drivers/char/tty_io.c

   1 /*
   2  *  linux/drivers/char/tty_io.c
   3  *
   4  *  Copyright (C) 1991, 1992  Linus Torvalds
   5  */
   6
   7 /*
   8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
   9  * or rs-channels. It also implements echoing, cooked mode etc.
  10  *
  11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
  12  *
  13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
  14  * tty_struct and tty_queue structures.  Previously there was an array
  15  * of 256 tty_struct's which was statically allocated, and the
  16  * tty_queue structures were allocated at boot time.  Both are now
  17  * dynamically allocated only when the tty is open.
  18  *
  19  * Also restructured routines so that there is more of a separation
  20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
  21  * the low-level tty routines (serial.c, pty.c, console.c).  This
  22  * makes for cleaner and more compact code.  -TYT, 9/17/92
  23  *
  24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
  25  * which can be dynamically activated and de-activated by the line
  26  * discipline handling modules (like SLIP).
  27  *
  28  * NOTE: pay no attention to the line discipline code (yet); its
  29  * interface is still subject to change in this version...
  30  * -- TYT, 1/31/92
  31  *
  32  * Added functionality to the OPOST tty handling.  No delays, but all
  33  * other bits should be there.
  34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
  35  *
  36  * Rewrote canonical mode and added more termios flags.
  37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
  38  *
  39  * Reorganized FASYNC support so mouse code can share it.
  40  *      -- ctm@ardi.com, 9Sep95
  41  *
  42  * New TIOCLINUX variants added.
  43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
  44  *
  45  * Restrict vt switching via ioctl()
  46  *      -- grif@cs.ucr.edu, 5-Dec-95
  47  *
  48  * Move console and virtual terminal code to more appropriate files,
  49  * implement CONFIG_VT and generalize console device interface.
  50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
  51  *
  52  * Rewrote init_dev and release_dev to eliminate races.
  53  *      -- Bill Hawes <whawes@star.net>, June 97
  54  *
  55  * Added devfs support.
  56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
  57  *
  58  * Added support for a Unix98-style ptmx device.
  59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
  60  *
  61  * Reduced memory usage for older ARM systems
  62  *      -- Russell King <rmk@arm.linux.org.uk>
  63  *
  64  * Move do_SAK() into process context.  Less stack use in devfs functions.
  65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
  66  */
  67
  68 #include <linux/config.h>
  69 #include <linux/types.h>
  70 #include <linux/major.h>
  71 #include <linux/errno.h>
  72 #include <linux/signal.h>
  73 #include <linux/fcntl.h>
  74 #include <linux/sched.h>
  75 #include <linux/interrupt.h>
  76 #include <linux/tty.h>
  77 #include <linux/tty_driver.h>
  78 #include <linux/tty_flip.h>
  79 #include <linux/devpts_fs.h>
  80 #include <linux/file.h>
  81 #include <linux/console.h>
  82 #include <linux/timer.h>
  83 #include <linux/ctype.h>
  84 #include <linux/kd.h>
  85 #include <linux/mm.h>
  86 #include <linux/string.h>
  87 #include <linux/slab.h>
  88 #include <linux/poll.h>
  89 #include <linux/proc_fs.h>
  90 #include <linux/init.h>
  91 #include <linux/module.h>
  92 #include <linux/smp_lock.h>
  93 #include <linux/device.h>
  94 #include <linux/idr.h>
  95
  96 #include <asm/uaccess.h>
  97 #include <asm/system.h>
  98 #include <asm/bitops.h>
  99
 100 #include <linux/kbd_kern.h>
 101 #include <linux/vt_kern.h>
 102 #include <linux/selection.h>
 103 #include <linux/devfs_fs_kernel.h>
 104
 105 #include <linux/kmod.h>
 106
 107 #undef TTY_DEBUG_HANGUP
 108
 109 #define TTY_PARANOIA_CHECK 1
 110 #define CHECK_TTY_COUNT 1
 111
 112 struct termios tty_std_termios = {      /* for the benefit of tty drivers  */
 113         .c_iflag = ICRNL | IXON,
 114         .c_oflag = OPOST | ONLCR,
 115         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
 116         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
 117                    ECHOCTL | ECHOKE | IEXTEN,
 118         .c_cc = INIT_C_CC
 119 };
 120
 121 EXPORT_SYMBOL(tty_std_termios);
 122
 123 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
 124 struct tty_ldisc ldiscs[NR_LDISCS];     /* line disc dispatch table     */
 125
 126 /* Semaphore to protect creating and releasing a tty */
 127 DECLARE_MUTEX(tty_sem);
 128
 129 #ifdef CONFIG_UNIX98_PTYS
 130 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
 131 extern int pty_limit;           /* Config limit on Unix98 ptys */
 132 static DEFINE_IDR(allocated_ptys);
 133 static DECLARE_MUTEX(allocated_ptys_lock);
 134 #endif
 135
 136 extern void disable_early_printk(void);
 137
 138 static void initialize_tty_struct(struct tty_struct *tty);
 139
 140 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
 141 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
 142 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
 143 static unsigned int tty_poll(struct file *, poll_table *);
 144 static int tty_open(struct inode *, struct file *);
 145 static int tty_release(struct inode *, struct file *);
 146 int tty_ioctl(struct inode * inode, struct file * file,
 147               unsigned int cmd, unsigned long arg);
 148 static int tty_fasync(int fd, struct file * filp, int on);
 149 extern void rs_360_init(void);
 150 static void release_mem(struct tty_struct *tty, int idx);
 151
 152
 153 static struct tty_struct *alloc_tty_struct(void)
 154 {
 155         struct tty_struct *tty;
 156
 157         tty = kmalloc(sizeof(struct tty_struct), GFP_KERNEL);
 158         if (tty)
 159                 memset(tty, 0, sizeof(struct tty_struct));
 160         return tty;
 161 }
 162
 163 static inline void free_tty_struct(struct tty_struct *tty)
 164 {
 165         kfree(tty);
 166 }
 167
 168 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
 169
 170 char *tty_name(struct tty_struct *tty, char *buf)
 171 {
 172         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
 173                 strcpy(buf, "NULL tty");
 174         else
 175                 strcpy(buf, tty->name);
 176         return buf;
 177 }
 178
 179 EXPORT_SYMBOL(tty_name);
 180
 181 inline int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
 182                               const char *routine)
 183 {
 184 #ifdef TTY_PARANOIA_CHECK
 185         if (!tty) {
 186                 printk(KERN_WARNING
 187                         "null TTY for (%d:%d) in %s\n",
 188                         imajor(inode), iminor(inode), routine);
 189                 return 1;
 190         }
 191         if (tty->magic != TTY_MAGIC) {
 192                 printk(KERN_WARNING
 193                         "bad magic number for tty struct (%d:%d) in %s\n",
 194                         imajor(inode), iminor(inode), routine);
 195                 return 1;
 196         }
 197 #endif
 198         return 0;
 199 }
 200
 201 static int check_tty_count(struct tty_struct *tty, const char *routine)
 202 {
 203 #ifdef CHECK_TTY_COUNT
 204         struct list_head *p;
 205         int count = 0;
 206
 207         file_list_lock();
 208         list_for_each(p, &tty->tty_files) {
 209                 count++;
 210         }
 211         file_list_unlock();
 212         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
 213             tty->driver->subtype == PTY_TYPE_SLAVE &&
 214             tty->link && tty->link->count)
 215                 count++;
 216         if (tty->count != count) {
 217                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
 218                                     "!= #fd's(%d) in %s\n",
 219                        tty->name, tty->count, count, routine);
 220                 return count;
 221        }
 222 #endif
 223         return 0;
 224 }
 225
 226 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
 227 {
 228         if (disc < N_TTY || disc >= NR_LDISCS)
 229                 return -EINVAL;
 230
 231         if (new_ldisc) {
 232                 ldiscs[disc] = *new_ldisc;
 233                 ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
 234                 ldiscs[disc].num = disc;
 235         } else
 236                 memset(&ldiscs[disc], 0, sizeof(struct tty_ldisc));
 237
 238         return 0;
 239 }
 240
 241 EXPORT_SYMBOL(tty_register_ldisc);
 242
 243 /* Set the discipline of a tty line. */
 244 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 245 {
 246         int     retval = 0;
 247         struct  tty_ldisc o_ldisc;
 248         char buf[64];
 249
 250         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
 251                 return -EINVAL;
 252         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
 253         /* Cyrus Durgin <cider@speakeasy.org> */
 254         if (!(ldiscs[ldisc].flags & LDISC_FLAG_DEFINED)) {
 255                 request_module("tty-ldisc-%d", ldisc);
 256         }
 257         if (!(ldiscs[ldisc].flags & LDISC_FLAG_DEFINED))
 258                 return -EINVAL;
 259
 260         if (tty->ldisc.num == ldisc)
 261                 return 0;       /* We are already in the desired discipline */
 262
 263         if (!try_module_get(ldiscs[ldisc].owner))
 264                 return -EINVAL;
 265
 266         o_ldisc = tty->ldisc;
 267
 268         tty_wait_until_sent(tty, 0);
 269
 270         /* Shutdown the current discipline. */
 271         if (tty->ldisc.close)
 272                 (tty->ldisc.close)(tty);
 273
 274         /* Now set up the new line discipline. */
 275         tty->ldisc = ldiscs[ldisc];
 276         tty->termios->c_line = ldisc;
 277         if (tty->ldisc.open)
 278                 retval = (tty->ldisc.open)(tty);
 279         if (retval < 0) {
 280                 tty->ldisc = o_ldisc;
 281                 tty->termios->c_line = tty->ldisc.num;
 282                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
 283                         tty->ldisc = ldiscs[N_TTY];
 284                         tty->termios->c_line = N_TTY;
 285                         if (tty->ldisc.open) {
 286                                 int r = tty->ldisc.open(tty);
 287
 288                                 if (r < 0)
 289                                         panic("Couldn't open N_TTY ldisc for "
 290                                               "%s --- error %d.",
 291                                               tty_name(tty, buf), r);
 292                         }
 293                 }
 294         } else {
 295                 module_put(o_ldisc.owner);
 296         }
 297
 298         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
 299                 tty->driver->set_ldisc(tty);
 300         return retval;
 301 }
 302
 303 /*
 304  * This routine returns a tty driver structure, given a device number
 305  */
 306 struct tty_driver *get_tty_driver(dev_t device, int *index)
 307 {
 308         struct tty_driver *p;
 309
 310         list_for_each_entry(p, &tty_drivers, tty_drivers) {
 311                 dev_t base = MKDEV(p->major, p->minor_start);
 312                 if (device < base || device >= base + p->num)
 313                         continue;
 314                 *index = device - base;
 315                 return p;
 316         }
 317         return NULL;
 318 }
 319
 320 /*
 321  * If we try to write to, or set the state of, a terminal and we're
 322  * not in the foreground, send a SIGTTOU.  If the signal is blocked or
 323  * ignored, go ahead and perform the operation.  (POSIX 7.2)
 324  */
 325 int tty_check_change(struct tty_struct * tty)
 326 {
 327         if (current->signal->tty != tty)
 328                 return 0;
 329         if (tty->pgrp <= 0) {
 330                 printk(KERN_WARNING "tty_check_change: tty->pgrp <= 0!\n");
 331                 return 0;
 332         }
 333         if (process_group(current) == tty->pgrp)
 334                 return 0;
 335         if (is_ignored(SIGTTOU))
 336                 return 0;
 337         if (is_orphaned_pgrp(process_group(current)))
 338                 return -EIO;
 339         (void) kill_pg(process_group(current), SIGTTOU, 1);
 340         return -ERESTARTSYS;
 341 }
 342
 343 EXPORT_SYMBOL(tty_check_change);
 344
 345 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
 346                                 size_t count, loff_t *ppos)
 347 {
 348         /* Can't seek (pread) on ttys.  */
 349         if (ppos != &file->f_pos)
 350                 return -ESPIPE;
 351         return 0;
 352 }
 353
 354 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
 355                                  size_t count, loff_t *ppos)
 356 {
 357         /* Can't seek (pwrite) on ttys.  */
 358         if (ppos != &file->f_pos)
 359                 return -ESPIPE;
 360         return -EIO;
 361 }
 362
 363 /* No kernel lock held - none needed ;) */
 364 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
 365 {
 366         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
 367 }
 368
 369 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
 370                              unsigned int cmd, unsigned long arg)
 371 {
 372         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
 373 }
 374
 375 static struct file_operations tty_fops = {
 376         .llseek         = no_llseek,
 377         .read           = tty_read,
 378         .write          = tty_write,
 379         .poll           = tty_poll,
 380         .ioctl          = tty_ioctl,
 381         .open           = tty_open,
 382         .release        = tty_release,
 383         .fasync         = tty_fasync,
 384 };
 385
 386 static struct file_operations console_fops = {
 387         .llseek         = no_llseek,
 388         .read           = tty_read,
 389         .write          = redirected_tty_write,
 390         .poll           = tty_poll,
 391         .ioctl          = tty_ioctl,
 392         .open           = tty_open,
 393         .release        = tty_release,
 394         .fasync         = tty_fasync,
 395 };
 396
 397 static struct file_operations hung_up_tty_fops = {
 398         .llseek         = no_llseek,
 399         .read           = hung_up_tty_read,
 400         .write          = hung_up_tty_write,
 401         .poll           = hung_up_tty_poll,
 402         .ioctl          = hung_up_tty_ioctl,
 403         .release        = tty_release,
 404 };
 405
 406 static spinlock_t redirect_lock = SPIN_LOCK_UNLOCKED;
 407 static struct file *redirect;
 408 /*
 409  * This can be called by the "eventd" kernel thread.  That is process synchronous,
 410  * but doesn't hold any locks, so we need to make sure we have the appropriate
 411  * locks for what we're doing..
 412  */
 413 void do_tty_hangup(void *data)
 414 {
 415         struct tty_struct *tty = (struct tty_struct *) data;
 416         struct file * cons_filp = NULL;
 417         struct file *filp, *f = NULL;
 418         struct task_struct *p;
 419         struct pid *pid;
 420         int    closecount = 0, n;
 421
 422         if (!tty)
 423                 return;
 424
 425         /* inuse_filps is protected by the single kernel lock */
 426         lock_kernel();
 427
 428         spin_lock(&redirect_lock);
 429         if (redirect && redirect->private_data == tty) {
 430                 f = redirect;
 431                 redirect = NULL;
 432         }
 433         spin_unlock(&redirect_lock);
 434
 435         check_tty_count(tty, "do_tty_hangup");
 436         file_list_lock();
 437         list_for_each_entry(filp, &tty->tty_files, f_list) {
 438                 if (filp->f_op->write == redirected_tty_write)
 439                         cons_filp = filp;
 440                 if (filp->f_op->write != tty_write)
 441                         continue;
 442                 closecount++;
 443                 tty_fasync(-1, filp, 0);        /* can't block */
 444                 filp->f_op = &hung_up_tty_fops;
 445         }
 446         file_list_unlock();
 447
 448         /* FIXME! What are the locking issues here? This may me overdoing things..
 449         * this question is especially important now that we've removed the irqlock. */
 450         {
 451                 unsigned long flags;
 452
 453                 local_irq_save(flags); // FIXME: is this safe?
 454                 if (tty->ldisc.flush_buffer)
 455                         tty->ldisc.flush_buffer(tty);
 456                 if (tty->driver->flush_buffer)
 457                         tty->driver->flush_buffer(tty);
 458                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
 459                     tty->ldisc.write_wakeup)
 460                         (tty->ldisc.write_wakeup)(tty);
 461                 local_irq_restore(flags); // FIXME: is this safe?
 462         }
 463
 464         wake_up_interruptible(&tty->write_wait);
 465         wake_up_interruptible(&tty->read_wait);
 466
 467         /*
 468          * Shutdown the current line discipline, and reset it to
 469          * N_TTY.
 470          */
 471         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
 472                 *tty->termios = tty->driver->init_termios;
 473         if (tty->ldisc.num != ldiscs[N_TTY].num) {
 474                 if (tty->ldisc.close)
 475                         (tty->ldisc.close)(tty);
 476                 module_put(tty->ldisc.owner);
 477
 478                 tty->ldisc = ldiscs[N_TTY];
 479                 tty->termios->c_line = N_TTY;
 480                 if (tty->ldisc.open) {
 481                         int i = (tty->ldisc.open)(tty);
 482                         if (i < 0)
 483                                 printk(KERN_ERR "do_tty_hangup: N_TTY open: "
 484                                                 "error %d\n", -i);
 485                 }
 486         }
 487
 488         read_lock(&tasklist_lock);
 489         if (tty->session > 0) {
 490                 struct list_head *l;
 491                 for_each_task_pid(tty->session, PIDTYPE_SID, p, l, pid) {
 492                         if (p->signal->tty == tty)
 493                                 p->signal->tty = NULL;
 494                         if (!p->signal->leader)
 495                                 continue;
 496                         send_group_sig_info(SIGHUP, SEND_SIG_PRIV, p);
 497                         send_group_sig_info(SIGCONT, SEND_SIG_PRIV, p);
 498                         if (tty->pgrp > 0)
 499                                 p->signal->tty_old_pgrp = tty->pgrp;
 500                 }
 501         }
 502         read_unlock(&tasklist_lock);
 503
 504         tty->flags = 0;
 505         tty->session = 0;
 506         tty->pgrp = -1;
 507         tty->ctrl_status = 0;
 508         /*
 509          *      If one of the devices matches a console pointer, we
 510          *      cannot just call hangup() because that will cause
 511          *      tty->count and state->count to go out of sync.
 512          *      So we just call close() the right number of times.
 513          */
 514         if (cons_filp) {
 515                 if (tty->driver->close)
 516                         for (n = 0; n < closecount; n++)
 517                                 tty->driver->close(tty, cons_filp);
 518         } else if (tty->driver->hangup)
 519                 (tty->driver->hangup)(tty);
 520         unlock_kernel();
 521         if (f)
 522                 fput(f);
 523 }
 524
 525 void tty_hangup(struct tty_struct * tty)
 526 {
 527 #ifdef TTY_DEBUG_HANGUP
 528         char    buf[64];
 529
 530         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
 531 #endif
 532         schedule_work(&tty->hangup_work);
 533 }
 534
 535 EXPORT_SYMBOL(tty_hangup);
 536
 537 void tty_vhangup(struct tty_struct * tty)
 538 {
 539 #ifdef TTY_DEBUG_HANGUP
 540         char    buf[64];
 541
 542         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
 543 #endif
 544         do_tty_hangup((void *) tty);
 545 }
 546 EXPORT_SYMBOL(tty_vhangup);
 547
 548 int tty_hung_up_p(struct file * filp)
 549 {
 550         return (filp->f_op == &hung_up_tty_fops);
 551 }
 552
 553 EXPORT_SYMBOL(tty_hung_up_p);
 554
 555 /*
 556  * This function is typically called only by the session leader, when
 557  * it wants to disassociate itself from its controlling tty.
 558  *
 559  * It performs the following functions:
 560  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
 561  *      (2)  Clears the tty from being controlling the session
 562  *      (3)  Clears the controlling tty for all processes in the
 563  *              session group.
 564  *
 565  * The argument on_exit is set to 1 if called when a process is
 566  * exiting; it is 0 if called by the ioctl TIOCNOTTY.
 567  */
 568 void disassociate_ctty(int on_exit)
 569 {
 570         struct tty_struct *tty;
 571         struct task_struct *p;
 572         struct list_head *l;
 573         struct pid *pid;
 574         int tty_pgrp = -1;
 575
 576         lock_kernel();
 577
 578         tty = current->signal->tty;
 579         if (tty) {
 580                 tty_pgrp = tty->pgrp;
 581                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
 582                         tty_vhangup(tty);
 583         } else {
 584                 if (current->signal->tty_old_pgrp) {
 585                         kill_pg(current->signal->tty_old_pgrp, SIGHUP, on_exit);
 586                         kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit);
 587                 }
 588                 unlock_kernel();
 589                 return;
 590         }
 591         if (tty_pgrp > 0) {
 592                 kill_pg(tty_pgrp, SIGHUP, on_exit);
 593                 if (!on_exit)
 594                         kill_pg(tty_pgrp, SIGCONT, on_exit);
 595         }
 596
 597         current->signal->tty_old_pgrp = 0;
 598         tty->session = 0;
 599         tty->pgrp = -1;
 600
 601         read_lock(&tasklist_lock);
 602         for_each_task_pid(current->signal->session, PIDTYPE_SID, p, l, pid)
 603                 p->signal->tty = NULL;
 604         read_unlock(&tasklist_lock);
 605         unlock_kernel();
 606 }
 607
 608 void stop_tty(struct tty_struct *tty)
 609 {
 610         if (tty->stopped)
 611                 return;
 612         tty->stopped = 1;
 613         if (tty->link && tty->link->packet) {
 614                 tty->ctrl_status &= ~TIOCPKT_START;
 615                 tty->ctrl_status |= TIOCPKT_STOP;
 616                 wake_up_interruptible(&tty->link->read_wait);
 617         }
 618         if (tty->driver->stop)
 619                 (tty->driver->stop)(tty);
 620 }
 621
 622 EXPORT_SYMBOL(stop_tty);
 623
 624 void start_tty(struct tty_struct *tty)
 625 {
 626         if (!tty->stopped || tty->flow_stopped)
 627                 return;
 628         tty->stopped = 0;
 629         if (tty->link && tty->link->packet) {
 630                 tty->ctrl_status &= ~TIOCPKT_STOP;
 631                 tty->ctrl_status |= TIOCPKT_START;
 632                 wake_up_interruptible(&tty->link->read_wait);
 633         }
 634         if (tty->driver->start)
 635                 (tty->driver->start)(tty);
 636         if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
 637             tty->ldisc.write_wakeup)
 638                 (tty->ldisc.write_wakeup)(tty);
 639         wake_up_interruptible(&tty->write_wait);
 640 }
 641
 642 EXPORT_SYMBOL(start_tty);
 643
 644 static ssize_t tty_read(struct file * file, char __user * buf, size_t count,
 645                         loff_t *ppos)
 646 {
 647         int i;
 648         struct tty_struct * tty;
 649         struct inode *inode;
 650
 651         /* Can't seek (pread) on ttys.  */
 652         if (ppos != &file->f_pos)
 653                 return -ESPIPE;
 654
 655         tty = (struct tty_struct *)file->private_data;
 656         inode = file->f_dentry->d_inode;
 657         if (tty_paranoia_check(tty, inode, "tty_read"))
 658                 return -EIO;
 659         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
 660                 return -EIO;
 661
 662         lock_kernel();
 663         if (tty->ldisc.read)
 664                 i = (tty->ldisc.read)(tty,file,buf,count);
 665         else
 666                 i = -EIO;
 667         unlock_kernel();
 668         if (i > 0)
 669                 inode->i_atime = CURRENT_TIME;
 670         return i;
 671 }
 672
 673 /*
 674  * Split writes up in sane blocksizes to avoid
 675  * denial-of-service type attacks
 676  */
 677 static inline ssize_t do_tty_write(
 678         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char __user *, size_t),
 679         struct tty_struct *tty,
 680         struct file *file,
 681         const unsigned char __user *buf,
 682         size_t count)
 683 {
 684         ssize_t ret = 0, written = 0;
 685
 686         if (down_interruptible(&tty->atomic_write)) {
 687                 return -ERESTARTSYS;
 688         }
 689         if ( test_bit(TTY_NO_WRITE_SPLIT, &tty->flags) ) {
 690                 lock_kernel();
 691                 written = write(tty, file, buf, count);
 692                 unlock_kernel();
 693         } else {
 694                 for (;;) {
 695                         unsigned long size = max((unsigned long)PAGE_SIZE*2, 16384UL);
 696                         if (size > count)
 697                                 size = count;
 698                         lock_kernel();
 699                         ret = write(tty, file, buf, size);
 700                         unlock_kernel();
 701                         if (ret <= 0)
 702                                 break;
 703                         written += ret;
 704                         buf += ret;
 705                         count -= ret;
 706                         if (!count)
 707                                 break;
 708                         ret = -ERESTARTSYS;
 709                         if (signal_pending(current))
 710                                 break;
 711                         cond_resched();
 712                 }
 713         }
 714         if (written) {
 715                 file->f_dentry->d_inode->i_mtime = CURRENT_TIME;
 716                 ret = written;
 717         }
 718         up(&tty->atomic_write);
 719         return ret;
 720 }
 721
 722
 723 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
 724                          loff_t *ppos)
 725 {
 726         struct tty_struct * tty;
 727         struct inode *inode = file->f_dentry->d_inode;
 728
 729         /* Can't seek (pwrite) on ttys.  */
 730         if (ppos != &file->f_pos)
 731                 return -ESPIPE;
 732
 733         tty = (struct tty_struct *)file->private_data;
 734         if (tty_paranoia_check(tty, inode, "tty_write"))
 735                 return -EIO;
 736         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
 737                 return -EIO;
 738         if (!tty->ldisc.write)
 739                 return -EIO;
 740         return do_tty_write(tty->ldisc.write, tty, file,
 741                             (const unsigned char __user *)buf, count);
 742 }
 743
 744 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
 745                          loff_t *ppos)
 746 {
 747         struct file *p = NULL;
 748
 749         spin_lock(&redirect_lock);
 750         if (redirect) {
 751                 get_file(redirect);
 752                 p = redirect;
 753         }
 754         spin_unlock(&redirect_lock);
 755
 756         if (p) {
 757                 ssize_t res;
 758                 /* Can't seek (pwrite) on ttys.  */
 759                 if (ppos != &file->f_pos)
 760                         return -ESPIPE;
 761                 res = vfs_write(p, buf, count, &p->f_pos);
 762                 fput(p);
 763                 return res;
 764         }
 765
 766         return tty_write(file, buf, count, ppos);
 767 }
 768
 769 static inline void tty_line_name(struct tty_driver *driver, int index, char *p)
 770 {
 771         sprintf(p, "%s%d", driver->name, index + driver->name_base);
 772 }
 773
 774 /*
 775  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
 776  * failed open.  The new code protects the open with a semaphore, so it's
 777  * really quite straightforward.  The semaphore locking can probably be
 778  * relaxed for the (most common) case of reopening a tty.
 779  */
 780 static int init_dev(struct tty_driver *driver, int idx,
 781         struct tty_struct **ret_tty)
 782 {
 783         struct tty_struct *tty, *o_tty;
 784         struct termios *tp, **tp_loc, *o_tp, **o_tp_loc;
 785         struct termios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
 786         int retval=0;
 787
 788         /*
 789          * Check whether we need to acquire the tty semaphore to avoid
 790          * race conditions.  For now, play it safe.
 791          */
 792         down(&tty_sem);
 793
 794         /* check whether we're reopening an existing tty */
 795         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
 796                 tty = devpts_get_tty(idx);
 797                 if (tty && driver->subtype == PTY_TYPE_MASTER)
 798                         tty = tty->link;
 799         } else {
 800                 tty = driver->ttys[idx];
 801         }
 802         if (tty) goto fast_track;
 803
 804         /*
 805          * First time open is complex, especially for PTY devices.
 806          * This code guarantees that either everything succeeds and the
 807          * TTY is ready for operation, or else the table slots are vacated
 808          * and the allocated memory released.  (Except that the termios
 809          * and locked termios may be retained.)
 810          */
 811
 812         if (!try_module_get(driver->owner)) {
 813                 retval = -ENODEV;
 814                 goto end_init;
 815         }
 816
 817         o_tty = NULL;
 818         tp = o_tp = NULL;
 819         ltp = o_ltp = NULL;
 820
 821         tty = alloc_tty_struct();
 822         if(!tty)
 823                 goto fail_no_mem;
 824         initialize_tty_struct(tty);
 825         tty->driver = driver;
 826         tty->index = idx;
 827         tty_line_name(driver, idx, tty->name);
 828
 829         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
 830                 tp_loc = &tty->termios;
 831                 ltp_loc = &tty->termios_locked;
 832         } else {
 833                 tp_loc = &driver->termios[idx];
 834                 ltp_loc = &driver->termios_locked[idx];
 835         }
 836
 837         if (!*tp_loc) {
 838                 tp = (struct termios *) kmalloc(sizeof(struct termios),
 839                                                 GFP_KERNEL);
 840                 if (!tp)
 841                         goto free_mem_out;
 842                 *tp = driver->init_termios;
 843         }
 844
 845         if (!*ltp_loc) {
 846                 ltp = (struct termios *) kmalloc(sizeof(struct termios),
 847                                                  GFP_KERNEL);
 848                 if (!ltp)
 849                         goto free_mem_out;
 850                 memset(ltp, 0, sizeof(struct termios));
 851         }
 852
 853         if (driver->type == TTY_DRIVER_TYPE_PTY) {
 854                 o_tty = alloc_tty_struct();
 855                 if (!o_tty)
 856                         goto free_mem_out;
 857                 initialize_tty_struct(o_tty);
 858                 o_tty->driver = driver->other;
 859                 o_tty->index = idx;
 860                 tty_line_name(driver->other, idx, o_tty->name);
 861
 862                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
 863                         o_tp_loc = &o_tty->termios;
 864                         o_ltp_loc = &o_tty->termios_locked;
 865                 } else {
 866                         o_tp_loc = &driver->other->termios[idx];
 867                         o_ltp_loc = &driver->other->termios_locked[idx];
 868                 }
 869
 870                 if (!*o_tp_loc) {
 871                         o_tp = (struct termios *)
 872                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
 873                         if (!o_tp)
 874                                 goto free_mem_out;
 875                         *o_tp = driver->other->init_termios;
 876                 }
 877
 878                 if (!*o_ltp_loc) {
 879                         o_ltp = (struct termios *)
 880                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
 881                         if (!o_ltp)
 882                                 goto free_mem_out;
 883                         memset(o_ltp, 0, sizeof(struct termios));
 884                 }
 885
 886                 /*
 887                  * Everything allocated ... set up the o_tty structure.
 888                  */
 889                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
 890                         driver->other->ttys[idx] = o_tty;
 891                 }
 892                 if (!*o_tp_loc)
 893                         *o_tp_loc = o_tp;
 894                 if (!*o_ltp_loc)
 895                         *o_ltp_loc = o_ltp;
 896                 o_tty->termios = *o_tp_loc;
 897                 o_tty->termios_locked = *o_ltp_loc;
 898                 driver->other->refcount++;
 899                 if (driver->subtype == PTY_TYPE_MASTER)
 900                         o_tty->count++;
 901
 902                 /* Establish the links in both directions */
 903                 tty->link   = o_tty;
 904                 o_tty->link = tty;
 905         }
 906
 907         /*
 908          * All structures have been allocated, so now we install them.
 909          * Failures after this point use release_mem to clean up, so
 910          * there's no need to null out the local pointers.
 911          */
 912         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
 913                 driver->ttys[idx] = tty;
 914         }
 915
 916         if (!*tp_loc)
 917                 *tp_loc = tp;
 918         if (!*ltp_loc)
 919                 *ltp_loc = ltp;
 920         tty->termios = *tp_loc;
 921         tty->termios_locked = *ltp_loc;
 922         driver->refcount++;
 923         tty->count++;
 924
 925         /*
 926          * Structures all installed ... call the ldisc open routines.
 927          * If we fail here just call release_mem to clean up.  No need
 928          * to decrement the use counts, as release_mem doesn't care.
 929          */
 930         if (tty->ldisc.open) {
 931                 retval = (tty->ldisc.open)(tty);
 932                 if (retval)
 933                         goto release_mem_out;
 934         }
 935         if (o_tty && o_tty->ldisc.open) {
 936                 retval = (o_tty->ldisc.open)(o_tty);
 937                 if (retval) {
 938                         if (tty->ldisc.close)
 939                                 (tty->ldisc.close)(tty);
 940                         goto release_mem_out;
 941                 }
 942         }
 943         goto success;
 944
 945         /*
 946          * This fast open can be used if the tty is already open.
 947          * No memory is allocated, and the only failures are from
 948          * attempting to open a closing tty or attempting multiple
 949          * opens on a pty master.
 950          */
 951 fast_track:
 952         if (test_bit(TTY_CLOSING, &tty->flags)) {
 953                 retval = -EIO;
 954                 goto end_init;
 955         }
 956         if (driver->type == TTY_DRIVER_TYPE_PTY &&
 957             driver->subtype == PTY_TYPE_MASTER) {
 958                 /*
 959                  * special case for PTY masters: only one open permitted,
 960                  * and the slave side open count is incremented as well.
 961                  */
 962                 if (tty->count) {
 963                         retval = -EIO;
 964                         goto end_init;
 965                 }
 966                 tty->link->count++;
 967         }
 968         tty->count++;
 969         tty->driver = driver; /* N.B. why do this every time?? */
 970
 971 success:
 972         *ret_tty = tty;
 973
 974         /* All paths come through here to release the semaphore */
 975 end_init:
 976         up(&tty_sem);
 977         return retval;
 978
 979         /* Release locally allocated memory ... nothing placed in slots */
 980 free_mem_out:
 981         if (o_tp)
 982                 kfree(o_tp);
 983         if (o_tty)
 984                 free_tty_struct(o_tty);
 985         if (ltp)
 986                 kfree(ltp);
 987         if (tp)
 988                 kfree(tp);
 989         free_tty_struct(tty);
 990
 991 fail_no_mem:
 992         module_put(driver->owner);
 993         retval = -ENOMEM;
 994         goto end_init;
 995
 996         /* call the tty release_mem routine to clean out this slot */
 997 release_mem_out:
 998         printk(KERN_INFO "init_dev: ldisc open failed, "
 999                          "clearing slot %d\n", idx);
1000         release_mem(tty, idx);
1001         goto end_init;
1002 }
1003
1004 /*
1005  * Releases memory associated with a tty structure, and clears out the
1006  * driver table slots.
1007  */
1008 static void release_mem(struct tty_struct *tty, int idx)
1009 {
1010         struct tty_struct *o_tty;
1011         struct termios *tp;
1012         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
1013
1014         if ((o_tty = tty->link) != NULL) {
1015                 if (!devpts)
1016                         o_tty->driver->ttys[idx] = NULL;
1017                 if (o_tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1018                         tp = o_tty->termios;
1019                         if (!devpts)
1020                                 o_tty->driver->termios[idx] = NULL;
1021                         kfree(tp);
1022
1023                         tp = o_tty->termios_locked;
1024                         if (!devpts)
1025                                 o_tty->driver->termios_locked[idx] = NULL;
1026                         kfree(tp);
1027                 }
1028                 o_tty->magic = 0;
1029                 o_tty->driver->refcount--;
1030                 file_list_lock();
1031                 list_del_init(&o_tty->tty_files);
1032                 file_list_unlock();
1033                 free_tty_struct(o_tty);
1034         }
1035
1036         if (!devpts)
1037                 tty->driver->ttys[idx] = NULL;
1038         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1039                 tp = tty->termios;
1040                 if (!devpts)
1041                         tty->driver->termios[idx] = NULL;
1042                 kfree(tp);
1043
1044                 tp = tty->termios_locked;
1045                 if (!devpts)
1046                         tty->driver->termios_locked[idx] = NULL;
1047                 kfree(tp);
1048         }
1049
1050         tty->magic = 0;
1051         tty->driver->refcount--;
1052         file_list_lock();
1053         list_del_init(&tty->tty_files);
1054         file_list_unlock();
1055         module_put(tty->driver->owner);
1056         free_tty_struct(tty);
1057 }
1058
1059 /*
1060  * Even releasing the tty structures is a tricky business.. We have
1061  * to be very careful that the structures are all released at the
1062  * same time, as interrupts might otherwise get the wrong pointers.
1063  *
1064  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1065  * lead to double frees or releasing memory still in use.
1066  */
1067 static void release_dev(struct file * filp)
1068 {
1069         struct tty_struct *tty, *o_tty;
1070         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1071         int     devpts_master;
1072         int     idx;
1073         char    buf[64];
1074
1075         tty = (struct tty_struct *)filp->private_data;
1076         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "release_dev"))
1077                 return;
1078
1079         check_tty_count(tty, "release_dev");
1080
1081         tty_fasync(-1, filp, 0);
1082
1083         idx = tty->index;
1084         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1085                       tty->driver->subtype == PTY_TYPE_MASTER);
1086         devpts_master = pty_master && (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM);
1087         o_tty = tty->link;
1088
1089 #ifdef TTY_PARANOIA_CHECK
1090         if (idx < 0 || idx >= tty->driver->num) {
1091                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
1092                                   "free (%s)\n", tty->name);
1093                 return;
1094         }
1095         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1096                 if (tty != tty->driver->ttys[idx]) {
1097                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
1098                                "for (%s)\n", idx, tty->name);
1099                         return;
1100                 }
1101                 if (tty->termios != tty->driver->termios[idx]) {
1102                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
1103                                "for (%s)\n",
1104                                idx, tty->name);
1105                         return;
1106                 }
1107                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
1108                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
1109                                "termios_locked for (%s)\n",
1110                                idx, tty->name);
1111                         return;
1112                 }
1113         }
1114 #endif
1115
1116 #ifdef TTY_DEBUG_HANGUP
1117         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
1118                tty_name(tty, buf), tty->count);
1119 #endif
1120
1121 #ifdef TTY_PARANOIA_CHECK
1122         if (tty->driver->other &&
1123              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1124                 if (o_tty != tty->driver->other->ttys[idx]) {
1125                         printk(KERN_DEBUG "release_dev: other->table[%d] "
1126                                           "not o_tty for (%s)\n",
1127                                idx, tty->name);
1128                         return;
1129                 }
1130                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1131                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
1132                                           "not o_termios for (%s)\n",
1133                                idx, tty->name);
1134                         return;
1135                 }
1136                 if (o_tty->termios_locked !=
1137                       tty->driver->other->termios_locked[idx]) {
1138                         printk(KERN_DEBUG "release_dev: other->termios_locked["
1139                                           "%d] not o_termios_locked for (%s)\n",
1140                                idx, tty->name);
1141                         return;
1142                 }
1143                 if (o_tty->link != tty) {
1144                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
1145                         return;
1146                 }
1147         }
1148 #endif
1149
1150         if (tty->driver->close)
1151                 tty->driver->close(tty, filp);
1152
1153         /*
1154          * Sanity check: if tty->count is going to zero, there shouldn't be
1155          * any waiters on tty->read_wait or tty->write_wait.  We test the
1156          * wait queues and kick everyone out _before_ actually starting to
1157          * close.  This ensures that we won't block while releasing the tty
1158          * structure.
1159          *
1160          * The test for the o_tty closing is necessary, since the master and
1161          * slave sides may close in any order.  If the slave side closes out
1162          * first, its count will be one, since the master side holds an open.
1163          * Thus this test wouldn't be triggered at the time the slave closes,
1164          * so we do it now.
1165          *
1166          * Note that it's possible for the tty to be opened again while we're
1167          * flushing out waiters.  By recalculating the closing flags before
1168          * each iteration we avoid any problems.
1169          */
1170         while (1) {
1171                 tty_closing = tty->count <= 1;
1172                 o_tty_closing = o_tty &&
1173                         (o_tty->count <= (pty_master ? 1 : 0));
1174                 do_sleep = 0;
1175
1176                 if (tty_closing) {
1177                         if (waitqueue_active(&tty->read_wait)) {
1178                                 wake_up(&tty->read_wait);
1179                                 do_sleep++;
1180                         }
1181                         if (waitqueue_active(&tty->write_wait)) {
1182                                 wake_up(&tty->write_wait);
1183                                 do_sleep++;
1184                         }
1185                 }
1186                 if (o_tty_closing) {
1187                         if (waitqueue_active(&o_tty->read_wait)) {
1188                                 wake_up(&o_tty->read_wait);
1189                                 do_sleep++;
1190                         }
1191                         if (waitqueue_active(&o_tty->write_wait)) {
1192                                 wake_up(&o_tty->write_wait);
1193                                 do_sleep++;
1194                         }
1195                 }
1196                 if (!do_sleep)
1197                         break;
1198
1199                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
1200                                     "active!\n", tty_name(tty, buf));
1201                 schedule();
1202         }
1203
1204         /*
1205          * The closing flags are now consistent with the open counts on
1206          * both sides, and we've completed the last operation that could
1207          * block, so it's safe to proceed with closing.
1208          */
1209         if (pty_master) {
1210                 if (--o_tty->count < 0) {
1211                         printk(KERN_WARNING "release_dev: bad pty slave count "
1212                                             "(%d) for %s\n",
1213                                o_tty->count, tty_name(o_tty, buf));
1214                         o_tty->count = 0;
1215                 }
1216         }
1217         if (--tty->count < 0) {
1218                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
1219                        tty->count, tty_name(tty, buf));
1220                 tty->count = 0;
1221         }
1222
1223         /*
1224          * We've decremented tty->count, so we need to remove this file
1225          * descriptor off the tty->tty_files list; this serves two
1226          * purposes:
1227          *  - check_tty_count sees the correct number of file descriptors
1228          *    associated with this tty.
1229          *  - do_tty_hangup no longer sees this file descriptor as
1230          *    something that needs to be handled for hangups.
1231          */
1232         file_kill(filp);
1233         filp->private_data = NULL;
1234
1235         /*
1236          * Perform some housekeeping before deciding whether to return.
1237          *
1238          * Set the TTY_CLOSING flag if this was the last open.  In the
1239          * case of a pty we may have to wait around for the other side
1240          * to close, and TTY_CLOSING makes sure we can't be reopened.
1241          */
1242         if(tty_closing)
1243                 set_bit(TTY_CLOSING, &tty->flags);
1244         if(o_tty_closing)
1245                 set_bit(TTY_CLOSING, &o_tty->flags);
1246
1247         /*
1248          * If _either_ side is closing, make sure there aren't any
1249          * processes that still think tty or o_tty is their controlling
1250          * tty.
1251          */
1252         if (tty_closing || o_tty_closing) {
1253                 struct task_struct *p;
1254                 struct list_head *l;
1255                 struct pid *pid;
1256
1257                 read_lock(&tasklist_lock);
1258                 for_each_task_pid(tty->session, PIDTYPE_SID, p, l, pid)
1259                         p->signal->tty = NULL;
1260                 if (o_tty)
1261                         for_each_task_pid(o_tty->session, PIDTYPE_SID, p,l, pid)
1262                                 p->signal->tty = NULL;
1263                 read_unlock(&tasklist_lock);
1264         }
1265
1266         /* check whether both sides are closing ... */
1267         if (!tty_closing || (o_tty && !o_tty_closing))
1268                 return;
1269
1270 #ifdef TTY_DEBUG_HANGUP
1271         printk(KERN_DEBUG "freeing tty structure...");
1272 #endif
1273
1274         /*
1275          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
1276          * kill any delayed work.
1277          */
1278         clear_bit(TTY_DONT_FLIP, &tty->flags);
1279         cancel_delayed_work(&tty->flip.work);
1280
1281         /*
1282          * Wait for ->hangup_work and ->flip.work handlers to terminate
1283          */
1284         flush_scheduled_work();
1285
1286         /*
1287          * Shutdown the current line discipline, and reset it to N_TTY.
1288          * N.B. why reset ldisc when we're releasing the memory??
1289          */
1290         if (tty->ldisc.close)
1291                 (tty->ldisc.close)(tty);
1292         module_put(tty->ldisc.owner);
1293
1294         tty->ldisc = ldiscs[N_TTY];
1295         tty->termios->c_line = N_TTY;
1296         if (o_tty) {
1297                 if (o_tty->ldisc.close)
1298                         (o_tty->ldisc.close)(o_tty);
1299                 module_put(o_tty->ldisc.owner);
1300                 o_tty->ldisc = ldiscs[N_TTY];
1301         }
1302
1303         /*
1304          * The release_mem function takes care of the details of clearing
1305          * the slots and preserving the termios structure.
1306          */
1307         release_mem(tty, idx);
1308
1309 #ifdef CONFIG_UNIX98_PTYS
1310         /* Make this pty number available for reallocation */
1311         if (devpts_master) {
1312                 down(&allocated_ptys_lock);
1313                 idr_remove(&allocated_ptys, idx);
1314                 up(&allocated_ptys_lock);
1315         }
1316 #endif
1317
1318 }
1319
1320 /*
1321  * tty_open and tty_release keep up the tty count that contains the
1322  * number of opens done on a tty. We cannot use the inode-count, as
1323  * different inodes might point to the same tty.
1324  *
1325  * Open-counting is needed for pty masters, as well as for keeping
1326  * track of serial lines: DTR is dropped when the last close happens.
1327  * (This is not done solely through tty->count, now.  - Ted 1/27/92)
1328  *
1329  * The termios state of a pty is reset on first open so that
1330  * settings don't persist across reuse.
1331  */
1332 static int tty_open(struct inode * inode, struct file * filp)
1333 {
1334         struct tty_struct *tty;
1335         int noctty, retval;
1336         struct tty_driver *driver;
1337         int index;
1338         dev_t device = inode->i_rdev;
1339         unsigned short saved_flags = filp->f_flags;
1340
1341 retry_open:
1342         noctty = filp->f_flags & O_NOCTTY;
1343         index  = -1;
1344         retval = 0;
1345
1346         if (device == MKDEV(TTYAUX_MAJOR,0)) {
1347                 if (!current->signal->tty)
1348                         return -ENXIO;
1349                 driver = current->signal->tty->driver;
1350                 index = current->signal->tty->index;
1351                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
1352                 /* noctty = 1; */
1353                 goto got_driver;
1354         }
1355 #ifdef CONFIG_VT
1356         if (device == MKDEV(TTY_MAJOR,0)) {
1357                 extern int fg_console;
1358                 extern struct tty_driver *console_driver;
1359                 driver = console_driver;
1360                 index = fg_console;
1361                 noctty = 1;
1362                 goto got_driver;
1363         }
1364 #endif
1365         if (device == MKDEV(TTYAUX_MAJOR,1)) {
1366                 driver = console_device(&index);
1367                 if (driver) {
1368                         /* Don't let /dev/console block */
1369                         filp->f_flags |= O_NONBLOCK;
1370                         noctty = 1;
1371                         goto got_driver;
1372                 }
1373                 return -ENODEV;
1374         }
1375
1376 #ifdef CONFIG_UNIX98_PTYS
1377         if (device == MKDEV(TTYAUX_MAJOR,2)) {
1378                 int idr_ret;
1379
1380                 /* find a device that is not in use. */
1381                 down(&allocated_ptys_lock);
1382                 if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
1383                         up(&allocated_ptys_lock);
1384                         return -ENOMEM;
1385                 }
1386                 idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
1387                 if (idr_ret < 0) {
1388                         up(&allocated_ptys_lock);
1389                         if (idr_ret == -EAGAIN)
1390                                 return -ENOMEM;
1391                         return -EIO;
1392                 }
1393                 if (index >= pty_limit) {
1394                         idr_remove(&allocated_ptys, index);
1395                         up(&allocated_ptys_lock);
1396                         return -EIO;
1397                 }
1398                 up(&allocated_ptys_lock);
1399
1400                 driver = ptm_driver;
1401                 retval = init_dev(driver, index, &tty);
1402                 if (retval) {
1403                         down(&allocated_ptys_lock);
1404                         idr_remove(&allocated_ptys, index);
1405                         up(&allocated_ptys_lock);
1406                         return retval;
1407                 }
1408
1409                 set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
1410                 if (devpts_pty_new(tty->link))
1411                         retval = -ENOMEM;
1412         } else
1413 #endif
1414         {
1415                 driver = get_tty_driver(device, &index);
1416                 if (!driver)
1417                         return -ENODEV;
1418 got_driver:
1419                 retval = init_dev(driver, index, &tty);
1420                 if (retval)
1421                         return retval;
1422         }
1423
1424         filp->private_data = tty;
1425         file_move(filp, &tty->tty_files);
1426         check_tty_count(tty, "tty_open");
1427         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1428             tty->driver->subtype == PTY_TYPE_MASTER)
1429                 noctty = 1;
1430 #ifdef TTY_DEBUG_HANGUP
1431         printk(KERN_DEBUG "opening %s...", tty->name);
1432 #endif
1433         if (!retval) {
1434                 if (tty->driver->open)
1435                         retval = tty->driver->open(tty, filp);
1436                 else
1437                         retval = -ENODEV;
1438         }
1439         filp->f_flags = saved_flags;
1440
1441         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
1442                 retval = -EBUSY;
1443
1444         if (retval) {
1445 #ifdef TTY_DEBUG_HANGUP
1446                 printk(KERN_DEBUG "error %d in opening %s...", retval,
1447                        tty->name);
1448 #endif
1449
1450 #ifdef CONFIG_UNIX98_PTYS
1451                 if (index != -1) {
1452                         down(&allocated_ptys_lock);
1453                         idr_remove(&allocated_ptys, index);
1454                         up(&allocated_ptys_lock);
1455                 }
1456 #endif
1457
1458                 release_dev(filp);
1459                 if (retval != -ERESTARTSYS)
1460                         return retval;
1461                 if (signal_pending(current))
1462                         return retval;
1463                 schedule();
1464                 /*
1465                  * Need to reset f_op in case a hangup happened.
1466                  */
1467                 if (filp->f_op == &hung_up_tty_fops)
1468                         filp->f_op = &tty_fops;
1469                 goto retry_open;
1470         }
1471         if (!noctty &&
1472             current->signal->leader &&
1473             !current->signal->tty &&
1474             tty->session == 0) {
1475                 task_lock(current);
1476                 current->signal->tty = tty;
1477                 task_unlock(current);
1478                 current->signal->tty_old_pgrp = 0;
1479                 tty->session = current->signal->session;
1480                 tty->pgrp = process_group(current);
1481         }
1482         return 0;
1483 }
1484
1485 static int tty_release(struct inode * inode, struct file * filp)
1486 {
1487         lock_kernel();
1488         release_dev(filp);
1489         unlock_kernel();
1490         return 0;
1491 }
1492
1493 /* No kernel lock held - fine */
1494 static unsigned int tty_poll(struct file * filp, poll_table * wait)
1495 {
1496         struct tty_struct * tty;
1497
1498         tty = (struct tty_struct *)filp->private_data;
1499         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_poll"))
1500                 return 0;
1501
1502         if (tty->ldisc.poll)
1503                 return (tty->ldisc.poll)(tty, filp, wait);
1504         return 0;
1505 }
1506
1507 static int tty_fasync(int fd, struct file * filp, int on)
1508 {
1509         struct tty_struct * tty;
1510         int retval;
1511
1512         tty = (struct tty_struct *)filp->private_data;
1513         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_fasync"))
1514                 return 0;
1515
1516         retval = fasync_helper(fd, filp, on, &tty->fasync);
1517         if (retval <= 0)
1518                 return retval;
1519
1520         if (on) {
1521                 if (!waitqueue_active(&tty->read_wait))
1522                         tty->minimum_to_wake = 1;
1523                 retval = f_setown(filp, (-tty->pgrp) ? : current->pid, 0);
1524                 if (retval)
1525                         return retval;
1526         } else {
1527                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
1528                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
1529         }
1530         return 0;
1531 }
1532
1533 static int tiocsti(struct tty_struct *tty, char __user *p)
1534 {
1535         char ch, mbz = 0;
1536
1537         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
1538                 return -EPERM;
1539         if (get_user(ch, p))
1540                 return -EFAULT;
1541         tty->ldisc.receive_buf(tty, &ch, &mbz, 1);
1542         return 0;
1543 }
1544
1545 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
1546 {
1547         if (copy_to_user(arg, &tty->winsize, sizeof(*arg)))
1548                 return -EFAULT;
1549         return 0;
1550 }
1551
1552 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
1553         struct winsize __user * arg)
1554 {
1555         struct winsize tmp_ws;
1556
1557         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
1558                 return -EFAULT;
1559         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
1560                 return 0;
1561 #ifdef CONFIG_VT
1562         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
1563                 unsigned int currcons = tty->index;
1564                 int rc;
1565
1566                 acquire_console_sem();
1567                 rc = vc_resize(currcons, tmp_ws.ws_col, tmp_ws.ws_row);
1568                 release_console_sem();
1569                 if (rc)
1570                         return -ENXIO;
1571         }
1572 #endif
1573         if (tty->pgrp > 0)
1574                 kill_pg(tty->pgrp, SIGWINCH, 1);
1575         if ((real_tty->pgrp != tty->pgrp) && (real_tty->pgrp > 0))
1576                 kill_pg(real_tty->pgrp, SIGWINCH, 1);
1577         tty->winsize = tmp_ws;
1578         real_tty->winsize = tmp_ws;
1579         return 0;
1580 }
1581
1582 static int tioccons(struct file *file)
1583 {
1584         if (file->f_op->write == redirected_tty_write) {
1585                 struct file *f;
1586                 if (!capable(CAP_SYS_ADMIN))
1587                         return -EPERM;
1588                 spin_lock(&redirect_lock);
1589                 f = redirect;
1590                 redirect = NULL;
1591                 spin_unlock(&redirect_lock);
1592                 if (f)
1593                         fput(f);
1594                 return 0;
1595         }
1596         spin_lock(&redirect_lock);
1597         if (redirect) {
1598                 spin_unlock(&redirect_lock);
1599                 return -EBUSY;
1600         }
1601         get_file(file);
1602         redirect = file;
1603         spin_unlock(&redirect_lock);
1604         return 0;
1605 }
1606
1607
1608 static int fionbio(struct file *file, int __user *p)
1609 {
1610         int nonblock;
1611
1612         if (get_user(nonblock, p))
1613                 return -EFAULT;
1614
1615         if (nonblock)
1616                 file->f_flags |= O_NONBLOCK;
1617         else
1618                 file->f_flags &= ~O_NONBLOCK;
1619         return 0;
1620 }
1621
1622 static int tiocsctty(struct tty_struct *tty, int arg)
1623 {
1624         struct list_head *l;
1625         struct pid *pid;
1626         task_t *p;
1627
1628         if (current->signal->leader &&
1629             (current->signal->session == tty->session))
1630                 return 0;
1631         /*
1632          * The process must be a session leader and
1633          * not have a controlling tty already.
1634          */
1635         if (!current->signal->leader || current->signal->tty)
1636                 return -EPERM;
1637         if (tty->session > 0) {
1638                 /*
1639                  * This tty is already the controlling
1640                  * tty for another session group!
1641                  */
1642                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
1643                         /*
1644                          * Steal it away
1645                          */
1646
1647                         read_lock(&tasklist_lock);
1648                         for_each_task_pid(tty->session, PIDTYPE_SID, p, l, pid)
1649                                 p->signal->tty = NULL;
1650                         read_unlock(&tasklist_lock);
1651                 } else
1652                         return -EPERM;
1653         }
1654         task_lock(current);
1655         current->signal->tty = tty;
1656         task_unlock(current);
1657         current->signal->tty_old_pgrp = 0;
1658         tty->session = current->signal->session;
1659         tty->pgrp = process_group(current);
1660         return 0;
1661 }
1662
1663 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
1664 {
1665         /*
1666          * (tty == real_tty) is a cheap way of
1667          * testing if the tty is NOT a master pty.
1668          */
1669         if (tty == real_tty && current->signal->tty != real_tty)
1670                 return -ENOTTY;
1671         return put_user(real_tty->pgrp, p);
1672 }
1673
1674 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
1675 {
1676         pid_t pgrp;
1677         int retval = tty_check_change(real_tty);
1678
1679         if (retval == -EIO)
1680                 return -ENOTTY;
1681         if (retval)
1682                 return retval;
1683         if (!current->signal->tty ||
1684             (current->signal->tty != real_tty) ||
1685             (real_tty->session != current->signal->session))
1686                 return -ENOTTY;
1687         if (get_user(pgrp, p))
1688                 return -EFAULT;
1689         if (pgrp < 0)
1690                 return -EINVAL;
1691         if (session_of_pgrp(pgrp) != current->signal->session)
1692                 return -EPERM;
1693         real_tty->pgrp = pgrp;
1694         return 0;
1695 }
1696
1697 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
1698 {
1699         /*
1700          * (tty == real_tty) is a cheap way of
1701          * testing if the tty is NOT a master pty.
1702         */
1703         if (tty == real_tty && current->signal->tty != real_tty)
1704                 return -ENOTTY;
1705         if (real_tty->session <= 0)
1706                 return -ENOTTY;
1707         return put_user(real_tty->session, p);
1708 }
1709
1710 static int tiocsetd(struct tty_struct *tty, int __user *p)
1711 {
1712         int ldisc;
1713
1714         if (get_user(ldisc, p))
1715                 return -EFAULT;
1716         return tty_set_ldisc(tty, ldisc);
1717 }
1718
1719 static int send_break(struct tty_struct *tty, int duration)
1720 {
1721         set_current_state(TASK_INTERRUPTIBLE);
1722
1723         tty->driver->break_ctl(tty, -1);
1724         if (!signal_pending(current))
1725                 schedule_timeout(duration);
1726         tty->driver->break_ctl(tty, 0);
1727         if (signal_pending(current))
1728                 return -EINTR;
1729         return 0;
1730 }
1731
1732 static int
1733 tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
1734 {
1735         int retval = -EINVAL;
1736
1737         if (tty->driver->tiocmget) {
1738                 retval = tty->driver->tiocmget(tty, file);
1739
1740                 if (retval >= 0)
1741                         retval = put_user(retval, p);
1742         }
1743         return retval;
1744 }
1745
1746 static int
1747 tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
1748              unsigned __user *p)
1749 {
1750         int retval = -EINVAL;
1751
1752         if (tty->driver->tiocmset) {
1753                 unsigned int set, clear, val;
1754
1755                 retval = get_user(val, p);
1756                 if (retval)
1757                         return retval;
1758
1759                 set = clear = 0;
1760                 switch (cmd) {
1761                 case TIOCMBIS:
1762                         set = val;
1763                         break;
1764                 case TIOCMBIC:
1765                         clear = val;
1766                         break;
1767                 case TIOCMSET:
1768                         set = val;
1769                         clear = ~val;
1770                         break;
1771                 }
1772
1773                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
1774                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
1775
1776                 retval = tty->driver->tiocmset(tty, file, set, clear);
1777         }
1778         return retval;
1779 }
1780
1781 /*
1782  * Split this up, as gcc can choke on it otherwise..
1783  */
1784 int tty_ioctl(struct inode * inode, struct file * file,
1785               unsigned int cmd, unsigned long arg)
1786 {
1787         struct tty_struct *tty, *real_tty;
1788         void __user *p = (void __user *)arg;
1789         int retval;
1790
1791         tty = (struct tty_struct *)file->private_data;
1792         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
1793                 return -EINVAL;
1794
1795         real_tty = tty;
1796         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1797             tty->driver->subtype == PTY_TYPE_MASTER)
1798                 real_tty = tty->link;
1799
1800         /*
1801          * Break handling by driver
1802          */
1803         if (!tty->driver->break_ctl) {
1804                 switch(cmd) {
1805                 case TIOCSBRK:
1806                 case TIOCCBRK:
1807                         if (tty->driver->ioctl)
1808                                 return tty->driver->ioctl(tty, file, cmd, arg);
1809                         return -EINVAL;
1810
1811                 /* These two ioctl's always return success; even if */
1812                 /* the driver doesn't support them. */
1813                 case TCSBRK:
1814                 case TCSBRKP:
1815                         if (!tty->driver->ioctl)
1816                                 return 0;
1817                         retval = tty->driver->ioctl(tty, file, cmd, arg);
1818                         if (retval == -ENOIOCTLCMD)
1819                                 retval = 0;
1820                         return retval;
1821                 }
1822         }
1823
1824         /*
1825          * Factor out some common prep work
1826          */
1827         switch (cmd) {
1828         case TIOCSETD:
1829         case TIOCSBRK:
1830         case TIOCCBRK:
1831         case TCSBRK:
1832         case TCSBRKP:
1833                 retval = tty_check_change(tty);
1834                 if (retval)
1835                         return retval;
1836                 if (cmd != TIOCCBRK) {
1837                         tty_wait_until_sent(tty, 0);
1838                         if (signal_pending(current))
1839                                 return -EINTR;
1840                 }
1841                 break;
1842         }
1843
1844         switch (cmd) {
1845                 case TIOCSTI:
1846                         return tiocsti(tty, p);
1847                 case TIOCGWINSZ:
1848                         return tiocgwinsz(tty, p);
1849                 case TIOCSWINSZ:
1850                         return tiocswinsz(tty, real_tty, p);
1851                 case TIOCCONS:
1852                         return real_tty!=tty ? -EINVAL : tioccons(file);
1853                 case FIONBIO:
1854                         return fionbio(file, p);
1855                 case TIOCEXCL:
1856                         set_bit(TTY_EXCLUSIVE, &tty->flags);
1857                         return 0;
1858                 case TIOCNXCL:
1859                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
1860                         return 0;
1861                 case TIOCNOTTY:
1862                         if (current->signal->tty != tty)
1863                                 return -ENOTTY;
1864                         if (current->signal->leader)
1865                                 disassociate_ctty(0);
1866                         task_lock(current);
1867                         current->signal->tty = NULL;
1868                         task_unlock(current);
1869                         return 0;
1870                 case TIOCSCTTY:
1871                         return tiocsctty(tty, arg);
1872                 case TIOCGPGRP:
1873                         return tiocgpgrp(tty, real_tty, p);
1874                 case TIOCSPGRP:
1875                         return tiocspgrp(tty, real_tty, p);
1876                 case TIOCGSID:
1877                         return tiocgsid(tty, real_tty, p);
1878                 case TIOCGETD:
1879                         return put_user(tty->ldisc.num, (int __user *)p);
1880                 case TIOCSETD:
1881                         return tiocsetd(tty, p);
1882 #ifdef CONFIG_VT
1883                 case TIOCLINUX:
1884                         return tioclinux(tty, arg);
1885 #endif
1886                 /*
1887                  * Break handling
1888                  */
1889                 case TIOCSBRK:  /* Turn break on, unconditionally */
1890                         tty->driver->break_ctl(tty, -1);
1891                         return 0;
1892
1893                 case TIOCCBRK:  /* Turn break off, unconditionally */
1894                         tty->driver->break_ctl(tty, 0);
1895                         return 0;
1896                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
1897                         /*
1898                          * XXX is the above comment correct, or the
1899                          * code below correct?  Is this ioctl used at
1900                          * all by anyone?
1901                          */
1902                         if (!arg)
1903                                 return send_break(tty, HZ/4);
1904                         return 0;
1905                 case TCSBRKP:   /* support for POSIX tcsendbreak() */
1906                         return send_break(tty, arg ? arg*(HZ/10) : HZ/4);
1907
1908                 case TIOCMGET:
1909                         return tty_tiocmget(tty, file, p);
1910
1911                 case TIOCMSET:
1912                 case TIOCMBIC:
1913                 case TIOCMBIS:
1914                         return tty_tiocmset(tty, file, cmd, p);
1915         }
1916         if (tty->driver->ioctl) {
1917                 int retval = (tty->driver->ioctl)(tty, file, cmd, arg);
1918                 if (retval != -ENOIOCTLCMD)
1919                         return retval;
1920         }
1921         if (tty->ldisc.ioctl) {
1922                 int retval = (tty->ldisc.ioctl)(tty, file, cmd, arg);
1923                 if (retval != -ENOIOCTLCMD)
1924                         return retval;
1925         }
1926         return -EINVAL;
1927 }
1928
1929
1930 /*
1931  * This implements the "Secure Attention Key" ---  the idea is to
1932  * prevent trojan horses by killing all processes associated with this
1933  * tty when the user hits the "Secure Attention Key".  Required for
1934  * super-paranoid applications --- see the Orange Book for more details.
1935  *
1936  * This code could be nicer; ideally it should send a HUP, wait a few
1937  * seconds, then send a INT, and then a KILL signal.  But you then
1938  * have to coordinate with the init process, since all processes associated
1939  * with the current tty must be dead before the new getty is allowed
1940  * to spawn.
1941  *
1942  * Now, if it would be correct ;-/ The current code has a nasty hole -
1943  * it doesn't catch files in flight. We may send the descriptor to ourselves
1944  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
1945  *
1946  * Nasty bug: do_SAK is being called in interrupt context.  This can
1947  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
1948  */
1949 static void __do_SAK(void *arg)
1950 {
1951 #ifdef TTY_SOFT_SAK
1952         tty_hangup(tty);
1953 #else
1954         struct tty_struct *tty = arg;
1955         struct task_struct *p;
1956         struct list_head *l;
1957         struct pid *pid;
1958         int session;
1959         int             i;
1960         struct file     *filp;
1961
1962         if (!tty)
1963                 return;
1964         session  = tty->session;
1965         if (tty->ldisc.flush_buffer)
1966                 tty->ldisc.flush_buffer(tty);
1967         if (tty->driver->flush_buffer)
1968                 tty->driver->flush_buffer(tty);
1969         read_lock(&tasklist_lock);
1970         for_each_task_pid(session, PIDTYPE_SID, p, l, pid) {
1971                 if (p->signal->tty == tty || session > 0) {
1972                         printk(KERN_NOTICE "SAK: killed process %d"
1973                             " (%s): p->signal->session==tty->session\n",
1974                             p->pid, p->comm);
1975                         send_sig(SIGKILL, p, 1);
1976                         continue;
1977                 }
1978                 task_lock(p);
1979                 if (p->files) {
1980                         spin_lock(&p->files->file_lock);
1981                         for (i=0; i < p->files->max_fds; i++) {
1982                                 filp = fcheck_files(p->files, i);
1983                                 if (!filp)
1984                                         continue;
1985                                 if (filp->f_op->read == tty_read &&
1986                                     filp->private_data == tty) {
1987                                         printk(KERN_NOTICE "SAK: killed process %d"
1988                                             " (%s): fd#%d opened to the tty\n",
1989                                             p->pid, p->comm, i);
1990                                         send_sig(SIGKILL, p, 1);
1991                                         break;
1992                                 }
1993                         }
1994                         spin_unlock(&p->files->file_lock);
1995                 }
1996                 task_unlock(p);
1997         }
1998         read_unlock(&tasklist_lock);
1999 #endif
2000 }
2001
2002 /*
2003  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2004  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2005  * the values which we write to it will be identical to the values which it
2006  * already has. --akpm
2007  */
2008 void do_SAK(struct tty_struct *tty)
2009 {
2010         if (!tty)
2011                 return;
2012         PREPARE_WORK(&tty->SAK_work, __do_SAK, tty);
2013         schedule_work(&tty->SAK_work);
2014 }
2015
2016 EXPORT_SYMBOL(do_SAK);
2017
2018 /*
2019  * This routine is called out of the software interrupt to flush data
2020  * from the flip buffer to the line discipline.
2021  */
2022 static void flush_to_ldisc(void *private_)
2023 {
2024         struct tty_struct *tty = (struct tty_struct *) private_;
2025         unsigned char   *cp;
2026         char            *fp;
2027         int             count;
2028         unsigned long flags;
2029
2030         if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
2031                 /*
2032                  * Do it after the next timer tick:
2033                  */
2034                 schedule_delayed_work(&tty->flip.work, 1);
2035                 return;
2036         }
2037
2038         spin_lock_irqsave(&tty->read_lock, flags);
2039         if (tty->flip.buf_num) {
2040                 cp = tty->flip.char_buf + TTY_FLIPBUF_SIZE;
2041                 fp = tty->flip.flag_buf + TTY_FLIPBUF_SIZE;
2042                 tty->flip.buf_num = 0;
2043                 tty->flip.char_buf_ptr = tty->flip.char_buf;
2044                 tty->flip.flag_buf_ptr = tty->flip.flag_buf;
2045         } else {
2046                 cp = tty->flip.char_buf;
2047                 fp = tty->flip.flag_buf;
2048                 tty->flip.buf_num = 1;
2049                 tty->flip.char_buf_ptr = tty->flip.char_buf + TTY_FLIPBUF_SIZE;
2050                 tty->flip.flag_buf_ptr = tty->flip.flag_buf + TTY_FLIPBUF_SIZE;
2051         }
2052         count = tty->flip.count;
2053         tty->flip.count = 0;
2054         spin_unlock_irqrestore(&tty->read_lock, flags);
2055
2056         tty->ldisc.receive_buf(tty, cp, fp, count);
2057 }
2058
2059 /*
2060  * Routine which returns the baud rate of the tty
2061  *
2062  * Note that the baud_table needs to be kept in sync with the
2063  * include/asm/termbits.h file.
2064  */
2065 static int baud_table[] = {
2066         0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
2067         9600, 19200, 38400, 57600, 115200, 230400, 460800,
2068 #ifdef __sparc__
2069         76800, 153600, 307200, 614400, 921600
2070 #else
2071         500000, 576000, 921600, 1000000, 1152000, 1500000, 2000000,
2072         2500000, 3000000, 3500000, 4000000
2073 #endif
2074 };
2075
2076 static int n_baud_table = ARRAY_SIZE(baud_table);
2077
2078 int tty_termios_baud_rate(struct termios *termios)
2079 {
2080         unsigned int cbaud = termios->c_cflag & CBAUD;
2081
2082         if (cbaud & CBAUDEX) {
2083                 cbaud &= ~CBAUDEX;
2084
2085                 if (cbaud < 1 || cbaud + 15 > n_baud_table)
2086                         termios->c_cflag &= ~CBAUDEX;
2087                 else
2088                         cbaud += 15;
2089         }
2090
2091         return baud_table[cbaud];
2092 }
2093
2094 EXPORT_SYMBOL(tty_termios_baud_rate);
2095
2096 int tty_get_baud_rate(struct tty_struct *tty)
2097 {
2098         int baud = tty_termios_baud_rate(tty->termios);
2099
2100         if (baud == 38400 && tty->alt_speed) {
2101                 if (!tty->warned) {
2102                         printk(KERN_WARNING "Use of setserial/setrocket to "
2103                                             "set SPD_* flags is deprecated\n");
2104                         tty->warned = 1;
2105                 }
2106                 baud = tty->alt_speed;
2107         }
2108
2109         return baud;
2110 }
2111
2112 EXPORT_SYMBOL(tty_get_baud_rate);
2113
2114 void tty_flip_buffer_push(struct tty_struct *tty)
2115 {
2116         if (tty->low_latency)
2117                 flush_to_ldisc((void *) tty);
2118         else
2119                 schedule_delayed_work(&tty->flip.work, 1);
2120 }
2121
2122 EXPORT_SYMBOL(tty_flip_buffer_push);
2123
2124 /*
2125  * This subroutine initializes a tty structure.
2126  */
2127 static void initialize_tty_struct(struct tty_struct *tty)
2128 {
2129         memset(tty, 0, sizeof(struct tty_struct));
2130         tty->magic = TTY_MAGIC;
2131         tty->ldisc = ldiscs[N_TTY];
2132         tty->pgrp = -1;
2133         tty->flip.char_buf_ptr = tty->flip.char_buf;
2134         tty->flip.flag_buf_ptr = tty->flip.flag_buf;
2135         INIT_WORK(&tty->flip.work, flush_to_ldisc, tty);
2136         init_MUTEX(&tty->flip.pty_sem);
2137         init_waitqueue_head(&tty->write_wait);
2138         init_waitqueue_head(&tty->read_wait);
2139         INIT_WORK(&tty->hangup_work, do_tty_hangup, tty);
2140         sema_init(&tty->atomic_read, 1);
2141         sema_init(&tty->atomic_write, 1);
2142         spin_lock_init(&tty->read_lock);
2143         INIT_LIST_HEAD(&tty->tty_files);
2144         INIT_WORK(&tty->SAK_work, NULL, NULL);
2145 }
2146
2147 /*
2148  * The default put_char routine if the driver did not define one.
2149  */
2150 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
2151 {
2152         tty->driver->write(tty, 0, &ch, 1);
2153 }
2154
2155 static struct class_simple *tty_class;
2156
2157 /**
2158  * tty_register_device - register a tty device
2159  * @driver: the tty driver that describes the tty device
2160  * @index: the index in the tty driver for this tty device
2161  * @device: a struct device that is associated with this tty device.
2162  *      This field is optional, if there is no known struct device for this
2163  *      tty device it can be set to NULL safely.
2164  *
2165  * This call is required to be made to register an individual tty device if
2166  * the tty driver's flags have the TTY_DRIVER_NO_DEVFS bit set.  If that
2167  * bit is not set, this function should not be called.
2168  */
2169 void tty_register_device(struct tty_driver *driver, unsigned index,
2170                          struct device *device)
2171 {
2172         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
2173
2174         if (index >= driver->num) {
2175                 printk(KERN_ERR "Attempt to register invalid tty line number "
2176                        " (%d).\n", index);
2177                 return;
2178         }
2179
2180         devfs_mk_cdev(dev, S_IFCHR | S_IRUSR | S_IWUSR,
2181                         "%s%d", driver->devfs_name, index + driver->name_base);
2182
2183         /* we don't care about the ptys */
2184         /* how nice to hide this behind some crappy interface.. */
2185         if (driver->type != TTY_DRIVER_TYPE_PTY) {
2186                 char name[64];
2187                 tty_line_name(driver, index, name);
2188                 class_simple_device_add(tty_class, dev, device, name);
2189         }
2190 }
2191
2192 /**
2193  * tty_unregister_device - unregister a tty device
2194  * @driver: the tty driver that describes the tty device
2195  * @index: the index in the tty driver for this tty device
2196  *
2197  * If a tty device is registered with a call to tty_register_device() then
2198  * this function must be made when the tty device is gone.
2199  */
2200 void tty_unregister_device(struct tty_driver *driver, unsigned index)
2201 {
2202         devfs_remove("%s%d", driver->devfs_name, index + driver->name_base);
2203         class_simple_device_remove(MKDEV(driver->major, driver->minor_start) + index);
2204 }
2205
2206 EXPORT_SYMBOL(tty_register_device);
2207 EXPORT_SYMBOL(tty_unregister_device);
2208
2209 struct tty_driver *alloc_tty_driver(int lines)
2210 {
2211         struct tty_driver *driver;
2212
2213         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
2214         if (driver) {
2215                 memset(driver, 0, sizeof(struct tty_driver));
2216                 driver->magic = TTY_DRIVER_MAGIC;
2217                 driver->num = lines;
2218                 /* later we'll move allocation of tables here */
2219         }
2220         return driver;
2221 }
2222
2223 void put_tty_driver(struct tty_driver *driver)
2224 {
2225         kfree(driver);
2226 }
2227
2228 void tty_set_operations(struct tty_driver *driver, struct tty_operations *op)
2229 {
2230         driver->open = op->open;
2231         driver->close = op->close;
2232         driver->write = op->write;
2233         driver->put_char = op->put_char;
2234         driver->flush_chars = op->flush_chars;
2235         driver->write_room = op->write_room;
2236         driver->chars_in_buffer = op->chars_in_buffer;
2237         driver->ioctl = op->ioctl;
2238         driver->set_termios = op->set_termios;
2239         driver->throttle = op->throttle;
2240         driver->unthrottle = op->unthrottle;
2241         driver->stop = op->stop;
2242         driver->start = op->start;
2243         driver->hangup = op->hangup;
2244         driver->break_ctl = op->break_ctl;
2245         driver->flush_buffer = op->flush_buffer;
2246         driver->set_ldisc = op->set_ldisc;
2247         driver->wait_until_sent = op->wait_until_sent;
2248         driver->send_xchar = op->send_xchar;
2249         driver->read_proc = op->read_proc;
2250         driver->write_proc = op->write_proc;
2251         driver->tiocmget = op->tiocmget;
2252         driver->tiocmset = op->tiocmset;
2253 }
2254
2255
2256 EXPORT_SYMBOL(alloc_tty_driver);
2257 EXPORT_SYMBOL(put_tty_driver);
2258 EXPORT_SYMBOL(tty_set_operations);
2259
2260 /*
2261  * Called by a tty driver to register itself.
2262  */
2263 int tty_register_driver(struct tty_driver *driver)
2264 {
2265         int error;
2266         int i;
2267         dev_t dev;
2268         void **p = NULL;
2269
2270         if (driver->flags & TTY_DRIVER_INSTALLED)
2271                 return 0;
2272
2273         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2274                 p = kmalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
2275                 if (!p)
2276                         return -ENOMEM;
2277                 memset(p, 0, driver->num * 3 * sizeof(void *));
2278         }
2279
2280         if (!driver->major) {
2281                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
2282                                                 (char*)driver->name);
2283                 if (!error) {
2284                         driver->major = MAJOR(dev);
2285                         driver->minor_start = MINOR(dev);
2286                 }
2287         } else {
2288                 dev = MKDEV(driver->major, driver->minor_start);
2289                 error = register_chrdev_region(dev, driver->num,
2290                                                 (char*)driver->name);
2291         }
2292         if (error < 0) {
2293                 kfree(p);
2294                 return error;
2295         }
2296
2297         if (p) {
2298                 driver->ttys = (struct tty_struct **)p;
2299                 driver->termios = (struct termios **)(p + driver->num);
2300                 driver->termios_locked = (struct termios **)(p + driver->num * 2);
2301         } else {
2302                 driver->ttys = NULL;
2303                 driver->termios = NULL;
2304                 driver->termios_locked = NULL;
2305         }
2306
2307         cdev_init(&driver->cdev, &tty_fops);
2308         driver->cdev.owner = driver->owner;
2309         error = cdev_add(&driver->cdev, dev, driver->num);
2310         if (error) {
2311                 cdev_del(&driver->cdev);
2312                 unregister_chrdev_region(dev, driver->num);
2313                 driver->ttys = NULL;
2314                 driver->termios = driver->termios_locked = NULL;
2315                 kfree(p);
2316                 return error;
2317         }
2318
2319         if (!driver->put_char)
2320                 driver->put_char = tty_default_put_char;
2321
2322         list_add(&driver->tty_drivers, &tty_drivers);
2323
2324         if ( !(driver->flags & TTY_DRIVER_NO_DEVFS) ) {
2325                 for(i = 0; i < driver->num; i++)
2326                     tty_register_device(driver, i, NULL);
2327         }
2328         proc_tty_register_driver(driver);
2329         return 0;
2330 }
2331
2332 EXPORT_SYMBOL(tty_register_driver);
2333
2334 /*
2335  * Called by a tty driver to unregister itself.
2336  */
2337 int tty_unregister_driver(struct tty_driver *driver)
2338 {
2339         int i;
2340         struct termios *tp;
2341         void *p;
2342
2343         if (driver->refcount)
2344                 return -EBUSY;
2345
2346         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
2347                                 driver->num);
2348
2349         list_del(&driver->tty_drivers);
2350
2351         /*
2352          * Free the termios and termios_locked structures because
2353          * we don't want to get memory leaks when modular tty
2354          * drivers are removed from the kernel.
2355          */
2356         for (i = 0; i < driver->num; i++) {
2357                 tp = driver->termios[i];
2358                 if (tp) {
2359                         driver->termios[i] = NULL;
2360                         kfree(tp);
2361                 }
2362                 tp = driver->termios_locked[i];
2363                 if (tp) {
2364                         driver->termios_locked[i] = NULL;
2365                         kfree(tp);
2366                 }
2367                 if (!(driver->flags & TTY_DRIVER_NO_DEVFS))
2368                         tty_unregister_device(driver, i);
2369         }
2370         p = driver->ttys;
2371         proc_tty_unregister_driver(driver);
2372         driver->ttys = NULL;
2373         driver->termios = driver->termios_locked = NULL;
2374         kfree(p);
2375         cdev_del(&driver->cdev);
2376         return 0;
2377 }
2378
2379 EXPORT_SYMBOL(tty_unregister_driver);
2380
2381
2382 /*
2383  * Initialize the console device. This is called *early*, so
2384  * we can't necessarily depend on lots of kernel help here.
2385  * Just do some early initializations, and do the complex setup
2386  * later.
2387  */
2388 void __init console_init(void)
2389 {
2390         initcall_t *call;
2391
2392         /* Setup the default TTY line discipline. */
2393         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
2394
2395         /*
2396          * set up the console device so that later boot sequences can
2397          * inform about problems etc..
2398          */
2399 #ifdef CONFIG_EARLY_PRINTK
2400         disable_early_printk();
2401 #endif
2402 #ifdef CONFIG_SERIAL_68360
2403         /* This is not a console initcall. I know not what it's doing here.
2404            So I haven't moved it. dwmw2 */
2405         rs_360_init();
2406 #endif
2407         call = &__con_initcall_start;
2408         while (call < &__con_initcall_end) {
2409                 (*call)();
2410                 call++;
2411         }
2412 }
2413
2414 #ifdef CONFIG_VT
2415 extern int vty_init(void);
2416 #endif
2417
2418 static int __init tty_class_init(void)
2419 {
2420         tty_class = class_simple_create(THIS_MODULE, "tty");
2421         if (IS_ERR(tty_class))
2422                 return PTR_ERR(tty_class);
2423         return 0;
2424 }
2425
2426 postcore_initcall(tty_class_init);
2427
2428 /* 3/2004 jmc: why do these devices exist? */
2429
2430 static struct cdev tty_cdev, console_cdev;
2431 #ifdef CONFIG_UNIX98_PTYS
2432 static struct cdev ptmx_cdev;
2433 #endif
2434 #ifdef CONFIG_VT
2435 static struct cdev vc0_cdev;
2436 #endif
2437
2438 /*
2439  * Ok, now we can initialize the rest of the tty devices and can count
2440  * on memory allocations, interrupts etc..
2441  */
2442 static int __init tty_init(void)
2443 {
2444         cdev_init(&tty_cdev, &tty_fops);
2445         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
2446             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
2447                 panic("Couldn't register /dev/tty driver\n");
2448         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 0), S_IFCHR|S_IRUGO|S_IWUGO, "tty");
2449         class_simple_device_add(tty_class, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
2450
2451         cdev_init(&console_cdev, &console_fops);
2452         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
2453             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
2454                 panic("Couldn't register /dev/console driver\n");
2455         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 1), S_IFCHR|S_IRUSR|S_IWUSR, "console");
2456         class_simple_device_add(tty_class, MKDEV(TTYAUX_MAJOR, 1), NULL, "console");
2457
2458 #ifdef CONFIG_UNIX98_PTYS
2459         cdev_init(&ptmx_cdev, &tty_fops);
2460         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
2461             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
2462                 panic("Couldn't register /dev/ptmx driver\n");
2463         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 2), S_IFCHR|S_IRUGO|S_IWUGO, "ptmx");
2464         class_simple_device_add(tty_class, MKDEV(TTYAUX_MAJOR, 2), NULL, "ptmx");
2465 #endif
2466
2467 #ifdef CONFIG_VT
2468         cdev_init(&vc0_cdev, &console_fops);
2469         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
2470             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
2471                 panic("Couldn't register /dev/tty0 driver\n");
2472         devfs_mk_cdev(MKDEV(TTY_MAJOR, 0), S_IFCHR|S_IRUSR|S_IWUSR, "vc/0");
2473         class_simple_device_add(tty_class, MKDEV(TTY_MAJOR, 0), NULL, "tty0");
2474
2475         vty_init();
2476 #endif
2477         return 0;
2478 }
2479 module_init(tty_init);