eb8b5be4e2494c318e9f4af4195d8cd0b63cede7
[linux-2.6.git] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/config.h>
69 #include <linux/types.h>
70 #include <linux/major.h>
71 #include <linux/errno.h>
72 #include <linux/signal.h>
73 #include <linux/fcntl.h>
74 #include <linux/sched.h>
75 #include <linux/interrupt.h>
76 #include <linux/tty.h>
77 #include <linux/tty_driver.h>
78 #include <linux/tty_flip.h>
79 #include <linux/devpts_fs.h>
80 #include <linux/file.h>
81 #include <linux/console.h>
82 #include <linux/timer.h>
83 #include <linux/ctype.h>
84 #include <linux/kd.h>
85 #include <linux/mm.h>
86 #include <linux/string.h>
87 #include <linux/slab.h>
88 #include <linux/poll.h>
89 #include <linux/proc_fs.h>
90 #include <linux/init.h>
91 #include <linux/module.h>
92 #include <linux/smp_lock.h>
93 #include <linux/device.h>
94 #include <linux/idr.h>
95 #include <linux/wait.h>
96 #include <linux/bitops.h>
97 #include <linux/delay.h>
98
99 #include <asm/uaccess.h>
100 #include <asm/system.h>
101
102 #include <linux/kbd_kern.h>
103 #include <linux/vt_kern.h>
104 #include <linux/selection.h>
105 #include <linux/devfs_fs_kernel.h>
106
107 #include <linux/kmod.h>
108
109 #undef TTY_DEBUG_HANGUP
110
111 #define TTY_PARANOIA_CHECK 1
112 #define CHECK_TTY_COUNT 1
113
114 struct termios tty_std_termios = {      /* for the benefit of tty drivers  */
115         .c_iflag = ICRNL | IXON,
116         .c_oflag = OPOST | ONLCR,
117         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
118         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
119                    ECHOCTL | ECHOKE | IEXTEN,
120         .c_cc = INIT_C_CC
121 };
122
123 EXPORT_SYMBOL(tty_std_termios);
124
125 /* This list gets poked at by procfs and various bits of boot up code. This
126    could do with some rationalisation such as pulling the tty proc function
127    into this file */
128    
129 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
130
131 /* Semaphore to protect creating and releasing a tty. This is shared with
132    vt.c for deeply disgusting hack reasons */
133 DECLARE_MUTEX(tty_sem);
134
135 #ifdef CONFIG_UNIX98_PTYS
136 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
137 extern int pty_limit;           /* Config limit on Unix98 ptys */
138 static DEFINE_IDR(allocated_ptys);
139 static DECLARE_MUTEX(allocated_ptys_lock);
140 static int ptmx_open(struct inode *, struct file *);
141 #endif
142
143 extern void disable_early_printk(void);
144
145 static void initialize_tty_struct(struct tty_struct *tty);
146
147 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
148 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
149 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
150 static unsigned int tty_poll(struct file *, poll_table *);
151 static int tty_open(struct inode *, struct file *);
152 static int tty_release(struct inode *, struct file *);
153 int tty_ioctl(struct inode * inode, struct file * file,
154               unsigned int cmd, unsigned long arg);
155 static int tty_fasync(int fd, struct file * filp, int on);
156 static void release_mem(struct tty_struct *tty, int idx);
157
158
159 static struct tty_struct *alloc_tty_struct(void)
160 {
161         struct tty_struct *tty;
162
163         tty = kmalloc(sizeof(struct tty_struct), GFP_KERNEL);
164         if (tty)
165                 memset(tty, 0, sizeof(struct tty_struct));
166         return tty;
167 }
168
169 static void tty_buffer_free_all(struct tty_struct *);
170
171 static inline void free_tty_struct(struct tty_struct *tty)
172 {
173         kfree(tty->write_buf);
174         tty_buffer_free_all(tty);
175         kfree(tty);
176 }
177
178 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
179
180 char *tty_name(struct tty_struct *tty, char *buf)
181 {
182         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
183                 strcpy(buf, "NULL tty");
184         else
185                 strcpy(buf, tty->name);
186         return buf;
187 }
188
189 EXPORT_SYMBOL(tty_name);
190
191 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
192                               const char *routine)
193 {
194 #ifdef TTY_PARANOIA_CHECK
195         if (!tty) {
196                 printk(KERN_WARNING
197                         "null TTY for (%d:%d) in %s\n",
198                         imajor(inode), iminor(inode), routine);
199                 return 1;
200         }
201         if (tty->magic != TTY_MAGIC) {
202                 printk(KERN_WARNING
203                         "bad magic number for tty struct (%d:%d) in %s\n",
204                         imajor(inode), iminor(inode), routine);
205                 return 1;
206         }
207 #endif
208         return 0;
209 }
210
211 static int check_tty_count(struct tty_struct *tty, const char *routine)
212 {
213 #ifdef CHECK_TTY_COUNT
214         struct list_head *p;
215         int count = 0;
216         
217         file_list_lock();
218         list_for_each(p, &tty->tty_files) {
219                 count++;
220         }
221         file_list_unlock();
222         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
223             tty->driver->subtype == PTY_TYPE_SLAVE &&
224             tty->link && tty->link->count)
225                 count++;
226         if (tty->count != count) {
227                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
228                                     "!= #fd's(%d) in %s\n",
229                        tty->name, tty->count, count, routine);
230                 return count;
231        }        
232 #endif
233         return 0;
234 }
235
236 /*
237  * Tty buffer allocation management
238  */
239
240 static void tty_buffer_free_all(struct tty_struct *tty)
241 {
242         struct tty_buffer *thead;
243         while((thead = tty->buf.head) != NULL) {
244                 tty->buf.head = thead->next;
245                 kfree(thead);
246         }
247         while((thead = tty->buf.free) != NULL) {
248                 tty->buf.free = thead->next;
249                 kfree(thead);
250         }
251         tty->buf.tail = NULL;
252 }
253
254 static void tty_buffer_init(struct tty_struct *tty)
255 {
256         tty->buf.head = NULL;
257         tty->buf.tail = NULL;
258         tty->buf.free = NULL;
259 }
260
261 static struct tty_buffer *tty_buffer_alloc(size_t size)
262 {
263         struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
264         if(p == NULL)
265                 return NULL;
266         p->used = 0;
267         p->size = size;
268         p->next = NULL;
269         p->char_buf_ptr = (char *)(p->data);
270         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
271 /*      printk("Flip create %p\n", p); */
272         return p;
273 }
274
275 /* Must be called with the tty_read lock held. This needs to acquire strategy
276    code to decide if we should kfree or relink a given expired buffer */
277
278 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
279 {
280         /* Dumb strategy for now - should keep some stats */
281 /*      printk("Flip dispose %p\n", b); */
282         if(b->size >= 512)
283                 kfree(b);
284         else {
285                 b->next = tty->buf.free;
286                 tty->buf.free = b;
287         }
288 }
289
290 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
291 {
292         struct tty_buffer **tbh = &tty->buf.free;
293         while((*tbh) != NULL) {
294                 struct tty_buffer *t = *tbh;
295                 if(t->size >= size) {
296                         *tbh = t->next;
297                         t->next = NULL;
298                         t->used = 0;
299                         /* DEBUG ONLY */
300                         memset(t->data, '*', size);
301 /*                      printk("Flip recycle %p\n", t); */
302                         return t;
303                 }
304                 tbh = &((*tbh)->next);
305         }
306         /* Round the buffer size out */
307         size = (size + 0xFF) & ~ 0xFF;
308         return tty_buffer_alloc(size);
309         /* Should possibly check if this fails for the largest buffer we
310            have queued and recycle that ? */
311 }
312
313 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
314 {
315         struct tty_buffer *b = tty->buf.tail, *n;
316         int left = 0;
317
318         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
319            remove this conditional if its worth it. This would be invisible
320            to the callers */
321         if(b != NULL)
322                 left = b->size - b->used;
323         if(left >= size)
324                 return size;
325         /* This is the slow path - looking for new buffers to use */
326         n = tty_buffer_find(tty, size);
327         if(n == NULL)
328                 return left;
329         if(b != NULL)
330                 b->next = n;
331         else
332                 tty->buf.head = n;
333         tty->buf.tail = n;
334         return size;
335 }
336
337 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
338
339 int tty_insert_flip_string(struct tty_struct *tty, unsigned char *chars, size_t size)
340 {
341         int copied = 0;
342         do {
343                 int space = tty_buffer_request_room(tty, size - copied);
344                 struct tty_buffer *tb = tty->buf.tail;
345                 /* If there is no space then tb may be NULL */
346                 if(unlikely(space == 0))
347                         break;
348                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
349                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
350                 tb->used += space;
351                 copied += space;
352                 chars += space;
353 /*              printk("Flip insert %d.\n", space); */
354         }
355         /* There is a small chance that we need to split the data over
356            several buffers. If this is the case we must loop */
357         while (unlikely(size > copied));
358         return copied;
359 }
360
361 EXPORT_SYMBOL_GPL(tty_insert_flip_string);
362
363 int tty_insert_flip_string_flags(struct tty_struct *tty, unsigned char *chars, char *flags, size_t size)
364 {
365         int copied = 0;
366         do {
367                 int space = tty_buffer_request_room(tty, size - copied);
368                 struct tty_buffer *tb = tty->buf.tail;
369                 /* If there is no space then tb may be NULL */
370                 if(unlikely(space == 0))
371                         break;
372                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
373                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
374                 tb->used += space;
375                 copied += space;
376                 chars += space;
377                 flags += space;
378         }
379         /* There is a small chance that we need to split the data over
380            several buffers. If this is the case we must loop */
381         while (unlikely(size > copied));
382         return copied;
383 }
384
385 EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
386
387
388 /*
389  *      Prepare a block of space in the buffer for data. Returns the length
390  *      available and buffer pointer to the space which is now allocated and
391  *      accounted for as ready for normal characters. This is used for drivers
392  *      that need their own block copy routines into the buffer. There is no
393  *      guarantee the buffer is a DMA target!
394  */
395
396 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
397 {
398         int space = tty_buffer_request_room(tty, size);
399         struct tty_buffer *tb = tty->buf.tail;
400         *chars = tb->char_buf_ptr + tb->used;
401         memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
402         tb->used += space;
403         return space;
404 }
405
406 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
407
408 /*
409  *      Prepare a block of space in the buffer for data. Returns the length
410  *      available and buffer pointer to the space which is now allocated and
411  *      accounted for as ready for characters. This is used for drivers
412  *      that need their own block copy routines into the buffer. There is no
413  *      guarantee the buffer is a DMA target!
414  */
415
416 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
417 {
418         int space = tty_buffer_request_room(tty, size);
419         struct tty_buffer *tb = tty->buf.tail;
420         *chars = tb->char_buf_ptr + tb->used;
421         *flags = tb->flag_buf_ptr + tb->used;
422         tb->used += space;
423         return space;
424 }
425
426 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
427
428
429
430 /*
431  *      This is probably overkill for real world processors but
432  *      they are not on hot paths so a little discipline won't do 
433  *      any harm.
434  */
435  
436 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
437 {
438         down(&tty->termios_sem);
439         tty->termios->c_line = num;
440         up(&tty->termios_sem);
441 }
442
443 /*
444  *      This guards the refcounted line discipline lists. The lock
445  *      must be taken with irqs off because there are hangup path
446  *      callers who will do ldisc lookups and cannot sleep.
447  */
448  
449 static DEFINE_SPINLOCK(tty_ldisc_lock);
450 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
451 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
452
453 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
454 {
455         unsigned long flags;
456         int ret = 0;
457         
458         if (disc < N_TTY || disc >= NR_LDISCS)
459                 return -EINVAL;
460         
461         spin_lock_irqsave(&tty_ldisc_lock, flags);
462         tty_ldiscs[disc] = *new_ldisc;
463         tty_ldiscs[disc].num = disc;
464         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
465         tty_ldiscs[disc].refcount = 0;
466         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
467         
468         return ret;
469 }
470 EXPORT_SYMBOL(tty_register_ldisc);
471
472 int tty_unregister_ldisc(int disc)
473 {
474         unsigned long flags;
475         int ret = 0;
476
477         if (disc < N_TTY || disc >= NR_LDISCS)
478                 return -EINVAL;
479
480         spin_lock_irqsave(&tty_ldisc_lock, flags);
481         if (tty_ldiscs[disc].refcount)
482                 ret = -EBUSY;
483         else
484                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
485         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
486
487         return ret;
488 }
489 EXPORT_SYMBOL(tty_unregister_ldisc);
490
491 struct tty_ldisc *tty_ldisc_get(int disc)
492 {
493         unsigned long flags;
494         struct tty_ldisc *ld;
495
496         if (disc < N_TTY || disc >= NR_LDISCS)
497                 return NULL;
498         
499         spin_lock_irqsave(&tty_ldisc_lock, flags);
500
501         ld = &tty_ldiscs[disc];
502         /* Check the entry is defined */
503         if(ld->flags & LDISC_FLAG_DEFINED)
504         {
505                 /* If the module is being unloaded we can't use it */
506                 if (!try_module_get(ld->owner))
507                         ld = NULL;
508                 else /* lock it */
509                         ld->refcount++;
510         }
511         else
512                 ld = NULL;
513         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
514         return ld;
515 }
516
517 EXPORT_SYMBOL_GPL(tty_ldisc_get);
518
519 void tty_ldisc_put(int disc)
520 {
521         struct tty_ldisc *ld;
522         unsigned long flags;
523         
524         if (disc < N_TTY || disc >= NR_LDISCS)
525                 BUG();
526                 
527         spin_lock_irqsave(&tty_ldisc_lock, flags);
528         ld = &tty_ldiscs[disc];
529         if(ld->refcount == 0)
530                 BUG();
531         ld->refcount --;
532         module_put(ld->owner);
533         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
534 }
535         
536 EXPORT_SYMBOL_GPL(tty_ldisc_put);
537
538 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
539 {
540         tty->ldisc = *ld;
541         tty->ldisc.refcount = 0;
542 }
543
544 /**
545  *      tty_ldisc_try           -       internal helper
546  *      @tty: the tty
547  *
548  *      Make a single attempt to grab and bump the refcount on
549  *      the tty ldisc. Return 0 on failure or 1 on success. This is
550  *      used to implement both the waiting and non waiting versions
551  *      of tty_ldisc_ref
552  */
553
554 static int tty_ldisc_try(struct tty_struct *tty)
555 {
556         unsigned long flags;
557         struct tty_ldisc *ld;
558         int ret = 0;
559         
560         spin_lock_irqsave(&tty_ldisc_lock, flags);
561         ld = &tty->ldisc;
562         if(test_bit(TTY_LDISC, &tty->flags))
563         {
564                 ld->refcount++;
565                 ret = 1;
566         }
567         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
568         return ret;
569 }
570
571 /**
572  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
573  *      @tty: tty device
574  *
575  *      Dereference the line discipline for the terminal and take a 
576  *      reference to it. If the line discipline is in flux then 
577  *      wait patiently until it changes.
578  *
579  *      Note: Must not be called from an IRQ/timer context. The caller
580  *      must also be careful not to hold other locks that will deadlock
581  *      against a discipline change, such as an existing ldisc reference
582  *      (which we check for)
583  */
584  
585 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
586 {
587         /* wait_event is a macro */
588         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
589         if(tty->ldisc.refcount == 0)
590                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
591         return &tty->ldisc;
592 }
593
594 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
595
596 /**
597  *      tty_ldisc_ref           -       get the tty ldisc
598  *      @tty: tty device
599  *
600  *      Dereference the line discipline for the terminal and take a 
601  *      reference to it. If the line discipline is in flux then 
602  *      return NULL. Can be called from IRQ and timer functions.
603  */
604  
605 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
606 {
607         if(tty_ldisc_try(tty))
608                 return &tty->ldisc;
609         return NULL;
610 }
611
612 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
613
614 /**
615  *      tty_ldisc_deref         -       free a tty ldisc reference
616  *      @ld: reference to free up
617  *
618  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
619  *      be called in IRQ context.
620  */
621  
622 void tty_ldisc_deref(struct tty_ldisc *ld)
623 {
624         unsigned long flags;
625
626         if(ld == NULL)
627                 BUG();
628                 
629         spin_lock_irqsave(&tty_ldisc_lock, flags);
630         if(ld->refcount == 0)
631                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
632         else
633                 ld->refcount--;
634         if(ld->refcount == 0)
635                 wake_up(&tty_ldisc_wait);
636         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
637 }
638
639 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
640
641 /**
642  *      tty_ldisc_enable        -       allow ldisc use
643  *      @tty: terminal to activate ldisc on
644  *
645  *      Set the TTY_LDISC flag when the line discipline can be called
646  *      again. Do neccessary wakeups for existing sleepers.
647  *
648  *      Note: nobody should set this bit except via this function. Clearing
649  *      directly is allowed.
650  */
651
652 static void tty_ldisc_enable(struct tty_struct *tty)
653 {
654         set_bit(TTY_LDISC, &tty->flags);
655         wake_up(&tty_ldisc_wait);
656 }
657         
658 /**
659  *      tty_set_ldisc           -       set line discipline
660  *      @tty: the terminal to set
661  *      @ldisc: the line discipline
662  *
663  *      Set the discipline of a tty line. Must be called from a process
664  *      context.
665  */
666  
667 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
668 {
669         int retval = 0;
670         struct tty_ldisc o_ldisc;
671         char buf[64];
672         int work;
673         unsigned long flags;
674         struct tty_ldisc *ld;
675         struct tty_struct *o_tty;
676
677         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
678                 return -EINVAL;
679
680 restart:
681
682         ld = tty_ldisc_get(ldisc);
683         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
684         /* Cyrus Durgin <cider@speakeasy.org> */
685         if (ld == NULL) {
686                 request_module("tty-ldisc-%d", ldisc);
687                 ld = tty_ldisc_get(ldisc);
688         }
689         if (ld == NULL)
690                 return -EINVAL;
691
692         /*
693          *      No more input please, we are switching. The new ldisc
694          *      will update this value in the ldisc open function
695          */
696
697         tty->receive_room = 0;
698
699         /*
700          *      Problem: What do we do if this blocks ?
701          */
702
703         tty_wait_until_sent(tty, 0);
704
705         if (tty->ldisc.num == ldisc) {
706                 tty_ldisc_put(ldisc);
707                 return 0;
708         }
709
710         o_ldisc = tty->ldisc;
711         o_tty = tty->link;
712
713         /*
714          *      Make sure we don't change while someone holds a
715          *      reference to the line discipline. The TTY_LDISC bit
716          *      prevents anyone taking a reference once it is clear.
717          *      We need the lock to avoid racing reference takers.
718          */
719
720         spin_lock_irqsave(&tty_ldisc_lock, flags);
721         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
722                 if(tty->ldisc.refcount) {
723                         /* Free the new ldisc we grabbed. Must drop the lock
724                            first. */
725                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
726                         tty_ldisc_put(ldisc);
727                         /*
728                          * There are several reasons we may be busy, including
729                          * random momentary I/O traffic. We must therefore
730                          * retry. We could distinguish between blocking ops
731                          * and retries if we made tty_ldisc_wait() smarter. That
732                          * is up for discussion.
733                          */
734                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
735                                 return -ERESTARTSYS;
736                         goto restart;
737                 }
738                 if(o_tty && o_tty->ldisc.refcount) {
739                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
740                         tty_ldisc_put(ldisc);
741                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
742                                 return -ERESTARTSYS;
743                         goto restart;
744                 }
745         }
746
747         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
748
749         if (!test_bit(TTY_LDISC, &tty->flags)) {
750                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
751                 tty_ldisc_put(ldisc);
752                 ld = tty_ldisc_ref_wait(tty);
753                 tty_ldisc_deref(ld);
754                 goto restart;
755         }
756
757         clear_bit(TTY_LDISC, &tty->flags);
758         clear_bit(TTY_DONT_FLIP, &tty->flags);
759         if (o_tty) {
760                 clear_bit(TTY_LDISC, &o_tty->flags);
761                 clear_bit(TTY_DONT_FLIP, &o_tty->flags);
762         }
763         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
764
765         /*
766          *      From this point on we know nobody has an ldisc
767          *      usage reference, nor can they obtain one until
768          *      we say so later on.
769          */
770
771         work = cancel_delayed_work(&tty->buf.work);
772         /*
773          * Wait for ->hangup_work and ->buf.work handlers to terminate
774          */
775          
776         flush_scheduled_work();
777         /* Shutdown the current discipline. */
778         if (tty->ldisc.close)
779                 (tty->ldisc.close)(tty);
780
781         /* Now set up the new line discipline. */
782         tty_ldisc_assign(tty, ld);
783         tty_set_termios_ldisc(tty, ldisc);
784         if (tty->ldisc.open)
785                 retval = (tty->ldisc.open)(tty);
786         if (retval < 0) {
787                 tty_ldisc_put(ldisc);
788                 /* There is an outstanding reference here so this is safe */
789                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
790                 tty_set_termios_ldisc(tty, tty->ldisc.num);
791                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
792                         tty_ldisc_put(o_ldisc.num);
793                         /* This driver is always present */
794                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
795                         tty_set_termios_ldisc(tty, N_TTY);
796                         if (tty->ldisc.open) {
797                                 int r = tty->ldisc.open(tty);
798
799                                 if (r < 0)
800                                         panic("Couldn't open N_TTY ldisc for "
801                                               "%s --- error %d.",
802                                               tty_name(tty, buf), r);
803                         }
804                 }
805         }
806         /* At this point we hold a reference to the new ldisc and a
807            a reference to the old ldisc. If we ended up flipping back
808            to the existing ldisc we have two references to it */
809         
810         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
811                 tty->driver->set_ldisc(tty);
812                 
813         tty_ldisc_put(o_ldisc.num);
814         
815         /*
816          *      Allow ldisc referencing to occur as soon as the driver
817          *      ldisc callback completes.
818          */
819          
820         tty_ldisc_enable(tty);
821         if (o_tty)
822                 tty_ldisc_enable(o_tty);
823         
824         /* Restart it in case no characters kick it off. Safe if
825            already running */
826         if (work)
827                 schedule_delayed_work(&tty->buf.work, 1);
828         return retval;
829 }
830
831 /*
832  * This routine returns a tty driver structure, given a device number
833  */
834 static struct tty_driver *get_tty_driver(dev_t device, int *index)
835 {
836         struct tty_driver *p;
837
838         list_for_each_entry(p, &tty_drivers, tty_drivers) {
839                 dev_t base = MKDEV(p->major, p->minor_start);
840                 if (device < base || device >= base + p->num)
841                         continue;
842                 *index = device - base;
843                 return p;
844         }
845         return NULL;
846 }
847
848 /*
849  * If we try to write to, or set the state of, a terminal and we're
850  * not in the foreground, send a SIGTTOU.  If the signal is blocked or
851  * ignored, go ahead and perform the operation.  (POSIX 7.2)
852  */
853 int tty_check_change(struct tty_struct * tty)
854 {
855         if (current->signal->tty != tty)
856                 return 0;
857         if (tty->pgrp <= 0) {
858                 printk(KERN_WARNING "tty_check_change: tty->pgrp <= 0!\n");
859                 return 0;
860         }
861         if (process_group(current) == tty->pgrp)
862                 return 0;
863         if (is_ignored(SIGTTOU))
864                 return 0;
865         if (is_orphaned_pgrp(process_group(current)))
866                 return -EIO;
867         (void) kill_pg(process_group(current), SIGTTOU, 1);
868         return -ERESTARTSYS;
869 }
870
871 EXPORT_SYMBOL(tty_check_change);
872
873 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
874                                 size_t count, loff_t *ppos)
875 {
876         return 0;
877 }
878
879 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
880                                  size_t count, loff_t *ppos)
881 {
882         return -EIO;
883 }
884
885 /* No kernel lock held - none needed ;) */
886 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
887 {
888         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
889 }
890
891 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
892                              unsigned int cmd, unsigned long arg)
893 {
894         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
895 }
896
897 static struct file_operations tty_fops = {
898         .llseek         = no_llseek,
899         .read           = tty_read,
900         .write          = tty_write,
901         .poll           = tty_poll,
902         .ioctl          = tty_ioctl,
903         .open           = tty_open,
904         .release        = tty_release,
905         .fasync         = tty_fasync,
906 };
907
908 #ifdef CONFIG_UNIX98_PTYS
909 static struct file_operations ptmx_fops = {
910         .llseek         = no_llseek,
911         .read           = tty_read,
912         .write          = tty_write,
913         .poll           = tty_poll,
914         .ioctl          = tty_ioctl,
915         .open           = ptmx_open,
916         .release        = tty_release,
917         .fasync         = tty_fasync,
918 };
919 #endif
920
921 static struct file_operations console_fops = {
922         .llseek         = no_llseek,
923         .read           = tty_read,
924         .write          = redirected_tty_write,
925         .poll           = tty_poll,
926         .ioctl          = tty_ioctl,
927         .open           = tty_open,
928         .release        = tty_release,
929         .fasync         = tty_fasync,
930 };
931
932 static struct file_operations hung_up_tty_fops = {
933         .llseek         = no_llseek,
934         .read           = hung_up_tty_read,
935         .write          = hung_up_tty_write,
936         .poll           = hung_up_tty_poll,
937         .ioctl          = hung_up_tty_ioctl,
938         .release        = tty_release,
939 };
940
941 static DEFINE_SPINLOCK(redirect_lock);
942 static struct file *redirect;
943
944 /**
945  *      tty_wakeup      -       request more data
946  *      @tty: terminal
947  *
948  *      Internal and external helper for wakeups of tty. This function
949  *      informs the line discipline if present that the driver is ready
950  *      to receive more output data.
951  */
952  
953 void tty_wakeup(struct tty_struct *tty)
954 {
955         struct tty_ldisc *ld;
956         
957         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
958                 ld = tty_ldisc_ref(tty);
959                 if(ld) {
960                         if(ld->write_wakeup)
961                                 ld->write_wakeup(tty);
962                         tty_ldisc_deref(ld);
963                 }
964         }
965         wake_up_interruptible(&tty->write_wait);
966 }
967
968 EXPORT_SYMBOL_GPL(tty_wakeup);
969
970 /**
971  *      tty_ldisc_flush -       flush line discipline queue
972  *      @tty: tty
973  *
974  *      Flush the line discipline queue (if any) for this tty. If there
975  *      is no line discipline active this is a no-op.
976  */
977  
978 void tty_ldisc_flush(struct tty_struct *tty)
979 {
980         struct tty_ldisc *ld = tty_ldisc_ref(tty);
981         if(ld) {
982                 if(ld->flush_buffer)
983                         ld->flush_buffer(tty);
984                 tty_ldisc_deref(ld);
985         }
986 }
987
988 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
989         
990 /*
991  * This can be called by the "eventd" kernel thread.  That is process synchronous,
992  * but doesn't hold any locks, so we need to make sure we have the appropriate
993  * locks for what we're doing..
994  */
995 static void do_tty_hangup(void *data)
996 {
997         struct tty_struct *tty = (struct tty_struct *) data;
998         struct file * cons_filp = NULL;
999         struct file *filp, *f = NULL;
1000         struct task_struct *p;
1001         struct tty_ldisc *ld;
1002         int    closecount = 0, n;
1003
1004         if (!tty)
1005                 return;
1006
1007         /* inuse_filps is protected by the single kernel lock */
1008         lock_kernel();
1009
1010         spin_lock(&redirect_lock);
1011         if (redirect && redirect->private_data == tty) {
1012                 f = redirect;
1013                 redirect = NULL;
1014         }
1015         spin_unlock(&redirect_lock);
1016         
1017         check_tty_count(tty, "do_tty_hangup");
1018         file_list_lock();
1019         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1020         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1021                 if (filp->f_op->write == redirected_tty_write)
1022                         cons_filp = filp;
1023                 if (filp->f_op->write != tty_write)
1024                         continue;
1025                 closecount++;
1026                 tty_fasync(-1, filp, 0);        /* can't block */
1027                 filp->f_op = &hung_up_tty_fops;
1028         }
1029         file_list_unlock();
1030         
1031         /* FIXME! What are the locking issues here? This may me overdoing things..
1032          * this question is especially important now that we've removed the irqlock. */
1033
1034         ld = tty_ldisc_ref(tty);
1035         if(ld != NULL)  /* We may have no line discipline at this point */
1036         {
1037                 if (ld->flush_buffer)
1038                         ld->flush_buffer(tty);
1039                 if (tty->driver->flush_buffer)
1040                         tty->driver->flush_buffer(tty);
1041                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1042                     ld->write_wakeup)
1043                         ld->write_wakeup(tty);
1044                 if (ld->hangup)
1045                         ld->hangup(tty);
1046         }
1047
1048         /* FIXME: Once we trust the LDISC code better we can wait here for
1049            ldisc completion and fix the driver call race */
1050            
1051         wake_up_interruptible(&tty->write_wait);
1052         wake_up_interruptible(&tty->read_wait);
1053
1054         /*
1055          * Shutdown the current line discipline, and reset it to
1056          * N_TTY.
1057          */
1058         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1059         {
1060                 down(&tty->termios_sem);
1061                 *tty->termios = tty->driver->init_termios;
1062                 up(&tty->termios_sem);
1063         }
1064         
1065         /* Defer ldisc switch */
1066         /* tty_deferred_ldisc_switch(N_TTY);
1067         
1068           This should get done automatically when the port closes and
1069           tty_release is called */
1070         
1071         read_lock(&tasklist_lock);
1072         if (tty->session > 0) {
1073                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1074                         if (p->signal->tty == tty)
1075                                 p->signal->tty = NULL;
1076                         if (!p->signal->leader)
1077                                 continue;
1078                         send_group_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1079                         send_group_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1080                         if (tty->pgrp > 0)
1081                                 p->signal->tty_old_pgrp = tty->pgrp;
1082                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1083         }
1084         read_unlock(&tasklist_lock);
1085
1086         tty->flags = 0;
1087         tty->session = 0;
1088         tty->pgrp = -1;
1089         tty->ctrl_status = 0;
1090         /*
1091          *      If one of the devices matches a console pointer, we
1092          *      cannot just call hangup() because that will cause
1093          *      tty->count and state->count to go out of sync.
1094          *      So we just call close() the right number of times.
1095          */
1096         if (cons_filp) {
1097                 if (tty->driver->close)
1098                         for (n = 0; n < closecount; n++)
1099                                 tty->driver->close(tty, cons_filp);
1100         } else if (tty->driver->hangup)
1101                 (tty->driver->hangup)(tty);
1102                 
1103         /* We don't want to have driver/ldisc interactions beyond
1104            the ones we did here. The driver layer expects no
1105            calls after ->hangup() from the ldisc side. However we
1106            can't yet guarantee all that */
1107
1108         set_bit(TTY_HUPPED, &tty->flags);
1109         if (ld) {
1110                 tty_ldisc_enable(tty);
1111                 tty_ldisc_deref(ld);
1112         }
1113         unlock_kernel();
1114         if (f)
1115                 fput(f);
1116 }
1117
1118 void tty_hangup(struct tty_struct * tty)
1119 {
1120 #ifdef TTY_DEBUG_HANGUP
1121         char    buf[64];
1122         
1123         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1124 #endif
1125         schedule_work(&tty->hangup_work);
1126 }
1127
1128 EXPORT_SYMBOL(tty_hangup);
1129
1130 void tty_vhangup(struct tty_struct * tty)
1131 {
1132 #ifdef TTY_DEBUG_HANGUP
1133         char    buf[64];
1134
1135         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1136 #endif
1137         do_tty_hangup((void *) tty);
1138 }
1139 EXPORT_SYMBOL(tty_vhangup);
1140
1141 int tty_hung_up_p(struct file * filp)
1142 {
1143         return (filp->f_op == &hung_up_tty_fops);
1144 }
1145
1146 EXPORT_SYMBOL(tty_hung_up_p);
1147
1148 /*
1149  * This function is typically called only by the session leader, when
1150  * it wants to disassociate itself from its controlling tty.
1151  *
1152  * It performs the following functions:
1153  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1154  *      (2)  Clears the tty from being controlling the session
1155  *      (3)  Clears the controlling tty for all processes in the
1156  *              session group.
1157  *
1158  * The argument on_exit is set to 1 if called when a process is
1159  * exiting; it is 0 if called by the ioctl TIOCNOTTY.
1160  */
1161 void disassociate_ctty(int on_exit)
1162 {
1163         struct tty_struct *tty;
1164         struct task_struct *p;
1165         int tty_pgrp = -1;
1166
1167         lock_kernel();
1168
1169         down(&tty_sem);
1170         tty = current->signal->tty;
1171         if (tty) {
1172                 tty_pgrp = tty->pgrp;
1173                 up(&tty_sem);
1174                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1175                         tty_vhangup(tty);
1176         } else {
1177                 if (current->signal->tty_old_pgrp) {
1178                         kill_pg(current->signal->tty_old_pgrp, SIGHUP, on_exit);
1179                         kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit);
1180                 }
1181                 up(&tty_sem);
1182                 unlock_kernel();        
1183                 return;
1184         }
1185         if (tty_pgrp > 0) {
1186                 kill_pg(tty_pgrp, SIGHUP, on_exit);
1187                 if (!on_exit)
1188                         kill_pg(tty_pgrp, SIGCONT, on_exit);
1189         }
1190
1191         /* Must lock changes to tty_old_pgrp */
1192         down(&tty_sem);
1193         current->signal->tty_old_pgrp = 0;
1194         tty->session = 0;
1195         tty->pgrp = -1;
1196
1197         /* Now clear signal->tty under the lock */
1198         read_lock(&tasklist_lock);
1199         do_each_task_pid(current->signal->session, PIDTYPE_SID, p) {
1200                 p->signal->tty = NULL;
1201         } while_each_task_pid(current->signal->session, PIDTYPE_SID, p);
1202         read_unlock(&tasklist_lock);
1203         up(&tty_sem);
1204         unlock_kernel();
1205 }
1206
1207 void stop_tty(struct tty_struct *tty)
1208 {
1209         if (tty->stopped)
1210                 return;
1211         tty->stopped = 1;
1212         if (tty->link && tty->link->packet) {
1213                 tty->ctrl_status &= ~TIOCPKT_START;
1214                 tty->ctrl_status |= TIOCPKT_STOP;
1215                 wake_up_interruptible(&tty->link->read_wait);
1216         }
1217         if (tty->driver->stop)
1218                 (tty->driver->stop)(tty);
1219 }
1220
1221 EXPORT_SYMBOL(stop_tty);
1222
1223 void start_tty(struct tty_struct *tty)
1224 {
1225         if (!tty->stopped || tty->flow_stopped)
1226                 return;
1227         tty->stopped = 0;
1228         if (tty->link && tty->link->packet) {
1229                 tty->ctrl_status &= ~TIOCPKT_STOP;
1230                 tty->ctrl_status |= TIOCPKT_START;
1231                 wake_up_interruptible(&tty->link->read_wait);
1232         }
1233         if (tty->driver->start)
1234                 (tty->driver->start)(tty);
1235
1236         /* If we have a running line discipline it may need kicking */
1237         tty_wakeup(tty);
1238         wake_up_interruptible(&tty->write_wait);
1239 }
1240
1241 EXPORT_SYMBOL(start_tty);
1242
1243 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1244                         loff_t *ppos)
1245 {
1246         int i;
1247         struct tty_struct * tty;
1248         struct inode *inode;
1249         struct tty_ldisc *ld;
1250
1251         tty = (struct tty_struct *)file->private_data;
1252         inode = file->f_dentry->d_inode;
1253         if (tty_paranoia_check(tty, inode, "tty_read"))
1254                 return -EIO;
1255         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1256                 return -EIO;
1257
1258         /* We want to wait for the line discipline to sort out in this
1259            situation */
1260         ld = tty_ldisc_ref_wait(tty);
1261         lock_kernel();
1262         if (ld->read)
1263                 i = (ld->read)(tty,file,buf,count);
1264         else
1265                 i = -EIO;
1266         tty_ldisc_deref(ld);
1267         unlock_kernel();
1268         if (i > 0)
1269                 inode->i_atime = current_fs_time(inode->i_sb);
1270         return i;
1271 }
1272
1273 /*
1274  * Split writes up in sane blocksizes to avoid
1275  * denial-of-service type attacks
1276  */
1277 static inline ssize_t do_tty_write(
1278         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1279         struct tty_struct *tty,
1280         struct file *file,
1281         const char __user *buf,
1282         size_t count)
1283 {
1284         ssize_t ret = 0, written = 0;
1285         unsigned int chunk;
1286         
1287         if (down_interruptible(&tty->atomic_write)) {
1288                 return -ERESTARTSYS;
1289         }
1290
1291         /*
1292          * We chunk up writes into a temporary buffer. This
1293          * simplifies low-level drivers immensely, since they
1294          * don't have locking issues and user mode accesses.
1295          *
1296          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1297          * big chunk-size..
1298          *
1299          * The default chunk-size is 2kB, because the NTTY
1300          * layer has problems with bigger chunks. It will
1301          * claim to be able to handle more characters than
1302          * it actually does.
1303          */
1304         chunk = 2048;
1305         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1306                 chunk = 65536;
1307         if (count < chunk)
1308                 chunk = count;
1309
1310         /* write_buf/write_cnt is protected by the atomic_write semaphore */
1311         if (tty->write_cnt < chunk) {
1312                 unsigned char *buf;
1313
1314                 if (chunk < 1024)
1315                         chunk = 1024;
1316
1317                 buf = kmalloc(chunk, GFP_KERNEL);
1318                 if (!buf) {
1319                         up(&tty->atomic_write);
1320                         return -ENOMEM;
1321                 }
1322                 kfree(tty->write_buf);
1323                 tty->write_cnt = chunk;
1324                 tty->write_buf = buf;
1325         }
1326
1327         /* Do the write .. */
1328         for (;;) {
1329                 size_t size = count;
1330                 if (size > chunk)
1331                         size = chunk;
1332                 ret = -EFAULT;
1333                 if (copy_from_user(tty->write_buf, buf, size))
1334                         break;
1335                 lock_kernel();
1336                 ret = write(tty, file, tty->write_buf, size);
1337                 unlock_kernel();
1338                 if (ret <= 0)
1339                         break;
1340                 written += ret;
1341                 buf += ret;
1342                 count -= ret;
1343                 if (!count)
1344                         break;
1345                 ret = -ERESTARTSYS;
1346                 if (signal_pending(current))
1347                         break;
1348                 cond_resched();
1349         }
1350         if (written) {
1351                 struct inode *inode = file->f_dentry->d_inode;
1352                 inode->i_mtime = current_fs_time(inode->i_sb);
1353                 ret = written;
1354         }
1355         up(&tty->atomic_write);
1356         return ret;
1357 }
1358
1359
1360 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1361                          loff_t *ppos)
1362 {
1363         struct tty_struct * tty;
1364         struct inode *inode = file->f_dentry->d_inode;
1365         ssize_t ret;
1366         struct tty_ldisc *ld;
1367         
1368         tty = (struct tty_struct *)file->private_data;
1369         if (tty_paranoia_check(tty, inode, "tty_write"))
1370                 return -EIO;
1371         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1372                 return -EIO;
1373
1374         ld = tty_ldisc_ref_wait(tty);           
1375         if (!ld->write)
1376                 ret = -EIO;
1377         else
1378                 ret = do_tty_write(ld->write, tty, file, buf, count);
1379         tty_ldisc_deref(ld);
1380         return ret;
1381 }
1382
1383 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1384                          loff_t *ppos)
1385 {
1386         struct file *p = NULL;
1387
1388         spin_lock(&redirect_lock);
1389         if (redirect) {
1390                 get_file(redirect);
1391                 p = redirect;
1392         }
1393         spin_unlock(&redirect_lock);
1394
1395         if (p) {
1396                 ssize_t res;
1397                 res = vfs_write(p, buf, count, &p->f_pos);
1398                 fput(p);
1399                 return res;
1400         }
1401
1402         return tty_write(file, buf, count, ppos);
1403 }
1404
1405 static char ptychar[] = "pqrstuvwxyzabcde";
1406
1407 static inline void pty_line_name(struct tty_driver *driver, int index, char *p)
1408 {
1409         int i = index + driver->name_base;
1410         /* ->name is initialized to "ttyp", but "tty" is expected */
1411         sprintf(p, "%s%c%x",
1412                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1413                         ptychar[i >> 4 & 0xf], i & 0xf);
1414 }
1415
1416 static inline void tty_line_name(struct tty_driver *driver, int index, char *p)
1417 {
1418         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1419 }
1420
1421 /*
1422  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1423  * failed open.  The new code protects the open with a semaphore, so it's
1424  * really quite straightforward.  The semaphore locking can probably be
1425  * relaxed for the (most common) case of reopening a tty.
1426  */
1427 static int init_dev(struct tty_driver *driver, int idx,
1428         struct tty_struct **ret_tty)
1429 {
1430         struct tty_struct *tty, *o_tty;
1431         struct termios *tp, **tp_loc, *o_tp, **o_tp_loc;
1432         struct termios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
1433         int retval=0;
1434
1435         /* check whether we're reopening an existing tty */
1436         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1437                 tty = devpts_get_tty(idx);
1438                 if (tty && driver->subtype == PTY_TYPE_MASTER)
1439                         tty = tty->link;
1440         } else {
1441                 tty = driver->ttys[idx];
1442         }
1443         if (tty) goto fast_track;
1444
1445         /*
1446          * First time open is complex, especially for PTY devices.
1447          * This code guarantees that either everything succeeds and the
1448          * TTY is ready for operation, or else the table slots are vacated
1449          * and the allocated memory released.  (Except that the termios 
1450          * and locked termios may be retained.)
1451          */
1452
1453         if (!try_module_get(driver->owner)) {
1454                 retval = -ENODEV;
1455                 goto end_init;
1456         }
1457
1458         o_tty = NULL;
1459         tp = o_tp = NULL;
1460         ltp = o_ltp = NULL;
1461
1462         tty = alloc_tty_struct();
1463         if(!tty)
1464                 goto fail_no_mem;
1465         initialize_tty_struct(tty);
1466         tty->driver = driver;
1467         tty->index = idx;
1468         tty_line_name(driver, idx, tty->name);
1469
1470         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1471                 tp_loc = &tty->termios;
1472                 ltp_loc = &tty->termios_locked;
1473         } else {
1474                 tp_loc = &driver->termios[idx];
1475                 ltp_loc = &driver->termios_locked[idx];
1476         }
1477
1478         if (!*tp_loc) {
1479                 tp = (struct termios *) kmalloc(sizeof(struct termios),
1480                                                 GFP_KERNEL);
1481                 if (!tp)
1482                         goto free_mem_out;
1483                 *tp = driver->init_termios;
1484         }
1485
1486         if (!*ltp_loc) {
1487                 ltp = (struct termios *) kmalloc(sizeof(struct termios),
1488                                                  GFP_KERNEL);
1489                 if (!ltp)
1490                         goto free_mem_out;
1491                 memset(ltp, 0, sizeof(struct termios));
1492         }
1493
1494         if (driver->type == TTY_DRIVER_TYPE_PTY) {
1495                 o_tty = alloc_tty_struct();
1496                 if (!o_tty)
1497                         goto free_mem_out;
1498                 initialize_tty_struct(o_tty);
1499                 o_tty->driver = driver->other;
1500                 o_tty->index = idx;
1501                 tty_line_name(driver->other, idx, o_tty->name);
1502
1503                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1504                         o_tp_loc = &o_tty->termios;
1505                         o_ltp_loc = &o_tty->termios_locked;
1506                 } else {
1507                         o_tp_loc = &driver->other->termios[idx];
1508                         o_ltp_loc = &driver->other->termios_locked[idx];
1509                 }
1510
1511                 if (!*o_tp_loc) {
1512                         o_tp = (struct termios *)
1513                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1514                         if (!o_tp)
1515                                 goto free_mem_out;
1516                         *o_tp = driver->other->init_termios;
1517                 }
1518
1519                 if (!*o_ltp_loc) {
1520                         o_ltp = (struct termios *)
1521                                 kmalloc(sizeof(struct termios), GFP_KERNEL);
1522                         if (!o_ltp)
1523                                 goto free_mem_out;
1524                         memset(o_ltp, 0, sizeof(struct termios));
1525                 }
1526
1527                 /*
1528                  * Everything allocated ... set up the o_tty structure.
1529                  */
1530                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
1531                         driver->other->ttys[idx] = o_tty;
1532                 }
1533                 if (!*o_tp_loc)
1534                         *o_tp_loc = o_tp;
1535                 if (!*o_ltp_loc)
1536                         *o_ltp_loc = o_ltp;
1537                 o_tty->termios = *o_tp_loc;
1538                 o_tty->termios_locked = *o_ltp_loc;
1539                 driver->other->refcount++;
1540                 if (driver->subtype == PTY_TYPE_MASTER)
1541                         o_tty->count++;
1542
1543                 /* Establish the links in both directions */
1544                 tty->link   = o_tty;
1545                 o_tty->link = tty;
1546         }
1547
1548         /* 
1549          * All structures have been allocated, so now we install them.
1550          * Failures after this point use release_mem to clean up, so 
1551          * there's no need to null out the local pointers.
1552          */
1553         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1554                 driver->ttys[idx] = tty;
1555         }
1556         
1557         if (!*tp_loc)
1558                 *tp_loc = tp;
1559         if (!*ltp_loc)
1560                 *ltp_loc = ltp;
1561         tty->termios = *tp_loc;
1562         tty->termios_locked = *ltp_loc;
1563         driver->refcount++;
1564         tty->count++;
1565
1566         /* 
1567          * Structures all installed ... call the ldisc open routines.
1568          * If we fail here just call release_mem to clean up.  No need
1569          * to decrement the use counts, as release_mem doesn't care.
1570          */
1571
1572         if (tty->ldisc.open) {
1573                 retval = (tty->ldisc.open)(tty);
1574                 if (retval)
1575                         goto release_mem_out;
1576         }
1577         if (o_tty && o_tty->ldisc.open) {
1578                 retval = (o_tty->ldisc.open)(o_tty);
1579                 if (retval) {
1580                         if (tty->ldisc.close)
1581                                 (tty->ldisc.close)(tty);
1582                         goto release_mem_out;
1583                 }
1584                 tty_ldisc_enable(o_tty);
1585         }
1586         tty_ldisc_enable(tty);
1587         goto success;
1588
1589         /*
1590          * This fast open can be used if the tty is already open.
1591          * No memory is allocated, and the only failures are from
1592          * attempting to open a closing tty or attempting multiple
1593          * opens on a pty master.
1594          */
1595 fast_track:
1596         if (test_bit(TTY_CLOSING, &tty->flags)) {
1597                 retval = -EIO;
1598                 goto end_init;
1599         }
1600         if (driver->type == TTY_DRIVER_TYPE_PTY &&
1601             driver->subtype == PTY_TYPE_MASTER) {
1602                 /*
1603                  * special case for PTY masters: only one open permitted, 
1604                  * and the slave side open count is incremented as well.
1605                  */
1606                 if (tty->count) {
1607                         retval = -EIO;
1608                         goto end_init;
1609                 }
1610                 tty->link->count++;
1611         }
1612         tty->count++;
1613         tty->driver = driver; /* N.B. why do this every time?? */
1614
1615         /* FIXME */
1616         if(!test_bit(TTY_LDISC, &tty->flags))
1617                 printk(KERN_ERR "init_dev but no ldisc\n");
1618 success:
1619         *ret_tty = tty;
1620         
1621         /* All paths come through here to release the semaphore */
1622 end_init:
1623         return retval;
1624
1625         /* Release locally allocated memory ... nothing placed in slots */
1626 free_mem_out:
1627         kfree(o_tp);
1628         if (o_tty)
1629                 free_tty_struct(o_tty);
1630         kfree(ltp);
1631         kfree(tp);
1632         free_tty_struct(tty);
1633
1634 fail_no_mem:
1635         module_put(driver->owner);
1636         retval = -ENOMEM;
1637         goto end_init;
1638
1639         /* call the tty release_mem routine to clean out this slot */
1640 release_mem_out:
1641         printk(KERN_INFO "init_dev: ldisc open failed, "
1642                          "clearing slot %d\n", idx);
1643         release_mem(tty, idx);
1644         goto end_init;
1645 }
1646
1647 /*
1648  * Releases memory associated with a tty structure, and clears out the
1649  * driver table slots.
1650  */
1651 static void release_mem(struct tty_struct *tty, int idx)
1652 {
1653         struct tty_struct *o_tty;
1654         struct termios *tp;
1655         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
1656
1657         if ((o_tty = tty->link) != NULL) {
1658                 if (!devpts)
1659                         o_tty->driver->ttys[idx] = NULL;
1660                 if (o_tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1661                         tp = o_tty->termios;
1662                         if (!devpts)
1663                                 o_tty->driver->termios[idx] = NULL;
1664                         kfree(tp);
1665
1666                         tp = o_tty->termios_locked;
1667                         if (!devpts)
1668                                 o_tty->driver->termios_locked[idx] = NULL;
1669                         kfree(tp);
1670                 }
1671                 o_tty->magic = 0;
1672                 o_tty->driver->refcount--;
1673                 file_list_lock();
1674                 list_del_init(&o_tty->tty_files);
1675                 file_list_unlock();
1676                 free_tty_struct(o_tty);
1677         }
1678
1679         if (!devpts)
1680                 tty->driver->ttys[idx] = NULL;
1681         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
1682                 tp = tty->termios;
1683                 if (!devpts)
1684                         tty->driver->termios[idx] = NULL;
1685                 kfree(tp);
1686
1687                 tp = tty->termios_locked;
1688                 if (!devpts)
1689                         tty->driver->termios_locked[idx] = NULL;
1690                 kfree(tp);
1691         }
1692
1693         tty->magic = 0;
1694         tty->driver->refcount--;
1695         file_list_lock();
1696         list_del_init(&tty->tty_files);
1697         file_list_unlock();
1698         module_put(tty->driver->owner);
1699         free_tty_struct(tty);
1700 }
1701
1702 /*
1703  * Even releasing the tty structures is a tricky business.. We have
1704  * to be very careful that the structures are all released at the
1705  * same time, as interrupts might otherwise get the wrong pointers.
1706  *
1707  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
1708  * lead to double frees or releasing memory still in use.
1709  */
1710 static void release_dev(struct file * filp)
1711 {
1712         struct tty_struct *tty, *o_tty;
1713         int     pty_master, tty_closing, o_tty_closing, do_sleep;
1714         int     devpts_master, devpts;
1715         int     idx;
1716         char    buf[64];
1717         unsigned long flags;
1718         
1719         tty = (struct tty_struct *)filp->private_data;
1720         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "release_dev"))
1721                 return;
1722
1723         check_tty_count(tty, "release_dev");
1724
1725         tty_fasync(-1, filp, 0);
1726
1727         idx = tty->index;
1728         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
1729                       tty->driver->subtype == PTY_TYPE_MASTER);
1730         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
1731         devpts_master = pty_master && devpts;
1732         o_tty = tty->link;
1733
1734 #ifdef TTY_PARANOIA_CHECK
1735         if (idx < 0 || idx >= tty->driver->num) {
1736                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
1737                                   "free (%s)\n", tty->name);
1738                 return;
1739         }
1740         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1741                 if (tty != tty->driver->ttys[idx]) {
1742                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
1743                                "for (%s)\n", idx, tty->name);
1744                         return;
1745                 }
1746                 if (tty->termios != tty->driver->termios[idx]) {
1747                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
1748                                "for (%s)\n",
1749                                idx, tty->name);
1750                         return;
1751                 }
1752                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
1753                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
1754                                "termios_locked for (%s)\n",
1755                                idx, tty->name);
1756                         return;
1757                 }
1758         }
1759 #endif
1760
1761 #ifdef TTY_DEBUG_HANGUP
1762         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
1763                tty_name(tty, buf), tty->count);
1764 #endif
1765
1766 #ifdef TTY_PARANOIA_CHECK
1767         if (tty->driver->other &&
1768              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
1769                 if (o_tty != tty->driver->other->ttys[idx]) {
1770                         printk(KERN_DEBUG "release_dev: other->table[%d] "
1771                                           "not o_tty for (%s)\n",
1772                                idx, tty->name);
1773                         return;
1774                 }
1775                 if (o_tty->termios != tty->driver->other->termios[idx]) {
1776                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
1777                                           "not o_termios for (%s)\n",
1778                                idx, tty->name);
1779                         return;
1780                 }
1781                 if (o_tty->termios_locked != 
1782                       tty->driver->other->termios_locked[idx]) {
1783                         printk(KERN_DEBUG "release_dev: other->termios_locked["
1784                                           "%d] not o_termios_locked for (%s)\n",
1785                                idx, tty->name);
1786                         return;
1787                 }
1788                 if (o_tty->link != tty) {
1789                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
1790                         return;
1791                 }
1792         }
1793 #endif
1794         if (tty->driver->close)
1795                 tty->driver->close(tty, filp);
1796
1797         /*
1798          * Sanity check: if tty->count is going to zero, there shouldn't be
1799          * any waiters on tty->read_wait or tty->write_wait.  We test the
1800          * wait queues and kick everyone out _before_ actually starting to
1801          * close.  This ensures that we won't block while releasing the tty
1802          * structure.
1803          *
1804          * The test for the o_tty closing is necessary, since the master and
1805          * slave sides may close in any order.  If the slave side closes out
1806          * first, its count will be one, since the master side holds an open.
1807          * Thus this test wouldn't be triggered at the time the slave closes,
1808          * so we do it now.
1809          *
1810          * Note that it's possible for the tty to be opened again while we're
1811          * flushing out waiters.  By recalculating the closing flags before
1812          * each iteration we avoid any problems.
1813          */
1814         while (1) {
1815                 /* Guard against races with tty->count changes elsewhere and
1816                    opens on /dev/tty */
1817                    
1818                 down(&tty_sem);
1819                 tty_closing = tty->count <= 1;
1820                 o_tty_closing = o_tty &&
1821                         (o_tty->count <= (pty_master ? 1 : 0));
1822                 up(&tty_sem);
1823                 do_sleep = 0;
1824
1825                 if (tty_closing) {
1826                         if (waitqueue_active(&tty->read_wait)) {
1827                                 wake_up(&tty->read_wait);
1828                                 do_sleep++;
1829                         }
1830                         if (waitqueue_active(&tty->write_wait)) {
1831                                 wake_up(&tty->write_wait);
1832                                 do_sleep++;
1833                         }
1834                 }
1835                 if (o_tty_closing) {
1836                         if (waitqueue_active(&o_tty->read_wait)) {
1837                                 wake_up(&o_tty->read_wait);
1838                                 do_sleep++;
1839                         }
1840                         if (waitqueue_active(&o_tty->write_wait)) {
1841                                 wake_up(&o_tty->write_wait);
1842                                 do_sleep++;
1843                         }
1844                 }
1845                 if (!do_sleep)
1846                         break;
1847
1848                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
1849                                     "active!\n", tty_name(tty, buf));
1850                 schedule();
1851         }       
1852
1853         /*
1854          * The closing flags are now consistent with the open counts on 
1855          * both sides, and we've completed the last operation that could 
1856          * block, so it's safe to proceed with closing.
1857          */
1858          
1859         down(&tty_sem);
1860         if (pty_master) {
1861                 if (--o_tty->count < 0) {
1862                         printk(KERN_WARNING "release_dev: bad pty slave count "
1863                                             "(%d) for %s\n",
1864                                o_tty->count, tty_name(o_tty, buf));
1865                         o_tty->count = 0;
1866                 }
1867         }
1868         if (--tty->count < 0) {
1869                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
1870                        tty->count, tty_name(tty, buf));
1871                 tty->count = 0;
1872         }
1873         up(&tty_sem);
1874         
1875         /*
1876          * We've decremented tty->count, so we need to remove this file
1877          * descriptor off the tty->tty_files list; this serves two
1878          * purposes:
1879          *  - check_tty_count sees the correct number of file descriptors
1880          *    associated with this tty.
1881          *  - do_tty_hangup no longer sees this file descriptor as
1882          *    something that needs to be handled for hangups.
1883          */
1884         file_kill(filp);
1885         filp->private_data = NULL;
1886
1887         /*
1888          * Perform some housekeeping before deciding whether to return.
1889          *
1890          * Set the TTY_CLOSING flag if this was the last open.  In the
1891          * case of a pty we may have to wait around for the other side
1892          * to close, and TTY_CLOSING makes sure we can't be reopened.
1893          */
1894         if(tty_closing)
1895                 set_bit(TTY_CLOSING, &tty->flags);
1896         if(o_tty_closing)
1897                 set_bit(TTY_CLOSING, &o_tty->flags);
1898
1899         /*
1900          * If _either_ side is closing, make sure there aren't any
1901          * processes that still think tty or o_tty is their controlling
1902          * tty.
1903          */
1904         if (tty_closing || o_tty_closing) {
1905                 struct task_struct *p;
1906
1907                 read_lock(&tasklist_lock);
1908                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1909                         p->signal->tty = NULL;
1910                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1911                 if (o_tty)
1912                         do_each_task_pid(o_tty->session, PIDTYPE_SID, p) {
1913                                 p->signal->tty = NULL;
1914                         } while_each_task_pid(o_tty->session, PIDTYPE_SID, p);
1915                 read_unlock(&tasklist_lock);
1916         }
1917
1918         /* check whether both sides are closing ... */
1919         if (!tty_closing || (o_tty && !o_tty_closing))
1920                 return;
1921         
1922 #ifdef TTY_DEBUG_HANGUP
1923         printk(KERN_DEBUG "freeing tty structure...");
1924 #endif
1925         /*
1926          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
1927          * kill any delayed work. As this is the final close it does not
1928          * race with the set_ldisc code path.
1929          */
1930         clear_bit(TTY_LDISC, &tty->flags);
1931         clear_bit(TTY_DONT_FLIP, &tty->flags);
1932         cancel_delayed_work(&tty->buf.work);
1933
1934         /*
1935          * Wait for ->hangup_work and ->buf.work handlers to terminate
1936          */
1937          
1938         flush_scheduled_work();
1939         
1940         /*
1941          * Wait for any short term users (we know they are just driver
1942          * side waiters as the file is closing so user count on the file
1943          * side is zero.
1944          */
1945         spin_lock_irqsave(&tty_ldisc_lock, flags);
1946         while(tty->ldisc.refcount)
1947         {
1948                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1949                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
1950                 spin_lock_irqsave(&tty_ldisc_lock, flags);
1951         }
1952         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1953         /*
1954          * Shutdown the current line discipline, and reset it to N_TTY.
1955          * N.B. why reset ldisc when we're releasing the memory??
1956          *
1957          * FIXME: this MUST get fixed for the new reflocking
1958          */
1959         if (tty->ldisc.close)
1960                 (tty->ldisc.close)(tty);
1961         tty_ldisc_put(tty->ldisc.num);
1962         
1963         /*
1964          *      Switch the line discipline back
1965          */
1966         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1967         tty_set_termios_ldisc(tty,N_TTY); 
1968         if (o_tty) {
1969                 /* FIXME: could o_tty be in setldisc here ? */
1970                 clear_bit(TTY_LDISC, &o_tty->flags);
1971                 if (o_tty->ldisc.close)
1972                         (o_tty->ldisc.close)(o_tty);
1973                 tty_ldisc_put(o_tty->ldisc.num);
1974                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
1975                 tty_set_termios_ldisc(o_tty,N_TTY); 
1976         }
1977         /*
1978          * The release_mem function takes care of the details of clearing
1979          * the slots and preserving the termios structure.
1980          */
1981         release_mem(tty, idx);
1982
1983 #ifdef CONFIG_UNIX98_PTYS
1984         /* Make this pty number available for reallocation */
1985         if (devpts) {
1986                 down(&allocated_ptys_lock);
1987                 idr_remove(&allocated_ptys, idx);
1988                 up(&allocated_ptys_lock);
1989         }
1990 #endif
1991
1992 }
1993
1994 /*
1995  * tty_open and tty_release keep up the tty count that contains the
1996  * number of opens done on a tty. We cannot use the inode-count, as
1997  * different inodes might point to the same tty.
1998  *
1999  * Open-counting is needed for pty masters, as well as for keeping
2000  * track of serial lines: DTR is dropped when the last close happens.
2001  * (This is not done solely through tty->count, now.  - Ted 1/27/92)
2002  *
2003  * The termios state of a pty is reset on first open so that
2004  * settings don't persist across reuse.
2005  */
2006 static int tty_open(struct inode * inode, struct file * filp)
2007 {
2008         struct tty_struct *tty;
2009         int noctty, retval;
2010         struct tty_driver *driver;
2011         int index;
2012         dev_t device = inode->i_rdev;
2013         unsigned short saved_flags = filp->f_flags;
2014
2015         nonseekable_open(inode, filp);
2016         
2017 retry_open:
2018         noctty = filp->f_flags & O_NOCTTY;
2019         index  = -1;
2020         retval = 0;
2021         
2022         down(&tty_sem);
2023
2024         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2025                 if (!current->signal->tty) {
2026                         up(&tty_sem);
2027                         return -ENXIO;
2028                 }
2029                 driver = current->signal->tty->driver;
2030                 index = current->signal->tty->index;
2031                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2032                 /* noctty = 1; */
2033                 goto got_driver;
2034         }
2035 #ifdef CONFIG_VT
2036         if (device == MKDEV(TTY_MAJOR,0)) {
2037                 extern struct tty_driver *console_driver;
2038                 driver = console_driver;
2039                 index = fg_console;
2040                 noctty = 1;
2041                 goto got_driver;
2042         }
2043 #endif
2044         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2045                 driver = console_device(&index);
2046                 if (driver) {
2047                         /* Don't let /dev/console block */
2048                         filp->f_flags |= O_NONBLOCK;
2049                         noctty = 1;
2050                         goto got_driver;
2051                 }
2052                 up(&tty_sem);
2053                 return -ENODEV;
2054         }
2055
2056         driver = get_tty_driver(device, &index);
2057         if (!driver) {
2058                 up(&tty_sem);
2059                 return -ENODEV;
2060         }
2061 got_driver:
2062         retval = init_dev(driver, index, &tty);
2063         up(&tty_sem);
2064         if (retval)
2065                 return retval;
2066
2067         filp->private_data = tty;
2068         file_move(filp, &tty->tty_files);
2069         check_tty_count(tty, "tty_open");
2070         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2071             tty->driver->subtype == PTY_TYPE_MASTER)
2072                 noctty = 1;
2073 #ifdef TTY_DEBUG_HANGUP
2074         printk(KERN_DEBUG "opening %s...", tty->name);
2075 #endif
2076         if (!retval) {
2077                 if (tty->driver->open)
2078                         retval = tty->driver->open(tty, filp);
2079                 else
2080                         retval = -ENODEV;
2081         }
2082         filp->f_flags = saved_flags;
2083
2084         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2085                 retval = -EBUSY;
2086
2087         if (retval) {
2088 #ifdef TTY_DEBUG_HANGUP
2089                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2090                        tty->name);
2091 #endif
2092                 release_dev(filp);
2093                 if (retval != -ERESTARTSYS)
2094                         return retval;
2095                 if (signal_pending(current))
2096                         return retval;
2097                 schedule();
2098                 /*
2099                  * Need to reset f_op in case a hangup happened.
2100                  */
2101                 if (filp->f_op == &hung_up_tty_fops)
2102                         filp->f_op = &tty_fops;
2103                 goto retry_open;
2104         }
2105         if (!noctty &&
2106             current->signal->leader &&
2107             !current->signal->tty &&
2108             tty->session == 0) {
2109                 task_lock(current);
2110                 current->signal->tty = tty;
2111                 task_unlock(current);
2112                 current->signal->tty_old_pgrp = 0;
2113                 tty->session = current->signal->session;
2114                 tty->pgrp = process_group(current);
2115         }
2116         return 0;
2117 }
2118
2119 #ifdef CONFIG_UNIX98_PTYS
2120 static int ptmx_open(struct inode * inode, struct file * filp)
2121 {
2122         struct tty_struct *tty;
2123         int retval;
2124         int index;
2125         int idr_ret;
2126
2127         nonseekable_open(inode, filp);
2128
2129         /* find a device that is not in use. */
2130         down(&allocated_ptys_lock);
2131         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2132                 up(&allocated_ptys_lock);
2133                 return -ENOMEM;
2134         }
2135         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2136         if (idr_ret < 0) {
2137                 up(&allocated_ptys_lock);
2138                 if (idr_ret == -EAGAIN)
2139                         return -ENOMEM;
2140                 return -EIO;
2141         }
2142         if (index >= pty_limit) {
2143                 idr_remove(&allocated_ptys, index);
2144                 up(&allocated_ptys_lock);
2145                 return -EIO;
2146         }
2147         up(&allocated_ptys_lock);
2148
2149         down(&tty_sem);
2150         retval = init_dev(ptm_driver, index, &tty);
2151         up(&tty_sem);
2152         
2153         if (retval)
2154                 goto out;
2155
2156         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2157         filp->private_data = tty;
2158         file_move(filp, &tty->tty_files);
2159
2160         retval = -ENOMEM;
2161         if (devpts_pty_new(tty->link))
2162                 goto out1;
2163
2164         check_tty_count(tty, "tty_open");
2165         retval = ptm_driver->open(tty, filp);
2166         if (!retval)
2167                 return 0;
2168 out1:
2169         release_dev(filp);
2170 out:
2171         down(&allocated_ptys_lock);
2172         idr_remove(&allocated_ptys, index);
2173         up(&allocated_ptys_lock);
2174         return retval;
2175 }
2176 #endif
2177
2178 static int tty_release(struct inode * inode, struct file * filp)
2179 {
2180         lock_kernel();
2181         release_dev(filp);
2182         unlock_kernel();
2183         return 0;
2184 }
2185
2186 /* No kernel lock held - fine */
2187 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2188 {
2189         struct tty_struct * tty;
2190         struct tty_ldisc *ld;
2191         int ret = 0;
2192
2193         tty = (struct tty_struct *)filp->private_data;
2194         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_poll"))
2195                 return 0;
2196                 
2197         ld = tty_ldisc_ref_wait(tty);
2198         if (ld->poll)
2199                 ret = (ld->poll)(tty, filp, wait);
2200         tty_ldisc_deref(ld);
2201         return ret;
2202 }
2203
2204 static int tty_fasync(int fd, struct file * filp, int on)
2205 {
2206         struct tty_struct * tty;
2207         int retval;
2208
2209         tty = (struct tty_struct *)filp->private_data;
2210         if (tty_paranoia_check(tty, filp->f_dentry->d_inode, "tty_fasync"))
2211                 return 0;
2212         
2213         retval = fasync_helper(fd, filp, on, &tty->fasync);
2214         if (retval <= 0)
2215                 return retval;
2216
2217         if (on) {
2218                 if (!waitqueue_active(&tty->read_wait))
2219                         tty->minimum_to_wake = 1;
2220                 retval = f_setown(filp, (-tty->pgrp) ? : current->pid, 0);
2221                 if (retval)
2222                         return retval;
2223         } else {
2224                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2225                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2226         }
2227         return 0;
2228 }
2229
2230 static int tiocsti(struct tty_struct *tty, char __user *p)
2231 {
2232         char ch, mbz = 0;
2233         struct tty_ldisc *ld;
2234         
2235         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2236                 return -EPERM;
2237         if (get_user(ch, p))
2238                 return -EFAULT;
2239         ld = tty_ldisc_ref_wait(tty);
2240         ld->receive_buf(tty, &ch, &mbz, 1);
2241         tty_ldisc_deref(ld);
2242         return 0;
2243 }
2244
2245 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2246 {
2247         if (copy_to_user(arg, &tty->winsize, sizeof(*arg)))
2248                 return -EFAULT;
2249         return 0;
2250 }
2251
2252 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2253         struct winsize __user * arg)
2254 {
2255         struct winsize tmp_ws;
2256
2257         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2258                 return -EFAULT;
2259         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2260                 return 0;
2261 #ifdef CONFIG_VT
2262         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2263                 int rc;
2264
2265                 acquire_console_sem();
2266                 rc = vc_resize(tty->driver_data, tmp_ws.ws_col, tmp_ws.ws_row);
2267                 release_console_sem();
2268                 if (rc)
2269                         return -ENXIO;
2270         }
2271 #endif
2272         if (tty->pgrp > 0)
2273                 kill_pg(tty->pgrp, SIGWINCH, 1);
2274         if ((real_tty->pgrp != tty->pgrp) && (real_tty->pgrp > 0))
2275                 kill_pg(real_tty->pgrp, SIGWINCH, 1);
2276         tty->winsize = tmp_ws;
2277         real_tty->winsize = tmp_ws;
2278         return 0;
2279 }
2280
2281 static int tioccons(struct file *file)
2282 {
2283         if (!capable(CAP_SYS_ADMIN))
2284                 return -EPERM;
2285         if (file->f_op->write == redirected_tty_write) {
2286                 struct file *f;
2287                 spin_lock(&redirect_lock);
2288                 f = redirect;
2289                 redirect = NULL;
2290                 spin_unlock(&redirect_lock);
2291                 if (f)
2292                         fput(f);
2293                 return 0;
2294         }
2295         spin_lock(&redirect_lock);
2296         if (redirect) {
2297                 spin_unlock(&redirect_lock);
2298                 return -EBUSY;
2299         }
2300         get_file(file);
2301         redirect = file;
2302         spin_unlock(&redirect_lock);
2303         return 0;
2304 }
2305
2306
2307 static int fionbio(struct file *file, int __user *p)
2308 {
2309         int nonblock;
2310
2311         if (get_user(nonblock, p))
2312                 return -EFAULT;
2313
2314         if (nonblock)
2315                 file->f_flags |= O_NONBLOCK;
2316         else
2317                 file->f_flags &= ~O_NONBLOCK;
2318         return 0;
2319 }
2320
2321 static int tiocsctty(struct tty_struct *tty, int arg)
2322 {
2323         task_t *p;
2324
2325         if (current->signal->leader &&
2326             (current->signal->session == tty->session))
2327                 return 0;
2328         /*
2329          * The process must be a session leader and
2330          * not have a controlling tty already.
2331          */
2332         if (!current->signal->leader || current->signal->tty)
2333                 return -EPERM;
2334         if (tty->session > 0) {
2335                 /*
2336                  * This tty is already the controlling
2337                  * tty for another session group!
2338                  */
2339                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
2340                         /*
2341                          * Steal it away
2342                          */
2343
2344                         read_lock(&tasklist_lock);
2345                         do_each_task_pid(tty->session, PIDTYPE_SID, p) {
2346                                 p->signal->tty = NULL;
2347                         } while_each_task_pid(tty->session, PIDTYPE_SID, p);
2348                         read_unlock(&tasklist_lock);
2349                 } else
2350                         return -EPERM;
2351         }
2352         task_lock(current);
2353         current->signal->tty = tty;
2354         task_unlock(current);
2355         current->signal->tty_old_pgrp = 0;
2356         tty->session = current->signal->session;
2357         tty->pgrp = process_group(current);
2358         return 0;
2359 }
2360
2361 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2362 {
2363         /*
2364          * (tty == real_tty) is a cheap way of
2365          * testing if the tty is NOT a master pty.
2366          */
2367         if (tty == real_tty && current->signal->tty != real_tty)
2368                 return -ENOTTY;
2369         return put_user(real_tty->pgrp, p);
2370 }
2371
2372 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2373 {
2374         pid_t pgrp;
2375         int retval = tty_check_change(real_tty);
2376
2377         if (retval == -EIO)
2378                 return -ENOTTY;
2379         if (retval)
2380                 return retval;
2381         if (!current->signal->tty ||
2382             (current->signal->tty != real_tty) ||
2383             (real_tty->session != current->signal->session))
2384                 return -ENOTTY;
2385         if (get_user(pgrp, p))
2386                 return -EFAULT;
2387         if (pgrp < 0)
2388                 return -EINVAL;
2389         if (session_of_pgrp(pgrp) != current->signal->session)
2390                 return -EPERM;
2391         real_tty->pgrp = pgrp;
2392         return 0;
2393 }
2394
2395 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2396 {
2397         /*
2398          * (tty == real_tty) is a cheap way of
2399          * testing if the tty is NOT a master pty.
2400         */
2401         if (tty == real_tty && current->signal->tty != real_tty)
2402                 return -ENOTTY;
2403         if (real_tty->session <= 0)
2404                 return -ENOTTY;
2405         return put_user(real_tty->session, p);
2406 }
2407
2408 static int tiocsetd(struct tty_struct *tty, int __user *p)
2409 {
2410         int ldisc;
2411
2412         if (get_user(ldisc, p))
2413                 return -EFAULT;
2414         return tty_set_ldisc(tty, ldisc);
2415 }
2416
2417 static int send_break(struct tty_struct *tty, unsigned int duration)
2418 {
2419         tty->driver->break_ctl(tty, -1);
2420         if (!signal_pending(current)) {
2421                 msleep_interruptible(duration);
2422         }
2423         tty->driver->break_ctl(tty, 0);
2424         if (signal_pending(current))
2425                 return -EINTR;
2426         return 0;
2427 }
2428
2429 static int
2430 tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
2431 {
2432         int retval = -EINVAL;
2433
2434         if (tty->driver->tiocmget) {
2435                 retval = tty->driver->tiocmget(tty, file);
2436
2437                 if (retval >= 0)
2438                         retval = put_user(retval, p);
2439         }
2440         return retval;
2441 }
2442
2443 static int
2444 tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
2445              unsigned __user *p)
2446 {
2447         int retval = -EINVAL;
2448
2449         if (tty->driver->tiocmset) {
2450                 unsigned int set, clear, val;
2451
2452                 retval = get_user(val, p);
2453                 if (retval)
2454                         return retval;
2455
2456                 set = clear = 0;
2457                 switch (cmd) {
2458                 case TIOCMBIS:
2459                         set = val;
2460                         break;
2461                 case TIOCMBIC:
2462                         clear = val;
2463                         break;
2464                 case TIOCMSET:
2465                         set = val;
2466                         clear = ~val;
2467                         break;
2468                 }
2469
2470                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2471                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
2472
2473                 retval = tty->driver->tiocmset(tty, file, set, clear);
2474         }
2475         return retval;
2476 }
2477
2478 /*
2479  * Split this up, as gcc can choke on it otherwise..
2480  */
2481 int tty_ioctl(struct inode * inode, struct file * file,
2482               unsigned int cmd, unsigned long arg)
2483 {
2484         struct tty_struct *tty, *real_tty;
2485         void __user *p = (void __user *)arg;
2486         int retval;
2487         struct tty_ldisc *ld;
2488         
2489         tty = (struct tty_struct *)file->private_data;
2490         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
2491                 return -EINVAL;
2492
2493         real_tty = tty;
2494         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2495             tty->driver->subtype == PTY_TYPE_MASTER)
2496                 real_tty = tty->link;
2497
2498         /*
2499          * Break handling by driver
2500          */
2501         if (!tty->driver->break_ctl) {
2502                 switch(cmd) {
2503                 case TIOCSBRK:
2504                 case TIOCCBRK:
2505                         if (tty->driver->ioctl)
2506                                 return tty->driver->ioctl(tty, file, cmd, arg);
2507                         return -EINVAL;
2508                         
2509                 /* These two ioctl's always return success; even if */
2510                 /* the driver doesn't support them. */
2511                 case TCSBRK:
2512                 case TCSBRKP:
2513                         if (!tty->driver->ioctl)
2514                                 return 0;
2515                         retval = tty->driver->ioctl(tty, file, cmd, arg);
2516                         if (retval == -ENOIOCTLCMD)
2517                                 retval = 0;
2518                         return retval;
2519                 }
2520         }
2521
2522         /*
2523          * Factor out some common prep work
2524          */
2525         switch (cmd) {
2526         case TIOCSETD:
2527         case TIOCSBRK:
2528         case TIOCCBRK:
2529         case TCSBRK:
2530         case TCSBRKP:                   
2531                 retval = tty_check_change(tty);
2532                 if (retval)
2533                         return retval;
2534                 if (cmd != TIOCCBRK) {
2535                         tty_wait_until_sent(tty, 0);
2536                         if (signal_pending(current))
2537                                 return -EINTR;
2538                 }
2539                 break;
2540         }
2541
2542         switch (cmd) {
2543                 case TIOCSTI:
2544                         return tiocsti(tty, p);
2545                 case TIOCGWINSZ:
2546                         return tiocgwinsz(tty, p);
2547                 case TIOCSWINSZ:
2548                         return tiocswinsz(tty, real_tty, p);
2549                 case TIOCCONS:
2550                         return real_tty!=tty ? -EINVAL : tioccons(file);
2551                 case FIONBIO:
2552                         return fionbio(file, p);
2553                 case TIOCEXCL:
2554                         set_bit(TTY_EXCLUSIVE, &tty->flags);
2555                         return 0;
2556                 case TIOCNXCL:
2557                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
2558                         return 0;
2559                 case TIOCNOTTY:
2560                         if (current->signal->tty != tty)
2561                                 return -ENOTTY;
2562                         if (current->signal->leader)
2563                                 disassociate_ctty(0);
2564                         task_lock(current);
2565                         current->signal->tty = NULL;
2566                         task_unlock(current);
2567                         return 0;
2568                 case TIOCSCTTY:
2569                         return tiocsctty(tty, arg);
2570                 case TIOCGPGRP:
2571                         return tiocgpgrp(tty, real_tty, p);
2572                 case TIOCSPGRP:
2573                         return tiocspgrp(tty, real_tty, p);
2574                 case TIOCGSID:
2575                         return tiocgsid(tty, real_tty, p);
2576                 case TIOCGETD:
2577                         /* FIXME: check this is ok */
2578                         return put_user(tty->ldisc.num, (int __user *)p);
2579                 case TIOCSETD:
2580                         return tiocsetd(tty, p);
2581 #ifdef CONFIG_VT
2582                 case TIOCLINUX:
2583                         return tioclinux(tty, arg);
2584 #endif
2585                 /*
2586                  * Break handling
2587                  */
2588                 case TIOCSBRK:  /* Turn break on, unconditionally */
2589                         tty->driver->break_ctl(tty, -1);
2590                         return 0;
2591                         
2592                 case TIOCCBRK:  /* Turn break off, unconditionally */
2593                         tty->driver->break_ctl(tty, 0);
2594                         return 0;
2595                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
2596                         /*
2597                          * XXX is the above comment correct, or the
2598                          * code below correct?  Is this ioctl used at
2599                          * all by anyone?
2600                          */
2601                         if (!arg)
2602                                 return send_break(tty, 250);
2603                         return 0;
2604                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
2605                         return send_break(tty, arg ? arg*100 : 250);
2606
2607                 case TIOCMGET:
2608                         return tty_tiocmget(tty, file, p);
2609
2610                 case TIOCMSET:
2611                 case TIOCMBIC:
2612                 case TIOCMBIS:
2613                         return tty_tiocmset(tty, file, cmd, p);
2614         }
2615         if (tty->driver->ioctl) {
2616                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
2617                 if (retval != -ENOIOCTLCMD)
2618                         return retval;
2619         }
2620         ld = tty_ldisc_ref_wait(tty);
2621         retval = -EINVAL;
2622         if (ld->ioctl) {
2623                 retval = ld->ioctl(tty, file, cmd, arg);
2624                 if (retval == -ENOIOCTLCMD)
2625                         retval = -EINVAL;
2626         }
2627         tty_ldisc_deref(ld);
2628         return retval;
2629 }
2630
2631
2632 /*
2633  * This implements the "Secure Attention Key" ---  the idea is to
2634  * prevent trojan horses by killing all processes associated with this
2635  * tty when the user hits the "Secure Attention Key".  Required for
2636  * super-paranoid applications --- see the Orange Book for more details.
2637  * 
2638  * This code could be nicer; ideally it should send a HUP, wait a few
2639  * seconds, then send a INT, and then a KILL signal.  But you then
2640  * have to coordinate with the init process, since all processes associated
2641  * with the current tty must be dead before the new getty is allowed
2642  * to spawn.
2643  *
2644  * Now, if it would be correct ;-/ The current code has a nasty hole -
2645  * it doesn't catch files in flight. We may send the descriptor to ourselves
2646  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
2647  *
2648  * Nasty bug: do_SAK is being called in interrupt context.  This can
2649  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
2650  */
2651 static void __do_SAK(void *arg)
2652 {
2653 #ifdef TTY_SOFT_SAK
2654         tty_hangup(tty);
2655 #else
2656         struct tty_struct *tty = arg;
2657         struct task_struct *p;
2658         int session;
2659         int             i;
2660         struct file     *filp;
2661         struct tty_ldisc *disc;
2662         struct fdtable *fdt;
2663         
2664         if (!tty)
2665                 return;
2666         session  = tty->session;
2667         
2668         /* We don't want an ldisc switch during this */
2669         disc = tty_ldisc_ref(tty);
2670         if (disc && disc->flush_buffer)
2671                 disc->flush_buffer(tty);
2672         tty_ldisc_deref(disc);
2673
2674         if (tty->driver->flush_buffer)
2675                 tty->driver->flush_buffer(tty);
2676         
2677         read_lock(&tasklist_lock);
2678         do_each_task_pid(session, PIDTYPE_SID, p) {
2679                 if (p->signal->tty == tty || session > 0) {
2680                         printk(KERN_NOTICE "SAK: killed process %d"
2681                             " (%s): p->signal->session==tty->session\n",
2682                             p->pid, p->comm);
2683                         send_sig(SIGKILL, p, 1);
2684                         continue;
2685                 }
2686                 task_lock(p);
2687                 if (p->files) {
2688                         rcu_read_lock();
2689                         fdt = files_fdtable(p->files);
2690                         for (i=0; i < fdt->max_fds; i++) {
2691                                 filp = fcheck_files(p->files, i);
2692                                 if (!filp)
2693                                         continue;
2694                                 if (filp->f_op->read == tty_read &&
2695                                     filp->private_data == tty) {
2696                                         printk(KERN_NOTICE "SAK: killed process %d"
2697                                             " (%s): fd#%d opened to the tty\n",
2698                                             p->pid, p->comm, i);
2699                                         send_sig(SIGKILL, p, 1);
2700                                         break;
2701                                 }
2702                         }
2703                         rcu_read_unlock();
2704                 }
2705                 task_unlock(p);
2706         } while_each_task_pid(session, PIDTYPE_SID, p);
2707         read_unlock(&tasklist_lock);
2708 #endif
2709 }
2710
2711 /*
2712  * The tq handling here is a little racy - tty->SAK_work may already be queued.
2713  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
2714  * the values which we write to it will be identical to the values which it
2715  * already has. --akpm
2716  */
2717 void do_SAK(struct tty_struct *tty)
2718 {
2719         if (!tty)
2720                 return;
2721         PREPARE_WORK(&tty->SAK_work, __do_SAK, tty);
2722         schedule_work(&tty->SAK_work);
2723 }
2724
2725 EXPORT_SYMBOL(do_SAK);
2726
2727 /*
2728  * This routine is called out of the software interrupt to flush data
2729  * from the buffer chain to the line discipline.
2730  */
2731  
2732 static void flush_to_ldisc(void *private_)
2733 {
2734         struct tty_struct *tty = (struct tty_struct *) private_;
2735         unsigned long   flags;
2736         struct tty_ldisc *disc;
2737         struct tty_buffer *tbuf;
2738
2739         disc = tty_ldisc_ref(tty);
2740         if (disc == NULL)       /*  !TTY_LDISC */
2741                 return;
2742
2743         if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
2744                 /*
2745                  * Do it after the next timer tick:
2746                  */
2747                 schedule_delayed_work(&tty->buf.work, 1);
2748                 goto out;
2749         }
2750         spin_lock_irqsave(&tty->read_lock, flags);
2751         while((tbuf = tty->buf.head) != NULL) {
2752                 tty->buf.head = tbuf->next;
2753                 if (tty->buf.head == NULL)
2754                         tty->buf.tail = NULL;
2755                 spin_unlock_irqrestore(&tty->read_lock, flags);
2756                 /* printk("Process buffer %p for %d\n", tbuf, tbuf->used); */
2757                 disc->receive_buf(tty, tbuf->char_buf_ptr,
2758                                        tbuf->flag_buf_ptr,
2759                                        tbuf->used);
2760                 spin_lock_irqsave(&tty->read_lock, flags);
2761                 tty_buffer_free(tty, tbuf);
2762         }
2763         spin_unlock_irqrestore(&tty->read_lock, flags);
2764 out:
2765         tty_ldisc_deref(disc);
2766 }
2767
2768 /*
2769  * Routine which returns the baud rate of the tty
2770  *
2771  * Note that the baud_table needs to be kept in sync with the
2772  * include/asm/termbits.h file.
2773  */
2774 static int baud_table[] = {
2775         0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
2776         9600, 19200, 38400, 57600, 115200, 230400, 460800,
2777 #ifdef __sparc__
2778         76800, 153600, 307200, 614400, 921600
2779 #else
2780         500000, 576000, 921600, 1000000, 1152000, 1500000, 2000000,
2781         2500000, 3000000, 3500000, 4000000
2782 #endif
2783 };
2784
2785 static int n_baud_table = ARRAY_SIZE(baud_table);
2786
2787 /**
2788  *      tty_termios_baud_rate
2789  *      @termios: termios structure
2790  *
2791  *      Convert termios baud rate data into a speed. This should be called
2792  *      with the termios lock held if this termios is a terminal termios
2793  *      structure. May change the termios data.
2794  */
2795  
2796 int tty_termios_baud_rate(struct termios *termios)
2797 {
2798         unsigned int cbaud;
2799         
2800         cbaud = termios->c_cflag & CBAUD;
2801
2802         if (cbaud & CBAUDEX) {
2803                 cbaud &= ~CBAUDEX;
2804
2805                 if (cbaud < 1 || cbaud + 15 > n_baud_table)
2806                         termios->c_cflag &= ~CBAUDEX;
2807                 else
2808                         cbaud += 15;
2809         }
2810         return baud_table[cbaud];
2811 }
2812
2813 EXPORT_SYMBOL(tty_termios_baud_rate);
2814
2815 /**
2816  *      tty_get_baud_rate       -       get tty bit rates
2817  *      @tty: tty to query
2818  *
2819  *      Returns the baud rate as an integer for this terminal. The
2820  *      termios lock must be held by the caller and the terminal bit
2821  *      flags may be updated.
2822  */
2823  
2824 int tty_get_baud_rate(struct tty_struct *tty)
2825 {
2826         int baud = tty_termios_baud_rate(tty->termios);
2827
2828         if (baud == 38400 && tty->alt_speed) {
2829                 if (!tty->warned) {
2830                         printk(KERN_WARNING "Use of setserial/setrocket to "
2831                                             "set SPD_* flags is deprecated\n");
2832                         tty->warned = 1;
2833                 }
2834                 baud = tty->alt_speed;
2835         }
2836         
2837         return baud;
2838 }
2839
2840 EXPORT_SYMBOL(tty_get_baud_rate);
2841
2842 /**
2843  *      tty_flip_buffer_push    -       terminal
2844  *      @tty: tty to push
2845  *
2846  *      Queue a push of the terminal flip buffers to the line discipline. This
2847  *      function must not be called from IRQ context if tty->low_latency is set.
2848  *
2849  *      In the event of the queue being busy for flipping the work will be
2850  *      held off and retried later.
2851  */
2852
2853 void tty_flip_buffer_push(struct tty_struct *tty)
2854 {
2855         if (tty->low_latency)
2856                 flush_to_ldisc((void *) tty);
2857         else
2858                 schedule_delayed_work(&tty->buf.work, 1);
2859 }
2860
2861 EXPORT_SYMBOL(tty_flip_buffer_push);
2862
2863
2864 /*
2865  * This subroutine initializes a tty structure.
2866  */
2867 static void initialize_tty_struct(struct tty_struct *tty)
2868 {
2869         memset(tty, 0, sizeof(struct tty_struct));
2870         tty->magic = TTY_MAGIC;
2871         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2872         tty->pgrp = -1;
2873         tty->overrun_time = jiffies;
2874         tty->buf.head = tty->buf.tail = NULL;
2875         tty_buffer_init(tty);
2876         INIT_WORK(&tty->buf.work, flush_to_ldisc, tty);
2877         init_MUTEX(&tty->buf.pty_sem);
2878         init_MUTEX(&tty->termios_sem);
2879         init_waitqueue_head(&tty->write_wait);
2880         init_waitqueue_head(&tty->read_wait);
2881         INIT_WORK(&tty->hangup_work, do_tty_hangup, tty);
2882         sema_init(&tty->atomic_read, 1);
2883         sema_init(&tty->atomic_write, 1);
2884         spin_lock_init(&tty->read_lock);
2885         INIT_LIST_HEAD(&tty->tty_files);
2886         INIT_WORK(&tty->SAK_work, NULL, NULL);
2887 }
2888
2889 /*
2890  * The default put_char routine if the driver did not define one.
2891  */
2892 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
2893 {
2894         tty->driver->write(tty, &ch, 1);
2895 }
2896
2897 static struct class *tty_class;
2898
2899 /**
2900  * tty_register_device - register a tty device
2901  * @driver: the tty driver that describes the tty device
2902  * @index: the index in the tty driver for this tty device
2903  * @device: a struct device that is associated with this tty device.
2904  *      This field is optional, if there is no known struct device for this
2905  *      tty device it can be set to NULL safely.
2906  *
2907  * This call is required to be made to register an individual tty device if
2908  * the tty driver's flags have the TTY_DRIVER_NO_DEVFS bit set.  If that
2909  * bit is not set, this function should not be called.
2910  */
2911 void tty_register_device(struct tty_driver *driver, unsigned index,
2912                          struct device *device)
2913 {
2914         char name[64];
2915         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
2916
2917         if (index >= driver->num) {
2918                 printk(KERN_ERR "Attempt to register invalid tty line number "
2919                        " (%d).\n", index);
2920                 return;
2921         }
2922
2923         devfs_mk_cdev(dev, S_IFCHR | S_IRUSR | S_IWUSR,
2924                         "%s%d", driver->devfs_name, index + driver->name_base);
2925
2926         if (driver->type == TTY_DRIVER_TYPE_PTY)
2927                 pty_line_name(driver, index, name);
2928         else
2929                 tty_line_name(driver, index, name);
2930         class_device_create(tty_class, NULL, dev, device, "%s", name);
2931 }
2932
2933 /**
2934  * tty_unregister_device - unregister a tty device
2935  * @driver: the tty driver that describes the tty device
2936  * @index: the index in the tty driver for this tty device
2937  *
2938  * If a tty device is registered with a call to tty_register_device() then
2939  * this function must be made when the tty device is gone.
2940  */
2941 void tty_unregister_device(struct tty_driver *driver, unsigned index)
2942 {
2943         devfs_remove("%s%d", driver->devfs_name, index + driver->name_base);
2944         class_device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
2945 }
2946
2947 EXPORT_SYMBOL(tty_register_device);
2948 EXPORT_SYMBOL(tty_unregister_device);
2949
2950 struct tty_driver *alloc_tty_driver(int lines)
2951 {
2952         struct tty_driver *driver;
2953
2954         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
2955         if (driver) {
2956                 memset(driver, 0, sizeof(struct tty_driver));
2957                 driver->magic = TTY_DRIVER_MAGIC;
2958                 driver->num = lines;
2959                 /* later we'll move allocation of tables here */
2960         }
2961         return driver;
2962 }
2963
2964 void put_tty_driver(struct tty_driver *driver)
2965 {
2966         kfree(driver);
2967 }
2968
2969 void tty_set_operations(struct tty_driver *driver, struct tty_operations *op)
2970 {
2971         driver->open = op->open;
2972         driver->close = op->close;
2973         driver->write = op->write;
2974         driver->put_char = op->put_char;
2975         driver->flush_chars = op->flush_chars;
2976         driver->write_room = op->write_room;
2977         driver->chars_in_buffer = op->chars_in_buffer;
2978         driver->ioctl = op->ioctl;
2979         driver->set_termios = op->set_termios;
2980         driver->throttle = op->throttle;
2981         driver->unthrottle = op->unthrottle;
2982         driver->stop = op->stop;
2983         driver->start = op->start;
2984         driver->hangup = op->hangup;
2985         driver->break_ctl = op->break_ctl;
2986         driver->flush_buffer = op->flush_buffer;
2987         driver->set_ldisc = op->set_ldisc;
2988         driver->wait_until_sent = op->wait_until_sent;
2989         driver->send_xchar = op->send_xchar;
2990         driver->read_proc = op->read_proc;
2991         driver->write_proc = op->write_proc;
2992         driver->tiocmget = op->tiocmget;
2993         driver->tiocmset = op->tiocmset;
2994 }
2995
2996
2997 EXPORT_SYMBOL(alloc_tty_driver);
2998 EXPORT_SYMBOL(put_tty_driver);
2999 EXPORT_SYMBOL(tty_set_operations);
3000
3001 /*
3002  * Called by a tty driver to register itself.
3003  */
3004 int tty_register_driver(struct tty_driver *driver)
3005 {
3006         int error;
3007         int i;
3008         dev_t dev;
3009         void **p = NULL;
3010
3011         if (driver->flags & TTY_DRIVER_INSTALLED)
3012                 return 0;
3013
3014         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
3015                 p = kmalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3016                 if (!p)
3017                         return -ENOMEM;
3018                 memset(p, 0, driver->num * 3 * sizeof(void *));
3019         }
3020
3021         if (!driver->major) {
3022                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3023                                                 (char*)driver->name);
3024                 if (!error) {
3025                         driver->major = MAJOR(dev);
3026                         driver->minor_start = MINOR(dev);
3027                 }
3028         } else {
3029                 dev = MKDEV(driver->major, driver->minor_start);
3030                 error = register_chrdev_region(dev, driver->num,
3031                                                 (char*)driver->name);
3032         }
3033         if (error < 0) {
3034                 kfree(p);
3035                 return error;
3036         }
3037
3038         if (p) {
3039                 driver->ttys = (struct tty_struct **)p;
3040                 driver->termios = (struct termios **)(p + driver->num);
3041                 driver->termios_locked = (struct termios **)(p + driver->num * 2);
3042         } else {
3043                 driver->ttys = NULL;
3044                 driver->termios = NULL;
3045                 driver->termios_locked = NULL;
3046         }
3047
3048         cdev_init(&driver->cdev, &tty_fops);
3049         driver->cdev.owner = driver->owner;
3050         error = cdev_add(&driver->cdev, dev, driver->num);
3051         if (error) {
3052                 cdev_del(&driver->cdev);
3053                 unregister_chrdev_region(dev, driver->num);
3054                 driver->ttys = NULL;
3055                 driver->termios = driver->termios_locked = NULL;
3056                 kfree(p);
3057                 return error;
3058         }
3059
3060         if (!driver->put_char)
3061                 driver->put_char = tty_default_put_char;
3062         
3063         list_add(&driver->tty_drivers, &tty_drivers);
3064         
3065         if ( !(driver->flags & TTY_DRIVER_NO_DEVFS) ) {
3066                 for(i = 0; i < driver->num; i++)
3067                     tty_register_device(driver, i, NULL);
3068         }
3069         proc_tty_register_driver(driver);
3070         return 0;
3071 }
3072
3073 EXPORT_SYMBOL(tty_register_driver);
3074
3075 /*
3076  * Called by a tty driver to unregister itself.
3077  */
3078 int tty_unregister_driver(struct tty_driver *driver)
3079 {
3080         int i;
3081         struct termios *tp;
3082         void *p;
3083
3084         if (driver->refcount)
3085                 return -EBUSY;
3086
3087         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3088                                 driver->num);
3089
3090         list_del(&driver->tty_drivers);
3091
3092         /*
3093          * Free the termios and termios_locked structures because
3094          * we don't want to get memory leaks when modular tty
3095          * drivers are removed from the kernel.
3096          */
3097         for (i = 0; i < driver->num; i++) {
3098                 tp = driver->termios[i];
3099                 if (tp) {
3100                         driver->termios[i] = NULL;
3101                         kfree(tp);
3102                 }
3103                 tp = driver->termios_locked[i];
3104                 if (tp) {
3105                         driver->termios_locked[i] = NULL;
3106                         kfree(tp);
3107                 }
3108                 if (!(driver->flags & TTY_DRIVER_NO_DEVFS))
3109                         tty_unregister_device(driver, i);
3110         }
3111         p = driver->ttys;
3112         proc_tty_unregister_driver(driver);
3113         driver->ttys = NULL;
3114         driver->termios = driver->termios_locked = NULL;
3115         kfree(p);
3116         cdev_del(&driver->cdev);
3117         return 0;
3118 }
3119
3120 EXPORT_SYMBOL(tty_unregister_driver);
3121
3122
3123 /*
3124  * Initialize the console device. This is called *early*, so
3125  * we can't necessarily depend on lots of kernel help here.
3126  * Just do some early initializations, and do the complex setup
3127  * later.
3128  */
3129 void __init console_init(void)
3130 {
3131         initcall_t *call;
3132
3133         /* Setup the default TTY line discipline. */
3134         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
3135
3136         /*
3137          * set up the console device so that later boot sequences can 
3138          * inform about problems etc..
3139          */
3140 #ifdef CONFIG_EARLY_PRINTK
3141         disable_early_printk();
3142 #endif
3143         call = __con_initcall_start;
3144         while (call < __con_initcall_end) {
3145                 (*call)();
3146                 call++;
3147         }
3148 }
3149
3150 #ifdef CONFIG_VT
3151 extern int vty_init(void);
3152 #endif
3153
3154 static int __init tty_class_init(void)
3155 {
3156         tty_class = class_create(THIS_MODULE, "tty");
3157         if (IS_ERR(tty_class))
3158                 return PTR_ERR(tty_class);
3159         return 0;
3160 }
3161
3162 postcore_initcall(tty_class_init);
3163
3164 /* 3/2004 jmc: why do these devices exist? */
3165
3166 static struct cdev tty_cdev, console_cdev;
3167 #ifdef CONFIG_UNIX98_PTYS
3168 static struct cdev ptmx_cdev;
3169 #endif
3170 #ifdef CONFIG_VT
3171 static struct cdev vc0_cdev;
3172 #endif
3173
3174 /*
3175  * Ok, now we can initialize the rest of the tty devices and can count
3176  * on memory allocations, interrupts etc..
3177  */
3178 static int __init tty_init(void)
3179 {
3180         cdev_init(&tty_cdev, &tty_fops);
3181         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3182             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3183                 panic("Couldn't register /dev/tty driver\n");
3184         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 0), S_IFCHR|S_IRUGO|S_IWUGO, "tty");
3185         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");
3186
3187         cdev_init(&console_cdev, &console_fops);
3188         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3189             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3190                 panic("Couldn't register /dev/console driver\n");
3191         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 1), S_IFCHR|S_IRUSR|S_IWUSR, "console");
3192         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL, "console");
3193
3194 #ifdef CONFIG_UNIX98_PTYS
3195         cdev_init(&ptmx_cdev, &ptmx_fops);
3196         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
3197             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
3198                 panic("Couldn't register /dev/ptmx driver\n");
3199         devfs_mk_cdev(MKDEV(TTYAUX_MAJOR, 2), S_IFCHR|S_IRUGO|S_IWUGO, "ptmx");
3200         class_device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), NULL, "ptmx");
3201 #endif
3202
3203 #ifdef CONFIG_VT
3204         cdev_init(&vc0_cdev, &console_fops);
3205         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
3206             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
3207                 panic("Couldn't register /dev/tty0 driver\n");
3208         devfs_mk_cdev(MKDEV(TTY_MAJOR, 0), S_IFCHR|S_IRUSR|S_IWUSR, "vc/0");
3209         class_device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), NULL, "tty0");
3210
3211         vty_init();
3212 #endif
3213         return 0;
3214 }
3215 module_init(tty_init);