tty: simplify calling of put_pid.
[linux-2.6.git] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/types.h>
69 #include <linux/major.h>
70 #include <linux/errno.h>
71 #include <linux/signal.h>
72 #include <linux/fcntl.h>
73 #include <linux/sched.h>
74 #include <linux/interrupt.h>
75 #include <linux/tty.h>
76 #include <linux/tty_driver.h>
77 #include <linux/tty_flip.h>
78 #include <linux/devpts_fs.h>
79 #include <linux/file.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/smp_lock.h>
92 #include <linux/device.h>
93 #include <linux/idr.h>
94 #include <linux/wait.h>
95 #include <linux/bitops.h>
96 #include <linux/delay.h>
97
98 #include <asm/uaccess.h>
99 #include <asm/system.h>
100
101 #include <linux/kbd_kern.h>
102 #include <linux/vt_kern.h>
103 #include <linux/selection.h>
104
105 #include <linux/kmod.h>
106
107 #undef TTY_DEBUG_HANGUP
108
109 #define TTY_PARANOIA_CHECK 1
110 #define CHECK_TTY_COUNT 1
111
112 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
113         .c_iflag = ICRNL | IXON,
114         .c_oflag = OPOST | ONLCR,
115         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
116         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
117                    ECHOCTL | ECHOKE | IEXTEN,
118         .c_cc = INIT_C_CC,
119         .c_ispeed = 38400,
120         .c_ospeed = 38400
121 };
122
123 EXPORT_SYMBOL(tty_std_termios);
124
125 /* This list gets poked at by procfs and various bits of boot up code. This
126    could do with some rationalisation such as pulling the tty proc function
127    into this file */
128    
129 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
130
131 /* Mutex to protect creating and releasing a tty. This is shared with
132    vt.c for deeply disgusting hack reasons */
133 DEFINE_MUTEX(tty_mutex);
134 EXPORT_SYMBOL(tty_mutex);
135
136 #ifdef CONFIG_UNIX98_PTYS
137 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
138 extern int pty_limit;           /* Config limit on Unix98 ptys */
139 static DEFINE_IDR(allocated_ptys);
140 static DECLARE_MUTEX(allocated_ptys_lock);
141 static int ptmx_open(struct inode *, struct file *);
142 #endif
143
144 static void initialize_tty_struct(struct tty_struct *tty);
145
146 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
147 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
148 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
149 static unsigned int tty_poll(struct file *, poll_table *);
150 static int tty_open(struct inode *, struct file *);
151 static int tty_release(struct inode *, struct file *);
152 int tty_ioctl(struct inode * inode, struct file * file,
153               unsigned int cmd, unsigned long arg);
154 static int tty_fasync(int fd, struct file * filp, int on);
155 static void release_tty(struct tty_struct *tty, int idx);
156 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157
158 /**
159  *      alloc_tty_struct        -       allocate a tty object
160  *
161  *      Return a new empty tty structure. The data fields have not
162  *      been initialized in any way but has been zeroed
163  *
164  *      Locking: none
165  */
166
167 static struct tty_struct *alloc_tty_struct(void)
168 {
169         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
170 }
171
172 static void tty_buffer_free_all(struct tty_struct *);
173
174 /**
175  *      free_tty_struct         -       free a disused tty
176  *      @tty: tty struct to free
177  *
178  *      Free the write buffers, tty queue and tty memory itself.
179  *
180  *      Locking: none. Must be called after tty is definitely unused
181  */
182
183 static inline void free_tty_struct(struct tty_struct *tty)
184 {
185         kfree(tty->write_buf);
186         tty_buffer_free_all(tty);
187         kfree(tty);
188 }
189
190 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
191
192 /**
193  *      tty_name        -       return tty naming
194  *      @tty: tty structure
195  *      @buf: buffer for output
196  *
197  *      Convert a tty structure into a name. The name reflects the kernel
198  *      naming policy and if udev is in use may not reflect user space
199  *
200  *      Locking: none
201  */
202
203 char *tty_name(struct tty_struct *tty, char *buf)
204 {
205         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
206                 strcpy(buf, "NULL tty");
207         else
208                 strcpy(buf, tty->name);
209         return buf;
210 }
211
212 EXPORT_SYMBOL(tty_name);
213
214 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
215                               const char *routine)
216 {
217 #ifdef TTY_PARANOIA_CHECK
218         if (!tty) {
219                 printk(KERN_WARNING
220                         "null TTY for (%d:%d) in %s\n",
221                         imajor(inode), iminor(inode), routine);
222                 return 1;
223         }
224         if (tty->magic != TTY_MAGIC) {
225                 printk(KERN_WARNING
226                         "bad magic number for tty struct (%d:%d) in %s\n",
227                         imajor(inode), iminor(inode), routine);
228                 return 1;
229         }
230 #endif
231         return 0;
232 }
233
234 static int check_tty_count(struct tty_struct *tty, const char *routine)
235 {
236 #ifdef CHECK_TTY_COUNT
237         struct list_head *p;
238         int count = 0;
239         
240         file_list_lock();
241         list_for_each(p, &tty->tty_files) {
242                 count++;
243         }
244         file_list_unlock();
245         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
246             tty->driver->subtype == PTY_TYPE_SLAVE &&
247             tty->link && tty->link->count)
248                 count++;
249         if (tty->count != count) {
250                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
251                                     "!= #fd's(%d) in %s\n",
252                        tty->name, tty->count, count, routine);
253                 return count;
254         }
255 #endif
256         return 0;
257 }
258
259 /*
260  * Tty buffer allocation management
261  */
262
263 /**
264  *      tty_buffer_free_all             -       free buffers used by a tty
265  *      @tty: tty to free from
266  *
267  *      Remove all the buffers pending on a tty whether queued with data
268  *      or in the free ring. Must be called when the tty is no longer in use
269  *
270  *      Locking: none
271  */
272
273 static void tty_buffer_free_all(struct tty_struct *tty)
274 {
275         struct tty_buffer *thead;
276         while((thead = tty->buf.head) != NULL) {
277                 tty->buf.head = thead->next;
278                 kfree(thead);
279         }
280         while((thead = tty->buf.free) != NULL) {
281                 tty->buf.free = thead->next;
282                 kfree(thead);
283         }
284         tty->buf.tail = NULL;
285         tty->buf.memory_used = 0;
286 }
287
288 /**
289  *      tty_buffer_init         -       prepare a tty buffer structure
290  *      @tty: tty to initialise
291  *
292  *      Set up the initial state of the buffer management for a tty device.
293  *      Must be called before the other tty buffer functions are used.
294  *
295  *      Locking: none
296  */
297
298 static void tty_buffer_init(struct tty_struct *tty)
299 {
300         spin_lock_init(&tty->buf.lock);
301         tty->buf.head = NULL;
302         tty->buf.tail = NULL;
303         tty->buf.free = NULL;
304         tty->buf.memory_used = 0;
305 }
306
307 /**
308  *      tty_buffer_alloc        -       allocate a tty buffer
309  *      @tty: tty device
310  *      @size: desired size (characters)
311  *
312  *      Allocate a new tty buffer to hold the desired number of characters.
313  *      Return NULL if out of memory or the allocation would exceed the
314  *      per device queue
315  *
316  *      Locking: Caller must hold tty->buf.lock
317  */
318
319 static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
320 {
321         struct tty_buffer *p;
322
323         if (tty->buf.memory_used + size > 65536)
324                 return NULL;
325         p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
326         if(p == NULL)
327                 return NULL;
328         p->used = 0;
329         p->size = size;
330         p->next = NULL;
331         p->commit = 0;
332         p->read = 0;
333         p->char_buf_ptr = (char *)(p->data);
334         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
335         tty->buf.memory_used += size;
336         return p;
337 }
338
339 /**
340  *      tty_buffer_free         -       free a tty buffer
341  *      @tty: tty owning the buffer
342  *      @b: the buffer to free
343  *
344  *      Free a tty buffer, or add it to the free list according to our
345  *      internal strategy
346  *
347  *      Locking: Caller must hold tty->buf.lock
348  */
349
350 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
351 {
352         /* Dumb strategy for now - should keep some stats */
353         tty->buf.memory_used -= b->size;
354         WARN_ON(tty->buf.memory_used < 0);
355
356         if(b->size >= 512)
357                 kfree(b);
358         else {
359                 b->next = tty->buf.free;
360                 tty->buf.free = b;
361         }
362 }
363
364 /**
365  *      tty_buffer_find         -       find a free tty buffer
366  *      @tty: tty owning the buffer
367  *      @size: characters wanted
368  *
369  *      Locate an existing suitable tty buffer or if we are lacking one then
370  *      allocate a new one. We round our buffers off in 256 character chunks
371  *      to get better allocation behaviour.
372  *
373  *      Locking: Caller must hold tty->buf.lock
374  */
375
376 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
377 {
378         struct tty_buffer **tbh = &tty->buf.free;
379         while((*tbh) != NULL) {
380                 struct tty_buffer *t = *tbh;
381                 if(t->size >= size) {
382                         *tbh = t->next;
383                         t->next = NULL;
384                         t->used = 0;
385                         t->commit = 0;
386                         t->read = 0;
387                         tty->buf.memory_used += t->size;
388                         return t;
389                 }
390                 tbh = &((*tbh)->next);
391         }
392         /* Round the buffer size out */
393         size = (size + 0xFF) & ~ 0xFF;
394         return tty_buffer_alloc(tty, size);
395         /* Should possibly check if this fails for the largest buffer we
396            have queued and recycle that ? */
397 }
398
399 /**
400  *      tty_buffer_request_room         -       grow tty buffer if needed
401  *      @tty: tty structure
402  *      @size: size desired
403  *
404  *      Make at least size bytes of linear space available for the tty
405  *      buffer. If we fail return the size we managed to find.
406  *
407  *      Locking: Takes tty->buf.lock
408  */
409 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
410 {
411         struct tty_buffer *b, *n;
412         int left;
413         unsigned long flags;
414
415         spin_lock_irqsave(&tty->buf.lock, flags);
416
417         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
418            remove this conditional if its worth it. This would be invisible
419            to the callers */
420         if ((b = tty->buf.tail) != NULL)
421                 left = b->size - b->used;
422         else
423                 left = 0;
424
425         if (left < size) {
426                 /* This is the slow path - looking for new buffers to use */
427                 if ((n = tty_buffer_find(tty, size)) != NULL) {
428                         if (b != NULL) {
429                                 b->next = n;
430                                 b->commit = b->used;
431                         } else
432                                 tty->buf.head = n;
433                         tty->buf.tail = n;
434                 } else
435                         size = left;
436         }
437
438         spin_unlock_irqrestore(&tty->buf.lock, flags);
439         return size;
440 }
441 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
442
443 /**
444  *      tty_insert_flip_string  -       Add characters to the tty buffer
445  *      @tty: tty structure
446  *      @chars: characters
447  *      @size: size
448  *
449  *      Queue a series of bytes to the tty buffering. All the characters
450  *      passed are marked as without error. Returns the number added.
451  *
452  *      Locking: Called functions may take tty->buf.lock
453  */
454
455 int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
456                                 size_t size)
457 {
458         int copied = 0;
459         do {
460                 int space = tty_buffer_request_room(tty, size - copied);
461                 struct tty_buffer *tb = tty->buf.tail;
462                 /* If there is no space then tb may be NULL */
463                 if(unlikely(space == 0))
464                         break;
465                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
466                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
467                 tb->used += space;
468                 copied += space;
469                 chars += space;
470                 /* There is a small chance that we need to split the data over
471                    several buffers. If this is the case we must loop */
472         } while (unlikely(size > copied));
473         return copied;
474 }
475 EXPORT_SYMBOL(tty_insert_flip_string);
476
477 /**
478  *      tty_insert_flip_string_flags    -       Add characters to the tty buffer
479  *      @tty: tty structure
480  *      @chars: characters
481  *      @flags: flag bytes
482  *      @size: size
483  *
484  *      Queue a series of bytes to the tty buffering. For each character
485  *      the flags array indicates the status of the character. Returns the
486  *      number added.
487  *
488  *      Locking: Called functions may take tty->buf.lock
489  */
490
491 int tty_insert_flip_string_flags(struct tty_struct *tty,
492                 const unsigned char *chars, const char *flags, size_t size)
493 {
494         int copied = 0;
495         do {
496                 int space = tty_buffer_request_room(tty, size - copied);
497                 struct tty_buffer *tb = tty->buf.tail;
498                 /* If there is no space then tb may be NULL */
499                 if(unlikely(space == 0))
500                         break;
501                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
502                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
503                 tb->used += space;
504                 copied += space;
505                 chars += space;
506                 flags += space;
507                 /* There is a small chance that we need to split the data over
508                    several buffers. If this is the case we must loop */
509         } while (unlikely(size > copied));
510         return copied;
511 }
512 EXPORT_SYMBOL(tty_insert_flip_string_flags);
513
514 /**
515  *      tty_schedule_flip       -       push characters to ldisc
516  *      @tty: tty to push from
517  *
518  *      Takes any pending buffers and transfers their ownership to the
519  *      ldisc side of the queue. It then schedules those characters for
520  *      processing by the line discipline.
521  *
522  *      Locking: Takes tty->buf.lock
523  */
524
525 void tty_schedule_flip(struct tty_struct *tty)
526 {
527         unsigned long flags;
528         spin_lock_irqsave(&tty->buf.lock, flags);
529         if (tty->buf.tail != NULL)
530                 tty->buf.tail->commit = tty->buf.tail->used;
531         spin_unlock_irqrestore(&tty->buf.lock, flags);
532         schedule_delayed_work(&tty->buf.work, 1);
533 }
534 EXPORT_SYMBOL(tty_schedule_flip);
535
536 /**
537  *      tty_prepare_flip_string         -       make room for characters
538  *      @tty: tty
539  *      @chars: return pointer for character write area
540  *      @size: desired size
541  *
542  *      Prepare a block of space in the buffer for data. Returns the length
543  *      available and buffer pointer to the space which is now allocated and
544  *      accounted for as ready for normal characters. This is used for drivers
545  *      that need their own block copy routines into the buffer. There is no
546  *      guarantee the buffer is a DMA target!
547  *
548  *      Locking: May call functions taking tty->buf.lock
549  */
550
551 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
552 {
553         int space = tty_buffer_request_room(tty, size);
554         if (likely(space)) {
555                 struct tty_buffer *tb = tty->buf.tail;
556                 *chars = tb->char_buf_ptr + tb->used;
557                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
558                 tb->used += space;
559         }
560         return space;
561 }
562
563 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
564
565 /**
566  *      tty_prepare_flip_string_flags   -       make room for characters
567  *      @tty: tty
568  *      @chars: return pointer for character write area
569  *      @flags: return pointer for status flag write area
570  *      @size: desired size
571  *
572  *      Prepare a block of space in the buffer for data. Returns the length
573  *      available and buffer pointer to the space which is now allocated and
574  *      accounted for as ready for characters. This is used for drivers
575  *      that need their own block copy routines into the buffer. There is no
576  *      guarantee the buffer is a DMA target!
577  *
578  *      Locking: May call functions taking tty->buf.lock
579  */
580
581 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
582 {
583         int space = tty_buffer_request_room(tty, size);
584         if (likely(space)) {
585                 struct tty_buffer *tb = tty->buf.tail;
586                 *chars = tb->char_buf_ptr + tb->used;
587                 *flags = tb->flag_buf_ptr + tb->used;
588                 tb->used += space;
589         }
590         return space;
591 }
592
593 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
594
595
596
597 /**
598  *      tty_set_termios_ldisc           -       set ldisc field
599  *      @tty: tty structure
600  *      @num: line discipline number
601  *
602  *      This is probably overkill for real world processors but
603  *      they are not on hot paths so a little discipline won't do 
604  *      any harm.
605  *
606  *      Locking: takes termios_mutex
607  */
608  
609 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
610 {
611         mutex_lock(&tty->termios_mutex);
612         tty->termios->c_line = num;
613         mutex_unlock(&tty->termios_mutex);
614 }
615
616 /*
617  *      This guards the refcounted line discipline lists. The lock
618  *      must be taken with irqs off because there are hangup path
619  *      callers who will do ldisc lookups and cannot sleep.
620  */
621  
622 static DEFINE_SPINLOCK(tty_ldisc_lock);
623 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
624 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
625
626 /**
627  *      tty_register_ldisc      -       install a line discipline
628  *      @disc: ldisc number
629  *      @new_ldisc: pointer to the ldisc object
630  *
631  *      Installs a new line discipline into the kernel. The discipline
632  *      is set up as unreferenced and then made available to the kernel
633  *      from this point onwards.
634  *
635  *      Locking:
636  *              takes tty_ldisc_lock to guard against ldisc races
637  */
638
639 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
640 {
641         unsigned long flags;
642         int ret = 0;
643         
644         if (disc < N_TTY || disc >= NR_LDISCS)
645                 return -EINVAL;
646         
647         spin_lock_irqsave(&tty_ldisc_lock, flags);
648         tty_ldiscs[disc] = *new_ldisc;
649         tty_ldiscs[disc].num = disc;
650         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
651         tty_ldiscs[disc].refcount = 0;
652         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
653         
654         return ret;
655 }
656 EXPORT_SYMBOL(tty_register_ldisc);
657
658 /**
659  *      tty_unregister_ldisc    -       unload a line discipline
660  *      @disc: ldisc number
661  *      @new_ldisc: pointer to the ldisc object
662  *
663  *      Remove a line discipline from the kernel providing it is not
664  *      currently in use.
665  *
666  *      Locking:
667  *              takes tty_ldisc_lock to guard against ldisc races
668  */
669
670 int tty_unregister_ldisc(int disc)
671 {
672         unsigned long flags;
673         int ret = 0;
674
675         if (disc < N_TTY || disc >= NR_LDISCS)
676                 return -EINVAL;
677
678         spin_lock_irqsave(&tty_ldisc_lock, flags);
679         if (tty_ldiscs[disc].refcount)
680                 ret = -EBUSY;
681         else
682                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
683         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
684
685         return ret;
686 }
687 EXPORT_SYMBOL(tty_unregister_ldisc);
688
689 /**
690  *      tty_ldisc_get           -       take a reference to an ldisc
691  *      @disc: ldisc number
692  *
693  *      Takes a reference to a line discipline. Deals with refcounts and
694  *      module locking counts. Returns NULL if the discipline is not available.
695  *      Returns a pointer to the discipline and bumps the ref count if it is
696  *      available
697  *
698  *      Locking:
699  *              takes tty_ldisc_lock to guard against ldisc races
700  */
701
702 struct tty_ldisc *tty_ldisc_get(int disc)
703 {
704         unsigned long flags;
705         struct tty_ldisc *ld;
706
707         if (disc < N_TTY || disc >= NR_LDISCS)
708                 return NULL;
709         
710         spin_lock_irqsave(&tty_ldisc_lock, flags);
711
712         ld = &tty_ldiscs[disc];
713         /* Check the entry is defined */
714         if(ld->flags & LDISC_FLAG_DEFINED)
715         {
716                 /* If the module is being unloaded we can't use it */
717                 if (!try_module_get(ld->owner))
718                         ld = NULL;
719                 else /* lock it */
720                         ld->refcount++;
721         }
722         else
723                 ld = NULL;
724         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
725         return ld;
726 }
727
728 EXPORT_SYMBOL_GPL(tty_ldisc_get);
729
730 /**
731  *      tty_ldisc_put           -       drop ldisc reference
732  *      @disc: ldisc number
733  *
734  *      Drop a reference to a line discipline. Manage refcounts and
735  *      module usage counts
736  *
737  *      Locking:
738  *              takes tty_ldisc_lock to guard against ldisc races
739  */
740
741 void tty_ldisc_put(int disc)
742 {
743         struct tty_ldisc *ld;
744         unsigned long flags;
745         
746         BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
747                 
748         spin_lock_irqsave(&tty_ldisc_lock, flags);
749         ld = &tty_ldiscs[disc];
750         BUG_ON(ld->refcount == 0);
751         ld->refcount--;
752         module_put(ld->owner);
753         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
754 }
755         
756 EXPORT_SYMBOL_GPL(tty_ldisc_put);
757
758 /**
759  *      tty_ldisc_assign        -       set ldisc on a tty
760  *      @tty: tty to assign
761  *      @ld: line discipline
762  *
763  *      Install an instance of a line discipline into a tty structure. The
764  *      ldisc must have a reference count above zero to ensure it remains/
765  *      The tty instance refcount starts at zero.
766  *
767  *      Locking:
768  *              Caller must hold references
769  */
770
771 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
772 {
773         tty->ldisc = *ld;
774         tty->ldisc.refcount = 0;
775 }
776
777 /**
778  *      tty_ldisc_try           -       internal helper
779  *      @tty: the tty
780  *
781  *      Make a single attempt to grab and bump the refcount on
782  *      the tty ldisc. Return 0 on failure or 1 on success. This is
783  *      used to implement both the waiting and non waiting versions
784  *      of tty_ldisc_ref
785  *
786  *      Locking: takes tty_ldisc_lock
787  */
788
789 static int tty_ldisc_try(struct tty_struct *tty)
790 {
791         unsigned long flags;
792         struct tty_ldisc *ld;
793         int ret = 0;
794         
795         spin_lock_irqsave(&tty_ldisc_lock, flags);
796         ld = &tty->ldisc;
797         if(test_bit(TTY_LDISC, &tty->flags))
798         {
799                 ld->refcount++;
800                 ret = 1;
801         }
802         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
803         return ret;
804 }
805
806 /**
807  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
808  *      @tty: tty device
809  *
810  *      Dereference the line discipline for the terminal and take a 
811  *      reference to it. If the line discipline is in flux then 
812  *      wait patiently until it changes.
813  *
814  *      Note: Must not be called from an IRQ/timer context. The caller
815  *      must also be careful not to hold other locks that will deadlock
816  *      against a discipline change, such as an existing ldisc reference
817  *      (which we check for)
818  *
819  *      Locking: call functions take tty_ldisc_lock
820  */
821  
822 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
823 {
824         /* wait_event is a macro */
825         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
826         if(tty->ldisc.refcount == 0)
827                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
828         return &tty->ldisc;
829 }
830
831 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
832
833 /**
834  *      tty_ldisc_ref           -       get the tty ldisc
835  *      @tty: tty device
836  *
837  *      Dereference the line discipline for the terminal and take a 
838  *      reference to it. If the line discipline is in flux then 
839  *      return NULL. Can be called from IRQ and timer functions.
840  *
841  *      Locking: called functions take tty_ldisc_lock
842  */
843  
844 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
845 {
846         if(tty_ldisc_try(tty))
847                 return &tty->ldisc;
848         return NULL;
849 }
850
851 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
852
853 /**
854  *      tty_ldisc_deref         -       free a tty ldisc reference
855  *      @ld: reference to free up
856  *
857  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
858  *      be called in IRQ context.
859  *
860  *      Locking: takes tty_ldisc_lock
861  */
862  
863 void tty_ldisc_deref(struct tty_ldisc *ld)
864 {
865         unsigned long flags;
866
867         BUG_ON(ld == NULL);
868                 
869         spin_lock_irqsave(&tty_ldisc_lock, flags);
870         if(ld->refcount == 0)
871                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
872         else
873                 ld->refcount--;
874         if(ld->refcount == 0)
875                 wake_up(&tty_ldisc_wait);
876         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
877 }
878
879 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
880
881 /**
882  *      tty_ldisc_enable        -       allow ldisc use
883  *      @tty: terminal to activate ldisc on
884  *
885  *      Set the TTY_LDISC flag when the line discipline can be called
886  *      again. Do neccessary wakeups for existing sleepers.
887  *
888  *      Note: nobody should set this bit except via this function. Clearing
889  *      directly is allowed.
890  */
891
892 static void tty_ldisc_enable(struct tty_struct *tty)
893 {
894         set_bit(TTY_LDISC, &tty->flags);
895         wake_up(&tty_ldisc_wait);
896 }
897         
898 /**
899  *      tty_set_ldisc           -       set line discipline
900  *      @tty: the terminal to set
901  *      @ldisc: the line discipline
902  *
903  *      Set the discipline of a tty line. Must be called from a process
904  *      context.
905  *
906  *      Locking: takes tty_ldisc_lock.
907  *               called functions take termios_mutex
908  */
909  
910 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
911 {
912         int retval = 0;
913         struct tty_ldisc o_ldisc;
914         char buf[64];
915         int work;
916         unsigned long flags;
917         struct tty_ldisc *ld;
918         struct tty_struct *o_tty;
919
920         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
921                 return -EINVAL;
922
923 restart:
924
925         ld = tty_ldisc_get(ldisc);
926         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
927         /* Cyrus Durgin <cider@speakeasy.org> */
928         if (ld == NULL) {
929                 request_module("tty-ldisc-%d", ldisc);
930                 ld = tty_ldisc_get(ldisc);
931         }
932         if (ld == NULL)
933                 return -EINVAL;
934
935         /*
936          *      No more input please, we are switching. The new ldisc
937          *      will update this value in the ldisc open function
938          */
939
940         tty->receive_room = 0;
941
942         /*
943          *      Problem: What do we do if this blocks ?
944          */
945
946         tty_wait_until_sent(tty, 0);
947
948         if (tty->ldisc.num == ldisc) {
949                 tty_ldisc_put(ldisc);
950                 return 0;
951         }
952
953         o_ldisc = tty->ldisc;
954         o_tty = tty->link;
955
956         /*
957          *      Make sure we don't change while someone holds a
958          *      reference to the line discipline. The TTY_LDISC bit
959          *      prevents anyone taking a reference once it is clear.
960          *      We need the lock to avoid racing reference takers.
961          */
962
963         spin_lock_irqsave(&tty_ldisc_lock, flags);
964         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
965                 if(tty->ldisc.refcount) {
966                         /* Free the new ldisc we grabbed. Must drop the lock
967                            first. */
968                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
969                         tty_ldisc_put(ldisc);
970                         /*
971                          * There are several reasons we may be busy, including
972                          * random momentary I/O traffic. We must therefore
973                          * retry. We could distinguish between blocking ops
974                          * and retries if we made tty_ldisc_wait() smarter. That
975                          * is up for discussion.
976                          */
977                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
978                                 return -ERESTARTSYS;
979                         goto restart;
980                 }
981                 if(o_tty && o_tty->ldisc.refcount) {
982                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
983                         tty_ldisc_put(ldisc);
984                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
985                                 return -ERESTARTSYS;
986                         goto restart;
987                 }
988         }
989
990         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
991
992         if (!test_bit(TTY_LDISC, &tty->flags)) {
993                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
994                 tty_ldisc_put(ldisc);
995                 ld = tty_ldisc_ref_wait(tty);
996                 tty_ldisc_deref(ld);
997                 goto restart;
998         }
999
1000         clear_bit(TTY_LDISC, &tty->flags);
1001         if (o_tty)
1002                 clear_bit(TTY_LDISC, &o_tty->flags);
1003         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1004
1005         /*
1006          *      From this point on we know nobody has an ldisc
1007          *      usage reference, nor can they obtain one until
1008          *      we say so later on.
1009          */
1010
1011         work = cancel_delayed_work(&tty->buf.work);
1012         /*
1013          * Wait for ->hangup_work and ->buf.work handlers to terminate
1014          */
1015          
1016         flush_scheduled_work();
1017         /* Shutdown the current discipline. */
1018         if (tty->ldisc.close)
1019                 (tty->ldisc.close)(tty);
1020
1021         /* Now set up the new line discipline. */
1022         tty_ldisc_assign(tty, ld);
1023         tty_set_termios_ldisc(tty, ldisc);
1024         if (tty->ldisc.open)
1025                 retval = (tty->ldisc.open)(tty);
1026         if (retval < 0) {
1027                 tty_ldisc_put(ldisc);
1028                 /* There is an outstanding reference here so this is safe */
1029                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
1030                 tty_set_termios_ldisc(tty, tty->ldisc.num);
1031                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
1032                         tty_ldisc_put(o_ldisc.num);
1033                         /* This driver is always present */
1034                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1035                         tty_set_termios_ldisc(tty, N_TTY);
1036                         if (tty->ldisc.open) {
1037                                 int r = tty->ldisc.open(tty);
1038
1039                                 if (r < 0)
1040                                         panic("Couldn't open N_TTY ldisc for "
1041                                               "%s --- error %d.",
1042                                               tty_name(tty, buf), r);
1043                         }
1044                 }
1045         }
1046         /* At this point we hold a reference to the new ldisc and a
1047            a reference to the old ldisc. If we ended up flipping back
1048            to the existing ldisc we have two references to it */
1049         
1050         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
1051                 tty->driver->set_ldisc(tty);
1052                 
1053         tty_ldisc_put(o_ldisc.num);
1054         
1055         /*
1056          *      Allow ldisc referencing to occur as soon as the driver
1057          *      ldisc callback completes.
1058          */
1059          
1060         tty_ldisc_enable(tty);
1061         if (o_tty)
1062                 tty_ldisc_enable(o_tty);
1063         
1064         /* Restart it in case no characters kick it off. Safe if
1065            already running */
1066         if (work)
1067                 schedule_delayed_work(&tty->buf.work, 1);
1068         return retval;
1069 }
1070
1071 /**
1072  *      get_tty_driver          -       find device of a tty
1073  *      @dev_t: device identifier
1074  *      @index: returns the index of the tty
1075  *
1076  *      This routine returns a tty driver structure, given a device number
1077  *      and also passes back the index number.
1078  *
1079  *      Locking: caller must hold tty_mutex
1080  */
1081
1082 static struct tty_driver *get_tty_driver(dev_t device, int *index)
1083 {
1084         struct tty_driver *p;
1085
1086         list_for_each_entry(p, &tty_drivers, tty_drivers) {
1087                 dev_t base = MKDEV(p->major, p->minor_start);
1088                 if (device < base || device >= base + p->num)
1089                         continue;
1090                 *index = device - base;
1091                 return p;
1092         }
1093         return NULL;
1094 }
1095
1096 /**
1097  *      tty_check_change        -       check for POSIX terminal changes
1098  *      @tty: tty to check
1099  *
1100  *      If we try to write to, or set the state of, a terminal and we're
1101  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
1102  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
1103  *
1104  *      Locking: none
1105  */
1106
1107 int tty_check_change(struct tty_struct * tty)
1108 {
1109         if (current->signal->tty != tty)
1110                 return 0;
1111         if (!tty->pgrp) {
1112                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
1113                 return 0;
1114         }
1115         if (task_pgrp(current) == tty->pgrp)
1116                 return 0;
1117         if (is_ignored(SIGTTOU))
1118                 return 0;
1119         if (is_current_pgrp_orphaned())
1120                 return -EIO;
1121         (void) kill_pgrp(task_pgrp(current), SIGTTOU, 1);
1122         return -ERESTARTSYS;
1123 }
1124
1125 EXPORT_SYMBOL(tty_check_change);
1126
1127 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
1128                                 size_t count, loff_t *ppos)
1129 {
1130         return 0;
1131 }
1132
1133 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
1134                                  size_t count, loff_t *ppos)
1135 {
1136         return -EIO;
1137 }
1138
1139 /* No kernel lock held - none needed ;) */
1140 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
1141 {
1142         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
1143 }
1144
1145 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
1146                              unsigned int cmd, unsigned long arg)
1147 {
1148         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
1149 }
1150
1151 static const struct file_operations tty_fops = {
1152         .llseek         = no_llseek,
1153         .read           = tty_read,
1154         .write          = tty_write,
1155         .poll           = tty_poll,
1156         .ioctl          = tty_ioctl,
1157         .open           = tty_open,
1158         .release        = tty_release,
1159         .fasync         = tty_fasync,
1160 };
1161
1162 #ifdef CONFIG_UNIX98_PTYS
1163 static const struct file_operations ptmx_fops = {
1164         .llseek         = no_llseek,
1165         .read           = tty_read,
1166         .write          = tty_write,
1167         .poll           = tty_poll,
1168         .ioctl          = tty_ioctl,
1169         .open           = ptmx_open,
1170         .release        = tty_release,
1171         .fasync         = tty_fasync,
1172 };
1173 #endif
1174
1175 static const struct file_operations console_fops = {
1176         .llseek         = no_llseek,
1177         .read           = tty_read,
1178         .write          = redirected_tty_write,
1179         .poll           = tty_poll,
1180         .ioctl          = tty_ioctl,
1181         .open           = tty_open,
1182         .release        = tty_release,
1183         .fasync         = tty_fasync,
1184 };
1185
1186 static const struct file_operations hung_up_tty_fops = {
1187         .llseek         = no_llseek,
1188         .read           = hung_up_tty_read,
1189         .write          = hung_up_tty_write,
1190         .poll           = hung_up_tty_poll,
1191         .ioctl          = hung_up_tty_ioctl,
1192         .release        = tty_release,
1193 };
1194
1195 static DEFINE_SPINLOCK(redirect_lock);
1196 static struct file *redirect;
1197
1198 /**
1199  *      tty_wakeup      -       request more data
1200  *      @tty: terminal
1201  *
1202  *      Internal and external helper for wakeups of tty. This function
1203  *      informs the line discipline if present that the driver is ready
1204  *      to receive more output data.
1205  */
1206  
1207 void tty_wakeup(struct tty_struct *tty)
1208 {
1209         struct tty_ldisc *ld;
1210         
1211         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
1212                 ld = tty_ldisc_ref(tty);
1213                 if(ld) {
1214                         if(ld->write_wakeup)
1215                                 ld->write_wakeup(tty);
1216                         tty_ldisc_deref(ld);
1217                 }
1218         }
1219         wake_up_interruptible(&tty->write_wait);
1220 }
1221
1222 EXPORT_SYMBOL_GPL(tty_wakeup);
1223
1224 /**
1225  *      tty_ldisc_flush -       flush line discipline queue
1226  *      @tty: tty
1227  *
1228  *      Flush the line discipline queue (if any) for this tty. If there
1229  *      is no line discipline active this is a no-op.
1230  */
1231  
1232 void tty_ldisc_flush(struct tty_struct *tty)
1233 {
1234         struct tty_ldisc *ld = tty_ldisc_ref(tty);
1235         if(ld) {
1236                 if(ld->flush_buffer)
1237                         ld->flush_buffer(tty);
1238                 tty_ldisc_deref(ld);
1239         }
1240 }
1241
1242 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
1243
1244 /**
1245  *      tty_reset_termios       -       reset terminal state
1246  *      @tty: tty to reset
1247  *
1248  *      Restore a terminal to the driver default state
1249  */
1250
1251 static void tty_reset_termios(struct tty_struct *tty)
1252 {
1253         mutex_lock(&tty->termios_mutex);
1254         *tty->termios = tty->driver->init_termios;
1255         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1256         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1257         mutex_unlock(&tty->termios_mutex);
1258 }
1259         
1260 /**
1261  *      do_tty_hangup           -       actual handler for hangup events
1262  *      @work: tty device
1263  *
1264  *      This can be called by the "eventd" kernel thread.  That is process
1265  *      synchronous but doesn't hold any locks, so we need to make sure we
1266  *      have the appropriate locks for what we're doing.
1267  *
1268  *      The hangup event clears any pending redirections onto the hung up
1269  *      device. It ensures future writes will error and it does the needed
1270  *      line discipline hangup and signal delivery. The tty object itself
1271  *      remains intact.
1272  *
1273  *      Locking:
1274  *              BKL
1275  *                redirect lock for undoing redirection
1276  *                file list lock for manipulating list of ttys
1277  *                tty_ldisc_lock from called functions
1278  *                termios_mutex resetting termios data
1279  *                tasklist_lock to walk task list for hangup event
1280  *                  ->siglock to protect ->signal/->sighand
1281  */
1282 static void do_tty_hangup(struct work_struct *work)
1283 {
1284         struct tty_struct *tty =
1285                 container_of(work, struct tty_struct, hangup_work);
1286         struct file * cons_filp = NULL;
1287         struct file *filp, *f = NULL;
1288         struct task_struct *p;
1289         struct tty_ldisc *ld;
1290         int    closecount = 0, n;
1291
1292         if (!tty)
1293                 return;
1294
1295         /* inuse_filps is protected by the single kernel lock */
1296         lock_kernel();
1297
1298         spin_lock(&redirect_lock);
1299         if (redirect && redirect->private_data == tty) {
1300                 f = redirect;
1301                 redirect = NULL;
1302         }
1303         spin_unlock(&redirect_lock);
1304         
1305         check_tty_count(tty, "do_tty_hangup");
1306         file_list_lock();
1307         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1308         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1309                 if (filp->f_op->write == redirected_tty_write)
1310                         cons_filp = filp;
1311                 if (filp->f_op->write != tty_write)
1312                         continue;
1313                 closecount++;
1314                 tty_fasync(-1, filp, 0);        /* can't block */
1315                 filp->f_op = &hung_up_tty_fops;
1316         }
1317         file_list_unlock();
1318         
1319         /* FIXME! What are the locking issues here? This may me overdoing things..
1320          * this question is especially important now that we've removed the irqlock. */
1321
1322         ld = tty_ldisc_ref(tty);
1323         if(ld != NULL)  /* We may have no line discipline at this point */
1324         {
1325                 if (ld->flush_buffer)
1326                         ld->flush_buffer(tty);
1327                 if (tty->driver->flush_buffer)
1328                         tty->driver->flush_buffer(tty);
1329                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1330                     ld->write_wakeup)
1331                         ld->write_wakeup(tty);
1332                 if (ld->hangup)
1333                         ld->hangup(tty);
1334         }
1335
1336         /* FIXME: Once we trust the LDISC code better we can wait here for
1337            ldisc completion and fix the driver call race */
1338            
1339         wake_up_interruptible(&tty->write_wait);
1340         wake_up_interruptible(&tty->read_wait);
1341
1342         /*
1343          * Shutdown the current line discipline, and reset it to
1344          * N_TTY.
1345          */
1346         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1347                 tty_reset_termios(tty);
1348         
1349         /* Defer ldisc switch */
1350         /* tty_deferred_ldisc_switch(N_TTY);
1351         
1352           This should get done automatically when the port closes and
1353           tty_release is called */
1354         
1355         read_lock(&tasklist_lock);
1356         if (tty->session) {
1357                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
1358                         spin_lock_irq(&p->sighand->siglock);
1359                         if (p->signal->tty == tty)
1360                                 p->signal->tty = NULL;
1361                         if (!p->signal->leader) {
1362                                 spin_unlock_irq(&p->sighand->siglock);
1363                                 continue;
1364                         }
1365                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1366                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1367                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
1368                         if (tty->pgrp)
1369                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
1370                         spin_unlock_irq(&p->sighand->siglock);
1371                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
1372         }
1373         read_unlock(&tasklist_lock);
1374
1375         tty->flags = 0;
1376         put_pid(tty->session);
1377         put_pid(tty->pgrp);
1378         tty->session = NULL;
1379         tty->pgrp = NULL;
1380         tty->ctrl_status = 0;
1381         /*
1382          *      If one of the devices matches a console pointer, we
1383          *      cannot just call hangup() because that will cause
1384          *      tty->count and state->count to go out of sync.
1385          *      So we just call close() the right number of times.
1386          */
1387         if (cons_filp) {
1388                 if (tty->driver->close)
1389                         for (n = 0; n < closecount; n++)
1390                                 tty->driver->close(tty, cons_filp);
1391         } else if (tty->driver->hangup)
1392                 (tty->driver->hangup)(tty);
1393                 
1394         /* We don't want to have driver/ldisc interactions beyond
1395            the ones we did here. The driver layer expects no
1396            calls after ->hangup() from the ldisc side. However we
1397            can't yet guarantee all that */
1398
1399         set_bit(TTY_HUPPED, &tty->flags);
1400         if (ld) {
1401                 tty_ldisc_enable(tty);
1402                 tty_ldisc_deref(ld);
1403         }
1404         unlock_kernel();
1405         if (f)
1406                 fput(f);
1407 }
1408
1409 /**
1410  *      tty_hangup              -       trigger a hangup event
1411  *      @tty: tty to hangup
1412  *
1413  *      A carrier loss (virtual or otherwise) has occurred on this like
1414  *      schedule a hangup sequence to run after this event.
1415  */
1416
1417 void tty_hangup(struct tty_struct * tty)
1418 {
1419 #ifdef TTY_DEBUG_HANGUP
1420         char    buf[64];
1421         
1422         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1423 #endif
1424         schedule_work(&tty->hangup_work);
1425 }
1426
1427 EXPORT_SYMBOL(tty_hangup);
1428
1429 /**
1430  *      tty_vhangup             -       process vhangup
1431  *      @tty: tty to hangup
1432  *
1433  *      The user has asked via system call for the terminal to be hung up.
1434  *      We do this synchronously so that when the syscall returns the process
1435  *      is complete. That guarantee is neccessary for security reasons.
1436  */
1437
1438 void tty_vhangup(struct tty_struct * tty)
1439 {
1440 #ifdef TTY_DEBUG_HANGUP
1441         char    buf[64];
1442
1443         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1444 #endif
1445         do_tty_hangup(&tty->hangup_work);
1446 }
1447 EXPORT_SYMBOL(tty_vhangup);
1448
1449 /**
1450  *      tty_hung_up_p           -       was tty hung up
1451  *      @filp: file pointer of tty
1452  *
1453  *      Return true if the tty has been subject to a vhangup or a carrier
1454  *      loss
1455  */
1456
1457 int tty_hung_up_p(struct file * filp)
1458 {
1459         return (filp->f_op == &hung_up_tty_fops);
1460 }
1461
1462 EXPORT_SYMBOL(tty_hung_up_p);
1463
1464 static void session_clear_tty(struct pid *session)
1465 {
1466         struct task_struct *p;
1467         do_each_pid_task(session, PIDTYPE_SID, p) {
1468                 proc_clear_tty(p);
1469         } while_each_pid_task(session, PIDTYPE_SID, p);
1470 }
1471
1472 /**
1473  *      disassociate_ctty       -       disconnect controlling tty
1474  *      @on_exit: true if exiting so need to "hang up" the session
1475  *
1476  *      This function is typically called only by the session leader, when
1477  *      it wants to disassociate itself from its controlling tty.
1478  *
1479  *      It performs the following functions:
1480  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1481  *      (2)  Clears the tty from being controlling the session
1482  *      (3)  Clears the controlling tty for all processes in the
1483  *              session group.
1484  *
1485  *      The argument on_exit is set to 1 if called when a process is
1486  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
1487  *
1488  *      Locking:
1489  *              BKL is taken for hysterical raisins
1490  *                tty_mutex is taken to protect tty
1491  *                ->siglock is taken to protect ->signal/->sighand
1492  *                tasklist_lock is taken to walk process list for sessions
1493  *                  ->siglock is taken to protect ->signal/->sighand
1494  */
1495
1496 void disassociate_ctty(int on_exit)
1497 {
1498         struct tty_struct *tty;
1499         struct pid *tty_pgrp = NULL;
1500
1501         lock_kernel();
1502
1503         mutex_lock(&tty_mutex);
1504         tty = get_current_tty();
1505         if (tty) {
1506                 tty_pgrp = get_pid(tty->pgrp);
1507                 mutex_unlock(&tty_mutex);
1508                 /* XXX: here we race, there is nothing protecting tty */
1509                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1510                         tty_vhangup(tty);
1511         } else if (on_exit) {
1512                 struct pid *old_pgrp;
1513                 spin_lock_irq(&current->sighand->siglock);
1514                 old_pgrp = current->signal->tty_old_pgrp;
1515                 current->signal->tty_old_pgrp = NULL;
1516                 spin_unlock_irq(&current->sighand->siglock);
1517                 if (old_pgrp) {
1518                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
1519                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
1520                         put_pid(old_pgrp);
1521                 }
1522                 mutex_unlock(&tty_mutex);
1523                 unlock_kernel();        
1524                 return;
1525         }
1526         if (tty_pgrp) {
1527                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
1528                 if (!on_exit)
1529                         kill_pgrp(tty_pgrp, SIGCONT, on_exit);
1530                 put_pid(tty_pgrp);
1531         }
1532
1533         spin_lock_irq(&current->sighand->siglock);
1534         put_pid(current->signal->tty_old_pgrp);
1535         current->signal->tty_old_pgrp = NULL;
1536         spin_unlock_irq(&current->sighand->siglock);
1537
1538         mutex_lock(&tty_mutex);
1539         /* It is possible that do_tty_hangup has free'd this tty */
1540         tty = get_current_tty();
1541         if (tty) {
1542                 put_pid(tty->session);
1543                 put_pid(tty->pgrp);
1544                 tty->session = NULL;
1545                 tty->pgrp = NULL;
1546         } else {
1547 #ifdef TTY_DEBUG_HANGUP
1548                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
1549                        " = NULL", tty);
1550 #endif
1551         }
1552         mutex_unlock(&tty_mutex);
1553
1554         /* Now clear signal->tty under the lock */
1555         read_lock(&tasklist_lock);
1556         session_clear_tty(task_session(current));
1557         read_unlock(&tasklist_lock);
1558         unlock_kernel();
1559 }
1560
1561
1562 /**
1563  *      stop_tty        -       propogate flow control
1564  *      @tty: tty to stop
1565  *
1566  *      Perform flow control to the driver. For PTY/TTY pairs we
1567  *      must also propogate the TIOCKPKT status. May be called
1568  *      on an already stopped device and will not re-call the driver
1569  *      method.
1570  *
1571  *      This functionality is used by both the line disciplines for
1572  *      halting incoming flow and by the driver. It may therefore be
1573  *      called from any context, may be under the tty atomic_write_lock
1574  *      but not always.
1575  *
1576  *      Locking:
1577  *              Broken. Relies on BKL which is unsafe here.
1578  */
1579
1580 void stop_tty(struct tty_struct *tty)
1581 {
1582         if (tty->stopped)
1583                 return;
1584         tty->stopped = 1;
1585         if (tty->link && tty->link->packet) {
1586                 tty->ctrl_status &= ~TIOCPKT_START;
1587                 tty->ctrl_status |= TIOCPKT_STOP;
1588                 wake_up_interruptible(&tty->link->read_wait);
1589         }
1590         if (tty->driver->stop)
1591                 (tty->driver->stop)(tty);
1592 }
1593
1594 EXPORT_SYMBOL(stop_tty);
1595
1596 /**
1597  *      start_tty       -       propogate flow control
1598  *      @tty: tty to start
1599  *
1600  *      Start a tty that has been stopped if at all possible. Perform
1601  *      any neccessary wakeups and propogate the TIOCPKT status. If this
1602  *      is the tty was previous stopped and is being started then the
1603  *      driver start method is invoked and the line discipline woken.
1604  *
1605  *      Locking:
1606  *              Broken. Relies on BKL which is unsafe here.
1607  */
1608
1609 void start_tty(struct tty_struct *tty)
1610 {
1611         if (!tty->stopped || tty->flow_stopped)
1612                 return;
1613         tty->stopped = 0;
1614         if (tty->link && tty->link->packet) {
1615                 tty->ctrl_status &= ~TIOCPKT_STOP;
1616                 tty->ctrl_status |= TIOCPKT_START;
1617                 wake_up_interruptible(&tty->link->read_wait);
1618         }
1619         if (tty->driver->start)
1620                 (tty->driver->start)(tty);
1621
1622         /* If we have a running line discipline it may need kicking */
1623         tty_wakeup(tty);
1624 }
1625
1626 EXPORT_SYMBOL(start_tty);
1627
1628 /**
1629  *      tty_read        -       read method for tty device files
1630  *      @file: pointer to tty file
1631  *      @buf: user buffer
1632  *      @count: size of user buffer
1633  *      @ppos: unused
1634  *
1635  *      Perform the read system call function on this terminal device. Checks
1636  *      for hung up devices before calling the line discipline method.
1637  *
1638  *      Locking:
1639  *              Locks the line discipline internally while needed
1640  *              For historical reasons the line discipline read method is
1641  *      invoked under the BKL. This will go away in time so do not rely on it
1642  *      in new code. Multiple read calls may be outstanding in parallel.
1643  */
1644
1645 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1646                         loff_t *ppos)
1647 {
1648         int i;
1649         struct tty_struct * tty;
1650         struct inode *inode;
1651         struct tty_ldisc *ld;
1652
1653         tty = (struct tty_struct *)file->private_data;
1654         inode = file->f_path.dentry->d_inode;
1655         if (tty_paranoia_check(tty, inode, "tty_read"))
1656                 return -EIO;
1657         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1658                 return -EIO;
1659
1660         /* We want to wait for the line discipline to sort out in this
1661            situation */
1662         ld = tty_ldisc_ref_wait(tty);
1663         lock_kernel();
1664         if (ld->read)
1665                 i = (ld->read)(tty,file,buf,count);
1666         else
1667                 i = -EIO;
1668         tty_ldisc_deref(ld);
1669         unlock_kernel();
1670         if (i > 0)
1671                 inode->i_atime = current_fs_time(inode->i_sb);
1672         return i;
1673 }
1674
1675 /*
1676  * Split writes up in sane blocksizes to avoid
1677  * denial-of-service type attacks
1678  */
1679 static inline ssize_t do_tty_write(
1680         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1681         struct tty_struct *tty,
1682         struct file *file,
1683         const char __user *buf,
1684         size_t count)
1685 {
1686         ssize_t ret = 0, written = 0;
1687         unsigned int chunk;
1688         
1689         /* FIXME: O_NDELAY ... */
1690         if (mutex_lock_interruptible(&tty->atomic_write_lock)) {
1691                 return -ERESTARTSYS;
1692         }
1693
1694         /*
1695          * We chunk up writes into a temporary buffer. This
1696          * simplifies low-level drivers immensely, since they
1697          * don't have locking issues and user mode accesses.
1698          *
1699          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1700          * big chunk-size..
1701          *
1702          * The default chunk-size is 2kB, because the NTTY
1703          * layer has problems with bigger chunks. It will
1704          * claim to be able to handle more characters than
1705          * it actually does.
1706          *
1707          * FIXME: This can probably go away now except that 64K chunks
1708          * are too likely to fail unless switched to vmalloc...
1709          */
1710         chunk = 2048;
1711         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1712                 chunk = 65536;
1713         if (count < chunk)
1714                 chunk = count;
1715
1716         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1717         if (tty->write_cnt < chunk) {
1718                 unsigned char *buf;
1719
1720                 if (chunk < 1024)
1721                         chunk = 1024;
1722
1723                 buf = kmalloc(chunk, GFP_KERNEL);
1724                 if (!buf) {
1725                         mutex_unlock(&tty->atomic_write_lock);
1726                         return -ENOMEM;
1727                 }
1728                 kfree(tty->write_buf);
1729                 tty->write_cnt = chunk;
1730                 tty->write_buf = buf;
1731         }
1732
1733         /* Do the write .. */
1734         for (;;) {
1735                 size_t size = count;
1736                 if (size > chunk)
1737                         size = chunk;
1738                 ret = -EFAULT;
1739                 if (copy_from_user(tty->write_buf, buf, size))
1740                         break;
1741                 lock_kernel();
1742                 ret = write(tty, file, tty->write_buf, size);
1743                 unlock_kernel();
1744                 if (ret <= 0)
1745                         break;
1746                 written += ret;
1747                 buf += ret;
1748                 count -= ret;
1749                 if (!count)
1750                         break;
1751                 ret = -ERESTARTSYS;
1752                 if (signal_pending(current))
1753                         break;
1754                 cond_resched();
1755         }
1756         if (written) {
1757                 struct inode *inode = file->f_path.dentry->d_inode;
1758                 inode->i_mtime = current_fs_time(inode->i_sb);
1759                 ret = written;
1760         }
1761         mutex_unlock(&tty->atomic_write_lock);
1762         return ret;
1763 }
1764
1765
1766 /**
1767  *      tty_write               -       write method for tty device file
1768  *      @file: tty file pointer
1769  *      @buf: user data to write
1770  *      @count: bytes to write
1771  *      @ppos: unused
1772  *
1773  *      Write data to a tty device via the line discipline.
1774  *
1775  *      Locking:
1776  *              Locks the line discipline as required
1777  *              Writes to the tty driver are serialized by the atomic_write_lock
1778  *      and are then processed in chunks to the device. The line discipline
1779  *      write method will not be involked in parallel for each device
1780  *              The line discipline write method is called under the big
1781  *      kernel lock for historical reasons. New code should not rely on this.
1782  */
1783
1784 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1785                          loff_t *ppos)
1786 {
1787         struct tty_struct * tty;
1788         struct inode *inode = file->f_path.dentry->d_inode;
1789         ssize_t ret;
1790         struct tty_ldisc *ld;
1791         
1792         tty = (struct tty_struct *)file->private_data;
1793         if (tty_paranoia_check(tty, inode, "tty_write"))
1794                 return -EIO;
1795         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1796                 return -EIO;
1797
1798         ld = tty_ldisc_ref_wait(tty);           
1799         if (!ld->write)
1800                 ret = -EIO;
1801         else
1802                 ret = do_tty_write(ld->write, tty, file, buf, count);
1803         tty_ldisc_deref(ld);
1804         return ret;
1805 }
1806
1807 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1808                          loff_t *ppos)
1809 {
1810         struct file *p = NULL;
1811
1812         spin_lock(&redirect_lock);
1813         if (redirect) {
1814                 get_file(redirect);
1815                 p = redirect;
1816         }
1817         spin_unlock(&redirect_lock);
1818
1819         if (p) {
1820                 ssize_t res;
1821                 res = vfs_write(p, buf, count, &p->f_pos);
1822                 fput(p);
1823                 return res;
1824         }
1825
1826         return tty_write(file, buf, count, ppos);
1827 }
1828
1829 static char ptychar[] = "pqrstuvwxyzabcde";
1830
1831 /**
1832  *      pty_line_name   -       generate name for a pty
1833  *      @driver: the tty driver in use
1834  *      @index: the minor number
1835  *      @p: output buffer of at least 6 bytes
1836  *
1837  *      Generate a name from a driver reference and write it to the output
1838  *      buffer.
1839  *
1840  *      Locking: None
1841  */
1842 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1843 {
1844         int i = index + driver->name_base;
1845         /* ->name is initialized to "ttyp", but "tty" is expected */
1846         sprintf(p, "%s%c%x",
1847                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1848                         ptychar[i >> 4 & 0xf], i & 0xf);
1849 }
1850
1851 /**
1852  *      pty_line_name   -       generate name for a tty
1853  *      @driver: the tty driver in use
1854  *      @index: the minor number
1855  *      @p: output buffer of at least 7 bytes
1856  *
1857  *      Generate a name from a driver reference and write it to the output
1858  *      buffer.
1859  *
1860  *      Locking: None
1861  */
1862 static void tty_line_name(struct tty_driver *driver, int index, char *p)
1863 {
1864         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1865 }
1866
1867 /**
1868  *      init_dev                -       initialise a tty device
1869  *      @driver: tty driver we are opening a device on
1870  *      @idx: device index
1871  *      @tty: returned tty structure
1872  *
1873  *      Prepare a tty device. This may not be a "new" clean device but
1874  *      could also be an active device. The pty drivers require special
1875  *      handling because of this.
1876  *
1877  *      Locking:
1878  *              The function is called under the tty_mutex, which
1879  *      protects us from the tty struct or driver itself going away.
1880  *
1881  *      On exit the tty device has the line discipline attached and
1882  *      a reference count of 1. If a pair was created for pty/tty use
1883  *      and the other was a pty master then it too has a reference count of 1.
1884  *
1885  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1886  * failed open.  The new code protects the open with a mutex, so it's
1887  * really quite straightforward.  The mutex locking can probably be
1888  * relaxed for the (most common) case of reopening a tty.
1889  */
1890
1891 static int init_dev(struct tty_driver *driver, int idx,
1892         struct tty_struct **ret_tty)
1893 {
1894         struct tty_struct *tty, *o_tty;
1895         struct ktermios *tp, **tp_loc, *o_tp, **o_tp_loc;
1896         struct ktermios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
1897         int retval = 0;
1898
1899         /* check whether we're reopening an existing tty */
1900         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1901                 tty = devpts_get_tty(idx);
1902                 /*
1903                  * If we don't have a tty here on a slave open, it's because
1904                  * the master already started the close process and there's
1905                  * no relation between devpts file and tty anymore.
1906                  */
1907                 if (!tty && driver->subtype == PTY_TYPE_SLAVE) {
1908                         retval = -EIO;
1909                         goto end_init;
1910                 }
1911                 /*
1912                  * It's safe from now on because init_dev() is called with
1913                  * tty_mutex held and release_dev() won't change tty->count
1914                  * or tty->flags without having to grab tty_mutex
1915                  */
1916                 if (tty && driver->subtype == PTY_TYPE_MASTER)
1917                         tty = tty->link;
1918         } else {
1919                 tty = driver->ttys[idx];
1920         }
1921         if (tty) goto fast_track;
1922
1923         /*
1924          * First time open is complex, especially for PTY devices.
1925          * This code guarantees that either everything succeeds and the
1926          * TTY is ready for operation, or else the table slots are vacated
1927          * and the allocated memory released.  (Except that the termios 
1928          * and locked termios may be retained.)
1929          */
1930
1931         if (!try_module_get(driver->owner)) {
1932                 retval = -ENODEV;
1933                 goto end_init;
1934         }
1935
1936         o_tty = NULL;
1937         tp = o_tp = NULL;
1938         ltp = o_ltp = NULL;
1939
1940         tty = alloc_tty_struct();
1941         if(!tty)
1942                 goto fail_no_mem;
1943         initialize_tty_struct(tty);
1944         tty->driver = driver;
1945         tty->index = idx;
1946         tty_line_name(driver, idx, tty->name);
1947
1948         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1949                 tp_loc = &tty->termios;
1950                 ltp_loc = &tty->termios_locked;
1951         } else {
1952                 tp_loc = &driver->termios[idx];
1953                 ltp_loc = &driver->termios_locked[idx];
1954         }
1955
1956         if (!*tp_loc) {
1957                 tp = (struct ktermios *) kmalloc(sizeof(struct ktermios),
1958                                                 GFP_KERNEL);
1959                 if (!tp)
1960                         goto free_mem_out;
1961                 *tp = driver->init_termios;
1962         }
1963
1964         if (!*ltp_loc) {
1965                 ltp = (struct ktermios *) kmalloc(sizeof(struct ktermios),
1966                                                  GFP_KERNEL);
1967                 if (!ltp)
1968                         goto free_mem_out;
1969                 memset(ltp, 0, sizeof(struct ktermios));
1970         }
1971
1972         if (driver->type == TTY_DRIVER_TYPE_PTY) {
1973                 o_tty = alloc_tty_struct();
1974                 if (!o_tty)
1975                         goto free_mem_out;
1976                 initialize_tty_struct(o_tty);
1977                 o_tty->driver = driver->other;
1978                 o_tty->index = idx;
1979                 tty_line_name(driver->other, idx, o_tty->name);
1980
1981                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1982                         o_tp_loc = &o_tty->termios;
1983                         o_ltp_loc = &o_tty->termios_locked;
1984                 } else {
1985                         o_tp_loc = &driver->other->termios[idx];
1986                         o_ltp_loc = &driver->other->termios_locked[idx];
1987                 }
1988
1989                 if (!*o_tp_loc) {
1990                         o_tp = (struct ktermios *)
1991                                 kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1992                         if (!o_tp)
1993                                 goto free_mem_out;
1994                         *o_tp = driver->other->init_termios;
1995                 }
1996
1997                 if (!*o_ltp_loc) {
1998                         o_ltp = (struct ktermios *)
1999                                 kmalloc(sizeof(struct ktermios), GFP_KERNEL);
2000                         if (!o_ltp)
2001                                 goto free_mem_out;
2002                         memset(o_ltp, 0, sizeof(struct ktermios));
2003                 }
2004
2005                 /*
2006                  * Everything allocated ... set up the o_tty structure.
2007                  */
2008                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
2009                         driver->other->ttys[idx] = o_tty;
2010                 }
2011                 if (!*o_tp_loc)
2012                         *o_tp_loc = o_tp;
2013                 if (!*o_ltp_loc)
2014                         *o_ltp_loc = o_ltp;
2015                 o_tty->termios = *o_tp_loc;
2016                 o_tty->termios_locked = *o_ltp_loc;
2017                 driver->other->refcount++;
2018                 if (driver->subtype == PTY_TYPE_MASTER)
2019                         o_tty->count++;
2020
2021                 /* Establish the links in both directions */
2022                 tty->link   = o_tty;
2023                 o_tty->link = tty;
2024         }
2025
2026         /* 
2027          * All structures have been allocated, so now we install them.
2028          * Failures after this point use release_tty to clean up, so
2029          * there's no need to null out the local pointers.
2030          */
2031         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2032                 driver->ttys[idx] = tty;
2033         }
2034         
2035         if (!*tp_loc)
2036                 *tp_loc = tp;
2037         if (!*ltp_loc)
2038                 *ltp_loc = ltp;
2039         tty->termios = *tp_loc;
2040         tty->termios_locked = *ltp_loc;
2041         /* Compatibility until drivers always set this */
2042         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
2043         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
2044         driver->refcount++;
2045         tty->count++;
2046
2047         /* 
2048          * Structures all installed ... call the ldisc open routines.
2049          * If we fail here just call release_tty to clean up.  No need
2050          * to decrement the use counts, as release_tty doesn't care.
2051          */
2052
2053         if (tty->ldisc.open) {
2054                 retval = (tty->ldisc.open)(tty);
2055                 if (retval)
2056                         goto release_mem_out;
2057         }
2058         if (o_tty && o_tty->ldisc.open) {
2059                 retval = (o_tty->ldisc.open)(o_tty);
2060                 if (retval) {
2061                         if (tty->ldisc.close)
2062                                 (tty->ldisc.close)(tty);
2063                         goto release_mem_out;
2064                 }
2065                 tty_ldisc_enable(o_tty);
2066         }
2067         tty_ldisc_enable(tty);
2068         goto success;
2069
2070         /*
2071          * This fast open can be used if the tty is already open.
2072          * No memory is allocated, and the only failures are from
2073          * attempting to open a closing tty or attempting multiple
2074          * opens on a pty master.
2075          */
2076 fast_track:
2077         if (test_bit(TTY_CLOSING, &tty->flags)) {
2078                 retval = -EIO;
2079                 goto end_init;
2080         }
2081         if (driver->type == TTY_DRIVER_TYPE_PTY &&
2082             driver->subtype == PTY_TYPE_MASTER) {
2083                 /*
2084                  * special case for PTY masters: only one open permitted, 
2085                  * and the slave side open count is incremented as well.
2086                  */
2087                 if (tty->count) {
2088                         retval = -EIO;
2089                         goto end_init;
2090                 }
2091                 tty->link->count++;
2092         }
2093         tty->count++;
2094         tty->driver = driver; /* N.B. why do this every time?? */
2095
2096         /* FIXME */
2097         if(!test_bit(TTY_LDISC, &tty->flags))
2098                 printk(KERN_ERR "init_dev but no ldisc\n");
2099 success:
2100         *ret_tty = tty;
2101         
2102         /* All paths come through here to release the mutex */
2103 end_init:
2104         return retval;
2105
2106         /* Release locally allocated memory ... nothing placed in slots */
2107 free_mem_out:
2108         kfree(o_tp);
2109         if (o_tty)
2110                 free_tty_struct(o_tty);
2111         kfree(ltp);
2112         kfree(tp);
2113         free_tty_struct(tty);
2114
2115 fail_no_mem:
2116         module_put(driver->owner);
2117         retval = -ENOMEM;
2118         goto end_init;
2119
2120         /* call the tty release_tty routine to clean out this slot */
2121 release_mem_out:
2122         if (printk_ratelimit())
2123                 printk(KERN_INFO "init_dev: ldisc open failed, "
2124                                  "clearing slot %d\n", idx);
2125         release_tty(tty, idx);
2126         goto end_init;
2127 }
2128
2129 /**
2130  *      release_one_tty         -       release tty structure memory
2131  *
2132  *      Releases memory associated with a tty structure, and clears out the
2133  *      driver table slots. This function is called when a device is no longer
2134  *      in use. It also gets called when setup of a device fails.
2135  *
2136  *      Locking:
2137  *              tty_mutex - sometimes only
2138  *              takes the file list lock internally when working on the list
2139  *      of ttys that the driver keeps.
2140  *              FIXME: should we require tty_mutex is held here ??
2141  */
2142 static void release_one_tty(struct tty_struct *tty, int idx)
2143 {
2144         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
2145         struct ktermios *tp;
2146
2147         if (!devpts)
2148                 tty->driver->ttys[idx] = NULL;
2149
2150         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
2151                 tp = tty->termios;
2152                 if (!devpts)
2153                         tty->driver->termios[idx] = NULL;
2154                 kfree(tp);
2155
2156                 tp = tty->termios_locked;
2157                 if (!devpts)
2158                         tty->driver->termios_locked[idx] = NULL;
2159                 kfree(tp);
2160         }
2161
2162
2163         tty->magic = 0;
2164         tty->driver->refcount--;
2165
2166         file_list_lock();
2167         list_del_init(&tty->tty_files);
2168         file_list_unlock();
2169
2170         free_tty_struct(tty);
2171 }
2172
2173 /**
2174  *      release_tty             -       release tty structure memory
2175  *
2176  *      Release both @tty and a possible linked partner (think pty pair),
2177  *      and decrement the refcount of the backing module.
2178  *
2179  *      Locking:
2180  *              tty_mutex - sometimes only
2181  *              takes the file list lock internally when working on the list
2182  *      of ttys that the driver keeps.
2183  *              FIXME: should we require tty_mutex is held here ??
2184  */
2185 static void release_tty(struct tty_struct *tty, int idx)
2186 {
2187         struct tty_driver *driver = tty->driver;
2188
2189         if (tty->link)
2190                 release_one_tty(tty->link, idx);
2191         release_one_tty(tty, idx);
2192         module_put(driver->owner);
2193 }
2194
2195 /*
2196  * Even releasing the tty structures is a tricky business.. We have
2197  * to be very careful that the structures are all released at the
2198  * same time, as interrupts might otherwise get the wrong pointers.
2199  *
2200  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
2201  * lead to double frees or releasing memory still in use.
2202  */
2203 static void release_dev(struct file * filp)
2204 {
2205         struct tty_struct *tty, *o_tty;
2206         int     pty_master, tty_closing, o_tty_closing, do_sleep;
2207         int     devpts;
2208         int     idx;
2209         char    buf[64];
2210         unsigned long flags;
2211         
2212         tty = (struct tty_struct *)filp->private_data;
2213         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "release_dev"))
2214                 return;
2215
2216         check_tty_count(tty, "release_dev");
2217
2218         tty_fasync(-1, filp, 0);
2219
2220         idx = tty->index;
2221         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2222                       tty->driver->subtype == PTY_TYPE_MASTER);
2223         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
2224         o_tty = tty->link;
2225
2226 #ifdef TTY_PARANOIA_CHECK
2227         if (idx < 0 || idx >= tty->driver->num) {
2228                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
2229                                   "free (%s)\n", tty->name);
2230                 return;
2231         }
2232         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2233                 if (tty != tty->driver->ttys[idx]) {
2234                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
2235                                "for (%s)\n", idx, tty->name);
2236                         return;
2237                 }
2238                 if (tty->termios != tty->driver->termios[idx]) {
2239                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
2240                                "for (%s)\n",
2241                                idx, tty->name);
2242                         return;
2243                 }
2244                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
2245                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
2246                                "termios_locked for (%s)\n",
2247                                idx, tty->name);
2248                         return;
2249                 }
2250         }
2251 #endif
2252
2253 #ifdef TTY_DEBUG_HANGUP
2254         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
2255                tty_name(tty, buf), tty->count);
2256 #endif
2257
2258 #ifdef TTY_PARANOIA_CHECK
2259         if (tty->driver->other &&
2260              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2261                 if (o_tty != tty->driver->other->ttys[idx]) {
2262                         printk(KERN_DEBUG "release_dev: other->table[%d] "
2263                                           "not o_tty for (%s)\n",
2264                                idx, tty->name);
2265                         return;
2266                 }
2267                 if (o_tty->termios != tty->driver->other->termios[idx]) {
2268                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
2269                                           "not o_termios for (%s)\n",
2270                                idx, tty->name);
2271                         return;
2272                 }
2273                 if (o_tty->termios_locked != 
2274                       tty->driver->other->termios_locked[idx]) {
2275                         printk(KERN_DEBUG "release_dev: other->termios_locked["
2276                                           "%d] not o_termios_locked for (%s)\n",
2277                                idx, tty->name);
2278                         return;
2279                 }
2280                 if (o_tty->link != tty) {
2281                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
2282                         return;
2283                 }
2284         }
2285 #endif
2286         if (tty->driver->close)
2287                 tty->driver->close(tty, filp);
2288
2289         /*
2290          * Sanity check: if tty->count is going to zero, there shouldn't be
2291          * any waiters on tty->read_wait or tty->write_wait.  We test the
2292          * wait queues and kick everyone out _before_ actually starting to
2293          * close.  This ensures that we won't block while releasing the tty
2294          * structure.
2295          *
2296          * The test for the o_tty closing is necessary, since the master and
2297          * slave sides may close in any order.  If the slave side closes out
2298          * first, its count will be one, since the master side holds an open.
2299          * Thus this test wouldn't be triggered at the time the slave closes,
2300          * so we do it now.
2301          *
2302          * Note that it's possible for the tty to be opened again while we're
2303          * flushing out waiters.  By recalculating the closing flags before
2304          * each iteration we avoid any problems.
2305          */
2306         while (1) {
2307                 /* Guard against races with tty->count changes elsewhere and
2308                    opens on /dev/tty */
2309                    
2310                 mutex_lock(&tty_mutex);
2311                 tty_closing = tty->count <= 1;
2312                 o_tty_closing = o_tty &&
2313                         (o_tty->count <= (pty_master ? 1 : 0));
2314                 do_sleep = 0;
2315
2316                 if (tty_closing) {
2317                         if (waitqueue_active(&tty->read_wait)) {
2318                                 wake_up(&tty->read_wait);
2319                                 do_sleep++;
2320                         }
2321                         if (waitqueue_active(&tty->write_wait)) {
2322                                 wake_up(&tty->write_wait);
2323                                 do_sleep++;
2324                         }
2325                 }
2326                 if (o_tty_closing) {
2327                         if (waitqueue_active(&o_tty->read_wait)) {
2328                                 wake_up(&o_tty->read_wait);
2329                                 do_sleep++;
2330                         }
2331                         if (waitqueue_active(&o_tty->write_wait)) {
2332                                 wake_up(&o_tty->write_wait);
2333                                 do_sleep++;
2334                         }
2335                 }
2336                 if (!do_sleep)
2337                         break;
2338
2339                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
2340                                     "active!\n", tty_name(tty, buf));
2341                 mutex_unlock(&tty_mutex);
2342                 schedule();
2343         }       
2344
2345         /*
2346          * The closing flags are now consistent with the open counts on 
2347          * both sides, and we've completed the last operation that could 
2348          * block, so it's safe to proceed with closing.
2349          */
2350         if (pty_master) {
2351                 if (--o_tty->count < 0) {
2352                         printk(KERN_WARNING "release_dev: bad pty slave count "
2353                                             "(%d) for %s\n",
2354                                o_tty->count, tty_name(o_tty, buf));
2355                         o_tty->count = 0;
2356                 }
2357         }
2358         if (--tty->count < 0) {
2359                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
2360                        tty->count, tty_name(tty, buf));
2361                 tty->count = 0;
2362         }
2363         
2364         /*
2365          * We've decremented tty->count, so we need to remove this file
2366          * descriptor off the tty->tty_files list; this serves two
2367          * purposes:
2368          *  - check_tty_count sees the correct number of file descriptors
2369          *    associated with this tty.
2370          *  - do_tty_hangup no longer sees this file descriptor as
2371          *    something that needs to be handled for hangups.
2372          */
2373         file_kill(filp);
2374         filp->private_data = NULL;
2375
2376         /*
2377          * Perform some housekeeping before deciding whether to return.
2378          *
2379          * Set the TTY_CLOSING flag if this was the last open.  In the
2380          * case of a pty we may have to wait around for the other side
2381          * to close, and TTY_CLOSING makes sure we can't be reopened.
2382          */
2383         if(tty_closing)
2384                 set_bit(TTY_CLOSING, &tty->flags);
2385         if(o_tty_closing)
2386                 set_bit(TTY_CLOSING, &o_tty->flags);
2387
2388         /*
2389          * If _either_ side is closing, make sure there aren't any
2390          * processes that still think tty or o_tty is their controlling
2391          * tty.
2392          */
2393         if (tty_closing || o_tty_closing) {
2394                 read_lock(&tasklist_lock);
2395                 session_clear_tty(tty->session);
2396                 if (o_tty)
2397                         session_clear_tty(o_tty->session);
2398                 read_unlock(&tasklist_lock);
2399         }
2400
2401         mutex_unlock(&tty_mutex);
2402
2403         /* check whether both sides are closing ... */
2404         if (!tty_closing || (o_tty && !o_tty_closing))
2405                 return;
2406         
2407 #ifdef TTY_DEBUG_HANGUP
2408         printk(KERN_DEBUG "freeing tty structure...");
2409 #endif
2410         /*
2411          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
2412          * kill any delayed work. As this is the final close it does not
2413          * race with the set_ldisc code path.
2414          */
2415         clear_bit(TTY_LDISC, &tty->flags);
2416         cancel_delayed_work(&tty->buf.work);
2417
2418         /*
2419          * Wait for ->hangup_work and ->buf.work handlers to terminate
2420          */
2421          
2422         flush_scheduled_work();
2423         
2424         /*
2425          * Wait for any short term users (we know they are just driver
2426          * side waiters as the file is closing so user count on the file
2427          * side is zero.
2428          */
2429         spin_lock_irqsave(&tty_ldisc_lock, flags);
2430         while(tty->ldisc.refcount)
2431         {
2432                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
2433                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
2434                 spin_lock_irqsave(&tty_ldisc_lock, flags);
2435         }
2436         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
2437         /*
2438          * Shutdown the current line discipline, and reset it to N_TTY.
2439          * N.B. why reset ldisc when we're releasing the memory??
2440          *
2441          * FIXME: this MUST get fixed for the new reflocking
2442          */
2443         if (tty->ldisc.close)
2444                 (tty->ldisc.close)(tty);
2445         tty_ldisc_put(tty->ldisc.num);
2446         
2447         /*
2448          *      Switch the line discipline back
2449          */
2450         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2451         tty_set_termios_ldisc(tty,N_TTY); 
2452         if (o_tty) {
2453                 /* FIXME: could o_tty be in setldisc here ? */
2454                 clear_bit(TTY_LDISC, &o_tty->flags);
2455                 if (o_tty->ldisc.close)
2456                         (o_tty->ldisc.close)(o_tty);
2457                 tty_ldisc_put(o_tty->ldisc.num);
2458                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
2459                 tty_set_termios_ldisc(o_tty,N_TTY); 
2460         }
2461         /*
2462          * The release_tty function takes care of the details of clearing
2463          * the slots and preserving the termios structure.
2464          */
2465         release_tty(tty, idx);
2466
2467 #ifdef CONFIG_UNIX98_PTYS
2468         /* Make this pty number available for reallocation */
2469         if (devpts) {
2470                 down(&allocated_ptys_lock);
2471                 idr_remove(&allocated_ptys, idx);
2472                 up(&allocated_ptys_lock);
2473         }
2474 #endif
2475
2476 }
2477
2478 /**
2479  *      tty_open                -       open a tty device
2480  *      @inode: inode of device file
2481  *      @filp: file pointer to tty
2482  *
2483  *      tty_open and tty_release keep up the tty count that contains the
2484  *      number of opens done on a tty. We cannot use the inode-count, as
2485  *      different inodes might point to the same tty.
2486  *
2487  *      Open-counting is needed for pty masters, as well as for keeping
2488  *      track of serial lines: DTR is dropped when the last close happens.
2489  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
2490  *
2491  *      The termios state of a pty is reset on first open so that
2492  *      settings don't persist across reuse.
2493  *
2494  *      Locking: tty_mutex protects tty, get_tty_driver and init_dev work.
2495  *               tty->count should protect the rest.
2496  *               ->siglock protects ->signal/->sighand
2497  */
2498
2499 static int tty_open(struct inode * inode, struct file * filp)
2500 {
2501         struct tty_struct *tty;
2502         int noctty, retval;
2503         struct tty_driver *driver;
2504         int index;
2505         dev_t device = inode->i_rdev;
2506         unsigned short saved_flags = filp->f_flags;
2507
2508         nonseekable_open(inode, filp);
2509         
2510 retry_open:
2511         noctty = filp->f_flags & O_NOCTTY;
2512         index  = -1;
2513         retval = 0;
2514         
2515         mutex_lock(&tty_mutex);
2516
2517         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2518                 tty = get_current_tty();
2519                 if (!tty) {
2520                         mutex_unlock(&tty_mutex);
2521                         return -ENXIO;
2522                 }
2523                 driver = tty->driver;
2524                 index = tty->index;
2525                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2526                 /* noctty = 1; */
2527                 goto got_driver;
2528         }
2529 #ifdef CONFIG_VT
2530         if (device == MKDEV(TTY_MAJOR,0)) {
2531                 extern struct tty_driver *console_driver;
2532                 driver = console_driver;
2533                 index = fg_console;
2534                 noctty = 1;
2535                 goto got_driver;
2536         }
2537 #endif
2538         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2539                 driver = console_device(&index);
2540                 if (driver) {
2541                         /* Don't let /dev/console block */
2542                         filp->f_flags |= O_NONBLOCK;
2543                         noctty = 1;
2544                         goto got_driver;
2545                 }
2546                 mutex_unlock(&tty_mutex);
2547                 return -ENODEV;
2548         }
2549
2550         driver = get_tty_driver(device, &index);
2551         if (!driver) {
2552                 mutex_unlock(&tty_mutex);
2553                 return -ENODEV;
2554         }
2555 got_driver:
2556         retval = init_dev(driver, index, &tty);
2557         mutex_unlock(&tty_mutex);
2558         if (retval)
2559                 return retval;
2560
2561         filp->private_data = tty;
2562         file_move(filp, &tty->tty_files);
2563         check_tty_count(tty, "tty_open");
2564         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2565             tty->driver->subtype == PTY_TYPE_MASTER)
2566                 noctty = 1;
2567 #ifdef TTY_DEBUG_HANGUP
2568         printk(KERN_DEBUG "opening %s...", tty->name);
2569 #endif
2570         if (!retval) {
2571                 if (tty->driver->open)
2572                         retval = tty->driver->open(tty, filp);
2573                 else
2574                         retval = -ENODEV;
2575         }
2576         filp->f_flags = saved_flags;
2577
2578         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2579                 retval = -EBUSY;
2580
2581         if (retval) {
2582 #ifdef TTY_DEBUG_HANGUP
2583                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2584                        tty->name);
2585 #endif
2586                 release_dev(filp);
2587                 if (retval != -ERESTARTSYS)
2588                         return retval;
2589                 if (signal_pending(current))
2590                         return retval;
2591                 schedule();
2592                 /*
2593                  * Need to reset f_op in case a hangup happened.
2594                  */
2595                 if (filp->f_op == &hung_up_tty_fops)
2596                         filp->f_op = &tty_fops;
2597                 goto retry_open;
2598         }
2599
2600         mutex_lock(&tty_mutex);
2601         spin_lock_irq(&current->sighand->siglock);
2602         if (!noctty &&
2603             current->signal->leader &&
2604             !current->signal->tty &&
2605             tty->session == NULL)
2606                 __proc_set_tty(current, tty);
2607         spin_unlock_irq(&current->sighand->siglock);
2608         mutex_unlock(&tty_mutex);
2609         return 0;
2610 }
2611
2612 #ifdef CONFIG_UNIX98_PTYS
2613 /**
2614  *      ptmx_open               -       open a unix 98 pty master
2615  *      @inode: inode of device file
2616  *      @filp: file pointer to tty
2617  *
2618  *      Allocate a unix98 pty master device from the ptmx driver.
2619  *
2620  *      Locking: tty_mutex protects theinit_dev work. tty->count should
2621                 protect the rest.
2622  *              allocated_ptys_lock handles the list of free pty numbers
2623  */
2624
2625 static int ptmx_open(struct inode * inode, struct file * filp)
2626 {
2627         struct tty_struct *tty;
2628         int retval;
2629         int index;
2630         int idr_ret;
2631
2632         nonseekable_open(inode, filp);
2633
2634         /* find a device that is not in use. */
2635         down(&allocated_ptys_lock);
2636         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2637                 up(&allocated_ptys_lock);
2638                 return -ENOMEM;
2639         }
2640         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2641         if (idr_ret < 0) {
2642                 up(&allocated_ptys_lock);
2643                 if (idr_ret == -EAGAIN)
2644                         return -ENOMEM;
2645                 return -EIO;
2646         }
2647         if (index >= pty_limit) {
2648                 idr_remove(&allocated_ptys, index);
2649                 up(&allocated_ptys_lock);
2650                 return -EIO;
2651         }
2652         up(&allocated_ptys_lock);
2653
2654         mutex_lock(&tty_mutex);
2655         retval = init_dev(ptm_driver, index, &tty);
2656         mutex_unlock(&tty_mutex);
2657         
2658         if (retval)
2659                 goto out;
2660
2661         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2662         filp->private_data = tty;
2663         file_move(filp, &tty->tty_files);
2664
2665         retval = -ENOMEM;
2666         if (devpts_pty_new(tty->link))
2667                 goto out1;
2668
2669         check_tty_count(tty, "tty_open");
2670         retval = ptm_driver->open(tty, filp);
2671         if (!retval)
2672                 return 0;
2673 out1:
2674         release_dev(filp);
2675         return retval;
2676 out:
2677         down(&allocated_ptys_lock);
2678         idr_remove(&allocated_ptys, index);
2679         up(&allocated_ptys_lock);
2680         return retval;
2681 }
2682 #endif
2683
2684 /**
2685  *      tty_release             -       vfs callback for close
2686  *      @inode: inode of tty
2687  *      @filp: file pointer for handle to tty
2688  *
2689  *      Called the last time each file handle is closed that references
2690  *      this tty. There may however be several such references.
2691  *
2692  *      Locking:
2693  *              Takes bkl. See release_dev
2694  */
2695
2696 static int tty_release(struct inode * inode, struct file * filp)
2697 {
2698         lock_kernel();
2699         release_dev(filp);
2700         unlock_kernel();
2701         return 0;
2702 }
2703
2704 /**
2705  *      tty_poll        -       check tty status
2706  *      @filp: file being polled
2707  *      @wait: poll wait structures to update
2708  *
2709  *      Call the line discipline polling method to obtain the poll
2710  *      status of the device.
2711  *
2712  *      Locking: locks called line discipline but ldisc poll method
2713  *      may be re-entered freely by other callers.
2714  */
2715
2716 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2717 {
2718         struct tty_struct * tty;
2719         struct tty_ldisc *ld;
2720         int ret = 0;
2721
2722         tty = (struct tty_struct *)filp->private_data;
2723         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2724                 return 0;
2725                 
2726         ld = tty_ldisc_ref_wait(tty);
2727         if (ld->poll)
2728                 ret = (ld->poll)(tty, filp, wait);
2729         tty_ldisc_deref(ld);
2730         return ret;
2731 }
2732
2733 static int tty_fasync(int fd, struct file * filp, int on)
2734 {
2735         struct tty_struct * tty;
2736         int retval;
2737
2738         tty = (struct tty_struct *)filp->private_data;
2739         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2740                 return 0;
2741         
2742         retval = fasync_helper(fd, filp, on, &tty->fasync);
2743         if (retval <= 0)
2744                 return retval;
2745
2746         if (on) {
2747                 enum pid_type type;
2748                 struct pid *pid;
2749                 if (!waitqueue_active(&tty->read_wait))
2750                         tty->minimum_to_wake = 1;
2751                 if (tty->pgrp) {
2752                         pid = tty->pgrp;
2753                         type = PIDTYPE_PGID;
2754                 } else {
2755                         pid = task_pid(current);
2756                         type = PIDTYPE_PID;
2757                 }
2758                 retval = __f_setown(filp, pid, type, 0);
2759                 if (retval)
2760                         return retval;
2761         } else {
2762                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2763                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2764         }
2765         return 0;
2766 }
2767
2768 /**
2769  *      tiocsti                 -       fake input character
2770  *      @tty: tty to fake input into
2771  *      @p: pointer to character
2772  *
2773  *      Fake input to a tty device. Does the neccessary locking and
2774  *      input management.
2775  *
2776  *      FIXME: does not honour flow control ??
2777  *
2778  *      Locking:
2779  *              Called functions take tty_ldisc_lock
2780  *              current->signal->tty check is safe without locks
2781  *
2782  *      FIXME: may race normal receive processing
2783  */
2784
2785 static int tiocsti(struct tty_struct *tty, char __user *p)
2786 {
2787         char ch, mbz = 0;
2788         struct tty_ldisc *ld;
2789         
2790         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2791                 return -EPERM;
2792         if (get_user(ch, p))
2793                 return -EFAULT;
2794         ld = tty_ldisc_ref_wait(tty);
2795         ld->receive_buf(tty, &ch, &mbz, 1);
2796         tty_ldisc_deref(ld);
2797         return 0;
2798 }
2799
2800 /**
2801  *      tiocgwinsz              -       implement window query ioctl
2802  *      @tty; tty
2803  *      @arg: user buffer for result
2804  *
2805  *      Copies the kernel idea of the window size into the user buffer.
2806  *
2807  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2808  *              is consistent.
2809  */
2810
2811 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2812 {
2813         int err;
2814
2815         mutex_lock(&tty->termios_mutex);
2816         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2817         mutex_unlock(&tty->termios_mutex);
2818
2819         return err ? -EFAULT: 0;
2820 }
2821
2822 /**
2823  *      tiocswinsz              -       implement window size set ioctl
2824  *      @tty; tty
2825  *      @arg: user buffer for result
2826  *
2827  *      Copies the user idea of the window size to the kernel. Traditionally
2828  *      this is just advisory information but for the Linux console it
2829  *      actually has driver level meaning and triggers a VC resize.
2830  *
2831  *      Locking:
2832  *              Called function use the console_sem is used to ensure we do
2833  *      not try and resize the console twice at once.
2834  *              The tty->termios_mutex is used to ensure we don't double
2835  *      resize and get confused. Lock order - tty->termios_mutex before
2836  *      console sem
2837  */
2838
2839 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2840         struct winsize __user * arg)
2841 {
2842         struct winsize tmp_ws;
2843
2844         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2845                 return -EFAULT;
2846
2847         mutex_lock(&tty->termios_mutex);
2848         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2849                 goto done;
2850
2851 #ifdef CONFIG_VT
2852         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2853                 if (vc_lock_resize(tty->driver_data, tmp_ws.ws_col,
2854                                         tmp_ws.ws_row)) {
2855                         mutex_unlock(&tty->termios_mutex);
2856                         return -ENXIO;
2857                 }
2858         }
2859 #endif
2860         if (tty->pgrp)
2861                 kill_pgrp(tty->pgrp, SIGWINCH, 1);
2862         if ((real_tty->pgrp != tty->pgrp) && real_tty->pgrp)
2863                 kill_pgrp(real_tty->pgrp, SIGWINCH, 1);
2864         tty->winsize = tmp_ws;
2865         real_tty->winsize = tmp_ws;
2866 done:
2867         mutex_unlock(&tty->termios_mutex);
2868         return 0;
2869 }
2870
2871 /**
2872  *      tioccons        -       allow admin to move logical console
2873  *      @file: the file to become console
2874  *
2875  *      Allow the adminstrator to move the redirected console device
2876  *
2877  *      Locking: uses redirect_lock to guard the redirect information
2878  */
2879
2880 static int tioccons(struct file *file)
2881 {
2882         if (!capable(CAP_SYS_ADMIN))
2883                 return -EPERM;
2884         if (file->f_op->write == redirected_tty_write) {
2885                 struct file *f;
2886                 spin_lock(&redirect_lock);
2887                 f = redirect;
2888                 redirect = NULL;
2889                 spin_unlock(&redirect_lock);
2890                 if (f)
2891                         fput(f);
2892                 return 0;
2893         }
2894         spin_lock(&redirect_lock);
2895         if (redirect) {
2896                 spin_unlock(&redirect_lock);
2897                 return -EBUSY;
2898         }
2899         get_file(file);
2900         redirect = file;
2901         spin_unlock(&redirect_lock);
2902         return 0;
2903 }
2904
2905 /**
2906  *      fionbio         -       non blocking ioctl
2907  *      @file: file to set blocking value
2908  *      @p: user parameter
2909  *
2910  *      Historical tty interfaces had a blocking control ioctl before
2911  *      the generic functionality existed. This piece of history is preserved
2912  *      in the expected tty API of posix OS's.
2913  *
2914  *      Locking: none, the open fle handle ensures it won't go away.
2915  */
2916
2917 static int fionbio(struct file *file, int __user *p)
2918 {
2919         int nonblock;
2920
2921         if (get_user(nonblock, p))
2922                 return -EFAULT;
2923
2924         if (nonblock)
2925                 file->f_flags |= O_NONBLOCK;
2926         else
2927                 file->f_flags &= ~O_NONBLOCK;
2928         return 0;
2929 }
2930
2931 /**
2932  *      tiocsctty       -       set controlling tty
2933  *      @tty: tty structure
2934  *      @arg: user argument
2935  *
2936  *      This ioctl is used to manage job control. It permits a session
2937  *      leader to set this tty as the controlling tty for the session.
2938  *
2939  *      Locking:
2940  *              Takes tty_mutex() to protect tty instance
2941  *              Takes tasklist_lock internally to walk sessions
2942  *              Takes ->siglock() when updating signal->tty
2943  */
2944
2945 static int tiocsctty(struct tty_struct *tty, int arg)
2946 {
2947         int ret = 0;
2948         if (current->signal->leader && (task_session(current) == tty->session))
2949                 return ret;
2950
2951         mutex_lock(&tty_mutex);
2952         /*
2953          * The process must be a session leader and
2954          * not have a controlling tty already.
2955          */
2956         if (!current->signal->leader || current->signal->tty) {
2957                 ret = -EPERM;
2958                 goto unlock;
2959         }
2960
2961         if (tty->session) {
2962                 /*
2963                  * This tty is already the controlling
2964                  * tty for another session group!
2965                  */
2966                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
2967                         /*
2968                          * Steal it away
2969                          */
2970                         read_lock(&tasklist_lock);
2971                         session_clear_tty(tty->session);
2972                         read_unlock(&tasklist_lock);
2973                 } else {
2974                         ret = -EPERM;
2975                         goto unlock;
2976                 }
2977         }
2978         proc_set_tty(current, tty);
2979 unlock:
2980         mutex_unlock(&tty_mutex);
2981         return ret;
2982 }
2983
2984 /**
2985  *      tiocgpgrp               -       get process group
2986  *      @tty: tty passed by user
2987  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
2988  *      @p: returned pid
2989  *
2990  *      Obtain the process group of the tty. If there is no process group
2991  *      return an error.
2992  *
2993  *      Locking: none. Reference to current->signal->tty is safe.
2994  */
2995
2996 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2997 {
2998         /*
2999          * (tty == real_tty) is a cheap way of
3000          * testing if the tty is NOT a master pty.
3001          */
3002         if (tty == real_tty && current->signal->tty != real_tty)
3003                 return -ENOTTY;
3004         return put_user(pid_nr(real_tty->pgrp), p);
3005 }
3006
3007 /**
3008  *      tiocspgrp               -       attempt to set process group
3009  *      @tty: tty passed by user
3010  *      @real_tty: tty side device matching tty passed by user
3011  *      @p: pid pointer
3012  *
3013  *      Set the process group of the tty to the session passed. Only
3014  *      permitted where the tty session is our session.
3015  *
3016  *      Locking: None
3017  */
3018
3019 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3020 {
3021         struct pid *pgrp;
3022         pid_t pgrp_nr;
3023         int retval = tty_check_change(real_tty);
3024
3025         if (retval == -EIO)
3026                 return -ENOTTY;
3027         if (retval)
3028                 return retval;
3029         if (!current->signal->tty ||
3030             (current->signal->tty != real_tty) ||
3031             (real_tty->session != task_session(current)))
3032                 return -ENOTTY;
3033         if (get_user(pgrp_nr, p))
3034                 return -EFAULT;
3035         if (pgrp_nr < 0)
3036                 return -EINVAL;
3037         rcu_read_lock();
3038         pgrp = find_pid(pgrp_nr);
3039         retval = -ESRCH;
3040         if (!pgrp)
3041                 goto out_unlock;
3042         retval = -EPERM;
3043         if (session_of_pgrp(pgrp) != task_session(current))
3044                 goto out_unlock;
3045         retval = 0;
3046         put_pid(real_tty->pgrp);
3047         real_tty->pgrp = get_pid(pgrp);
3048 out_unlock:
3049         rcu_read_unlock();
3050         return retval;
3051 }
3052
3053 /**
3054  *      tiocgsid                -       get session id
3055  *      @tty: tty passed by user
3056  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
3057  *      @p: pointer to returned session id
3058  *
3059  *      Obtain the session id of the tty. If there is no session
3060  *      return an error.
3061  *
3062  *      Locking: none. Reference to current->signal->tty is safe.
3063  */
3064
3065 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3066 {
3067         /*
3068          * (tty == real_tty) is a cheap way of
3069          * testing if the tty is NOT a master pty.
3070         */
3071         if (tty == real_tty && current->signal->tty != real_tty)
3072                 return -ENOTTY;
3073         if (!real_tty->session)
3074                 return -ENOTTY;
3075         return put_user(pid_nr(real_tty->session), p);
3076 }
3077
3078 /**
3079  *      tiocsetd        -       set line discipline
3080  *      @tty: tty device
3081  *      @p: pointer to user data
3082  *
3083  *      Set the line discipline according to user request.
3084  *
3085  *      Locking: see tty_set_ldisc, this function is just a helper
3086  */
3087
3088 static int tiocsetd(struct tty_struct *tty, int __user *p)
3089 {
3090         int ldisc;
3091
3092         if (get_user(ldisc, p))
3093                 return -EFAULT;
3094         return tty_set_ldisc(tty, ldisc);
3095 }
3096
3097 /**
3098  *      send_break      -       performed time break
3099  *      @tty: device to break on
3100  *      @duration: timeout in mS
3101  *
3102  *      Perform a timed break on hardware that lacks its own driver level
3103  *      timed break functionality.
3104  *
3105  *      Locking:
3106  *              atomic_write_lock serializes
3107  *
3108  */
3109
3110 static int send_break(struct tty_struct *tty, unsigned int duration)
3111 {
3112         if (mutex_lock_interruptible(&tty->atomic_write_lock))
3113                 return -EINTR;
3114         tty->driver->break_ctl(tty, -1);
3115         if (!signal_pending(current)) {
3116                 msleep_interruptible(duration);
3117         }
3118         tty->driver->break_ctl(tty, 0);
3119         mutex_unlock(&tty->atomic_write_lock);
3120         if (signal_pending(current))
3121                 return -EINTR;
3122         return 0;
3123 }
3124
3125 /**
3126  *      tiocmget                -       get modem status
3127  *      @tty: tty device
3128  *      @file: user file pointer
3129  *      @p: pointer to result
3130  *
3131  *      Obtain the modem status bits from the tty driver if the feature
3132  *      is supported. Return -EINVAL if it is not available.
3133  *
3134  *      Locking: none (up to the driver)
3135  */
3136
3137 static int tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
3138 {
3139         int retval = -EINVAL;
3140
3141         if (tty->driver->tiocmget) {
3142                 retval = tty->driver->tiocmget(tty, file);
3143
3144                 if (retval >= 0)
3145                         retval = put_user(retval, p);
3146         }
3147         return retval;
3148 }
3149
3150 /**
3151  *      tiocmset                -       set modem status
3152  *      @tty: tty device
3153  *      @file: user file pointer
3154  *      @cmd: command - clear bits, set bits or set all
3155  *      @p: pointer to desired bits
3156  *
3157  *      Set the modem status bits from the tty driver if the feature
3158  *      is supported. Return -EINVAL if it is not available.
3159  *
3160  *      Locking: none (up to the driver)
3161  */
3162
3163 static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
3164              unsigned __user *p)
3165 {
3166         int retval = -EINVAL;
3167
3168         if (tty->driver->tiocmset) {
3169                 unsigned int set, clear, val;
3170
3171                 retval = get_user(val, p);
3172                 if (retval)
3173                         return retval;
3174
3175                 set = clear = 0;
3176                 switch (cmd) {
3177                 case TIOCMBIS:
3178                         set = val;
3179                         break;
3180                 case TIOCMBIC:
3181                         clear = val;
3182                         break;
3183                 case TIOCMSET:
3184                         set = val;
3185                         clear = ~val;
3186                         break;
3187                 }
3188
3189                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
3190                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
3191
3192                 retval = tty->driver->tiocmset(tty, file, set, clear);
3193         }
3194         return retval;
3195 }
3196
3197 /*
3198  * Split this up, as gcc can choke on it otherwise..
3199  */
3200 int tty_ioctl(struct inode * inode, struct file * file,
3201               unsigned int cmd, unsigned long arg)
3202 {
3203         struct tty_struct *tty, *real_tty;
3204         void __user *p = (void __user *)arg;
3205         int retval;
3206         struct tty_ldisc *ld;
3207         
3208         tty = (struct tty_struct *)file->private_data;
3209         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
3210                 return -EINVAL;
3211
3212         /* CHECKME: is this safe as one end closes ? */
3213
3214         real_tty = tty;
3215         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
3216             tty->driver->subtype == PTY_TYPE_MASTER)
3217                 real_tty = tty->link;
3218
3219         /*
3220          * Break handling by driver
3221          */
3222         if (!tty->driver->break_ctl) {
3223                 switch(cmd) {
3224                 case TIOCSBRK:
3225                 case TIOCCBRK:
3226                         if (tty->driver->ioctl)
3227                                 return tty->driver->ioctl(tty, file, cmd, arg);
3228                         return -EINVAL;
3229                         
3230                 /* These two ioctl's always return success; even if */
3231                 /* the driver doesn't support them. */
3232                 case TCSBRK:
3233                 case TCSBRKP:
3234                         if (!tty->driver->ioctl)
3235                                 return 0;
3236                         retval = tty->driver->ioctl(tty, file, cmd, arg);
3237                         if (retval == -ENOIOCTLCMD)
3238                                 retval = 0;
3239                         return retval;
3240                 }
3241         }
3242
3243         /*
3244          * Factor out some common prep work
3245          */
3246         switch (cmd) {
3247         case TIOCSETD:
3248         case TIOCSBRK:
3249         case TIOCCBRK:
3250         case TCSBRK:
3251         case TCSBRKP:                   
3252                 retval = tty_check_change(tty);
3253                 if (retval)
3254                         return retval;
3255                 if (cmd != TIOCCBRK) {
3256                         tty_wait_until_sent(tty, 0);
3257                         if (signal_pending(current))
3258                                 return -EINTR;
3259                 }
3260                 break;
3261         }
3262
3263         switch (cmd) {
3264                 case TIOCSTI:
3265                         return tiocsti(tty, p);
3266                 case TIOCGWINSZ:
3267                         return tiocgwinsz(tty, p);
3268                 case TIOCSWINSZ:
3269                         return tiocswinsz(tty, real_tty, p);
3270                 case TIOCCONS:
3271                         return real_tty!=tty ? -EINVAL : tioccons(file);
3272                 case FIONBIO:
3273                         return fionbio(file, p);
3274                 case TIOCEXCL:
3275                         set_bit(TTY_EXCLUSIVE, &tty->flags);
3276                         return 0;
3277                 case TIOCNXCL:
3278                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
3279                         return 0;
3280                 case TIOCNOTTY:
3281                         if (current->signal->tty != tty)
3282                                 return -ENOTTY;
3283                         if (current->signal->leader)
3284                                 disassociate_ctty(0);
3285                         proc_clear_tty(current);
3286                         return 0;
3287                 case TIOCSCTTY:
3288                         return tiocsctty(tty, arg);
3289                 case TIOCGPGRP:
3290                         return tiocgpgrp(tty, real_tty, p);
3291                 case TIOCSPGRP:
3292                         return tiocspgrp(tty, real_tty, p);
3293                 case TIOCGSID:
3294                         return tiocgsid(tty, real_tty, p);
3295                 case TIOCGETD:
3296                         /* FIXME: check this is ok */
3297                         return put_user(tty->ldisc.num, (int __user *)p);
3298                 case TIOCSETD:
3299                         return tiocsetd(tty, p);
3300 #ifdef CONFIG_VT
3301                 case TIOCLINUX:
3302                         return tioclinux(tty, arg);
3303 #endif
3304                 /*
3305                  * Break handling
3306                  */
3307                 case TIOCSBRK:  /* Turn break on, unconditionally */
3308                         tty->driver->break_ctl(tty, -1);
3309                         return 0;
3310                         
3311                 case TIOCCBRK:  /* Turn break off, unconditionally */
3312                         tty->driver->break_ctl(tty, 0);
3313                         return 0;
3314                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
3315                         /* non-zero arg means wait for all output data
3316                          * to be sent (performed above) but don't send break.
3317                          * This is used by the tcdrain() termios function.
3318                          */
3319                         if (!arg)
3320                                 return send_break(tty, 250);
3321                         return 0;
3322                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
3323                         return send_break(tty, arg ? arg*100 : 250);
3324
3325                 case TIOCMGET:
3326                         return tty_tiocmget(tty, file, p);
3327
3328                 case TIOCMSET:
3329                 case TIOCMBIC:
3330                 case TIOCMBIS:
3331                         return tty_tiocmset(tty, file, cmd, p);
3332         }
3333         if (tty->driver->ioctl) {
3334                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
3335                 if (retval != -ENOIOCTLCMD)
3336                         return retval;
3337         }
3338         ld = tty_ldisc_ref_wait(tty);
3339         retval = -EINVAL;
3340         if (ld->ioctl) {
3341                 retval = ld->ioctl(tty, file, cmd, arg);
3342                 if (retval == -ENOIOCTLCMD)
3343                         retval = -EINVAL;
3344         }
3345         tty_ldisc_deref(ld);
3346         return retval;
3347 }
3348
3349
3350 /*
3351  * This implements the "Secure Attention Key" ---  the idea is to
3352  * prevent trojan horses by killing all processes associated with this
3353  * tty when the user hits the "Secure Attention Key".  Required for
3354  * super-paranoid applications --- see the Orange Book for more details.
3355  * 
3356  * This code could be nicer; ideally it should send a HUP, wait a few
3357  * seconds, then send a INT, and then a KILL signal.  But you then
3358  * have to coordinate with the init process, since all processes associated
3359  * with the current tty must be dead before the new getty is allowed
3360  * to spawn.
3361  *
3362  * Now, if it would be correct ;-/ The current code has a nasty hole -
3363  * it doesn't catch files in flight. We may send the descriptor to ourselves
3364  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
3365  *
3366  * Nasty bug: do_SAK is being called in interrupt context.  This can
3367  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
3368  */
3369 void __do_SAK(struct tty_struct *tty)
3370 {
3371 #ifdef TTY_SOFT_SAK
3372         tty_hangup(tty);
3373 #else
3374         struct task_struct *g, *p;
3375         struct pid *session;
3376         int             i;
3377         struct file     *filp;
3378         struct fdtable *fdt;
3379         
3380         if (!tty)
3381                 return;
3382         session = tty->session;
3383         
3384         tty_ldisc_flush(tty);
3385
3386         if (tty->driver->flush_buffer)
3387                 tty->driver->flush_buffer(tty);
3388         
3389         read_lock(&tasklist_lock);
3390         /* Kill the entire session */
3391         do_each_pid_task(session, PIDTYPE_SID, p) {
3392                 printk(KERN_NOTICE "SAK: killed process %d"
3393                         " (%s): process_session(p)==tty->session\n",
3394                         p->pid, p->comm);
3395                 send_sig(SIGKILL, p, 1);
3396         } while_each_pid_task(session, PIDTYPE_SID, p);
3397         /* Now kill any processes that happen to have the
3398          * tty open.
3399          */
3400         do_each_thread(g, p) {
3401                 if (p->signal->tty == tty) {
3402                         printk(KERN_NOTICE "SAK: killed process %d"
3403                             " (%s): process_session(p)==tty->session\n",
3404                             p->pid, p->comm);
3405                         send_sig(SIGKILL, p, 1);
3406                         continue;
3407                 }
3408                 task_lock(p);
3409                 if (p->files) {
3410                         /*
3411                          * We don't take a ref to the file, so we must
3412                          * hold ->file_lock instead.
3413                          */
3414                         spin_lock(&p->files->file_lock);
3415                         fdt = files_fdtable(p->files);
3416                         for (i=0; i < fdt->max_fds; i++) {
3417                                 filp = fcheck_files(p->files, i);
3418                                 if (!filp)
3419                                         continue;
3420                                 if (filp->f_op->read == tty_read &&
3421                                     filp->private_data == tty) {
3422                                         printk(KERN_NOTICE "SAK: killed process %d"
3423                                             " (%s): fd#%d opened to the tty\n",
3424                                             p->pid, p->comm, i);
3425                                         force_sig(SIGKILL, p);
3426                                         break;
3427                                 }
3428                         }
3429                         spin_unlock(&p->files->file_lock);
3430                 }
3431                 task_unlock(p);
3432         } while_each_thread(g, p);
3433         read_unlock(&tasklist_lock);
3434 #endif
3435 }
3436
3437 static void do_SAK_work(struct work_struct *work)
3438 {
3439         struct tty_struct *tty =
3440                 container_of(work, struct tty_struct, SAK_work);
3441         __do_SAK(tty);
3442 }
3443
3444 /*
3445  * The tq handling here is a little racy - tty->SAK_work may already be queued.
3446  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3447  * the values which we write to it will be identical to the values which it
3448  * already has. --akpm
3449  */
3450 void do_SAK(struct tty_struct *tty)
3451 {
3452         if (!tty)
3453                 return;
3454         schedule_work(&tty->SAK_work);
3455 }
3456
3457 EXPORT_SYMBOL(do_SAK);
3458
3459 /**
3460  *      flush_to_ldisc
3461  *      @work: tty structure passed from work queue.
3462  *
3463  *      This routine is called out of the software interrupt to flush data
3464  *      from the buffer chain to the line discipline.
3465  *
3466  *      Locking: holds tty->buf.lock to guard buffer list. Drops the lock
3467  *      while invoking the line discipline receive_buf method. The
3468  *      receive_buf method is single threaded for each tty instance.
3469  */
3470  
3471 static void flush_to_ldisc(struct work_struct *work)
3472 {
3473         struct tty_struct *tty =
3474                 container_of(work, struct tty_struct, buf.work.work);
3475         unsigned long   flags;
3476         struct tty_ldisc *disc;
3477         struct tty_buffer *tbuf, *head;
3478         char *char_buf;
3479         unsigned char *flag_buf;
3480
3481         disc = tty_ldisc_ref(tty);
3482         if (disc == NULL)       /*  !TTY_LDISC */
3483                 return;
3484
3485         spin_lock_irqsave(&tty->buf.lock, flags);
3486         head = tty->buf.head;
3487         if (head != NULL) {
3488                 tty->buf.head = NULL;
3489                 for (;;) {
3490                         int count = head->commit - head->read;
3491                         if (!count) {
3492                                 if (head->next == NULL)
3493                                         break;
3494                                 tbuf = head;
3495                                 head = head->next;
3496                                 tty_buffer_free(tty, tbuf);
3497                                 continue;
3498                         }
3499                         if (!tty->receive_room) {
3500                                 schedule_delayed_work(&tty->buf.work, 1);
3501                                 break;
3502                         }
3503                         if (count > tty->receive_room)
3504                                 count = tty->receive_room;
3505                         char_buf = head->char_buf_ptr + head->read;
3506                         flag_buf = head->flag_buf_ptr + head->read;
3507                         head->read += count;
3508                         spin_unlock_irqrestore(&tty->buf.lock, flags);
3509                         disc->receive_buf(tty, char_buf, flag_buf, count);
3510                         spin_lock_irqsave(&tty->buf.lock, flags);
3511                 }
3512                 tty->buf.head = head;
3513         }
3514         spin_unlock_irqrestore(&tty->buf.lock, flags);
3515
3516         tty_ldisc_deref(disc);
3517 }
3518
3519 /**
3520  *      tty_flip_buffer_push    -       terminal
3521  *      @tty: tty to push
3522  *
3523  *      Queue a push of the terminal flip buffers to the line discipline. This
3524  *      function must not be called from IRQ context if tty->low_latency is set.
3525  *
3526  *      In the event of the queue being busy for flipping the work will be
3527  *      held off and retried later.
3528  *
3529  *      Locking: tty buffer lock. Driver locks in low latency mode.
3530  */
3531
3532 void tty_flip_buffer_push(struct tty_struct *tty)
3533 {
3534         unsigned long flags;
3535         spin_lock_irqsave(&tty->buf.lock, flags);
3536         if (tty->buf.tail != NULL)
3537                 tty->buf.tail->commit = tty->buf.tail->used;
3538         spin_unlock_irqrestore(&tty->buf.lock, flags);
3539
3540         if (tty->low_latency)
3541                 flush_to_ldisc(&tty->buf.work.work);
3542         else
3543                 schedule_delayed_work(&tty->buf.work, 1);
3544 }
3545
3546 EXPORT_SYMBOL(tty_flip_buffer_push);
3547
3548
3549 /**
3550  *      initialize_tty_struct
3551  *      @tty: tty to initialize
3552  *
3553  *      This subroutine initializes a tty structure that has been newly
3554  *      allocated.
3555  *
3556  *      Locking: none - tty in question must not be exposed at this point
3557  */
3558
3559 static void initialize_tty_struct(struct tty_struct *tty)
3560 {
3561         memset(tty, 0, sizeof(struct tty_struct));
3562         tty->magic = TTY_MAGIC;
3563         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
3564         tty->session = NULL;
3565         tty->pgrp = NULL;
3566         tty->overrun_time = jiffies;
3567         tty->buf.head = tty->buf.tail = NULL;
3568         tty_buffer_init(tty);
3569         INIT_DELAYED_WORK(&tty->buf.work, flush_to_ldisc);
3570         init_MUTEX(&tty->buf.pty_sem);
3571         mutex_init(&tty->termios_mutex);
3572         init_waitqueue_head(&tty->write_wait);
3573         init_waitqueue_head(&tty->read_wait);
3574         INIT_WORK(&tty->hangup_work, do_tty_hangup);
3575         mutex_init(&tty->atomic_read_lock);
3576         mutex_init(&tty->atomic_write_lock);
3577         spin_lock_init(&tty->read_lock);
3578         INIT_LIST_HEAD(&tty->tty_files);
3579         INIT_WORK(&tty->SAK_work, do_SAK_work);
3580 }
3581
3582 /*
3583  * The default put_char routine if the driver did not define one.
3584  */
3585
3586 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
3587 {
3588         tty->driver->write(tty, &ch, 1);
3589 }
3590
3591 static struct class *tty_class;
3592
3593 /**
3594  *      tty_register_device - register a tty device
3595  *      @driver: the tty driver that describes the tty device
3596  *      @index: the index in the tty driver for this tty device
3597  *      @device: a struct device that is associated with this tty device.
3598  *              This field is optional, if there is no known struct device
3599  *              for this tty device it can be set to NULL safely.
3600  *
3601  *      Returns a pointer to the struct device for this tty device
3602  *      (or ERR_PTR(-EFOO) on error).
3603  *
3604  *      This call is required to be made to register an individual tty device
3605  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3606  *      that bit is not set, this function should not be called by a tty
3607  *      driver.
3608  *
3609  *      Locking: ??
3610  */
3611
3612 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3613                                    struct device *device)
3614 {
3615         char name[64];
3616         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3617
3618         if (index >= driver->num) {
3619                 printk(KERN_ERR "Attempt to register invalid tty line number "
3620                        " (%d).\n", index);
3621                 return ERR_PTR(-EINVAL);
3622         }
3623
3624         if (driver->type == TTY_DRIVER_TYPE_PTY)
3625                 pty_line_name(driver, index, name);
3626         else
3627                 tty_line_name(driver, index, name);
3628
3629         return device_create(tty_class, device, dev, name);
3630 }
3631
3632 /**
3633  *      tty_unregister_device - unregister a tty device
3634  *      @driver: the tty driver that describes the tty device
3635  *      @index: the index in the tty driver for this tty device
3636  *
3637  *      If a tty device is registered with a call to tty_register_device() then
3638  *      this function must be called when the tty device is gone.
3639  *
3640  *      Locking: ??
3641  */
3642
3643 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3644 {
3645         device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
3646 }
3647
3648 EXPORT_SYMBOL(tty_register_device);
3649 EXPORT_SYMBOL(tty_unregister_device);
3650
3651 struct tty_driver *alloc_tty_driver(int lines)
3652 {
3653         struct tty_driver *driver;
3654
3655         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
3656         if (driver) {
3657                 memset(driver, 0, sizeof(struct tty_driver));
3658                 driver->magic = TTY_DRIVER_MAGIC;
3659                 driver->num = lines;
3660                 /* later we'll move allocation of tables here */
3661         }
3662         return driver;
3663 }
3664
3665 void put_tty_driver(struct tty_driver *driver)
3666 {
3667         kfree(driver);
3668 }
3669
3670 void tty_set_operations(struct tty_driver *driver,
3671                         const struct tty_operations *op)
3672 {
3673         driver->open = op->open;
3674         driver->close = op->close;
3675         driver->write = op->write;
3676         driver->put_char = op->put_char;
3677         driver->flush_chars = op->flush_chars;
3678         driver->write_room = op->write_room;
3679         driver->chars_in_buffer = op->chars_in_buffer;
3680         driver->ioctl = op->ioctl;
3681         driver->set_termios = op->set_termios;
3682         driver->throttle = op->throttle;
3683         driver->unthrottle = op->unthrottle;
3684         driver->stop = op->stop;
3685         driver->start = op->start;
3686         driver->hangup = op->hangup;
3687         driver->break_ctl = op->break_ctl;
3688         driver->flush_buffer = op->flush_buffer;
3689         driver->set_ldisc = op->set_ldisc;
3690         driver->wait_until_sent = op->wait_until_sent;
3691         driver->send_xchar = op->send_xchar;
3692         driver->read_proc = op->read_proc;
3693         driver->write_proc = op->write_proc;
3694         driver->tiocmget = op->tiocmget;
3695         driver->tiocmset = op->tiocmset;
3696 }
3697
3698
3699 EXPORT_SYMBOL(alloc_tty_driver);
3700 EXPORT_SYMBOL(put_tty_driver);
3701 EXPORT_SYMBOL(tty_set_operations);
3702
3703 /*
3704  * Called by a tty driver to register itself.
3705  */
3706 int tty_register_driver(struct tty_driver *driver)
3707 {
3708         int error;
3709         int i;
3710         dev_t dev;
3711         void **p = NULL;
3712
3713         if (driver->flags & TTY_DRIVER_INSTALLED)
3714                 return 0;
3715
3716         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3717                 p = kzalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3718                 if (!p)
3719                         return -ENOMEM;
3720         }
3721
3722         if (!driver->major) {
3723                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3724                                                 driver->name);
3725                 if (!error) {
3726                         driver->major = MAJOR(dev);
3727                         driver->minor_start = MINOR(dev);
3728                 }
3729         } else {
3730                 dev = MKDEV(driver->major, driver->minor_start);
3731                 error = register_chrdev_region(dev, driver->num, driver->name);
3732         }
3733         if (error < 0) {
3734                 kfree(p);
3735                 return error;
3736         }
3737
3738         if (p) {
3739                 driver->ttys = (struct tty_struct **)p;
3740                 driver->termios = (struct ktermios **)(p + driver->num);
3741                 driver->termios_locked = (struct ktermios **)(p + driver->num * 2);
3742         } else {
3743                 driver->ttys = NULL;
3744                 driver->termios = NULL;
3745                 driver->termios_locked = NULL;
3746         }
3747
3748         cdev_init(&driver->cdev, &tty_fops);
3749         driver->cdev.owner = driver->owner;
3750         error = cdev_add(&driver->cdev, dev, driver->num);
3751         if (error) {
3752                 unregister_chrdev_region(dev, driver->num);
3753                 driver->ttys = NULL;
3754                 driver->termios = driver->termios_locked = NULL;
3755                 kfree(p);
3756                 return error;
3757         }
3758
3759         if (!driver->put_char)
3760                 driver->put_char = tty_default_put_char;
3761         
3762         list_add(&driver->tty_drivers, &tty_drivers);
3763         
3764         if ( !(driver->flags & TTY_DRIVER_DYNAMIC_DEV) ) {
3765                 for(i = 0; i < driver->num; i++)
3766                     tty_register_device(driver, i, NULL);
3767         }
3768         proc_tty_register_driver(driver);
3769         return 0;
3770 }
3771
3772 EXPORT_SYMBOL(tty_register_driver);
3773
3774 /*
3775  * Called by a tty driver to unregister itself.
3776  */
3777 int tty_unregister_driver(struct tty_driver *driver)
3778 {
3779         int i;
3780         struct ktermios *tp;
3781         void *p;
3782
3783         if (driver->refcount)
3784                 return -EBUSY;
3785
3786         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3787                                 driver->num);
3788
3789         list_del(&driver->tty_drivers);
3790
3791         /*
3792          * Free the termios and termios_locked structures because
3793          * we don't want to get memory leaks when modular tty
3794          * drivers are removed from the kernel.
3795          */
3796         for (i = 0; i < driver->num; i++) {
3797                 tp = driver->termios[i];
3798                 if (tp) {
3799                         driver->termios[i] = NULL;
3800                         kfree(tp);
3801                 }
3802                 tp = driver->termios_locked[i];
3803                 if (tp) {
3804                         driver->termios_locked[i] = NULL;
3805                         kfree(tp);
3806                 }
3807                 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3808                         tty_unregister_device(driver, i);
3809         }
3810         p = driver->ttys;
3811         proc_tty_unregister_driver(driver);
3812         driver->ttys = NULL;
3813         driver->termios = driver->termios_locked = NULL;
3814         kfree(p);
3815         cdev_del(&driver->cdev);
3816         return 0;
3817 }
3818 EXPORT_SYMBOL(tty_unregister_driver);
3819
3820 dev_t tty_devnum(struct tty_struct *tty)
3821 {
3822         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3823 }
3824 EXPORT_SYMBOL(tty_devnum);
3825
3826 void proc_clear_tty(struct task_struct *p)
3827 {
3828         spin_lock_irq(&p->sighand->siglock);
3829         p->signal->tty = NULL;
3830         spin_unlock_irq(&p->sighand->siglock);
3831 }
3832
3833 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3834 {
3835         if (tty) {
3836                 /* We should not have a session or pgrp to here but.... */
3837                 put_pid(tty->session);
3838                 put_pid(tty->pgrp);
3839                 tty->session = get_pid(task_session(tsk));
3840                 tty->pgrp = get_pid(task_pgrp(tsk));
3841         }
3842         put_pid(tsk->signal->tty_old_pgrp);
3843         tsk->signal->tty = tty;
3844         tsk->signal->tty_old_pgrp = NULL;
3845 }
3846
3847 void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3848 {
3849         spin_lock_irq(&tsk->sighand->siglock);
3850         __proc_set_tty(tsk, tty);
3851         spin_unlock_irq(&tsk->sighand->siglock);
3852 }
3853
3854 struct tty_struct *get_current_tty(void)
3855 {
3856         struct tty_struct *tty;
3857         WARN_ON_ONCE(!mutex_is_locked(&tty_mutex));
3858         tty = current->signal->tty;
3859         /*
3860          * session->tty can be changed/cleared from under us, make sure we
3861          * issue the load. The obtained pointer, when not NULL, is valid as
3862          * long as we hold tty_mutex.
3863          */
3864         barrier();
3865         return tty;
3866 }
3867 EXPORT_SYMBOL_GPL(get_current_tty);
3868
3869 /*
3870  * Initialize the console device. This is called *early*, so
3871  * we can't necessarily depend on lots of kernel help here.
3872  * Just do some early initializations, and do the complex setup
3873  * later.
3874  */
3875 void __init console_init(void)
3876 {
3877         initcall_t *call;
3878
3879         /* Setup the default TTY line discipline. */
3880         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
3881
3882         /*
3883          * set up the console device so that later boot sequences can 
3884          * inform about problems etc..
3885          */
3886         call = __con_initcall_start;
3887         while (call < __con_initcall_end) {
3888                 (*call)();
3889                 call++;
3890         }
3891 }
3892
3893 #ifdef CONFIG_VT
3894 extern int vty_init(void);
3895 #endif
3896
3897 static int __init tty_class_init(void)
3898 {
3899         tty_class = class_create(THIS_MODULE, "tty");
3900         if (IS_ERR(tty_class))
3901                 return PTR_ERR(tty_class);
3902         return 0;
3903 }
3904
3905 postcore_initcall(tty_class_init);
3906
3907 /* 3/2004 jmc: why do these devices exist? */
3908
3909 static struct cdev tty_cdev, console_cdev;
3910 #ifdef CONFIG_UNIX98_PTYS
3911 static struct cdev ptmx_cdev;
3912 #endif
3913 #ifdef CONFIG_VT
3914 static struct cdev vc0_cdev;
3915 #endif
3916
3917 /*
3918  * Ok, now we can initialize the rest of the tty devices and can count
3919  * on memory allocations, interrupts etc..
3920  */
3921 static int __init tty_init(void)
3922 {
3923         cdev_init(&tty_cdev, &tty_fops);
3924         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3925             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3926                 panic("Couldn't register /dev/tty driver\n");
3927         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), "tty");
3928
3929         cdev_init(&console_cdev, &console_fops);
3930         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3931             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3932                 panic("Couldn't register /dev/console driver\n");
3933         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), "console");
3934
3935 #ifdef CONFIG_UNIX98_PTYS
3936         cdev_init(&ptmx_cdev, &ptmx_fops);
3937         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
3938             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
3939                 panic("Couldn't register /dev/ptmx driver\n");
3940         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), "ptmx");
3941 #endif
3942
3943 #ifdef CONFIG_VT
3944         cdev_init(&vc0_cdev, &console_fops);
3945         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
3946             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
3947                 panic("Couldn't register /dev/tty0 driver\n");
3948         device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), "tty0");
3949
3950         vty_init();
3951 #endif
3952         return 0;
3953 }
3954 module_init(tty_init);