.
3755  *
3756  *      Returns a pointer to the struct device for this tty device
3757  *      (or ERR_PTR(-EFOO) on error).
3758  *
3759  *      This call is required to be made to register an individual tty device
3760  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3761  *      that bit is not set, this function should not be called by a tty
3762  *      driver.
3763  *
3764  *      Locking: ??
3765  */
3766
3767 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3768                                    struct device *device)
3769 {
3770         char name[64];
3771         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3772
3773         if (index >= driver->num) {
3774                 printk(KERN_ERR "Attempt to register invalid tty line number "
3775                        " (%d).\n", index);
3776                 return ERR_PTR(-EINVAL);
3777         }
3778
3779         if (driver->type == TTY_DRIVER_TYPE_PTY)
3780                 pty_line_name(driver, index, name);
3781         else
3782                 tty_line_name(driver, index, name);
3783
3784         return device_create(tty_class, device, dev, name);
3785 }
3786
3787 /**
3788  *      tty_unregister_device - unregister a tty device
3789  *      @driver: the tty driver that describes the tty device
3790  *      @index: the index in the tty driver for this tty device
3791  *
3792  *      If a tty device is registered with a call to tty_register_device() then
3793  *      this function must be called when the tty device is gone.
3794  *
3795  *      Locking: ??
3796  */
3797
3798 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3799 {
3800         device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
3801 }
3802
3803 EXPORT_SYMBOL(tty_register_device);
3804 EXPORT_SYMBOL(tty_unregister_device);
3805
3806 struct tty_driver *alloc_tty_driver(int lines)
3807 {
3808         struct tty_driver *driver;
3809
3810         driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
3811         if (driver) {
3812                 driver->magic = TTY_DRIVER_MAGIC;
3813                 driver->num = lines;
3814                 /* later we'll move allocation of tables here */
3815         }
3816         return driver;
3817 }
3818
3819 void put_tty_driver(struct tty_driver *driver)
3820 {
3821         kfree(driver);
3822 }
3823
3824 void tty_set_operations(struct tty_driver *driver,
3825                         const struct tty_operations *op)
3826 {
3827         driver->open = op->open;
3828         driver->close = op->close;
3829         driver->write = op->write;
3830         driver->put_char = op->put_char;
3831         driver->flush_chars = op->flush_chars;
3832         driver->write_room = op->write_room;
3833         driver->chars_in_buffer = op->chars_in_buffer;
3834         driver->ioctl = op->ioctl;
3835         driver->compat_ioctl = op->compat_ioctl;
3836         driver->set_termios = op->set_termios;
3837         driver->throttle = op->throttle;
3838         driver->unthrottle = op->unthrottle;
3839         driver->stop = op->stop;
3840         driver->start = op->start;
3841         driver->hangup = op->hangup;
3842         driver->break_ctl = op->break_ctl;
3843         driver->flush_buffer = op->flush_buffer;
3844         driver->set_ldisc = op->set_ldisc;
3845         driver->wait_until_sent = op->wait_until_sent;
3846         driver->send_xchar = op->send_xchar;
3847         driver->read_proc = op->read_proc;
3848         driver->write_proc = op->write_proc;
3849         driver->tiocmget = op->tiocmget;
3850         driver->tiocmset = op->tiocmset;
3851 }
3852
3853
3854 EXPORT_SYMBOL(alloc_tty_driver);
3855 EXPORT_SYMBOL(put_tty_driver);
3856 EXPORT_SYMBOL(tty_set_operations);
3857
3858 /*
3859  * Called by a tty driver to register itself.
3860  */
3861 int tty_register_driver(struct tty_driver *driver)
3862 {
3863         int error;
3864         int i;
3865         dev_t dev;
3866         void **p = NULL;
3867
3868         if (driver->flags & TTY_DRIVER_INSTALLED)
3869                 return 0;
3870
3871         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3872                 p = kzalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3873                 if (!p)
3874                         return -ENOMEM;
3875         }
3876
3877         if (!driver->major) {
3878                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3879                                                 driver->name);
3880                 if (!error) {
3881                         driver->major = MAJOR(dev);
3882                         driver->minor_start = MINOR(dev);
3883                 }
3884         } else {
3885                 dev = MKDEV(driver->major, driver->minor_start);
3886                 error = register_chrdev_region(dev, driver->num, driver->name);
3887         }
3888         if (error < 0) {
3889                 kfree(p);
3890                 return error;
3891         }
3892
3893         if (p) {
3894                 driver->ttys = (struct tty_struct **)p;
3895                 driver->termios = (struct ktermios **)(p + driver->num);
3896                 driver->termios_locked = (struct ktermios **)(p + driver->num * 2);
3897         } else {
3898                 driver->ttys = NULL;
3899                 driver->termios = NULL;
3900                 driver->termios_locked = NULL;
3901         }
3902
3903         cdev_init(&driver->cdev, &tty_fops);
3904         driver->cdev.owner = driver->owner;
3905         error = cdev_add(&driver->cdev, dev, driver->num);
3906         if (error) {
3907                 unregister_chrdev_region(dev, driver->num);
3908                 driver->ttys = NULL;
3909                 driver->termios = driver->termios_locked = NULL;
3910                 kfree(p);
3911                 return error;
3912         }
3913
3914         if (!driver->put_char)
3915                 driver->put_char = tty_default_put_char;
3916         
3917         mutex_lock(&tty_mutex);
3918         list_add(&driver->tty_drivers, &tty_drivers);
3919         mutex_unlock(&tty_mutex);
3920         
3921         if ( !(driver->flags & TTY_DRIVER_DYNAMIC_DEV) ) {
3922                 for(i = 0; i < driver->num; i++)
3923                     tty_register_device(driver, i, NULL);
3924         }
3925         proc_tty_register_driver(driver);
3926         return 0;
3927 }
3928
3929 EXPORT_SYMBOL(tty_register_driver);
3930
3931 /*
3932  * Called by a tty driver to unregister itself.
3933  */
3934 int tty_unregister_driver(struct tty_driver *driver)
3935 {
3936         int i;
3937         struct ktermios *tp;
3938         void *p;
3939
3940         if (driver->refcount)
3941                 return -EBUSY;
3942
3943         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3944                                 driver->num);
3945         mutex_lock(&tty_mutex);
3946         list_del(&driver->tty_drivers);
3947         mutex_unlock(&tty_mutex);
3948
3949         /*
3950          * Free the termios and termios_locked structures because
3951          * we don't want to get memory leaks when modular tty
3952          * drivers are removed from the kernel.
3953          */
3954         for (i = 0; i < driver->num; i++) {
3955                 tp = driver->termios[i];
3956                 if (tp) {
3957                         driver->termios[i] = NULL;
3958                         kfree(tp);
3959                 }
3960                 tp = driver->termios_locked[i];
3961                 if (tp) {
3962                         driver->termios_locked[i] = NULL;
3963                         kfree(tp);
3964                 }
3965                 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3966                         tty_unregister_device(driver, i);
3967         }
3968         p = driver->ttys;
3969         proc_tty_unregister_driver(driver);
3970         driver->ttys = NULL;
3971         driver->termios = driver->termios_locked = NULL;
3972         kfree(p);
3973         cdev_del(&driver->cdev);
3974         return 0;
3975 }
3976 EXPORT_SYMBOL(tty_unregister_driver);
3977
3978 dev_t tty_devnum(struct tty_struct *tty)
3979 {
3980         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3981 }
3982 EXPORT_SYMBOL(tty_devnum);
3983
3984 void proc_clear_tty(struct task_struct *p)
3985 {
3986         spin_lock_irq(&p->sighand->siglock);
3987         p->signal->tty = NULL;
3988         spin_unlock_irq(&p->sighand->siglock);
3989 }
3990 EXPORT_SYMBOL(proc_clear_tty);
3991
3992 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3993 {
3994         if (tty) {
3995                 /* We should not have a session or pgrp to here but.... */
3996                 put_pid(tty->session);
3997                 put_pid(tty->pgrp);
3998                 tty->session = get_pid(task_session(tsk));
3999                 tty->pgrp = get_pid(task_pgrp(tsk));
4000         }
4001         put_pid(tsk->signal->tty_old_pgrp);
4002         tsk->signal->tty = tty;
4003         tsk->signal->tty_old_pgrp = NULL;
4004 }
4005
4006 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
4007 {
4008         spin_lock_irq(&tsk->sighand->siglock);
4009         __proc_set_tty(tsk, tty);
4010         spin_unlock_irq(&tsk->sighand->siglock);
4011 }
4012
4013 struct tty_struct *get_current_tty(void)
4014 {
4015         struct tty_struct *tty;
4016         WARN_ON_ONCE(!mutex_is_locked(&tty_mutex));
4017         tty = current->signal->tty;
4018         /*
4019          * session->tty can be changed/cleared from under us, make sure we
4020          * issue the load. The obtained pointer, when not NULL, is valid as
4021          * long as we hold tty_mutex.
4022          */
4023         barrier();
4024         return tty;
4025 }
4026 EXPORT_SYMBOL_GPL(get_current_tty);
4027
4028 /*
4029  * Initialize the console device. This is called *early*, so
4030  * we can't necessarily depend on lots of kernel help here.
4031  * Just do some early initializations, and do the complex setup
4032  * later.
4033  */
4034 void __init console_init(void)
4035 {
4036         initcall_t *call;
4037
4038         /* Setup the default TTY line discipline. */
4039         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
4040
4041         /*
4042          * set up the console device so that later boot sequences can 
4043          * inform about problems etc..
4044          */
4045         call = __con_initcall_start;
4046         while (call < __con_initcall_end) {
4047                 (*call)();
4048                 call++;
4049         }
4050 }
4051
4052 #ifdef CONFIG_VT
4053 extern int vty_init(void);
4054 #endif
4055
4056 static int __init tty_class_init(void)
4057 {
4058         tty_class = class_create(THIS_MODULE, "tty");
4059         if (IS_ERR(tty_class))
4060                 return PTR_ERR(tty_class);
4061         return 0;
4062 }
4063
4064 postcore_initcall(tty_class_init);
4065
4066 /* 3/2004 jmc: why do these devices exist? */
4067
4068 static struct cdev tty_cdev, console_cdev;
4069 #ifdef CONFIG_UNIX98_PTYS
4070 static struct cdev ptmx_cdev;
4071 #endif
4072 #ifdef CONFIG_VT
4073 static struct cdev vc0_cdev;
4074 #endif
4075
4076 /*
4077  * Ok, now we can initialize the rest of the tty devices and can count
4078  * on memory allocations, interrupts etc..
4079  */
4080 static int __init tty_init(void)
4081 {
4082         cdev_init(&tty_cdev, &tty_fops);
4083         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
4084             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
4085                 panic("Couldn't register /dev/tty driver\n");
4086         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), "tty");
4087
4088         cdev_init(&console_cdev, &console_fops);
4089         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
4090             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
4091                 panic("Couldn't register /dev/console driver\n");
4092         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), "console");
4093
4094 #ifdef CONFIG_UNIX98_PTYS
4095         cdev_init(&ptmx_cdev, &ptmx_fops);
4096         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
4097             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
4098                 panic("Couldn't register /dev/ptmx driver\n");
4099         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), "ptmx");
4100 #endif
4101
4102 #ifdef CONFIG_VT
4103         cdev_init(&vc0_cdev, &console_fops);
4104         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
4105             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
4106                 panic("Couldn't register /dev/tty0 driver\n");
4107         device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), "tty0");
4108
4109         vty_init();
4110 #endif
4111         return 0;
4112 }
4113 module_init(tty_init);