Merge omap tree
[linux-2.6] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/config.h>
69 #include <linux/types.h>
70 #include <linux/major.h>
71 #include <linux/errno.h>
72 #include <linux/signal.h>
73 #include <linux/fcntl.h>
74 #include <linux/sched.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/console.h>
82 #include <linux/timer.h>
83 #include <linux/ctype.h>
84 #include <linux/kd.h>
85 #include <linux/mm.h>
86 #include <linux/string.h>
87 #include <linux/slab.h>
88 #include <linux/poll.h>
89 #include <linux/proc_fs.h>
90 #include <linux/init.h>
91 #include <linux/module.h>
92 #include <linux/smp_lock.h>
93 #include <linux/device.h>
94 #include <linux/idr.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98
99 #include <asm/uaccess.h>
100 #include <asm/system.h>
101
102 #include <linux/kbd_kern.h>
103 #include <linux/vt_kern.h>
104 #include <linux/selection.h>
105 #include <linux/devfs_fs_kernel.h>
106
107 #include <linux/kmod.h>
108
109 #undef TTY_DEBUG_HANGUP
110
111 #define TTY_PARANOIA_CHECK 1
112 #define CHECK_TTY_COUNT 1
113
114 struct termios tty_std_termios = {      /* for the benefit of tty drivers  */
115         .c_iflag = ICRNL | IXON,
116         .c_oflag = OPOST | ONLCR,
117         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
118         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
119                    ECHOCTL | ECHOKE | IEXTEN,
120         .c_cc = INIT_C_CC
121 };
122
123 EXPORT_SYMBOL(tty_std_termios);
124
125 /* This list gets poked at by procfs and various bits of boot up code. This
126    could do with some rationalisation such as pulling the tty proc function
127    into this file */
128    
129 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
130
131 /* Semaphore to protect creating and releasing a tty. This is shared with
132    vt.c for deeply disgusting hack reasons */
133 DEFINE_MUTEX(tty_mutex);
134
135 #ifdef CONFIG_UNIX98_PTYS
136 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
137 extern int pty_limit;           /* Config limit on Unix98 ptys */
138 static DEFINE_IDR(allocated_ptys);
139 static DECLARE_MUTEX(allocated_ptys_lock);
140 static int ptmx_open(struct inode *, struct file *);
141 #endif
142
143 extern void disable_early_printk(void);
144
145 static void initialize_tty_struct(struct tty_struct *tty);
146
147 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
148 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
149 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
150 static unsigned int tty_poll(struct file *, poll_table *);
151 static int tty_open(struct inode *, struct file *);
152 static int tty_release(struct inode *, struct file *);
153 int tty_ioctl(struct inode * inode, struct file * file,
154               unsigned int cmd, unsigned long arg);
155 static int tty_fasync(int fd, struct file * filp, int on);
156 static void release_mem(struct tty_struct *tty, int idx);
157
158
159 static struct tty_struct *alloc_tty_struct(void)
160 {
161         struct tty_struct *tty;
162
163         tty = kmalloc(sizeof(struct tty_struct), GFP_KERNEL);
164         if (tty)
165                 memset(tty, 0, sizeof(struct tty_struct));
166         return tty;
167 }
168
169 static void tty_buffer_free_all(struct tty_struct *);
170
171 static inline void free_tty_struct(struct tty_struct *tty)
172 {
173         kfree(tty->write_buf);
174         tty_buffer_free_all(tty);
175         kfree(tty);
176 }
177
178 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
179
180 char *tty_name(struct tty_struct *tty, char *buf)
181 {
182         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
183                 strcpy(buf, "NULL tty");
184         else
185                 strcpy(buf, tty->name);
186         return buf;
187 }
188
189 EXPORT_SYMBOL(tty_name);
190
191 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
192                               const char *routine)
193 {
194 #ifdef TTY_PARANOIA_CHECK
195         if (!tty) {
196                 printk(KERN_WARNING
197                         "null TTY for (%d:%d) in %s\n",
198                         imajor(inode), iminor(inode), routine);
199                 return 1;
200         }
201         if (tty->magic != TTY_MAGIC) {
202                 printk(KERN_WARNING
203                         "bad magic number for tty struct (%d:%d) in %s\n",
204                         imajor(inode), iminor(inode), routine);
205                 return 1;
206         }
207 #endif
208         return 0;
209 }
210
211 static int check_tty_count(struct tty_struct *tty, const char *routine)
212 {
213 #ifdef CHECK_TTY_COUNT
214         struct list_head *p;
215         int count = 0;
216         
217         file_list_lock();
218         list_for_each(p, &tty->tty_files) {
219                 count++;
220         }
221         file_list_unlock();
222         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
223             tty->driver->subtype == PTY_TYPE_SLAVE &&
224             tty->link && tty->link->count)
225                 count++;
226         if (tty->count != count) {
227                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
228                                     "!= #fd's(%d) in %s\n",
229                        tty->name, tty->count, count, routine);
230                 return count;
231        }        
232 #endif
233         return 0;
234 }
235
236 /*
237  * Tty buffer allocation management
238  */
239
240 static void tty_buffer_free_all(struct tty_struct *tty)
241 {
242         struct tty_buffer *thead;
243         while((thead = tty->buf.head) != NULL) {
244                 tty->buf.head = thead->next;
245                 kfree(thead);
246         }
247         while((thead = tty->buf.free) != NULL) {
248                 tty->buf.free = thead->next;
249                 kfree(thead);
250         }
251         tty->buf.tail = NULL;
252 }
253
254 static void tty_buffer_init(struct tty_struct *tty)
255 {
256         spin_lock_init(&tty->buf.lock);
257         tty->buf.head = NULL;
258         tty->buf.tail = NULL;
259         tty->buf.free = NULL;
260 }
261
262 static struct tty_buffer *tty_buffer_alloc(size_t size)
263 {
264         struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
265         if(p == NULL)
266                 return NULL;
267         p->used = 0;
268         p->size = size;
269         p->next = NULL;
270         p->commit = 0;
271         p->read = 0;
272         p->char_buf_ptr = (char *)(p->data);
273         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
274 /*      printk("Flip create %p\n", p); */
275         return p;
276 }
277
278 /* Must be called with the tty_read lock held. This needs to acquire strategy
279    code to decide if we should kfree or relink a given expired buffer */
280
281 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
282 {
283         /* Dumb strategy for now - should keep some stats */
284 /*      printk("Flip dispose %p\n", b); */
285         if(b->size >= 512)
286                 kfree(b);
287         else {
288                 b->next = tty->buf.free;
289                 tty->buf.free = b;
290         }
291 }
292
293 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
294 {
295         struct tty_buffer **tbh = &tty->buf.free;
296         while((*tbh) != NULL) {
297                 struct tty_buffer *t = *tbh;
298                 if(t->size >= size) {
299                         *tbh = t->next;
300                         t->next = NULL;
301                         t->used = 0;
302                         t->commit = 0;
303                         t->read = 0;
304                         /* DEBUG ONLY */
305 /*                      memset(t->data, '*', size); */
306 /*                      printk("Flip recycle %p\n", t); */
307                         return t;
308                 }
309                 tbh = &((*tbh)->next);
310         }
311         /* Round the buffer size out */
312         size = (size + 0xFF) & ~ 0xFF;
313         return tty_buffer_alloc(size);
314         /* Should possibly check if this fails for the largest buffer we
315            have queued and recycle that ? */
316 }
317
318 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
319 {
320         struct tty_buffer *b, *n;
321         int left;
322         unsigned long flags;
323
324         spin_lock_irqsave(&tty->buf.lock, flags);
325
326         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
327            remove this conditional if its worth it. This would be invisible
328            to the callers */
329         if ((b = tty->buf.tail) != NULL)
330                 left = b->size - b->used;
331         else
332                 left = 0;
333
334         if (left < size) {
335                 /* This is the slow path - looking for new buffers to use */
336                 if ((n = tty_buffer_find(tty, size)) != NULL) {
337                         if (b != NULL) {
338                                 b->next = n;
339                                 b->commit = b->used;
340                         } else
341                                 tty->buf.head = n;
342                         tty->buf.tail = n;
343                 } else
344                         size = left;
345         }
346
347         spin_unlock_irqrestore(&tty->buf.lock, flags);
348         return size;
349 }
350 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
351
352 int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
353                                 size_t size)
354 {
355         int copied = 0;
356         do {
357                 int space = tty_buffer_request_room(tty, size - copied);
358                 struct tty_buffer *tb = tty->buf.tail;
359                 /* If there is no space then tb may be NULL */
360                 if(unlikely(space == 0))
361                         break;
362                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
363                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
364                 tb->used += space;
365                 copied += space;
366                 chars += space;
367         }
368         /* There is a small chance that we need to split the data over
369            several buffers. If this is the case we must loop */
370         while (unlikely(size > copied));
371         return copied;
372 }
373 EXPORT_SYMBOL(tty_insert_flip_string);
374
375 int tty_insert_flip_string_flags(struct tty_struct *tty,
376                 const unsigned char *chars, const char *flags, size_t size)
377 {
378         int copied = 0;
379         do {
380                 int space = tty_buffer_request_room(tty, size - copied);
381                 struct tty_buffer *tb = tty->buf.tail;
382                 /* If there is no space then tb may be NULL */
383                 if(unlikely(space == 0))
384                         break;
385                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
386                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
387                 tb->used += space;
388                 copied += space;
389                 chars += space;
390                 flags += space;
391         }
392         /* There is a small chance that we need to split the data over
393            several buffers. If this is the case we must loop */
394         while (unlikely(size > copied));
395         return copied;
396 }
397 EXPORT_SYMBOL(tty_insert_flip_string_flags);
398
399 void tty_schedule_flip(struct tty_struct *tty)
400 {
401         unsigned long flags;
402         spin_lock_irqsave(&tty->buf.lock, flags);
403         if (tty->buf.tail != NULL)
404                 tty->buf.tail->commit = tty->buf.tail->used;
405         spin_unlock_irqrestore(&tty->buf.lock, flags);
406         schedule_delayed_work(&tty->buf.work, 1);
407 }
408 EXPORT_SYMBOL(tty_schedule_flip);
409
410 /*
411  *      Prepare a block of space in the buffer for data. Returns the length
412  *      available and buffer pointer to the space which is now allocated and
413  *      accounted for as ready for normal characters. This is used for drivers
414  *      that need their own block copy routines into the buffer. There is no
415  *      guarantee the buffer is a DMA target!
416  */
417
418 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
419 {
420         int space = tty_buffer_request_room(tty, size);
421         if (likely(space)) {
422                 struct tty_buffer *tb = tty->buf.tail;
423                 *chars = tb->char_buf_ptr + tb->used;
424                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
425                 tb->used += space;
426         }
427         return space;
428 }
429
430 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
431
432 /*
433  *      Prepare a block of space in the buffer for data. Returns the length
434  *      available and buffer pointer to the space which is now allocated and
435  *      accounted for as ready for characters. This is used for drivers
436  *      that need their own block copy routines into the buffer. There is no
437  *      guarantee the buffer is a DMA target!
438  */
439
440 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
441 {
442         int space = tty_buffer_request_room(tty, size);
443         if (likely(space)) {
444                 struct tty_buffer *tb = tty->buf.tail;
445                 *chars = tb->char_buf_ptr + tb->used;
446                 *flags = tb->flag_buf_ptr + tb->used;
447                 tb->used += space;
448         }
449         return space;
450 }
451
452 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
453
454
455
456 /*
457  *      This is probably overkill for real world processors but
458  *      they are not on hot paths so a little discipline won't do 
459  *      any harm.
460  */
461  
462 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
463 {
464         down(&tty->termios_sem);
465         tty->termios->c_line = num;
466         up(&tty->termios_sem);
467 }
468
469 /*
470  *      This guards the refcounted line discipline lists. The lock
471  *      must be taken with irqs off because there are hangup path
472  *      callers who will do ldisc lookups and cannot sleep.
473  */
474  
475 static DEFINE_SPINLOCK(tty_ldisc_lock);
476 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
477 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
478
479 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
480 {
481         unsigned long flags;
482         int ret = 0;
483         
484         if (disc < N_TTY || disc >= NR_LDISCS)
485                 return -EINVAL;
486         
487         spin_lock_irqsave(&tty_ldisc_lock, flags);
488         tty_ldiscs[disc] = *new_ldisc;
489         tty_ldiscs[disc].num = disc;
490         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
491         tty_ldiscs[disc].refcount = 0;
492         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
493         
494         return ret;
495 }
496 EXPORT_SYMBOL(tty_register_ldisc);
497
498 int tty_unregister_ldisc(int disc)
499 {
500         unsigned long flags;
501         int ret = 0;
502
503         if (disc < N_TTY || disc >= NR_LDISCS)
504                 return -EINVAL;
505
506         spin_lock_irqsave(&tty_ldisc_lock, flags);
507         if (tty_ldiscs[disc].refcount)
508                 ret = -EBUSY;
509         else
510                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
511         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
512
513         return ret;
514 }
515 EXPORT_SYMBOL(tty_unregister_ldisc);
516
517 struct tty_ldisc *tty_ldisc_get(int disc)
518 {
519         unsigned long flags;
520         struct tty_ldisc *ld;
521
522         if (disc < N_TTY || disc >= NR_LDISCS)
523                 return NULL;
524         
525         spin_lock_irqsave(&tty_ldisc_lock, flags);
526
527         ld = &tty_ldiscs[disc];
528         /* Check the entry is defined */
529         if(ld->flags & LDISC_FLAG_DEFINED)
530         {
531                 /* If the module is being unloaded we can't use it */
532                 if (!try_module_get(ld->owner))
533                         ld = NULL;
534                 else /* lock it */
535                         ld->refcount++;
536         }
537         else
538                 ld = NULL;
539         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
540         return ld;
541 }
542
543 EXPORT_SYMBOL_GPL(tty_ldisc_get);
544
545 void tty_ldisc_put(int disc)
546 {
547         struct tty_ldisc *ld;
548         unsigned long flags;
549         
550         BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
551                 
552         spin_lock_irqsave(&tty_ldisc_lock, flags);
553         ld = &tty_ldiscs[disc];
554         BUG_ON(ld->refcount == 0);
555         ld->refcount--;
556         module_put(ld->owner);
557         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
558 }
559         
560 EXPORT_SYMBOL_GPL(tty_ldisc_put);
561
562 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
563 {
564         tty->ldisc = *ld;
565         tty->ldisc.refcount = 0;
566 }
567
568 /**
569  *      tty_ldisc_try           -       internal helper
570  *      @tty: the tty
571  *
572  *      Make a single attempt to grab and bump the refcount on
573  *      the tty ldisc. Return 0 on failure or 1 on success. This is
574  *      used to implement both the waiting and non waiting versions
575  *      of tty_ldisc_ref
576  */
577
578 static int tty_ldisc_try(struct tty_struct *tty)
579 {
580         unsigned long flags;
581         struct tty_ldisc *ld;
582         int ret = 0;
583         
584         spin_lock_irqsave(&tty_ldisc_lock, flags);
585         ld = &tty->ldisc;
586         if(test_bit(TTY_LDISC, &tty->flags))
587         {
588                 ld->refcount++;
589                 ret = 1;
590         }
591         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
592         return ret;
593 }
594
595 /**
596  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
597  *      @tty: tty device
598  *
599  *      Dereference the line discipline for the terminal and take a 
600  *      reference to it. If the line discipline is in flux then 
601  *      wait patiently until it changes.
602  *
603  *      Note: Must not be called from an IRQ/timer context. The caller
604  *      must also be careful not to hold other locks that will deadlock
605  *      against a discipline change, such as an existing ldisc reference
606  *      (which we check for)
607  */
608  
609 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
610 {
611         /* wait_event is a macro */
612         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
613         if(tty->ldisc.refcount == 0)
614                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
615         return &tty->ldisc;
616 }
617
618 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
619
620 /**
621  *      tty_ldisc_ref           -       get the tty ldisc
622  *      @tty: tty device
623  *
624  *      Dereference the line discipline for the terminal and take a 
625  *      reference to it. If the line discipline is in flux then 
626  *      return NULL. Can be called from IRQ and timer functions.
627  */
628  
629 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
630 {
631         if(tty_ldisc_try(tty))
632                 return &tty->ldisc;
633         return NULL;
634 }
635
636 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
637
638 /**
639  *      tty_ldisc_deref         -       free a tty ldisc reference
640  *      @ld: reference to free up
641  *
642  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
643  *      be called in IRQ context.
644  */
645  
646 void tty_ldisc_deref(struct tty_ldisc *ld)
647 {
648         unsigned long flags;
649
650         BUG_ON(ld == NULL);
651                 
652         spin_lock_irqsave(&tty_ldisc_lock, flags);
653         if(ld->refcount == 0)
654                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
655         else
656                 ld->refcount--;
657         if(ld->refcount == 0)
658                 wake_up(&tty_ldisc_wait);
659         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
660 }
661
662 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
663
664 /**
665  *      tty_ldisc_enable        -       allow ldisc use
666  *      @tty: terminal to activate ldisc on
667  *
668  *      Set the TTY_LDISC flag when the line discipline can be called
669  *      again. Do neccessary wakeups for existing sleepers.
670  *
671  *      Note: nobody should set this bit except via this function. Clearing
672  *      directly is allowed.
673  */
674
675 static void tty_ldisc_enable(struct tty_struct *tty)
676 {
677         set_bit(TTY_LDISC, &tty->flags);
678         wake_up(&tty_ldisc_wait);
679 }
680         
681 /**
682  *      tty_set_ldisc           -       set line discipline
683  *      @tty: the terminal to set
684  *      @ldisc: the line discipline
685  *
686  *      Set the discipline of a tty line. Must be called from a process
687  *      context.
688  */
689  
690 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
691 {
692         int retval = 0;
693         struct tty_ldisc o_ldisc;
694         char buf[64];
695         int work;
696         unsigned long flags;
697         struct tty_ldisc *ld;
698         struct tty_struct *o_tty;
699
700         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
701                 return -EINVAL;
702
703 restart:
704
705         ld = tty_ldisc_get(ldisc);
706         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
707         /* Cyrus Durgin <cider@speakeasy.org> */
708         if (ld == NULL) {
709                 request_module("tty-ldisc-%d", ldisc);
710                 ld = tty_ldisc_get(ldisc);
711         }
712         if (ld == NULL)
713                 return -EINVAL;
714
715         /*
716          *      No more input please, we are switching. The new ldisc
717          *      will update this value in the ldisc open function
718          */
719
720         tty->receive_room = 0;
721
722         /*
723          *      Problem: What do we do if this blocks ?
724          */
725
726         tty_wait_until_sent(tty, 0);
727
728         if (tty->ldisc.num == ldisc) {
729                 tty_ldisc_put(ldisc);
730                 return 0;
731         }
732
733         o_ldisc = tty->ldisc;
734         o_tty = tty->link;
735
736         /*
737          *      Make sure we don't change while someone holds a
738          *      reference to the line discipline. The TTY_LDISC bit
739          *      prevents anyone taking a reference once it is clear.
740          *      We need the lock to avoid racing reference takers.
741          */
742
743         spin_lock_irqsave(&tty_ldisc_lock, flags);
744         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
745                 if(tty->ldisc.refcount) {
746                         /* Free the new ldisc we grabbed. Must drop the lock
747                            first. */
748                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
749                         tty_ldisc_put(ldisc);
750                         /*
751                          * There are several reasons we may be busy, including
752                          * random momentary I/O traffic. We must therefore
753                          * retry. We could distinguish between blocking ops
754                          * and retries if we made tty_ldisc_wait() smarter. That
755                          * is up for discussion.
756                          */
757                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
758                                 return -ERESTARTSYS;
759                         goto restart;
760                 }
761                 if(o_tty && o_tty->ldisc.refcount) {
762                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
763                         tty_ldisc_put(ldisc);
764                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
765                                 return -ERESTARTSYS;
766                         goto restart;
767                 }
768         }
769
770         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
771
772         if (!test_bit(TTY_LDISC, &tty->flags)) {
773                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
774                 tty_ldisc_put(ldisc);
775                 ld = tty_ldisc_ref_wait(tty);
776                 tty_ldisc_deref(ld);
777                 goto restart;
778         }
779
780         clear_bit(TTY_LDISC, &tty->flags);
781         if (o_tty)
782                 clear_bit(TTY_LDISC, &o_tty->flags);
783         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
784
785         /*
786          *      From this point on we know nobody has an ldisc
787          *      usage reference, nor can they obtain one until
788          *      we say so later on.
789          */
790
791         work = cancel_delayed_work(&tty->buf.work);
792         /*
793          * Wait for ->hangup_work and ->buf.work handlers to terminate
794          */
795          
796         flush_scheduled_work();
797         /* Shutdown the current discipline. */
798         if (tty->ldisc.close)
799                 (tty->ldisc.close)(tty);
800
801         /* Now set up the new line discipline. */
802         tty_ldisc_assign(tty, ld);
803         tty_set_termios_ldisc(tty, ldisc);
804         if (tty->ldisc.open)
805                 retval = (tty->ldisc.open)(tty);
806         if (retval < 0) {
807                 tty_ldisc_put(ldisc);
808                 /* There is an outstanding reference here so this is safe */
809                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
810                 tty_set_termios_ldisc(tty, tty->ldisc.num);
811                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
812                         tty_ldisc_put(o_ldisc.num);
813                         /* This driver is always present */
814                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
815                         tty_set_termios_ldisc(tty, N_TTY);
816                         if (tty->ldisc.open) {
817                                 int r = tty->ldisc.open(tty);
818
819                                 if (r < 0)
820                                         panic("Couldn't open N_TTY ldisc for "
821                                               "%s --- error %d.",
822                                               tty_name(tty, buf), r);
823                         }
824                 }
825         }
826         /* At this point we hold a reference to the new ldisc and a
827            a reference to the old ldisc. If we ended up flipping back
828            to the existing ldisc we have two references to it */
829         
830         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
831                 tty->driver->set_ldisc(tty);
832                 
833         tty_ldisc_put(o_ldisc.num);
834         
835         /*
836          *      Allow ldisc referencing to occur as soon as the driver
837          *      ldisc callback completes.
838          */
839          
840         tty_ldisc_enable(tty);
841         if (o_tty)
842                 tty_ldisc_enable(o_tty);
843         
844         /* Restart it in case no characters kick it off. Safe if
845            already running */
846         if (work)
847                 schedule_delayed_work(&tty->buf.work, 1);
848         return retval;
849 }
850
851 /*
852  * This routine returns a tty driver structure, given a device number
853  */
854 static struct tty_driver *get_tty_driver(dev_t device, int *index)
855 {
856         struct tty_driver *p;
857
858         list_for_each_entry(p, &tty_drivers, tty_drivers) {
859                 dev_t base = MKDEV(p->major, p->minor_start);
860                 if (device < base || device >= base + p->num)
861                         continue;
862                 *index = device - base;
863                 return p;
864         }
865         return NULL;
866 }
867
868 /*
869  * If we try to write to, or set the state of, a terminal and we're
870  * not in the foreground, send a SIGTTOU.  If the signal is blocked or
871  * ignored, go ahead and perform the operation.  (POSIX 7.2)
872  */
873 int tty_check_change(struct tty_struct * tty)
874 {
875         if (current->signal->tty != tty)
876                 return 0;
877         if (tty->pgrp <= 0) {
878                 printk(KERN_WARNING "tty_check_change: tty->pgrp <= 0!\n");
879                 return 0;
880         }
881         if (process_group(current) == tty->pgrp)
882                 return 0;
883         if (is_ignored(SIGTTOU))
884                 return 0;
885         if (is_orphaned_pgrp(process_group(current)))
886                 return -EIO;
887         (void) kill_pg(process_group(current), SIGTTOU, 1);
888         return -ERESTARTSYS;
889 }
890
891 EXPORT_SYMBOL(tty_check_change);
892
893 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
894                                 size_t count, loff_t *ppos)
895 {
896         return 0;
897 }
898
899 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
900                                  size_t count, loff_t *ppos)
901 {
902         return -EIO;
903 }
904
905 /* No kernel lock held - none needed ;) */
906 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
907 {
908         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
909 }
910
911 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
912                              unsigned int cmd, unsigned long arg)
913 {
914         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
915 }
916
917 static struct file_operations tty_fops = {
918         .llseek         = no_llseek,
919         .read           = tty_read,
920         .write          = tty_write,
921         .poll           = tty_poll,
922         .ioctl          = tty_ioctl,
923         .open           = tty_open,
924         .release        = tty_release,
925         .fasync         = tty_fasync,
926 };
927
928 #ifdef CONFIG_UNIX98_PTYS
929 static struct file_operations ptmx_fops = {
930         .llseek         = no_llseek,
931         .read           = tty_read,
932         .write          = tty_write,
933         .poll           = tty_poll,
934         .ioctl          = tty_ioctl,
935         .open           = ptmx_open,
936         .release        = tty_release,
937         .fasync         = tty_fasync,
938 };
939 #endif
940
941 static struct file_operations console_fops = {
942         .llseek         = no_llseek,
943         .read           = tty_read,
944         .write          = redirected_tty_write,
945         .poll           = tty_poll,
946         .ioctl          = tty_ioctl,
947         .open           = tty_open,
948         .release        = tty_release,
949         .fasync         = tty_fasync,
950 };
951
952 static struct file_operations hung_up_tty_fops = {
953         .llseek         = no_llseek,
954         .read           = hung_up_tty_read,
955         .write          = hung_up_tty_write,
956         .poll           = hung_up_tty_poll,
957         .ioctl          = hung_up_tty_ioctl,
958         .release        = tty_release,
959 };
960
961 static DEFINE_SPINLOCK(redirect_lock);
962 static struct file *redirect;
963
964 /**
965  *      tty_wakeup      -       request more data
966  *      @tty: terminal
967  *
968  *      Internal and external helper for wakeups of tty. This function
969  *      informs the line discipline if present that the driver is ready
970  *      to receive more output data.
971  */
972  
973 void tty_wakeup(struct tty_struct *tty)
974 {
975         struct tty_ldisc *ld;
976         
977         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
978                 ld = tty_ldisc_ref(tty);
979                 if(ld) {
980                         if(ld->write_wakeup)
981                                 ld->write_wakeup(tty);
982                         tty_ldisc_deref(ld);
983                 }
984         }
985         wake_up_interruptible(&tty->write_wait);
986 }
987
988 EXPORT_SYMBOL_GPL(tty_wakeup);
989
990 /**
991  *      tty_ldisc_flush -       flush line discipline queue
992  *      @tty: tty
993  *
994  *      Flush the line discipline queue (if any) for this tty. If there
995  *      is no line discipline active this is a no-op.
996  */
997  
998 void tty_ldisc_flush(struct tty_struct *tty)
999 {
1000         struct tty_ldisc *ld = tty_ldisc_ref(tty);
1001         if(ld) {
1002                 if(ld->flush_buffer)
1003                         ld->flush_buffer(tty);
1004                 tty_ldisc_deref(ld);
1005         }
1006 }
1007
1008 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
1009         
1010 /*
1011  * This can be called by the "eventd" kernel thread.  That is process synchronous,
1012  * but doesn't hold any locks, so we need to make sure we have the appropriate
1013  * locks for what we're doing..
1014  */
1015 static void do_tty_hangup(void *data)
1016 {
1017         struct tty_struct *tty = (struct tty_struct *) data;
1018         struct file * cons_filp = NULL;
1019         struct file *filp, *f = NULL;
1020         struct task_struct *p;
1021         struct tty_ldisc *ld;
1022         int    closecount = 0, n;
1023
1024         if (!tty)
1025                 return;
1026
1027         /* inuse_filps is protected by the single kernel lock */
1028         lock_kernel();
1029
1030         spin_lock(&redirect_lock);
1031         if (redirect && redirect->private_data == tty) {
1032                 f = redirect;
1033                 redirect = NULL;
1034         }
1035         spin_unlock(&redirect_lock);
1036         
1037         check_tty_count(tty, "do_tty_hangup");
1038         file_list_lock();
1039         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1040         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1041                 if (filp->f_op->write == redirected_tty_write)
1042                         cons_filp = filp;
1043                 if (filp->f_op->write != tty_write)
1044                         continue;
1045                 closecount++;
1046                 tty_fasync(-1, filp, 0);        /* can't block */
1047                 filp->f_op = &hung_up_tty_fops;
1048         }
1049         file_list_unlock();
1050         
1051         /* FIXME! What are the locking issues here? This may me overdoing things..
1052          * this question is especially important now that we've removed the irqlock. */
1053
1054         ld = tty_ldisc_ref(tty);
1055         if(ld != NULL)  /* We may have no line discipline at this point */
1056         {
1057                 if (ld->flush_buffer)
1058                         ld->flush_buffer(tty);
1059                 if (tty->driver->flush_buffer)
1060                         tty->driver->flush_buffer(tty);
1061                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1062                     ld->write_wakeup)
1063                         ld->write_wakeup(tty);
1064                 if (ld->hangup)
1065                         ld->hangup(tty);
1066         }
1067
1068         /* FIXME: Once we trust the LDISC code better we can wait here for
1069            ldisc completion and fix the driver call race */
1070            
1071         wake_up_interruptible(&tty->write_wait);
1072         wake_up_interruptible(&tty->read_wait);
1073
1074         /*
1075          * Shutdown the current line discipline, and reset it to
1076          * N_TTY.
1077          */
1078         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1079         {
1080                 down(&tty->termios_sem);
1081                 *tty->termios = tty->driver->init_termios;
1082                 up(&tty->termios_sem);
1083         }
1084         
1085         /* Defer ldisc switch */
1086         /* tty_deferred_ldisc_switch(N_TTY);
1087         
1088           This should get done automatically when the port closes and
1089           tty_release is called */
1090         
1091         read_lock(&tasklist_lock);
1092         if (tty->session > 0) {
1093                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1094                         if (p->signal->tty == tty)
1095                                 p->signal->tty = NULL;
1096                         if (!p->signal->leader)
1097                                 continue;
1098                         group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1099                         group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1100                         if (tty->pgrp > 0)
1101                                 p->signal->tty_old_pgrp = tty->pgrp;
1102                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1103         }
1104         read_unlock(&tasklist_lock);
1105
1106         tty->flags = 0;
1107         tty->session = 0;
1108         tty->pgrp = -1;
1109         tty->ctrl_status = 0;
1110         /*
1111          *      If one of the devices matches a console pointer, we
1112          *      cannot just call hangup() because that will cause
1113          *      tty->count and state->count to go out of sync.
1114          *      So we just call close() the right number of times.
1115          */
1116         if (cons_filp) {
1117                 if (tty->driver->close)
1118                         for (n = 0; n < closecount; n++)
1119                                 tty->driver->close(tty, cons_filp);
1120         } else if (tty->driver->hangup)
1121                 (tty->driver->hangup)(tty);
1122                 
1123         /* We don't want to have driver/ldisc interactions beyond
1124            the ones we did here. The driver layer expects no
1125            calls after ->hangup() from the ldisc side. However we
1126            can't yet guarantee all that */
1127
1128         set_bit(TTY_HUPPED, &tty->flags);
1129         if (ld) {
1130                 tty_ldisc_enable(tty);
1131                 tty_ldisc_deref(ld);
1132         }
1133         unlock_kernel();
1134         if (f)
1135                 fput(f);
1136 }
1137
1138 void tty_hangup(struct tty_struct * tty)
1139 {
1140 #ifdef TTY_DEBUG_HANGUP
1141         char    buf[64];
1142         
1143         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1144 #endif
1145         schedule_work(&tty->hangup_work);
1146 }
1147
1148 EXPORT_SYMBOL(tty_hangup);
1149
1150 void tty_vhangup(struct tty_struct * tty)
1151 {
1152 #ifdef TTY_DEBUG_HANGUP
1153         char    buf[64];
1154
1155         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1156 #endif
1157         do_tty_hangup((void *) tty);
1158 }
1159 EXPORT_SYMBOL(tty_vhangup);
1160
1161 int tty_hung_up_p(struct file * filp)
1162 {
1163         return (filp->f_op == &hung_up_tty_fops);
1164 }
1165
1166 EXPORT_SYMBOL(tty_hung_up_p);
1167
1168 /*
1169  * This function is typically called only by the session leader, when
1170  * it wants to disassociate itself from its controlling tty.
1171  *
1172  * It performs the following functions:
1173  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1174  *      (2)  Clears the tty from being controlling the session
1175  *      (3)  Clears the controlling tty for all processes in the
1176  *              session group.
1177  *
1178  * The argument on_exit is set to 1 if called when a process is
1179  * exiting; it is 0 if called by the ioctl TIOCNOTTY.
1180  */
1181 void disassociate_ctty(int on_exit)
1182 {
1183         struct tty_struct *tty;
1184         struct task_struct *p;
1185         int tty_pgrp = -1;
1186
1187         lock_kernel();
1188
1189         mutex_lock(&tty_mutex);
1190         tty = current->signal->tty;
1191         if (tty) {
1192                 tty_pgrp = tty->pgrp;
1193                 mutex_unlock(&tty_mutex);
1194                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1195                         tty_vhangup(tty);
1196         } else {
1197                 if (current->signal->tty_old_pgrp) {
1198                         kill_pg(current->signal->tty_old_pgrp, SIGHUP, on_exit);
1199                         kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit);
1200                 }
1201                 mutex_unlock(&tty_mutex);
1202                 unlock_kernel();        
1203                 return;
1204         }
1205         if (tty_pgrp > 0) {
1206                 kill_pg(tty_pgrp, SIGHUP, on_exit);
1207                 if (!on_exit)
1208                         kill_pg(tty_pgrp, SIGCONT, on_exit);
1209         }
1210
1211         /* Must lock changes to tty_old_pgrp */
1212         mutex_lock(&tty_mutex);
1213         current->signal->tty_old_pgrp = 0;
1214         tty->session = 0;
1215         tty->pgrp = -1;
1216
1217         /* Now clear signal->tty under the lock */
1218         read_lock(&tasklist_lock);
1219         do_each_task_pid(current->signal->session, PIDTYPE_SID, p) {
1220                 p->signal->tty = NULL;
1221         } while_each_task_pid(current->signal->session, PIDTYPE_SID, p);
1222         read_unlock(&tasklist_lock);
1223         mutex_unlock(&tty_mutex);
1224         unlock_kernel();
1225 }
1226
1227 void stop_tty(struct tty_struct *tty)
1228 {
1229         if (tty->stopped)
1230                 return;
1231         tty->stopped = 1;
1232         if (tty->link && tty->link->packet) {
1233                 tty->ctrl_status &= ~TIOCPKT_START;
1234                 tty->ctrl_status |= TIOCPKT_STOP;
1235                 wake_up_interruptible(&tty->link->read_wait);
1236         }
1237         if (tty->driver->stop)
1238                 (tty->driver->stop)(tty);
1239 }
1240
1241 EXPORT_SYMBOL(stop_tty);
1242
1243 void start_tty(struct tty_struct *tty)
1244 {
1245         if (!tty->stopped || tty->flow_stopped)
1246                 return;
1247         tty->stopped = 0;
1248         if (tty->link && tty->link->packet) {
1249                 tty->ctrl_status &= ~TIOCPKT_STOP;
1250                 tty->ctrl_status |= TIOCPKT_START;
1251                 wake_up_interruptible(&tty->link->read_wait);
1252         }
1253         if (tty->driver->start)
1254                 (tty->driver->start)(tty);
1255
1256         /* If we have a running line discipline it may need kicking */
1257         tty_wakeup(tty);
1258         wake_up_interruptible(&tty->write_wait);
1259 }
1260
1261 EXPORT_SYMBOL(start_tty);
1262
1263 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1264                         loff_t *ppos)
1265 {
1266         int i;
1267         struct tty_struct * tty;
1268         struct inode *inode;
1269         struct tty_ldisc *ld;
1270
1271         tty = (struct tty_struct *)file->private_data;
1272         inode = file->f_dentry->d_inode;
1273         if (tty_paranoia_check(tty, inode, "tty_read"))
1274                 return -EIO;
1275         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1276                 return -EIO;
1277
1278         /* We want to wait for the line discipline to sort out in this
1279            situation */
1280         ld = tty_ldisc_ref_wait(tty);
1281         lock_kernel();
1282         if (ld->read)
1283                 i = (ld->read)(tty,file,buf,count);
1284         else
1285                 i = -EIO;
1286         tty_ldisc_deref(ld);
1287         unlock_kernel();
1288         if (i > 0)
1289                 inode->i_atime = current_fs_time(inode->i_sb);
1290         return i;
1291 }
1292
1293 /*
1294  * Split writes up in sane blocksizes to avoid
1295  * denial-of-service type attacks
1296  */
1297 static inline ssize_t do_tty_write(
1298         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1299         struct tty_struct *tty,
1300         struct file *file,
1301         const char __user *buf,
1302         size_t count)
1303 {
1304         ssize_t ret = 0, written = 0;
1305         unsigned int chunk;
1306         
1307         if (mutex_lock_interruptible(&tty->atomic_write_lock)) {
1308                 return -ERESTARTSYS;
1309         }
1310
1311         /*
1312          * We chunk up writes into a temporary buffer. This
1313          * simplifies low-level drivers immensely, since they
1314          * don't have locking issues and user mode accesses.
1315          *
1316          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1317          * big chunk-size..
1318          *
1319          * The default chunk-size is 2kB, because the NTTY
1320          * layer has problems with bigger chunks. It will
1321          * claim to be able to handle more characters than
1322          * it actually does.
1323          */
1324         chunk = 2048;
1325         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1326                 chunk = 65536;
1327         if (count < chunk)
1328                 chunk = count;
1329
1330         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1331         if (tty->write_cnt < chunk) {
1332                 unsigned char *buf;
1333
1334                 if (chunk < 1024)
1335                         chunk = 1024;
1336
1337                 buf = kmalloc(chunk, GFP_KERNEL);
1338                 if (!buf) {
1339                         mutex_unlock(&tty->atomic_write_lock);
1340                         return -ENOMEM;
1341                 }
1342                 kfree(tty->write_buf);
1343                 tty->write_cnt = chunk;
1344                 tty->write_buf = buf;
1345         }
1346
1347         /* Do the write .. */
1348         for (;;) {
1349                 size_t size = count;
1350                 if (size > chunk)
1351                         size = chunk;
1352                 ret = -EFAULT;
1353                 if (copy_from_user(tty->write_buf, buf, size))
1354                         break;
1355                 lock_kernel();
1356                 ret = write(tty, file, tty->write_buf, size);
1357                 unlock_kernel();
1358                 if (ret <= 0)
1359                         break;
1360                 written += ret;
1361                 buf += ret;
1362                 count -= ret;
1363                 if (!count)
1364                         break;
1365                 ret = -ERESTARTSYS;
1366                 if (signal_pending(current))
1367                         break;
1368                 cond_resched();
1369         }
1370         if (written) {
1371                 struct inode *inode = file->f_dentry->d_inode;
1372                 inode->i_mtime = current_fs_time(inode->i_sb);
1373                 ret = written;
1374         }
1375         mutex_unlock(&tty->atomic_write_lock);
1376         return ret;
1377 }
1378
1379
1380 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1381                          loff_t *ppos)
1382 {
1383         struct tty_struct * tty;
1384         struct inode *inode = file->f_dentry->d_inode;
1385         ssize_t ret;
1386         struct tty_ldisc *ld;
1387         
1388         tty = (struct tty_struct *)file->private_data;
1389         if (tty_paranoia_check(tty, inode, "tty_write"))
1390                 return -EIO;
1391         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1392                 return -EIO;
1393
1394         ld = tty_ldisc_ref_wait(tty);           
1395         if (!ld->write)
1396                 ret = -EIO;
1397         else
1398                 ret = do_tty_write(ld->write, tty, file, buf, count);
1399         tty_ldisc_deref(ld);
1400         return ret;
1401 }
1402
1403 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1404                          loff_t *ppos)
1405 {
1406         struct file *p = NULL;
1407
1408         spin_lock(&redirect_lock);
1409         if (redirect) {
1410                 get_file(redirect);
1411                 p = redirect;
1412         }
1413         spin_unlock(&redirect_lock);
1414
1415         if (p) {
1416                 ssize_t res;
1417                 res = vfs_write(p, buf, count, &p->f_pos);
1418                 fput(p);
1419                 return res;
1420         }
1421
1422         return tty_write(file, buf, count, ppos);
1423 }
1424
1425 static char ptychar[] = "pqrstuvwxyzabcde";
1426
1427 static inline void pty_line_name(struct tty_driver *driver, int index, char *p)
1428 {
1429         int i = index + driver->name_base;
1430         /* ->name is initialized to "ttyp", but "tty" is expected */
1431         sprintf(p, "%s%c%x",
1432                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1433                         ptychar[i >> 4 & 0xf], i & 0xf);
1434 }
1435
1436 static inline void tty_line_name(struct tty_driver *driver, int index, char *p)
1437 {
1438         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1439 }
1440
1441 /*
1442  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1443  * failed open.  The new code protects the open with a mutex, so it's
1444  * really quite straightforward.  The mutex locking can probably be
1445  * relaxed for the (most common) case of reopening a tty.
1446  */
1447 static int init_dev(struct tty_driver *driver, int idx,
1448         struct tty_struct **ret_tty)
1449 {
1450         struct tty_struct *tty, *o_tty;
1451         struct termios *tp, **tp_loc, *o_tp, **o_tp_loc;
1452         struct termios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
1453         int retval=0;
1454
1455         /* check whether we're reopening an existing tty */
1456         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1457                 tty = devpts_get_tty(idx);
1458                 if (tty && driver->subtype == PTY_TYPE_MASTER)
1459                         tty = tty->link;
1460         } else {
1461                 tty = driver->ttys[idx];
1462         }
1463         if (tty) goto fast_track;
1464
1465         /*
1466          * First time open is complex, especially for PTY devices.
1467          * This code guarantees that either everything succeeds and the
1468          * TTY is ready for operation, or else the table slots are vacated
1469          * and the allocated memory released.  (Except that the termios 
1470          * and locked termios may be retained.)
1471          */
1472
1473         if (!try_module_get(driver->owner)) {
1474                 retval = -ENODEV;
1475                 goto end_init;
1476         }
1477
1478         o_tty = NULL;
1479         tp = o_tp = NULL;
1480         ltp = o_ltp = NULL;
1481
1482         tty = alloc_tty_struct();
1483         if(!tty)
1484                 goto fail_no_mem;
1485         initialize_tty_struct(tty);
1486         tty->driver = driver;
1487         tty->index = idx;
1488         tty_line_name(driver, idx, tty->name);
1489
1490         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1491                 tp_loc = &tty->termios;
1492                 ltp_loc = &tty->termios_locked;
1493         } else {
1494                 tp_loc = &driver->termios[idx];
1495                 ltp_loc = &driver->termios_locked[idx];
1496         }
1497
1498         if (!*tp_loc) {
1499                 tp = (struct termios *) kmalloc(sizeof(struct termios),
1500                                                 GFP_KERNEL);
1501                 if (!tp)
1502                         goto free_mem_out;
1503                 *tp = driver->init_termios;
1504         }
1505
1506         if (!*ltp_loc) {
1507                 ltp = (struct termios *) kmalloc(sizeof(struct termios),
1508                                                  GFP_KERNEL);
1509                 if (!ltp)
1510                         goto free_mem_out;
1511                 memset(ltp, 0, sizeof(struct termios));
1512         }
1513
1514         if (driver->type == TTY_DRIVER_TYPE_PTY) {
1515                 o_tty = alloc_tty_struct();
1516                 if (!o_tty)
1517                         goto free_mem_out;
1518                 initialize_tty_struct(o_tty);
1519                 o_tty->driver = driver->other;
1520                 o_tty->index = idx;
1521                 tty_line_name(driver->other, idx, o_tty->name);
1522
1523                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1524                         o_tp_loc = &o_tty->termios;
1525                         o_ltp_loc = &o_tty->termios_locked;
1526                 } else {
1527                         o_tp_loc = &driver->other->termios[idx];
1528                         o_ltp_loc = &driver->other->termios_locked[idx];
1529                 }
1530
1531                 if (!*o_tp_loc) {
1532                         o_tp = (struct termios *)
1533                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1534                         if (!o_tp)
1535                                 goto free_mem_out;
1536                         *o_tp = driver->other->init_termios;
1537                 }
1538
1539                 if (!*o_ltp_loc) {
1540                         o_ltp = (struct termios *)
1541                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1542                         if (!o_ltp)
1543                                 goto free_mem_out;
1544                         memset(o_ltp, 0, sizeof(struct termios));
1545                 }
1546
1547                 /*
1548                  * Everything allocated ... set up the o_tty structure.
1549                  */
1550                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
1551                         driver->other->ttys[idx] = o_tty;
1552                 }
1553                 if (!*o_tp_loc)
1554                         *o_tp_loc = o_tp;
1555                 if (!*o_ltp_loc)
1556                         *o_ltp_loc = o_ltp;
1557                 o_tty->termios = *o_tp_loc;
1558                 o_tty->termios_locked = *o_ltp_loc;
1559                 driver->other->refcount++;
1560                 if (driver->subtype == PTY_TYPE_MASTER)
1561                         o_tty->count++;
1562
1563                 /* Establish the links in both directions */
1564                 tty->link   = o_tty;
1565                 o_tty->link = tty;
1566         }
1567
1568         /* 
1569          * All structures have been allocated, so now we install them.
1570          * Failures after this point use release_mem to clean up, so 
1571          * there's no need to null out the local pointers.
1572          */
1573         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1574                 driver->ttys[idx] = tty;
1575         }
1576         
1577         if (!*tp_loc)
1578                 *tp_loc = tp;
1579         if (!*ltp_loc)
1580                 *ltp_loc = ltp;
1581         tty->termios = *tp_loc;
1582         tty->termios_locked = *ltp_loc;
1583         driver->refcount++;
1584         tty->count++;
1585
1586         /* 
1587          * Structures all installed ... call the ldisc open routines.
1588          * If we fail here just call release_mem to clean up.  No need
1589          * to decrement the use counts, as release_mem doesn't care.
1590          */
1591
1592         if (tty->ldisc.open) {
1593                 retval = (tty->ldisc.open)(tty);
1594                 if (retval)
1595                         goto release_mem_out;
1596         }
1597         if (o_tty && o_tty->ldisc.open) {
1598                 retval = (o_tty->ldisc.open)(o_tty);
1599                 if (retval) {
1600                         if (tty->ldisc.close)
1601                                 (tty->ldisc.close)(tty);
1602                         goto release_mem_out;
1603                 }
1604                 tty_ldisc_enable(o_tty);
1605         }
1606         tty_ldisc_enable(tty);
1607         goto success;
1608
1609         /*
1610          * This fast open can be used if the tty is already open.
1611          * No memory is allocated, and the only failures are from
1612          * attempting to open a closing tty or attempting multiple
1613          * opens on a pty master.
1614          */
1615 fast_track:
1616         if (test_bit(TTY_CLOSING, &tty->flags)) {
1617                 retval = -EIO;
1618                 goto end_init;
1619         }
1620         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1621             driver->subtype == PTY_TYPE_MASTER) {
1622                 /*
1623                  * special case for PTY masters: only one open permitted, 
1624                  * and the slave side open count is incremented as well.
1625                  */
1626                 if (tty->count) {
1627                         retval = -EIO;
1628                         goto end_init;
1629                 }
1630                 tty->link->count++;
1631         }
1632         tty->count++;
1633         tty->driver = driver; /* N.B. why do this every time?? */
1634
1635         /* FIXME */
1636         if(!test_bit(TTY_LDISC, &tty->flags))
1637                 printk(KERN_ERR "init_dev but no ldisc\n");
1638 success:
1639         *ret_tty = tty;
1640         
1641         /* All paths come through here to release the mutex */
1642 end_init:
1643         return retval;
1644
1645         /* Release locally allocated memory ... nothing placed in slots */
1646 free_mem_out:
1647         kfree(o_tp);
1648         if (o_tty)
1649                 free_tty_struct(o_tty);
1650         kfree(ltp);
1651         kfree(tp);
1652         free_tty_struct(tty);
1653
1654 fail_no_mem:
1655         module_put(driver->owner);
1656         retval = -ENOMEM;
1657         goto end_init;
1658
1659         /* call the tty release_mem routine to clean out this slot */
1660 release_mem_out:
1661         printk(KERN_INFO "init_dev: ldisc open failed, "
1662                          "clearing slot %d\n", idx);
1663         release_mem(tty, idx);
1664         goto end_init;
1665 }
1666
1667 /*
1668  * Releases memory associated with a tty structure, and clears out the
1669  * driver table slots.
1670  */
1671 static void release_mem(struct tty_struct *tty, int idx)
1672 {
1673         struct tty_struct *o_tty;
1674         struct termios *tp;
1675         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
1676
1677         if ((o_tty = tty->link) != NULL) {
1678                 if (!devpts)
1679                         o_tty->driver->ttys[idx] = NULL;
1680                 if (o_tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1681                         tp = o_tty->termios;
1682                         if (!devpts)
1683                                 o_tty->driver->termios[idx] = NULL;
1684                         kfree(tp);
1685
1686                         tp = o_tty->termios_locked;
1687                         if (!devpts)
1688                                 o_tty->driver->termios_locked[idx] = NULL;
1689                         kfree(tp);
1690                 }
1691                 o_tty->magic = 0;
1692                 o_tty->driver->refcount--;
1693                 file_list_lock();
1694                 list_del_init(&o_tty->tty_files);
1695                 file_list_unlock();
1696                 free_tty_struct(o_tty);
1697         }
1698
1699         if (!devpts)
1700                 tty->driver->ttys[idx] = NULL;
1701         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1702                 tp = tty->termios;
1703                 if (!devpts)
1704                         tty->driver->termios[idx] = NULL;
1705                 kfree(tp);
1706
1707                 tp = tty->termios_locked;
1708                 if (!devpts)
1709                         tty->driver->termios_locked[idx] = NULL;
1710                 kfree(tp);
1711         }
1712
1713         tty->magic = 0;
1714         tty->driver->refcount--;
1715         file_list_lock();
1716         list_del_init(&tty->tty_files);
1717         file_list_unlock();
1718         module_put(tty->driver->owner);
1719         free_tty_struct(tty);
1720 }
1721
1722 /*
1723  * Even releasing the tty structures is a tricky business.. We have
1724  * to be very careful that the structures are all released at the
1725  * same time, as interrupts might otherwise get the wrong pointers.
1726  *
1727  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1728  * lead to double frees or releasing memory still in use.
1729  */
1730 static void release_dev(struct file * filp)
1731 {
1732         struct tty_struct *tty, *o_tty;
1733         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1734         int     devpts;
1735         int     idx;
1736         char    buf[64];
1737         unsigned long flags;
1738         
1739         tty = (struct tty_struct *)filp->private_data;
1740         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "release_dev"))
1741                 return;
1742
1743         check_tty_count(tty, "release_dev");
1744
1745         tty_fasync(-1, filp, 0);
1746
1747         idx = tty->index;
1748         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1749                       tty->driver->subtype == PTY_TYPE_MASTER);
1750         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1751         o_tty = tty->link;
1752
1753 #ifdef TTY_PARANOIA_CHECK
1754         if (idx < 0 || idx >= tty->driver->num) {
1755                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
1756                                   "free (%s)\n", tty->name);
1757                 return;
1758         }
1759         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1760                 if (tty != tty->driver->ttys[idx]) {
1761                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
1762                                "for (%s)\n", idx, tty->name);
1763                         return;
1764                 }
1765                 if (tty->termios != tty->driver->termios[idx]) {
1766                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
1767                                "for (%s)\n",
1768                                idx, tty->name);
1769                         return;
1770                 }
1771                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
1772                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
1773                                "termios_locked for (%s)\n",
1774                                idx, tty->name);
1775                         return;
1776                 }
1777         }
1778 #endif
1779
1780 #ifdef TTY_DEBUG_HANGUP
1781         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
1782                tty_name(tty, buf), tty->count);
1783 #endif
1784
1785 #ifdef TTY_PARANOIA_CHECK
1786         if (tty->driver->other &&
1787              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1788                 if (o_tty != tty->driver->other->ttys[idx]) {
1789                         printk(KERN_DEBUG "release_dev: other->table[%d] "
1790                                           "not o_tty for (%s)\n",
1791                                idx, tty->name);
1792                         return;
1793                 }
1794                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1795                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
1796                                           "not o_termios for (%s)\n",
1797                                idx, tty->name);
1798                         return;
1799                 }
1800                 if (o_tty->termios_locked != 
1801                       tty->driver->other->termios_locked[idx]) {
1802                         printk(KERN_DEBUG "release_dev: other->termios_locked["
1803                                           "%d] not o_termios_locked for (%s)\n",
1804                                idx, tty->name);
1805                         return;
1806                 }
1807                 if (o_tty->link != tty) {
1808                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
1809                         return;
1810                 }
1811         }
1812 #endif
1813         if (tty->driver->close)
1814                 tty->driver->close(tty, filp);
1815
1816         /*
1817          * Sanity check: if tty->count is going to zero, there shouldn't be
1818          * any waiters on tty->read_wait or tty->write_wait.  We test the
1819          * wait queues and kick everyone out _before_ actually starting to
1820          * close.  This ensures that we won't block while releasing the tty
1821          * structure.
1822          *
1823          * The test for the o_tty closing is necessary, since the master and
1824          * slave sides may close in any order.  If the slave side closes out
1825          * first, its count will be one, since the master side holds an open.
1826          * Thus this test wouldn't be triggered at the time the slave closes,
1827          * so we do it now.
1828          *
1829          * Note that it's possible for the tty to be opened again while we're
1830          * flushing out waiters.  By recalculating the closing flags before
1831          * each iteration we avoid any problems.
1832          */
1833         while (1) {
1834                 /* Guard against races with tty->count changes elsewhere and
1835                    opens on /dev/tty */
1836                    
1837                 mutex_lock(&tty_mutex);
1838                 tty_closing = tty->count <= 1;
1839                 o_tty_closing = o_tty &&
1840                         (o_tty->count <= (pty_master ? 1 : 0));
1841                 do_sleep = 0;
1842
1843                 if (tty_closing) {
1844                         if (waitqueue_active(&tty->read_wait)) {
1845                                 wake_up(&tty->read_wait);
1846                                 do_sleep++;
1847                         }
1848                         if (waitqueue_active(&tty->write_wait)) {
1849                                 wake_up(&tty->write_wait);
1850                                 do_sleep++;
1851                         }
1852                 }
1853                 if (o_tty_closing) {
1854                         if (waitqueue_active(&o_tty->read_wait)) {
1855                                 wake_up(&o_tty->read_wait);
1856                                 do_sleep++;
1857                         }
1858                         if (waitqueue_active(&o_tty->write_wait)) {
1859                                 wake_up(&o_tty->write_wait);
1860                                 do_sleep++;
1861                         }
1862                 }
1863                 if (!do_sleep)
1864                         break;
1865
1866                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
1867                                     "active!\n", tty_name(tty, buf));
1868                 mutex_unlock(&tty_mutex);
1869                 schedule();
1870         }       
1871
1872         /*
1873          * The closing flags are now consistent with the open counts on 
1874          * both sides, and we've completed the last operation that could 
1875          * block, so it's safe to proceed with closing.
1876          */
1877         if (pty_master) {
1878                 if (--o_tty->count < 0) {
1879                         printk(KERN_WARNING "release_dev: bad pty slave count "
1880                                             "(%d) for %s\n",
1881                                o_tty->count, tty_name(o_tty, buf));
1882                         o_tty->count = 0;
1883                 }
1884         }
1885         if (--tty->count < 0) {
1886                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
1887                        tty->count, tty_name(tty, buf));
1888                 tty->count = 0;
1889         }
1890         
1891         /*
1892          * We've decremented tty->count, so we need to remove this file
1893          * descriptor off the tty->tty_files list; this serves two
1894          * purposes:
1895          *  - check_tty_count sees the correct number of file descriptors
1896          *    associated with this tty.
1897          *  - do_tty_hangup no longer sees this file descriptor as
1898          *    something that needs to be handled for hangups.
1899          */
1900         file_kill(filp);
1901         filp->private_data = NULL;
1902
1903         /*
1904          * Perform some housekeeping before deciding whether to return.
1905          *
1906          * Set the TTY_CLOSING flag if this was the last open.  In the
1907          * case of a pty we may have to wait around for the other side
1908          * to close, and TTY_CLOSING makes sure we can't be reopened.
1909          */
1910         if(tty_closing)
1911                 set_bit(TTY_CLOSING, &tty->flags);
1912         if(o_tty_closing)
1913                 set_bit(TTY_CLOSING, &o_tty->flags);
1914
1915         /*
1916          * If _either_ side is closing, make sure there aren't any
1917          * processes that still think tty or o_tty is their controlling
1918          * tty.
1919          */
1920         if (tty_closing || o_tty_closing) {
1921                 struct task_struct *p;
1922
1923                 read_lock(&tasklist_lock);
1924                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1925                         p->signal->tty = NULL;
1926                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1927                 if (o_tty)
1928                         do_each_task_pid(o_tty->session, PIDTYPE_SID, p) {
1929                                 p->signal->tty = NULL;
1930                         } while_each_task_pid(o_tty->session, PIDTYPE_SID, p);
1931                 read_unlock(&tasklist_lock);
1932         }
1933
1934         mutex_unlock(&tty_mutex);
1935
1936         /* check whether both sides are closing ... */
1937         if (!tty_closing || (o_tty && !o_tty_closing))
1938                 return;
1939         
1940 #ifdef TTY_DEBUG_HANGUP
1941         printk(KERN_DEBUG "freeing tty structure...");
1942 #endif
1943         /*
1944          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
1945          * kill any delayed work. As this is the final close it does not
1946          * race with the set_ldisc code path.
1947          */
1948         clear_bit(TTY_LDISC, &tty->flags);
1949         cancel_delayed_work(&tty->buf.work);
1950
1951         /*
1952          * Wait for ->hangup_work and ->buf.work handlers to terminate
1953          */
1954          
1955         flush_scheduled_work();
1956         
1957         /*
1958          * Wait for any short term users (we know they are just driver
1959          * side waiters as the file is closing so user count on the file
1960          * side is zero.
1961          */
1962         spin_lock_irqsave(&tty_ldisc_lock, flags);
1963         while(tty->ldisc.refcount)
1964         {
1965                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1966                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
1967                 spin_lock_irqsave(&tty_ldisc_lock, flags);
1968         }
1969         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1970         /*
1971          * Shutdown the current line discipline, and reset it to N_TTY.
1972          * N.B. why reset ldisc when we're releasing the memory??
1973          *
1974          * FIXME: this MUST get fixed for the new reflocking
1975          */
1976         if (tty->ldisc.close)
1977                 (tty->ldisc.close)(tty);
1978         tty_ldisc_put(tty->ldisc.num);
1979         
1980         /*
1981          *      Switch the line discipline back
1982          */
1983         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1984         tty_set_termios_ldisc(tty,N_TTY); 
1985         if (o_tty) {
1986                 /* FIXME: could o_tty be in setldisc here ? */
1987                 clear_bit(TTY_LDISC, &o_tty->flags);
1988                 if (o_tty->ldisc.close)
1989                         (o_tty->ldisc.close)(o_tty);
1990                 tty_ldisc_put(o_tty->ldisc.num);
1991                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
1992                 tty_set_termios_ldisc(o_tty,N_TTY); 
1993         }
1994         /*
1995          * The release_mem function takes care of the details of clearing
1996          * the slots and preserving the termios structure.
1997          */
1998         release_mem(tty, idx);
1999
2000 #ifdef CONFIG_UNIX98_PTYS
2001         /* Make this pty number available for reallocation */
2002         if (devpts) {
2003                 down(&allocated_ptys_lock);
2004                 idr_remove(&allocated_ptys, idx);
2005                 up(&allocated_ptys_lock);
2006         }
2007 #endif
2008
2009 }
2010
2011 /*
2012  * tty_open and tty_release keep up the tty count that contains the
2013  * number of opens done on a tty. We cannot use the inode-count, as
2014  * different inodes might point to the same tty.
2015  *
2016  * Open-counting is needed for pty masters, as well as for keeping
2017  * track of serial lines: DTR is dropped when the last close happens.
2018  * (This is not done solely through tty->count, now.  - Ted 1/27/92)
2019  *
2020  * The termios state of a pty is reset on first open so that
2021  * settings don't persist across reuse.
2022  */
2023 static int tty_open(struct inode * inode, struct file * filp)
2024 {
2025         struct tty_struct *tty;
2026         int noctty, retval;
2027         struct tty_driver *driver;
2028         int index;
2029         dev_t device = inode->i_rdev;
2030         unsigned short saved_flags = filp->f_flags;
2031
2032         nonseekable_open(inode, filp);
2033         
2034 retry_open:
2035         noctty = filp->f_flags & O_NOCTTY;
2036         index  = -1;
2037         retval = 0;
2038         
2039         mutex_lock(&tty_mutex);
2040
2041         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2042                 if (!current->signal->tty) {
2043                         mutex_unlock(&tty_mutex);
2044                         return -ENXIO;
2045                 }
2046                 driver = current->signal->tty->driver;
2047                 index = current->signal->tty->index;
2048                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2049                 /* noctty = 1; */
2050                 goto got_driver;
2051         }
2052 #ifdef CONFIG_VT
2053         if (device == MKDEV(TTY_MAJOR,0)) {
2054                 extern struct tty_driver *console_driver;
2055                 driver = console_driver;
2056                 index = fg_console;
2057                 noctty = 1;
2058                 goto got_driver;
2059         }
2060 #endif
2061         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2062                 driver = console_device(&index);
2063                 if (driver) {
2064                         /* Don't let /dev/console block */
2065                         filp->f_flags |= O_NONBLOCK;
2066                         noctty = 1;
2067                         goto got_driver;
2068                 }
2069                 mutex_unlock(&tty_mutex);
2070                 return -ENODEV;
2071         }
2072
2073         driver = get_tty_driver(device, &index);
2074         if (!driver) {
2075                 mutex_unlock(&tty_mutex);
2076                 return -ENODEV;
2077         }
2078 got_driver:
2079         retval = init_dev(driver, index, &tty);
2080         mutex_unlock(&tty_mutex);
2081         if (retval)
2082                 return retval;
2083
2084         filp->private_data = tty;
2085         file_move(filp, &tty->tty_files);
2086         check_tty_count(tty, "tty_open");
2087         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2088             tty->driver->subtype == PTY_TYPE_MASTER)
2089                 noctty = 1;
2090 #ifdef TTY_DEBUG_HANGUP
2091         printk(KERN_DEBUG "opening %s...", tty->name);
2092 #endif
2093         if (!retval) {
2094                 if (tty->driver->open)
2095                         retval = tty->driver->open(tty, filp);
2096                 else
2097                         retval = -ENODEV;
2098         }
2099         filp->f_flags = saved_flags;
2100
2101         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2102                 retval = -EBUSY;
2103
2104         if (retval) {
2105 #ifdef TTY_DEBUG_HANGUP
2106                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2107                        tty->name);
2108 #endif
2109                 release_dev(filp);
2110                 if (retval != -ERESTARTSYS)
2111                         return retval;
2112                 if (signal_pending(current))
2113                         return retval;
2114                 schedule();
2115                 /*
2116                  * Need to reset f_op in case a hangup happened.
2117                  */
2118                 if (filp->f_op == &hung_up_tty_fops)
2119                         filp->f_op = &tty_fops;
2120                 goto retry_open;
2121         }
2122         if (!noctty &&
2123             current->signal->leader &&
2124             !current->signal->tty &&
2125             tty->session == 0) {
2126                 task_lock(current);
2127                 current->signal->tty = tty;
2128                 task_unlock(current);
2129                 current->signal->tty_old_pgrp = 0;
2130                 tty->session = current->signal->session;
2131                 tty->pgrp = process_group(current);
2132         }
2133         return 0;
2134 }
2135
2136 #ifdef CONFIG_UNIX98_PTYS
2137 static int ptmx_open(struct inode * inode, struct file * filp)
2138 {
2139         struct tty_struct *tty;
2140         int retval;
2141         int index;
2142         int idr_ret;
2143
2144         nonseekable_open(inode, filp);
2145
2146         /* find a device that is not in use. */
2147         down(&allocated_ptys_lock);
2148         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2149                 up(&allocated_ptys_lock);
2150                 return -ENOMEM;
2151         }
2152         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2153         if (idr_ret < 0) {
2154                 up(&allocated_ptys_lock);
2155                 if (idr_ret == -EAGAIN)
2156                         return -ENOMEM;
2157                 return -EIO;
2158         }
2159         if (index >= pty_limit) {
2160                 idr_remove(&allocated_ptys, index);
2161                 up(&allocated_ptys_lock);
2162                 return -EIO;
2163         }
2164         up(&allocated_ptys_lock);
2165
2166         mutex_lock(&tty_mutex);
2167         retval = init_dev(ptm_driver, index, &tty);
2168         mutex_unlock(&tty_mutex);
2169         
2170         if (retval)
2171                 goto out;
2172
2173         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2174         filp->private_data = tty;
2175         file_move(filp, &tty->tty_files);
2176
2177         retval = -ENOMEM;
2178         if (devpts_pty_new(tty->link))
2179                 goto out1;
2180
2181         check_tty_count(tty, "tty_open");
2182         retval = ptm_driver->open(tty, filp);
2183         if (!retval)
2184                 return 0;
2185 out1:
2186         release_dev(filp);
2187         return retval;
2188 out:
2189         down(&allocated_ptys_lock);
2190         idr_remove(&allocated_ptys, index);
2191         up(&allocated_ptys_lock);
2192         return retval;
2193 }
2194 #endif
2195
2196 static int tty_release(struct inode * inode, struct file * filp)
2197 {
2198         lock_kernel();
2199         release_dev(filp);
2200         unlock_kernel();
2201         return 0;
2202 }
2203
2204 /* No kernel lock held - fine */
2205 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2206 {
2207         struct tty_struct * tty;
2208         struct tty_ldisc *ld;
2209         int ret = 0;
2210
2211         tty = (struct tty_struct *)filp->private_data;
2212         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_poll"))
2213                 return 0;
2214                 
2215         ld = tty_ldisc_ref_wait(tty);
2216         if (ld->poll)
2217                 ret = (ld->poll)(tty, filp, wait);
2218         tty_ldisc_deref(ld);
2219         return ret;
2220 }
2221
2222 static int tty_fasync(int fd, struct file * filp, int on)
2223 {
2224         struct tty_struct * tty;
2225         int retval;
2226
2227         tty = (struct tty_struct *)filp->private_data;
2228         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_fasync"))
2229                 return 0;
2230         
2231         retval = fasync_helper(fd, filp, on, &tty->fasync);
2232         if (retval <= 0)
2233                 return retval;
2234
2235         if (on) {
2236                 if (!waitqueue_active(&tty->read_wait))
2237                         tty->minimum_to_wake = 1;
2238                 retval = f_setown(filp, (-tty->pgrp) ? : current->pid, 0);
2239                 if (retval)
2240                         return retval;
2241         } else {
2242                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2243                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2244         }
2245         return 0;
2246 }
2247
2248 static int tiocsti(struct tty_struct *tty, char __user *p)
2249 {
2250         char ch, mbz = 0;
2251         struct tty_ldisc *ld;
2252         
2253         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2254                 return -EPERM;
2255         if (get_user(ch, p))
2256                 return -EFAULT;
2257         ld = tty_ldisc_ref_wait(tty);
2258         ld->receive_buf(tty, &ch, &mbz, 1);
2259         tty_ldisc_deref(ld);
2260         return 0;
2261 }
2262
2263 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2264 {
2265         if (copy_to_user(arg, &tty->winsize, sizeof(*arg)))
2266                 return -EFAULT;
2267         return 0;
2268 }
2269
2270 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2271         struct winsize __user * arg)
2272 {
2273         struct winsize tmp_ws;
2274
2275         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2276                 return -EFAULT;
2277         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2278                 return 0;
2279 #ifdef CONFIG_VT
2280         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2281                 int rc;
2282
2283                 acquire_console_sem();
2284                 rc = vc_resize(tty->driver_data, tmp_ws.ws_col, tmp_ws.ws_row);
2285                 release_console_sem();
2286                 if (rc)
2287                         return -ENXIO;
2288         }
2289 #endif
2290         if (tty->pgrp > 0)
2291                 kill_pg(tty->pgrp, SIGWINCH, 1);
2292         if ((real_tty->pgrp != tty->pgrp) && (real_tty->pgrp > 0))
2293                 kill_pg(real_tty->pgrp, SIGWINCH, 1);
2294         tty->winsize = tmp_ws;
2295         real_tty->winsize = tmp_ws;
2296         return 0;
2297 }
2298
2299 static int tioccons(struct file *file)
2300 {
2301         if (!capable(CAP_SYS_ADMIN))
2302                 return -EPERM;
2303         if (file->f_op->write == redirected_tty_write) {
2304                 struct file *f;
2305                 spin_lock(&redirect_lock);
2306                 f = redirect;
2307                 redirect = NULL;
2308                 spin_unlock(&redirect_lock);
2309                 if (f)
2310                         fput(f);
2311                 return 0;
2312         }
2313         spin_lock(&redirect_lock);
2314         if (redirect) {
2315                 spin_unlock(&redirect_lock);
2316                 return -EBUSY;
2317         }
2318         get_file(file);
2319         redirect = file;
2320         spin_unlock(&redirect_lock);
2321         return 0;
2322 }
2323
2324
2325 static int fionbio(struct file *file, int __user *p)
2326 {
2327         int nonblock;
2328
2329         if (get_user(nonblock, p))
2330                 return -EFAULT;
2331
2332         if (nonblock)
2333                 file->f_flags |= O_NONBLOCK;
2334         else
2335                 file->f_flags &= ~O_NONBLOCK;
2336         return 0;
2337 }
2338
2339 static int tiocsctty(struct tty_struct *tty, int arg)
2340 {
2341         task_t *p;
2342
2343         if (current->signal->leader &&
2344             (current->signal->session == tty->session))
2345                 return 0;
2346         /*
2347          * The process must be a session leader and
2348          * not have a controlling tty already.
2349          */
2350         if (!current->signal->leader || current->signal->tty)
2351                 return -EPERM;
2352         if (tty->session > 0) {
2353                 /*
2354                  * This tty is already the controlling
2355                  * tty for another session group!
2356                  */
2357                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
2358                         /*
2359                          * Steal it away
2360                          */
2361
2362                         read_lock(&tasklist_lock);
2363                         do_each_task_pid(tty->session, PIDTYPE_SID, p) {
2364                                 p->signal->tty = NULL;
2365                         } while_each_task_pid(tty->session, PIDTYPE_SID, p);
2366                         read_unlock(&tasklist_lock);
2367                 } else
2368                         return -EPERM;
2369         }
2370         task_lock(current);
2371         current->signal->tty = tty;
2372         task_unlock(current);
2373         current->signal->tty_old_pgrp = 0;
2374         tty->session = current->signal->session;
2375         tty->pgrp = process_group(current);
2376         return 0;
2377 }
2378
2379 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2380 {
2381         /*
2382          * (tty == real_tty) is a cheap way of
2383          * testing if the tty is NOT a master pty.
2384          */
2385         if (tty == real_tty && current->signal->tty != real_tty)
2386                 return -ENOTTY;
2387         return put_user(real_tty->pgrp, p);
2388 }
2389
2390 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2391 {
2392         pid_t pgrp;
2393         int retval = tty_check_change(real_tty);
2394
2395         if (retval == -EIO)
2396                 return -ENOTTY;
2397         if (retval)
2398                 return retval;
2399         if (!current->signal->tty ||
2400             (current->signal->tty != real_tty) ||
2401             (real_tty->session != current->signal->session))
2402                 return -ENOTTY;
2403         if (get_user(pgrp, p))
2404                 return -EFAULT;
2405         if (pgrp < 0)
2406                 return -EINVAL;
2407         if (session_of_pgrp(pgrp) != current->signal->session)
2408                 return -EPERM;
2409         real_tty->pgrp = pgrp;
2410         return 0;
2411 }
2412
2413 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2414 {
2415         /*
2416          * (tty == real_tty) is a cheap way of
2417          * testing if the tty is NOT a master pty.
2418         */
2419         if (tty == real_tty && current->signal->tty != real_tty)
2420                 return -ENOTTY;
2421         if (real_tty->session <= 0)
2422                 return -ENOTTY;
2423         return put_user(real_tty->session, p);
2424 }
2425
2426 static int tiocsetd(struct tty_struct *tty, int __user *p)
2427 {
2428         int ldisc;
2429
2430         if (get_user(ldisc, p))
2431                 return -EFAULT;
2432         return tty_set_ldisc(tty, ldisc);
2433 }
2434
2435 static int send_break(struct tty_struct *tty, unsigned int duration)
2436 {
2437         tty->driver->break_ctl(tty, -1);
2438         if (!signal_pending(current)) {
2439                 msleep_interruptible(duration);
2440         }
2441         tty->driver->break_ctl(tty, 0);
2442         if (signal_pending(current))
2443                 return -EINTR;
2444         return 0;
2445 }
2446
2447 static int
2448 tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
2449 {
2450         int retval = -EINVAL;
2451
2452         if (tty->driver->tiocmget) {
2453                 retval = tty->driver->tiocmget(tty, file);
2454
2455                 if (retval >= 0)
2456                         retval = put_user(retval, p);
2457         }
2458         return retval;
2459 }
2460
2461 static int
2462 tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
2463              unsigned __user *p)
2464 {
2465         int retval = -EINVAL;
2466
2467         if (tty->driver->tiocmset) {
2468                 unsigned int set, clear, val;
2469
2470                 retval = get_user(val, p);
2471                 if (retval)
2472                         return retval;
2473
2474                 set = clear = 0;
2475                 switch (cmd) {
2476                 case TIOCMBIS:
2477                         set = val;
2478                         break;
2479                 case TIOCMBIC:
2480                         clear = val;
2481                         break;
2482                 case TIOCMSET:
2483                         set = val;
2484                         clear = ~val;
2485                         break;
2486                 }
2487
2488                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2489                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2490
2491                 retval = tty->driver->tiocmset(tty, file, set, clear);
2492         }
2493         return retval;
2494 }
2495
2496 /*
2497  * Split this up, as gcc can choke on it otherwise..
2498  */
2499 int tty_ioctl(struct inode * inode, struct file * file,
2500               unsigned int cmd, unsigned long arg)
2501 {
2502         struct tty_struct *tty, *real_tty;
2503         void __user *p = (void __user *)arg;
2504         int retval;
2505         struct tty_ldisc *ld;
2506         
2507         tty = (struct tty_struct *)file->private_data;
2508         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2509                 return -EINVAL;
2510
2511         real_tty = tty;
2512         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2513             tty->driver->subtype == PTY_TYPE_MASTER)
2514                 real_tty = tty->link;
2515
2516         /*
2517          * Break handling by driver
2518          */
2519         if (!tty->driver->break_ctl) {
2520                 switch(cmd) {
2521                 case TIOCSBRK:
2522                 case TIOCCBRK:
2523                         if (tty->driver->ioctl)
2524                                 return tty->driver->ioctl(tty, file, cmd, arg);
2525                         return -EINVAL;
2526                         
2527                 /* These two ioctl's always return success; even if */
2528                 /* the driver doesn't support them. */
2529                 case TCSBRK:
2530                 case TCSBRKP:
2531                         if (!tty->driver->ioctl)
2532                                 return 0;
2533                         retval = tty->driver->ioctl(tty, file, cmd, arg);
2534                         if (retval == -ENOIOCTLCMD)
2535                                 retval = 0;
2536                         return retval;
2537                 }
2538         }
2539
2540         /*
2541          * Factor out some common prep work
2542          */
2543         switch (cmd) {
2544         case TIOCSETD:
2545         case TIOCSBRK:
2546         case TIOCCBRK:
2547         case TCSBRK:
2548         case TCSBRKP:                   
2549                 retval = tty_check_change(tty);
2550                 if (retval)
2551                         return retval;
2552                 if (cmd != TIOCCBRK) {
2553                         tty_wait_until_sent(tty, 0);
2554                         if (signal_pending(current))
2555                                 return -EINTR;
2556                 }
2557                 break;
2558         }
2559
2560         switch (cmd) {
2561                 case TIOCSTI:
2562                         return tiocsti(tty, p);
2563                 case TIOCGWINSZ:
2564                         return tiocgwinsz(tty, p);
2565                 case TIOCSWINSZ:
2566                         return tiocswinsz(tty, real_tty, p);
2567                 case TIOCCONS:
2568                         return real_tty!=tty ? -EINVAL : tioccons(file);
2569                 case FIONBIO:
2570                         return fionbio(file, p);
2571                 case TIOCEXCL:
2572                         set_bit(TTY_EXCLUSIVE, &tty->flags);
2573                         return 0;
2574                 case TIOCNXCL:
2575                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
2576                         return 0;
2577                 case TIOCNOTTY:
2578                         if (current->signal->tty != tty)
2579                                 return -ENOTTY;
2580                         if (current->signal->leader)
2581                                 disassociate_ctty(0);
2582                         task_lock(current);
2583                         current->signal->tty = NULL;
2584                         task_unlock(current);
2585                         return 0;
2586                 case TIOCSCTTY:
2587                         return tiocsctty(tty, arg);
2588                 case TIOCGPGRP:
2589                         return tiocgpgrp(tty, real_tty, p);
2590                 case TIOCSPGRP:
2591                         return tiocspgrp(tty, real_tty, p);
2592                 case TIOCGSID:
2593                         return tiocgsid(tty, real_tty, p);
2594                 case TIOCGETD:
2595                         /* FIXME: check this is ok */
2596                         return put_user(tty->ldisc.num, (int __user *)p);
2597                 case TIOCSETD:
2598                         return tiocsetd(tty, p);
2599 #ifdef CONFIG_VT
2600                 case TIOCLINUX:
2601                         return tioclinux(tty, arg);
2602 #endif
2603                 /*
2604                  * Break handling
2605                  */
2606                 case TIOCSBRK:  /* Turn break on, unconditionally */
2607                         tty->driver->break_ctl(tty, -1);
2608                         return 0;
2609                         
2610                 case TIOCCBRK:  /* Turn break off, unconditionally */
2611                         tty->driver->break_ctl(tty, 0);
2612                         return 0;
2613                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
2614                         /* non-zero arg means wait for all output data
2615                          * to be sent (performed above) but don't send break.
2616                          * This is used by the tcdrain() termios function.
2617                          */
2618                         if (!arg)
2619                                 return send_break(tty, 250);
2620                         return 0;
2621                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
2622                         return send_break(tty, arg ? arg*100 : 250);
2623
2624                 case TIOCMGET:
2625                         return tty_tiocmget(tty, file, p);
2626
2627                 case TIOCMSET:
2628                 case TIOCMBIC:
2629                 case TIOCMBIS:
2630                         return tty_tiocmset(tty, file, cmd, p);
2631         }
2632         if (tty->driver->ioctl) {
2633                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
2634                 if (retval != -ENOIOCTLCMD)
2635                         return retval;
2636         }
2637         ld = tty_ldisc_ref_wait(tty);
2638         retval = -EINVAL;
2639         if (ld->ioctl) {
2640                 retval = ld->ioctl(tty, file, cmd, arg);
2641                 if (retval == -ENOIOCTLCMD)
2642                         retval = -EINVAL;
2643         }
2644         tty_ldisc_deref(ld);
2645         return retval;
2646 }
2647
2648
2649 /*
2650  * This implements the "Secure Attention Key" ---  the idea is to
2651  * prevent trojan horses by killing all processes associated with this
2652  * tty when the user hits the "Secure Attention Key".  Required for
2653  * super-paranoid applications --- see the Orange Book for more details.
2654  * 
2655  * This code could be nicer; ideally it should send a HUP, wait a few
2656  * seconds, then send a INT, and then a KILL signal.  But you then
2657  * have to coordinate with the init process, since all processes associated
2658  * with the current tty must be dead before the new getty is allowed
2659  * to spawn.
2660  *
2661  * Now, if it would be correct ;-/ The current code has a nasty hole -
2662  * it doesn't catch files in flight. We may send the descriptor to ourselves
2663  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2664  *
2665  * Nasty bug: do_SAK is being called in interrupt context.  This can
2666  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2667  */
2668 static void __do_SAK(void *arg)
2669 {
2670 #ifdef TTY_SOFT_SAK
2671         tty_hangup(tty);
2672 #else
2673         struct tty_struct *tty = arg;
2674         struct task_struct *g, *p;
2675         int session;
2676         int             i;
2677         struct file     *filp;
2678         struct tty_ldisc *disc;
2679         struct fdtable *fdt;
2680         
2681         if (!tty)
2682                 return;
2683         session  = tty->session;
2684         
2685         /* We don't want an ldisc switch during this */
2686         disc = tty_ldisc_ref(tty);
2687         if (disc && disc->flush_buffer)
2688                 disc->flush_buffer(tty);
2689         tty_ldisc_deref(disc);
2690
2691         if (tty->driver->flush_buffer)
2692                 tty->driver->flush_buffer(tty);
2693         
2694         read_lock(&tasklist_lock);
2695         /* Kill the entire session */
2696         do_each_task_pid(session, PIDTYPE_SID, p) {
2697                 printk(KERN_NOTICE "SAK: killed process %d"
2698                         " (%s): p->signal->session==tty->session\n",
2699                         p->pid, p->comm);
2700                 send_sig(SIGKILL, p, 1);
2701         } while_each_task_pid(session, PIDTYPE_SID, p);
2702         /* Now kill any processes that happen to have the
2703          * tty open.
2704          */
2705         do_each_thread(g, p) {
2706                 if (p->signal->tty == tty) {
2707                         printk(KERN_NOTICE "SAK: killed process %d"
2708                             " (%s): p->signal->session==tty->session\n",
2709                             p->pid, p->comm);
2710                         send_sig(SIGKILL, p, 1);
2711                         continue;
2712                 }
2713                 task_lock(p);
2714                 if (p->files) {
2715                         /*
2716                          * We don't take a ref to the file, so we must
2717                          * hold ->file_lock instead.
2718                          */
2719                         spin_lock(&p->files->file_lock);
2720                         fdt = files_fdtable(p->files);
2721                         for (i=0; i < fdt->max_fds; i++) {
2722                                 filp = fcheck_files(p->files, i);
2723                                 if (!filp)
2724                                         continue;
2725                                 if (filp->f_op->read == tty_read &&
2726                                     filp->private_data == tty) {
2727                                         printk(KERN_NOTICE "SAK: killed process %d"
2728                                             " (%s): fd#%d opened to the tty\n",
2729                                             p->pid, p->comm, i);
2730                                         force_sig(SIGKILL, p);
2731                                         break;
2732                                 }
2733                         }
2734                         spin_unlock(&p->files->file_lock);
2735                 }
2736                 task_unlock(p);
2737         } while_each_thread(g, p);
2738         read_unlock(&tasklist_lock);
2739 #endif
2740 }
2741
2742 /*
2743  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2744  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2745  * the values which we write to it will be identical to the values which it
2746  * already has. --akpm
2747  */
2748 void do_SAK(struct tty_struct *tty)
2749 {
2750         if (!tty)
2751                 return;
2752         PREPARE_WORK(&tty->SAK_work, __do_SAK, tty);
2753         schedule_work(&tty->SAK_work);
2754 }
2755
2756 EXPORT_SYMBOL(do_SAK);
2757
2758 /*
2759  * This routine is called out of the software interrupt to flush data
2760  * from the buffer chain to the line discipline.
2761  */
2762  
2763 static void flush_to_ldisc(void *private_)
2764 {
2765         struct tty_struct *tty = (struct tty_struct *) private_;
2766         unsigned long   flags;
2767         struct tty_ldisc *disc;
2768         struct tty_buffer *tbuf, *head;
2769         char *char_buf;
2770         unsigned char *flag_buf;
2771
2772         disc = tty_ldisc_ref(tty);
2773         if (disc == NULL)       /*  !TTY_LDISC */
2774                 return;
2775
2776         spin_lock_irqsave(&tty->buf.lock, flags);
2777         head = tty->buf.head;
2778         if (head != NULL) {
2779                 tty->buf.head = NULL;
2780                 for (;;) {
2781                         int count = head->commit - head->read;
2782                         if (!count) {
2783                                 if (head->next == NULL)
2784                                         break;
2785                                 tbuf = head;
2786                                 head = head->next;
2787                                 tty_buffer_free(tty, tbuf);
2788                                 continue;
2789                         }
2790                         if (!tty->receive_room) {
2791                                 schedule_delayed_work(&tty->buf.work, 1);
2792                                 break;
2793                         }
2794                         if (count > tty->receive_room)
2795                                 count = tty->receive_room;
2796                         char_buf = head->char_buf_ptr + head->read;
2797                         flag_buf = head->flag_buf_ptr + head->read;
2798                         head->read += count;
2799                         spin_unlock_irqrestore(&tty->buf.lock, flags);
2800                         disc->receive_buf(tty, char_buf, flag_buf, count);
2801                         spin_lock_irqsave(&tty->buf.lock, flags);
2802                 }
2803                 tty->buf.head = head;
2804         }
2805         spin_unlock_irqrestore(&tty->buf.lock, flags);
2806
2807         tty_ldisc_deref(disc);
2808 }
2809
2810 /*
2811  * Routine which returns the baud rate of the tty
2812  *
2813  * Note that the baud_table needs to be kept in sync with the
2814  * include/asm/termbits.h file.
2815  */
2816 static int baud_table[] = {
2817         0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
2818         9600, 19200, 38400, 57600, 115200, 230400, 460800,
2819 #ifdef __sparc__
2820         76800, 153600, 307200, 614400, 921600
2821 #else
2822         500000, 576000, 921600, 1000000, 1152000, 1500000, 2000000,
2823         2500000, 3000000, 3500000, 4000000
2824 #endif
2825 };
2826
2827 static int n_baud_table = ARRAY_SIZE(baud_table);
2828
2829 /**
2830  *      tty_termios_baud_rate
2831  *      @termios: termios structure
2832  *
2833  *      Convert termios baud rate data into a speed. This should be called
2834  *      with the termios lock held if this termios is a terminal termios
2835  *      structure. May change the termios data.
2836  */
2837  
2838 int tty_termios_baud_rate(struct termios *termios)
2839 {
2840         unsigned int cbaud;
2841         
2842         cbaud = termios->c_cflag & CBAUD;
2843
2844         if (cbaud & CBAUDEX) {
2845                 cbaud &= ~CBAUDEX;
2846
2847                 if (cbaud < 1 || cbaud + 15 > n_baud_table)
2848                         termios->c_cflag &= ~CBAUDEX;
2849                 else
2850                         cbaud += 15;
2851         }
2852         return baud_table[cbaud];
2853 }
2854
2855 EXPORT_SYMBOL(tty_termios_baud_rate);
2856
2857 /**
2858  *      tty_get_baud_rate       -       get tty bit rates
2859  *      @tty: tty to query
2860  *
2861  *      Returns the baud rate as an integer for this terminal. The
2862  *      termios lock must be held by the caller and the terminal bit
2863  *      flags may be updated.
2864  */
2865  
2866 int tty_get_baud_rate(struct tty_struct *tty)
2867 {
2868         int baud = tty_termios_baud_rate(tty->termios);
2869
2870         if (baud == 38400 && tty->alt_speed) {
2871                 if (!tty->warned) {
2872                         printk(KERN_WARNING "Use of setserial/setrocket to "
2873                                             "set SPD_* flags is deprecated\n");
2874                         tty->warned = 1;
2875                 }
2876                 baud = tty->alt_speed;
2877         }
2878         
2879         return baud;
2880 }
2881
2882 EXPORT_SYMBOL(tty_get_baud_rate);
2883
2884 /**
2885  *      tty_flip_buffer_push    -       terminal
2886  *      @tty: tty to push
2887  *
2888  *      Queue a push of the terminal flip buffers to the line discipline. This
2889  *      function must not be called from IRQ context if tty->low_latency is set.
2890  *
2891  *      In the event of the queue being busy for flipping the work will be
2892  *      held off and retried later.
2893  */
2894
2895 void tty_flip_buffer_push(struct tty_struct *tty)
2896 {
2897         unsigned long flags;
2898         spin_lock_irqsave(&tty->buf.lock, flags);
2899         if (tty->buf.tail != NULL)
2900                 tty->buf.tail->commit = tty->buf.tail->used;
2901         spin_unlock_irqrestore(&tty->buf.lock, flags);
2902
2903         if (tty->low_latency)
2904                 flush_to_ldisc((void *) tty);
2905         else
2906                 schedule_delayed_work(&tty->buf.work, 1);
2907 }
2908
2909 EXPORT_SYMBOL(tty_flip_buffer_push);
2910
2911
2912 /*
2913  * This subroutine initializes a tty structure.
2914  */
2915 static void initialize_tty_struct(struct tty_struct *tty)
2916 {
2917         memset(tty, 0, sizeof(struct tty_struct));
2918         tty->magic = TTY_MAGIC;
2919         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2920         tty->pgrp = -1;
2921         tty->overrun_time = jiffies;
2922         tty->buf.head = tty->buf.tail = NULL;
2923         tty_buffer_init(tty);
2924         INIT_WORK(&tty->buf.work, flush_to_ldisc, tty);
2925         init_MUTEX(&tty->buf.pty_sem);
2926         init_MUTEX(&tty->termios_sem);
2927         init_waitqueue_head(&tty->write_wait);
2928         init_waitqueue_head(&tty->read_wait);
2929         INIT_WORK(&tty->hangup_work, do_tty_hangup, tty);
2930         mutex_init(&tty->atomic_read_lock);
2931         mutex_init(&tty->atomic_write_lock);
2932         spin_lock_init(&tty->read_lock);
2933         INIT_LIST_HEAD(&tty->tty_files);
2934         INIT_WORK(&tty->SAK_work, NULL, NULL);
2935 }
2936
2937 /*
2938  * The default put_char routine if the driver did not define one.
2939  */
2940 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
2941 {
2942         tty->driver->write(tty, &ch, 1);
2943 }
2944
2945 static struct class *tty_class;
2946
2947 /**
2948  * tty_register_device - register a tty device
2949  * @driver: the tty driver that describes the tty device
2950  * @index: the index in the tty driver for this tty device
2951  * @device: a struct device that is associated with this tty device.
2952  *      This field is optional, if there is no known struct device for this
2953  *      tty device it can be set to NULL safely.
2954  *
2955  * Returns a pointer to the class device (or ERR_PTR(-EFOO) on error).
2956  *
2957  * This call is required to be made to register an individual tty device if
2958  * the tty driver's flags have the TTY_DRIVER_NO_DEVFS bit set.  If that
2959  * bit is not set, this function should not be called.
2960  */
2961 struct class_device *tty_register_device(struct tty_driver *driver,
2962                                          unsigned index, struct device *device)
2963 {
2964         char name[64];
2965         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
2966
2967         if (index >= driver->num) {
2968                 printk(KERN_ERR "Attempt to register invalid tty line number "
2969                        " (%d).\n", index);
2970                 return ERR_PTR(-EINVAL);
2971         }
2972
2973         devfs_mk_cdev(dev, S_IFCHR | S_IRUSR | S_IWUSR,
2974                         "%s%d", driver->devfs_name, index + driver->name_base);
2975
2976         if (driver->type == TTY_DRIVER_TYPE_PTY)
2977                 pty_line_name(driver, index, name);
2978         else
2979                 tty_line_name(driver, index, name);
2980
2981         return class_device_create(tty_class, NULL, dev, device, "%s", name);
2982 }
2983
2984 /**
2985  * tty_unregister_device - unregister a tty device
2986  * @driver: the tty driver that describes the tty device
2987  * @index: the index in the tty driver for this tty device
2988  *
2989  * If a tty device is registered with a call to tty_register_device() then
2990  * this function must be made when the tty device is gone.
2991  */
2992 void tty_unregister_device(struct tty_driver *driver, unsigned index)
2993 {
2994         devfs_remove("%s%d", driver->devfs_name, index + driver->name_base);
2995         class_device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
2996 }
2997
2998 EXPORT_SYMBOL(tty_register_device);
2999 EXPORT_SYMBOL(tty_unregister_device);
3000
3001 struct tty_driver *alloc_tty_driver(int lines)
3002 {
3003         struct tty_driver *driver;
3004
3005         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
3006         if (driver) {
3007                 memset(driver, 0, sizeof(struct tty_driver));
3008                 driver->magic = TTY_DRIVER_MAGIC;
3009                 driver->num = lines;
3010                 /* later we'll move allocation of tables here */
3011         }
3012         return driver;
3013 }
3014
3015 void put_tty_driver(struct tty_driver *driver)
3016 {
3017         kfree(driver);
3018 }
3019
3020 void tty_set_operations(struct tty_driver *driver, struct tty_operations *op)
3021 {
3022         driver->open = op->open;
3023         driver->close = op->close;
3024         driver->write = op->write;
3025         driver->put_char = op->put_char;
3026         driver->flush_chars = op->flush_chars;
3027         driver->write_room = op->write_room;
3028         driver->chars_in_buffer = op->chars_in_buffer;
3029         driver->ioctl = op->ioctl;
3030         driver->set_termios = op->set_termios;
3031         driver->throttle = op->throttle;
3032         driver->unthrottle = op->unthrottle;
3033         driver->stop = op->stop;
3034         driver->start = op->start;
3035         driver->hangup = op->hangup;
3036         driver->break_ctl = op->break_ctl;
3037         driver->flush_buffer = op->flush_buffer;
3038         driver->set_ldisc = op->set_ldisc;
3039         driver->wait_until_sent = op->wait_until_sent;
3040         driver->send_xchar = op->send_xchar;
3041         driver->read_proc = op->read_proc;
3042         driver->write_proc = op->write_proc;
3043         driver->tiocmget = op->tiocmget;
3044         driver->tiocmset = op->tiocmset;
3045 }
3046
3047
3048 EXPORT_SYMBOL(alloc_tty_driver);
3049 EXPORT_SYMBOL(put_tty_driver);
3050 EXPORT_SYMBOL(tty_set_operations);
3051
3052 /*
3053  * Called by a tty driver to register itself.
3054  */
3055 int tty_register_driver(struct tty_driver *driver)
3056 {
3057         int error;
3058         int i;
3059         dev_t dev;
3060         void **p = NULL;
3061
3062         if (driver->flags & TTY_DRIVER_INSTALLED)
3063                 return 0;
3064
3065         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
3066                 p = kmalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3067                 if (!p)
3068                         return -ENOMEM;
3069                 memset(p, 0, driver->num * 3 * sizeof(void *));
3070         }
3071
3072         if (!driver->major) {
3073                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3074                                                 (char*)driver->name);
3075                 if (!error) {
3076                         driver->major = MAJOR(dev);
3077                         driver->minor_start = MINOR(dev);
3078                 }
3079         } else {
3080                 dev = MKDEV(driver->major, driver->minor_start);
3081                 error = register_chrdev_region(dev, driver->num,
3082                                                 (char*)driver->name);
3083         }
3084         if (error < 0) {
3085                 kfree(p);
3086                 return error;
3087         }
3088
3089         if (p) {
3090                 driver->ttys = (struct tty_struct **)p;
3091                 driver->termios = (struct termios **)(p + driver->num);
3092                 driver->termios_locked = (struct termios **)(p + driver->num * 2);
3093         } else {
3094                 driver->ttys = NULL;
3095                 driver->termios = NULL;
3096                 driver->termios_locked = NULL;
3097         }
3098
3099         cdev_init(&driver->cdev, &tty_fops);
3100         driver->cdev.owner = driver->owner;
3101         error = cdev_add(&driver->cdev, dev, driver->num);
3102         if (error) {
3103                 cdev_del(&driver->cdev);
3104                 unregister_chrdev_region(dev, driver->num);
3105                 driver->ttys = NULL;
3106                 driver->termios = driver->termios_locked = NULL;
3107                 kfree(p);
3108                 return error;
3109         }
3110
3111         if (!driver->put_char)
3112                 driver->put_char = tty_default_put_char;
3113         
3114         list_add(&driver->tty_drivers, &tty_drivers);
3115         
3116         if ( !(driver->flags & TTY_DRIVER_NO_DEVFS) ) {
3117                 for(i = 0; i < driver->num; i++)
3118                     tty_register_device(driver, i, NULL);
3119         }
3120         proc_tty_register_driver(driver);
3121         return 0;
3122 }
3123
3124 EXPORT_SYMBOL(tty_register_driver);
3125
3126 /*
3127  * Called by a tty driver to unregister itself.
3128  */
3129 int tty_unregister_driver(struct tty_driver *driver)
3130 {
3131         int i;
3132         struct termios *tp;
3133         void *p;
3134
3135         if (driver->refcount)
3136                 return -EBUSY;
3137
3138         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3139                                 driver->num);
3140
3141         list_del(&driver->tty_drivers);
3142
3143         /*
3144          * Free the termios and termios_locked structures because
3145          * we don't want to get memory leaks when modular tty
3146          * drivers are removed from the kernel.
3147          */
3148         for (i = 0; i < driver->num; i++) {
3149                 tp = driver->termios[i];
3150                 if (tp) {
3151                         driver->termios[i] = NULL;
3152                         kfree(tp);
3153                 }
3154                 tp = driver->termios_locked[i];
3155                 if (tp) {
3156                         driver->termios_locked[i] = NULL;
3157                         kfree(tp);
3158                 }
3159                 if (!(driver->flags & TTY_DRIVER_NO_DEVFS))
3160                         tty_unregister_device(driver, i);
3161         }
3162         p = driver->ttys;
3163         proc_tty_unregister_driver(driver);
3164         driver->ttys = NULL;
3165         driver->termios = driver->termios_locked = NULL;
3166         kfree(p);
3167         cdev_del(&driver->cdev);
3168         return 0;
3169 }
3170
3171 EXPORT_SYMBOL(tty_unregister_driver);
3172
3173
3174 /*
3175  * Initialize the console device. This is called *early*, so
3176  * we can't necessarily depend on lots of kernel help here.
3177  * Just do some early initializations, and do the complex setup
3178  * later.
3179  */
3180 void __init console_init(void)
3181 {
3182         initcall_t *call;
3183
3184         /* Setup the default TTY line discipline. */
3185         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
3186
3187         /*
3188          * set up the console device so that later boot sequences can 
3189          * inform about problems etc..
3190          */
3191 #ifdef CONFIG_EARLY_PRINTK
3192         disable_early_printk();
3193 #endif
3194         call = __con_initcall_start;
3195         while (call < __con_initcall_end) {
3196                 (*call)();
3197                 call++;
3198         }
3199 }
3200
3201 #ifdef CONFIG_VT
3202 extern int vty_init(void);
3203 #endif
3204
3205 static int __init tty_class_init(void)
3206 {
3207         tty_class = class_create(THIS_MODULE, "tty");
3208         if (IS_ERR(tty_class))
3209                 return PTR_ERR(tty_class);
3210         return 0;
3211 }
3212
3213 postcore_initcall(tty_class_init);
3214
3215 /* 3/2004 jmc: why do these devices exist? */
3216
3217 static struct cdev tty_cdev, console_cdev;
3218 #ifdef CONFIG_UNIX98_PTYS
3219 static struct cdev ptmx_cdev;
3220 #endif
3221 #ifdef CONFIG_VT
3222 static struct cdev vc0_cdev;
3223 #endif
3224
3225 /*
3226  * Ok, now we can initialize the rest of the tty devices and can count
3227  * on memory allocations, interrupts etc..
3228  */
3229 static int __init tty_init(void)
3230 {
3231         cdev_init(&tty_cdev, &tty_fops);
3232         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3233             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3234                 panic("Couldn't register /dev/tty driver\n");
3235         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 0), S_IFCHR|S_IRUGO|S_IWUGO, "tty");
3236         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3237
3238         cdev_init(&console_cdev, &console_fops);
3239         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3240             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3241                 panic("Couldn't register /dev/console driver\n");
3242         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 1), S_IFCHR|S_IRUSR|S_IWUSR, "console");
3243         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL, "console");
3244
3245 #ifdef CONFIG_UNIX98_PTYS
3246         cdev_init(&ptmx_cdev, &ptmx_fops);
3247         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
3248             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
3249                 panic("Couldn't register /dev/ptmx driver\n");
3250         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 2), S_IFCHR|S_IRUGO|S_IWUGO, "ptmx");
3251         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), NULL, "ptmx");
3252 #endif
3253
3254 #ifdef CONFIG_VT
3255         cdev_init(&vc0_cdev, &console_fops);
3256         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
3257             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
3258                 panic("Couldn't register /dev/tty0 driver\n");
3259         devfs_mk_cdev(MKDEV(TTY_MAJOR, 0), S_IFCHR|S_IRUSR|S_IWUSR, "vc/0");
3260         class_device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), NULL, "tty0");
3261
3262         vty_init();
3263 #endif
3264         return 0;
3265 }
3266 module_init(tty_init);