Merge branch 'mv-merge'
[linux-2.6] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/config.h>
69 #include <linux/types.h>
70 #include <linux/major.h>
71 #include <linux/errno.h>
72 #include <linux/signal.h>
73 #include <linux/fcntl.h>
74 #include <linux/sched.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/console.h>
82 #include <linux/timer.h>
83 #include <linux/ctype.h>
84 #include <linux/kd.h>
85 #include <linux/mm.h>
86 #include <linux/string.h>
87 #include <linux/slab.h>
88 #include <linux/poll.h>
89 #include <linux/proc_fs.h>
90 #include <linux/init.h>
91 #include <linux/module.h>
92 #include <linux/smp_lock.h>
93 #include <linux/device.h>
94 #include <linux/idr.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98
99 #include <asm/uaccess.h>
100 #include <asm/system.h>
101
102 #include <linux/kbd_kern.h>
103 #include <linux/vt_kern.h>
104 #include <linux/selection.h>
105 #include <linux/devfs_fs_kernel.h>
106
107 #include <linux/kmod.h>
108
109 #undef TTY_DEBUG_HANGUP
110
111 #define TTY_PARANOIA_CHECK 1
112 #define CHECK_TTY_COUNT 1
113
114 struct termios tty_std_termios = {      /* for the benefit of tty drivers  */
115         .c_iflag = ICRNL | IXON,
116         .c_oflag = OPOST | ONLCR,
117         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
118         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
119                    ECHOCTL | ECHOKE | IEXTEN,
120         .c_cc = INIT_C_CC
121 };
122
123 EXPORT_SYMBOL(tty_std_termios);
124
125 /* This list gets poked at by procfs and various bits of boot up code. This
126    could do with some rationalisation such as pulling the tty proc function
127    into this file */
128    
129 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
130
131 /* Semaphore to protect creating and releasing a tty. This is shared with
132    vt.c for deeply disgusting hack reasons */
133 DEFINE_MUTEX(tty_mutex);
134
135 #ifdef CONFIG_UNIX98_PTYS
136 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
137 extern int pty_limit;           /* Config limit on Unix98 ptys */
138 static DEFINE_IDR(allocated_ptys);
139 static DECLARE_MUTEX(allocated_ptys_lock);
140 static int ptmx_open(struct inode *, struct file *);
141 #endif
142
143 extern void disable_early_printk(void);
144
145 static void initialize_tty_struct(struct tty_struct *tty);
146
147 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
148 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
149 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
150 static unsigned int tty_poll(struct file *, poll_table *);
151 static int tty_open(struct inode *, struct file *);
152 static int tty_release(struct inode *, struct file *);
153 int tty_ioctl(struct inode * inode, struct file * file,
154               unsigned int cmd, unsigned long arg);
155 static int tty_fasync(int fd, struct file * filp, int on);
156 static void release_mem(struct tty_struct *tty, int idx);
157
158
159 static struct tty_struct *alloc_tty_struct(void)
160 {
161         struct tty_struct *tty;
162
163         tty = kmalloc(sizeof(struct tty_struct), GFP_KERNEL);
164         if (tty)
165                 memset(tty, 0, sizeof(struct tty_struct));
166         return tty;
167 }
168
169 static void tty_buffer_free_all(struct tty_struct *);
170
171 static inline void free_tty_struct(struct tty_struct *tty)
172 {
173         kfree(tty->write_buf);
174         tty_buffer_free_all(tty);
175         kfree(tty);
176 }
177
178 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
179
180 char *tty_name(struct tty_struct *tty, char *buf)
181 {
182         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
183                 strcpy(buf, "NULL tty");
184         else
185                 strcpy(buf, tty->name);
186         return buf;
187 }
188
189 EXPORT_SYMBOL(tty_name);
190
191 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
192                               const char *routine)
193 {
194 #ifdef TTY_PARANOIA_CHECK
195         if (!tty) {
196                 printk(KERN_WARNING
197                         "null TTY for (%d:%d) in %s\n",
198                         imajor(inode), iminor(inode), routine);
199                 return 1;
200         }
201         if (tty->magic != TTY_MAGIC) {
202                 printk(KERN_WARNING
203                         "bad magic number for tty struct (%d:%d) in %s\n",
204                         imajor(inode), iminor(inode), routine);
205                 return 1;
206         }
207 #endif
208         return 0;
209 }
210
211 static int check_tty_count(struct tty_struct *tty, const char *routine)
212 {
213 #ifdef CHECK_TTY_COUNT
214         struct list_head *p;
215         int count = 0;
216         
217         file_list_lock();
218         list_for_each(p, &tty->tty_files) {
219                 count++;
220         }
221         file_list_unlock();
222         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
223             tty->driver->subtype == PTY_TYPE_SLAVE &&
224             tty->link && tty->link->count)
225                 count++;
226         if (tty->count != count) {
227                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
228                                     "!= #fd's(%d) in %s\n",
229                        tty->name, tty->count, count, routine);
230                 return count;
231        }        
232 #endif
233         return 0;
234 }
235
236 /*
237  * Tty buffer allocation management
238  */
239
240 static void tty_buffer_free_all(struct tty_struct *tty)
241 {
242         struct tty_buffer *thead;
243         while((thead = tty->buf.head) != NULL) {
244                 tty->buf.head = thead->next;
245                 kfree(thead);
246         }
247         while((thead = tty->buf.free) != NULL) {
248                 tty->buf.free = thead->next;
249                 kfree(thead);
250         }
251         tty->buf.tail = NULL;
252 }
253
254 static void tty_buffer_init(struct tty_struct *tty)
255 {
256         spin_lock_init(&tty->buf.lock);
257         tty->buf.head = NULL;
258         tty->buf.tail = NULL;
259         tty->buf.free = NULL;
260 }
261
262 static struct tty_buffer *tty_buffer_alloc(size_t size)
263 {
264         struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
265         if(p == NULL)
266                 return NULL;
267         p->used = 0;
268         p->size = size;
269         p->next = NULL;
270         p->active = 0;
271         p->commit = 0;
272         p->read = 0;
273         p->char_buf_ptr = (char *)(p->data);
274         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
275 /*      printk("Flip create %p\n", p); */
276         return p;
277 }
278
279 /* Must be called with the tty_read lock held. This needs to acquire strategy
280    code to decide if we should kfree or relink a given expired buffer */
281
282 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
283 {
284         /* Dumb strategy for now - should keep some stats */
285 /*      printk("Flip dispose %p\n", b); */
286         if(b->size >= 512)
287                 kfree(b);
288         else {
289                 b->next = tty->buf.free;
290                 tty->buf.free = b;
291         }
292 }
293
294 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
295 {
296         struct tty_buffer **tbh = &tty->buf.free;
297         while((*tbh) != NULL) {
298                 struct tty_buffer *t = *tbh;
299                 if(t->size >= size) {
300                         *tbh = t->next;
301                         t->next = NULL;
302                         t->used = 0;
303                         t->commit = 0;
304                         t->read = 0;
305                         /* DEBUG ONLY */
306 /*                      memset(t->data, '*', size); */
307 /*                      printk("Flip recycle %p\n", t); */
308                         return t;
309                 }
310                 tbh = &((*tbh)->next);
311         }
312         /* Round the buffer size out */
313         size = (size + 0xFF) & ~ 0xFF;
314         return tty_buffer_alloc(size);
315         /* Should possibly check if this fails for the largest buffer we
316            have queued and recycle that ? */
317 }
318
319 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
320 {
321         struct tty_buffer *b, *n;
322         int left;
323         unsigned long flags;
324
325         spin_lock_irqsave(&tty->buf.lock, flags);
326
327         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
328            remove this conditional if its worth it. This would be invisible
329            to the callers */
330         if ((b = tty->buf.tail) != NULL) {
331                 left = b->size - b->used;
332                 b->active = 1;
333         } else
334                 left = 0;
335
336         if (left < size) {
337                 /* This is the slow path - looking for new buffers to use */
338                 if ((n = tty_buffer_find(tty, size)) != NULL) {
339                         if (b != NULL) {
340                                 b->next = n;
341                                 b->active = 0;
342                                 b->commit = b->used;
343                         } else
344                                 tty->buf.head = n;
345                         tty->buf.tail = n;
346                         n->active = 1;
347                 } else
348                         size = left;
349         }
350
351         spin_unlock_irqrestore(&tty->buf.lock, flags);
352         return size;
353 }
354
355 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
356
357 int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars, size_t size)
358 {
359         int copied = 0;
360         do {
361                 int space = tty_buffer_request_room(tty, size - copied);
362                 struct tty_buffer *tb = tty->buf.tail;
363                 /* If there is no space then tb may be NULL */
364                 if(unlikely(space == 0))
365                         break;
366                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
367                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
368                 tb->used += space;
369                 copied += space;
370                 chars += space;
371 /*              printk("Flip insert %d.\n", space); */
372         }
373         /* There is a small chance that we need to split the data over
374            several buffers. If this is the case we must loop */
375         while (unlikely(size > copied));
376         return copied;
377 }
378
379 EXPORT_SYMBOL_GPL(tty_insert_flip_string);
380
381 int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *chars, const char *flags, size_t size)
382 {
383         int copied = 0;
384         do {
385                 int space = tty_buffer_request_room(tty, size - copied);
386                 struct tty_buffer *tb = tty->buf.tail;
387                 /* If there is no space then tb may be NULL */
388                 if(unlikely(space == 0))
389                         break;
390                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
391                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
392                 tb->used += space;
393                 copied += space;
394                 chars += space;
395                 flags += space;
396         }
397         /* There is a small chance that we need to split the data over
398            several buffers. If this is the case we must loop */
399         while (unlikely(size > copied));
400         return copied;
401 }
402
403 EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
404
405
406 /*
407  *      Prepare a block of space in the buffer for data. Returns the length
408  *      available and buffer pointer to the space which is now allocated and
409  *      accounted for as ready for normal characters. This is used for drivers
410  *      that need their own block copy routines into the buffer. There is no
411  *      guarantee the buffer is a DMA target!
412  */
413
414 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
415 {
416         int space = tty_buffer_request_room(tty, size);
417         if (likely(space)) {
418                 struct tty_buffer *tb = tty->buf.tail;
419                 *chars = tb->char_buf_ptr + tb->used;
420                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
421                 tb->used += space;
422         }
423         return space;
424 }
425
426 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
427
428 /*
429  *      Prepare a block of space in the buffer for data. Returns the length
430  *      available and buffer pointer to the space which is now allocated and
431  *      accounted for as ready for characters. This is used for drivers
432  *      that need their own block copy routines into the buffer. There is no
433  *      guarantee the buffer is a DMA target!
434  */
435
436 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
437 {
438         int space = tty_buffer_request_room(tty, size);
439         if (likely(space)) {
440                 struct tty_buffer *tb = tty->buf.tail;
441                 *chars = tb->char_buf_ptr + tb->used;
442                 *flags = tb->flag_buf_ptr + tb->used;
443                 tb->used += space;
444         }
445         return space;
446 }
447
448 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
449
450
451
452 /*
453  *      This is probably overkill for real world processors but
454  *      they are not on hot paths so a little discipline won't do 
455  *      any harm.
456  */
457  
458 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
459 {
460         down(&tty->termios_sem);
461         tty->termios->c_line = num;
462         up(&tty->termios_sem);
463 }
464
465 /*
466  *      This guards the refcounted line discipline lists. The lock
467  *      must be taken with irqs off because there are hangup path
468  *      callers who will do ldisc lookups and cannot sleep.
469  */
470  
471 static DEFINE_SPINLOCK(tty_ldisc_lock);
472 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
473 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
474
475 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
476 {
477         unsigned long flags;
478         int ret = 0;
479         
480         if (disc < N_TTY || disc >= NR_LDISCS)
481                 return -EINVAL;
482         
483         spin_lock_irqsave(&tty_ldisc_lock, flags);
484         tty_ldiscs[disc] = *new_ldisc;
485         tty_ldiscs[disc].num = disc;
486         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
487         tty_ldiscs[disc].refcount = 0;
488         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
489         
490         return ret;
491 }
492 EXPORT_SYMBOL(tty_register_ldisc);
493
494 int tty_unregister_ldisc(int disc)
495 {
496         unsigned long flags;
497         int ret = 0;
498
499         if (disc < N_TTY || disc >= NR_LDISCS)
500                 return -EINVAL;
501
502         spin_lock_irqsave(&tty_ldisc_lock, flags);
503         if (tty_ldiscs[disc].refcount)
504                 ret = -EBUSY;
505         else
506                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
507         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
508
509         return ret;
510 }
511 EXPORT_SYMBOL(tty_unregister_ldisc);
512
513 struct tty_ldisc *tty_ldisc_get(int disc)
514 {
515         unsigned long flags;
516         struct tty_ldisc *ld;
517
518         if (disc < N_TTY || disc >= NR_LDISCS)
519                 return NULL;
520         
521         spin_lock_irqsave(&tty_ldisc_lock, flags);
522
523         ld = &tty_ldiscs[disc];
524         /* Check the entry is defined */
525         if(ld->flags & LDISC_FLAG_DEFINED)
526         {
527                 /* If the module is being unloaded we can't use it */
528                 if (!try_module_get(ld->owner))
529                         ld = NULL;
530                 else /* lock it */
531                         ld->refcount++;
532         }
533         else
534                 ld = NULL;
535         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
536         return ld;
537 }
538
539 EXPORT_SYMBOL_GPL(tty_ldisc_get);
540
541 void tty_ldisc_put(int disc)
542 {
543         struct tty_ldisc *ld;
544         unsigned long flags;
545         
546         BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
547                 
548         spin_lock_irqsave(&tty_ldisc_lock, flags);
549         ld = &tty_ldiscs[disc];
550         BUG_ON(ld->refcount == 0);
551         ld->refcount--;
552         module_put(ld->owner);
553         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
554 }
555         
556 EXPORT_SYMBOL_GPL(tty_ldisc_put);
557
558 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
559 {
560         tty->ldisc = *ld;
561         tty->ldisc.refcount = 0;
562 }
563
564 /**
565  *      tty_ldisc_try           -       internal helper
566  *      @tty: the tty
567  *
568  *      Make a single attempt to grab and bump the refcount on
569  *      the tty ldisc. Return 0 on failure or 1 on success. This is
570  *      used to implement both the waiting and non waiting versions
571  *      of tty_ldisc_ref
572  */
573
574 static int tty_ldisc_try(struct tty_struct *tty)
575 {
576         unsigned long flags;
577         struct tty_ldisc *ld;
578         int ret = 0;
579         
580         spin_lock_irqsave(&tty_ldisc_lock, flags);
581         ld = &tty->ldisc;
582         if(test_bit(TTY_LDISC, &tty->flags))
583         {
584                 ld->refcount++;
585                 ret = 1;
586         }
587         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
588         return ret;
589 }
590
591 /**
592  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
593  *      @tty: tty device
594  *
595  *      Dereference the line discipline for the terminal and take a 
596  *      reference to it. If the line discipline is in flux then 
597  *      wait patiently until it changes.
598  *
599  *      Note: Must not be called from an IRQ/timer context. The caller
600  *      must also be careful not to hold other locks that will deadlock
601  *      against a discipline change, such as an existing ldisc reference
602  *      (which we check for)
603  */
604  
605 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
606 {
607         /* wait_event is a macro */
608         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
609         if(tty->ldisc.refcount == 0)
610                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
611         return &tty->ldisc;
612 }
613
614 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
615
616 /**
617  *      tty_ldisc_ref           -       get the tty ldisc
618  *      @tty: tty device
619  *
620  *      Dereference the line discipline for the terminal and take a 
621  *      reference to it. If the line discipline is in flux then 
622  *      return NULL. Can be called from IRQ and timer functions.
623  */
624  
625 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
626 {
627         if(tty_ldisc_try(tty))
628                 return &tty->ldisc;
629         return NULL;
630 }
631
632 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
633
634 /**
635  *      tty_ldisc_deref         -       free a tty ldisc reference
636  *      @ld: reference to free up
637  *
638  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
639  *      be called in IRQ context.
640  */
641  
642 void tty_ldisc_deref(struct tty_ldisc *ld)
643 {
644         unsigned long flags;
645
646         BUG_ON(ld == NULL);
647                 
648         spin_lock_irqsave(&tty_ldisc_lock, flags);
649         if(ld->refcount == 0)
650                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
651         else
652                 ld->refcount--;
653         if(ld->refcount == 0)
654                 wake_up(&tty_ldisc_wait);
655         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
656 }
657
658 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
659
660 /**
661  *      tty_ldisc_enable        -       allow ldisc use
662  *      @tty: terminal to activate ldisc on
663  *
664  *      Set the TTY_LDISC flag when the line discipline can be called
665  *      again. Do neccessary wakeups for existing sleepers.
666  *
667  *      Note: nobody should set this bit except via this function. Clearing
668  *      directly is allowed.
669  */
670
671 static void tty_ldisc_enable(struct tty_struct *tty)
672 {
673         set_bit(TTY_LDISC, &tty->flags);
674         wake_up(&tty_ldisc_wait);
675 }
676         
677 /**
678  *      tty_set_ldisc           -       set line discipline
679  *      @tty: the terminal to set
680  *      @ldisc: the line discipline
681  *
682  *      Set the discipline of a tty line. Must be called from a process
683  *      context.
684  */
685  
686 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
687 {
688         int retval = 0;
689         struct tty_ldisc o_ldisc;
690         char buf[64];
691         int work;
692         unsigned long flags;
693         struct tty_ldisc *ld;
694         struct tty_struct *o_tty;
695
696         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
697                 return -EINVAL;
698
699 restart:
700
701         ld = tty_ldisc_get(ldisc);
702         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
703         /* Cyrus Durgin <cider@speakeasy.org> */
704         if (ld == NULL) {
705                 request_module("tty-ldisc-%d", ldisc);
706                 ld = tty_ldisc_get(ldisc);
707         }
708         if (ld == NULL)
709                 return -EINVAL;
710
711         /*
712          *      No more input please, we are switching. The new ldisc
713          *      will update this value in the ldisc open function
714          */
715
716         tty->receive_room = 0;
717
718         /*
719          *      Problem: What do we do if this blocks ?
720          */
721
722         tty_wait_until_sent(tty, 0);
723
724         if (tty->ldisc.num == ldisc) {
725                 tty_ldisc_put(ldisc);
726                 return 0;
727         }
728
729         o_ldisc = tty->ldisc;
730         o_tty = tty->link;
731
732         /*
733          *      Make sure we don't change while someone holds a
734          *      reference to the line discipline. The TTY_LDISC bit
735          *      prevents anyone taking a reference once it is clear.
736          *      We need the lock to avoid racing reference takers.
737          */
738
739         spin_lock_irqsave(&tty_ldisc_lock, flags);
740         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
741                 if(tty->ldisc.refcount) {
742                         /* Free the new ldisc we grabbed. Must drop the lock
743                            first. */
744                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
745                         tty_ldisc_put(ldisc);
746                         /*
747                          * There are several reasons we may be busy, including
748                          * random momentary I/O traffic. We must therefore
749                          * retry. We could distinguish between blocking ops
750                          * and retries if we made tty_ldisc_wait() smarter. That
751                          * is up for discussion.
752                          */
753                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
754                                 return -ERESTARTSYS;
755                         goto restart;
756                 }
757                 if(o_tty && o_tty->ldisc.refcount) {
758                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
759                         tty_ldisc_put(ldisc);
760                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
761                                 return -ERESTARTSYS;
762                         goto restart;
763                 }
764         }
765
766         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
767
768         if (!test_bit(TTY_LDISC, &tty->flags)) {
769                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
770                 tty_ldisc_put(ldisc);
771                 ld = tty_ldisc_ref_wait(tty);
772                 tty_ldisc_deref(ld);
773                 goto restart;
774         }
775
776         clear_bit(TTY_LDISC, &tty->flags);
777         clear_bit(TTY_DONT_FLIP, &tty->flags);
778         if (o_tty) {
779                 clear_bit(TTY_LDISC, &o_tty->flags);
780                 clear_bit(TTY_DONT_FLIP, &o_tty->flags);
781         }
782         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
783
784         /*
785          *      From this point on we know nobody has an ldisc
786          *      usage reference, nor can they obtain one until
787          *      we say so later on.
788          */
789
790         work = cancel_delayed_work(&tty->buf.work);
791         /*
792          * Wait for ->hangup_work and ->buf.work handlers to terminate
793          */
794          
795         flush_scheduled_work();
796         /* Shutdown the current discipline. */
797         if (tty->ldisc.close)
798                 (tty->ldisc.close)(tty);
799
800         /* Now set up the new line discipline. */
801         tty_ldisc_assign(tty, ld);
802         tty_set_termios_ldisc(tty, ldisc);
803         if (tty->ldisc.open)
804                 retval = (tty->ldisc.open)(tty);
805         if (retval < 0) {
806                 tty_ldisc_put(ldisc);
807                 /* There is an outstanding reference here so this is safe */
808                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
809                 tty_set_termios_ldisc(tty, tty->ldisc.num);
810                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
811                         tty_ldisc_put(o_ldisc.num);
812                         /* This driver is always present */
813                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
814                         tty_set_termios_ldisc(tty, N_TTY);
815                         if (tty->ldisc.open) {
816                                 int r = tty->ldisc.open(tty);
817
818                                 if (r < 0)
819                                         panic("Couldn't open N_TTY ldisc for "
820                                               "%s --- error %d.",
821                                               tty_name(tty, buf), r);
822                         }
823                 }
824         }
825         /* At this point we hold a reference to the new ldisc and a
826            a reference to the old ldisc. If we ended up flipping back
827            to the existing ldisc we have two references to it */
828         
829         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
830                 tty->driver->set_ldisc(tty);
831                 
832         tty_ldisc_put(o_ldisc.num);
833         
834         /*
835          *      Allow ldisc referencing to occur as soon as the driver
836          *      ldisc callback completes.
837          */
838          
839         tty_ldisc_enable(tty);
840         if (o_tty)
841                 tty_ldisc_enable(o_tty);
842         
843         /* Restart it in case no characters kick it off. Safe if
844            already running */
845         if (work)
846                 schedule_delayed_work(&tty->buf.work, 1);
847         return retval;
848 }
849
850 /*
851  * This routine returns a tty driver structure, given a device number
852  */
853 static struct tty_driver *get_tty_driver(dev_t device, int *index)
854 {
855         struct tty_driver *p;
856
857         list_for_each_entry(p, &tty_drivers, tty_drivers) {
858                 dev_t base = MKDEV(p->major, p->minor_start);
859                 if (device < base || device >= base + p->num)
860                         continue;
861                 *index = device - base;
862                 return p;
863         }
864         return NULL;
865 }
866
867 /*
868  * If we try to write to, or set the state of, a terminal and we're
869  * not in the foreground, send a SIGTTOU.  If the signal is blocked or
870  * ignored, go ahead and perform the operation.  (POSIX 7.2)
871  */
872 int tty_check_change(struct tty_struct * tty)
873 {
874         if (current->signal->tty != tty)
875                 return 0;
876         if (tty->pgrp <= 0) {
877                 printk(KERN_WARNING "tty_check_change: tty->pgrp <= 0!\n");
878                 return 0;
879         }
880         if (process_group(current) == tty->pgrp)
881                 return 0;
882         if (is_ignored(SIGTTOU))
883                 return 0;
884         if (is_orphaned_pgrp(process_group(current)))
885                 return -EIO;
886         (void) kill_pg(process_group(current), SIGTTOU, 1);
887         return -ERESTARTSYS;
888 }
889
890 EXPORT_SYMBOL(tty_check_change);
891
892 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
893                                 size_t count, loff_t *ppos)
894 {
895         return 0;
896 }
897
898 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
899                                  size_t count, loff_t *ppos)
900 {
901         return -EIO;
902 }
903
904 /* No kernel lock held - none needed ;) */
905 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
906 {
907         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
908 }
909
910 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
911                              unsigned int cmd, unsigned long arg)
912 {
913         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
914 }
915
916 static struct file_operations tty_fops = {
917         .llseek         = no_llseek,
918         .read           = tty_read,
919         .write          = tty_write,
920         .poll           = tty_poll,
921         .ioctl          = tty_ioctl,
922         .open           = tty_open,
923         .release        = tty_release,
924         .fasync         = tty_fasync,
925 };
926
927 #ifdef CONFIG_UNIX98_PTYS
928 static struct file_operations ptmx_fops = {
929         .llseek         = no_llseek,
930         .read           = tty_read,
931         .write          = tty_write,
932         .poll           = tty_poll,
933         .ioctl          = tty_ioctl,
934         .open           = ptmx_open,
935         .release        = tty_release,
936         .fasync         = tty_fasync,
937 };
938 #endif
939
940 static struct file_operations console_fops = {
941         .llseek         = no_llseek,
942         .read           = tty_read,
943         .write          = redirected_tty_write,
944         .poll           = tty_poll,
945         .ioctl          = tty_ioctl,
946         .open           = tty_open,
947         .release        = tty_release,
948         .fasync         = tty_fasync,
949 };
950
951 static struct file_operations hung_up_tty_fops = {
952         .llseek         = no_llseek,
953         .read           = hung_up_tty_read,
954         .write          = hung_up_tty_write,
955         .poll           = hung_up_tty_poll,
956         .ioctl          = hung_up_tty_ioctl,
957         .release        = tty_release,
958 };
959
960 static DEFINE_SPINLOCK(redirect_lock);
961 static struct file *redirect;
962
963 /**
964  *      tty_wakeup      -       request more data
965  *      @tty: terminal
966  *
967  *      Internal and external helper for wakeups of tty. This function
968  *      informs the line discipline if present that the driver is ready
969  *      to receive more output data.
970  */
971  
972 void tty_wakeup(struct tty_struct *tty)
973 {
974         struct tty_ldisc *ld;
975         
976         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
977                 ld = tty_ldisc_ref(tty);
978                 if(ld) {
979                         if(ld->write_wakeup)
980                                 ld->write_wakeup(tty);
981                         tty_ldisc_deref(ld);
982                 }
983         }
984         wake_up_interruptible(&tty->write_wait);
985 }
986
987 EXPORT_SYMBOL_GPL(tty_wakeup);
988
989 /**
990  *      tty_ldisc_flush -       flush line discipline queue
991  *      @tty: tty
992  *
993  *      Flush the line discipline queue (if any) for this tty. If there
994  *      is no line discipline active this is a no-op.
995  */
996  
997 void tty_ldisc_flush(struct tty_struct *tty)
998 {
999         struct tty_ldisc *ld = tty_ldisc_ref(tty);
1000         if(ld) {
1001                 if(ld->flush_buffer)
1002                         ld->flush_buffer(tty);
1003                 tty_ldisc_deref(ld);
1004         }
1005 }
1006
1007 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
1008         
1009 /*
1010  * This can be called by the "eventd" kernel thread.  That is process synchronous,
1011  * but doesn't hold any locks, so we need to make sure we have the appropriate
1012  * locks for what we're doing..
1013  */
1014 static void do_tty_hangup(void *data)
1015 {
1016         struct tty_struct *tty = (struct tty_struct *) data;
1017         struct file * cons_filp = NULL;
1018         struct file *filp, *f = NULL;
1019         struct task_struct *p;
1020         struct tty_ldisc *ld;
1021         int    closecount = 0, n;
1022
1023         if (!tty)
1024                 return;
1025
1026         /* inuse_filps is protected by the single kernel lock */
1027         lock_kernel();
1028
1029         spin_lock(&redirect_lock);
1030         if (redirect && redirect->private_data == tty) {
1031                 f = redirect;
1032                 redirect = NULL;
1033         }
1034         spin_unlock(&redirect_lock);
1035         
1036         check_tty_count(tty, "do_tty_hangup");
1037         file_list_lock();
1038         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1039         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1040                 if (filp->f_op->write == redirected_tty_write)
1041                         cons_filp = filp;
1042                 if (filp->f_op->write != tty_write)
1043                         continue;
1044                 closecount++;
1045                 tty_fasync(-1, filp, 0);        /* can't block */
1046                 filp->f_op = &hung_up_tty_fops;
1047         }
1048         file_list_unlock();
1049         
1050         /* FIXME! What are the locking issues here? This may me overdoing things..
1051          * this question is especially important now that we've removed the irqlock. */
1052
1053         ld = tty_ldisc_ref(tty);
1054         if(ld != NULL)  /* We may have no line discipline at this point */
1055         {
1056                 if (ld->flush_buffer)
1057                         ld->flush_buffer(tty);
1058                 if (tty->driver->flush_buffer)
1059                         tty->driver->flush_buffer(tty);
1060                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1061                     ld->write_wakeup)
1062                         ld->write_wakeup(tty);
1063                 if (ld->hangup)
1064                         ld->hangup(tty);
1065         }
1066
1067         /* FIXME: Once we trust the LDISC code better we can wait here for
1068            ldisc completion and fix the driver call race */
1069            
1070         wake_up_interruptible(&tty->write_wait);
1071         wake_up_interruptible(&tty->read_wait);
1072
1073         /*
1074          * Shutdown the current line discipline, and reset it to
1075          * N_TTY.
1076          */
1077         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1078         {
1079                 down(&tty->termios_sem);
1080                 *tty->termios = tty->driver->init_termios;
1081                 up(&tty->termios_sem);
1082         }
1083         
1084         /* Defer ldisc switch */
1085         /* tty_deferred_ldisc_switch(N_TTY);
1086         
1087           This should get done automatically when the port closes and
1088           tty_release is called */
1089         
1090         read_lock(&tasklist_lock);
1091         if (tty->session > 0) {
1092                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1093                         if (p->signal->tty == tty)
1094                                 p->signal->tty = NULL;
1095                         if (!p->signal->leader)
1096                                 continue;
1097                         group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1098                         group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1099                         if (tty->pgrp > 0)
1100                                 p->signal->tty_old_pgrp = tty->pgrp;
1101                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1102         }
1103         read_unlock(&tasklist_lock);
1104
1105         tty->flags = 0;
1106         tty->session = 0;
1107         tty->pgrp = -1;
1108         tty->ctrl_status = 0;
1109         /*
1110          *      If one of the devices matches a console pointer, we
1111          *      cannot just call hangup() because that will cause
1112          *      tty->count and state->count to go out of sync.
1113          *      So we just call close() the right number of times.
1114          */
1115         if (cons_filp) {
1116                 if (tty->driver->close)
1117                         for (n = 0; n < closecount; n++)
1118                                 tty->driver->close(tty, cons_filp);
1119         } else if (tty->driver->hangup)
1120                 (tty->driver->hangup)(tty);
1121                 
1122         /* We don't want to have driver/ldisc interactions beyond
1123            the ones we did here. The driver layer expects no
1124            calls after ->hangup() from the ldisc side. However we
1125            can't yet guarantee all that */
1126
1127         set_bit(TTY_HUPPED, &tty->flags);
1128         if (ld) {
1129                 tty_ldisc_enable(tty);
1130                 tty_ldisc_deref(ld);
1131         }
1132         unlock_kernel();
1133         if (f)
1134                 fput(f);
1135 }
1136
1137 void tty_hangup(struct tty_struct * tty)
1138 {
1139 #ifdef TTY_DEBUG_HANGUP
1140         char    buf[64];
1141         
1142         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1143 #endif
1144         schedule_work(&tty->hangup_work);
1145 }
1146
1147 EXPORT_SYMBOL(tty_hangup);
1148
1149 void tty_vhangup(struct tty_struct * tty)
1150 {
1151 #ifdef TTY_DEBUG_HANGUP
1152         char    buf[64];
1153
1154         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1155 #endif
1156         do_tty_hangup((void *) tty);
1157 }
1158 EXPORT_SYMBOL(tty_vhangup);
1159
1160 int tty_hung_up_p(struct file * filp)
1161 {
1162         return (filp->f_op == &hung_up_tty_fops);
1163 }
1164
1165 EXPORT_SYMBOL(tty_hung_up_p);
1166
1167 /*
1168  * This function is typically called only by the session leader, when
1169  * it wants to disassociate itself from its controlling tty.
1170  *
1171  * It performs the following functions:
1172  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1173  *      (2)  Clears the tty from being controlling the session
1174  *      (3)  Clears the controlling tty for all processes in the
1175  *              session group.
1176  *
1177  * The argument on_exit is set to 1 if called when a process is
1178  * exiting; it is 0 if called by the ioctl TIOCNOTTY.
1179  */
1180 void disassociate_ctty(int on_exit)
1181 {
1182         struct tty_struct *tty;
1183         struct task_struct *p;
1184         int tty_pgrp = -1;
1185
1186         lock_kernel();
1187
1188         mutex_lock(&tty_mutex);
1189         tty = current->signal->tty;
1190         if (tty) {
1191                 tty_pgrp = tty->pgrp;
1192                 mutex_unlock(&tty_mutex);
1193                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1194                         tty_vhangup(tty);
1195         } else {
1196                 if (current->signal->tty_old_pgrp) {
1197                         kill_pg(current->signal->tty_old_pgrp, SIGHUP, on_exit);
1198                         kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit);
1199                 }
1200                 mutex_unlock(&tty_mutex);
1201                 unlock_kernel();        
1202                 return;
1203         }
1204         if (tty_pgrp > 0) {
1205                 kill_pg(tty_pgrp, SIGHUP, on_exit);
1206                 if (!on_exit)
1207                         kill_pg(tty_pgrp, SIGCONT, on_exit);
1208         }
1209
1210         /* Must lock changes to tty_old_pgrp */
1211         mutex_lock(&tty_mutex);
1212         current->signal->tty_old_pgrp = 0;
1213         tty->session = 0;
1214         tty->pgrp = -1;
1215
1216         /* Now clear signal->tty under the lock */
1217         read_lock(&tasklist_lock);
1218         do_each_task_pid(current->signal->session, PIDTYPE_SID, p) {
1219                 p->signal->tty = NULL;
1220         } while_each_task_pid(current->signal->session, PIDTYPE_SID, p);
1221         read_unlock(&tasklist_lock);
1222         mutex_unlock(&tty_mutex);
1223         unlock_kernel();
1224 }
1225
1226 void stop_tty(struct tty_struct *tty)
1227 {
1228         if (tty->stopped)
1229                 return;
1230         tty->stopped = 1;
1231         if (tty->link && tty->link->packet) {
1232                 tty->ctrl_status &= ~TIOCPKT_START;
1233                 tty->ctrl_status |= TIOCPKT_STOP;
1234                 wake_up_interruptible(&tty->link->read_wait);
1235         }
1236         if (tty->driver->stop)
1237                 (tty->driver->stop)(tty);
1238 }
1239
1240 EXPORT_SYMBOL(stop_tty);
1241
1242 void start_tty(struct tty_struct *tty)
1243 {
1244         if (!tty->stopped || tty->flow_stopped)
1245                 return;
1246         tty->stopped = 0;
1247         if (tty->link && tty->link->packet) {
1248                 tty->ctrl_status &= ~TIOCPKT_STOP;
1249                 tty->ctrl_status |= TIOCPKT_START;
1250                 wake_up_interruptible(&tty->link->read_wait);
1251         }
1252         if (tty->driver->start)
1253                 (tty->driver->start)(tty);
1254
1255         /* If we have a running line discipline it may need kicking */
1256         tty_wakeup(tty);
1257         wake_up_interruptible(&tty->write_wait);
1258 }
1259
1260 EXPORT_SYMBOL(start_tty);
1261
1262 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1263                         loff_t *ppos)
1264 {
1265         int i;
1266         struct tty_struct * tty;
1267         struct inode *inode;
1268         struct tty_ldisc *ld;
1269
1270         tty = (struct tty_struct *)file->private_data;
1271         inode = file->f_dentry->d_inode;
1272         if (tty_paranoia_check(tty, inode, "tty_read"))
1273                 return -EIO;
1274         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1275                 return -EIO;
1276
1277         /* We want to wait for the line discipline to sort out in this
1278            situation */
1279         ld = tty_ldisc_ref_wait(tty);
1280         lock_kernel();
1281         if (ld->read)
1282                 i = (ld->read)(tty,file,buf,count);
1283         else
1284                 i = -EIO;
1285         tty_ldisc_deref(ld);
1286         unlock_kernel();
1287         if (i > 0)
1288                 inode->i_atime = current_fs_time(inode->i_sb);
1289         return i;
1290 }
1291
1292 /*
1293  * Split writes up in sane blocksizes to avoid
1294  * denial-of-service type attacks
1295  */
1296 static inline ssize_t do_tty_write(
1297         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1298         struct tty_struct *tty,
1299         struct file *file,
1300         const char __user *buf,
1301         size_t count)
1302 {
1303         ssize_t ret = 0, written = 0;
1304         unsigned int chunk;
1305         
1306         if (mutex_lock_interruptible(&tty->atomic_write_lock)) {
1307                 return -ERESTARTSYS;
1308         }
1309
1310         /*
1311          * We chunk up writes into a temporary buffer. This
1312          * simplifies low-level drivers immensely, since they
1313          * don't have locking issues and user mode accesses.
1314          *
1315          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1316          * big chunk-size..
1317          *
1318          * The default chunk-size is 2kB, because the NTTY
1319          * layer has problems with bigger chunks. It will
1320          * claim to be able to handle more characters than
1321          * it actually does.
1322          */
1323         chunk = 2048;
1324         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1325                 chunk = 65536;
1326         if (count < chunk)
1327                 chunk = count;
1328
1329         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1330         if (tty->write_cnt < chunk) {
1331                 unsigned char *buf;
1332
1333                 if (chunk < 1024)
1334                         chunk = 1024;
1335
1336                 buf = kmalloc(chunk, GFP_KERNEL);
1337                 if (!buf) {
1338                         mutex_unlock(&tty->atomic_write_lock);
1339                         return -ENOMEM;
1340                 }
1341                 kfree(tty->write_buf);
1342                 tty->write_cnt = chunk;
1343                 tty->write_buf = buf;
1344         }
1345
1346         /* Do the write .. */
1347         for (;;) {
1348                 size_t size = count;
1349                 if (size > chunk)
1350                         size = chunk;
1351                 ret = -EFAULT;
1352                 if (copy_from_user(tty->write_buf, buf, size))
1353                         break;
1354                 lock_kernel();
1355                 ret = write(tty, file, tty->write_buf, size);
1356                 unlock_kernel();
1357                 if (ret <= 0)
1358                         break;
1359                 written += ret;
1360                 buf += ret;
1361                 count -= ret;
1362                 if (!count)
1363                         break;
1364                 ret = -ERESTARTSYS;
1365                 if (signal_pending(current))
1366                         break;
1367                 cond_resched();
1368         }
1369         if (written) {
1370                 struct inode *inode = file->f_dentry->d_inode;
1371                 inode->i_mtime = current_fs_time(inode->i_sb);
1372                 ret = written;
1373         }
1374         mutex_unlock(&tty->atomic_write_lock);
1375         return ret;
1376 }
1377
1378
1379 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1380                          loff_t *ppos)
1381 {
1382         struct tty_struct * tty;
1383         struct inode *inode = file->f_dentry->d_inode;
1384         ssize_t ret;
1385         struct tty_ldisc *ld;
1386         
1387         tty = (struct tty_struct *)file->private_data;
1388         if (tty_paranoia_check(tty, inode, "tty_write"))
1389                 return -EIO;
1390         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1391                 return -EIO;
1392
1393         ld = tty_ldisc_ref_wait(tty);           
1394         if (!ld->write)
1395                 ret = -EIO;
1396         else
1397                 ret = do_tty_write(ld->write, tty, file, buf, count);
1398         tty_ldisc_deref(ld);
1399         return ret;
1400 }
1401
1402 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1403                          loff_t *ppos)
1404 {
1405         struct file *p = NULL;
1406
1407         spin_lock(&redirect_lock);
1408         if (redirect) {
1409                 get_file(redirect);
1410                 p = redirect;
1411         }
1412         spin_unlock(&redirect_lock);
1413
1414         if (p) {
1415                 ssize_t res;
1416                 res = vfs_write(p, buf, count, &p->f_pos);
1417                 fput(p);
1418                 return res;
1419         }
1420
1421         return tty_write(file, buf, count, ppos);
1422 }
1423
1424 static char ptychar[] = "pqrstuvwxyzabcde";
1425
1426 static inline void pty_line_name(struct tty_driver *driver, int index, char *p)
1427 {
1428         int i = index + driver->name_base;
1429         /* ->name is initialized to "ttyp", but "tty" is expected */
1430         sprintf(p, "%s%c%x",
1431                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1432                         ptychar[i >> 4 & 0xf], i & 0xf);
1433 }
1434
1435 static inline void tty_line_name(struct tty_driver *driver, int index, char *p)
1436 {
1437         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1438 }
1439
1440 /*
1441  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1442  * failed open.  The new code protects the open with a mutex, so it's
1443  * really quite straightforward.  The mutex locking can probably be
1444  * relaxed for the (most common) case of reopening a tty.
1445  */
1446 static int init_dev(struct tty_driver *driver, int idx,
1447         struct tty_struct **ret_tty)
1448 {
1449         struct tty_struct *tty, *o_tty;
1450         struct termios *tp, **tp_loc, *o_tp, **o_tp_loc;
1451         struct termios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
1452         int retval=0;
1453
1454         /* check whether we're reopening an existing tty */
1455         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1456                 tty = devpts_get_tty(idx);
1457                 if (tty && driver->subtype == PTY_TYPE_MASTER)
1458                         tty = tty->link;
1459         } else {
1460                 tty = driver->ttys[idx];
1461         }
1462         if (tty) goto fast_track;
1463
1464         /*
1465          * First time open is complex, especially for PTY devices.
1466          * This code guarantees that either everything succeeds and the
1467          * TTY is ready for operation, or else the table slots are vacated
1468          * and the allocated memory released.  (Except that the termios 
1469          * and locked termios may be retained.)
1470          */
1471
1472         if (!try_module_get(driver->owner)) {
1473                 retval = -ENODEV;
1474                 goto end_init;
1475         }
1476
1477         o_tty = NULL;
1478         tp = o_tp = NULL;
1479         ltp = o_ltp = NULL;
1480
1481         tty = alloc_tty_struct();
1482         if(!tty)
1483                 goto fail_no_mem;
1484         initialize_tty_struct(tty);
1485         tty->driver = driver;
1486         tty->index = idx;
1487         tty_line_name(driver, idx, tty->name);
1488
1489         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1490                 tp_loc = &tty->termios;
1491                 ltp_loc = &tty->termios_locked;
1492         } else {
1493                 tp_loc = &driver->termios[idx];
1494                 ltp_loc = &driver->termios_locked[idx];
1495         }
1496
1497         if (!*tp_loc) {
1498                 tp = (struct termios *) kmalloc(sizeof(struct termios),
1499                                                 GFP_KERNEL);
1500                 if (!tp)
1501                         goto free_mem_out;
1502                 *tp = driver->init_termios;
1503         }
1504
1505         if (!*ltp_loc) {
1506                 ltp = (struct termios *) kmalloc(sizeof(struct termios),
1507                                                  GFP_KERNEL);
1508                 if (!ltp)
1509                         goto free_mem_out;
1510                 memset(ltp, 0, sizeof(struct termios));
1511         }
1512
1513         if (driver->type == TTY_DRIVER_TYPE_PTY) {
1514                 o_tty = alloc_tty_struct();
1515                 if (!o_tty)
1516                         goto free_mem_out;
1517                 initialize_tty_struct(o_tty);
1518                 o_tty->driver = driver->other;
1519                 o_tty->index = idx;
1520                 tty_line_name(driver->other, idx, o_tty->name);
1521
1522                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1523                         o_tp_loc = &o_tty->termios;
1524                         o_ltp_loc = &o_tty->termios_locked;
1525                 } else {
1526                         o_tp_loc = &driver->other->termios[idx];
1527                         o_ltp_loc = &driver->other->termios_locked[idx];
1528                 }
1529
1530                 if (!*o_tp_loc) {
1531                         o_tp = (struct termios *)
1532                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1533                         if (!o_tp)
1534                                 goto free_mem_out;
1535                         *o_tp = driver->other->init_termios;
1536                 }
1537
1538                 if (!*o_ltp_loc) {
1539                         o_ltp = (struct termios *)
1540                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1541                         if (!o_ltp)
1542                                 goto free_mem_out;
1543                         memset(o_ltp, 0, sizeof(struct termios));
1544                 }
1545
1546                 /*
1547                  * Everything allocated ... set up the o_tty structure.
1548                  */
1549                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
1550                         driver->other->ttys[idx] = o_tty;
1551                 }
1552                 if (!*o_tp_loc)
1553                         *o_tp_loc = o_tp;
1554                 if (!*o_ltp_loc)
1555                         *o_ltp_loc = o_ltp;
1556                 o_tty->termios = *o_tp_loc;
1557                 o_tty->termios_locked = *o_ltp_loc;
1558                 driver->other->refcount++;
1559                 if (driver->subtype == PTY_TYPE_MASTER)
1560                         o_tty->count++;
1561
1562                 /* Establish the links in both directions */
1563                 tty->link   = o_tty;
1564                 o_tty->link = tty;
1565         }
1566
1567         /* 
1568          * All structures have been allocated, so now we install them.
1569          * Failures after this point use release_mem to clean up, so 
1570          * there's no need to null out the local pointers.
1571          */
1572         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1573                 driver->ttys[idx] = tty;
1574         }
1575         
1576         if (!*tp_loc)
1577                 *tp_loc = tp;
1578         if (!*ltp_loc)
1579                 *ltp_loc = ltp;
1580         tty->termios = *tp_loc;
1581         tty->termios_locked = *ltp_loc;
1582         driver->refcount++;
1583         tty->count++;
1584
1585         /* 
1586          * Structures all installed ... call the ldisc open routines.
1587          * If we fail here just call release_mem to clean up.  No need
1588          * to decrement the use counts, as release_mem doesn't care.
1589          */
1590
1591         if (tty->ldisc.open) {
1592                 retval = (tty->ldisc.open)(tty);
1593                 if (retval)
1594                         goto release_mem_out;
1595         }
1596         if (o_tty && o_tty->ldisc.open) {
1597                 retval = (o_tty->ldisc.open)(o_tty);
1598                 if (retval) {
1599                         if (tty->ldisc.close)
1600                                 (tty->ldisc.close)(tty);
1601                         goto release_mem_out;
1602                 }
1603                 tty_ldisc_enable(o_tty);
1604         }
1605         tty_ldisc_enable(tty);
1606         goto success;
1607
1608         /*
1609          * This fast open can be used if the tty is already open.
1610          * No memory is allocated, and the only failures are from
1611          * attempting to open a closing tty or attempting multiple
1612          * opens on a pty master.
1613          */
1614 fast_track:
1615         if (test_bit(TTY_CLOSING, &tty->flags)) {
1616                 retval = -EIO;
1617                 goto end_init;
1618         }
1619         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1620             driver->subtype == PTY_TYPE_MASTER) {
1621                 /*
1622                  * special case for PTY masters: only one open permitted, 
1623                  * and the slave side open count is incremented as well.
1624                  */
1625                 if (tty->count) {
1626                         retval = -EIO;
1627                         goto end_init;
1628                 }
1629                 tty->link->count++;
1630         }
1631         tty->count++;
1632         tty->driver = driver; /* N.B. why do this every time?? */
1633
1634         /* FIXME */
1635         if(!test_bit(TTY_LDISC, &tty->flags))
1636                 printk(KERN_ERR "init_dev but no ldisc\n");
1637 success:
1638         *ret_tty = tty;
1639         
1640         /* All paths come through here to release the mutex */
1641 end_init:
1642         return retval;
1643
1644         /* Release locally allocated memory ... nothing placed in slots */
1645 free_mem_out:
1646         kfree(o_tp);
1647         if (o_tty)
1648                 free_tty_struct(o_tty);
1649         kfree(ltp);
1650         kfree(tp);
1651         free_tty_struct(tty);
1652
1653 fail_no_mem:
1654         module_put(driver->owner);
1655         retval = -ENOMEM;
1656         goto end_init;
1657
1658         /* call the tty release_mem routine to clean out this slot */
1659 release_mem_out:
1660         printk(KERN_INFO "init_dev: ldisc open failed, "
1661                          "clearing slot %d\n", idx);
1662         release_mem(tty, idx);
1663         goto end_init;
1664 }
1665
1666 /*
1667  * Releases memory associated with a tty structure, and clears out the
1668  * driver table slots.
1669  */
1670 static void release_mem(struct tty_struct *tty, int idx)
1671 {
1672         struct tty_struct *o_tty;
1673         struct termios *tp;
1674         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
1675
1676         if ((o_tty = tty->link) != NULL) {
1677                 if (!devpts)
1678                         o_tty->driver->ttys[idx] = NULL;
1679                 if (o_tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1680                         tp = o_tty->termios;
1681                         if (!devpts)
1682                                 o_tty->driver->termios[idx] = NULL;
1683                         kfree(tp);
1684
1685                         tp = o_tty->termios_locked;
1686                         if (!devpts)
1687                                 o_tty->driver->termios_locked[idx] = NULL;
1688                         kfree(tp);
1689                 }
1690                 o_tty->magic = 0;
1691                 o_tty->driver->refcount--;
1692                 file_list_lock();
1693                 list_del_init(&o_tty->tty_files);
1694                 file_list_unlock();
1695                 free_tty_struct(o_tty);
1696         }
1697
1698         if (!devpts)
1699                 tty->driver->ttys[idx] = NULL;
1700         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1701                 tp = tty->termios;
1702                 if (!devpts)
1703                         tty->driver->termios[idx] = NULL;
1704                 kfree(tp);
1705
1706                 tp = tty->termios_locked;
1707                 if (!devpts)
1708                         tty->driver->termios_locked[idx] = NULL;
1709                 kfree(tp);
1710         }
1711
1712         tty->magic = 0;
1713         tty->driver->refcount--;
1714         file_list_lock();
1715         list_del_init(&tty->tty_files);
1716         file_list_unlock();
1717         module_put(tty->driver->owner);
1718         free_tty_struct(tty);
1719 }
1720
1721 /*
1722  * Even releasing the tty structures is a tricky business.. We have
1723  * to be very careful that the structures are all released at the
1724  * same time, as interrupts might otherwise get the wrong pointers.
1725  *
1726  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1727  * lead to double frees or releasing memory still in use.
1728  */
1729 static void release_dev(struct file * filp)
1730 {
1731         struct tty_struct *tty, *o_tty;
1732         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1733         int     devpts_master, devpts;
1734         int     idx;
1735         char    buf[64];
1736         unsigned long flags;
1737         
1738         tty = (struct tty_struct *)filp->private_data;
1739         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "release_dev"))
1740                 return;
1741
1742         check_tty_count(tty, "release_dev");
1743
1744         tty_fasync(-1, filp, 0);
1745
1746         idx = tty->index;
1747         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1748                       tty->driver->subtype == PTY_TYPE_MASTER);
1749         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1750         devpts_master = pty_master && devpts;
1751         o_tty = tty->link;
1752
1753 #ifdef TTY_PARANOIA_CHECK
1754         if (idx < 0 || idx >= tty->driver->num) {
1755                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
1756                                   "free (%s)\n", tty->name);
1757                 return;
1758         }
1759         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1760                 if (tty != tty->driver->ttys[idx]) {
1761                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
1762                                "for (%s)\n", idx, tty->name);
1763                         return;
1764                 }
1765                 if (tty->termios != tty->driver->termios[idx]) {
1766                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
1767                                "for (%s)\n",
1768                                idx, tty->name);
1769                         return;
1770                 }
1771                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
1772                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
1773                                "termios_locked for (%s)\n",
1774                                idx, tty->name);
1775                         return;
1776                 }
1777         }
1778 #endif
1779
1780 #ifdef TTY_DEBUG_HANGUP
1781         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
1782                tty_name(tty, buf), tty->count);
1783 #endif
1784
1785 #ifdef TTY_PARANOIA_CHECK
1786         if (tty->driver->other &&
1787              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1788                 if (o_tty != tty->driver->other->ttys[idx]) {
1789                         printk(KERN_DEBUG "release_dev: other->table[%d] "
1790                                           "not o_tty for (%s)\n",
1791                                idx, tty->name);
1792                         return;
1793                 }
1794                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1795                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
1796                                           "not o_termios for (%s)\n",
1797                                idx, tty->name);
1798                         return;
1799                 }
1800                 if (o_tty->termios_locked != 
1801                       tty->driver->other->termios_locked[idx]) {
1802                         printk(KERN_DEBUG "release_dev: other->termios_locked["
1803                                           "%d] not o_termios_locked for (%s)\n",
1804                                idx, tty->name);
1805                         return;
1806                 }
1807                 if (o_tty->link != tty) {
1808                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
1809                         return;
1810                 }
1811         }
1812 #endif
1813         if (tty->driver->close)
1814                 tty->driver->close(tty, filp);
1815
1816         /*
1817          * Sanity check: if tty->count is going to zero, there shouldn't be
1818          * any waiters on tty->read_wait or tty->write_wait.  We test the
1819          * wait queues and kick everyone out _before_ actually starting to
1820          * close.  This ensures that we won't block while releasing the tty
1821          * structure.
1822          *
1823          * The test for the o_tty closing is necessary, since the master and
1824          * slave sides may close in any order.  If the slave side closes out
1825          * first, its count will be one, since the master side holds an open.
1826          * Thus this test wouldn't be triggered at the time the slave closes,
1827          * so we do it now.
1828          *
1829          * Note that it's possible for the tty to be opened again while we're
1830          * flushing out waiters.  By recalculating the closing flags before
1831          * each iteration we avoid any problems.
1832          */
1833         while (1) {
1834                 /* Guard against races with tty->count changes elsewhere and
1835                    opens on /dev/tty */
1836                    
1837                 mutex_lock(&tty_mutex);
1838                 tty_closing = tty->count <= 1;
1839                 o_tty_closing = o_tty &&
1840                         (o_tty->count <= (pty_master ? 1 : 0));
1841                 do_sleep = 0;
1842
1843                 if (tty_closing) {
1844                         if (waitqueue_active(&tty->read_wait)) {
1845                                 wake_up(&tty->read_wait);
1846                                 do_sleep++;
1847                         }
1848                         if (waitqueue_active(&tty->write_wait)) {
1849                                 wake_up(&tty->write_wait);
1850                                 do_sleep++;
1851                         }
1852                 }
1853                 if (o_tty_closing) {
1854                         if (waitqueue_active(&o_tty->read_wait)) {
1855                                 wake_up(&o_tty->read_wait);
1856                                 do_sleep++;
1857                         }
1858                         if (waitqueue_active(&o_tty->write_wait)) {
1859                                 wake_up(&o_tty->write_wait);
1860                                 do_sleep++;
1861                         }
1862                 }
1863                 if (!do_sleep)
1864                         break;
1865
1866                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
1867                                     "active!\n", tty_name(tty, buf));
1868                 mutex_unlock(&tty_mutex);
1869                 schedule();
1870         }       
1871
1872         /*
1873          * The closing flags are now consistent with the open counts on 
1874          * both sides, and we've completed the last operation that could 
1875          * block, so it's safe to proceed with closing.
1876          */
1877         if (pty_master) {
1878                 if (--o_tty->count < 0) {
1879                         printk(KERN_WARNING "release_dev: bad pty slave count "
1880                                             "(%d) for %s\n",
1881                                o_tty->count, tty_name(o_tty, buf));
1882                         o_tty->count = 0;
1883                 }
1884         }
1885         if (--tty->count < 0) {
1886                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
1887                        tty->count, tty_name(tty, buf));
1888                 tty->count = 0;
1889         }
1890         
1891         /*
1892          * We've decremented tty->count, so we need to remove this file
1893          * descriptor off the tty->tty_files list; this serves two
1894          * purposes:
1895          *  - check_tty_count sees the correct number of file descriptors
1896          *    associated with this tty.
1897          *  - do_tty_hangup no longer sees this file descriptor as
1898          *    something that needs to be handled for hangups.
1899          */
1900         file_kill(filp);
1901         filp->private_data = NULL;
1902
1903         /*
1904          * Perform some housekeeping before deciding whether to return.
1905          *
1906          * Set the TTY_CLOSING flag if this was the last open.  In the
1907          * case of a pty we may have to wait around for the other side
1908          * to close, and TTY_CLOSING makes sure we can't be reopened.
1909          */
1910         if(tty_closing)
1911                 set_bit(TTY_CLOSING, &tty->flags);
1912         if(o_tty_closing)
1913                 set_bit(TTY_CLOSING, &o_tty->flags);
1914
1915         /*
1916          * If _either_ side is closing, make sure there aren't any
1917          * processes that still think tty or o_tty is their controlling
1918          * tty.
1919          */
1920         if (tty_closing || o_tty_closing) {
1921                 struct task_struct *p;
1922
1923                 read_lock(&tasklist_lock);
1924                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1925                         p->signal->tty = NULL;
1926                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1927                 if (o_tty)
1928                         do_each_task_pid(o_tty->session, PIDTYPE_SID, p) {
1929                                 p->signal->tty = NULL;
1930                         } while_each_task_pid(o_tty->session, PIDTYPE_SID, p);
1931                 read_unlock(&tasklist_lock);
1932         }
1933
1934         mutex_unlock(&tty_mutex);
1935
1936         /* check whether both sides are closing ... */
1937         if (!tty_closing || (o_tty && !o_tty_closing))
1938                 return;
1939         
1940 #ifdef TTY_DEBUG_HANGUP
1941         printk(KERN_DEBUG "freeing tty structure...");
1942 #endif
1943         /*
1944          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
1945          * kill any delayed work. As this is the final close it does not
1946          * race with the set_ldisc code path.
1947          */
1948         clear_bit(TTY_LDISC, &tty->flags);
1949         clear_bit(TTY_DONT_FLIP, &tty->flags);
1950         cancel_delayed_work(&tty->buf.work);
1951
1952         /*
1953          * Wait for ->hangup_work and ->buf.work handlers to terminate
1954          */
1955          
1956         flush_scheduled_work();
1957         
1958         /*
1959          * Wait for any short term users (we know they are just driver
1960          * side waiters as the file is closing so user count on the file
1961          * side is zero.
1962          */
1963         spin_lock_irqsave(&tty_ldisc_lock, flags);
1964         while(tty->ldisc.refcount)
1965         {
1966                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1967                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
1968                 spin_lock_irqsave(&tty_ldisc_lock, flags);
1969         }
1970         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1971         /*
1972          * Shutdown the current line discipline, and reset it to N_TTY.
1973          * N.B. why reset ldisc when we're releasing the memory??
1974          *
1975          * FIXME: this MUST get fixed for the new reflocking
1976          */
1977         if (tty->ldisc.close)
1978                 (tty->ldisc.close)(tty);
1979         tty_ldisc_put(tty->ldisc.num);
1980         
1981         /*
1982          *      Switch the line discipline back
1983          */
1984         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1985         tty_set_termios_ldisc(tty,N_TTY); 
1986         if (o_tty) {
1987                 /* FIXME: could o_tty be in setldisc here ? */
1988                 clear_bit(TTY_LDISC, &o_tty->flags);
1989                 if (o_tty->ldisc.close)
1990                         (o_tty->ldisc.close)(o_tty);
1991                 tty_ldisc_put(o_tty->ldisc.num);
1992                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
1993                 tty_set_termios_ldisc(o_tty,N_TTY); 
1994         }
1995         /*
1996          * The release_mem function takes care of the details of clearing
1997          * the slots and preserving the termios structure.
1998          */
1999         release_mem(tty, idx);
2000
2001 #ifdef CONFIG_UNIX98_PTYS
2002         /* Make this pty number available for reallocation */
2003         if (devpts) {
2004                 down(&allocated_ptys_lock);
2005                 idr_remove(&allocated_ptys, idx);
2006                 up(&allocated_ptys_lock);
2007         }
2008 #endif
2009
2010 }
2011
2012 /*
2013  * tty_open and tty_release keep up the tty count that contains the
2014  * number of opens done on a tty. We cannot use the inode-count, as
2015  * different inodes might point to the same tty.
2016  *
2017  * Open-counting is needed for pty masters, as well as for keeping
2018  * track of serial lines: DTR is dropped when the last close happens.
2019  * (This is not done solely through tty->count, now.  - Ted 1/27/92)
2020  *
2021  * The termios state of a pty is reset on first open so that
2022  * settings don't persist across reuse.
2023  */
2024 static int tty_open(struct inode * inode, struct file * filp)
2025 {
2026         struct tty_struct *tty;
2027         int noctty, retval;
2028         struct tty_driver *driver;
2029         int index;
2030         dev_t device = inode->i_rdev;
2031         unsigned short saved_flags = filp->f_flags;
2032
2033         nonseekable_open(inode, filp);
2034         
2035 retry_open:
2036         noctty = filp->f_flags & O_NOCTTY;
2037         index  = -1;
2038         retval = 0;
2039         
2040         mutex_lock(&tty_mutex);
2041
2042         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2043                 if (!current->signal->tty) {
2044                         mutex_unlock(&tty_mutex);
2045                         return -ENXIO;
2046                 }
2047                 driver = current->signal->tty->driver;
2048                 index = current->signal->tty->index;
2049                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2050                 /* noctty = 1; */
2051                 goto got_driver;
2052         }
2053 #ifdef CONFIG_VT
2054         if (device == MKDEV(TTY_MAJOR,0)) {
2055                 extern struct tty_driver *console_driver;
2056                 driver = console_driver;
2057                 index = fg_console;
2058                 noctty = 1;
2059                 goto got_driver;
2060         }
2061 #endif
2062         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2063                 driver = console_device(&index);
2064                 if (driver) {
2065                         /* Don't let /dev/console block */
2066                         filp->f_flags |= O_NONBLOCK;
2067                         noctty = 1;
2068                         goto got_driver;
2069                 }
2070                 mutex_unlock(&tty_mutex);
2071                 return -ENODEV;
2072         }
2073
2074         driver = get_tty_driver(device, &index);
2075         if (!driver) {
2076                 mutex_unlock(&tty_mutex);
2077                 return -ENODEV;
2078         }
2079 got_driver:
2080         retval = init_dev(driver, index, &tty);
2081         mutex_unlock(&tty_mutex);
2082         if (retval)
2083                 return retval;
2084
2085         filp->private_data = tty;
2086         file_move(filp, &tty->tty_files);
2087         check_tty_count(tty, "tty_open");
2088         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2089             tty->driver->subtype == PTY_TYPE_MASTER)
2090                 noctty = 1;
2091 #ifdef TTY_DEBUG_HANGUP
2092         printk(KERN_DEBUG "opening %s...", tty->name);
2093 #endif
2094         if (!retval) {
2095                 if (tty->driver->open)
2096                         retval = tty->driver->open(tty, filp);
2097                 else
2098                         retval = -ENODEV;
2099         }
2100         filp->f_flags = saved_flags;
2101
2102         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2103                 retval = -EBUSY;
2104
2105         if (retval) {
2106 #ifdef TTY_DEBUG_HANGUP
2107                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2108                        tty->name);
2109 #endif
2110                 release_dev(filp);
2111                 if (retval != -ERESTARTSYS)
2112                         return retval;
2113                 if (signal_pending(current))
2114                         return retval;
2115                 schedule();
2116                 /*
2117                  * Need to reset f_op in case a hangup happened.
2118                  */
2119                 if (filp->f_op == &hung_up_tty_fops)
2120                         filp->f_op = &tty_fops;
2121                 goto retry_open;
2122         }
2123         if (!noctty &&
2124             current->signal->leader &&
2125             !current->signal->tty &&
2126             tty->session == 0) {
2127                 task_lock(current);
2128                 current->signal->tty = tty;
2129                 task_unlock(current);
2130                 current->signal->tty_old_pgrp = 0;
2131                 tty->session = current->signal->session;
2132                 tty->pgrp = process_group(current);
2133         }
2134         return 0;
2135 }
2136
2137 #ifdef CONFIG_UNIX98_PTYS
2138 static int ptmx_open(struct inode * inode, struct file * filp)
2139 {
2140         struct tty_struct *tty;
2141         int retval;
2142         int index;
2143         int idr_ret;
2144
2145         nonseekable_open(inode, filp);
2146
2147         /* find a device that is not in use. */
2148         down(&allocated_ptys_lock);
2149         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2150                 up(&allocated_ptys_lock);
2151                 return -ENOMEM;
2152         }
2153         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2154         if (idr_ret < 0) {
2155                 up(&allocated_ptys_lock);
2156                 if (idr_ret == -EAGAIN)
2157                         return -ENOMEM;
2158                 return -EIO;
2159         }
2160         if (index >= pty_limit) {
2161                 idr_remove(&allocated_ptys, index);
2162                 up(&allocated_ptys_lock);
2163                 return -EIO;
2164         }
2165         up(&allocated_ptys_lock);
2166
2167         mutex_lock(&tty_mutex);
2168         retval = init_dev(ptm_driver, index, &tty);
2169         mutex_unlock(&tty_mutex);
2170         
2171         if (retval)
2172                 goto out;
2173
2174         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2175         filp->private_data = tty;
2176         file_move(filp, &tty->tty_files);
2177
2178         retval = -ENOMEM;
2179         if (devpts_pty_new(tty->link))
2180                 goto out1;
2181
2182         check_tty_count(tty, "tty_open");
2183         retval = ptm_driver->open(tty, filp);
2184         if (!retval)
2185                 return 0;
2186 out1:
2187         release_dev(filp);
2188 out:
2189         down(&allocated_ptys_lock);
2190         idr_remove(&allocated_ptys, index);
2191         up(&allocated_ptys_lock);
2192         return retval;
2193 }
2194 #endif
2195
2196 static int tty_release(struct inode * inode, struct file * filp)
2197 {
2198         lock_kernel();
2199         release_dev(filp);
2200         unlock_kernel();
2201         return 0;
2202 }
2203
2204 /* No kernel lock held - fine */
2205 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2206 {
2207         struct tty_struct * tty;
2208         struct tty_ldisc *ld;
2209         int ret = 0;
2210
2211         tty = (struct tty_struct *)filp->private_data;
2212         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_poll"))
2213                 return 0;
2214                 
2215         ld = tty_ldisc_ref_wait(tty);
2216         if (ld->poll)
2217                 ret = (ld->poll)(tty, filp, wait);
2218         tty_ldisc_deref(ld);
2219         return ret;
2220 }
2221
2222 static int tty_fasync(int fd, struct file * filp, int on)
2223 {
2224         struct tty_struct * tty;
2225         int retval;
2226
2227         tty = (struct tty_struct *)filp->private_data;
2228         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_fasync"))
2229                 return 0;
2230         
2231         retval = fasync_helper(fd, filp, on, &tty->fasync);
2232         if (retval <= 0)
2233                 return retval;
2234
2235         if (on) {
2236                 if (!waitqueue_active(&tty->read_wait))
2237                         tty->minimum_to_wake = 1;
2238                 retval = f_setown(filp, (-tty->pgrp) ? : current->pid, 0);
2239                 if (retval)
2240                         return retval;
2241         } else {
2242                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2243                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2244         }
2245         return 0;
2246 }
2247
2248 static int tiocsti(struct tty_struct *tty, char __user *p)
2249 {
2250         char ch, mbz = 0;
2251         struct tty_ldisc *ld;
2252         
2253         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2254                 return -EPERM;
2255         if (get_user(ch, p))
2256                 return -EFAULT;
2257         ld = tty_ldisc_ref_wait(tty);
2258         ld->receive_buf(tty, &ch, &mbz, 1);
2259         tty_ldisc_deref(ld);
2260         return 0;
2261 }
2262
2263 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2264 {
2265         if (copy_to_user(arg, &tty->winsize, sizeof(*arg)))
2266                 return -EFAULT;
2267         return 0;
2268 }
2269
2270 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2271         struct winsize __user * arg)
2272 {
2273         struct winsize tmp_ws;
2274
2275         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2276                 return -EFAULT;
2277         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2278                 return 0;
2279 #ifdef CONFIG_VT
2280         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2281                 int rc;
2282
2283                 acquire_console_sem();
2284                 rc = vc_resize(tty->driver_data, tmp_ws.ws_col, tmp_ws.ws_row);
2285                 release_console_sem();
2286                 if (rc)
2287                         return -ENXIO;
2288         }
2289 #endif
2290         if (tty->pgrp > 0)
2291                 kill_pg(tty->pgrp, SIGWINCH, 1);
2292         if ((real_tty->pgrp != tty->pgrp) && (real_tty->pgrp > 0))
2293                 kill_pg(real_tty->pgrp, SIGWINCH, 1);
2294         tty->winsize = tmp_ws;
2295         real_tty->winsize = tmp_ws;
2296         return 0;
2297 }
2298
2299 static int tioccons(struct file *file)
2300 {
2301         if (!capable(CAP_SYS_ADMIN))
2302                 return -EPERM;
2303         if (file->f_op->write == redirected_tty_write) {
2304                 struct file *f;
2305                 spin_lock(&redirect_lock);
2306                 f = redirect;
2307                 redirect = NULL;
2308                 spin_unlock(&redirect_lock);
2309                 if (f)
2310                         fput(f);
2311                 return 0;
2312         }
2313         spin_lock(&redirect_lock);
2314         if (redirect) {
2315                 spin_unlock(&redirect_lock);
2316                 return -EBUSY;
2317         }
2318         get_file(file);
2319         redirect = file;
2320         spin_unlock(&redirect_lock);
2321         return 0;
2322 }
2323
2324
2325 static int fionbio(struct file *file, int __user *p)
2326 {
2327         int nonblock;
2328
2329         if (get_user(nonblock, p))
2330                 return -EFAULT;
2331
2332         if (nonblock)
2333                 file->f_flags |= O_NONBLOCK;
2334         else
2335                 file->f_flags &= ~O_NONBLOCK;
2336         return 0;
2337 }
2338
2339 static int tiocsctty(struct tty_struct *tty, int arg)
2340 {
2341         task_t *p;
2342
2343         if (current->signal->leader &&
2344             (current->signal->session == tty->session))
2345                 return 0;
2346         /*
2347          * The process must be a session leader and
2348          * not have a controlling tty already.
2349          */
2350         if (!current->signal->leader || current->signal->tty)
2351                 return -EPERM;
2352         if (tty->session > 0) {
2353                 /*
2354                  * This tty is already the controlling
2355                  * tty for another session group!
2356                  */
2357                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
2358                         /*
2359                          * Steal it away
2360                          */
2361
2362                         read_lock(&tasklist_lock);
2363                         do_each_task_pid(tty->session, PIDTYPE_SID, p) {
2364                                 p->signal->tty = NULL;
2365                         } while_each_task_pid(tty->session, PIDTYPE_SID, p);
2366                         read_unlock(&tasklist_lock);
2367                 } else
2368                         return -EPERM;
2369         }
2370         task_lock(current);
2371         current->signal->tty = tty;
2372         task_unlock(current);
2373         current->signal->tty_old_pgrp = 0;
2374         tty->session = current->signal->session;
2375         tty->pgrp = process_group(current);
2376         return 0;
2377 }
2378
2379 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2380 {
2381         /*
2382          * (tty == real_tty) is a cheap way of
2383          * testing if the tty is NOT a master pty.
2384          */
2385         if (tty == real_tty && current->signal->tty != real_tty)
2386                 return -ENOTTY;
2387         return put_user(real_tty->pgrp, p);
2388 }
2389
2390 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2391 {
2392         pid_t pgrp;
2393         int retval = tty_check_change(real_tty);
2394
2395         if (retval == -EIO)
2396                 return -ENOTTY;
2397         if (retval)
2398                 return retval;
2399         if (!current->signal->tty ||
2400             (current->signal->tty != real_tty) ||
2401             (real_tty->session != current->signal->session))
2402                 return -ENOTTY;
2403         if (get_user(pgrp, p))
2404                 return -EFAULT;
2405         if (pgrp < 0)
2406                 return -EINVAL;
2407         if (session_of_pgrp(pgrp) != current->signal->session)
2408                 return -EPERM;
2409         real_tty->pgrp = pgrp;
2410         return 0;
2411 }
2412
2413 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2414 {
2415         /*
2416          * (tty == real_tty) is a cheap way of
2417          * testing if the tty is NOT a master pty.
2418         */
2419         if (tty == real_tty && current->signal->tty != real_tty)
2420                 return -ENOTTY;
2421         if (real_tty->session <= 0)
2422                 return -ENOTTY;
2423         return put_user(real_tty->session, p);
2424 }
2425
2426 static int tiocsetd(struct tty_struct *tty, int __user *p)
2427 {
2428         int ldisc;
2429
2430         if (get_user(ldisc, p))
2431                 return -EFAULT;
2432         return tty_set_ldisc(tty, ldisc);
2433 }
2434
2435 static int send_break(struct tty_struct *tty, unsigned int duration)
2436 {
2437         tty->driver->break_ctl(tty, -1);
2438         if (!signal_pending(current)) {
2439                 msleep_interruptible(duration);
2440         }
2441         tty->driver->break_ctl(tty, 0);
2442         if (signal_pending(current))
2443                 return -EINTR;
2444         return 0;
2445 }
2446
2447 static int
2448 tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
2449 {
2450         int retval = -EINVAL;
2451
2452         if (tty->driver->tiocmget) {
2453                 retval = tty->driver->tiocmget(tty, file);
2454
2455                 if (retval >= 0)
2456                         retval = put_user(retval, p);
2457         }
2458         return retval;
2459 }
2460
2461 static int
2462 tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
2463              unsigned __user *p)
2464 {
2465         int retval = -EINVAL;
2466
2467         if (tty->driver->tiocmset) {
2468                 unsigned int set, clear, val;
2469
2470                 retval = get_user(val, p);
2471                 if (retval)
2472                         return retval;
2473
2474                 set = clear = 0;
2475                 switch (cmd) {
2476                 case TIOCMBIS:
2477                         set = val;
2478                         break;
2479                 case TIOCMBIC:
2480                         clear = val;
2481                         break;
2482                 case TIOCMSET:
2483                         set = val;
2484                         clear = ~val;
2485                         break;
2486                 }
2487
2488                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2489                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2490
2491                 retval = tty->driver->tiocmset(tty, file, set, clear);
2492         }
2493         return retval;
2494 }
2495
2496 /*
2497  * Split this up, as gcc can choke on it otherwise..
2498  */
2499 int tty_ioctl(struct inode * inode, struct file * file,
2500               unsigned int cmd, unsigned long arg)
2501 {
2502         struct tty_struct *tty, *real_tty;
2503         void __user *p = (void __user *)arg;
2504         int retval;
2505         struct tty_ldisc *ld;
2506         
2507         tty = (struct tty_struct *)file->private_data;
2508         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2509                 return -EINVAL;
2510
2511         real_tty = tty;
2512         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2513             tty->driver->subtype == PTY_TYPE_MASTER)
2514                 real_tty = tty->link;
2515
2516         /*
2517          * Break handling by driver
2518          */
2519         if (!tty->driver->break_ctl) {
2520                 switch(cmd) {
2521                 case TIOCSBRK:
2522                 case TIOCCBRK:
2523                         if (tty->driver->ioctl)
2524                                 return tty->driver->ioctl(tty, file, cmd, arg);
2525                         return -EINVAL;
2526                         
2527                 /* These two ioctl's always return success; even if */
2528                 /* the driver doesn't support them. */
2529                 case TCSBRK:
2530                 case TCSBRKP:
2531                         if (!tty->driver->ioctl)
2532                                 return 0;
2533                         retval = tty->driver->ioctl(tty, file, cmd, arg);
2534                         if (retval == -ENOIOCTLCMD)
2535                                 retval = 0;
2536                         return retval;
2537                 }
2538         }
2539
2540         /*
2541          * Factor out some common prep work
2542          */
2543         switch (cmd) {
2544         case TIOCSETD:
2545         case TIOCSBRK:
2546         case TIOCCBRK:
2547         case TCSBRK:
2548         case TCSBRKP:                   
2549                 retval = tty_check_change(tty);
2550                 if (retval)
2551                         return retval;
2552                 if (cmd != TIOCCBRK) {
2553                         tty_wait_until_sent(tty, 0);
2554                         if (signal_pending(current))
2555                                 return -EINTR;
2556                 }
2557                 break;
2558         }
2559
2560         switch (cmd) {
2561                 case TIOCSTI:
2562                         return tiocsti(tty, p);
2563                 case TIOCGWINSZ:
2564                         return tiocgwinsz(tty, p);
2565                 case TIOCSWINSZ:
2566                         return tiocswinsz(tty, real_tty, p);
2567                 case TIOCCONS:
2568                         return real_tty!=tty ? -EINVAL : tioccons(file);
2569                 case FIONBIO:
2570                         return fionbio(file, p);
2571                 case TIOCEXCL:
2572                         set_bit(TTY_EXCLUSIVE, &tty->flags);
2573                         return 0;
2574                 case TIOCNXCL:
2575                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
2576                         return 0;
2577                 case TIOCNOTTY:
2578                         if (current->signal->tty != tty)
2579                                 return -ENOTTY;
2580                         if (current->signal->leader)
2581                                 disassociate_ctty(0);
2582                         task_lock(current);
2583                         current->signal->tty = NULL;
2584                         task_unlock(current);
2585                         return 0;
2586                 case TIOCSCTTY:
2587                         return tiocsctty(tty, arg);
2588                 case TIOCGPGRP:
2589                         return tiocgpgrp(tty, real_tty, p);
2590                 case TIOCSPGRP:
2591                         return tiocspgrp(tty, real_tty, p);
2592                 case TIOCGSID:
2593                         return tiocgsid(tty, real_tty, p);
2594                 case TIOCGETD:
2595                         /* FIXME: check this is ok */
2596                         return put_user(tty->ldisc.num, (int __user *)p);
2597                 case TIOCSETD:
2598                         return tiocsetd(tty, p);
2599 #ifdef CONFIG_VT
2600                 case TIOCLINUX:
2601                         return tioclinux(tty, arg);
2602 #endif
2603                 /*
2604                  * Break handling
2605                  */
2606                 case TIOCSBRK:  /* Turn break on, unconditionally */
2607                         tty->driver->break_ctl(tty, -1);
2608                         return 0;
2609                         
2610                 case TIOCCBRK:  /* Turn break off, unconditionally */
2611                         tty->driver->break_ctl(tty, 0);
2612                         return 0;
2613                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
2614                         /*
2615                          * XXX is the above comment correct, or the
2616                          * code below correct?  Is this ioctl used at
2617                          * all by anyone?
2618                          */
2619                         if (!arg)
2620                                 return send_break(tty, 250);
2621                         return 0;
2622                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
2623                         return send_break(tty, arg ? arg*100 : 250);
2624
2625                 case TIOCMGET:
2626                         return tty_tiocmget(tty, file, p);
2627
2628                 case TIOCMSET:
2629                 case TIOCMBIC:
2630                 case TIOCMBIS:
2631                         return tty_tiocmset(tty, file, cmd, p);
2632         }
2633         if (tty->driver->ioctl) {
2634                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
2635                 if (retval != -ENOIOCTLCMD)
2636                         return retval;
2637         }
2638         ld = tty_ldisc_ref_wait(tty);
2639         retval = -EINVAL;
2640         if (ld->ioctl) {
2641                 retval = ld->ioctl(tty, file, cmd, arg);
2642                 if (retval == -ENOIOCTLCMD)
2643                         retval = -EINVAL;
2644         }
2645         tty_ldisc_deref(ld);
2646         return retval;
2647 }
2648
2649
2650 /*
2651  * This implements the "Secure Attention Key" ---  the idea is to
2652  * prevent trojan horses by killing all processes associated with this
2653  * tty when the user hits the "Secure Attention Key".  Required for
2654  * super-paranoid applications --- see the Orange Book for more details.
2655  * 
2656  * This code could be nicer; ideally it should send a HUP, wait a few
2657  * seconds, then send a INT, and then a KILL signal.  But you then
2658  * have to coordinate with the init process, since all processes associated
2659  * with the current tty must be dead before the new getty is allowed
2660  * to spawn.
2661  *
2662  * Now, if it would be correct ;-/ The current code has a nasty hole -
2663  * it doesn't catch files in flight. We may send the descriptor to ourselves
2664  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2665  *
2666  * Nasty bug: do_SAK is being called in interrupt context.  This can
2667  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2668  */
2669 static void __do_SAK(void *arg)
2670 {
2671 #ifdef TTY_SOFT_SAK
2672         tty_hangup(tty);
2673 #else
2674         struct tty_struct *tty = arg;
2675         struct task_struct *g, *p;
2676         int session;
2677         int             i;
2678         struct file     *filp;
2679         struct tty_ldisc *disc;
2680         struct fdtable *fdt;
2681         
2682         if (!tty)
2683                 return;
2684         session  = tty->session;
2685         
2686         /* We don't want an ldisc switch during this */
2687         disc = tty_ldisc_ref(tty);
2688         if (disc && disc->flush_buffer)
2689                 disc->flush_buffer(tty);
2690         tty_ldisc_deref(disc);
2691
2692         if (tty->driver->flush_buffer)
2693                 tty->driver->flush_buffer(tty);
2694         
2695         read_lock(&tasklist_lock);
2696         /* Kill the entire session */
2697         do_each_task_pid(session, PIDTYPE_SID, p) {
2698                 printk(KERN_NOTICE "SAK: killed process %d"
2699                         " (%s): p->signal->session==tty->session\n",
2700                         p->pid, p->comm);
2701                 send_sig(SIGKILL, p, 1);
2702         } while_each_task_pid(session, PIDTYPE_SID, p);
2703         /* Now kill any processes that happen to have the
2704          * tty open.
2705          */
2706         do_each_thread(g, p) {
2707                 if (p->signal->tty == tty) {
2708                         printk(KERN_NOTICE "SAK: killed process %d"
2709                             " (%s): p->signal->session==tty->session\n",
2710                             p->pid, p->comm);
2711                         send_sig(SIGKILL, p, 1);
2712                         continue;
2713                 }
2714                 task_lock(p);
2715                 if (p->files) {
2716                         rcu_read_lock();
2717                         fdt = files_fdtable(p->files);
2718                         for (i=0; i < fdt->max_fds; i++) {
2719                                 filp = fcheck_files(p->files, i);
2720                                 if (!filp)
2721                                         continue;
2722                                 if (filp->f_op->read == tty_read &&
2723                                     filp->private_data == tty) {
2724                                         printk(KERN_NOTICE "SAK: killed process %d"
2725                                             " (%s): fd#%d opened to the tty\n",
2726                                             p->pid, p->comm, i);
2727                                         send_sig(SIGKILL, p, 1);
2728                                         break;
2729                                 }
2730                         }
2731                         rcu_read_unlock();
2732                 }
2733                 task_unlock(p);
2734         } while_each_thread(g, p);
2735         read_unlock(&tasklist_lock);
2736 #endif
2737 }
2738
2739 /*
2740  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2741  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2742  * the values which we write to it will be identical to the values which it
2743  * already has. --akpm
2744  */
2745 void do_SAK(struct tty_struct *tty)
2746 {
2747         if (!tty)
2748                 return;
2749         PREPARE_WORK(&tty->SAK_work, __do_SAK, tty);
2750         schedule_work(&tty->SAK_work);
2751 }
2752
2753 EXPORT_SYMBOL(do_SAK);
2754
2755 /*
2756  * This routine is called out of the software interrupt to flush data
2757  * from the buffer chain to the line discipline.
2758  */
2759  
2760 static void flush_to_ldisc(void *private_)
2761 {
2762         struct tty_struct *tty = (struct tty_struct *) private_;
2763         unsigned long   flags;
2764         struct tty_ldisc *disc;
2765         struct tty_buffer *tbuf;
2766         int count;
2767         char *char_buf;
2768         unsigned char *flag_buf;
2769
2770         disc = tty_ldisc_ref(tty);
2771         if (disc == NULL)       /*  !TTY_LDISC */
2772                 return;
2773
2774         if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
2775                 /*
2776                  * Do it after the next timer tick:
2777                  */
2778                 schedule_delayed_work(&tty->buf.work, 1);
2779                 goto out;
2780         }
2781         spin_lock_irqsave(&tty->buf.lock, flags);
2782         while((tbuf = tty->buf.head) != NULL) {
2783                 while ((count = tbuf->commit - tbuf->read) != 0) {
2784                         char_buf = tbuf->char_buf_ptr + tbuf->read;
2785                         flag_buf = tbuf->flag_buf_ptr + tbuf->read;
2786                         tbuf->read += count;
2787                         spin_unlock_irqrestore(&tty->buf.lock, flags);
2788                         disc->receive_buf(tty, char_buf, flag_buf, count);
2789                         spin_lock_irqsave(&tty->buf.lock, flags);
2790                 }
2791                 if (tbuf->active)
2792                         break;
2793                 tty->buf.head = tbuf->next;
2794                 if (tty->buf.head == NULL)
2795                         tty->buf.tail = NULL;
2796                 tty_buffer_free(tty, tbuf);
2797         }
2798         spin_unlock_irqrestore(&tty->buf.lock, flags);
2799 out:
2800         tty_ldisc_deref(disc);
2801 }
2802
2803 /*
2804  * Routine which returns the baud rate of the tty
2805  *
2806  * Note that the baud_table needs to be kept in sync with the
2807  * include/asm/termbits.h file.
2808  */
2809 static int baud_table[] = {
2810         0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
2811         9600, 19200, 38400, 57600, 115200, 230400, 460800,
2812 #ifdef __sparc__
2813         76800, 153600, 307200, 614400, 921600
2814 #else
2815         500000, 576000, 921600, 1000000, 1152000, 1500000, 2000000,
2816         2500000, 3000000, 3500000, 4000000
2817 #endif
2818 };
2819
2820 static int n_baud_table = ARRAY_SIZE(baud_table);
2821
2822 /**
2823  *      tty_termios_baud_rate
2824  *      @termios: termios structure
2825  *
2826  *      Convert termios baud rate data into a speed. This should be called
2827  *      with the termios lock held if this termios is a terminal termios
2828  *      structure. May change the termios data.
2829  */
2830  
2831 int tty_termios_baud_rate(struct termios *termios)
2832 {
2833         unsigned int cbaud;
2834         
2835         cbaud = termios->c_cflag & CBAUD;
2836
2837         if (cbaud & CBAUDEX) {
2838                 cbaud &= ~CBAUDEX;
2839
2840                 if (cbaud < 1 || cbaud + 15 > n_baud_table)
2841                         termios->c_cflag &= ~CBAUDEX;
2842                 else
2843                         cbaud += 15;
2844         }
2845         return baud_table[cbaud];
2846 }
2847
2848 EXPORT_SYMBOL(tty_termios_baud_rate);
2849
2850 /**
2851  *      tty_get_baud_rate       -       get tty bit rates
2852  *      @tty: tty to query
2853  *
2854  *      Returns the baud rate as an integer for this terminal. The
2855  *      termios lock must be held by the caller and the terminal bit
2856  *      flags may be updated.
2857  */
2858  
2859 int tty_get_baud_rate(struct tty_struct *tty)
2860 {
2861         int baud = tty_termios_baud_rate(tty->termios);
2862
2863         if (baud == 38400 && tty->alt_speed) {
2864                 if (!tty->warned) {
2865                         printk(KERN_WARNING "Use of setserial/setrocket to "
2866                                             "set SPD_* flags is deprecated\n");
2867                         tty->warned = 1;
2868                 }
2869                 baud = tty->alt_speed;
2870         }
2871         
2872         return baud;
2873 }
2874
2875 EXPORT_SYMBOL(tty_get_baud_rate);
2876
2877 /**
2878  *      tty_flip_buffer_push    -       terminal
2879  *      @tty: tty to push
2880  *
2881  *      Queue a push of the terminal flip buffers to the line discipline. This
2882  *      function must not be called from IRQ context if tty->low_latency is set.
2883  *
2884  *      In the event of the queue being busy for flipping the work will be
2885  *      held off and retried later.
2886  */
2887
2888 void tty_flip_buffer_push(struct tty_struct *tty)
2889 {
2890         unsigned long flags;
2891         spin_lock_irqsave(&tty->buf.lock, flags);
2892         if (tty->buf.tail != NULL) {
2893                 tty->buf.tail->active = 0;
2894                 tty->buf.tail->commit = tty->buf.tail->used;
2895         }
2896         spin_unlock_irqrestore(&tty->buf.lock, flags);
2897
2898         if (tty->low_latency)
2899                 flush_to_ldisc((void *) tty);
2900         else
2901                 schedule_delayed_work(&tty->buf.work, 1);
2902 }
2903
2904 EXPORT_SYMBOL(tty_flip_buffer_push);
2905
2906
2907 /*
2908  * This subroutine initializes a tty structure.
2909  */
2910 static void initialize_tty_struct(struct tty_struct *tty)
2911 {
2912         memset(tty, 0, sizeof(struct tty_struct));
2913         tty->magic = TTY_MAGIC;
2914         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2915         tty->pgrp = -1;
2916         tty->overrun_time = jiffies;
2917         tty->buf.head = tty->buf.tail = NULL;
2918         tty_buffer_init(tty);
2919         INIT_WORK(&tty->buf.work, flush_to_ldisc, tty);
2920         init_MUTEX(&tty->buf.pty_sem);
2921         init_MUTEX(&tty->termios_sem);
2922         init_waitqueue_head(&tty->write_wait);
2923         init_waitqueue_head(&tty->read_wait);
2924         INIT_WORK(&tty->hangup_work, do_tty_hangup, tty);
2925         mutex_init(&tty->atomic_read_lock);
2926         mutex_init(&tty->atomic_write_lock);
2927         spin_lock_init(&tty->read_lock);
2928         INIT_LIST_HEAD(&tty->tty_files);
2929         INIT_WORK(&tty->SAK_work, NULL, NULL);
2930 }
2931
2932 /*
2933  * The default put_char routine if the driver did not define one.
2934  */
2935 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
2936 {
2937         tty->driver->write(tty, &ch, 1);
2938 }
2939
2940 static struct class *tty_class;
2941
2942 /**
2943  * tty_register_device - register a tty device
2944  * @driver: the tty driver that describes the tty device
2945  * @index: the index in the tty driver for this tty device
2946  * @device: a struct device that is associated with this tty device.
2947  *      This field is optional, if there is no known struct device for this
2948  *      tty device it can be set to NULL safely.
2949  *
2950  * This call is required to be made to register an individual tty device if
2951  * the tty driver's flags have the TTY_DRIVER_NO_DEVFS bit set.  If that
2952  * bit is not set, this function should not be called.
2953  */
2954 void tty_register_device(struct tty_driver *driver, unsigned index,
2955                          struct device *device)
2956 {
2957         char name[64];
2958         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
2959
2960         if (index >= driver->num) {
2961                 printk(KERN_ERR "Attempt to register invalid tty line number "
2962                        " (%d).\n", index);
2963                 return;
2964         }
2965
2966         devfs_mk_cdev(dev, S_IFCHR | S_IRUSR | S_IWUSR,
2967                         "%s%d", driver->devfs_name, index + driver->name_base);
2968
2969         if (driver->type == TTY_DRIVER_TYPE_PTY)
2970                 pty_line_name(driver, index, name);
2971         else
2972                 tty_line_name(driver, index, name);
2973         class_device_create(tty_class, NULL, dev, device, "%s", name);
2974 }
2975
2976 /**
2977  * tty_unregister_device - unregister a tty device
2978  * @driver: the tty driver that describes the tty device
2979  * @index: the index in the tty driver for this tty device
2980  *
2981  * If a tty device is registered with a call to tty_register_device() then
2982  * this function must be made when the tty device is gone.
2983  */
2984 void tty_unregister_device(struct tty_driver *driver, unsigned index)
2985 {
2986         devfs_remove("%s%d", driver->devfs_name, index + driver->name_base);
2987         class_device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
2988 }
2989
2990 EXPORT_SYMBOL(tty_register_device);
2991 EXPORT_SYMBOL(tty_unregister_device);
2992
2993 struct tty_driver *alloc_tty_driver(int lines)
2994 {
2995         struct tty_driver *driver;
2996
2997         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
2998         if (driver) {
2999                 memset(driver, 0, sizeof(struct tty_driver));
3000                 driver->magic = TTY_DRIVER_MAGIC;
3001                 driver->num = lines;
3002                 /* later we'll move allocation of tables here */
3003         }
3004         return driver;
3005 }
3006
3007 void put_tty_driver(struct tty_driver *driver)
3008 {
3009         kfree(driver);
3010 }
3011
3012 void tty_set_operations(struct tty_driver *driver, struct tty_operations *op)
3013 {
3014         driver->open = op->open;
3015         driver->close = op->close;
3016         driver->write = op->write;
3017         driver->put_char = op->put_char;
3018         driver->flush_chars = op->flush_chars;
3019         driver->write_room = op->write_room;
3020         driver->chars_in_buffer = op->chars_in_buffer;
3021         driver->ioctl = op->ioctl;
3022         driver->set_termios = op->set_termios;
3023         driver->throttle = op->throttle;
3024         driver->unthrottle = op->unthrottle;
3025         driver->stop = op->stop;
3026         driver->start = op->start;
3027         driver->hangup = op->hangup;
3028         driver->break_ctl = op->break_ctl;
3029         driver->flush_buffer = op->flush_buffer;
3030         driver->set_ldisc = op->set_ldisc;
3031         driver->wait_until_sent = op->wait_until_sent;
3032         driver->send_xchar = op->send_xchar;
3033         driver->read_proc = op->read_proc;
3034         driver->write_proc = op->write_proc;
3035         driver->tiocmget = op->tiocmget;
3036         driver->tiocmset = op->tiocmset;
3037 }
3038
3039
3040 EXPORT_SYMBOL(alloc_tty_driver);
3041 EXPORT_SYMBOL(put_tty_driver);
3042 EXPORT_SYMBOL(tty_set_operations);
3043
3044 /*
3045  * Called by a tty driver to register itself.
3046  */
3047 int tty_register_driver(struct tty_driver *driver)
3048 {
3049         int error;
3050         int i;
3051         dev_t dev;
3052         void **p = NULL;
3053
3054         if (driver->flags & TTY_DRIVER_INSTALLED)
3055                 return 0;
3056
3057         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
3058                 p = kmalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3059                 if (!p)
3060                         return -ENOMEM;
3061                 memset(p, 0, driver->num * 3 * sizeof(void *));
3062         }
3063
3064         if (!driver->major) {
3065                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3066                                                 (char*)driver->name);
3067                 if (!error) {
3068                         driver->major = MAJOR(dev);
3069                         driver->minor_start = MINOR(dev);
3070                 }
3071         } else {
3072                 dev = MKDEV(driver->major, driver->minor_start);
3073                 error = register_chrdev_region(dev, driver->num,
3074                                                 (char*)driver->name);
3075         }
3076         if (error < 0) {
3077                 kfree(p);
3078                 return error;
3079         }
3080
3081         if (p) {
3082                 driver->ttys = (struct tty_struct **)p;
3083                 driver->termios = (struct termios **)(p + driver->num);
3084                 driver->termios_locked = (struct termios **)(p + driver->num * 2);
3085         } else {
3086                 driver->ttys = NULL;
3087                 driver->termios = NULL;
3088                 driver->termios_locked = NULL;
3089         }
3090
3091         cdev_init(&driver->cdev, &tty_fops);
3092         driver->cdev.owner = driver->owner;
3093         error = cdev_add(&driver->cdev, dev, driver->num);
3094         if (error) {
3095                 cdev_del(&driver->cdev);
3096                 unregister_chrdev_region(dev, driver->num);
3097                 driver->ttys = NULL;
3098                 driver->termios = driver->termios_locked = NULL;
3099                 kfree(p);
3100                 return error;
3101         }
3102
3103         if (!driver->put_char)
3104                 driver->put_char = tty_default_put_char;
3105         
3106         list_add(&driver->tty_drivers, &tty_drivers);
3107         
3108         if ( !(driver->flags & TTY_DRIVER_NO_DEVFS) ) {
3109                 for(i = 0; i < driver->num; i++)
3110                     tty_register_device(driver, i, NULL);
3111         }
3112         proc_tty_register_driver(driver);
3113         return 0;
3114 }
3115
3116 EXPORT_SYMBOL(tty_register_driver);
3117
3118 /*
3119  * Called by a tty driver to unregister itself.
3120  */
3121 int tty_unregister_driver(struct tty_driver *driver)
3122 {
3123         int i;
3124         struct termios *tp;
3125         void *p;
3126
3127         if (driver->refcount)
3128                 return -EBUSY;
3129
3130         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3131                                 driver->num);
3132
3133         list_del(&driver->tty_drivers);
3134
3135         /*
3136          * Free the termios and termios_locked structures because
3137          * we don't want to get memory leaks when modular tty
3138          * drivers are removed from the kernel.
3139          */
3140         for (i = 0; i < driver->num; i++) {
3141                 tp = driver->termios[i];
3142                 if (tp) {
3143                         driver->termios[i] = NULL;
3144                         kfree(tp);
3145                 }
3146                 tp = driver->termios_locked[i];
3147                 if (tp) {
3148                         driver->termios_locked[i] = NULL;
3149                         kfree(tp);
3150                 }
3151                 if (!(driver->flags & TTY_DRIVER_NO_DEVFS))
3152                         tty_unregister_device(driver, i);
3153         }
3154         p = driver->ttys;
3155         proc_tty_unregister_driver(driver);
3156         driver->ttys = NULL;
3157         driver->termios = driver->termios_locked = NULL;
3158         kfree(p);
3159         cdev_del(&driver->cdev);
3160         return 0;
3161 }
3162
3163 EXPORT_SYMBOL(tty_unregister_driver);
3164
3165
3166 /*
3167  * Initialize the console device. This is called *early*, so
3168  * we can't necessarily depend on lots of kernel help here.
3169  * Just do some early initializations, and do the complex setup
3170  * later.
3171  */
3172 void __init console_init(void)
3173 {
3174         initcall_t *call;
3175
3176         /* Setup the default TTY line discipline. */
3177         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
3178
3179         /*
3180          * set up the console device so that later boot sequences can 
3181          * inform about problems etc..
3182          */
3183 #ifdef CONFIG_EARLY_PRINTK
3184         disable_early_printk();
3185 #endif
3186         call = __con_initcall_start;
3187         while (call < __con_initcall_end) {
3188                 (*call)();
3189                 call++;
3190         }
3191 }
3192
3193 #ifdef CONFIG_VT
3194 extern int vty_init(void);
3195 #endif
3196
3197 static int __init tty_class_init(void)
3198 {
3199         tty_class = class_create(THIS_MODULE, "tty");
3200         if (IS_ERR(tty_class))
3201                 return PTR_ERR(tty_class);
3202         return 0;
3203 }
3204
3205 postcore_initcall(tty_class_init);
3206
3207 /* 3/2004 jmc: why do these devices exist? */
3208
3209 static struct cdev tty_cdev, console_cdev;
3210 #ifdef CONFIG_UNIX98_PTYS
3211 static struct cdev ptmx_cdev;
3212 #endif
3213 #ifdef CONFIG_VT
3214 static struct cdev vc0_cdev;
3215 #endif
3216
3217 /*
3218  * Ok, now we can initialize the rest of the tty devices and can count
3219  * on memory allocations, interrupts etc..
3220  */
3221 static int __init tty_init(void)
3222 {
3223         cdev_init(&tty_cdev, &tty_fops);
3224         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3225             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3226                 panic("Couldn't register /dev/tty driver\n");
3227         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 0), S_IFCHR|S_IRUGO|S_IWUGO, "tty");
3228         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3229
3230         cdev_init(&console_cdev, &console_fops);
3231         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3232             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3233                 panic("Couldn't register /dev/console driver\n");
3234         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 1), S_IFCHR|S_IRUSR|S_IWUSR, "console");
3235         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL, "console");
3236
3237 #ifdef CONFIG_UNIX98_PTYS
3238         cdev_init(&ptmx_cdev, &ptmx_fops);
3239         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
3240             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
3241                 panic("Couldn't register /dev/ptmx driver\n");
3242         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 2), S_IFCHR|S_IRUGO|S_IWUGO, "ptmx");
3243         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), NULL, "ptmx");
3244 #endif
3245
3246 #ifdef CONFIG_VT
3247         cdev_init(&vc0_cdev, &console_fops);
3248         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
3249             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
3250                 panic("Couldn't register /dev/tty0 driver\n");
3251         devfs_mk_cdev(MKDEV(TTY_MAJOR, 0), S_IFCHR|S_IRUSR|S_IWUSR, "vc/0");
3252         class_device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), NULL, "tty0");
3253
3254         vty_init();
3255 #endif
3256         return 0;
3257 }
3258 module_init(tty_init);