tty: introduce no_tty and use it in selinux
[linux-2.6.git] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/types.h>
69 #include <linux/major.h>
70 #include <linux/errno.h>
71 #include <linux/signal.h>
72 #include <linux/fcntl.h>
73 #include <linux/sched.h>
74 #include <linux/interrupt.h>
75 #include <linux/tty.h>
76 #include <linux/tty_driver.h>
77 #include <linux/tty_flip.h>
78 #include <linux/devpts_fs.h>
79 #include <linux/file.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/smp_lock.h>
92 #include <linux/device.h>
93 #include <linux/idr.h>
94 #include <linux/wait.h>
95 #include <linux/bitops.h>
96 #include <linux/delay.h>
97
98 #include <asm/uaccess.h>
99 #include <asm/system.h>
100
101 #include <linux/kbd_kern.h>
102 #include <linux/vt_kern.h>
103 #include <linux/selection.h>
104
105 #include <linux/kmod.h>
106
107 #undef TTY_DEBUG_HANGUP
108
109 #define TTY_PARANOIA_CHECK 1
110 #define CHECK_TTY_COUNT 1
111
112 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
113         .c_iflag = ICRNL | IXON,
114         .c_oflag = OPOST | ONLCR,
115         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
116         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
117                    ECHOCTL | ECHOKE | IEXTEN,
118         .c_cc = INIT_C_CC,
119         .c_ispeed = 38400,
120         .c_ospeed = 38400
121 };
122
123 EXPORT_SYMBOL(tty_std_termios);
124
125 /* This list gets poked at by procfs and various bits of boot up code. This
126    could do with some rationalisation such as pulling the tty proc function
127    into this file */
128    
129 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
130
131 /* Mutex to protect creating and releasing a tty. This is shared with
132    vt.c for deeply disgusting hack reasons */
133 DEFINE_MUTEX(tty_mutex);
134 EXPORT_SYMBOL(tty_mutex);
135
136 #ifdef CONFIG_UNIX98_PTYS
137 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
138 extern int pty_limit;           /* Config limit on Unix98 ptys */
139 static DEFINE_IDR(allocated_ptys);
140 static DECLARE_MUTEX(allocated_ptys_lock);
141 static int ptmx_open(struct inode *, struct file *);
142 #endif
143
144 static void initialize_tty_struct(struct tty_struct *tty);
145
146 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
147 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
148 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
149 static unsigned int tty_poll(struct file *, poll_table *);
150 static int tty_open(struct inode *, struct file *);
151 static int tty_release(struct inode *, struct file *);
152 int tty_ioctl(struct inode * inode, struct file * file,
153               unsigned int cmd, unsigned long arg);
154 static int tty_fasync(int fd, struct file * filp, int on);
155 static void release_tty(struct tty_struct *tty, int idx);
156 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
157 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
158
159 /**
160  *      alloc_tty_struct        -       allocate a tty object
161  *
162  *      Return a new empty tty structure. The data fields have not
163  *      been initialized in any way but has been zeroed
164  *
165  *      Locking: none
166  */
167
168 static struct tty_struct *alloc_tty_struct(void)
169 {
170         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
171 }
172
173 static void tty_buffer_free_all(struct tty_struct *);
174
175 /**
176  *      free_tty_struct         -       free a disused tty
177  *      @tty: tty struct to free
178  *
179  *      Free the write buffers, tty queue and tty memory itself.
180  *
181  *      Locking: none. Must be called after tty is definitely unused
182  */
183
184 static inline void free_tty_struct(struct tty_struct *tty)
185 {
186         kfree(tty->write_buf);
187         tty_buffer_free_all(tty);
188         kfree(tty);
189 }
190
191 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
192
193 /**
194  *      tty_name        -       return tty naming
195  *      @tty: tty structure
196  *      @buf: buffer for output
197  *
198  *      Convert a tty structure into a name. The name reflects the kernel
199  *      naming policy and if udev is in use may not reflect user space
200  *
201  *      Locking: none
202  */
203
204 char *tty_name(struct tty_struct *tty, char *buf)
205 {
206         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
207                 strcpy(buf, "NULL tty");
208         else
209                 strcpy(buf, tty->name);
210         return buf;
211 }
212
213 EXPORT_SYMBOL(tty_name);
214
215 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
216                               const char *routine)
217 {
218 #ifdef TTY_PARANOIA_CHECK
219         if (!tty) {
220                 printk(KERN_WARNING
221                         "null TTY for (%d:%d) in %s\n",
222                         imajor(inode), iminor(inode), routine);
223                 return 1;
224         }
225         if (tty->magic != TTY_MAGIC) {
226                 printk(KERN_WARNING
227                         "bad magic number for tty struct (%d:%d) in %s\n",
228                         imajor(inode), iminor(inode), routine);
229                 return 1;
230         }
231 #endif
232         return 0;
233 }
234
235 static int check_tty_count(struct tty_struct *tty, const char *routine)
236 {
237 #ifdef CHECK_TTY_COUNT
238         struct list_head *p;
239         int count = 0;
240         
241         file_list_lock();
242         list_for_each(p, &tty->tty_files) {
243                 count++;
244         }
245         file_list_unlock();
246         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
247             tty->driver->subtype == PTY_TYPE_SLAVE &&
248             tty->link && tty->link->count)
249                 count++;
250         if (tty->count != count) {
251                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
252                                     "!= #fd's(%d) in %s\n",
253                        tty->name, tty->count, count, routine);
254                 return count;
255         }
256 #endif
257         return 0;
258 }
259
260 /*
261  * Tty buffer allocation management
262  */
263
264 /**
265  *      tty_buffer_free_all             -       free buffers used by a tty
266  *      @tty: tty to free from
267  *
268  *      Remove all the buffers pending on a tty whether queued with data
269  *      or in the free ring. Must be called when the tty is no longer in use
270  *
271  *      Locking: none
272  */
273
274 static void tty_buffer_free_all(struct tty_struct *tty)
275 {
276         struct tty_buffer *thead;
277         while((thead = tty->buf.head) != NULL) {
278                 tty->buf.head = thead->next;
279                 kfree(thead);
280         }
281         while((thead = tty->buf.free) != NULL) {
282                 tty->buf.free = thead->next;
283                 kfree(thead);
284         }
285         tty->buf.tail = NULL;
286         tty->buf.memory_used = 0;
287 }
288
289 /**
290  *      tty_buffer_init         -       prepare a tty buffer structure
291  *      @tty: tty to initialise
292  *
293  *      Set up the initial state of the buffer management for a tty device.
294  *      Must be called before the other tty buffer functions are used.
295  *
296  *      Locking: none
297  */
298
299 static void tty_buffer_init(struct tty_struct *tty)
300 {
301         spin_lock_init(&tty->buf.lock);
302         tty->buf.head = NULL;
303         tty->buf.tail = NULL;
304         tty->buf.free = NULL;
305         tty->buf.memory_used = 0;
306 }
307
308 /**
309  *      tty_buffer_alloc        -       allocate a tty buffer
310  *      @tty: tty device
311  *      @size: desired size (characters)
312  *
313  *      Allocate a new tty buffer to hold the desired number of characters.
314  *      Return NULL if out of memory or the allocation would exceed the
315  *      per device queue
316  *
317  *      Locking: Caller must hold tty->buf.lock
318  */
319
320 static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
321 {
322         struct tty_buffer *p;
323
324         if (tty->buf.memory_used + size > 65536)
325                 return NULL;
326         p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
327         if(p == NULL)
328                 return NULL;
329         p->used = 0;
330         p->size = size;
331         p->next = NULL;
332         p->commit = 0;
333         p->read = 0;
334         p->char_buf_ptr = (char *)(p->data);
335         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
336         tty->buf.memory_used += size;
337         return p;
338 }
339
340 /**
341  *      tty_buffer_free         -       free a tty buffer
342  *      @tty: tty owning the buffer
343  *      @b: the buffer to free
344  *
345  *      Free a tty buffer, or add it to the free list according to our
346  *      internal strategy
347  *
348  *      Locking: Caller must hold tty->buf.lock
349  */
350
351 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
352 {
353         /* Dumb strategy for now - should keep some stats */
354         tty->buf.memory_used -= b->size;
355         WARN_ON(tty->buf.memory_used < 0);
356
357         if(b->size >= 512)
358                 kfree(b);
359         else {
360                 b->next = tty->buf.free;
361                 tty->buf.free = b;
362         }
363 }
364
365 /**
366  *      tty_buffer_find         -       find a free tty buffer
367  *      @tty: tty owning the buffer
368  *      @size: characters wanted
369  *
370  *      Locate an existing suitable tty buffer or if we are lacking one then
371  *      allocate a new one. We round our buffers off in 256 character chunks
372  *      to get better allocation behaviour.
373  *
374  *      Locking: Caller must hold tty->buf.lock
375  */
376
377 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
378 {
379         struct tty_buffer **tbh = &tty->buf.free;
380         while((*tbh) != NULL) {
381                 struct tty_buffer *t = *tbh;
382                 if(t->size >= size) {
383                         *tbh = t->next;
384                         t->next = NULL;
385                         t->used = 0;
386                         t->commit = 0;
387                         t->read = 0;
388                         tty->buf.memory_used += t->size;
389                         return t;
390                 }
391                 tbh = &((*tbh)->next);
392         }
393         /* Round the buffer size out */
394         size = (size + 0xFF) & ~ 0xFF;
395         return tty_buffer_alloc(tty, size);
396         /* Should possibly check if this fails for the largest buffer we
397            have queued and recycle that ? */
398 }
399
400 /**
401  *      tty_buffer_request_room         -       grow tty buffer if needed
402  *      @tty: tty structure
403  *      @size: size desired
404  *
405  *      Make at least size bytes of linear space available for the tty
406  *      buffer. If we fail return the size we managed to find.
407  *
408  *      Locking: Takes tty->buf.lock
409  */
410 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
411 {
412         struct tty_buffer *b, *n;
413         int left;
414         unsigned long flags;
415
416         spin_lock_irqsave(&tty->buf.lock, flags);
417
418         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
419            remove this conditional if its worth it. This would be invisible
420            to the callers */
421         if ((b = tty->buf.tail) != NULL)
422                 left = b->size - b->used;
423         else
424                 left = 0;
425
426         if (left < size) {
427                 /* This is the slow path - looking for new buffers to use */
428                 if ((n = tty_buffer_find(tty, size)) != NULL) {
429                         if (b != NULL) {
430                                 b->next = n;
431                                 b->commit = b->used;
432                         } else
433                                 tty->buf.head = n;
434                         tty->buf.tail = n;
435                 } else
436                         size = left;
437         }
438
439         spin_unlock_irqrestore(&tty->buf.lock, flags);
440         return size;
441 }
442 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
443
444 /**
445  *      tty_insert_flip_string  -       Add characters to the tty buffer
446  *      @tty: tty structure
447  *      @chars: characters
448  *      @size: size
449  *
450  *      Queue a series of bytes to the tty buffering. All the characters
451  *      passed are marked as without error. Returns the number added.
452  *
453  *      Locking: Called functions may take tty->buf.lock
454  */
455
456 int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
457                                 size_t size)
458 {
459         int copied = 0;
460         do {
461                 int space = tty_buffer_request_room(tty, size - copied);
462                 struct tty_buffer *tb = tty->buf.tail;
463                 /* If there is no space then tb may be NULL */
464                 if(unlikely(space == 0))
465                         break;
466                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
467                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
468                 tb->used += space;
469                 copied += space;
470                 chars += space;
471                 /* There is a small chance that we need to split the data over
472                    several buffers. If this is the case we must loop */
473         } while (unlikely(size > copied));
474         return copied;
475 }
476 EXPORT_SYMBOL(tty_insert_flip_string);
477
478 /**
479  *      tty_insert_flip_string_flags    -       Add characters to the tty buffer
480  *      @tty: tty structure
481  *      @chars: characters
482  *      @flags: flag bytes
483  *      @size: size
484  *
485  *      Queue a series of bytes to the tty buffering. For each character
486  *      the flags array indicates the status of the character. Returns the
487  *      number added.
488  *
489  *      Locking: Called functions may take tty->buf.lock
490  */
491
492 int tty_insert_flip_string_flags(struct tty_struct *tty,
493                 const unsigned char *chars, const char *flags, size_t size)
494 {
495         int copied = 0;
496         do {
497                 int space = tty_buffer_request_room(tty, size - copied);
498                 struct tty_buffer *tb = tty->buf.tail;
499                 /* If there is no space then tb may be NULL */
500                 if(unlikely(space == 0))
501                         break;
502                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
503                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
504                 tb->used += space;
505                 copied += space;
506                 chars += space;
507                 flags += space;
508                 /* There is a small chance that we need to split the data over
509                    several buffers. If this is the case we must loop */
510         } while (unlikely(size > copied));
511         return copied;
512 }
513 EXPORT_SYMBOL(tty_insert_flip_string_flags);
514
515 /**
516  *      tty_schedule_flip       -       push characters to ldisc
517  *      @tty: tty to push from
518  *
519  *      Takes any pending buffers and transfers their ownership to the
520  *      ldisc side of the queue. It then schedules those characters for
521  *      processing by the line discipline.
522  *
523  *      Locking: Takes tty->buf.lock
524  */
525
526 void tty_schedule_flip(struct tty_struct *tty)
527 {
528         unsigned long flags;
529         spin_lock_irqsave(&tty->buf.lock, flags);
530         if (tty->buf.tail != NULL)
531                 tty->buf.tail->commit = tty->buf.tail->used;
532         spin_unlock_irqrestore(&tty->buf.lock, flags);
533         schedule_delayed_work(&tty->buf.work, 1);
534 }
535 EXPORT_SYMBOL(tty_schedule_flip);
536
537 /**
538  *      tty_prepare_flip_string         -       make room for characters
539  *      @tty: tty
540  *      @chars: return pointer for character write area
541  *      @size: desired size
542  *
543  *      Prepare a block of space in the buffer for data. Returns the length
544  *      available and buffer pointer to the space which is now allocated and
545  *      accounted for as ready for normal characters. This is used for drivers
546  *      that need their own block copy routines into the buffer. There is no
547  *      guarantee the buffer is a DMA target!
548  *
549  *      Locking: May call functions taking tty->buf.lock
550  */
551
552 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
553 {
554         int space = tty_buffer_request_room(tty, size);
555         if (likely(space)) {
556                 struct tty_buffer *tb = tty->buf.tail;
557                 *chars = tb->char_buf_ptr + tb->used;
558                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
559                 tb->used += space;
560         }
561         return space;
562 }
563
564 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
565
566 /**
567  *      tty_prepare_flip_string_flags   -       make room for characters
568  *      @tty: tty
569  *      @chars: return pointer for character write area
570  *      @flags: return pointer for status flag write area
571  *      @size: desired size
572  *
573  *      Prepare a block of space in the buffer for data. Returns the length
574  *      available and buffer pointer to the space which is now allocated and
575  *      accounted for as ready for characters. This is used for drivers
576  *      that need their own block copy routines into the buffer. There is no
577  *      guarantee the buffer is a DMA target!
578  *
579  *      Locking: May call functions taking tty->buf.lock
580  */
581
582 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
583 {
584         int space = tty_buffer_request_room(tty, size);
585         if (likely(space)) {
586                 struct tty_buffer *tb = tty->buf.tail;
587                 *chars = tb->char_buf_ptr + tb->used;
588                 *flags = tb->flag_buf_ptr + tb->used;
589                 tb->used += space;
590         }
591         return space;
592 }
593
594 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
595
596
597
598 /**
599  *      tty_set_termios_ldisc           -       set ldisc field
600  *      @tty: tty structure
601  *      @num: line discipline number
602  *
603  *      This is probably overkill for real world processors but
604  *      they are not on hot paths so a little discipline won't do 
605  *      any harm.
606  *
607  *      Locking: takes termios_mutex
608  */
609  
610 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
611 {
612         mutex_lock(&tty->termios_mutex);
613         tty->termios->c_line = num;
614         mutex_unlock(&tty->termios_mutex);
615 }
616
617 /*
618  *      This guards the refcounted line discipline lists. The lock
619  *      must be taken with irqs off because there are hangup path
620  *      callers who will do ldisc lookups and cannot sleep.
621  */
622  
623 static DEFINE_SPINLOCK(tty_ldisc_lock);
624 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
625 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
626
627 /**
628  *      tty_register_ldisc      -       install a line discipline
629  *      @disc: ldisc number
630  *      @new_ldisc: pointer to the ldisc object
631  *
632  *      Installs a new line discipline into the kernel. The discipline
633  *      is set up as unreferenced and then made available to the kernel
634  *      from this point onwards.
635  *
636  *      Locking:
637  *              takes tty_ldisc_lock to guard against ldisc races
638  */
639
640 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
641 {
642         unsigned long flags;
643         int ret = 0;
644         
645         if (disc < N_TTY || disc >= NR_LDISCS)
646                 return -EINVAL;
647         
648         spin_lock_irqsave(&tty_ldisc_lock, flags);
649         tty_ldiscs[disc] = *new_ldisc;
650         tty_ldiscs[disc].num = disc;
651         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
652         tty_ldiscs[disc].refcount = 0;
653         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
654         
655         return ret;
656 }
657 EXPORT_SYMBOL(tty_register_ldisc);
658
659 /**
660  *      tty_unregister_ldisc    -       unload a line discipline
661  *      @disc: ldisc number
662  *      @new_ldisc: pointer to the ldisc object
663  *
664  *      Remove a line discipline from the kernel providing it is not
665  *      currently in use.
666  *
667  *      Locking:
668  *              takes tty_ldisc_lock to guard against ldisc races
669  */
670
671 int tty_unregister_ldisc(int disc)
672 {
673         unsigned long flags;
674         int ret = 0;
675
676         if (disc < N_TTY || disc >= NR_LDISCS)
677                 return -EINVAL;
678
679         spin_lock_irqsave(&tty_ldisc_lock, flags);
680         if (tty_ldiscs[disc].refcount)
681                 ret = -EBUSY;
682         else
683                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
684         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
685
686         return ret;
687 }
688 EXPORT_SYMBOL(tty_unregister_ldisc);
689
690 /**
691  *      tty_ldisc_get           -       take a reference to an ldisc
692  *      @disc: ldisc number
693  *
694  *      Takes a reference to a line discipline. Deals with refcounts and
695  *      module locking counts. Returns NULL if the discipline is not available.
696  *      Returns a pointer to the discipline and bumps the ref count if it is
697  *      available
698  *
699  *      Locking:
700  *              takes tty_ldisc_lock to guard against ldisc races
701  */
702
703 struct tty_ldisc *tty_ldisc_get(int disc)
704 {
705         unsigned long flags;
706         struct tty_ldisc *ld;
707
708         if (disc < N_TTY || disc >= NR_LDISCS)
709                 return NULL;
710         
711         spin_lock_irqsave(&tty_ldisc_lock, flags);
712
713         ld = &tty_ldiscs[disc];
714         /* Check the entry is defined */
715         if(ld->flags & LDISC_FLAG_DEFINED)
716         {
717                 /* If the module is being unloaded we can't use it */
718                 if (!try_module_get(ld->owner))
719                         ld = NULL;
720                 else /* lock it */
721                         ld->refcount++;
722         }
723         else
724                 ld = NULL;
725         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
726         return ld;
727 }
728
729 EXPORT_SYMBOL_GPL(tty_ldisc_get);
730
731 /**
732  *      tty_ldisc_put           -       drop ldisc reference
733  *      @disc: ldisc number
734  *
735  *      Drop a reference to a line discipline. Manage refcounts and
736  *      module usage counts
737  *
738  *      Locking:
739  *              takes tty_ldisc_lock to guard against ldisc races
740  */
741
742 void tty_ldisc_put(int disc)
743 {
744         struct tty_ldisc *ld;
745         unsigned long flags;
746         
747         BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
748                 
749         spin_lock_irqsave(&tty_ldisc_lock, flags);
750         ld = &tty_ldiscs[disc];
751         BUG_ON(ld->refcount == 0);
752         ld->refcount--;
753         module_put(ld->owner);
754         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
755 }
756         
757 EXPORT_SYMBOL_GPL(tty_ldisc_put);
758
759 /**
760  *      tty_ldisc_assign        -       set ldisc on a tty
761  *      @tty: tty to assign
762  *      @ld: line discipline
763  *
764  *      Install an instance of a line discipline into a tty structure. The
765  *      ldisc must have a reference count above zero to ensure it remains/
766  *      The tty instance refcount starts at zero.
767  *
768  *      Locking:
769  *              Caller must hold references
770  */
771
772 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
773 {
774         tty->ldisc = *ld;
775         tty->ldisc.refcount = 0;
776 }
777
778 /**
779  *      tty_ldisc_try           -       internal helper
780  *      @tty: the tty
781  *
782  *      Make a single attempt to grab and bump the refcount on
783  *      the tty ldisc. Return 0 on failure or 1 on success. This is
784  *      used to implement both the waiting and non waiting versions
785  *      of tty_ldisc_ref
786  *
787  *      Locking: takes tty_ldisc_lock
788  */
789
790 static int tty_ldisc_try(struct tty_struct *tty)
791 {
792         unsigned long flags;
793         struct tty_ldisc *ld;
794         int ret = 0;
795         
796         spin_lock_irqsave(&tty_ldisc_lock, flags);
797         ld = &tty->ldisc;
798         if(test_bit(TTY_LDISC, &tty->flags))
799         {
800                 ld->refcount++;
801                 ret = 1;
802         }
803         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
804         return ret;
805 }
806
807 /**
808  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
809  *      @tty: tty device
810  *
811  *      Dereference the line discipline for the terminal and take a 
812  *      reference to it. If the line discipline is in flux then 
813  *      wait patiently until it changes.
814  *
815  *      Note: Must not be called from an IRQ/timer context. The caller
816  *      must also be careful not to hold other locks that will deadlock
817  *      against a discipline change, such as an existing ldisc reference
818  *      (which we check for)
819  *
820  *      Locking: call functions take tty_ldisc_lock
821  */
822  
823 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
824 {
825         /* wait_event is a macro */
826         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
827         if(tty->ldisc.refcount == 0)
828                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
829         return &tty->ldisc;
830 }
831
832 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
833
834 /**
835  *      tty_ldisc_ref           -       get the tty ldisc
836  *      @tty: tty device
837  *
838  *      Dereference the line discipline for the terminal and take a 
839  *      reference to it. If the line discipline is in flux then 
840  *      return NULL. Can be called from IRQ and timer functions.
841  *
842  *      Locking: called functions take tty_ldisc_lock
843  */
844  
845 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
846 {
847         if(tty_ldisc_try(tty))
848                 return &tty->ldisc;
849         return NULL;
850 }
851
852 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
853
854 /**
855  *      tty_ldisc_deref         -       free a tty ldisc reference
856  *      @ld: reference to free up
857  *
858  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
859  *      be called in IRQ context.
860  *
861  *      Locking: takes tty_ldisc_lock
862  */
863  
864 void tty_ldisc_deref(struct tty_ldisc *ld)
865 {
866         unsigned long flags;
867
868         BUG_ON(ld == NULL);
869                 
870         spin_lock_irqsave(&tty_ldisc_lock, flags);
871         if(ld->refcount == 0)
872                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
873         else
874                 ld->refcount--;
875         if(ld->refcount == 0)
876                 wake_up(&tty_ldisc_wait);
877         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
878 }
879
880 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
881
882 /**
883  *      tty_ldisc_enable        -       allow ldisc use
884  *      @tty: terminal to activate ldisc on
885  *
886  *      Set the TTY_LDISC flag when the line discipline can be called
887  *      again. Do neccessary wakeups for existing sleepers.
888  *
889  *      Note: nobody should set this bit except via this function. Clearing
890  *      directly is allowed.
891  */
892
893 static void tty_ldisc_enable(struct tty_struct *tty)
894 {
895         set_bit(TTY_LDISC, &tty->flags);
896         wake_up(&tty_ldisc_wait);
897 }
898         
899 /**
900  *      tty_set_ldisc           -       set line discipline
901  *      @tty: the terminal to set
902  *      @ldisc: the line discipline
903  *
904  *      Set the discipline of a tty line. Must be called from a process
905  *      context.
906  *
907  *      Locking: takes tty_ldisc_lock.
908  *               called functions take termios_mutex
909  */
910  
911 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
912 {
913         int retval = 0;
914         struct tty_ldisc o_ldisc;
915         char buf[64];
916         int work;
917         unsigned long flags;
918         struct tty_ldisc *ld;
919         struct tty_struct *o_tty;
920
921         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
922                 return -EINVAL;
923
924 restart:
925
926         ld = tty_ldisc_get(ldisc);
927         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
928         /* Cyrus Durgin <cider@speakeasy.org> */
929         if (ld == NULL) {
930                 request_module("tty-ldisc-%d", ldisc);
931                 ld = tty_ldisc_get(ldisc);
932         }
933         if (ld == NULL)
934                 return -EINVAL;
935
936         /*
937          *      No more input please, we are switching. The new ldisc
938          *      will update this value in the ldisc open function
939          */
940
941         tty->receive_room = 0;
942
943         /*
944          *      Problem: What do we do if this blocks ?
945          */
946
947         tty_wait_until_sent(tty, 0);
948
949         if (tty->ldisc.num == ldisc) {
950                 tty_ldisc_put(ldisc);
951                 return 0;
952         }
953
954         o_ldisc = tty->ldisc;
955         o_tty = tty->link;
956
957         /*
958          *      Make sure we don't change while someone holds a
959          *      reference to the line discipline. The TTY_LDISC bit
960          *      prevents anyone taking a reference once it is clear.
961          *      We need the lock to avoid racing reference takers.
962          */
963
964         spin_lock_irqsave(&tty_ldisc_lock, flags);
965         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
966                 if(tty->ldisc.refcount) {
967                         /* Free the new ldisc we grabbed. Must drop the lock
968                            first. */
969                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
970                         tty_ldisc_put(ldisc);
971                         /*
972                          * There are several reasons we may be busy, including
973                          * random momentary I/O traffic. We must therefore
974                          * retry. We could distinguish between blocking ops
975                          * and retries if we made tty_ldisc_wait() smarter. That
976                          * is up for discussion.
977                          */
978                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
979                                 return -ERESTARTSYS;
980                         goto restart;
981                 }
982                 if(o_tty && o_tty->ldisc.refcount) {
983                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
984                         tty_ldisc_put(ldisc);
985                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
986                                 return -ERESTARTSYS;
987                         goto restart;
988                 }
989         }
990
991         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
992
993         if (!test_bit(TTY_LDISC, &tty->flags)) {
994                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
995                 tty_ldisc_put(ldisc);
996                 ld = tty_ldisc_ref_wait(tty);
997                 tty_ldisc_deref(ld);
998                 goto restart;
999         }
1000
1001         clear_bit(TTY_LDISC, &tty->flags);
1002         if (o_tty)
1003                 clear_bit(TTY_LDISC, &o_tty->flags);
1004         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1005
1006         /*
1007          *      From this point on we know nobody has an ldisc
1008          *      usage reference, nor can they obtain one until
1009          *      we say so later on.
1010          */
1011
1012         work = cancel_delayed_work(&tty->buf.work);
1013         /*
1014          * Wait for ->hangup_work and ->buf.work handlers to terminate
1015          */
1016          
1017         flush_scheduled_work();
1018         /* Shutdown the current discipline. */
1019         if (tty->ldisc.close)
1020                 (tty->ldisc.close)(tty);
1021
1022         /* Now set up the new line discipline. */
1023         tty_ldisc_assign(tty, ld);
1024         tty_set_termios_ldisc(tty, ldisc);
1025         if (tty->ldisc.open)
1026                 retval = (tty->ldisc.open)(tty);
1027         if (retval < 0) {
1028                 tty_ldisc_put(ldisc);
1029                 /* There is an outstanding reference here so this is safe */
1030                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
1031                 tty_set_termios_ldisc(tty, tty->ldisc.num);
1032                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
1033                         tty_ldisc_put(o_ldisc.num);
1034                         /* This driver is always present */
1035                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1036                         tty_set_termios_ldisc(tty, N_TTY);
1037                         if (tty->ldisc.open) {
1038                                 int r = tty->ldisc.open(tty);
1039
1040                                 if (r < 0)
1041                                         panic("Couldn't open N_TTY ldisc for "
1042                                               "%s --- error %d.",
1043                                               tty_name(tty, buf), r);
1044                         }
1045                 }
1046         }
1047         /* At this point we hold a reference to the new ldisc and a
1048            a reference to the old ldisc. If we ended up flipping back
1049            to the existing ldisc we have two references to it */
1050         
1051         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
1052                 tty->driver->set_ldisc(tty);
1053                 
1054         tty_ldisc_put(o_ldisc.num);
1055         
1056         /*
1057          *      Allow ldisc referencing to occur as soon as the driver
1058          *      ldisc callback completes.
1059          */
1060          
1061         tty_ldisc_enable(tty);
1062         if (o_tty)
1063                 tty_ldisc_enable(o_tty);
1064         
1065         /* Restart it in case no characters kick it off. Safe if
1066            already running */
1067         if (work)
1068                 schedule_delayed_work(&tty->buf.work, 1);
1069         return retval;
1070 }
1071
1072 /**
1073  *      get_tty_driver          -       find device of a tty
1074  *      @dev_t: device identifier
1075  *      @index: returns the index of the tty
1076  *
1077  *      This routine returns a tty driver structure, given a device number
1078  *      and also passes back the index number.
1079  *
1080  *      Locking: caller must hold tty_mutex
1081  */
1082
1083 static struct tty_driver *get_tty_driver(dev_t device, int *index)
1084 {
1085         struct tty_driver *p;
1086
1087         list_for_each_entry(p, &tty_drivers, tty_drivers) {
1088                 dev_t base = MKDEV(p->major, p->minor_start);
1089                 if (device < base || device >= base + p->num)
1090                         continue;
1091                 *index = device - base;
1092                 return p;
1093         }
1094         return NULL;
1095 }
1096
1097 /**
1098  *      tty_check_change        -       check for POSIX terminal changes
1099  *      @tty: tty to check
1100  *
1101  *      If we try to write to, or set the state of, a terminal and we're
1102  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
1103  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
1104  *
1105  *      Locking: none
1106  */
1107
1108 int tty_check_change(struct tty_struct * tty)
1109 {
1110         if (current->signal->tty != tty)
1111                 return 0;
1112         if (!tty->pgrp) {
1113                 printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
1114                 return 0;
1115         }
1116         if (task_pgrp(current) == tty->pgrp)
1117                 return 0;
1118         if (is_ignored(SIGTTOU))
1119                 return 0;
1120         if (is_current_pgrp_orphaned())
1121                 return -EIO;
1122         (void) kill_pgrp(task_pgrp(current), SIGTTOU, 1);
1123         return -ERESTARTSYS;
1124 }
1125
1126 EXPORT_SYMBOL(tty_check_change);
1127
1128 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
1129                                 size_t count, loff_t *ppos)
1130 {
1131         return 0;
1132 }
1133
1134 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
1135                                  size_t count, loff_t *ppos)
1136 {
1137         return -EIO;
1138 }
1139
1140 /* No kernel lock held - none needed ;) */
1141 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
1142 {
1143         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
1144 }
1145
1146 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
1147                              unsigned int cmd, unsigned long arg)
1148 {
1149         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
1150 }
1151
1152 static const struct file_operations tty_fops = {
1153         .llseek         = no_llseek,
1154         .read           = tty_read,
1155         .write          = tty_write,
1156         .poll           = tty_poll,
1157         .ioctl          = tty_ioctl,
1158         .open           = tty_open,
1159         .release        = tty_release,
1160         .fasync         = tty_fasync,
1161 };
1162
1163 #ifdef CONFIG_UNIX98_PTYS
1164 static const struct file_operations ptmx_fops = {
1165         .llseek         = no_llseek,
1166         .read           = tty_read,
1167         .write          = tty_write,
1168         .poll           = tty_poll,
1169         .ioctl          = tty_ioctl,
1170         .open           = ptmx_open,
1171         .release        = tty_release,
1172         .fasync         = tty_fasync,
1173 };
1174 #endif
1175
1176 static const struct file_operations console_fops = {
1177         .llseek         = no_llseek,
1178         .read           = tty_read,
1179         .write          = redirected_tty_write,
1180         .poll           = tty_poll,
1181         .ioctl          = tty_ioctl,
1182         .open           = tty_open,
1183         .release        = tty_release,
1184         .fasync         = tty_fasync,
1185 };
1186
1187 static const struct file_operations hung_up_tty_fops = {
1188         .llseek         = no_llseek,
1189         .read           = hung_up_tty_read,
1190         .write          = hung_up_tty_write,
1191         .poll           = hung_up_tty_poll,
1192         .ioctl          = hung_up_tty_ioctl,
1193         .release        = tty_release,
1194 };
1195
1196 static DEFINE_SPINLOCK(redirect_lock);
1197 static struct file *redirect;
1198
1199 /**
1200  *      tty_wakeup      -       request more data
1201  *      @tty: terminal
1202  *
1203  *      Internal and external helper for wakeups of tty. This function
1204  *      informs the line discipline if present that the driver is ready
1205  *      to receive more output data.
1206  */
1207  
1208 void tty_wakeup(struct tty_struct *tty)
1209 {
1210         struct tty_ldisc *ld;
1211         
1212         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
1213                 ld = tty_ldisc_ref(tty);
1214                 if(ld) {
1215                         if(ld->write_wakeup)
1216                                 ld->write_wakeup(tty);
1217                         tty_ldisc_deref(ld);
1218                 }
1219         }
1220         wake_up_interruptible(&tty->write_wait);
1221 }
1222
1223 EXPORT_SYMBOL_GPL(tty_wakeup);
1224
1225 /**
1226  *      tty_ldisc_flush -       flush line discipline queue
1227  *      @tty: tty
1228  *
1229  *      Flush the line discipline queue (if any) for this tty. If there
1230  *      is no line discipline active this is a no-op.
1231  */
1232  
1233 void tty_ldisc_flush(struct tty_struct *tty)
1234 {
1235         struct tty_ldisc *ld = tty_ldisc_ref(tty);
1236         if(ld) {
1237                 if(ld->flush_buffer)
1238                         ld->flush_buffer(tty);
1239                 tty_ldisc_deref(ld);
1240         }
1241 }
1242
1243 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
1244
1245 /**
1246  *      tty_reset_termios       -       reset terminal state
1247  *      @tty: tty to reset
1248  *
1249  *      Restore a terminal to the driver default state
1250  */
1251
1252 static void tty_reset_termios(struct tty_struct *tty)
1253 {
1254         mutex_lock(&tty->termios_mutex);
1255         *tty->termios = tty->driver->init_termios;
1256         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1257         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1258         mutex_unlock(&tty->termios_mutex);
1259 }
1260         
1261 /**
1262  *      do_tty_hangup           -       actual handler for hangup events
1263  *      @work: tty device
1264  *
1265  *      This can be called by the "eventd" kernel thread.  That is process
1266  *      synchronous but doesn't hold any locks, so we need to make sure we
1267  *      have the appropriate locks for what we're doing.
1268  *
1269  *      The hangup event clears any pending redirections onto the hung up
1270  *      device. It ensures future writes will error and it does the needed
1271  *      line discipline hangup and signal delivery. The tty object itself
1272  *      remains intact.
1273  *
1274  *      Locking:
1275  *              BKL
1276  *                redirect lock for undoing redirection
1277  *                file list lock for manipulating list of ttys
1278  *                tty_ldisc_lock from called functions
1279  *                termios_mutex resetting termios data
1280  *                tasklist_lock to walk task list for hangup event
1281  *                  ->siglock to protect ->signal/->sighand
1282  */
1283 static void do_tty_hangup(struct work_struct *work)
1284 {
1285         struct tty_struct *tty =
1286                 container_of(work, struct tty_struct, hangup_work);
1287         struct file * cons_filp = NULL;
1288         struct file *filp, *f = NULL;
1289         struct task_struct *p;
1290         struct tty_ldisc *ld;
1291         int    closecount = 0, n;
1292
1293         if (!tty)
1294                 return;
1295
1296         /* inuse_filps is protected by the single kernel lock */
1297         lock_kernel();
1298
1299         spin_lock(&redirect_lock);
1300         if (redirect && redirect->private_data == tty) {
1301                 f = redirect;
1302                 redirect = NULL;
1303         }
1304         spin_unlock(&redirect_lock);
1305         
1306         check_tty_count(tty, "do_tty_hangup");
1307         file_list_lock();
1308         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1309         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1310                 if (filp->f_op->write == redirected_tty_write)
1311                         cons_filp = filp;
1312                 if (filp->f_op->write != tty_write)
1313                         continue;
1314                 closecount++;
1315                 tty_fasync(-1, filp, 0);        /* can't block */
1316                 filp->f_op = &hung_up_tty_fops;
1317         }
1318         file_list_unlock();
1319         
1320         /* FIXME! What are the locking issues here? This may me overdoing things..
1321          * this question is especially important now that we've removed the irqlock. */
1322
1323         ld = tty_ldisc_ref(tty);
1324         if(ld != NULL)  /* We may have no line discipline at this point */
1325         {
1326                 if (ld->flush_buffer)
1327                         ld->flush_buffer(tty);
1328                 if (tty->driver->flush_buffer)
1329                         tty->driver->flush_buffer(tty);
1330                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1331                     ld->write_wakeup)
1332                         ld->write_wakeup(tty);
1333                 if (ld->hangup)
1334                         ld->hangup(tty);
1335         }
1336
1337         /* FIXME: Once we trust the LDISC code better we can wait here for
1338            ldisc completion and fix the driver call race */
1339            
1340         wake_up_interruptible(&tty->write_wait);
1341         wake_up_interruptible(&tty->read_wait);
1342
1343         /*
1344          * Shutdown the current line discipline, and reset it to
1345          * N_TTY.
1346          */
1347         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1348                 tty_reset_termios(tty);
1349         
1350         /* Defer ldisc switch */
1351         /* tty_deferred_ldisc_switch(N_TTY);
1352         
1353           This should get done automatically when the port closes and
1354           tty_release is called */
1355         
1356         read_lock(&tasklist_lock);
1357         if (tty->session) {
1358                 do_each_pid_task(tty->session, PIDTYPE_SID, p) {
1359                         spin_lock_irq(&p->sighand->siglock);
1360                         if (p->signal->tty == tty)
1361                                 p->signal->tty = NULL;
1362                         if (!p->signal->leader) {
1363                                 spin_unlock_irq(&p->sighand->siglock);
1364                                 continue;
1365                         }
1366                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1367                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1368                         put_pid(p->signal->tty_old_pgrp);  /* A noop */
1369                         if (tty->pgrp)
1370                                 p->signal->tty_old_pgrp = get_pid(tty->pgrp);
1371                         spin_unlock_irq(&p->sighand->siglock);
1372                 } while_each_pid_task(tty->session, PIDTYPE_SID, p);
1373         }
1374         read_unlock(&tasklist_lock);
1375
1376         tty->flags = 0;
1377         put_pid(tty->session);
1378         put_pid(tty->pgrp);
1379         tty->session = NULL;
1380         tty->pgrp = NULL;
1381         tty->ctrl_status = 0;
1382         /*
1383          *      If one of the devices matches a console pointer, we
1384          *      cannot just call hangup() because that will cause
1385          *      tty->count and state->count to go out of sync.
1386          *      So we just call close() the right number of times.
1387          */
1388         if (cons_filp) {
1389                 if (tty->driver->close)
1390                         for (n = 0; n < closecount; n++)
1391                                 tty->driver->close(tty, cons_filp);
1392         } else if (tty->driver->hangup)
1393                 (tty->driver->hangup)(tty);
1394                 
1395         /* We don't want to have driver/ldisc interactions beyond
1396            the ones we did here. The driver layer expects no
1397            calls after ->hangup() from the ldisc side. However we
1398            can't yet guarantee all that */
1399
1400         set_bit(TTY_HUPPED, &tty->flags);
1401         if (ld) {
1402                 tty_ldisc_enable(tty);
1403                 tty_ldisc_deref(ld);
1404         }
1405         unlock_kernel();
1406         if (f)
1407                 fput(f);
1408 }
1409
1410 /**
1411  *      tty_hangup              -       trigger a hangup event
1412  *      @tty: tty to hangup
1413  *
1414  *      A carrier loss (virtual or otherwise) has occurred on this like
1415  *      schedule a hangup sequence to run after this event.
1416  */
1417
1418 void tty_hangup(struct tty_struct * tty)
1419 {
1420 #ifdef TTY_DEBUG_HANGUP
1421         char    buf[64];
1422         
1423         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1424 #endif
1425         schedule_work(&tty->hangup_work);
1426 }
1427
1428 EXPORT_SYMBOL(tty_hangup);
1429
1430 /**
1431  *      tty_vhangup             -       process vhangup
1432  *      @tty: tty to hangup
1433  *
1434  *      The user has asked via system call for the terminal to be hung up.
1435  *      We do this synchronously so that when the syscall returns the process
1436  *      is complete. That guarantee is neccessary for security reasons.
1437  */
1438
1439 void tty_vhangup(struct tty_struct * tty)
1440 {
1441 #ifdef TTY_DEBUG_HANGUP
1442         char    buf[64];
1443
1444         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1445 #endif
1446         do_tty_hangup(&tty->hangup_work);
1447 }
1448 EXPORT_SYMBOL(tty_vhangup);
1449
1450 /**
1451  *      tty_hung_up_p           -       was tty hung up
1452  *      @filp: file pointer of tty
1453  *
1454  *      Return true if the tty has been subject to a vhangup or a carrier
1455  *      loss
1456  */
1457
1458 int tty_hung_up_p(struct file * filp)
1459 {
1460         return (filp->f_op == &hung_up_tty_fops);
1461 }
1462
1463 EXPORT_SYMBOL(tty_hung_up_p);
1464
1465 static void session_clear_tty(struct pid *session)
1466 {
1467         struct task_struct *p;
1468         do_each_pid_task(session, PIDTYPE_SID, p) {
1469                 proc_clear_tty(p);
1470         } while_each_pid_task(session, PIDTYPE_SID, p);
1471 }
1472
1473 /**
1474  *      disassociate_ctty       -       disconnect controlling tty
1475  *      @on_exit: true if exiting so need to "hang up" the session
1476  *
1477  *      This function is typically called only by the session leader, when
1478  *      it wants to disassociate itself from its controlling tty.
1479  *
1480  *      It performs the following functions:
1481  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1482  *      (2)  Clears the tty from being controlling the session
1483  *      (3)  Clears the controlling tty for all processes in the
1484  *              session group.
1485  *
1486  *      The argument on_exit is set to 1 if called when a process is
1487  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
1488  *
1489  *      Locking:
1490  *              BKL is taken for hysterical raisins
1491  *                tty_mutex is taken to protect tty
1492  *                ->siglock is taken to protect ->signal/->sighand
1493  *                tasklist_lock is taken to walk process list for sessions
1494  *                  ->siglock is taken to protect ->signal/->sighand
1495  */
1496
1497 void disassociate_ctty(int on_exit)
1498 {
1499         struct tty_struct *tty;
1500         struct pid *tty_pgrp = NULL;
1501
1502         lock_kernel();
1503
1504         mutex_lock(&tty_mutex);
1505         tty = get_current_tty();
1506         if (tty) {
1507                 tty_pgrp = get_pid(tty->pgrp);
1508                 mutex_unlock(&tty_mutex);
1509                 /* XXX: here we race, there is nothing protecting tty */
1510                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1511                         tty_vhangup(tty);
1512         } else if (on_exit) {
1513                 struct pid *old_pgrp;
1514                 spin_lock_irq(&current->sighand->siglock);
1515                 old_pgrp = current->signal->tty_old_pgrp;
1516                 current->signal->tty_old_pgrp = NULL;
1517                 spin_unlock_irq(&current->sighand->siglock);
1518                 if (old_pgrp) {
1519                         kill_pgrp(old_pgrp, SIGHUP, on_exit);
1520                         kill_pgrp(old_pgrp, SIGCONT, on_exit);
1521                         put_pid(old_pgrp);
1522                 }
1523                 mutex_unlock(&tty_mutex);
1524                 unlock_kernel();        
1525                 return;
1526         }
1527         if (tty_pgrp) {
1528                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
1529                 if (!on_exit)
1530                         kill_pgrp(tty_pgrp, SIGCONT, on_exit);
1531                 put_pid(tty_pgrp);
1532         }
1533
1534         spin_lock_irq(&current->sighand->siglock);
1535         put_pid(current->signal->tty_old_pgrp);
1536         current->signal->tty_old_pgrp = NULL;
1537         spin_unlock_irq(&current->sighand->siglock);
1538
1539         mutex_lock(&tty_mutex);
1540         /* It is possible that do_tty_hangup has free'd this tty */
1541         tty = get_current_tty();
1542         if (tty) {
1543                 put_pid(tty->session);
1544                 put_pid(tty->pgrp);
1545                 tty->session = NULL;
1546                 tty->pgrp = NULL;
1547         } else {
1548 #ifdef TTY_DEBUG_HANGUP
1549                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
1550                        " = NULL", tty);
1551 #endif
1552         }
1553         mutex_unlock(&tty_mutex);
1554
1555         /* Now clear signal->tty under the lock */
1556         read_lock(&tasklist_lock);
1557         session_clear_tty(task_session(current));
1558         read_unlock(&tasklist_lock);
1559         unlock_kernel();
1560 }
1561
1562 /**
1563  *
1564  *      no_tty  - Ensure the current process does not have a controlling tty
1565  */
1566 void no_tty(void)
1567 {
1568         struct task_struct *tsk = current;
1569         if (tsk->signal->leader)
1570                 disassociate_ctty(0);
1571         proc_clear_tty(tsk);
1572 }
1573
1574
1575 /**
1576  *      stop_tty        -       propogate flow control
1577  *      @tty: tty to stop
1578  *
1579  *      Perform flow control to the driver. For PTY/TTY pairs we
1580  *      must also propogate the TIOCKPKT status. May be called
1581  *      on an already stopped device and will not re-call the driver
1582  *      method.
1583  *
1584  *      This functionality is used by both the line disciplines for
1585  *      halting incoming flow and by the driver. It may therefore be
1586  *      called from any context, may be under the tty atomic_write_lock
1587  *      but not always.
1588  *
1589  *      Locking:
1590  *              Broken. Relies on BKL which is unsafe here.
1591  */
1592
1593 void stop_tty(struct tty_struct *tty)
1594 {
1595         if (tty->stopped)
1596                 return;
1597         tty->stopped = 1;
1598         if (tty->link && tty->link->packet) {
1599                 tty->ctrl_status &= ~TIOCPKT_START;
1600                 tty->ctrl_status |= TIOCPKT_STOP;
1601                 wake_up_interruptible(&tty->link->read_wait);
1602         }
1603         if (tty->driver->stop)
1604                 (tty->driver->stop)(tty);
1605 }
1606
1607 EXPORT_SYMBOL(stop_tty);
1608
1609 /**
1610  *      start_tty       -       propogate flow control
1611  *      @tty: tty to start
1612  *
1613  *      Start a tty that has been stopped if at all possible. Perform
1614  *      any neccessary wakeups and propogate the TIOCPKT status. If this
1615  *      is the tty was previous stopped and is being started then the
1616  *      driver start method is invoked and the line discipline woken.
1617  *
1618  *      Locking:
1619  *              Broken. Relies on BKL which is unsafe here.
1620  */
1621
1622 void start_tty(struct tty_struct *tty)
1623 {
1624         if (!tty->stopped || tty->flow_stopped)
1625                 return;
1626         tty->stopped = 0;
1627         if (tty->link && tty->link->packet) {
1628                 tty->ctrl_status &= ~TIOCPKT_STOP;
1629                 tty->ctrl_status |= TIOCPKT_START;
1630                 wake_up_interruptible(&tty->link->read_wait);
1631         }
1632         if (tty->driver->start)
1633                 (tty->driver->start)(tty);
1634
1635         /* If we have a running line discipline it may need kicking */
1636         tty_wakeup(tty);
1637 }
1638
1639 EXPORT_SYMBOL(start_tty);
1640
1641 /**
1642  *      tty_read        -       read method for tty device files
1643  *      @file: pointer to tty file
1644  *      @buf: user buffer
1645  *      @count: size of user buffer
1646  *      @ppos: unused
1647  *
1648  *      Perform the read system call function on this terminal device. Checks
1649  *      for hung up devices before calling the line discipline method.
1650  *
1651  *      Locking:
1652  *              Locks the line discipline internally while needed
1653  *              For historical reasons the line discipline read method is
1654  *      invoked under the BKL. This will go away in time so do not rely on it
1655  *      in new code. Multiple read calls may be outstanding in parallel.
1656  */
1657
1658 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1659                         loff_t *ppos)
1660 {
1661         int i;
1662         struct tty_struct * tty;
1663         struct inode *inode;
1664         struct tty_ldisc *ld;
1665
1666         tty = (struct tty_struct *)file->private_data;
1667         inode = file->f_path.dentry->d_inode;
1668         if (tty_paranoia_check(tty, inode, "tty_read"))
1669                 return -EIO;
1670         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1671                 return -EIO;
1672
1673         /* We want to wait for the line discipline to sort out in this
1674            situation */
1675         ld = tty_ldisc_ref_wait(tty);
1676         lock_kernel();
1677         if (ld->read)
1678                 i = (ld->read)(tty,file,buf,count);
1679         else
1680                 i = -EIO;
1681         tty_ldisc_deref(ld);
1682         unlock_kernel();
1683         if (i > 0)
1684                 inode->i_atime = current_fs_time(inode->i_sb);
1685         return i;
1686 }
1687
1688 /*
1689  * Split writes up in sane blocksizes to avoid
1690  * denial-of-service type attacks
1691  */
1692 static inline ssize_t do_tty_write(
1693         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1694         struct tty_struct *tty,
1695         struct file *file,
1696         const char __user *buf,
1697         size_t count)
1698 {
1699         ssize_t ret = 0, written = 0;
1700         unsigned int chunk;
1701         
1702         /* FIXME: O_NDELAY ... */
1703         if (mutex_lock_interruptible(&tty->atomic_write_lock)) {
1704                 return -ERESTARTSYS;
1705         }
1706
1707         /*
1708          * We chunk up writes into a temporary buffer. This
1709          * simplifies low-level drivers immensely, since they
1710          * don't have locking issues and user mode accesses.
1711          *
1712          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1713          * big chunk-size..
1714          *
1715          * The default chunk-size is 2kB, because the NTTY
1716          * layer has problems with bigger chunks. It will
1717          * claim to be able to handle more characters than
1718          * it actually does.
1719          *
1720          * FIXME: This can probably go away now except that 64K chunks
1721          * are too likely to fail unless switched to vmalloc...
1722          */
1723         chunk = 2048;
1724         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1725                 chunk = 65536;
1726         if (count < chunk)
1727                 chunk = count;
1728
1729         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1730         if (tty->write_cnt < chunk) {
1731                 unsigned char *buf;
1732
1733                 if (chunk < 1024)
1734                         chunk = 1024;
1735
1736                 buf = kmalloc(chunk, GFP_KERNEL);
1737                 if (!buf) {
1738                         mutex_unlock(&tty->atomic_write_lock);
1739                         return -ENOMEM;
1740                 }
1741                 kfree(tty->write_buf);
1742                 tty->write_cnt = chunk;
1743                 tty->write_buf = buf;
1744         }
1745
1746         /* Do the write .. */
1747         for (;;) {
1748                 size_t size = count;
1749                 if (size > chunk)
1750                         size = chunk;
1751                 ret = -EFAULT;
1752                 if (copy_from_user(tty->write_buf, buf, size))
1753                         break;
1754                 lock_kernel();
1755                 ret = write(tty, file, tty->write_buf, size);
1756                 unlock_kernel();
1757                 if (ret <= 0)
1758                         break;
1759                 written += ret;
1760                 buf += ret;
1761                 count -= ret;
1762                 if (!count)
1763                         break;
1764                 ret = -ERESTARTSYS;
1765                 if (signal_pending(current))
1766                         break;
1767                 cond_resched();
1768         }
1769         if (written) {
1770                 struct inode *inode = file->f_path.dentry->d_inode;
1771                 inode->i_mtime = current_fs_time(inode->i_sb);
1772                 ret = written;
1773         }
1774         mutex_unlock(&tty->atomic_write_lock);
1775         return ret;
1776 }
1777
1778
1779 /**
1780  *      tty_write               -       write method for tty device file
1781  *      @file: tty file pointer
1782  *      @buf: user data to write
1783  *      @count: bytes to write
1784  *      @ppos: unused
1785  *
1786  *      Write data to a tty device via the line discipline.
1787  *
1788  *      Locking:
1789  *              Locks the line discipline as required
1790  *              Writes to the tty driver are serialized by the atomic_write_lock
1791  *      and are then processed in chunks to the device. The line discipline
1792  *      write method will not be involked in parallel for each device
1793  *              The line discipline write method is called under the big
1794  *      kernel lock for historical reasons. New code should not rely on this.
1795  */
1796
1797 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1798                          loff_t *ppos)
1799 {
1800         struct tty_struct * tty;
1801         struct inode *inode = file->f_path.dentry->d_inode;
1802         ssize_t ret;
1803         struct tty_ldisc *ld;
1804         
1805         tty = (struct tty_struct *)file->private_data;
1806         if (tty_paranoia_check(tty, inode, "tty_write"))
1807                 return -EIO;
1808         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1809                 return -EIO;
1810
1811         ld = tty_ldisc_ref_wait(tty);           
1812         if (!ld->write)
1813                 ret = -EIO;
1814         else
1815                 ret = do_tty_write(ld->write, tty, file, buf, count);
1816         tty_ldisc_deref(ld);
1817         return ret;
1818 }
1819
1820 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1821                          loff_t *ppos)
1822 {
1823         struct file *p = NULL;
1824
1825         spin_lock(&redirect_lock);
1826         if (redirect) {
1827                 get_file(redirect);
1828                 p = redirect;
1829         }
1830         spin_unlock(&redirect_lock);
1831
1832         if (p) {
1833                 ssize_t res;
1834                 res = vfs_write(p, buf, count, &p->f_pos);
1835                 fput(p);
1836                 return res;
1837         }
1838
1839         return tty_write(file, buf, count, ppos);
1840 }
1841
1842 static char ptychar[] = "pqrstuvwxyzabcde";
1843
1844 /**
1845  *      pty_line_name   -       generate name for a pty
1846  *      @driver: the tty driver in use
1847  *      @index: the minor number
1848  *      @p: output buffer of at least 6 bytes
1849  *
1850  *      Generate a name from a driver reference and write it to the output
1851  *      buffer.
1852  *
1853  *      Locking: None
1854  */
1855 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1856 {
1857         int i = index + driver->name_base;
1858         /* ->name is initialized to "ttyp", but "tty" is expected */
1859         sprintf(p, "%s%c%x",
1860                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1861                         ptychar[i >> 4 & 0xf], i & 0xf);
1862 }
1863
1864 /**
1865  *      pty_line_name   -       generate name for a tty
1866  *      @driver: the tty driver in use
1867  *      @index: the minor number
1868  *      @p: output buffer of at least 7 bytes
1869  *
1870  *      Generate a name from a driver reference and write it to the output
1871  *      buffer.
1872  *
1873  *      Locking: None
1874  */
1875 static void tty_line_name(struct tty_driver *driver, int index, char *p)
1876 {
1877         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1878 }
1879
1880 /**
1881  *      init_dev                -       initialise a tty device
1882  *      @driver: tty driver we are opening a device on
1883  *      @idx: device index
1884  *      @tty: returned tty structure
1885  *
1886  *      Prepare a tty device. This may not be a "new" clean device but
1887  *      could also be an active device. The pty drivers require special
1888  *      handling because of this.
1889  *
1890  *      Locking:
1891  *              The function is called under the tty_mutex, which
1892  *      protects us from the tty struct or driver itself going away.
1893  *
1894  *      On exit the tty device has the line discipline attached and
1895  *      a reference count of 1. If a pair was created for pty/tty use
1896  *      and the other was a pty master then it too has a reference count of 1.
1897  *
1898  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1899  * failed open.  The new code protects the open with a mutex, so it's
1900  * really quite straightforward.  The mutex locking can probably be
1901  * relaxed for the (most common) case of reopening a tty.
1902  */
1903
1904 static int init_dev(struct tty_driver *driver, int idx,
1905         struct tty_struct **ret_tty)
1906 {
1907         struct tty_struct *tty, *o_tty;
1908         struct ktermios *tp, **tp_loc, *o_tp, **o_tp_loc;
1909         struct ktermios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
1910         int retval = 0;
1911
1912         /* check whether we're reopening an existing tty */
1913         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1914                 tty = devpts_get_tty(idx);
1915                 /*
1916                  * If we don't have a tty here on a slave open, it's because
1917                  * the master already started the close process and there's
1918                  * no relation between devpts file and tty anymore.
1919                  */
1920                 if (!tty && driver->subtype == PTY_TYPE_SLAVE) {
1921                         retval = -EIO;
1922                         goto end_init;
1923                 }
1924                 /*
1925                  * It's safe from now on because init_dev() is called with
1926                  * tty_mutex held and release_dev() won't change tty->count
1927                  * or tty->flags without having to grab tty_mutex
1928                  */
1929                 if (tty && driver->subtype == PTY_TYPE_MASTER)
1930                         tty = tty->link;
1931         } else {
1932                 tty = driver->ttys[idx];
1933         }
1934         if (tty) goto fast_track;
1935
1936         /*
1937          * First time open is complex, especially for PTY devices.
1938          * This code guarantees that either everything succeeds and the
1939          * TTY is ready for operation, or else the table slots are vacated
1940          * and the allocated memory released.  (Except that the termios 
1941          * and locked termios may be retained.)
1942          */
1943
1944         if (!try_module_get(driver->owner)) {
1945                 retval = -ENODEV;
1946                 goto end_init;
1947         }
1948
1949         o_tty = NULL;
1950         tp = o_tp = NULL;
1951         ltp = o_ltp = NULL;
1952
1953         tty = alloc_tty_struct();
1954         if(!tty)
1955                 goto fail_no_mem;
1956         initialize_tty_struct(tty);
1957         tty->driver = driver;
1958         tty->index = idx;
1959         tty_line_name(driver, idx, tty->name);
1960
1961         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1962                 tp_loc = &tty->termios;
1963                 ltp_loc = &tty->termios_locked;
1964         } else {
1965                 tp_loc = &driver->termios[idx];
1966                 ltp_loc = &driver->termios_locked[idx];
1967         }
1968
1969         if (!*tp_loc) {
1970                 tp = (struct ktermios *) kmalloc(sizeof(struct ktermios),
1971                                                 GFP_KERNEL);
1972                 if (!tp)
1973                         goto free_mem_out;
1974                 *tp = driver->init_termios;
1975         }
1976
1977         if (!*ltp_loc) {
1978                 ltp = (struct ktermios *) kmalloc(sizeof(struct ktermios),
1979                                                  GFP_KERNEL);
1980                 if (!ltp)
1981                         goto free_mem_out;
1982                 memset(ltp, 0, sizeof(struct ktermios));
1983         }
1984
1985         if (driver->type == TTY_DRIVER_TYPE_PTY) {
1986                 o_tty = alloc_tty_struct();
1987                 if (!o_tty)
1988                         goto free_mem_out;
1989                 initialize_tty_struct(o_tty);
1990                 o_tty->driver = driver->other;
1991                 o_tty->index = idx;
1992                 tty_line_name(driver->other, idx, o_tty->name);
1993
1994                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1995                         o_tp_loc = &o_tty->termios;
1996                         o_ltp_loc = &o_tty->termios_locked;
1997                 } else {
1998                         o_tp_loc = &driver->other->termios[idx];
1999                         o_ltp_loc = &driver->other->termios_locked[idx];
2000                 }
2001
2002                 if (!*o_tp_loc) {
2003                         o_tp = (struct ktermios *)
2004                                 kmalloc(sizeof(struct ktermios), GFP_KERNEL);
2005                         if (!o_tp)
2006                                 goto free_mem_out;
2007                         *o_tp = driver->other->init_termios;
2008                 }
2009
2010                 if (!*o_ltp_loc) {
2011                         o_ltp = (struct ktermios *)
2012                                 kmalloc(sizeof(struct ktermios), GFP_KERNEL);
2013                         if (!o_ltp)
2014                                 goto free_mem_out;
2015                         memset(o_ltp, 0, sizeof(struct ktermios));
2016                 }
2017
2018                 /*
2019                  * Everything allocated ... set up the o_tty structure.
2020                  */
2021                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
2022                         driver->other->ttys[idx] = o_tty;
2023                 }
2024                 if (!*o_tp_loc)
2025                         *o_tp_loc = o_tp;
2026                 if (!*o_ltp_loc)
2027                         *o_ltp_loc = o_ltp;
2028                 o_tty->termios = *o_tp_loc;
2029                 o_tty->termios_locked = *o_ltp_loc;
2030                 driver->other->refcount++;
2031                 if (driver->subtype == PTY_TYPE_MASTER)
2032                         o_tty->count++;
2033
2034                 /* Establish the links in both directions */
2035                 tty->link   = o_tty;
2036                 o_tty->link = tty;
2037         }
2038
2039         /* 
2040          * All structures have been allocated, so now we install them.
2041          * Failures after this point use release_tty to clean up, so
2042          * there's no need to null out the local pointers.
2043          */
2044         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2045                 driver->ttys[idx] = tty;
2046         }
2047         
2048         if (!*tp_loc)
2049                 *tp_loc = tp;
2050         if (!*ltp_loc)
2051                 *ltp_loc = ltp;
2052         tty->termios = *tp_loc;
2053         tty->termios_locked = *ltp_loc;
2054         /* Compatibility until drivers always set this */
2055         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
2056         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
2057         driver->refcount++;
2058         tty->count++;
2059
2060         /* 
2061          * Structures all installed ... call the ldisc open routines.
2062          * If we fail here just call release_tty to clean up.  No need
2063          * to decrement the use counts, as release_tty doesn't care.
2064          */
2065
2066         if (tty->ldisc.open) {
2067                 retval = (tty->ldisc.open)(tty);
2068                 if (retval)
2069                         goto release_mem_out;
2070         }
2071         if (o_tty && o_tty->ldisc.open) {
2072                 retval = (o_tty->ldisc.open)(o_tty);
2073                 if (retval) {
2074                         if (tty->ldisc.close)
2075                                 (tty->ldisc.close)(tty);
2076                         goto release_mem_out;
2077                 }
2078                 tty_ldisc_enable(o_tty);
2079         }
2080         tty_ldisc_enable(tty);
2081         goto success;
2082
2083         /*
2084          * This fast open can be used if the tty is already open.
2085          * No memory is allocated, and the only failures are from
2086          * attempting to open a closing tty or attempting multiple
2087          * opens on a pty master.
2088          */
2089 fast_track:
2090         if (test_bit(TTY_CLOSING, &tty->flags)) {
2091                 retval = -EIO;
2092                 goto end_init;
2093         }
2094         if (driver->type == TTY_DRIVER_TYPE_PTY &&
2095             driver->subtype == PTY_TYPE_MASTER) {
2096                 /*
2097                  * special case for PTY masters: only one open permitted, 
2098                  * and the slave side open count is incremented as well.
2099                  */
2100                 if (tty->count) {
2101                         retval = -EIO;
2102                         goto end_init;
2103                 }
2104                 tty->link->count++;
2105         }
2106         tty->count++;
2107         tty->driver = driver; /* N.B. why do this every time?? */
2108
2109         /* FIXME */
2110         if(!test_bit(TTY_LDISC, &tty->flags))
2111                 printk(KERN_ERR "init_dev but no ldisc\n");
2112 success:
2113         *ret_tty = tty;
2114         
2115         /* All paths come through here to release the mutex */
2116 end_init:
2117         return retval;
2118
2119         /* Release locally allocated memory ... nothing placed in slots */
2120 free_mem_out:
2121         kfree(o_tp);
2122         if (o_tty)
2123                 free_tty_struct(o_tty);
2124         kfree(ltp);
2125         kfree(tp);
2126         free_tty_struct(tty);
2127
2128 fail_no_mem:
2129         module_put(driver->owner);
2130         retval = -ENOMEM;
2131         goto end_init;
2132
2133         /* call the tty release_tty routine to clean out this slot */
2134 release_mem_out:
2135         if (printk_ratelimit())
2136                 printk(KERN_INFO "init_dev: ldisc open failed, "
2137                                  "clearing slot %d\n", idx);
2138         release_tty(tty, idx);
2139         goto end_init;
2140 }
2141
2142 /**
2143  *      release_one_tty         -       release tty structure memory
2144  *
2145  *      Releases memory associated with a tty structure, and clears out the
2146  *      driver table slots. This function is called when a device is no longer
2147  *      in use. It also gets called when setup of a device fails.
2148  *
2149  *      Locking:
2150  *              tty_mutex - sometimes only
2151  *              takes the file list lock internally when working on the list
2152  *      of ttys that the driver keeps.
2153  *              FIXME: should we require tty_mutex is held here ??
2154  */
2155 static void release_one_tty(struct tty_struct *tty, int idx)
2156 {
2157         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
2158         struct ktermios *tp;
2159
2160         if (!devpts)
2161                 tty->driver->ttys[idx] = NULL;
2162
2163         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
2164                 tp = tty->termios;
2165                 if (!devpts)
2166                         tty->driver->termios[idx] = NULL;
2167                 kfree(tp);
2168
2169                 tp = tty->termios_locked;
2170                 if (!devpts)
2171                         tty->driver->termios_locked[idx] = NULL;
2172                 kfree(tp);
2173         }
2174
2175
2176         tty->magic = 0;
2177         tty->driver->refcount--;
2178
2179         file_list_lock();
2180         list_del_init(&tty->tty_files);
2181         file_list_unlock();
2182
2183         free_tty_struct(tty);
2184 }
2185
2186 /**
2187  *      release_tty             -       release tty structure memory
2188  *
2189  *      Release both @tty and a possible linked partner (think pty pair),
2190  *      and decrement the refcount of the backing module.
2191  *
2192  *      Locking:
2193  *              tty_mutex - sometimes only
2194  *              takes the file list lock internally when working on the list
2195  *      of ttys that the driver keeps.
2196  *              FIXME: should we require tty_mutex is held here ??
2197  */
2198 static void release_tty(struct tty_struct *tty, int idx)
2199 {
2200         struct tty_driver *driver = tty->driver;
2201
2202         if (tty->link)
2203                 release_one_tty(tty->link, idx);
2204         release_one_tty(tty, idx);
2205         module_put(driver->owner);
2206 }
2207
2208 /*
2209  * Even releasing the tty structures is a tricky business.. We have
2210  * to be very careful that the structures are all released at the
2211  * same time, as interrupts might otherwise get the wrong pointers.
2212  *
2213  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
2214  * lead to double frees or releasing memory still in use.
2215  */
2216 static void release_dev(struct file * filp)
2217 {
2218         struct tty_struct *tty, *o_tty;
2219         int     pty_master, tty_closing, o_tty_closing, do_sleep;
2220         int     devpts;
2221         int     idx;
2222         char    buf[64];
2223         unsigned long flags;
2224         
2225         tty = (struct tty_struct *)filp->private_data;
2226         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "release_dev"))
2227                 return;
2228
2229         check_tty_count(tty, "release_dev");
2230
2231         tty_fasync(-1, filp, 0);
2232
2233         idx = tty->index;
2234         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2235                       tty->driver->subtype == PTY_TYPE_MASTER);
2236         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
2237         o_tty = tty->link;
2238
2239 #ifdef TTY_PARANOIA_CHECK
2240         if (idx < 0 || idx >= tty->driver->num) {
2241                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
2242                                   "free (%s)\n", tty->name);
2243                 return;
2244         }
2245         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2246                 if (tty != tty->driver->ttys[idx]) {
2247                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
2248                                "for (%s)\n", idx, tty->name);
2249                         return;
2250                 }
2251                 if (tty->termios != tty->driver->termios[idx]) {
2252                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
2253                                "for (%s)\n",
2254                                idx, tty->name);
2255                         return;
2256                 }
2257                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
2258                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
2259                                "termios_locked for (%s)\n",
2260                                idx, tty->name);
2261                         return;
2262                 }
2263         }
2264 #endif
2265
2266 #ifdef TTY_DEBUG_HANGUP
2267         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
2268                tty_name(tty, buf), tty->count);
2269 #endif
2270
2271 #ifdef TTY_PARANOIA_CHECK
2272         if (tty->driver->other &&
2273              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2274                 if (o_tty != tty->driver->other->ttys[idx]) {
2275                         printk(KERN_DEBUG "release_dev: other->table[%d] "
2276                                           "not o_tty for (%s)\n",
2277                                idx, tty->name);
2278                         return;
2279                 }
2280                 if (o_tty->termios != tty->driver->other->termios[idx]) {
2281                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
2282                                           "not o_termios for (%s)\n",
2283                                idx, tty->name);
2284                         return;
2285                 }
2286                 if (o_tty->termios_locked != 
2287                       tty->driver->other->termios_locked[idx]) {
2288                         printk(KERN_DEBUG "release_dev: other->termios_locked["
2289                                           "%d] not o_termios_locked for (%s)\n",
2290                                idx, tty->name);
2291                         return;
2292                 }
2293                 if (o_tty->link != tty) {
2294                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
2295                         return;
2296                 }
2297         }
2298 #endif
2299         if (tty->driver->close)
2300                 tty->driver->close(tty, filp);
2301
2302         /*
2303          * Sanity check: if tty->count is going to zero, there shouldn't be
2304          * any waiters on tty->read_wait or tty->write_wait.  We test the
2305          * wait queues and kick everyone out _before_ actually starting to
2306          * close.  This ensures that we won't block while releasing the tty
2307          * structure.
2308          *
2309          * The test for the o_tty closing is necessary, since the master and
2310          * slave sides may close in any order.  If the slave side closes out
2311          * first, its count will be one, since the master side holds an open.
2312          * Thus this test wouldn't be triggered at the time the slave closes,
2313          * so we do it now.
2314          *
2315          * Note that it's possible for the tty to be opened again while we're
2316          * flushing out waiters.  By recalculating the closing flags before
2317          * each iteration we avoid any problems.
2318          */
2319         while (1) {
2320                 /* Guard against races with tty->count changes elsewhere and
2321                    opens on /dev/tty */
2322                    
2323                 mutex_lock(&tty_mutex);
2324                 tty_closing = tty->count <= 1;
2325                 o_tty_closing = o_tty &&
2326                         (o_tty->count <= (pty_master ? 1 : 0));
2327                 do_sleep = 0;
2328
2329                 if (tty_closing) {
2330                         if (waitqueue_active(&tty->read_wait)) {
2331                                 wake_up(&tty->read_wait);
2332                                 do_sleep++;
2333                         }
2334                         if (waitqueue_active(&tty->write_wait)) {
2335                                 wake_up(&tty->write_wait);
2336                                 do_sleep++;
2337                         }
2338                 }
2339                 if (o_tty_closing) {
2340                         if (waitqueue_active(&o_tty->read_wait)) {
2341                                 wake_up(&o_tty->read_wait);
2342                                 do_sleep++;
2343                         }
2344                         if (waitqueue_active(&o_tty->write_wait)) {
2345                                 wake_up(&o_tty->write_wait);
2346                                 do_sleep++;
2347                         }
2348                 }
2349                 if (!do_sleep)
2350                         break;
2351
2352                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
2353                                     "active!\n", tty_name(tty, buf));
2354                 mutex_unlock(&tty_mutex);
2355                 schedule();
2356         }       
2357
2358         /*
2359          * The closing flags are now consistent with the open counts on 
2360          * both sides, and we've completed the last operation that could 
2361          * block, so it's safe to proceed with closing.
2362          */
2363         if (pty_master) {
2364                 if (--o_tty->count < 0) {
2365                         printk(KERN_WARNING "release_dev: bad pty slave count "
2366                                             "(%d) for %s\n",
2367                                o_tty->count, tty_name(o_tty, buf));
2368                         o_tty->count = 0;
2369                 }
2370         }
2371         if (--tty->count < 0) {
2372                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
2373                        tty->count, tty_name(tty, buf));
2374                 tty->count = 0;
2375         }
2376         
2377         /*
2378          * We've decremented tty->count, so we need to remove this file
2379          * descriptor off the tty->tty_files list; this serves two
2380          * purposes:
2381          *  - check_tty_count sees the correct number of file descriptors
2382          *    associated with this tty.
2383          *  - do_tty_hangup no longer sees this file descriptor as
2384          *    something that needs to be handled for hangups.
2385          */
2386         file_kill(filp);
2387         filp->private_data = NULL;
2388
2389         /*
2390          * Perform some housekeeping before deciding whether to return.
2391          *
2392          * Set the TTY_CLOSING flag if this was the last open.  In the
2393          * case of a pty we may have to wait around for the other side
2394          * to close, and TTY_CLOSING makes sure we can't be reopened.
2395          */
2396         if(tty_closing)
2397                 set_bit(TTY_CLOSING, &tty->flags);
2398         if(o_tty_closing)
2399                 set_bit(TTY_CLOSING, &o_tty->flags);
2400
2401         /*
2402          * If _either_ side is closing, make sure there aren't any
2403          * processes that still think tty or o_tty is their controlling
2404          * tty.
2405          */
2406         if (tty_closing || o_tty_closing) {
2407                 read_lock(&tasklist_lock);
2408                 session_clear_tty(tty->session);
2409                 if (o_tty)
2410                         session_clear_tty(o_tty->session);
2411                 read_unlock(&tasklist_lock);
2412         }
2413
2414         mutex_unlock(&tty_mutex);
2415
2416         /* check whether both sides are closing ... */
2417         if (!tty_closing || (o_tty && !o_tty_closing))
2418                 return;
2419         
2420 #ifdef TTY_DEBUG_HANGUP
2421         printk(KERN_DEBUG "freeing tty structure...");
2422 #endif
2423         /*
2424          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
2425          * kill any delayed work. As this is the final close it does not
2426          * race with the set_ldisc code path.
2427          */
2428         clear_bit(TTY_LDISC, &tty->flags);
2429         cancel_delayed_work(&tty->buf.work);
2430
2431         /*
2432          * Wait for ->hangup_work and ->buf.work handlers to terminate
2433          */
2434          
2435         flush_scheduled_work();
2436         
2437         /*
2438          * Wait for any short term users (we know they are just driver
2439          * side waiters as the file is closing so user count on the file
2440          * side is zero.
2441          */
2442         spin_lock_irqsave(&tty_ldisc_lock, flags);
2443         while(tty->ldisc.refcount)
2444         {
2445                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
2446                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
2447                 spin_lock_irqsave(&tty_ldisc_lock, flags);
2448         }
2449         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
2450         /*
2451          * Shutdown the current line discipline, and reset it to N_TTY.
2452          * N.B. why reset ldisc when we're releasing the memory??
2453          *
2454          * FIXME: this MUST get fixed for the new reflocking
2455          */
2456         if (tty->ldisc.close)
2457                 (tty->ldisc.close)(tty);
2458         tty_ldisc_put(tty->ldisc.num);
2459         
2460         /*
2461          *      Switch the line discipline back
2462          */
2463         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2464         tty_set_termios_ldisc(tty,N_TTY); 
2465         if (o_tty) {
2466                 /* FIXME: could o_tty be in setldisc here ? */
2467                 clear_bit(TTY_LDISC, &o_tty->flags);
2468                 if (o_tty->ldisc.close)
2469                         (o_tty->ldisc.close)(o_tty);
2470                 tty_ldisc_put(o_tty->ldisc.num);
2471                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
2472                 tty_set_termios_ldisc(o_tty,N_TTY); 
2473         }
2474         /*
2475          * The release_tty function takes care of the details of clearing
2476          * the slots and preserving the termios structure.
2477          */
2478         release_tty(tty, idx);
2479
2480 #ifdef CONFIG_UNIX98_PTYS
2481         /* Make this pty number available for reallocation */
2482         if (devpts) {
2483                 down(&allocated_ptys_lock);
2484                 idr_remove(&allocated_ptys, idx);
2485                 up(&allocated_ptys_lock);
2486         }
2487 #endif
2488
2489 }
2490
2491 /**
2492  *      tty_open                -       open a tty device
2493  *      @inode: inode of device file
2494  *      @filp: file pointer to tty
2495  *
2496  *      tty_open and tty_release keep up the tty count that contains the
2497  *      number of opens done on a tty. We cannot use the inode-count, as
2498  *      different inodes might point to the same tty.
2499  *
2500  *      Open-counting is needed for pty masters, as well as for keeping
2501  *      track of serial lines: DTR is dropped when the last close happens.
2502  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
2503  *
2504  *      The termios state of a pty is reset on first open so that
2505  *      settings don't persist across reuse.
2506  *
2507  *      Locking: tty_mutex protects tty, get_tty_driver and init_dev work.
2508  *               tty->count should protect the rest.
2509  *               ->siglock protects ->signal/->sighand
2510  */
2511
2512 static int tty_open(struct inode * inode, struct file * filp)
2513 {
2514         struct tty_struct *tty;
2515         int noctty, retval;
2516         struct tty_driver *driver;
2517         int index;
2518         dev_t device = inode->i_rdev;
2519         unsigned short saved_flags = filp->f_flags;
2520
2521         nonseekable_open(inode, filp);
2522         
2523 retry_open:
2524         noctty = filp->f_flags & O_NOCTTY;
2525         index  = -1;
2526         retval = 0;
2527         
2528         mutex_lock(&tty_mutex);
2529
2530         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2531                 tty = get_current_tty();
2532                 if (!tty) {
2533                         mutex_unlock(&tty_mutex);
2534                         return -ENXIO;
2535                 }
2536                 driver = tty->driver;
2537                 index = tty->index;
2538                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2539                 /* noctty = 1; */
2540                 goto got_driver;
2541         }
2542 #ifdef CONFIG_VT
2543         if (device == MKDEV(TTY_MAJOR,0)) {
2544                 extern struct tty_driver *console_driver;
2545                 driver = console_driver;
2546                 index = fg_console;
2547                 noctty = 1;
2548                 goto got_driver;
2549         }
2550 #endif
2551         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2552                 driver = console_device(&index);
2553                 if (driver) {
2554                         /* Don't let /dev/console block */
2555                         filp->f_flags |= O_NONBLOCK;
2556                         noctty = 1;
2557                         goto got_driver;
2558                 }
2559                 mutex_unlock(&tty_mutex);
2560                 return -ENODEV;
2561         }
2562
2563         driver = get_tty_driver(device, &index);
2564         if (!driver) {
2565                 mutex_unlock(&tty_mutex);
2566                 return -ENODEV;
2567         }
2568 got_driver:
2569         retval = init_dev(driver, index, &tty);
2570         mutex_unlock(&tty_mutex);
2571         if (retval)
2572                 return retval;
2573
2574         filp->private_data = tty;
2575         file_move(filp, &tty->tty_files);
2576         check_tty_count(tty, "tty_open");
2577         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2578             tty->driver->subtype == PTY_TYPE_MASTER)
2579                 noctty = 1;
2580 #ifdef TTY_DEBUG_HANGUP
2581         printk(KERN_DEBUG "opening %s...", tty->name);
2582 #endif
2583         if (!retval) {
2584                 if (tty->driver->open)
2585                         retval = tty->driver->open(tty, filp);
2586                 else
2587                         retval = -ENODEV;
2588         }
2589         filp->f_flags = saved_flags;
2590
2591         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2592                 retval = -EBUSY;
2593
2594         if (retval) {
2595 #ifdef TTY_DEBUG_HANGUP
2596                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2597                        tty->name);
2598 #endif
2599                 release_dev(filp);
2600                 if (retval != -ERESTARTSYS)
2601                         return retval;
2602                 if (signal_pending(current))
2603                         return retval;
2604                 schedule();
2605                 /*
2606                  * Need to reset f_op in case a hangup happened.
2607                  */
2608                 if (filp->f_op == &hung_up_tty_fops)
2609                         filp->f_op = &tty_fops;
2610                 goto retry_open;
2611         }
2612
2613         mutex_lock(&tty_mutex);
2614         spin_lock_irq(&current->sighand->siglock);
2615         if (!noctty &&
2616             current->signal->leader &&
2617             !current->signal->tty &&
2618             tty->session == NULL)
2619                 __proc_set_tty(current, tty);
2620         spin_unlock_irq(&current->sighand->siglock);
2621         mutex_unlock(&tty_mutex);
2622         return 0;
2623 }
2624
2625 #ifdef CONFIG_UNIX98_PTYS
2626 /**
2627  *      ptmx_open               -       open a unix 98 pty master
2628  *      @inode: inode of device file
2629  *      @filp: file pointer to tty
2630  *
2631  *      Allocate a unix98 pty master device from the ptmx driver.
2632  *
2633  *      Locking: tty_mutex protects theinit_dev work. tty->count should
2634                 protect the rest.
2635  *              allocated_ptys_lock handles the list of free pty numbers
2636  */
2637
2638 static int ptmx_open(struct inode * inode, struct file * filp)
2639 {
2640         struct tty_struct *tty;
2641         int retval;
2642         int index;
2643         int idr_ret;
2644
2645         nonseekable_open(inode, filp);
2646
2647         /* find a device that is not in use. */
2648         down(&allocated_ptys_lock);
2649         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2650                 up(&allocated_ptys_lock);
2651                 return -ENOMEM;
2652         }
2653         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2654         if (idr_ret < 0) {
2655                 up(&allocated_ptys_lock);
2656                 if (idr_ret == -EAGAIN)
2657                         return -ENOMEM;
2658                 return -EIO;
2659         }
2660         if (index >= pty_limit) {
2661                 idr_remove(&allocated_ptys, index);
2662                 up(&allocated_ptys_lock);
2663                 return -EIO;
2664         }
2665         up(&allocated_ptys_lock);
2666
2667         mutex_lock(&tty_mutex);
2668         retval = init_dev(ptm_driver, index, &tty);
2669         mutex_unlock(&tty_mutex);
2670         
2671         if (retval)
2672                 goto out;
2673
2674         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2675         filp->private_data = tty;
2676         file_move(filp, &tty->tty_files);
2677
2678         retval = -ENOMEM;
2679         if (devpts_pty_new(tty->link))
2680                 goto out1;
2681
2682         check_tty_count(tty, "tty_open");
2683         retval = ptm_driver->open(tty, filp);
2684         if (!retval)
2685                 return 0;
2686 out1:
2687         release_dev(filp);
2688         return retval;
2689 out:
2690         down(&allocated_ptys_lock);
2691         idr_remove(&allocated_ptys, index);
2692         up(&allocated_ptys_lock);
2693         return retval;
2694 }
2695 #endif
2696
2697 /**
2698  *      tty_release             -       vfs callback for close
2699  *      @inode: inode of tty
2700  *      @filp: file pointer for handle to tty
2701  *
2702  *      Called the last time each file handle is closed that references
2703  *      this tty. There may however be several such references.
2704  *
2705  *      Locking:
2706  *              Takes bkl. See release_dev
2707  */
2708
2709 static int tty_release(struct inode * inode, struct file * filp)
2710 {
2711         lock_kernel();
2712         release_dev(filp);
2713         unlock_kernel();
2714         return 0;
2715 }
2716
2717 /**
2718  *      tty_poll        -       check tty status
2719  *      @filp: file being polled
2720  *      @wait: poll wait structures to update
2721  *
2722  *      Call the line discipline polling method to obtain the poll
2723  *      status of the device.
2724  *
2725  *      Locking: locks called line discipline but ldisc poll method
2726  *      may be re-entered freely by other callers.
2727  */
2728
2729 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2730 {
2731         struct tty_struct * tty;
2732         struct tty_ldisc *ld;
2733         int ret = 0;
2734
2735         tty = (struct tty_struct *)filp->private_data;
2736         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2737                 return 0;
2738                 
2739         ld = tty_ldisc_ref_wait(tty);
2740         if (ld->poll)
2741                 ret = (ld->poll)(tty, filp, wait);
2742         tty_ldisc_deref(ld);
2743         return ret;
2744 }
2745
2746 static int tty_fasync(int fd, struct file * filp, int on)
2747 {
2748         struct tty_struct * tty;
2749         int retval;
2750
2751         tty = (struct tty_struct *)filp->private_data;
2752         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2753                 return 0;
2754         
2755         retval = fasync_helper(fd, filp, on, &tty->fasync);
2756         if (retval <= 0)
2757                 return retval;
2758
2759         if (on) {
2760                 enum pid_type type;
2761                 struct pid *pid;
2762                 if (!waitqueue_active(&tty->read_wait))
2763                         tty->minimum_to_wake = 1;
2764                 if (tty->pgrp) {
2765                         pid = tty->pgrp;
2766                         type = PIDTYPE_PGID;
2767                 } else {
2768                         pid = task_pid(current);
2769                         type = PIDTYPE_PID;
2770                 }
2771                 retval = __f_setown(filp, pid, type, 0);
2772                 if (retval)
2773                         return retval;
2774         } else {
2775                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2776                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2777         }
2778         return 0;
2779 }
2780
2781 /**
2782  *      tiocsti                 -       fake input character
2783  *      @tty: tty to fake input into
2784  *      @p: pointer to character
2785  *
2786  *      Fake input to a tty device. Does the neccessary locking and
2787  *      input management.
2788  *
2789  *      FIXME: does not honour flow control ??
2790  *
2791  *      Locking:
2792  *              Called functions take tty_ldisc_lock
2793  *              current->signal->tty check is safe without locks
2794  *
2795  *      FIXME: may race normal receive processing
2796  */
2797
2798 static int tiocsti(struct tty_struct *tty, char __user *p)
2799 {
2800         char ch, mbz = 0;
2801         struct tty_ldisc *ld;
2802         
2803         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2804                 return -EPERM;
2805         if (get_user(ch, p))
2806                 return -EFAULT;
2807         ld = tty_ldisc_ref_wait(tty);
2808         ld->receive_buf(tty, &ch, &mbz, 1);
2809         tty_ldisc_deref(ld);
2810         return 0;
2811 }
2812
2813 /**
2814  *      tiocgwinsz              -       implement window query ioctl
2815  *      @tty; tty
2816  *      @arg: user buffer for result
2817  *
2818  *      Copies the kernel idea of the window size into the user buffer.
2819  *
2820  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2821  *              is consistent.
2822  */
2823
2824 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2825 {
2826         int err;
2827
2828         mutex_lock(&tty->termios_mutex);
2829         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2830         mutex_unlock(&tty->termios_mutex);
2831
2832         return err ? -EFAULT: 0;
2833 }
2834
2835 /**
2836  *      tiocswinsz              -       implement window size set ioctl
2837  *      @tty; tty
2838  *      @arg: user buffer for result
2839  *
2840  *      Copies the user idea of the window size to the kernel. Traditionally
2841  *      this is just advisory information but for the Linux console it
2842  *      actually has driver level meaning and triggers a VC resize.
2843  *
2844  *      Locking:
2845  *              Called function use the console_sem is used to ensure we do
2846  *      not try and resize the console twice at once.
2847  *              The tty->termios_mutex is used to ensure we don't double
2848  *      resize and get confused. Lock order - tty->termios_mutex before
2849  *      console sem
2850  */
2851
2852 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2853         struct winsize __user * arg)
2854 {
2855         struct winsize tmp_ws;
2856
2857         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2858                 return -EFAULT;
2859
2860         mutex_lock(&tty->termios_mutex);
2861         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2862                 goto done;
2863
2864 #ifdef CONFIG_VT
2865         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2866                 if (vc_lock_resize(tty->driver_data, tmp_ws.ws_col,
2867                                         tmp_ws.ws_row)) {
2868                         mutex_unlock(&tty->termios_mutex);
2869                         return -ENXIO;
2870                 }
2871         }
2872 #endif
2873         if (tty->pgrp)
2874                 kill_pgrp(tty->pgrp, SIGWINCH, 1);
2875         if ((real_tty->pgrp != tty->pgrp) && real_tty->pgrp)
2876                 kill_pgrp(real_tty->pgrp, SIGWINCH, 1);
2877         tty->winsize = tmp_ws;
2878         real_tty->winsize = tmp_ws;
2879 done:
2880         mutex_unlock(&tty->termios_mutex);
2881         return 0;
2882 }
2883
2884 /**
2885  *      tioccons        -       allow admin to move logical console
2886  *      @file: the file to become console
2887  *
2888  *      Allow the adminstrator to move the redirected console device
2889  *
2890  *      Locking: uses redirect_lock to guard the redirect information
2891  */
2892
2893 static int tioccons(struct file *file)
2894 {
2895         if (!capable(CAP_SYS_ADMIN))
2896                 return -EPERM;
2897         if (file->f_op->write == redirected_tty_write) {
2898                 struct file *f;
2899                 spin_lock(&redirect_lock);
2900                 f = redirect;
2901                 redirect = NULL;
2902                 spin_unlock(&redirect_lock);
2903                 if (f)
2904                         fput(f);
2905                 return 0;
2906         }
2907         spin_lock(&redirect_lock);
2908         if (redirect) {
2909                 spin_unlock(&redirect_lock);
2910                 return -EBUSY;
2911         }
2912         get_file(file);
2913         redirect = file;
2914         spin_unlock(&redirect_lock);
2915         return 0;
2916 }
2917
2918 /**
2919  *      fionbio         -       non blocking ioctl
2920  *      @file: file to set blocking value
2921  *      @p: user parameter
2922  *
2923  *      Historical tty interfaces had a blocking control ioctl before
2924  *      the generic functionality existed. This piece of history is preserved
2925  *      in the expected tty API of posix OS's.
2926  *
2927  *      Locking: none, the open fle handle ensures it won't go away.
2928  */
2929
2930 static int fionbio(struct file *file, int __user *p)
2931 {
2932         int nonblock;
2933
2934         if (get_user(nonblock, p))
2935                 return -EFAULT;
2936
2937         if (nonblock)
2938                 file->f_flags |= O_NONBLOCK;
2939         else
2940                 file->f_flags &= ~O_NONBLOCK;
2941         return 0;
2942 }
2943
2944 /**
2945  *      tiocsctty       -       set controlling tty
2946  *      @tty: tty structure
2947  *      @arg: user argument
2948  *
2949  *      This ioctl is used to manage job control. It permits a session
2950  *      leader to set this tty as the controlling tty for the session.
2951  *
2952  *      Locking:
2953  *              Takes tty_mutex() to protect tty instance
2954  *              Takes tasklist_lock internally to walk sessions
2955  *              Takes ->siglock() when updating signal->tty
2956  */
2957
2958 static int tiocsctty(struct tty_struct *tty, int arg)
2959 {
2960         int ret = 0;
2961         if (current->signal->leader && (task_session(current) == tty->session))
2962                 return ret;
2963
2964         mutex_lock(&tty_mutex);
2965         /*
2966          * The process must be a session leader and
2967          * not have a controlling tty already.
2968          */
2969         if (!current->signal->leader || current->signal->tty) {
2970                 ret = -EPERM;
2971                 goto unlock;
2972         }
2973
2974         if (tty->session) {
2975                 /*
2976                  * This tty is already the controlling
2977                  * tty for another session group!
2978                  */
2979                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
2980                         /*
2981                          * Steal it away
2982                          */
2983                         read_lock(&tasklist_lock);
2984                         session_clear_tty(tty->session);
2985                         read_unlock(&tasklist_lock);
2986                 } else {
2987                         ret = -EPERM;
2988                         goto unlock;
2989                 }
2990         }
2991         proc_set_tty(current, tty);
2992 unlock:
2993         mutex_unlock(&tty_mutex);
2994         return ret;
2995 }
2996
2997 /**
2998  *      tiocgpgrp               -       get process group
2999  *      @tty: tty passed by user
3000  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
3001  *      @p: returned pid
3002  *
3003  *      Obtain the process group of the tty. If there is no process group
3004  *      return an error.
3005  *
3006  *      Locking: none. Reference to current->signal->tty is safe.
3007  */
3008
3009 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3010 {
3011         /*
3012          * (tty == real_tty) is a cheap way of
3013          * testing if the tty is NOT a master pty.
3014          */
3015         if (tty == real_tty && current->signal->tty != real_tty)
3016                 return -ENOTTY;
3017         return put_user(pid_nr(real_tty->pgrp), p);
3018 }
3019
3020 /**
3021  *      tiocspgrp               -       attempt to set process group
3022  *      @tty: tty passed by user
3023  *      @real_tty: tty side device matching tty passed by user
3024  *      @p: pid pointer
3025  *
3026  *      Set the process group of the tty to the session passed. Only
3027  *      permitted where the tty session is our session.
3028  *
3029  *      Locking: None
3030  */
3031
3032 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3033 {
3034         struct pid *pgrp;
3035         pid_t pgrp_nr;
3036         int retval = tty_check_change(real_tty);
3037
3038         if (retval == -EIO)
3039                 return -ENOTTY;
3040         if (retval)
3041                 return retval;
3042         if (!current->signal->tty ||
3043             (current->signal->tty != real_tty) ||
3044             (real_tty->session != task_session(current)))
3045                 return -ENOTTY;
3046         if (get_user(pgrp_nr, p))
3047                 return -EFAULT;
3048         if (pgrp_nr < 0)
3049                 return -EINVAL;
3050         rcu_read_lock();
3051         pgrp = find_pid(pgrp_nr);
3052         retval = -ESRCH;
3053         if (!pgrp)
3054                 goto out_unlock;
3055         retval = -EPERM;
3056         if (session_of_pgrp(pgrp) != task_session(current))
3057                 goto out_unlock;
3058         retval = 0;
3059         put_pid(real_tty->pgrp);
3060         real_tty->pgrp = get_pid(pgrp);
3061 out_unlock:
3062         rcu_read_unlock();
3063         return retval;
3064 }
3065
3066 /**
3067  *      tiocgsid                -       get session id
3068  *      @tty: tty passed by user
3069  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
3070  *      @p: pointer to returned session id
3071  *
3072  *      Obtain the session id of the tty. If there is no session
3073  *      return an error.
3074  *
3075  *      Locking: none. Reference to current->signal->tty is safe.
3076  */
3077
3078 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3079 {
3080         /*
3081          * (tty == real_tty) is a cheap way of
3082          * testing if the tty is NOT a master pty.
3083         */
3084         if (tty == real_tty && current->signal->tty != real_tty)
3085                 return -ENOTTY;
3086         if (!real_tty->session)
3087                 return -ENOTTY;
3088         return put_user(pid_nr(real_tty->session), p);
3089 }
3090
3091 /**
3092  *      tiocsetd        -       set line discipline
3093  *      @tty: tty device
3094  *      @p: pointer to user data
3095  *
3096  *      Set the line discipline according to user request.
3097  *
3098  *      Locking: see tty_set_ldisc, this function is just a helper
3099  */
3100
3101 static int tiocsetd(struct tty_struct *tty, int __user *p)
3102 {
3103         int ldisc;
3104
3105         if (get_user(ldisc, p))
3106                 return -EFAULT;
3107         return tty_set_ldisc(tty, ldisc);
3108 }
3109
3110 /**
3111  *      send_break      -       performed time break
3112  *      @tty: device to break on
3113  *      @duration: timeout in mS
3114  *
3115  *      Perform a timed break on hardware that lacks its own driver level
3116  *      timed break functionality.
3117  *
3118  *      Locking:
3119  *              atomic_write_lock serializes
3120  *
3121  */
3122
3123 static int send_break(struct tty_struct *tty, unsigned int duration)
3124 {
3125         if (mutex_lock_interruptible(&tty->atomic_write_lock))
3126                 return -EINTR;
3127         tty->driver->break_ctl(tty, -1);
3128         if (!signal_pending(current)) {
3129                 msleep_interruptible(duration);
3130         }
3131         tty->driver->break_ctl(tty, 0);
3132         mutex_unlock(&tty->atomic_write_lock);
3133         if (signal_pending(current))
3134                 return -EINTR;
3135         return 0;
3136 }
3137
3138 /**
3139  *      tiocmget                -       get modem status
3140  *      @tty: tty device
3141  *      @file: user file pointer
3142  *      @p: pointer to result
3143  *
3144  *      Obtain the modem status bits from the tty driver if the feature
3145  *      is supported. Return -EINVAL if it is not available.
3146  *
3147  *      Locking: none (up to the driver)
3148  */
3149
3150 static int tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
3151 {
3152         int retval = -EINVAL;
3153
3154         if (tty->driver->tiocmget) {
3155                 retval = tty->driver->tiocmget(tty, file);
3156
3157                 if (retval >= 0)
3158                         retval = put_user(retval, p);
3159         }
3160         return retval;
3161 }
3162
3163 /**
3164  *      tiocmset                -       set modem status
3165  *      @tty: tty device
3166  *      @file: user file pointer
3167  *      @cmd: command - clear bits, set bits or set all
3168  *      @p: pointer to desired bits
3169  *
3170  *      Set the modem status bits from the tty driver if the feature
3171  *      is supported. Return -EINVAL if it is not available.
3172  *
3173  *      Locking: none (up to the driver)
3174  */
3175
3176 static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
3177              unsigned __user *p)
3178 {
3179         int retval = -EINVAL;
3180
3181         if (tty->driver->tiocmset) {
3182                 unsigned int set, clear, val;
3183
3184                 retval = get_user(val, p);
3185                 if (retval)
3186                         return retval;
3187
3188                 set = clear = 0;
3189                 switch (cmd) {
3190                 case TIOCMBIS:
3191                         set = val;
3192                         break;
3193                 case TIOCMBIC:
3194                         clear = val;
3195                         break;
3196                 case TIOCMSET:
3197                         set = val;
3198                         clear = ~val;
3199                         break;
3200                 }
3201
3202                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
3203                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
3204
3205                 retval = tty->driver->tiocmset(tty, file, set, clear);
3206         }
3207         return retval;
3208 }
3209
3210 /*
3211  * Split this up, as gcc can choke on it otherwise..
3212  */
3213 int tty_ioctl(struct inode * inode, struct file * file,
3214               unsigned int cmd, unsigned long arg)
3215 {
3216         struct tty_struct *tty, *real_tty;
3217         void __user *p = (void __user *)arg;
3218         int retval;
3219         struct tty_ldisc *ld;
3220         
3221         tty = (struct tty_struct *)file->private_data;
3222         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
3223                 return -EINVAL;
3224
3225         /* CHECKME: is this safe as one end closes ? */
3226
3227         real_tty = tty;
3228         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
3229             tty->driver->subtype == PTY_TYPE_MASTER)
3230                 real_tty = tty->link;
3231
3232         /*
3233          * Break handling by driver
3234          */
3235         if (!tty->driver->break_ctl) {
3236                 switch(cmd) {
3237                 case TIOCSBRK:
3238                 case TIOCCBRK:
3239                         if (tty->driver->ioctl)
3240                                 return tty->driver->ioctl(tty, file, cmd, arg);
3241                         return -EINVAL;
3242                         
3243                 /* These two ioctl's always return success; even if */
3244                 /* the driver doesn't support them. */
3245                 case TCSBRK:
3246                 case TCSBRKP:
3247                         if (!tty->driver->ioctl)
3248                                 return 0;
3249                         retval = tty->driver->ioctl(tty, file, cmd, arg);
3250                         if (retval == -ENOIOCTLCMD)
3251                                 retval = 0;
3252                         return retval;
3253                 }
3254         }
3255
3256         /*
3257          * Factor out some common prep work
3258          */
3259         switch (cmd) {
3260         case TIOCSETD:
3261         case TIOCSBRK:
3262         case TIOCCBRK:
3263         case TCSBRK:
3264         case TCSBRKP:                   
3265                 retval = tty_check_change(tty);
3266                 if (retval)
3267                         return retval;
3268                 if (cmd != TIOCCBRK) {
3269                         tty_wait_until_sent(tty, 0);
3270                         if (signal_pending(current))
3271                                 return -EINTR;
3272                 }
3273                 break;
3274         }
3275
3276         switch (cmd) {
3277                 case TIOCSTI:
3278                         return tiocsti(tty, p);
3279                 case TIOCGWINSZ:
3280                         return tiocgwinsz(tty, p);
3281                 case TIOCSWINSZ:
3282                         return tiocswinsz(tty, real_tty, p);
3283                 case TIOCCONS:
3284                         return real_tty!=tty ? -EINVAL : tioccons(file);
3285                 case FIONBIO:
3286                         return fionbio(file, p);
3287                 case TIOCEXCL:
3288                         set_bit(TTY_EXCLUSIVE, &tty->flags);
3289                         return 0;
3290                 case TIOCNXCL:
3291                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
3292                         return 0;
3293                 case TIOCNOTTY:
3294                         if (current->signal->tty != tty)
3295                                 return -ENOTTY;
3296                         no_tty();
3297                         return 0;
3298                 case TIOCSCTTY:
3299                         return tiocsctty(tty, arg);
3300                 case TIOCGPGRP:
3301                         return tiocgpgrp(tty, real_tty, p);
3302                 case TIOCSPGRP:
3303                         return tiocspgrp(tty, real_tty, p);
3304                 case TIOCGSID:
3305                         return tiocgsid(tty, real_tty, p);
3306                 case TIOCGETD:
3307                         /* FIXME: check this is ok */
3308                         return put_user(tty->ldisc.num, (int __user *)p);
3309                 case TIOCSETD:
3310                         return tiocsetd(tty, p);
3311 #ifdef CONFIG_VT
3312                 case TIOCLINUX:
3313                         return tioclinux(tty, arg);
3314 #endif
3315                 /*
3316                  * Break handling
3317                  */
3318                 case TIOCSBRK:  /* Turn break on, unconditionally */
3319                         tty->driver->break_ctl(tty, -1);
3320                         return 0;
3321                         
3322                 case TIOCCBRK:  /* Turn break off, unconditionally */
3323                         tty->driver->break_ctl(tty, 0);
3324                         return 0;
3325                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
3326                         /* non-zero arg means wait for all output data
3327                          * to be sent (performed above) but don't send break.
3328                          * This is used by the tcdrain() termios function.
3329                          */
3330                         if (!arg)
3331                                 return send_break(tty, 250);
3332                         return 0;
3333                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
3334                         return send_break(tty, arg ? arg*100 : 250);
3335
3336                 case TIOCMGET:
3337                         return tty_tiocmget(tty, file, p);
3338
3339                 case TIOCMSET:
3340                 case TIOCMBIC:
3341                 case TIOCMBIS:
3342                         return tty_tiocmset(tty, file, cmd, p);
3343         }
3344         if (tty->driver->ioctl) {
3345                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
3346                 if (retval != -ENOIOCTLCMD)
3347                         return retval;
3348         }
3349         ld = tty_ldisc_ref_wait(tty);
3350         retval = -EINVAL;
3351         if (ld->ioctl) {
3352                 retval = ld->ioctl(tty, file, cmd, arg);
3353                 if (retval == -ENOIOCTLCMD)
3354                         retval = -EINVAL;
3355         }
3356         tty_ldisc_deref(ld);
3357         return retval;
3358 }
3359
3360
3361 /*
3362  * This implements the "Secure Attention Key" ---  the idea is to
3363  * prevent trojan horses by killing all processes associated with this
3364  * tty when the user hits the "Secure Attention Key".  Required for
3365  * super-paranoid applications --- see the Orange Book for more details.
3366  * 
3367  * This code could be nicer; ideally it should send a HUP, wait a few
3368  * seconds, then send a INT, and then a KILL signal.  But you then
3369  * have to coordinate with the init process, since all processes associated
3370  * with the current tty must be dead before the new getty is allowed
3371  * to spawn.
3372  *
3373  * Now, if it would be correct ;-/ The current code has a nasty hole -
3374  * it doesn't catch files in flight. We may send the descriptor to ourselves
3375  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
3376  *
3377  * Nasty bug: do_SAK is being called in interrupt context.  This can
3378  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
3379  */
3380 void __do_SAK(struct tty_struct *tty)
3381 {
3382 #ifdef TTY_SOFT_SAK
3383         tty_hangup(tty);
3384 #else
3385         struct task_struct *g, *p;
3386         struct pid *session;
3387         int             i;
3388         struct file     *filp;
3389         struct fdtable *fdt;
3390         
3391         if (!tty)
3392                 return;
3393         session = tty->session;
3394         
3395         tty_ldisc_flush(tty);
3396
3397         if (tty->driver->flush_buffer)
3398                 tty->driver->flush_buffer(tty);
3399         
3400         read_lock(&tasklist_lock);
3401         /* Kill the entire session */
3402         do_each_pid_task(session, PIDTYPE_SID, p) {
3403                 printk(KERN_NOTICE "SAK: killed process %d"
3404                         " (%s): process_session(p)==tty->session\n",
3405                         p->pid, p->comm);
3406                 send_sig(SIGKILL, p, 1);
3407         } while_each_pid_task(session, PIDTYPE_SID, p);
3408         /* Now kill any processes that happen to have the
3409          * tty open.
3410          */
3411         do_each_thread(g, p) {
3412                 if (p->signal->tty == tty) {
3413                         printk(KERN_NOTICE "SAK: killed process %d"
3414                             " (%s): process_session(p)==tty->session\n",
3415                             p->pid, p->comm);
3416                         send_sig(SIGKILL, p, 1);
3417                         continue;
3418                 }
3419                 task_lock(p);
3420                 if (p->files) {
3421                         /*
3422                          * We don't take a ref to the file, so we must
3423                          * hold ->file_lock instead.
3424                          */
3425                         spin_lock(&p->files->file_lock);
3426                         fdt = files_fdtable(p->files);
3427                         for (i=0; i < fdt->max_fds; i++) {
3428                                 filp = fcheck_files(p->files, i);
3429                                 if (!filp)
3430                                         continue;
3431                                 if (filp->f_op->read == tty_read &&
3432                                     filp->private_data == tty) {
3433                                         printk(KERN_NOTICE "SAK: killed process %d"
3434                                             " (%s): fd#%d opened to the tty\n",
3435                                             p->pid, p->comm, i);
3436                                         force_sig(SIGKILL, p);
3437                                         break;
3438                                 }
3439                         }
3440                         spin_unlock(&p->files->file_lock);
3441                 }
3442                 task_unlock(p);
3443         } while_each_thread(g, p);
3444         read_unlock(&tasklist_lock);
3445 #endif
3446 }
3447
3448 static void do_SAK_work(struct work_struct *work)
3449 {
3450         struct tty_struct *tty =
3451                 container_of(work, struct tty_struct, SAK_work);
3452         __do_SAK(tty);
3453 }
3454
3455 /*
3456  * The tq handling here is a little racy - tty->SAK_work may already be queued.
3457  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3458  * the values which we write to it will be identical to the values which it
3459  * already has. --akpm
3460  */
3461 void do_SAK(struct tty_struct *tty)
3462 {
3463         if (!tty)
3464                 return;
3465         schedule_work(&tty->SAK_work);
3466 }
3467
3468 EXPORT_SYMBOL(do_SAK);
3469
3470 /**
3471  *      flush_to_ldisc
3472  *      @work: tty structure passed from work queue.
3473  *
3474  *      This routine is called out of the software interrupt to flush data
3475  *      from the buffer chain to the line discipline.
3476  *
3477  *      Locking: holds tty->buf.lock to guard buffer list. Drops the lock
3478  *      while invoking the line discipline receive_buf method. The
3479  *      receive_buf method is single threaded for each tty instance.
3480  */
3481  
3482 static void flush_to_ldisc(struct work_struct *work)
3483 {
3484         struct tty_struct *tty =
3485                 container_of(work, struct tty_struct, buf.work.work);
3486         unsigned long   flags;
3487         struct tty_ldisc *disc;
3488         struct tty_buffer *tbuf, *head;
3489         char *char_buf;
3490         unsigned char *flag_buf;
3491
3492         disc = tty_ldisc_ref(tty);
3493         if (disc == NULL)       /*  !TTY_LDISC */
3494                 return;
3495
3496         spin_lock_irqsave(&tty->buf.lock, flags);
3497         head = tty->buf.head;
3498         if (head != NULL) {
3499                 tty->buf.head = NULL;
3500                 for (;;) {
3501                         int count = head->commit - head->read;
3502                         if (!count) {
3503                                 if (head->next == NULL)
3504                                         break;
3505                                 tbuf = head;
3506                                 head = head->next;
3507                                 tty_buffer_free(tty, tbuf);
3508                                 continue;
3509                         }
3510                         if (!tty->receive_room) {
3511                                 schedule_delayed_work(&tty->buf.work, 1);
3512                                 break;
3513                         }
3514                         if (count > tty->receive_room)
3515                                 count = tty->receive_room;
3516                         char_buf = head->char_buf_ptr + head->read;
3517                         flag_buf = head->flag_buf_ptr + head->read;
3518                         head->read += count;
3519                         spin_unlock_irqrestore(&tty->buf.lock, flags);
3520                         disc->receive_buf(tty, char_buf, flag_buf, count);
3521                         spin_lock_irqsave(&tty->buf.lock, flags);
3522                 }
3523                 tty->buf.head = head;
3524         }
3525         spin_unlock_irqrestore(&tty->buf.lock, flags);
3526
3527         tty_ldisc_deref(disc);
3528 }
3529
3530 /**
3531  *      tty_flip_buffer_push    -       terminal
3532  *      @tty: tty to push
3533  *
3534  *      Queue a push of the terminal flip buffers to the line discipline. This
3535  *      function must not be called from IRQ context if tty->low_latency is set.
3536  *
3537  *      In the event of the queue being busy for flipping the work will be
3538  *      held off and retried later.
3539  *
3540  *      Locking: tty buffer lock. Driver locks in low latency mode.
3541  */
3542
3543 void tty_flip_buffer_push(struct tty_struct *tty)
3544 {
3545         unsigned long flags;
3546         spin_lock_irqsave(&tty->buf.lock, flags);
3547         if (tty->buf.tail != NULL)
3548                 tty->buf.tail->commit = tty->buf.tail->used;
3549         spin_unlock_irqrestore(&tty->buf.lock, flags);
3550
3551         if (tty->low_latency)
3552                 flush_to_ldisc(&tty->buf.work.work);
3553         else
3554                 schedule_delayed_work(&tty->buf.work, 1);
3555 }
3556
3557 EXPORT_SYMBOL(tty_flip_buffer_push);
3558
3559
3560 /**
3561  *      initialize_tty_struct
3562  *      @tty: tty to initialize
3563  *
3564  *      This subroutine initializes a tty structure that has been newly
3565  *      allocated.
3566  *
3567  *      Locking: none - tty in question must not be exposed at this point
3568  */
3569
3570 static void initialize_tty_struct(struct tty_struct *tty)
3571 {
3572         memset(tty, 0, sizeof(struct tty_struct));
3573         tty->magic = TTY_MAGIC;
3574         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
3575         tty->session = NULL;
3576         tty->pgrp = NULL;
3577         tty->overrun_time = jiffies;
3578         tty->buf.head = tty->buf.tail = NULL;
3579         tty_buffer_init(tty);
3580         INIT_DELAYED_WORK(&tty->buf.work, flush_to_ldisc);
3581         init_MUTEX(&tty->buf.pty_sem);
3582         mutex_init(&tty->termios_mutex);
3583         init_waitqueue_head(&tty->write_wait);
3584         init_waitqueue_head(&tty->read_wait);
3585         INIT_WORK(&tty->hangup_work, do_tty_hangup);
3586         mutex_init(&tty->atomic_read_lock);
3587         mutex_init(&tty->atomic_write_lock);
3588         spin_lock_init(&tty->read_lock);
3589         INIT_LIST_HEAD(&tty->tty_files);
3590         INIT_WORK(&tty->SAK_work, do_SAK_work);
3591 }
3592
3593 /*
3594  * The default put_char routine if the driver did not define one.
3595  */
3596
3597 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
3598 {
3599         tty->driver->write(tty, &ch, 1);
3600 }
3601
3602 static struct class *tty_class;
3603
3604 /**
3605  *      tty_register_device - register a tty device
3606  *      @driver: the tty driver that describes the tty device
3607  *      @index: the index in the tty driver for this tty device
3608  *      @device: a struct device that is associated with this tty device.
3609  *              This field is optional, if there is no known struct device
3610  *              for this tty device it can be set to NULL safely.
3611  *
3612  *      Returns a pointer to the struct device for this tty device
3613  *      (or ERR_PTR(-EFOO) on error).
3614  *
3615  *      This call is required to be made to register an individual tty device
3616  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3617  *      that bit is not set, this function should not be called by a tty
3618  *      driver.
3619  *
3620  *      Locking: ??
3621  */
3622
3623 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3624                                    struct device *device)
3625 {
3626         char name[64];
3627         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3628
3629         if (index >= driver->num) {
3630                 printk(KERN_ERR "Attempt to register invalid tty line number "
3631                        " (%d).\n", index);
3632                 return ERR_PTR(-EINVAL);
3633         }
3634
3635         if (driver->type == TTY_DRIVER_TYPE_PTY)
3636                 pty_line_name(driver, index, name);
3637         else
3638                 tty_line_name(driver, index, name);
3639
3640         return device_create(tty_class, device, dev, name);
3641 }
3642
3643 /**
3644  *      tty_unregister_device - unregister a tty device
3645  *      @driver: the tty driver that describes the tty device
3646  *      @index: the index in the tty driver for this tty device
3647  *
3648  *      If a tty device is registered with a call to tty_register_device() then
3649  *      this function must be called when the tty device is gone.
3650  *
3651  *      Locking: ??
3652  */
3653
3654 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3655 {
3656         device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
3657 }
3658
3659 EXPORT_SYMBOL(tty_register_device);
3660 EXPORT_SYMBOL(tty_unregister_device);
3661
3662 struct tty_driver *alloc_tty_driver(int lines)
3663 {
3664         struct tty_driver *driver;
3665
3666         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
3667         if (driver) {
3668                 memset(driver, 0, sizeof(struct tty_driver));
3669                 driver->magic = TTY_DRIVER_MAGIC;
3670                 driver->num = lines;
3671                 /* later we'll move allocation of tables here */
3672         }
3673         return driver;
3674 }
3675
3676 void put_tty_driver(struct tty_driver *driver)
3677 {
3678         kfree(driver);
3679 }
3680
3681 void tty_set_operations(struct tty_driver *driver,
3682                         const struct tty_operations *op)
3683 {
3684         driver->open = op->open;
3685         driver->close = op->close;
3686         driver->write = op->write;
3687         driver->put_char = op->put_char;
3688         driver->flush_chars = op->flush_chars;
3689         driver->write_room = op->write_room;
3690         driver->chars_in_buffer = op->chars_in_buffer;
3691         driver->ioctl = op->ioctl;
3692         driver->set_termios = op->set_termios;
3693         driver->throttle = op->throttle;
3694         driver->unthrottle = op->unthrottle;
3695         driver->stop = op->stop;
3696         driver->start = op->start;
3697         driver->hangup = op->hangup;
3698         driver->break_ctl = op->break_ctl;
3699         driver->flush_buffer = op->flush_buffer;
3700         driver->set_ldisc = op->set_ldisc;
3701         driver->wait_until_sent = op->wait_until_sent;
3702         driver->send_xchar = op->send_xchar;
3703         driver->read_proc = op->read_proc;
3704         driver->write_proc = op->write_proc;
3705         driver->tiocmget = op->tiocmget;
3706         driver->tiocmset = op->tiocmset;
3707 }
3708
3709
3710 EXPORT_SYMBOL(alloc_tty_driver);
3711 EXPORT_SYMBOL(put_tty_driver);
3712 EXPORT_SYMBOL(tty_set_operations);
3713
3714 /*
3715  * Called by a tty driver to register itself.
3716  */
3717 int tty_register_driver(struct tty_driver *driver)
3718 {
3719         int error;
3720         int i;
3721         dev_t dev;
3722         void **p = NULL;
3723
3724         if (driver->flags & TTY_DRIVER_INSTALLED)
3725                 return 0;
3726
3727         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
3728                 p = kzalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3729                 if (!p)
3730                         return -ENOMEM;
3731         }
3732
3733         if (!driver->major) {
3734                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3735                                                 driver->name);
3736                 if (!error) {
3737                         driver->major = MAJOR(dev);
3738                         driver->minor_start = MINOR(dev);
3739                 }
3740         } else {
3741                 dev = MKDEV(driver->major, driver->minor_start);
3742                 error = register_chrdev_region(dev, driver->num, driver->name);
3743         }
3744         if (error < 0) {
3745                 kfree(p);
3746                 return error;
3747         }
3748
3749         if (p) {
3750                 driver->ttys = (struct tty_struct **)p;
3751                 driver->termios = (struct ktermios **)(p + driver->num);
3752                 driver->termios_locked = (struct ktermios **)(p + driver->num * 2);
3753         } else {
3754                 driver->ttys = NULL;
3755                 driver->termios = NULL;
3756                 driver->termios_locked = NULL;
3757         }
3758
3759         cdev_init(&driver->cdev, &tty_fops);
3760         driver->cdev.owner = driver->owner;
3761         error = cdev_add(&driver->cdev, dev, driver->num);
3762         if (error) {
3763                 unregister_chrdev_region(dev, driver->num);
3764                 driver->ttys = NULL;
3765                 driver->termios = driver->termios_locked = NULL;
3766                 kfree(p);
3767                 return error;
3768         }
3769
3770         if (!driver->put_char)
3771                 driver->put_char = tty_default_put_char;
3772         
3773         list_add(&driver->tty_drivers, &tty_drivers);
3774         
3775         if ( !(driver->flags & TTY_DRIVER_DYNAMIC_DEV) ) {
3776                 for(i = 0; i < driver->num; i++)
3777                     tty_register_device(driver, i, NULL);
3778         }
3779         proc_tty_register_driver(driver);
3780         return 0;
3781 }
3782
3783 EXPORT_SYMBOL(tty_register_driver);
3784
3785 /*
3786  * Called by a tty driver to unregister itself.
3787  */
3788 int tty_unregister_driver(struct tty_driver *driver)
3789 {
3790         int i;
3791         struct ktermios *tp;
3792         void *p;
3793
3794         if (driver->refcount)
3795                 return -EBUSY;
3796
3797         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3798                                 driver->num);
3799
3800         list_del(&driver->tty_drivers);
3801
3802         /*
3803          * Free the termios and termios_locked structures because
3804          * we don't want to get memory leaks when modular tty
3805          * drivers are removed from the kernel.
3806          */
3807         for (i = 0; i < driver->num; i++) {
3808                 tp = driver->termios[i];
3809                 if (tp) {
3810                         driver->termios[i] = NULL;
3811                         kfree(tp);
3812                 }
3813                 tp = driver->termios_locked[i];
3814                 if (tp) {
3815                         driver->termios_locked[i] = NULL;
3816                         kfree(tp);
3817                 }
3818                 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3819                         tty_unregister_device(driver, i);
3820         }
3821         p = driver->ttys;
3822         proc_tty_unregister_driver(driver);
3823         driver->ttys = NULL;
3824         driver->termios = driver->termios_locked = NULL;
3825         kfree(p);
3826         cdev_del(&driver->cdev);
3827         return 0;
3828 }
3829 EXPORT_SYMBOL(tty_unregister_driver);
3830
3831 dev_t tty_devnum(struct tty_struct *tty)
3832 {
3833         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3834 }
3835 EXPORT_SYMBOL(tty_devnum);
3836
3837 void proc_clear_tty(struct task_struct *p)
3838 {
3839         spin_lock_irq(&p->sighand->siglock);
3840         p->signal->tty = NULL;
3841         spin_unlock_irq(&p->sighand->siglock);
3842 }
3843
3844 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3845 {
3846         if (tty) {
3847                 /* We should not have a session or pgrp to here but.... */
3848                 put_pid(tty->session);
3849                 put_pid(tty->pgrp);
3850                 tty->session = get_pid(task_session(tsk));
3851                 tty->pgrp = get_pid(task_pgrp(tsk));
3852         }
3853         put_pid(tsk->signal->tty_old_pgrp);
3854         tsk->signal->tty = tty;
3855         tsk->signal->tty_old_pgrp = NULL;
3856 }
3857
3858 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3859 {
3860         spin_lock_irq(&tsk->sighand->siglock);
3861         __proc_set_tty(tsk, tty);
3862         spin_unlock_irq(&tsk->sighand->siglock);
3863 }
3864
3865 struct tty_struct *get_current_tty(void)
3866 {
3867         struct tty_struct *tty;
3868         WARN_ON_ONCE(!mutex_is_locked(&tty_mutex));
3869         tty = current->signal->tty;
3870         /*
3871          * session->tty can be changed/cleared from under us, make sure we
3872          * issue the load. The obtained pointer, when not NULL, is valid as
3873          * long as we hold tty_mutex.
3874          */
3875         barrier();
3876         return tty;
3877 }
3878 EXPORT_SYMBOL_GPL(get_current_tty);
3879
3880 /*
3881  * Initialize the console device. This is called *early*, so
3882  * we can't necessarily depend on lots of kernel help here.
3883  * Just do some early initializations, and do the complex setup
3884  * later.
3885  */
3886 void __init console_init(void)
3887 {
3888         initcall_t *call;
3889
3890         /* Setup the default TTY line discipline. */
3891         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
3892
3893         /*
3894          * set up the console device so that later boot sequences can 
3895          * inform about problems etc..
3896          */
3897         call = __con_initcall_start;
3898         while (call < __con_initcall_end) {
3899                 (*call)();
3900                 call++;
3901         }
3902 }
3903
3904 #ifdef CONFIG_VT
3905 extern int vty_init(void);
3906 #endif
3907
3908 static int __init tty_class_init(void)
3909 {
3910         tty_class = class_create(THIS_MODULE, "tty");
3911         if (IS_ERR(tty_class))
3912                 return PTR_ERR(tty_class);
3913         return 0;
3914 }
3915
3916 postcore_initcall(tty_class_init);
3917
3918 /* 3/2004 jmc: why do these devices exist? */
3919
3920 static struct cdev tty_cdev, console_cdev;
3921 #ifdef CONFIG_UNIX98_PTYS
3922 static struct cdev ptmx_cdev;
3923 #endif
3924 #ifdef CONFIG_VT
3925 static struct cdev vc0_cdev;
3926 #endif
3927
3928 /*
3929  * Ok, now we can initialize the rest of the tty devices and can count
3930  * on memory allocations, interrupts etc..
3931  */
3932 static int __init tty_init(void)
3933 {
3934         cdev_init(&tty_cdev, &tty_fops);
3935         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3936             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3937                 panic("Couldn't register /dev/tty driver\n");
3938         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), "tty");
3939
3940         cdev_init(&console_cdev, &console_fops);
3941         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3942             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3943                 panic("Couldn't register /dev/console driver\n");
3944         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), "console");
3945
3946 #ifdef CONFIG_UNIX98_PTYS
3947         cdev_init(&ptmx_cdev, &ptmx_fops);
3948         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
3949             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
3950                 panic("Couldn't register /dev/ptmx driver\n");
3951         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), "ptmx");
3952 #endif
3953
3954 #ifdef CONFIG_VT
3955         cdev_init(&vc0_cdev, &console_fops);
3956         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
3957             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
3958                 panic("Couldn't register /dev/tty0 driver\n");
3959         device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), "tty0");
3960
3961         vty_init();
3962 #endif
3963         return 0;
3964 }
3965 module_init(tty_init);