linux 2.6.16.38 w/ vs2.0.3-rc1
[linux-2.6.git] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/config.h>
69 #include <linux/types.h>
70 #include <linux/major.h>
71 #include <linux/errno.h>
72 #include <linux/signal.h>
73 #include <linux/fcntl.h>
74 #include <linux/sched.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/console.h>
82 #include <linux/timer.h>
83 #include <linux/ctype.h>
84 #include <linux/kd.h>
85 #include <linux/mm.h>
86 #include <linux/string.h>
87 #include <linux/slab.h>
88 #include <linux/poll.h>
89 #include <linux/proc_fs.h>
90 #include <linux/init.h>
91 #include <linux/module.h>
92 #include <linux/smp_lock.h>
93 #include <linux/device.h>
94 #include <linux/idr.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98
99 #include <asm/uaccess.h>
100 #include <asm/system.h>
101
102 #include <linux/kbd_kern.h>
103 #include <linux/vt_kern.h>
104 #include <linux/selection.h>
105 #include <linux/devfs_fs_kernel.h>
106 #include <linux/vs_cvirt.h>
107
108 #include <linux/kmod.h>
109
110 #undef TTY_DEBUG_HANGUP
111
112 #define TTY_PARANOIA_CHECK 1
113 #define CHECK_TTY_COUNT 1
114
115 struct termios tty_std_termios = {      /* for the benefit of tty drivers  */
116         .c_iflag = ICRNL | IXON,
117         .c_oflag = OPOST | ONLCR,
118         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
119         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
120                    ECHOCTL | ECHOKE | IEXTEN,
121         .c_cc = INIT_C_CC
122 };
123
124 EXPORT_SYMBOL(tty_std_termios);
125
126 /* This list gets poked at by procfs and various bits of boot up code. This
127    could do with some rationalisation such as pulling the tty proc function
128    into this file */
129    
130 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
131
132 /* Semaphore to protect creating and releasing a tty. This is shared with
133    vt.c for deeply disgusting hack reasons */
134 DECLARE_MUTEX(tty_sem);
135
136 #ifdef CONFIG_UNIX98_PTYS
137 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
138 extern int pty_limit;           /* Config limit on Unix98 ptys */
139 static DEFINE_IDR(allocated_ptys);
140 static DECLARE_MUTEX(allocated_ptys_lock);
141 static int ptmx_open(struct inode *, struct file *);
142 #endif
143
144 extern void disable_early_printk(void);
145
146 static void initialize_tty_struct(struct tty_struct *tty);
147
148 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
149 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
150 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
151 static unsigned int tty_poll(struct file *, poll_table *);
152 static int tty_open(struct inode *, struct file *);
153 static int tty_release(struct inode *, struct file *);
154 int tty_ioctl(struct inode * inode, struct file * file,
155               unsigned int cmd, unsigned long arg);
156 static int tty_fasync(int fd, struct file * filp, int on);
157 static void release_mem(struct tty_struct *tty, int idx);
158
159
160 static struct tty_struct *alloc_tty_struct(void)
161 {
162         struct tty_struct *tty;
163
164         tty = kmalloc(sizeof(struct tty_struct), GFP_KERNEL);
165         if (tty)
166                 memset(tty, 0, sizeof(struct tty_struct));
167         return tty;
168 }
169
170 static void tty_buffer_free_all(struct tty_struct *);
171
172 static inline void free_tty_struct(struct tty_struct *tty)
173 {
174         kfree(tty->write_buf);
175         tty_buffer_free_all(tty);
176         kfree(tty);
177 }
178
179 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
180
181 char *tty_name(struct tty_struct *tty, char *buf)
182 {
183         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
184                 strcpy(buf, "NULL tty");
185         else
186                 strcpy(buf, tty->name);
187         return buf;
188 }
189
190 EXPORT_SYMBOL(tty_name);
191
192 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
193                               const char *routine)
194 {
195 #ifdef TTY_PARANOIA_CHECK
196         if (!tty) {
197                 printk(KERN_WARNING
198                         "null TTY for (%d:%d) in %s\n",
199                         imajor(inode), iminor(inode), routine);
200                 return 1;
201         }
202         if (tty->magic != TTY_MAGIC) {
203                 printk(KERN_WARNING
204                         "bad magic number for tty struct (%d:%d) in %s\n",
205                         imajor(inode), iminor(inode), routine);
206                 return 1;
207         }
208 #endif
209         return 0;
210 }
211
212 static int check_tty_count(struct tty_struct *tty, const char *routine)
213 {
214 #ifdef CHECK_TTY_COUNT
215         struct list_head *p;
216         int count = 0;
217         
218         file_list_lock();
219         list_for_each(p, &tty->tty_files) {
220                 count++;
221         }
222         file_list_unlock();
223         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
224             tty->driver->subtype == PTY_TYPE_SLAVE &&
225             tty->link && tty->link->count)
226                 count++;
227         if (tty->count != count) {
228                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
229                                     "!= #fd's(%d) in %s\n",
230                        tty->name, tty->count, count, routine);
231                 return count;
232        }        
233 #endif
234         return 0;
235 }
236
237 /*
238  * Tty buffer allocation management
239  */
240
241 static void tty_buffer_free_all(struct tty_struct *tty)
242 {
243         struct tty_buffer *thead;
244         while((thead = tty->buf.head) != NULL) {
245                 tty->buf.head = thead->next;
246                 kfree(thead);
247         }
248         while((thead = tty->buf.free) != NULL) {
249                 tty->buf.free = thead->next;
250                 kfree(thead);
251         }
252         tty->buf.tail = NULL;
253 }
254
255 static void tty_buffer_init(struct tty_struct *tty)
256 {
257         spin_lock_init(&tty->buf.lock);
258         tty->buf.head = NULL;
259         tty->buf.tail = NULL;
260         tty->buf.free = NULL;
261 }
262
263 static struct tty_buffer *tty_buffer_alloc(size_t size)
264 {
265         struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
266         if(p == NULL)
267                 return NULL;
268         p->used = 0;
269         p->size = size;
270         p->next = NULL;
271         p->active = 0;
272         p->commit = 0;
273         p->read = 0;
274         p->char_buf_ptr = (char *)(p->data);
275         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
276 /*      printk("Flip create %p\n", p); */
277         return p;
278 }
279
280 /* Must be called with the tty_read lock held. This needs to acquire strategy
281    code to decide if we should kfree or relink a given expired buffer */
282
283 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
284 {
285         /* Dumb strategy for now - should keep some stats */
286 /*      printk("Flip dispose %p\n", b); */
287         if(b->size >= 512)
288                 kfree(b);
289         else {
290                 b->next = tty->buf.free;
291                 tty->buf.free = b;
292         }
293 }
294
295 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
296 {
297         struct tty_buffer **tbh = &tty->buf.free;
298         while((*tbh) != NULL) {
299                 struct tty_buffer *t = *tbh;
300                 if(t->size >= size) {
301                         *tbh = t->next;
302                         t->next = NULL;
303                         t->used = 0;
304                         t->commit = 0;
305                         t->read = 0;
306                         /* DEBUG ONLY */
307 /*                      memset(t->data, '*', size); */
308 /*                      printk("Flip recycle %p\n", t); */
309                         return t;
310                 }
311                 tbh = &((*tbh)->next);
312         }
313         /* Round the buffer size out */
314         size = (size + 0xFF) & ~ 0xFF;
315         return tty_buffer_alloc(size);
316         /* Should possibly check if this fails for the largest buffer we
317            have queued and recycle that ? */
318 }
319
320 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
321 {
322         struct tty_buffer *b, *n;
323         int left;
324         unsigned long flags;
325
326         spin_lock_irqsave(&tty->buf.lock, flags);
327
328         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
329            remove this conditional if its worth it. This would be invisible
330            to the callers */
331         if ((b = tty->buf.tail) != NULL) {
332                 left = b->size - b->used;
333                 b->active = 1;
334         } else
335                 left = 0;
336
337         if (left < size) {
338                 /* This is the slow path - looking for new buffers to use */
339                 if ((n = tty_buffer_find(tty, size)) != NULL) {
340                         if (b != NULL) {
341                                 b->next = n;
342                                 b->active = 0;
343                                 b->commit = b->used;
344                         } else
345                                 tty->buf.head = n;
346                         tty->buf.tail = n;
347                         n->active = 1;
348                 } else
349                         size = left;
350         }
351
352         spin_unlock_irqrestore(&tty->buf.lock, flags);
353         return size;
354 }
355
356 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
357
358 int tty_insert_flip_string(struct tty_struct *tty, unsigned char *chars, size_t size)
359 {
360         int copied = 0;
361         do {
362                 int space = tty_buffer_request_room(tty, size - copied);
363                 struct tty_buffer *tb = tty->buf.tail;
364                 /* If there is no space then tb may be NULL */
365                 if(unlikely(space == 0))
366                         break;
367                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
368                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
369                 tb->used += space;
370                 copied += space;
371                 chars += space;
372 /*              printk("Flip insert %d.\n", space); */
373         }
374         /* There is a small chance that we need to split the data over
375            several buffers. If this is the case we must loop */
376         while (unlikely(size > copied));
377         return copied;
378 }
379
380 EXPORT_SYMBOL_GPL(tty_insert_flip_string);
381
382 int tty_insert_flip_string_flags(struct tty_struct *tty, unsigned char *chars, char *flags, size_t size)
383 {
384         int copied = 0;
385         do {
386                 int space = tty_buffer_request_room(tty, size - copied);
387                 struct tty_buffer *tb = tty->buf.tail;
388                 /* If there is no space then tb may be NULL */
389                 if(unlikely(space == 0))
390                         break;
391                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
392                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
393                 tb->used += space;
394                 copied += space;
395                 chars += space;
396                 flags += space;
397         }
398         /* There is a small chance that we need to split the data over
399            several buffers. If this is the case we must loop */
400         while (unlikely(size > copied));
401         return copied;
402 }
403
404 EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
405
406
407 /*
408  *      Prepare a block of space in the buffer for data. Returns the length
409  *      available and buffer pointer to the space which is now allocated and
410  *      accounted for as ready for normal characters. This is used for drivers
411  *      that need their own block copy routines into the buffer. There is no
412  *      guarantee the buffer is a DMA target!
413  */
414
415 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
416 {
417         int space = tty_buffer_request_room(tty, size);
418         if (likely(space)) {
419                 struct tty_buffer *tb = tty->buf.tail;
420                 *chars = tb->char_buf_ptr + tb->used;
421                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
422                 tb->used += space;
423         }
424         return space;
425 }
426
427 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
428
429 /*
430  *      Prepare a block of space in the buffer for data. Returns the length
431  *      available and buffer pointer to the space which is now allocated and
432  *      accounted for as ready for characters. This is used for drivers
433  *      that need their own block copy routines into the buffer. There is no
434  *      guarantee the buffer is a DMA target!
435  */
436
437 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
438 {
439         int space = tty_buffer_request_room(tty, size);
440         if (likely(space)) {
441                 struct tty_buffer *tb = tty->buf.tail;
442                 *chars = tb->char_buf_ptr + tb->used;
443                 *flags = tb->flag_buf_ptr + tb->used;
444                 tb->used += space;
445         }
446         return space;
447 }
448
449 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
450
451
452
453 /*
454  *      This is probably overkill for real world processors but
455  *      they are not on hot paths so a little discipline won't do 
456  *      any harm.
457  */
458  
459 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
460 {
461         down(&tty->termios_sem);
462         tty->termios->c_line = num;
463         up(&tty->termios_sem);
464 }
465
466 /*
467  *      This guards the refcounted line discipline lists. The lock
468  *      must be taken with irqs off because there are hangup path
469  *      callers who will do ldisc lookups and cannot sleep.
470  */
471  
472 static DEFINE_SPINLOCK(tty_ldisc_lock);
473 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
474 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
475
476 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
477 {
478         unsigned long flags;
479         int ret = 0;
480         
481         if (disc < N_TTY || disc >= NR_LDISCS)
482                 return -EINVAL;
483         
484         spin_lock_irqsave(&tty_ldisc_lock, flags);
485         tty_ldiscs[disc] = *new_ldisc;
486         tty_ldiscs[disc].num = disc;
487         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
488         tty_ldiscs[disc].refcount = 0;
489         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
490         
491         return ret;
492 }
493 EXPORT_SYMBOL(tty_register_ldisc);
494
495 int tty_unregister_ldisc(int disc)
496 {
497         unsigned long flags;
498         int ret = 0;
499
500         if (disc < N_TTY || disc >= NR_LDISCS)
501                 return -EINVAL;
502
503         spin_lock_irqsave(&tty_ldisc_lock, flags);
504         if (tty_ldiscs[disc].refcount)
505                 ret = -EBUSY;
506         else
507                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
508         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
509
510         return ret;
511 }
512 EXPORT_SYMBOL(tty_unregister_ldisc);
513
514 struct tty_ldisc *tty_ldisc_get(int disc)
515 {
516         unsigned long flags;
517         struct tty_ldisc *ld;
518
519         if (disc < N_TTY || disc >= NR_LDISCS)
520                 return NULL;
521         
522         spin_lock_irqsave(&tty_ldisc_lock, flags);
523
524         ld = &tty_ldiscs[disc];
525         /* Check the entry is defined */
526         if(ld->flags & LDISC_FLAG_DEFINED)
527         {
528                 /* If the module is being unloaded we can't use it */
529                 if (!try_module_get(ld->owner))
530                         ld = NULL;
531                 else /* lock it */
532                         ld->refcount++;
533         }
534         else
535                 ld = NULL;
536         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
537         return ld;
538 }
539
540 EXPORT_SYMBOL_GPL(tty_ldisc_get);
541
542 void tty_ldisc_put(int disc)
543 {
544         struct tty_ldisc *ld;
545         unsigned long flags;
546         
547         if (disc < N_TTY || disc >= NR_LDISCS)
548                 BUG();
549                 
550         spin_lock_irqsave(&tty_ldisc_lock, flags);
551         ld = &tty_ldiscs[disc];
552         if(ld->refcount == 0)
553                 BUG();
554         ld->refcount --;
555         module_put(ld->owner);
556         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
557 }
558         
559 EXPORT_SYMBOL_GPL(tty_ldisc_put);
560
561 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
562 {
563         tty->ldisc = *ld;
564         tty->ldisc.refcount = 0;
565 }
566
567 /**
568  *      tty_ldisc_try           -       internal helper
569  *      @tty: the tty
570  *
571  *      Make a single attempt to grab and bump the refcount on
572  *      the tty ldisc. Return 0 on failure or 1 on success. This is
573  *      used to implement both the waiting and non waiting versions
574  *      of tty_ldisc_ref
575  */
576
577 static int tty_ldisc_try(struct tty_struct *tty)
578 {
579         unsigned long flags;
580         struct tty_ldisc *ld;
581         int ret = 0;
582         
583         spin_lock_irqsave(&tty_ldisc_lock, flags);
584         ld = &tty->ldisc;
585         if(test_bit(TTY_LDISC, &tty->flags))
586         {
587                 ld->refcount++;
588                 ret = 1;
589         }
590         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
591         return ret;
592 }
593
594 /**
595  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
596  *      @tty: tty device
597  *
598  *      Dereference the line discipline for the terminal and take a 
599  *      reference to it. If the line discipline is in flux then 
600  *      wait patiently until it changes.
601  *
602  *      Note: Must not be called from an IRQ/timer context. The caller
603  *      must also be careful not to hold other locks that will deadlock
604  *      against a discipline change, such as an existing ldisc reference
605  *      (which we check for)
606  */
607  
608 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
609 {
610         /* wait_event is a macro */
611         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
612         if(tty->ldisc.refcount == 0)
613                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
614         return &tty->ldisc;
615 }
616
617 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
618
619 /**
620  *      tty_ldisc_ref           -       get the tty ldisc
621  *      @tty: tty device
622  *
623  *      Dereference the line discipline for the terminal and take a 
624  *      reference to it. If the line discipline is in flux then 
625  *      return NULL. Can be called from IRQ and timer functions.
626  */
627  
628 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
629 {
630         if(tty_ldisc_try(tty))
631                 return &tty->ldisc;
632         return NULL;
633 }
634
635 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
636
637 /**
638  *      tty_ldisc_deref         -       free a tty ldisc reference
639  *      @ld: reference to free up
640  *
641  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
642  *      be called in IRQ context.
643  */
644  
645 void tty_ldisc_deref(struct tty_ldisc *ld)
646 {
647         unsigned long flags;
648
649         if(ld == NULL)
650                 BUG();
651                 
652         spin_lock_irqsave(&tty_ldisc_lock, flags);
653         if(ld->refcount == 0)
654                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
655         else
656                 ld->refcount--;
657         if(ld->refcount == 0)
658                 wake_up(&tty_ldisc_wait);
659         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
660 }
661
662 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
663
664 /**
665  *      tty_ldisc_enable        -       allow ldisc use
666  *      @tty: terminal to activate ldisc on
667  *
668  *      Set the TTY_LDISC flag when the line discipline can be called
669  *      again. Do neccessary wakeups for existing sleepers.
670  *
671  *      Note: nobody should set this bit except via this function. Clearing
672  *      directly is allowed.
673  */
674
675 static void tty_ldisc_enable(struct tty_struct *tty)
676 {
677         set_bit(TTY_LDISC, &tty->flags);
678         wake_up(&tty_ldisc_wait);
679 }
680         
681 /**
682  *      tty_set_ldisc           -       set line discipline
683  *      @tty: the terminal to set
684  *      @ldisc: the line discipline
685  *
686  *      Set the discipline of a tty line. Must be called from a process
687  *      context.
688  */
689  
690 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
691 {
692         int retval = 0;
693         struct tty_ldisc o_ldisc;
694         char buf[64];
695         int work;
696         unsigned long flags;
697         struct tty_ldisc *ld;
698         struct tty_struct *o_tty;
699
700         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
701                 return -EINVAL;
702
703 restart:
704
705         ld = tty_ldisc_get(ldisc);
706         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
707         /* Cyrus Durgin <cider@speakeasy.org> */
708         if (ld == NULL) {
709                 request_module("tty-ldisc-%d", ldisc);
710                 ld = tty_ldisc_get(ldisc);
711         }
712         if (ld == NULL)
713                 return -EINVAL;
714
715         /*
716          *      No more input please, we are switching. The new ldisc
717          *      will update this value in the ldisc open function
718          */
719
720         tty->receive_room = 0;
721
722         /*
723          *      Problem: What do we do if this blocks ?
724          */
725
726         tty_wait_until_sent(tty, 0);
727
728         if (tty->ldisc.num == ldisc) {
729                 tty_ldisc_put(ldisc);
730                 return 0;
731         }
732
733         o_ldisc = tty->ldisc;
734         o_tty = tty->link;
735
736         /*
737          *      Make sure we don't change while someone holds a
738          *      reference to the line discipline. The TTY_LDISC bit
739          *      prevents anyone taking a reference once it is clear.
740          *      We need the lock to avoid racing reference takers.
741          */
742
743         spin_lock_irqsave(&tty_ldisc_lock, flags);
744         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
745                 if(tty->ldisc.refcount) {
746                         /* Free the new ldisc we grabbed. Must drop the lock
747                            first. */
748                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
749                         tty_ldisc_put(ldisc);
750                         /*
751                          * There are several reasons we may be busy, including
752                          * random momentary I/O traffic. We must therefore
753                          * retry. We could distinguish between blocking ops
754                          * and retries if we made tty_ldisc_wait() smarter. That
755                          * is up for discussion.
756                          */
757                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
758                                 return -ERESTARTSYS;
759                         goto restart;
760                 }
761                 if(o_tty && o_tty->ldisc.refcount) {
762                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
763                         tty_ldisc_put(ldisc);
764                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
765                                 return -ERESTARTSYS;
766                         goto restart;
767                 }
768         }
769
770         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
771
772         if (!test_bit(TTY_LDISC, &tty->flags)) {
773                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
774                 tty_ldisc_put(ldisc);
775                 ld = tty_ldisc_ref_wait(tty);
776                 tty_ldisc_deref(ld);
777                 goto restart;
778         }
779
780         clear_bit(TTY_LDISC, &tty->flags);
781         clear_bit(TTY_DONT_FLIP, &tty->flags);
782         if (o_tty) {
783                 clear_bit(TTY_LDISC, &o_tty->flags);
784                 clear_bit(TTY_DONT_FLIP, &o_tty->flags);
785         }
786         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
787
788         /*
789          *      From this point on we know nobody has an ldisc
790          *      usage reference, nor can they obtain one until
791          *      we say so later on.
792          */
793
794         work = cancel_delayed_work(&tty->buf.work);
795         /*
796          * Wait for ->hangup_work and ->buf.work handlers to terminate
797          */
798          
799         flush_scheduled_work();
800         /* Shutdown the current discipline. */
801         if (tty->ldisc.close)
802                 (tty->ldisc.close)(tty);
803
804         /* Now set up the new line discipline. */
805         tty_ldisc_assign(tty, ld);
806         tty_set_termios_ldisc(tty, ldisc);
807         if (tty->ldisc.open)
808                 retval = (tty->ldisc.open)(tty);
809         if (retval < 0) {
810                 tty_ldisc_put(ldisc);
811                 /* There is an outstanding reference here so this is safe */
812                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
813                 tty_set_termios_ldisc(tty, tty->ldisc.num);
814                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
815                         tty_ldisc_put(o_ldisc.num);
816                         /* This driver is always present */
817                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
818                         tty_set_termios_ldisc(tty, N_TTY);
819                         if (tty->ldisc.open) {
820                                 int r = tty->ldisc.open(tty);
821
822                                 if (r < 0)
823                                         panic("Couldn't open N_TTY ldisc for "
824                                               "%s --- error %d.",
825                                               tty_name(tty, buf), r);
826                         }
827                 }
828         }
829         /* At this point we hold a reference to the new ldisc and a
830            a reference to the old ldisc. If we ended up flipping back
831            to the existing ldisc we have two references to it */
832         
833         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
834                 tty->driver->set_ldisc(tty);
835                 
836         tty_ldisc_put(o_ldisc.num);
837         
838         /*
839          *      Allow ldisc referencing to occur as soon as the driver
840          *      ldisc callback completes.
841          */
842          
843         tty_ldisc_enable(tty);
844         if (o_tty)
845                 tty_ldisc_enable(o_tty);
846         
847         /* Restart it in case no characters kick it off. Safe if
848            already running */
849         if (work)
850                 schedule_delayed_work(&tty->buf.work, 1);
851         return retval;
852 }
853
854 /*
855  * This routine returns a tty driver structure, given a device number
856  */
857 static struct tty_driver *get_tty_driver(dev_t device, int *index)
858 {
859         struct tty_driver *p;
860
861         list_for_each_entry(p, &tty_drivers, tty_drivers) {
862                 dev_t base = MKDEV(p->major, p->minor_start);
863                 if (device < base || device >= base + p->num)
864                         continue;
865                 *index = device - base;
866                 return p;
867         }
868         return NULL;
869 }
870
871 /*
872  * If we try to write to, or set the state of, a terminal and we're
873  * not in the foreground, send a SIGTTOU.  If the signal is blocked or
874  * ignored, go ahead and perform the operation.  (POSIX 7.2)
875  */
876 int tty_check_change(struct tty_struct * tty)
877 {
878         if (current->signal->tty != tty)
879                 return 0;
880         if (tty->pgrp <= 0) {
881                 printk(KERN_WARNING "tty_check_change: tty->pgrp <= 0!\n");
882                 return 0;
883         }
884         if (process_group(current) == tty->pgrp)
885                 return 0;
886         if (is_ignored(SIGTTOU))
887                 return 0;
888         if (is_orphaned_pgrp(process_group(current)))
889                 return -EIO;
890         (void) kill_pg(process_group(current), SIGTTOU, 1);
891         return -ERESTARTSYS;
892 }
893
894 EXPORT_SYMBOL(tty_check_change);
895
896 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
897                                 size_t count, loff_t *ppos)
898 {
899         return 0;
900 }
901
902 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
903                                  size_t count, loff_t *ppos)
904 {
905         return -EIO;
906 }
907
908 /* No kernel lock held - none needed ;) */
909 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
910 {
911         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
912 }
913
914 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
915                              unsigned int cmd, unsigned long arg)
916 {
917         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
918 }
919
920 static struct file_operations tty_fops = {
921         .llseek         = no_llseek,
922         .read           = tty_read,
923         .write          = tty_write,
924         .poll           = tty_poll,
925         .ioctl          = tty_ioctl,
926         .open           = tty_open,
927         .release        = tty_release,
928         .fasync         = tty_fasync,
929 };
930
931 #ifdef CONFIG_UNIX98_PTYS
932 static struct file_operations ptmx_fops = {
933         .llseek         = no_llseek,
934         .read           = tty_read,
935         .write          = tty_write,
936         .poll           = tty_poll,
937         .ioctl          = tty_ioctl,
938         .open           = ptmx_open,
939         .release        = tty_release,
940         .fasync         = tty_fasync,
941 };
942 #endif
943
944 static struct file_operations console_fops = {
945         .llseek         = no_llseek,
946         .read           = tty_read,
947         .write          = redirected_tty_write,
948         .poll           = tty_poll,
949         .ioctl          = tty_ioctl,
950         .open           = tty_open,
951         .release        = tty_release,
952         .fasync         = tty_fasync,
953 };
954
955 static struct file_operations hung_up_tty_fops = {
956         .llseek         = no_llseek,
957         .read           = hung_up_tty_read,
958         .write          = hung_up_tty_write,
959         .poll           = hung_up_tty_poll,
960         .ioctl          = hung_up_tty_ioctl,
961         .release        = tty_release,
962 };
963
964 static DEFINE_SPINLOCK(redirect_lock);
965 static struct file *redirect;
966
967 /**
968  *      tty_wakeup      -       request more data
969  *      @tty: terminal
970  *
971  *      Internal and external helper for wakeups of tty. This function
972  *      informs the line discipline if present that the driver is ready
973  *      to receive more output data.
974  */
975  
976 void tty_wakeup(struct tty_struct *tty)
977 {
978         struct tty_ldisc *ld;
979         
980         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
981                 ld = tty_ldisc_ref(tty);
982                 if(ld) {
983                         if(ld->write_wakeup)
984                                 ld->write_wakeup(tty);
985                         tty_ldisc_deref(ld);
986                 }
987         }
988         wake_up_interruptible(&tty->write_wait);
989 }
990
991 EXPORT_SYMBOL_GPL(tty_wakeup);
992
993 /**
994  *      tty_ldisc_flush -       flush line discipline queue
995  *      @tty: tty
996  *
997  *      Flush the line discipline queue (if any) for this tty. If there
998  *      is no line discipline active this is a no-op.
999  */
1000  
1001 void tty_ldisc_flush(struct tty_struct *tty)
1002 {
1003         struct tty_ldisc *ld = tty_ldisc_ref(tty);
1004         if(ld) {
1005                 if(ld->flush_buffer)
1006                         ld->flush_buffer(tty);
1007                 tty_ldisc_deref(ld);
1008         }
1009 }
1010
1011 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
1012         
1013 /*
1014  * This can be called by the "eventd" kernel thread.  That is process synchronous,
1015  * but doesn't hold any locks, so we need to make sure we have the appropriate
1016  * locks for what we're doing..
1017  */
1018 static void do_tty_hangup(void *data)
1019 {
1020         struct tty_struct *tty = (struct tty_struct *) data;
1021         struct file * cons_filp = NULL;
1022         struct file *filp, *f = NULL;
1023         struct task_struct *p;
1024         struct tty_ldisc *ld;
1025         int    closecount = 0, n;
1026
1027         if (!tty)
1028                 return;
1029
1030         /* inuse_filps is protected by the single kernel lock */
1031         lock_kernel();
1032
1033         spin_lock(&redirect_lock);
1034         if (redirect && redirect->private_data == tty) {
1035                 f = redirect;
1036                 redirect = NULL;
1037         }
1038         spin_unlock(&redirect_lock);
1039         
1040         check_tty_count(tty, "do_tty_hangup");
1041         file_list_lock();
1042         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1043         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1044                 if (filp->f_op->write == redirected_tty_write)
1045                         cons_filp = filp;
1046                 if (filp->f_op->write != tty_write)
1047                         continue;
1048                 closecount++;
1049                 tty_fasync(-1, filp, 0);        /* can't block */
1050                 filp->f_op = &hung_up_tty_fops;
1051         }
1052         file_list_unlock();
1053         
1054         /* FIXME! What are the locking issues here? This may me overdoing things..
1055          * this question is especially important now that we've removed the irqlock. */
1056
1057         ld = tty_ldisc_ref(tty);
1058         if(ld != NULL)  /* We may have no line discipline at this point */
1059         {
1060                 if (ld->flush_buffer)
1061                         ld->flush_buffer(tty);
1062                 if (tty->driver->flush_buffer)
1063                         tty->driver->flush_buffer(tty);
1064                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1065                     ld->write_wakeup)
1066                         ld->write_wakeup(tty);
1067                 if (ld->hangup)
1068                         ld->hangup(tty);
1069         }
1070
1071         /* FIXME: Once we trust the LDISC code better we can wait here for
1072            ldisc completion and fix the driver call race */
1073            
1074         wake_up_interruptible(&tty->write_wait);
1075         wake_up_interruptible(&tty->read_wait);
1076
1077         /*
1078          * Shutdown the current line discipline, and reset it to
1079          * N_TTY.
1080          */
1081         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1082         {
1083                 down(&tty->termios_sem);
1084                 *tty->termios = tty->driver->init_termios;
1085                 up(&tty->termios_sem);
1086         }
1087         
1088         /* Defer ldisc switch */
1089         /* tty_deferred_ldisc_switch(N_TTY);
1090         
1091           This should get done automatically when the port closes and
1092           tty_release is called */
1093         
1094         read_lock(&tasklist_lock);
1095         if (tty->session > 0) {
1096                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1097                         if (p->signal->tty == tty)
1098                                 p->signal->tty = NULL;
1099                         if (!p->signal->leader)
1100                                 continue;
1101                         send_group_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1102                         send_group_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1103                         if (tty->pgrp > 0)
1104                                 p->signal->tty_old_pgrp = tty->pgrp;
1105                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1106         }
1107         read_unlock(&tasklist_lock);
1108
1109         tty->flags = 0;
1110         tty->session = 0;
1111         tty->pgrp = -1;
1112         tty->ctrl_status = 0;
1113         /*
1114          *      If one of the devices matches a console pointer, we
1115          *      cannot just call hangup() because that will cause
1116          *      tty->count and state->count to go out of sync.
1117          *      So we just call close() the right number of times.
1118          */
1119         if (cons_filp) {
1120                 if (tty->driver->close)
1121                         for (n = 0; n < closecount; n++)
1122                                 tty->driver->close(tty, cons_filp);
1123         } else if (tty->driver->hangup)
1124                 (tty->driver->hangup)(tty);
1125                 
1126         /* We don't want to have driver/ldisc interactions beyond
1127            the ones we did here. The driver layer expects no
1128            calls after ->hangup() from the ldisc side. However we
1129            can't yet guarantee all that */
1130
1131         set_bit(TTY_HUPPED, &tty->flags);
1132         if (ld) {
1133                 tty_ldisc_enable(tty);
1134                 tty_ldisc_deref(ld);
1135         }
1136         unlock_kernel();
1137         if (f)
1138                 fput(f);
1139 }
1140
1141 void tty_hangup(struct tty_struct * tty)
1142 {
1143 #ifdef TTY_DEBUG_HANGUP
1144         char    buf[64];
1145         
1146         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1147 #endif
1148         schedule_work(&tty->hangup_work);
1149 }
1150
1151 EXPORT_SYMBOL(tty_hangup);
1152
1153 void tty_vhangup(struct tty_struct * tty)
1154 {
1155 #ifdef TTY_DEBUG_HANGUP
1156         char    buf[64];
1157
1158         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1159 #endif
1160         do_tty_hangup((void *) tty);
1161 }
1162 EXPORT_SYMBOL(tty_vhangup);
1163
1164 int tty_hung_up_p(struct file * filp)
1165 {
1166         return (filp->f_op == &hung_up_tty_fops);
1167 }
1168
1169 EXPORT_SYMBOL(tty_hung_up_p);
1170
1171 /*
1172  * This function is typically called only by the session leader, when
1173  * it wants to disassociate itself from its controlling tty.
1174  *
1175  * It performs the following functions:
1176  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1177  *      (2)  Clears the tty from being controlling the session
1178  *      (3)  Clears the controlling tty for all processes in the
1179  *              session group.
1180  *
1181  * The argument on_exit is set to 1 if called when a process is
1182  * exiting; it is 0 if called by the ioctl TIOCNOTTY.
1183  */
1184 void disassociate_ctty(int on_exit)
1185 {
1186         struct tty_struct *tty;
1187         struct task_struct *p;
1188         int tty_pgrp = -1;
1189
1190         lock_kernel();
1191
1192         down(&tty_sem);
1193         tty = current->signal->tty;
1194         if (tty) {
1195                 tty_pgrp = tty->pgrp;
1196                 up(&tty_sem);
1197                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1198                         tty_vhangup(tty);
1199         } else {
1200                 if (current->signal->tty_old_pgrp) {
1201                         kill_pg(current->signal->tty_old_pgrp, SIGHUP, on_exit);
1202                         kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit);
1203                 }
1204                 up(&tty_sem);
1205                 unlock_kernel();        
1206                 return;
1207         }
1208         if (tty_pgrp > 0) {
1209                 kill_pg(tty_pgrp, SIGHUP, on_exit);
1210                 if (!on_exit)
1211                         kill_pg(tty_pgrp, SIGCONT, on_exit);
1212         }
1213
1214         /* Must lock changes to tty_old_pgrp */
1215         down(&tty_sem);
1216         current->signal->tty_old_pgrp = 0;
1217         tty->session = 0;
1218         tty->pgrp = -1;
1219
1220         /* Now clear signal->tty under the lock */
1221         read_lock(&tasklist_lock);
1222         do_each_task_pid(current->signal->session, PIDTYPE_SID, p) {
1223                 p->signal->tty = NULL;
1224         } while_each_task_pid(current->signal->session, PIDTYPE_SID, p);
1225         read_unlock(&tasklist_lock);
1226         up(&tty_sem);
1227         unlock_kernel();
1228 }
1229
1230 void stop_tty(struct tty_struct *tty)
1231 {
1232         if (tty->stopped)
1233                 return;
1234         tty->stopped = 1;
1235         if (tty->link && tty->link->packet) {
1236                 tty->ctrl_status &= ~TIOCPKT_START;
1237                 tty->ctrl_status |= TIOCPKT_STOP;
1238                 wake_up_interruptible(&tty->link->read_wait);
1239         }
1240         if (tty->driver->stop)
1241                 (tty->driver->stop)(tty);
1242 }
1243
1244 EXPORT_SYMBOL(stop_tty);
1245
1246 void start_tty(struct tty_struct *tty)
1247 {
1248         if (!tty->stopped || tty->flow_stopped)
1249                 return;
1250         tty->stopped = 0;
1251         if (tty->link && tty->link->packet) {
1252                 tty->ctrl_status &= ~TIOCPKT_STOP;
1253                 tty->ctrl_status |= TIOCPKT_START;
1254                 wake_up_interruptible(&tty->link->read_wait);
1255         }
1256         if (tty->driver->start)
1257                 (tty->driver->start)(tty);
1258
1259         /* If we have a running line discipline it may need kicking */
1260         tty_wakeup(tty);
1261         wake_up_interruptible(&tty->write_wait);
1262 }
1263
1264 EXPORT_SYMBOL(start_tty);
1265
1266 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1267                         loff_t *ppos)
1268 {
1269         int i;
1270         struct tty_struct * tty;
1271         struct inode *inode;
1272         struct tty_ldisc *ld;
1273
1274         tty = (struct tty_struct *)file->private_data;
1275         inode = file->f_dentry->d_inode;
1276         if (tty_paranoia_check(tty, inode, "tty_read"))
1277                 return -EIO;
1278         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1279                 return -EIO;
1280
1281         /* We want to wait for the line discipline to sort out in this
1282            situation */
1283         ld = tty_ldisc_ref_wait(tty);
1284         lock_kernel();
1285         if (ld->read)
1286                 i = (ld->read)(tty,file,buf,count);
1287         else
1288                 i = -EIO;
1289         tty_ldisc_deref(ld);
1290         unlock_kernel();
1291         if (i > 0)
1292                 inode->i_atime = current_fs_time(inode->i_sb);
1293         return i;
1294 }
1295
1296 /*
1297  * Split writes up in sane blocksizes to avoid
1298  * denial-of-service type attacks
1299  */
1300 static inline ssize_t do_tty_write(
1301         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1302         struct tty_struct *tty,
1303         struct file *file,
1304         const char __user *buf,
1305         size_t count)
1306 {
1307         ssize_t ret = 0, written = 0;
1308         unsigned int chunk;
1309         
1310         if (down_interruptible(&tty->atomic_write)) {
1311                 return -ERESTARTSYS;
1312         }
1313
1314         /*
1315          * We chunk up writes into a temporary buffer. This
1316          * simplifies low-level drivers immensely, since they
1317          * don't have locking issues and user mode accesses.
1318          *
1319          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1320          * big chunk-size..
1321          *
1322          * The default chunk-size is 2kB, because the NTTY
1323          * layer has problems with bigger chunks. It will
1324          * claim to be able to handle more characters than
1325          * it actually does.
1326          */
1327         chunk = 2048;
1328         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1329                 chunk = 65536;
1330         if (count < chunk)
1331                 chunk = count;
1332
1333         /* write_buf/write_cnt is protected by the atomic_write semaphore */
1334         if (tty->write_cnt < chunk) {
1335                 unsigned char *buf;
1336
1337                 if (chunk < 1024)
1338                         chunk = 1024;
1339
1340                 buf = kmalloc(chunk, GFP_KERNEL);
1341                 if (!buf) {
1342                         up(&tty->atomic_write);
1343                         return -ENOMEM;
1344                 }
1345                 kfree(tty->write_buf);
1346                 tty->write_cnt = chunk;
1347                 tty->write_buf = buf;
1348         }
1349
1350         /* Do the write .. */
1351         for (;;) {
1352                 size_t size = count;
1353                 if (size > chunk)
1354                         size = chunk;
1355                 ret = -EFAULT;
1356                 if (copy_from_user(tty->write_buf, buf, size))
1357                         break;
1358                 lock_kernel();
1359                 ret = write(tty, file, tty->write_buf, size);
1360                 unlock_kernel();
1361                 if (ret <= 0)
1362                         break;
1363                 written += ret;
1364                 buf += ret;
1365                 count -= ret;
1366                 if (!count)
1367                         break;
1368                 ret = -ERESTARTSYS;
1369                 if (signal_pending(current))
1370                         break;
1371                 cond_resched();
1372         }
1373         if (written) {
1374                 struct inode *inode = file->f_dentry->d_inode;
1375                 inode->i_mtime = current_fs_time(inode->i_sb);
1376                 ret = written;
1377         }
1378         up(&tty->atomic_write);
1379         return ret;
1380 }
1381
1382
1383 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1384                          loff_t *ppos)
1385 {
1386         struct tty_struct * tty;
1387         struct inode *inode = file->f_dentry->d_inode;
1388         ssize_t ret;
1389         struct tty_ldisc *ld;
1390         
1391         tty = (struct tty_struct *)file->private_data;
1392         if (tty_paranoia_check(tty, inode, "tty_write"))
1393                 return -EIO;
1394         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1395                 return -EIO;
1396
1397         ld = tty_ldisc_ref_wait(tty);           
1398         if (!ld->write)
1399                 ret = -EIO;
1400         else
1401                 ret = do_tty_write(ld->write, tty, file, buf, count);
1402         tty_ldisc_deref(ld);
1403         return ret;
1404 }
1405
1406 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1407                          loff_t *ppos)
1408 {
1409         struct file *p = NULL;
1410
1411         spin_lock(&redirect_lock);
1412         if (redirect) {
1413                 get_file(redirect);
1414                 p = redirect;
1415         }
1416         spin_unlock(&redirect_lock);
1417
1418         if (p) {
1419                 ssize_t res;
1420                 res = vfs_write(p, buf, count, &p->f_pos);
1421                 fput(p);
1422                 return res;
1423         }
1424
1425         return tty_write(file, buf, count, ppos);
1426 }
1427
1428 static char ptychar[] = "pqrstuvwxyzabcde";
1429
1430 static inline void pty_line_name(struct tty_driver *driver, int index, char *p)
1431 {
1432         int i = index + driver->name_base;
1433         /* ->name is initialized to "ttyp", but "tty" is expected */
1434         sprintf(p, "%s%c%x",
1435                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1436                         ptychar[i >> 4 & 0xf], i & 0xf);
1437 }
1438
1439 static inline void tty_line_name(struct tty_driver *driver, int index, char *p)
1440 {
1441         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1442 }
1443
1444 /*
1445  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1446  * failed open.  The new code protects the open with a semaphore, so it's
1447  * really quite straightforward.  The semaphore locking can probably be
1448  * relaxed for the (most common) case of reopening a tty.
1449  */
1450 static int init_dev(struct tty_driver *driver, int idx,
1451         struct tty_struct **ret_tty)
1452 {
1453         struct tty_struct *tty, *o_tty;
1454         struct termios *tp, **tp_loc, *o_tp, **o_tp_loc;
1455         struct termios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
1456         int retval=0;
1457
1458         /* check whether we're reopening an existing tty */
1459         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1460                 tty = devpts_get_tty(idx);
1461                 if (tty && driver->subtype == PTY_TYPE_MASTER)
1462                         tty = tty->link;
1463         } else {
1464                 tty = driver->ttys[idx];
1465         }
1466         if (tty) goto fast_track;
1467
1468         /*
1469          * First time open is complex, especially for PTY devices.
1470          * This code guarantees that either everything succeeds and the
1471          * TTY is ready for operation, or else the table slots are vacated
1472          * and the allocated memory released.  (Except that the termios 
1473          * and locked termios may be retained.)
1474          */
1475
1476         if (!try_module_get(driver->owner)) {
1477                 retval = -ENODEV;
1478                 goto end_init;
1479         }
1480
1481         o_tty = NULL;
1482         tp = o_tp = NULL;
1483         ltp = o_ltp = NULL;
1484
1485         tty = alloc_tty_struct();
1486         if(!tty)
1487                 goto fail_no_mem;
1488         initialize_tty_struct(tty);
1489         tty->driver = driver;
1490         tty->index = idx;
1491         tty_line_name(driver, idx, tty->name);
1492
1493         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1494                 tp_loc = &tty->termios;
1495                 ltp_loc = &tty->termios_locked;
1496         } else {
1497                 tp_loc = &driver->termios[idx];
1498                 ltp_loc = &driver->termios_locked[idx];
1499         }
1500
1501         if (!*tp_loc) {
1502                 tp = (struct termios *) kmalloc(sizeof(struct termios),
1503                                                 GFP_KERNEL);
1504                 if (!tp)
1505                         goto free_mem_out;
1506                 *tp = driver->init_termios;
1507         }
1508
1509         if (!*ltp_loc) {
1510                 ltp = (struct termios *) kmalloc(sizeof(struct termios),
1511                                                  GFP_KERNEL);
1512                 if (!ltp)
1513                         goto free_mem_out;
1514                 memset(ltp, 0, sizeof(struct termios));
1515         }
1516
1517         if (driver->type == TTY_DRIVER_TYPE_PTY) {
1518                 o_tty = alloc_tty_struct();
1519                 if (!o_tty)
1520                         goto free_mem_out;
1521                 initialize_tty_struct(o_tty);
1522                 o_tty->driver = driver->other;
1523                 o_tty->index = idx;
1524                 tty_line_name(driver->other, idx, o_tty->name);
1525
1526                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1527                         o_tp_loc = &o_tty->termios;
1528                         o_ltp_loc = &o_tty->termios_locked;
1529                 } else {
1530                         o_tp_loc = &driver->other->termios[idx];
1531                         o_ltp_loc = &driver->other->termios_locked[idx];
1532                 }
1533
1534                 if (!*o_tp_loc) {
1535                         o_tp = (struct termios *)
1536                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1537                         if (!o_tp)
1538                                 goto free_mem_out;
1539                         *o_tp = driver->other->init_termios;
1540                 }
1541
1542                 if (!*o_ltp_loc) {
1543                         o_ltp = (struct termios *)
1544                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1545                         if (!o_ltp)
1546                                 goto free_mem_out;
1547                         memset(o_ltp, 0, sizeof(struct termios));
1548                 }
1549
1550                 /*
1551                  * Everything allocated ... set up the o_tty structure.
1552                  */
1553                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
1554                         driver->other->ttys[idx] = o_tty;
1555                 }
1556                 if (!*o_tp_loc)
1557                         *o_tp_loc = o_tp;
1558                 if (!*o_ltp_loc)
1559                         *o_ltp_loc = o_ltp;
1560                 o_tty->termios = *o_tp_loc;
1561                 o_tty->termios_locked = *o_ltp_loc;
1562                 driver->other->refcount++;
1563                 if (driver->subtype == PTY_TYPE_MASTER)
1564                         o_tty->count++;
1565
1566                 /* Establish the links in both directions */
1567                 tty->link   = o_tty;
1568                 o_tty->link = tty;
1569         }
1570
1571         /* 
1572          * All structures have been allocated, so now we install them.
1573          * Failures after this point use release_mem to clean up, so 
1574          * there's no need to null out the local pointers.
1575          */
1576         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1577                 driver->ttys[idx] = tty;
1578         }
1579         
1580         if (!*tp_loc)
1581                 *tp_loc = tp;
1582         if (!*ltp_loc)
1583                 *ltp_loc = ltp;
1584         tty->termios = *tp_loc;
1585         tty->termios_locked = *ltp_loc;
1586         driver->refcount++;
1587         tty->count++;
1588
1589         /* 
1590          * Structures all installed ... call the ldisc open routines.
1591          * If we fail here just call release_mem to clean up.  No need
1592          * to decrement the use counts, as release_mem doesn't care.
1593          */
1594
1595         if (tty->ldisc.open) {
1596                 retval = (tty->ldisc.open)(tty);
1597                 if (retval)
1598                         goto release_mem_out;
1599         }
1600         if (o_tty && o_tty->ldisc.open) {
1601                 retval = (o_tty->ldisc.open)(o_tty);
1602                 if (retval) {
1603                         if (tty->ldisc.close)
1604                                 (tty->ldisc.close)(tty);
1605                         goto release_mem_out;
1606                 }
1607                 tty_ldisc_enable(o_tty);
1608         }
1609         tty_ldisc_enable(tty);
1610         goto success;
1611
1612         /*
1613          * This fast open can be used if the tty is already open.
1614          * No memory is allocated, and the only failures are from
1615          * attempting to open a closing tty or attempting multiple
1616          * opens on a pty master.
1617          */
1618 fast_track:
1619         if (test_bit(TTY_CLOSING, &tty->flags)) {
1620                 retval = -EIO;
1621                 goto end_init;
1622         }
1623         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1624             driver->subtype == PTY_TYPE_MASTER) {
1625                 /*
1626                  * special case for PTY masters: only one open permitted, 
1627                  * and the slave side open count is incremented as well.
1628                  */
1629                 if (tty->count) {
1630                         retval = -EIO;
1631                         goto end_init;
1632                 }
1633                 tty->link->count++;
1634         }
1635         tty->count++;
1636         tty->driver = driver; /* N.B. why do this every time?? */
1637
1638         /* FIXME */
1639         if(!test_bit(TTY_LDISC, &tty->flags))
1640                 printk(KERN_ERR "init_dev but no ldisc\n");
1641 success:
1642         *ret_tty = tty;
1643         
1644         /* All paths come through here to release the semaphore */
1645 end_init:
1646         return retval;
1647
1648         /* Release locally allocated memory ... nothing placed in slots */
1649 free_mem_out:
1650         kfree(o_tp);
1651         if (o_tty)
1652                 free_tty_struct(o_tty);
1653         kfree(ltp);
1654         kfree(tp);
1655         free_tty_struct(tty);
1656
1657 fail_no_mem:
1658         module_put(driver->owner);
1659         retval = -ENOMEM;
1660         goto end_init;
1661
1662         /* call the tty release_mem routine to clean out this slot */
1663 release_mem_out:
1664         printk(KERN_INFO "init_dev: ldisc open failed, "
1665                          "clearing slot %d\n", idx);
1666         release_mem(tty, idx);
1667         goto end_init;
1668 }
1669
1670 /*
1671  * Releases memory associated with a tty structure, and clears out the
1672  * driver table slots.
1673  */
1674 static void release_mem(struct tty_struct *tty, int idx)
1675 {
1676         struct tty_struct *o_tty;
1677         struct termios *tp;
1678         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
1679
1680         if ((o_tty = tty->link) != NULL) {
1681                 if (!devpts)
1682                         o_tty->driver->ttys[idx] = NULL;
1683                 if (o_tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1684                         tp = o_tty->termios;
1685                         if (!devpts)
1686                                 o_tty->driver->termios[idx] = NULL;
1687                         kfree(tp);
1688
1689                         tp = o_tty->termios_locked;
1690                         if (!devpts)
1691                                 o_tty->driver->termios_locked[idx] = NULL;
1692                         kfree(tp);
1693                 }
1694                 o_tty->magic = 0;
1695                 o_tty->driver->refcount--;
1696                 file_list_lock();
1697                 list_del_init(&o_tty->tty_files);
1698                 file_list_unlock();
1699                 free_tty_struct(o_tty);
1700         }
1701
1702         if (!devpts)
1703                 tty->driver->ttys[idx] = NULL;
1704         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1705                 tp = tty->termios;
1706                 if (!devpts)
1707                         tty->driver->termios[idx] = NULL;
1708                 kfree(tp);
1709
1710                 tp = tty->termios_locked;
1711                 if (!devpts)
1712                         tty->driver->termios_locked[idx] = NULL;
1713                 kfree(tp);
1714         }
1715
1716         tty->magic = 0;
1717         tty->driver->refcount--;
1718         file_list_lock();
1719         list_del_init(&tty->tty_files);
1720         file_list_unlock();
1721         module_put(tty->driver->owner);
1722         free_tty_struct(tty);
1723 }
1724
1725 /*
1726  * Even releasing the tty structures is a tricky business.. We have
1727  * to be very careful that the structures are all released at the
1728  * same time, as interrupts might otherwise get the wrong pointers.
1729  *
1730  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1731  * lead to double frees or releasing memory still in use.
1732  */
1733 static void release_dev(struct file * filp)
1734 {
1735         struct tty_struct *tty, *o_tty;
1736         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1737         int     devpts_master, devpts;
1738         int     idx;
1739         char    buf[64];
1740         unsigned long flags;
1741         
1742         tty = (struct tty_struct *)filp->private_data;
1743         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "release_dev"))
1744                 return;
1745
1746         check_tty_count(tty, "release_dev");
1747
1748         tty_fasync(-1, filp, 0);
1749
1750         idx = tty->index;
1751         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1752                       tty->driver->subtype == PTY_TYPE_MASTER);
1753         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1754         devpts_master = pty_master && devpts;
1755         o_tty = tty->link;
1756
1757 #ifdef TTY_PARANOIA_CHECK
1758         if (idx < 0 || idx >= tty->driver->num) {
1759                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
1760                                   "free (%s)\n", tty->name);
1761                 return;
1762         }
1763         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1764                 if (tty != tty->driver->ttys[idx]) {
1765                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
1766                                "for (%s)\n", idx, tty->name);
1767                         return;
1768                 }
1769                 if (tty->termios != tty->driver->termios[idx]) {
1770                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
1771                                "for (%s)\n",
1772                                idx, tty->name);
1773                         return;
1774                 }
1775                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
1776                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
1777                                "termios_locked for (%s)\n",
1778                                idx, tty->name);
1779                         return;
1780                 }
1781         }
1782 #endif
1783
1784 #ifdef TTY_DEBUG_HANGUP
1785         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
1786                tty_name(tty, buf), tty->count);
1787 #endif
1788
1789 #ifdef TTY_PARANOIA_CHECK
1790         if (tty->driver->other &&
1791              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1792                 if (o_tty != tty->driver->other->ttys[idx]) {
1793                         printk(KERN_DEBUG "release_dev: other->table[%d] "
1794                                           "not o_tty for (%s)\n",
1795                                idx, tty->name);
1796                         return;
1797                 }
1798                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1799                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
1800                                           "not o_termios for (%s)\n",
1801                                idx, tty->name);
1802                         return;
1803                 }
1804                 if (o_tty->termios_locked != 
1805                       tty->driver->other->termios_locked[idx]) {
1806                         printk(KERN_DEBUG "release_dev: other->termios_locked["
1807                                           "%d] not o_termios_locked for (%s)\n",
1808                                idx, tty->name);
1809                         return;
1810                 }
1811                 if (o_tty->link != tty) {
1812                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
1813                         return;
1814                 }
1815         }
1816 #endif
1817         if (tty->driver->close)
1818                 tty->driver->close(tty, filp);
1819
1820         /*
1821          * Sanity check: if tty->count is going to zero, there shouldn't be
1822          * any waiters on tty->read_wait or tty->write_wait.  We test the
1823          * wait queues and kick everyone out _before_ actually starting to
1824          * close.  This ensures that we won't block while releasing the tty
1825          * structure.
1826          *
1827          * The test for the o_tty closing is necessary, since the master and
1828          * slave sides may close in any order.  If the slave side closes out
1829          * first, its count will be one, since the master side holds an open.
1830          * Thus this test wouldn't be triggered at the time the slave closes,
1831          * so we do it now.
1832          *
1833          * Note that it's possible for the tty to be opened again while we're
1834          * flushing out waiters.  By recalculating the closing flags before
1835          * each iteration we avoid any problems.
1836          */
1837         while (1) {
1838                 /* Guard against races with tty->count changes elsewhere and
1839                    opens on /dev/tty */
1840                    
1841                 down(&tty_sem);
1842                 tty_closing = tty->count <= 1;
1843                 o_tty_closing = o_tty &&
1844                         (o_tty->count <= (pty_master ? 1 : 0));
1845                 do_sleep = 0;
1846
1847                 if (tty_closing) {
1848                         if (waitqueue_active(&tty->read_wait)) {
1849                                 wake_up(&tty->read_wait);
1850                                 do_sleep++;
1851                         }
1852                         if (waitqueue_active(&tty->write_wait)) {
1853                                 wake_up(&tty->write_wait);
1854                                 do_sleep++;
1855                         }
1856                 }
1857                 if (o_tty_closing) {
1858                         if (waitqueue_active(&o_tty->read_wait)) {
1859                                 wake_up(&o_tty->read_wait);
1860                                 do_sleep++;
1861                         }
1862                         if (waitqueue_active(&o_tty->write_wait)) {
1863                                 wake_up(&o_tty->write_wait);
1864                                 do_sleep++;
1865                         }
1866                 }
1867                 if (!do_sleep)
1868                         break;
1869
1870                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
1871                                     "active!\n", tty_name(tty, buf));
1872                 up(&tty_sem);
1873                 schedule();
1874         }       
1875
1876         /*
1877          * The closing flags are now consistent with the open counts on 
1878          * both sides, and we've completed the last operation that could 
1879          * block, so it's safe to proceed with closing.
1880          */
1881         if (pty_master) {
1882                 if (--o_tty->count < 0) {
1883                         printk(KERN_WARNING "release_dev: bad pty slave count "
1884                                             "(%d) for %s\n",
1885                                o_tty->count, tty_name(o_tty, buf));
1886                         o_tty->count = 0;
1887                 }
1888         }
1889         if (--tty->count < 0) {
1890                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
1891                        tty->count, tty_name(tty, buf));
1892                 tty->count = 0;
1893         }
1894         
1895         /*
1896          * We've decremented tty->count, so we need to remove this file
1897          * descriptor off the tty->tty_files list; this serves two
1898          * purposes:
1899          *  - check_tty_count sees the correct number of file descriptors
1900          *    associated with this tty.
1901          *  - do_tty_hangup no longer sees this file descriptor as
1902          *    something that needs to be handled for hangups.
1903          */
1904         file_kill(filp);
1905         filp->private_data = NULL;
1906
1907         /*
1908          * Perform some housekeeping before deciding whether to return.
1909          *
1910          * Set the TTY_CLOSING flag if this was the last open.  In the
1911          * case of a pty we may have to wait around for the other side
1912          * to close, and TTY_CLOSING makes sure we can't be reopened.
1913          */
1914         if(tty_closing)
1915                 set_bit(TTY_CLOSING, &tty->flags);
1916         if(o_tty_closing)
1917                 set_bit(TTY_CLOSING, &o_tty->flags);
1918
1919         /*
1920          * If _either_ side is closing, make sure there aren't any
1921          * processes that still think tty or o_tty is their controlling
1922          * tty.
1923          */
1924         if (tty_closing || o_tty_closing) {
1925                 struct task_struct *p;
1926
1927                 read_lock(&tasklist_lock);
1928                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1929                         p->signal->tty = NULL;
1930                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1931                 if (o_tty)
1932                         do_each_task_pid(o_tty->session, PIDTYPE_SID, p) {
1933                                 p->signal->tty = NULL;
1934                         } while_each_task_pid(o_tty->session, PIDTYPE_SID, p);
1935                 read_unlock(&tasklist_lock);
1936         }
1937
1938         up(&tty_sem);
1939
1940         /* check whether both sides are closing ... */
1941         if (!tty_closing || (o_tty && !o_tty_closing))
1942                 return;
1943         
1944 #ifdef TTY_DEBUG_HANGUP
1945         printk(KERN_DEBUG "freeing tty structure...");
1946 #endif
1947         /*
1948          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
1949          * kill any delayed work. As this is the final close it does not
1950          * race with the set_ldisc code path.
1951          */
1952         clear_bit(TTY_LDISC, &tty->flags);
1953         clear_bit(TTY_DONT_FLIP, &tty->flags);
1954         cancel_delayed_work(&tty->buf.work);
1955
1956         /*
1957          * Wait for ->hangup_work and ->buf.work handlers to terminate
1958          */
1959          
1960         flush_scheduled_work();
1961         
1962         /*
1963          * Wait for any short term users (we know they are just driver
1964          * side waiters as the file is closing so user count on the file
1965          * side is zero.
1966          */
1967         spin_lock_irqsave(&tty_ldisc_lock, flags);
1968         while(tty->ldisc.refcount)
1969         {
1970                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1971                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
1972                 spin_lock_irqsave(&tty_ldisc_lock, flags);
1973         }
1974         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1975         /*
1976          * Shutdown the current line discipline, and reset it to N_TTY.
1977          * N.B. why reset ldisc when we're releasing the memory??
1978          *
1979          * FIXME: this MUST get fixed for the new reflocking
1980          */
1981         if (tty->ldisc.close)
1982                 (tty->ldisc.close)(tty);
1983         tty_ldisc_put(tty->ldisc.num);
1984         
1985         /*
1986          *      Switch the line discipline back
1987          */
1988         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1989         tty_set_termios_ldisc(tty,N_TTY); 
1990         if (o_tty) {
1991                 /* FIXME: could o_tty be in setldisc here ? */
1992                 clear_bit(TTY_LDISC, &o_tty->flags);
1993                 if (o_tty->ldisc.close)
1994                         (o_tty->ldisc.close)(o_tty);
1995                 tty_ldisc_put(o_tty->ldisc.num);
1996                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
1997                 tty_set_termios_ldisc(o_tty,N_TTY); 
1998         }
1999         /*
2000          * The release_mem function takes care of the details of clearing
2001          * the slots and preserving the termios structure.
2002          */
2003         release_mem(tty, idx);
2004
2005 #ifdef CONFIG_UNIX98_PTYS
2006         /* Make this pty number available for reallocation */
2007         if (devpts) {
2008                 down(&allocated_ptys_lock);
2009                 idr_remove(&allocated_ptys, idx);
2010                 up(&allocated_ptys_lock);
2011         }
2012 #endif
2013
2014 }
2015
2016 /*
2017  * tty_open and tty_release keep up the tty count that contains the
2018  * number of opens done on a tty. We cannot use the inode-count, as
2019  * different inodes might point to the same tty.
2020  *
2021  * Open-counting is needed for pty masters, as well as for keeping
2022  * track of serial lines: DTR is dropped when the last close happens.
2023  * (This is not done solely through tty->count, now.  - Ted 1/27/92)
2024  *
2025  * The termios state of a pty is reset on first open so that
2026  * settings don't persist across reuse.
2027  */
2028 static int tty_open(struct inode * inode, struct file * filp)
2029 {
2030         struct tty_struct *tty;
2031         int noctty, retval;
2032         struct tty_driver *driver;
2033         int index;
2034         dev_t device = inode->i_rdev;
2035         unsigned short saved_flags = filp->f_flags;
2036
2037         nonseekable_open(inode, filp);
2038         
2039 retry_open:
2040         noctty = filp->f_flags & O_NOCTTY;
2041         index  = -1;
2042         retval = 0;
2043         
2044         down(&tty_sem);
2045
2046         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2047                 if (!current->signal->tty) {
2048                         up(&tty_sem);
2049                         return -ENXIO;
2050                 }
2051                 driver = current->signal->tty->driver;
2052                 index = current->signal->tty->index;
2053                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2054                 /* noctty = 1; */
2055                 goto got_driver;
2056         }
2057 #ifdef CONFIG_VT
2058         if (device == MKDEV(TTY_MAJOR,0)) {
2059                 extern struct tty_driver *console_driver;
2060                 driver = console_driver;
2061                 index = fg_console;
2062                 noctty = 1;
2063                 goto got_driver;
2064         }
2065 #endif
2066         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2067                 driver = console_device(&index);
2068                 if (driver) {
2069                         /* Don't let /dev/console block */
2070                         filp->f_flags |= O_NONBLOCK;
2071                         noctty = 1;
2072                         goto got_driver;
2073                 }
2074                 up(&tty_sem);
2075                 return -ENODEV;
2076         }
2077
2078         driver = get_tty_driver(device, &index);
2079         if (!driver) {
2080                 up(&tty_sem);
2081                 return -ENODEV;
2082         }
2083 got_driver:
2084         retval = init_dev(driver, index, &tty);
2085         up(&tty_sem);
2086         if (retval)
2087                 return retval;
2088
2089         filp->private_data = tty;
2090         file_move(filp, &tty->tty_files);
2091         check_tty_count(tty, "tty_open");
2092         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2093             tty->driver->subtype == PTY_TYPE_MASTER)
2094                 noctty = 1;
2095 #ifdef TTY_DEBUG_HANGUP
2096         printk(KERN_DEBUG "opening %s...", tty->name);
2097 #endif
2098         if (!retval) {
2099                 if (tty->driver->open)
2100                         retval = tty->driver->open(tty, filp);
2101                 else
2102                         retval = -ENODEV;
2103         }
2104         filp->f_flags = saved_flags;
2105
2106         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2107                 retval = -EBUSY;
2108
2109         if (retval) {
2110 #ifdef TTY_DEBUG_HANGUP
2111                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2112                        tty->name);
2113 #endif
2114                 release_dev(filp);
2115                 if (retval != -ERESTARTSYS)
2116                         return retval;
2117                 if (signal_pending(current))
2118                         return retval;
2119                 schedule();
2120                 /*
2121                  * Need to reset f_op in case a hangup happened.
2122                  */
2123                 if (filp->f_op == &hung_up_tty_fops)
2124                         filp->f_op = &tty_fops;
2125                 goto retry_open;
2126         }
2127         if (!noctty &&
2128             current->signal->leader &&
2129             !current->signal->tty &&
2130             tty->session == 0) {
2131                 task_lock(current);
2132                 current->signal->tty = tty;
2133                 task_unlock(current);
2134                 current->signal->tty_old_pgrp = 0;
2135                 tty->session = current->signal->session;
2136                 tty->pgrp = process_group(current);
2137         }
2138         return 0;
2139 }
2140
2141 #ifdef CONFIG_UNIX98_PTYS
2142 static int ptmx_open(struct inode * inode, struct file * filp)
2143 {
2144         struct tty_struct *tty;
2145         int retval;
2146         int index;
2147         int idr_ret;
2148
2149         nonseekable_open(inode, filp);
2150
2151         /* find a device that is not in use. */
2152         down(&allocated_ptys_lock);
2153         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2154                 up(&allocated_ptys_lock);
2155                 return -ENOMEM;
2156         }
2157         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2158         if (idr_ret < 0) {
2159                 up(&allocated_ptys_lock);
2160                 if (idr_ret == -EAGAIN)
2161                         return -ENOMEM;
2162                 return -EIO;
2163         }
2164         if (index >= pty_limit) {
2165                 idr_remove(&allocated_ptys, index);
2166                 up(&allocated_ptys_lock);
2167                 return -EIO;
2168         }
2169         up(&allocated_ptys_lock);
2170
2171         down(&tty_sem);
2172         retval = init_dev(ptm_driver, index, &tty);
2173         up(&tty_sem);
2174         
2175         if (retval)
2176                 goto out;
2177
2178         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2179         filp->private_data = tty;
2180         file_move(filp, &tty->tty_files);
2181
2182         retval = -ENOMEM;
2183         if (devpts_pty_new(tty->link))
2184                 goto out1;
2185
2186         check_tty_count(tty, "tty_open");
2187         retval = ptm_driver->open(tty, filp);
2188         if (!retval)
2189                 return 0;
2190 out1:
2191         release_dev(filp);
2192 out:
2193         down(&allocated_ptys_lock);
2194         idr_remove(&allocated_ptys, index);
2195         up(&allocated_ptys_lock);
2196         return retval;
2197 }
2198 #endif
2199
2200 static int tty_release(struct inode * inode, struct file * filp)
2201 {
2202         lock_kernel();
2203         release_dev(filp);
2204         unlock_kernel();
2205         return 0;
2206 }
2207
2208 /* No kernel lock held - fine */
2209 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2210 {
2211         struct tty_struct * tty;
2212         struct tty_ldisc *ld;
2213         int ret = 0;
2214
2215         tty = (struct tty_struct *)filp->private_data;
2216         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_poll"))
2217                 return 0;
2218                 
2219         ld = tty_ldisc_ref_wait(tty);
2220         if (ld->poll)
2221                 ret = (ld->poll)(tty, filp, wait);
2222         tty_ldisc_deref(ld);
2223         return ret;
2224 }
2225
2226 static int tty_fasync(int fd, struct file * filp, int on)
2227 {
2228         struct tty_struct * tty;
2229         int retval;
2230
2231         tty = (struct tty_struct *)filp->private_data;
2232         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_fasync"))
2233                 return 0;
2234         
2235         retval = fasync_helper(fd, filp, on, &tty->fasync);
2236         if (retval <= 0)
2237                 return retval;
2238
2239         if (on) {
2240                 if (!waitqueue_active(&tty->read_wait))
2241                         tty->minimum_to_wake = 1;
2242                 retval = f_setown(filp, (-tty->pgrp) ? : current->pid, 0);
2243                 if (retval)
2244                         return retval;
2245         } else {
2246                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2247                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2248         }
2249         return 0;
2250 }
2251
2252 static int tiocsti(struct tty_struct *tty, char __user *p)
2253 {
2254         char ch, mbz = 0;
2255         struct tty_ldisc *ld;
2256         
2257         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2258                 return -EPERM;
2259         if (get_user(ch, p))
2260                 return -EFAULT;
2261         ld = tty_ldisc_ref_wait(tty);
2262         ld->receive_buf(tty, &ch, &mbz, 1);
2263         tty_ldisc_deref(ld);
2264         return 0;
2265 }
2266
2267 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2268 {
2269         if (copy_to_user(arg, &tty->winsize, sizeof(*arg)))
2270                 return -EFAULT;
2271         return 0;
2272 }
2273
2274 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2275         struct winsize __user * arg)
2276 {
2277         struct winsize tmp_ws;
2278
2279         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2280                 return -EFAULT;
2281         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2282                 return 0;
2283 #ifdef CONFIG_VT
2284         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2285                 int rc;
2286
2287                 acquire_console_sem();
2288                 rc = vc_resize(tty->driver_data, tmp_ws.ws_col, tmp_ws.ws_row);
2289                 release_console_sem();
2290                 if (rc)
2291                         return -ENXIO;
2292         }
2293 #endif
2294         if (tty->pgrp > 0)
2295                 kill_pg(tty->pgrp, SIGWINCH, 1);
2296         if ((real_tty->pgrp != tty->pgrp) && (real_tty->pgrp > 0))
2297                 kill_pg(real_tty->pgrp, SIGWINCH, 1);
2298         tty->winsize = tmp_ws;
2299         real_tty->winsize = tmp_ws;
2300         return 0;
2301 }
2302
2303 static int tioccons(struct file *file)
2304 {
2305         if (!capable(CAP_SYS_ADMIN))
2306                 return -EPERM;
2307         if (file->f_op->write == redirected_tty_write) {
2308                 struct file *f;
2309                 spin_lock(&redirect_lock);
2310                 f = redirect;
2311                 redirect = NULL;
2312                 spin_unlock(&redirect_lock);
2313                 if (f)
2314                         fput(f);
2315                 return 0;
2316         }
2317         spin_lock(&redirect_lock);
2318         if (redirect) {
2319                 spin_unlock(&redirect_lock);
2320                 return -EBUSY;
2321         }
2322         get_file(file);
2323         redirect = file;
2324         spin_unlock(&redirect_lock);
2325         return 0;
2326 }
2327
2328
2329 static int fionbio(struct file *file, int __user *p)
2330 {
2331         int nonblock;
2332
2333         if (get_user(nonblock, p))
2334                 return -EFAULT;
2335
2336         if (nonblock)
2337                 file->f_flags |= O_NONBLOCK;
2338         else
2339                 file->f_flags &= ~O_NONBLOCK;
2340         return 0;
2341 }
2342
2343 static int tiocsctty(struct tty_struct *tty, int arg)
2344 {
2345         task_t *p;
2346
2347         if (current->signal->leader &&
2348             (current->signal->session == tty->session))
2349                 return 0;
2350         /*
2351          * The process must be a session leader and
2352          * not have a controlling tty already.
2353          */
2354         if (!current->signal->leader || current->signal->tty)
2355                 return -EPERM;
2356         if (tty->session > 0) {
2357                 /*
2358                  * This tty is already the controlling
2359                  * tty for another session group!
2360                  */
2361                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
2362                         /*
2363                          * Steal it away
2364                          */
2365
2366                         read_lock(&tasklist_lock);
2367                         do_each_task_pid(tty->session, PIDTYPE_SID, p) {
2368                                 p->signal->tty = NULL;
2369                         } while_each_task_pid(tty->session, PIDTYPE_SID, p);
2370                         read_unlock(&tasklist_lock);
2371                 } else
2372                         return -EPERM;
2373         }
2374         task_lock(current);
2375         current->signal->tty = tty;
2376         task_unlock(current);
2377         current->signal->tty_old_pgrp = 0;
2378         tty->session = current->signal->session;
2379         tty->pgrp = process_group(current);
2380         return 0;
2381 }
2382
2383 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2384 {
2385         pid_t pgrp;
2386         /*
2387          * (tty == real_tty) is a cheap way of
2388          * testing if the tty is NOT a master pty.
2389          */
2390         if (tty == real_tty && current->signal->tty != real_tty)
2391                 return -ENOTTY;
2392
2393         pgrp = vx_map_pid(real_tty->pgrp);
2394         return put_user(pgrp, p);
2395 }
2396
2397 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2398 {
2399         pid_t pgrp;
2400         int retval = tty_check_change(real_tty);
2401
2402         if (retval == -EIO)
2403                 return -ENOTTY;
2404         if (retval)
2405                 return retval;
2406         if (!current->signal->tty ||
2407             (current->signal->tty != real_tty) ||
2408             (real_tty->session != current->signal->session))
2409                 return -ENOTTY;
2410         if (get_user(pgrp, p))
2411                 return -EFAULT;
2412
2413         pgrp = vx_rmap_pid(pgrp);
2414         if (pgrp < 0)
2415                 return -EINVAL;
2416         if (session_of_pgrp(pgrp) != current->signal->session)
2417                 return -EPERM;
2418         real_tty->pgrp = pgrp;
2419         return 0;
2420 }
2421
2422 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2423 {
2424         /*
2425          * (tty == real_tty) is a cheap way of
2426          * testing if the tty is NOT a master pty.
2427         */
2428         if (tty == real_tty && current->signal->tty != real_tty)
2429                 return -ENOTTY;
2430         if (real_tty->session <= 0)
2431                 return -ENOTTY;
2432         return put_user(real_tty->session, p);
2433 }
2434
2435 static int tiocsetd(struct tty_struct *tty, int __user *p)
2436 {
2437         int ldisc;
2438
2439         if (get_user(ldisc, p))
2440                 return -EFAULT;
2441         return tty_set_ldisc(tty, ldisc);
2442 }
2443
2444 static int send_break(struct tty_struct *tty, unsigned int duration)
2445 {
2446         tty->driver->break_ctl(tty, -1);
2447         if (!signal_pending(current)) {
2448                 msleep_interruptible(duration);
2449         }
2450         tty->driver->break_ctl(tty, 0);
2451         if (signal_pending(current))
2452                 return -EINTR;
2453         return 0;
2454 }
2455
2456 static int
2457 tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
2458 {
2459         int retval = -EINVAL;
2460
2461         if (tty->driver->tiocmget) {
2462                 retval = tty->driver->tiocmget(tty, file);
2463
2464                 if (retval >= 0)
2465                         retval = put_user(retval, p);
2466         }
2467         return retval;
2468 }
2469
2470 static int
2471 tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
2472              unsigned __user *p)
2473 {
2474         int retval = -EINVAL;
2475
2476         if (tty->driver->tiocmset) {
2477                 unsigned int set, clear, val;
2478
2479                 retval = get_user(val, p);
2480                 if (retval)
2481                         return retval;
2482
2483                 set = clear = 0;
2484                 switch (cmd) {
2485                 case TIOCMBIS:
2486                         set = val;
2487                         break;
2488                 case TIOCMBIC:
2489                         clear = val;
2490                         break;
2491                 case TIOCMSET:
2492                         set = val;
2493                         clear = ~val;
2494                         break;
2495                 }
2496
2497                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2498                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2499
2500                 retval = tty->driver->tiocmset(tty, file, set, clear);
2501         }
2502         return retval;
2503 }
2504
2505 /*
2506  * Split this up, as gcc can choke on it otherwise..
2507  */
2508 int tty_ioctl(struct inode * inode, struct file * file,
2509               unsigned int cmd, unsigned long arg)
2510 {
2511         struct tty_struct *tty, *real_tty;
2512         void __user *p = (void __user *)arg;
2513         int retval;
2514         struct tty_ldisc *ld;
2515         
2516         tty = (struct tty_struct *)file->private_data;
2517         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2518                 return -EINVAL;
2519
2520         real_tty = tty;
2521         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2522             tty->driver->subtype == PTY_TYPE_MASTER)
2523                 real_tty = tty->link;
2524
2525         /*
2526          * Break handling by driver
2527          */
2528         if (!tty->driver->break_ctl) {
2529                 switch(cmd) {
2530                 case TIOCSBRK:
2531                 case TIOCCBRK:
2532                         if (tty->driver->ioctl)
2533                                 return tty->driver->ioctl(tty, file, cmd, arg);
2534                         return -EINVAL;
2535                         
2536                 /* These two ioctl's always return success; even if */
2537                 /* the driver doesn't support them. */
2538                 case TCSBRK:
2539                 case TCSBRKP:
2540                         if (!tty->driver->ioctl)
2541                                 return 0;
2542                         retval = tty->driver->ioctl(tty, file, cmd, arg);
2543                         if (retval == -ENOIOCTLCMD)
2544                                 retval = 0;
2545                         return retval;
2546                 }
2547         }
2548
2549         /*
2550          * Factor out some common prep work
2551          */
2552         switch (cmd) {
2553         case TIOCSETD:
2554         case TIOCSBRK:
2555         case TIOCCBRK:
2556         case TCSBRK:
2557         case TCSBRKP:                   
2558                 retval = tty_check_change(tty);
2559                 if (retval)
2560                         return retval;
2561                 if (cmd != TIOCCBRK) {
2562                         tty_wait_until_sent(tty, 0);
2563                         if (signal_pending(current))
2564                                 return -EINTR;
2565                 }
2566                 break;
2567         }
2568
2569         switch (cmd) {
2570                 case TIOCSTI:
2571                         return tiocsti(tty, p);
2572                 case TIOCGWINSZ:
2573                         return tiocgwinsz(tty, p);
2574                 case TIOCSWINSZ:
2575                         return tiocswinsz(tty, real_tty, p);
2576                 case TIOCCONS:
2577                         return real_tty!=tty ? -EINVAL : tioccons(file);
2578                 case FIONBIO:
2579                         return fionbio(file, p);
2580                 case TIOCEXCL:
2581                         set_bit(TTY_EXCLUSIVE, &tty->flags);
2582                         return 0;
2583                 case TIOCNXCL:
2584                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
2585                         return 0;
2586                 case TIOCNOTTY:
2587                         if (current->signal->tty != tty)
2588                                 return -ENOTTY;
2589                         if (current->signal->leader)
2590                                 disassociate_ctty(0);
2591                         task_lock(current);
2592                         current->signal->tty = NULL;
2593                         task_unlock(current);
2594                         return 0;
2595                 case TIOCSCTTY:
2596                         return tiocsctty(tty, arg);
2597                 case TIOCGPGRP:
2598                         return tiocgpgrp(tty, real_tty, p);
2599                 case TIOCSPGRP:
2600                         return tiocspgrp(tty, real_tty, p);
2601                 case TIOCGSID:
2602                         return tiocgsid(tty, real_tty, p);
2603                 case TIOCGETD:
2604                         /* FIXME: check this is ok */
2605                         return put_user(tty->ldisc.num, (int __user *)p);
2606                 case TIOCSETD:
2607                         return tiocsetd(tty, p);
2608 #ifdef CONFIG_VT
2609                 case TIOCLINUX:
2610                         return tioclinux(tty, arg);
2611 #endif
2612                 /*
2613                  * Break handling
2614                  */
2615                 case TIOCSBRK:  /* Turn break on, unconditionally */
2616                         tty->driver->break_ctl(tty, -1);
2617                         return 0;
2618                         
2619                 case TIOCCBRK:  /* Turn break off, unconditionally */
2620                         tty->driver->break_ctl(tty, 0);
2621                         return 0;
2622                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
2623                         /*
2624                          * XXX is the above comment correct, or the
2625                          * code below correct?  Is this ioctl used at
2626                          * all by anyone?
2627                          */
2628                         if (!arg)
2629                                 return send_break(tty, 250);
2630                         return 0;
2631                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
2632                         return send_break(tty, arg ? arg*100 : 250);
2633
2634                 case TIOCMGET:
2635                         return tty_tiocmget(tty, file, p);
2636
2637                 case TIOCMSET:
2638                 case TIOCMBIC:
2639                 case TIOCMBIS:
2640                         return tty_tiocmset(tty, file, cmd, p);
2641         }
2642         if (tty->driver->ioctl) {
2643                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
2644                 if (retval != -ENOIOCTLCMD)
2645                         return retval;
2646         }
2647         ld = tty_ldisc_ref_wait(tty);
2648         retval = -EINVAL;
2649         if (ld->ioctl) {
2650                 retval = ld->ioctl(tty, file, cmd, arg);
2651                 if (retval == -ENOIOCTLCMD)
2652                         retval = -EINVAL;
2653         }
2654         tty_ldisc_deref(ld);
2655         return retval;
2656 }
2657
2658
2659 /*
2660  * This implements the "Secure Attention Key" ---  the idea is to
2661  * prevent trojan horses by killing all processes associated with this
2662  * tty when the user hits the "Secure Attention Key".  Required for
2663  * super-paranoid applications --- see the Orange Book for more details.
2664  * 
2665  * This code could be nicer; ideally it should send a HUP, wait a few
2666  * seconds, then send a INT, and then a KILL signal.  But you then
2667  * have to coordinate with the init process, since all processes associated
2668  * with the current tty must be dead before the new getty is allowed
2669  * to spawn.
2670  *
2671  * Now, if it would be correct ;-/ The current code has a nasty hole -
2672  * it doesn't catch files in flight. We may send the descriptor to ourselves
2673  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2674  *
2675  * Nasty bug: do_SAK is being called in interrupt context.  This can
2676  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2677  */
2678 static void __do_SAK(void *arg)
2679 {
2680 #ifdef TTY_SOFT_SAK
2681         tty_hangup(tty);
2682 #else
2683         struct tty_struct *tty = arg;
2684         struct task_struct *p;
2685         int session;
2686         int             i;
2687         struct file     *filp;
2688         struct tty_ldisc *disc;
2689         struct fdtable *fdt;
2690         
2691         if (!tty)
2692                 return;
2693         session  = tty->session;
2694         
2695         /* We don't want an ldisc switch during this */
2696         disc = tty_ldisc_ref(tty);
2697         if (disc && disc->flush_buffer)
2698                 disc->flush_buffer(tty);
2699         tty_ldisc_deref(disc);
2700
2701         if (tty->driver->flush_buffer)
2702                 tty->driver->flush_buffer(tty);
2703         
2704         read_lock(&tasklist_lock);
2705         do_each_task_pid(session, PIDTYPE_SID, p) {
2706                 if (p->signal->tty == tty || session > 0) {
2707                         printk(KERN_NOTICE "SAK: killed process %d"
2708                             " (%s): p->signal->session==tty->session\n",
2709                             p->pid, p->comm);
2710                         send_sig(SIGKILL, p, 1);
2711                         continue;
2712                 }
2713                 task_lock(p);
2714                 if (p->files) {
2715                         /*
2716                          * We don't take a ref to the file, so we must
2717                          * hold ->file_lock instead.
2718                          */
2719                         spin_lock(&p->files->file_lock);
2720                         fdt = files_fdtable(p->files);
2721                         for (i=0; i < fdt->max_fds; i++) {
2722                                 filp = fcheck_files(p->files, i);
2723                                 if (!filp)
2724                                         continue;
2725                                 if (filp->f_op->read == tty_read &&
2726                                     filp->private_data == tty) {
2727                                         printk(KERN_NOTICE "SAK: killed process %d"
2728                                             " (%s): fd#%d opened to the tty\n",
2729                                             p->pid, p->comm, i);
2730                                         send_sig(SIGKILL, p, 1);
2731                                         break;
2732                                 }
2733                         }
2734                         spin_unlock(&p->files->file_lock);
2735                 }
2736                 task_unlock(p);
2737         } while_each_task_pid(session, PIDTYPE_SID, p);
2738         read_unlock(&tasklist_lock);
2739 #endif
2740 }
2741
2742 /*
2743  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2744  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2745  * the values which we write to it will be identical to the values which it
2746  * already has. --akpm
2747  */
2748 void do_SAK(struct tty_struct *tty)
2749 {
2750         if (!tty)
2751                 return;
2752         PREPARE_WORK(&tty->SAK_work, __do_SAK, tty);
2753         schedule_work(&tty->SAK_work);
2754 }
2755
2756 EXPORT_SYMBOL(do_SAK);
2757
2758 /*
2759  * This routine is called out of the software interrupt to flush data
2760  * from the buffer chain to the line discipline.
2761  */
2762  
2763 static void flush_to_ldisc(void *private_)
2764 {
2765         struct tty_struct *tty = (struct tty_struct *) private_;
2766         unsigned long   flags;
2767         struct tty_ldisc *disc;
2768         struct tty_buffer *tbuf, *head;
2769         int count;
2770         char *char_buf;
2771         unsigned char *flag_buf;
2772
2773         disc = tty_ldisc_ref(tty);
2774         if (disc == NULL)       /*  !TTY_LDISC */
2775                 return;
2776
2777         if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
2778                 /*
2779                  * Do it after the next timer tick:
2780                  */
2781                 schedule_delayed_work(&tty->buf.work, 1);
2782                 goto out;
2783         }
2784         spin_lock_irqsave(&tty->buf.lock, flags);
2785         head = tty->buf.head;
2786         tty->buf.head = NULL;
2787         while((tbuf = head) != NULL) {
2788                 while ((count = tbuf->commit - tbuf->read) != 0) {
2789                         char_buf = tbuf->char_buf_ptr + tbuf->read;
2790                         flag_buf = tbuf->flag_buf_ptr + tbuf->read;
2791                         tbuf->read += count;
2792                         spin_unlock_irqrestore(&tty->buf.lock, flags);
2793                         disc->receive_buf(tty, char_buf, flag_buf, count);
2794                         spin_lock_irqsave(&tty->buf.lock, flags);
2795                 }
2796                 if (tbuf->active) {
2797                         tty->buf.head = head;
2798                         break;
2799                 }
2800                 head = tbuf->next;
2801                 if (head == NULL)
2802                         tty->buf.tail = NULL;
2803                 tty_buffer_free(tty, tbuf);
2804         }
2805         spin_unlock_irqrestore(&tty->buf.lock, flags);
2806 out:
2807         tty_ldisc_deref(disc);
2808 }
2809
2810 /*
2811  * Routine which returns the baud rate of the tty
2812  *
2813  * Note that the baud_table needs to be kept in sync with the
2814  * include/asm/termbits.h file.
2815  */
2816 static int baud_table[] = {
2817         0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
2818         9600, 19200, 38400, 57600, 115200, 230400, 460800,
2819 #ifdef __sparc__
2820         76800, 153600, 307200, 614400, 921600
2821 #else
2822         500000, 576000, 921600, 1000000, 1152000, 1500000, 2000000,
2823         2500000, 3000000, 3500000, 4000000
2824 #endif
2825 };
2826
2827 static int n_baud_table = ARRAY_SIZE(baud_table);
2828
2829 /**
2830  *      tty_termios_baud_rate
2831  *      @termios: termios structure
2832  *
2833  *      Convert termios baud rate data into a speed. This should be called
2834  *      with the termios lock held if this termios is a terminal termios
2835  *      structure. May change the termios data.
2836  */
2837  
2838 int tty_termios_baud_rate(struct termios *termios)
2839 {
2840         unsigned int cbaud;
2841         
2842         cbaud = termios->c_cflag & CBAUD;
2843
2844         if (cbaud & CBAUDEX) {
2845                 cbaud &= ~CBAUDEX;
2846
2847                 if (cbaud < 1 || cbaud + 15 > n_baud_table)
2848                         termios->c_cflag &= ~CBAUDEX;
2849                 else
2850                         cbaud += 15;
2851         }
2852         return baud_table[cbaud];
2853 }
2854
2855 EXPORT_SYMBOL(tty_termios_baud_rate);
2856
2857 /**
2858  *      tty_get_baud_rate       -       get tty bit rates
2859  *      @tty: tty to query
2860  *
2861  *      Returns the baud rate as an integer for this terminal. The
2862  *      termios lock must be held by the caller and the terminal bit
2863  *      flags may be updated.
2864  */
2865  
2866 int tty_get_baud_rate(struct tty_struct *tty)
2867 {
2868         int baud = tty_termios_baud_rate(tty->termios);
2869
2870         if (baud == 38400 && tty->alt_speed) {
2871                 if (!tty->warned) {
2872                         printk(KERN_WARNING "Use of setserial/setrocket to "
2873                                             "set SPD_* flags is deprecated\n");
2874                         tty->warned = 1;
2875                 }
2876                 baud = tty->alt_speed;
2877         }
2878         
2879         return baud;
2880 }
2881
2882 EXPORT_SYMBOL(tty_get_baud_rate);
2883
2884 /**
2885  *      tty_flip_buffer_push    -       terminal
2886  *      @tty: tty to push
2887  *
2888  *      Queue a push of the terminal flip buffers to the line discipline. This
2889  *      function must not be called from IRQ context if tty->low_latency is set.
2890  *
2891  *      In the event of the queue being busy for flipping the work will be
2892  *      held off and retried later.
2893  */
2894
2895 void tty_flip_buffer_push(struct tty_struct *tty)
2896 {
2897         unsigned long flags;
2898         spin_lock_irqsave(&tty->buf.lock, flags);
2899         if (tty->buf.tail != NULL) {
2900                 tty->buf.tail->active = 0;
2901                 tty->buf.tail->commit = tty->buf.tail->used;
2902         }
2903         spin_unlock_irqrestore(&tty->buf.lock, flags);
2904
2905         if (tty->low_latency)
2906                 flush_to_ldisc((void *) tty);
2907         else
2908                 schedule_delayed_work(&tty->buf.work, 1);
2909 }
2910
2911 EXPORT_SYMBOL(tty_flip_buffer_push);
2912
2913
2914 /*
2915  * This subroutine initializes a tty structure.
2916  */
2917 static void initialize_tty_struct(struct tty_struct *tty)
2918 {
2919         memset(tty, 0, sizeof(struct tty_struct));
2920         tty->magic = TTY_MAGIC;
2921         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2922         tty->pgrp = -1;
2923         tty->overrun_time = jiffies;
2924         tty->buf.head = tty->buf.tail = NULL;
2925         tty_buffer_init(tty);
2926         INIT_WORK(&tty->buf.work, flush_to_ldisc, tty);
2927         init_MUTEX(&tty->buf.pty_sem);
2928         init_MUTEX(&tty->termios_sem);
2929         init_waitqueue_head(&tty->write_wait);
2930         init_waitqueue_head(&tty->read_wait);
2931         INIT_WORK(&tty->hangup_work, do_tty_hangup, tty);
2932         sema_init(&tty->atomic_read, 1);
2933         sema_init(&tty->atomic_write, 1);
2934         spin_lock_init(&tty->read_lock);
2935         INIT_LIST_HEAD(&tty->tty_files);
2936         INIT_WORK(&tty->SAK_work, NULL, NULL);
2937 }
2938
2939 /*
2940  * The default put_char routine if the driver did not define one.
2941  */
2942 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
2943 {
2944         tty->driver->write(tty, &ch, 1);
2945 }
2946
2947 static struct class *tty_class;
2948
2949 /**
2950  * tty_register_device - register a tty device
2951  * @driver: the tty driver that describes the tty device
2952  * @index: the index in the tty driver for this tty device
2953  * @device: a struct device that is associated with this tty device.
2954  *      This field is optional, if there is no known struct device for this
2955  *      tty device it can be set to NULL safely.
2956  *
2957  * This call is required to be made to register an individual tty device if
2958  * the tty driver's flags have the TTY_DRIVER_NO_DEVFS bit set.  If that
2959  * bit is not set, this function should not be called.
2960  */
2961 void tty_register_device(struct tty_driver *driver, unsigned index,
2962                          struct device *device)
2963 {
2964         char name[64];
2965         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
2966
2967         if (index >= driver->num) {
2968                 printk(KERN_ERR "Attempt to register invalid tty line number "
2969                        " (%d).\n", index);
2970                 return;
2971         }
2972
2973         devfs_mk_cdev(dev, S_IFCHR | S_IRUSR | S_IWUSR,
2974                         "%s%d", driver->devfs_name, index + driver->name_base);
2975
2976         if (driver->type == TTY_DRIVER_TYPE_PTY)
2977                 pty_line_name(driver, index, name);
2978         else
2979                 tty_line_name(driver, index, name);
2980         class_device_create(tty_class, NULL, dev, device, "%s", name);
2981 }
2982
2983 /**
2984  * tty_unregister_device - unregister a tty device
2985  * @driver: the tty driver that describes the tty device
2986  * @index: the index in the tty driver for this tty device
2987  *
2988  * If a tty device is registered with a call to tty_register_device() then
2989  * this function must be made when the tty device is gone.
2990  */
2991 void tty_unregister_device(struct tty_driver *driver, unsigned index)
2992 {
2993         devfs_remove("%s%d", driver->devfs_name, index + driver->name_base);
2994         class_device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
2995 }
2996
2997 EXPORT_SYMBOL(tty_register_device);
2998 EXPORT_SYMBOL(tty_unregister_device);
2999
3000 struct tty_driver *alloc_tty_driver(int lines)
3001 {
3002         struct tty_driver *driver;
3003
3004         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
3005         if (driver) {
3006                 memset(driver, 0, sizeof(struct tty_driver));
3007                 driver->magic = TTY_DRIVER_MAGIC;
3008                 driver->num = lines;
3009                 /* later we'll move allocation of tables here */
3010         }
3011         return driver;
3012 }
3013
3014 void put_tty_driver(struct tty_driver *driver)
3015 {
3016         kfree(driver);
3017 }
3018
3019 void tty_set_operations(struct tty_driver *driver, struct tty_operations *op)
3020 {
3021         driver->open = op->open;
3022         driver->close = op->close;
3023         driver->write = op->write;
3024         driver->put_char = op->put_char;
3025         driver->flush_chars = op->flush_chars;
3026         driver->write_room = op->write_room;
3027         driver->chars_in_buffer = op->chars_in_buffer;
3028         driver->ioctl = op->ioctl;
3029         driver->set_termios = op->set_termios;
3030         driver->throttle = op->throttle;
3031         driver->unthrottle = op->unthrottle;
3032         driver->stop = op->stop;
3033         driver->start = op->start;
3034         driver->hangup = op->hangup;
3035         driver->break_ctl = op->break_ctl;
3036         driver->flush_buffer = op->flush_buffer;
3037         driver->set_ldisc = op->set_ldisc;
3038         driver->wait_until_sent = op->wait_until_sent;
3039         driver->send_xchar = op->send_xchar;
3040         driver->read_proc = op->read_proc;
3041         driver->write_proc = op->write_proc;
3042         driver->tiocmget = op->tiocmget;
3043         driver->tiocmset = op->tiocmset;
3044 }
3045
3046
3047 EXPORT_SYMBOL(alloc_tty_driver);
3048 EXPORT_SYMBOL(put_tty_driver);
3049 EXPORT_SYMBOL(tty_set_operations);
3050
3051 /*
3052  * Called by a tty driver to register itself.
3053  */
3054 int tty_register_driver(struct tty_driver *driver)
3055 {
3056         int error;
3057         int i;
3058         dev_t dev;
3059         void **p = NULL;
3060
3061         if (driver->flags & TTY_DRIVER_INSTALLED)
3062                 return 0;
3063
3064         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
3065                 p = kmalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3066                 if (!p)
3067                         return -ENOMEM;
3068                 memset(p, 0, driver->num * 3 * sizeof(void *));
3069         }
3070
3071         if (!driver->major) {
3072                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3073                                                 (char*)driver->name);
3074                 if (!error) {
3075                         driver->major = MAJOR(dev);
3076                         driver->minor_start = MINOR(dev);
3077                 }
3078         } else {
3079                 dev = MKDEV(driver->major, driver->minor_start);
3080                 error = register_chrdev_region(dev, driver->num,
3081                                                 (char*)driver->name);
3082         }
3083         if (error < 0) {
3084                 kfree(p);
3085                 return error;
3086         }
3087
3088         if (p) {
3089                 driver->ttys = (struct tty_struct **)p;
3090                 driver->termios = (struct termios **)(p + driver->num);
3091                 driver->termios_locked = (struct termios **)(p + driver->num * 2);
3092         } else {
3093                 driver->ttys = NULL;
3094                 driver->termios = NULL;
3095                 driver->termios_locked = NULL;
3096         }
3097
3098         cdev_init(&driver->cdev, &tty_fops);
3099         driver->cdev.owner = driver->owner;
3100         error = cdev_add(&driver->cdev, dev, driver->num);
3101         if (error) {
3102                 cdev_del(&driver->cdev);
3103                 unregister_chrdev_region(dev, driver->num);
3104                 driver->ttys = NULL;
3105                 driver->termios = driver->termios_locked = NULL;
3106                 kfree(p);
3107                 return error;
3108         }
3109
3110         if (!driver->put_char)
3111                 driver->put_char = tty_default_put_char;
3112         
3113         list_add(&driver->tty_drivers, &tty_drivers);
3114         
3115         if ( !(driver->flags & TTY_DRIVER_NO_DEVFS) ) {
3116                 for(i = 0; i < driver->num; i++)
3117                     tty_register_device(driver, i, NULL);
3118         }
3119         proc_tty_register_driver(driver);
3120         return 0;
3121 }
3122
3123 EXPORT_SYMBOL(tty_register_driver);
3124
3125 /*
3126  * Called by a tty driver to unregister itself.
3127  */
3128 int tty_unregister_driver(struct tty_driver *driver)
3129 {
3130         int i;
3131         struct termios *tp;
3132         void *p;
3133
3134         if (driver->refcount)
3135                 return -EBUSY;
3136
3137         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3138                                 driver->num);
3139
3140         list_del(&driver->tty_drivers);
3141
3142         /*
3143          * Free the termios and termios_locked structures because
3144          * we don't want to get memory leaks when modular tty
3145          * drivers are removed from the kernel.
3146          */
3147         for (i = 0; i < driver->num; i++) {
3148                 tp = driver->termios[i];
3149                 if (tp) {
3150                         driver->termios[i] = NULL;
3151                         kfree(tp);
3152                 }
3153                 tp = driver->termios_locked[i];
3154                 if (tp) {
3155                         driver->termios_locked[i] = NULL;
3156                         kfree(tp);
3157                 }
3158                 if (!(driver->flags & TTY_DRIVER_NO_DEVFS))
3159                         tty_unregister_device(driver, i);
3160         }
3161         p = driver->ttys;
3162         proc_tty_unregister_driver(driver);
3163         driver->ttys = NULL;
3164         driver->termios = driver->termios_locked = NULL;
3165         kfree(p);
3166         cdev_del(&driver->cdev);
3167         return 0;
3168 }
3169
3170 EXPORT_SYMBOL(tty_unregister_driver);
3171
3172
3173 /*
3174  * Initialize the console device. This is called *early*, so
3175  * we can't necessarily depend on lots of kernel help here.
3176  * Just do some early initializations, and do the complex setup
3177  * later.
3178  */
3179 void __init console_init(void)
3180 {
3181         initcall_t *call;
3182
3183         /* Setup the default TTY line discipline. */
3184         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
3185
3186         /*
3187          * set up the console device so that later boot sequences can 
3188          * inform about problems etc..
3189          */
3190 #ifdef CONFIG_EARLY_PRINTK
3191         disable_early_printk();
3192 #endif
3193         call = __con_initcall_start;
3194         while (call < __con_initcall_end) {
3195                 (*call)();
3196                 call++;
3197         }
3198 }
3199
3200 #ifdef CONFIG_VT
3201 extern int vty_init(void);
3202 #endif
3203
3204 static int __init tty_class_init(void)
3205 {
3206         tty_class = class_create(THIS_MODULE, "tty");
3207         if (IS_ERR(tty_class))
3208                 return PTR_ERR(tty_class);
3209         return 0;
3210 }
3211
3212 postcore_initcall(tty_class_init);
3213
3214 /* 3/2004 jmc: why do these devices exist? */
3215
3216 static struct cdev tty_cdev, console_cdev;
3217 #ifdef CONFIG_UNIX98_PTYS
3218 static struct cdev ptmx_cdev;
3219 #endif
3220 #ifdef CONFIG_VT
3221 static struct cdev vc0_cdev;
3222 #endif
3223
3224 /*
3225  * Ok, now we can initialize the rest of the tty devices and can count
3226  * on memory allocations, interrupts etc..
3227  */
3228 static int __init tty_init(void)
3229 {
3230         cdev_init(&tty_cdev, &tty_fops);
3231         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3232             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3233                 panic("Couldn't register /dev/tty driver\n");
3234         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 0), S_IFCHR|S_IRUGO|S_IWUGO, "tty");
3235         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3236
3237         cdev_init(&console_cdev, &console_fops);
3238         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3239             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3240                 panic("Couldn't register /dev/console driver\n");
3241         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 1), S_IFCHR|S_IRUSR|S_IWUSR, "console");
3242         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL, "console");
3243
3244 #ifdef CONFIG_UNIX98_PTYS
3245         cdev_init(&ptmx_cdev, &ptmx_fops);
3246         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
3247             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
3248                 panic("Couldn't register /dev/ptmx driver\n");
3249         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 2), S_IFCHR|S_IRUGO|S_IWUGO, "ptmx");
3250         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), NULL, "ptmx");
3251 #endif
3252
3253 #ifdef CONFIG_VT
3254         cdev_init(&vc0_cdev, &console_fops);
3255         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
3256             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
3257                 panic("Couldn't register /dev/tty0 driver\n");
3258         devfs_mk_cdev(MKDEV(TTY_MAJOR, 0), S_IFCHR|S_IRUSR|S_IWUSR, "vc/0");
3259         class_device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), NULL, "tty0");
3260
3261         vty_init();
3262 #endif
3263         return 0;
3264 }
3265 module_init(tty_init);