n_tty: Split n_tty_receive_char()
[firefly-linux-kernel-4.4.55.git] / drivers / tty / n_tty.c
1 /*
2  * n_tty.c --- implements the N_TTY line discipline.
3  *
4  * This code used to be in tty_io.c, but things are getting hairy
5  * enough that it made sense to split things off.  (The N_TTY
6  * processing has changed so much that it's hardly recognizable,
7  * anyway...)
8  *
9  * Note that the open routine for N_TTY is guaranteed never to return
10  * an error.  This is because Linux will fall back to setting a line
11  * to N_TTY if it can not switch to any other line discipline.
12  *
13  * Written by Theodore Ts'o, Copyright 1994.
14  *
15  * This file also contains code originally written by Linus Torvalds,
16  * Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
17  *
18  * This file may be redistributed under the terms of the GNU General Public
19  * License.
20  *
21  * Reduced memory usage for older ARM systems  - Russell King.
22  *
23  * 2000/01/20   Fixed SMP locking on put_tty_queue using bits of
24  *              the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
25  *              who actually finally proved there really was a race.
26  *
27  * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
28  *              waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
29  *              Also fixed a bug in BLOCKING mode where n_tty_write returns
30  *              EAGAIN
31  */
32
33 #include <linux/types.h>
34 #include <linux/major.h>
35 #include <linux/errno.h>
36 #include <linux/signal.h>
37 #include <linux/fcntl.h>
38 #include <linux/sched.h>
39 #include <linux/interrupt.h>
40 #include <linux/tty.h>
41 #include <linux/timer.h>
42 #include <linux/ctype.h>
43 #include <linux/mm.h>
44 #include <linux/string.h>
45 #include <linux/slab.h>
46 #include <linux/poll.h>
47 #include <linux/bitops.h>
48 #include <linux/audit.h>
49 #include <linux/file.h>
50 #include <linux/uaccess.h>
51 #include <linux/module.h>
52 #include <linux/ratelimit.h>
53 #include <linux/vmalloc.h>
54
55
56 /* number of characters left in xmit buffer before select has we have room */
57 #define WAKEUP_CHARS 256
58
59 /*
60  * This defines the low- and high-watermarks for throttling and
61  * unthrottling the TTY driver.  These watermarks are used for
62  * controlling the space in the read buffer.
63  */
64 #define TTY_THRESHOLD_THROTTLE          128 /* now based on remaining room */
65 #define TTY_THRESHOLD_UNTHROTTLE        128
66
67 /*
68  * Special byte codes used in the echo buffer to represent operations
69  * or special handling of characters.  Bytes in the echo buffer that
70  * are not part of such special blocks are treated as normal character
71  * codes.
72  */
73 #define ECHO_OP_START 0xff
74 #define ECHO_OP_MOVE_BACK_COL 0x80
75 #define ECHO_OP_SET_CANON_COL 0x81
76 #define ECHO_OP_ERASE_TAB 0x82
77
78 #define ECHO_COMMIT_WATERMARK   256
79 #define ECHO_BLOCK              256
80 #define ECHO_DISCARD_WATERMARK  N_TTY_BUF_SIZE - (ECHO_BLOCK + 32)
81
82
83 #undef N_TTY_TRACE
84 #ifdef N_TTY_TRACE
85 # define n_tty_trace(f, args...)        trace_printk(f, ##args)
86 #else
87 # define n_tty_trace(f, args...)
88 #endif
89
90 struct n_tty_data {
91         /* producer-published */
92         size_t read_head;
93         size_t canon_head;
94         size_t echo_head;
95         size_t echo_commit;
96         DECLARE_BITMAP(char_map, 256);
97
98         /* private to n_tty_receive_overrun (single-threaded) */
99         unsigned long overrun_time;
100         int num_overrun;
101
102         /* non-atomic */
103         bool no_room;
104
105         /* must hold exclusive termios_rwsem to reset these */
106         unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
107
108         /* shared by producer and consumer */
109         char read_buf[N_TTY_BUF_SIZE];
110         DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
111         unsigned char echo_buf[N_TTY_BUF_SIZE];
112
113         int minimum_to_wake;
114
115         /* consumer-published */
116         size_t read_tail;
117         size_t line_start;
118
119         /* protected by output lock */
120         unsigned int column;
121         unsigned int canon_column;
122         size_t echo_tail;
123
124         struct mutex atomic_read_lock;
125         struct mutex output_lock;
126 };
127
128 static inline size_t read_cnt(struct n_tty_data *ldata)
129 {
130         return ldata->read_head - ldata->read_tail;
131 }
132
133 static inline unsigned char read_buf(struct n_tty_data *ldata, size_t i)
134 {
135         return ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
136 }
137
138 static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i)
139 {
140         return &ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
141 }
142
143 static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i)
144 {
145         return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
146 }
147
148 static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
149 {
150         return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
151 }
152
153 static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
154                                unsigned char __user *ptr)
155 {
156         struct n_tty_data *ldata = tty->disc_data;
157
158         tty_audit_add_data(tty, &x, 1, ldata->icanon);
159         return put_user(x, ptr);
160 }
161
162 static int receive_room(struct tty_struct *tty)
163 {
164         struct n_tty_data *ldata = tty->disc_data;
165         int left;
166
167         if (I_PARMRK(tty)) {
168                 /* Multiply read_cnt by 3, since each byte might take up to
169                  * three times as many spaces when PARMRK is set (depending on
170                  * its flags, e.g. parity error). */
171                 left = N_TTY_BUF_SIZE - read_cnt(ldata) * 3 - 1;
172         } else
173                 left = N_TTY_BUF_SIZE - read_cnt(ldata) - 1;
174
175         /*
176          * If we are doing input canonicalization, and there are no
177          * pending newlines, let characters through without limit, so
178          * that erase characters will be handled.  Other excess
179          * characters will be beeped.
180          */
181         if (left <= 0)
182                 left = ldata->icanon && ldata->canon_head == ldata->read_tail;
183
184         return left;
185 }
186
187 /**
188  *      n_tty_set_room  -       receive space
189  *      @tty: terminal
190  *
191  *      Re-schedules the flip buffer work if space just became available.
192  *
193  *      Caller holds exclusive termios_rwsem
194  *         or
195  *      n_tty_read()/consumer path:
196  *              holds non-exclusive termios_rwsem
197  */
198
199 static void n_tty_set_room(struct tty_struct *tty)
200 {
201         struct n_tty_data *ldata = tty->disc_data;
202
203         /* Did this open up the receive buffer? We may need to flip */
204         if (unlikely(ldata->no_room) && receive_room(tty)) {
205                 ldata->no_room = 0;
206
207                 WARN_RATELIMIT(tty->port->itty == NULL,
208                                 "scheduling with invalid itty\n");
209                 /* see if ldisc has been killed - if so, this means that
210                  * even though the ldisc has been halted and ->buf.work
211                  * cancelled, ->buf.work is about to be rescheduled
212                  */
213                 WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
214                                "scheduling buffer work for halted ldisc\n");
215                 queue_work(system_unbound_wq, &tty->port->buf.work);
216         }
217 }
218
219 static ssize_t chars_in_buffer(struct tty_struct *tty)
220 {
221         struct n_tty_data *ldata = tty->disc_data;
222         ssize_t n = 0;
223
224         if (!ldata->icanon)
225                 n = read_cnt(ldata);
226         else
227                 n = ldata->canon_head - ldata->read_tail;
228         return n;
229 }
230
231 /**
232  *      n_tty_write_wakeup      -       asynchronous I/O notifier
233  *      @tty: tty device
234  *
235  *      Required for the ptys, serial driver etc. since processes
236  *      that attach themselves to the master and rely on ASYNC
237  *      IO must be woken up
238  */
239
240 static void n_tty_write_wakeup(struct tty_struct *tty)
241 {
242         if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
243                 kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
244 }
245
246 static void n_tty_check_throttle(struct tty_struct *tty)
247 {
248         if (tty->driver->type == TTY_DRIVER_TYPE_PTY)
249                 return;
250         /*
251          * Check the remaining room for the input canonicalization
252          * mode.  We don't want to throttle the driver if we're in
253          * canonical mode and don't have a newline yet!
254          */
255         while (1) {
256                 int throttled;
257                 tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
258                 if (receive_room(tty) >= TTY_THRESHOLD_THROTTLE)
259                         break;
260                 throttled = tty_throttle_safe(tty);
261                 if (!throttled)
262                         break;
263         }
264         __tty_set_flow_change(tty, 0);
265 }
266
267 static inline void n_tty_check_unthrottle(struct tty_struct *tty)
268 {
269         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
270             tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
271                 if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
272                         return;
273                 if (!tty->count)
274                         return;
275                 n_tty_set_room(tty);
276                 n_tty_write_wakeup(tty->link);
277                 wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
278                 return;
279         }
280
281         /* If there is enough space in the read buffer now, let the
282          * low-level driver know. We use chars_in_buffer() to
283          * check the buffer, as it now knows about canonical mode.
284          * Otherwise, if the driver is throttled and the line is
285          * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
286          * we won't get any more characters.
287          */
288
289         while (1) {
290                 int unthrottled;
291                 tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
292                 if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
293                         break;
294                 if (!tty->count)
295                         break;
296                 n_tty_set_room(tty);
297                 unthrottled = tty_unthrottle_safe(tty);
298                 if (!unthrottled)
299                         break;
300         }
301         __tty_set_flow_change(tty, 0);
302 }
303
304 /**
305  *      put_tty_queue           -       add character to tty
306  *      @c: character
307  *      @ldata: n_tty data
308  *
309  *      Add a character to the tty read_buf queue.
310  *
311  *      n_tty_receive_buf()/producer path:
312  *              caller holds non-exclusive termios_rwsem
313  *              modifies read_head
314  *
315  *      read_head is only considered 'published' if canonical mode is
316  *      not active.
317  */
318
319 static void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
320 {
321         if (read_cnt(ldata) < N_TTY_BUF_SIZE) {
322                 *read_buf_addr(ldata, ldata->read_head) = c;
323                 ldata->read_head++;
324         }
325 }
326
327 /**
328  *      reset_buffer_flags      -       reset buffer state
329  *      @tty: terminal to reset
330  *
331  *      Reset the read buffer counters and clear the flags.
332  *      Called from n_tty_open() and n_tty_flush_buffer().
333  *
334  *      Locking: caller holds exclusive termios_rwsem
335  *               (or locking is not required)
336  */
337
338 static void reset_buffer_flags(struct n_tty_data *ldata)
339 {
340         ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
341         ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
342         ldata->line_start = 0;
343
344         ldata->erasing = 0;
345         bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
346 }
347
348 static void n_tty_packet_mode_flush(struct tty_struct *tty)
349 {
350         unsigned long flags;
351
352         spin_lock_irqsave(&tty->ctrl_lock, flags);
353         if (tty->link->packet) {
354                 tty->ctrl_status |= TIOCPKT_FLUSHREAD;
355                 wake_up_interruptible(&tty->link->read_wait);
356         }
357         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
358 }
359
360 /**
361  *      n_tty_flush_buffer      -       clean input queue
362  *      @tty:   terminal device
363  *
364  *      Flush the input buffer. Called when the tty layer wants the
365  *      buffer flushed (eg at hangup) or when the N_TTY line discipline
366  *      internally has to clean the pending queue (for example some signals).
367  *
368  *      Holds termios_rwsem to exclude producer/consumer while
369  *      buffer indices are reset.
370  *
371  *      Locking: ctrl_lock, exclusive termios_rwsem
372  */
373
374 static void n_tty_flush_buffer(struct tty_struct *tty)
375 {
376         down_write(&tty->termios_rwsem);
377         reset_buffer_flags(tty->disc_data);
378         n_tty_set_room(tty);
379
380         if (tty->link)
381                 n_tty_packet_mode_flush(tty);
382         up_write(&tty->termios_rwsem);
383 }
384
385 /**
386  *      n_tty_chars_in_buffer   -       report available bytes
387  *      @tty: tty device
388  *
389  *      Report the number of characters buffered to be delivered to user
390  *      at this instant in time.
391  *
392  *      Locking: exclusive termios_rwsem
393  */
394
395 static ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
396 {
397         ssize_t n;
398
399         WARN_ONCE(1, "%s is deprecated and scheduled for removal.", __func__);
400
401         down_write(&tty->termios_rwsem);
402         n = chars_in_buffer(tty);
403         up_write(&tty->termios_rwsem);
404         return n;
405 }
406
407 /**
408  *      is_utf8_continuation    -       utf8 multibyte check
409  *      @c: byte to check
410  *
411  *      Returns true if the utf8 character 'c' is a multibyte continuation
412  *      character. We use this to correctly compute the on screen size
413  *      of the character when printing
414  */
415
416 static inline int is_utf8_continuation(unsigned char c)
417 {
418         return (c & 0xc0) == 0x80;
419 }
420
421 /**
422  *      is_continuation         -       multibyte check
423  *      @c: byte to check
424  *
425  *      Returns true if the utf8 character 'c' is a multibyte continuation
426  *      character and the terminal is in unicode mode.
427  */
428
429 static inline int is_continuation(unsigned char c, struct tty_struct *tty)
430 {
431         return I_IUTF8(tty) && is_utf8_continuation(c);
432 }
433
434 /**
435  *      do_output_char                  -       output one character
436  *      @c: character (or partial unicode symbol)
437  *      @tty: terminal device
438  *      @space: space available in tty driver write buffer
439  *
440  *      This is a helper function that handles one output character
441  *      (including special characters like TAB, CR, LF, etc.),
442  *      doing OPOST processing and putting the results in the
443  *      tty driver's write buffer.
444  *
445  *      Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY
446  *      and NLDLY.  They simply aren't relevant in the world today.
447  *      If you ever need them, add them here.
448  *
449  *      Returns the number of bytes of buffer space used or -1 if
450  *      no space left.
451  *
452  *      Locking: should be called under the output_lock to protect
453  *               the column state and space left in the buffer
454  */
455
456 static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
457 {
458         struct n_tty_data *ldata = tty->disc_data;
459         int     spaces;
460
461         if (!space)
462                 return -1;
463
464         switch (c) {
465         case '\n':
466                 if (O_ONLRET(tty))
467                         ldata->column = 0;
468                 if (O_ONLCR(tty)) {
469                         if (space < 2)
470                                 return -1;
471                         ldata->canon_column = ldata->column = 0;
472                         tty->ops->write(tty, "\r\n", 2);
473                         return 2;
474                 }
475                 ldata->canon_column = ldata->column;
476                 break;
477         case '\r':
478                 if (O_ONOCR(tty) && ldata->column == 0)
479                         return 0;
480                 if (O_OCRNL(tty)) {
481                         c = '\n';
482                         if (O_ONLRET(tty))
483                                 ldata->canon_column = ldata->column = 0;
484                         break;
485                 }
486                 ldata->canon_column = ldata->column = 0;
487                 break;
488         case '\t':
489                 spaces = 8 - (ldata->column & 7);
490                 if (O_TABDLY(tty) == XTABS) {
491                         if (space < spaces)
492                                 return -1;
493                         ldata->column += spaces;
494                         tty->ops->write(tty, "        ", spaces);
495                         return spaces;
496                 }
497                 ldata->column += spaces;
498                 break;
499         case '\b':
500                 if (ldata->column > 0)
501                         ldata->column--;
502                 break;
503         default:
504                 if (!iscntrl(c)) {
505                         if (O_OLCUC(tty))
506                                 c = toupper(c);
507                         if (!is_continuation(c, tty))
508                                 ldata->column++;
509                 }
510                 break;
511         }
512
513         tty_put_char(tty, c);
514         return 1;
515 }
516
517 /**
518  *      process_output                  -       output post processor
519  *      @c: character (or partial unicode symbol)
520  *      @tty: terminal device
521  *
522  *      Output one character with OPOST processing.
523  *      Returns -1 when the output device is full and the character
524  *      must be retried.
525  *
526  *      Locking: output_lock to protect column state and space left
527  *               (also, this is called from n_tty_write under the
528  *                tty layer write lock)
529  */
530
531 static int process_output(unsigned char c, struct tty_struct *tty)
532 {
533         struct n_tty_data *ldata = tty->disc_data;
534         int     space, retval;
535
536         mutex_lock(&ldata->output_lock);
537
538         space = tty_write_room(tty);
539         retval = do_output_char(c, tty, space);
540
541         mutex_unlock(&ldata->output_lock);
542         if (retval < 0)
543                 return -1;
544         else
545                 return 0;
546 }
547
548 /**
549  *      process_output_block            -       block post processor
550  *      @tty: terminal device
551  *      @buf: character buffer
552  *      @nr: number of bytes to output
553  *
554  *      Output a block of characters with OPOST processing.
555  *      Returns the number of characters output.
556  *
557  *      This path is used to speed up block console writes, among other
558  *      things when processing blocks of output data. It handles only
559  *      the simple cases normally found and helps to generate blocks of
560  *      symbols for the console driver and thus improve performance.
561  *
562  *      Locking: output_lock to protect column state and space left
563  *               (also, this is called from n_tty_write under the
564  *                tty layer write lock)
565  */
566
567 static ssize_t process_output_block(struct tty_struct *tty,
568                                     const unsigned char *buf, unsigned int nr)
569 {
570         struct n_tty_data *ldata = tty->disc_data;
571         int     space;
572         int     i;
573         const unsigned char *cp;
574
575         mutex_lock(&ldata->output_lock);
576
577         space = tty_write_room(tty);
578         if (!space) {
579                 mutex_unlock(&ldata->output_lock);
580                 return 0;
581         }
582         if (nr > space)
583                 nr = space;
584
585         for (i = 0, cp = buf; i < nr; i++, cp++) {
586                 unsigned char c = *cp;
587
588                 switch (c) {
589                 case '\n':
590                         if (O_ONLRET(tty))
591                                 ldata->column = 0;
592                         if (O_ONLCR(tty))
593                                 goto break_out;
594                         ldata->canon_column = ldata->column;
595                         break;
596                 case '\r':
597                         if (O_ONOCR(tty) && ldata->column == 0)
598                                 goto break_out;
599                         if (O_OCRNL(tty))
600                                 goto break_out;
601                         ldata->canon_column = ldata->column = 0;
602                         break;
603                 case '\t':
604                         goto break_out;
605                 case '\b':
606                         if (ldata->column > 0)
607                                 ldata->column--;
608                         break;
609                 default:
610                         if (!iscntrl(c)) {
611                                 if (O_OLCUC(tty))
612                                         goto break_out;
613                                 if (!is_continuation(c, tty))
614                                         ldata->column++;
615                         }
616                         break;
617                 }
618         }
619 break_out:
620         i = tty->ops->write(tty, buf, i);
621
622         mutex_unlock(&ldata->output_lock);
623         return i;
624 }
625
626 /**
627  *      process_echoes  -       write pending echo characters
628  *      @tty: terminal device
629  *
630  *      Write previously buffered echo (and other ldisc-generated)
631  *      characters to the tty.
632  *
633  *      Characters generated by the ldisc (including echoes) need to
634  *      be buffered because the driver's write buffer can fill during
635  *      heavy program output.  Echoing straight to the driver will
636  *      often fail under these conditions, causing lost characters and
637  *      resulting mismatches of ldisc state information.
638  *
639  *      Since the ldisc state must represent the characters actually sent
640  *      to the driver at the time of the write, operations like certain
641  *      changes in column state are also saved in the buffer and executed
642  *      here.
643  *
644  *      A circular fifo buffer is used so that the most recent characters
645  *      are prioritized.  Also, when control characters are echoed with a
646  *      prefixed "^", the pair is treated atomically and thus not separated.
647  *
648  *      Locking: callers must hold output_lock
649  */
650
651 static size_t __process_echoes(struct tty_struct *tty)
652 {
653         struct n_tty_data *ldata = tty->disc_data;
654         int     space, old_space;
655         size_t tail;
656         unsigned char c;
657
658         old_space = space = tty_write_room(tty);
659
660         tail = ldata->echo_tail;
661         while (ldata->echo_commit != tail) {
662                 c = echo_buf(ldata, tail);
663                 if (c == ECHO_OP_START) {
664                         unsigned char op;
665                         int no_space_left = 0;
666
667                         /*
668                          * If the buffer byte is the start of a multi-byte
669                          * operation, get the next byte, which is either the
670                          * op code or a control character value.
671                          */
672                         op = echo_buf(ldata, tail + 1);
673
674                         switch (op) {
675                                 unsigned int num_chars, num_bs;
676
677                         case ECHO_OP_ERASE_TAB:
678                                 num_chars = echo_buf(ldata, tail + 2);
679
680                                 /*
681                                  * Determine how many columns to go back
682                                  * in order to erase the tab.
683                                  * This depends on the number of columns
684                                  * used by other characters within the tab
685                                  * area.  If this (modulo 8) count is from
686                                  * the start of input rather than from a
687                                  * previous tab, we offset by canon column.
688                                  * Otherwise, tab spacing is normal.
689                                  */
690                                 if (!(num_chars & 0x80))
691                                         num_chars += ldata->canon_column;
692                                 num_bs = 8 - (num_chars & 7);
693
694                                 if (num_bs > space) {
695                                         no_space_left = 1;
696                                         break;
697                                 }
698                                 space -= num_bs;
699                                 while (num_bs--) {
700                                         tty_put_char(tty, '\b');
701                                         if (ldata->column > 0)
702                                                 ldata->column--;
703                                 }
704                                 tail += 3;
705                                 break;
706
707                         case ECHO_OP_SET_CANON_COL:
708                                 ldata->canon_column = ldata->column;
709                                 tail += 2;
710                                 break;
711
712                         case ECHO_OP_MOVE_BACK_COL:
713                                 if (ldata->column > 0)
714                                         ldata->column--;
715                                 tail += 2;
716                                 break;
717
718                         case ECHO_OP_START:
719                                 /* This is an escaped echo op start code */
720                                 if (!space) {
721                                         no_space_left = 1;
722                                         break;
723                                 }
724                                 tty_put_char(tty, ECHO_OP_START);
725                                 ldata->column++;
726                                 space--;
727                                 tail += 2;
728                                 break;
729
730                         default:
731                                 /*
732                                  * If the op is not a special byte code,
733                                  * it is a ctrl char tagged to be echoed
734                                  * as "^X" (where X is the letter
735                                  * representing the control char).
736                                  * Note that we must ensure there is
737                                  * enough space for the whole ctrl pair.
738                                  *
739                                  */
740                                 if (space < 2) {
741                                         no_space_left = 1;
742                                         break;
743                                 }
744                                 tty_put_char(tty, '^');
745                                 tty_put_char(tty, op ^ 0100);
746                                 ldata->column += 2;
747                                 space -= 2;
748                                 tail += 2;
749                         }
750
751                         if (no_space_left)
752                                 break;
753                 } else {
754                         if (O_OPOST(tty)) {
755                                 int retval = do_output_char(c, tty, space);
756                                 if (retval < 0)
757                                         break;
758                                 space -= retval;
759                         } else {
760                                 if (!space)
761                                         break;
762                                 tty_put_char(tty, c);
763                                 space -= 1;
764                         }
765                         tail += 1;
766                 }
767         }
768
769         /* If the echo buffer is nearly full (so that the possibility exists
770          * of echo overrun before the next commit), then discard enough
771          * data at the tail to prevent a subsequent overrun */
772         while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
773                 if (echo_buf(ldata, tail == ECHO_OP_START)) {
774                         if (echo_buf(ldata, tail) == ECHO_OP_ERASE_TAB)
775                                 tail += 3;
776                         else
777                                 tail += 2;
778                 } else
779                         tail++;
780         }
781
782         ldata->echo_tail = tail;
783         return old_space - space;
784 }
785
786 static void commit_echoes(struct tty_struct *tty)
787 {
788         struct n_tty_data *ldata = tty->disc_data;
789         size_t nr, old, echoed;
790         size_t head;
791
792         head = ldata->echo_head;
793         old = ldata->echo_commit - ldata->echo_tail;
794
795         /* Process committed echoes if the accumulated # of bytes
796          * is over the threshold (and try again each time another
797          * block is accumulated) */
798         nr = head - ldata->echo_tail;
799         if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK))
800                 return;
801
802         mutex_lock(&ldata->output_lock);
803         ldata->echo_commit = head;
804         echoed = __process_echoes(tty);
805         mutex_unlock(&ldata->output_lock);
806
807         if (echoed && tty->ops->flush_chars)
808                 tty->ops->flush_chars(tty);
809 }
810
811 static void process_echoes(struct tty_struct *tty)
812 {
813         struct n_tty_data *ldata = tty->disc_data;
814         size_t echoed;
815
816         if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_tail)
817                 return;
818
819         mutex_lock(&ldata->output_lock);
820         echoed = __process_echoes(tty);
821         mutex_unlock(&ldata->output_lock);
822
823         if (echoed && tty->ops->flush_chars)
824                 tty->ops->flush_chars(tty);
825 }
826
827 static void flush_echoes(struct tty_struct *tty)
828 {
829         struct n_tty_data *ldata = tty->disc_data;
830
831         if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_head)
832                 return;
833
834         mutex_lock(&ldata->output_lock);
835         ldata->echo_commit = ldata->echo_head;
836         __process_echoes(tty);
837         mutex_unlock(&ldata->output_lock);
838 }
839
840 /**
841  *      add_echo_byte   -       add a byte to the echo buffer
842  *      @c: unicode byte to echo
843  *      @ldata: n_tty data
844  *
845  *      Add a character or operation byte to the echo buffer.
846  */
847
848 static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
849 {
850         *echo_buf_addr(ldata, ldata->echo_head++) = c;
851 }
852
853 /**
854  *      echo_move_back_col      -       add operation to move back a column
855  *      @ldata: n_tty data
856  *
857  *      Add an operation to the echo buffer to move back one column.
858  */
859
860 static void echo_move_back_col(struct n_tty_data *ldata)
861 {
862         add_echo_byte(ECHO_OP_START, ldata);
863         add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
864 }
865
866 /**
867  *      echo_set_canon_col      -       add operation to set the canon column
868  *      @ldata: n_tty data
869  *
870  *      Add an operation to the echo buffer to set the canon column
871  *      to the current column.
872  */
873
874 static void echo_set_canon_col(struct n_tty_data *ldata)
875 {
876         add_echo_byte(ECHO_OP_START, ldata);
877         add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
878 }
879
880 /**
881  *      echo_erase_tab  -       add operation to erase a tab
882  *      @num_chars: number of character columns already used
883  *      @after_tab: true if num_chars starts after a previous tab
884  *      @ldata: n_tty data
885  *
886  *      Add an operation to the echo buffer to erase a tab.
887  *
888  *      Called by the eraser function, which knows how many character
889  *      columns have been used since either a previous tab or the start
890  *      of input.  This information will be used later, along with
891  *      canon column (if applicable), to go back the correct number
892  *      of columns.
893  */
894
895 static void echo_erase_tab(unsigned int num_chars, int after_tab,
896                            struct n_tty_data *ldata)
897 {
898         add_echo_byte(ECHO_OP_START, ldata);
899         add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
900
901         /* We only need to know this modulo 8 (tab spacing) */
902         num_chars &= 7;
903
904         /* Set the high bit as a flag if num_chars is after a previous tab */
905         if (after_tab)
906                 num_chars |= 0x80;
907
908         add_echo_byte(num_chars, ldata);
909 }
910
911 /**
912  *      echo_char_raw   -       echo a character raw
913  *      @c: unicode byte to echo
914  *      @tty: terminal device
915  *
916  *      Echo user input back onto the screen. This must be called only when
917  *      L_ECHO(tty) is true. Called from the driver receive_buf path.
918  *
919  *      This variant does not treat control characters specially.
920  */
921
922 static void echo_char_raw(unsigned char c, struct n_tty_data *ldata)
923 {
924         if (c == ECHO_OP_START) {
925                 add_echo_byte(ECHO_OP_START, ldata);
926                 add_echo_byte(ECHO_OP_START, ldata);
927         } else {
928                 add_echo_byte(c, ldata);
929         }
930 }
931
932 /**
933  *      echo_char       -       echo a character
934  *      @c: unicode byte to echo
935  *      @tty: terminal device
936  *
937  *      Echo user input back onto the screen. This must be called only when
938  *      L_ECHO(tty) is true. Called from the driver receive_buf path.
939  *
940  *      This variant tags control characters to be echoed as "^X"
941  *      (where X is the letter representing the control char).
942  */
943
944 static void echo_char(unsigned char c, struct tty_struct *tty)
945 {
946         struct n_tty_data *ldata = tty->disc_data;
947
948         if (c == ECHO_OP_START) {
949                 add_echo_byte(ECHO_OP_START, ldata);
950                 add_echo_byte(ECHO_OP_START, ldata);
951         } else {
952                 if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
953                         add_echo_byte(ECHO_OP_START, ldata);
954                 add_echo_byte(c, ldata);
955         }
956 }
957
958 /**
959  *      finish_erasing          -       complete erase
960  *      @ldata: n_tty data
961  */
962
963 static inline void finish_erasing(struct n_tty_data *ldata)
964 {
965         if (ldata->erasing) {
966                 echo_char_raw('/', ldata);
967                 ldata->erasing = 0;
968         }
969 }
970
971 /**
972  *      eraser          -       handle erase function
973  *      @c: character input
974  *      @tty: terminal device
975  *
976  *      Perform erase and necessary output when an erase character is
977  *      present in the stream from the driver layer. Handles the complexities
978  *      of UTF-8 multibyte symbols.
979  *
980  *      n_tty_receive_buf()/producer path:
981  *              caller holds non-exclusive termios_rwsem
982  *              modifies read_head
983  *
984  *      Modifying the read_head is not considered a publish in this context
985  *      because canonical mode is active -- only canon_head publishes
986  */
987
988 static void eraser(unsigned char c, struct tty_struct *tty)
989 {
990         struct n_tty_data *ldata = tty->disc_data;
991         enum { ERASE, WERASE, KILL } kill_type;
992         size_t head;
993         size_t cnt;
994         int seen_alnums;
995
996         if (ldata->read_head == ldata->canon_head) {
997                 /* process_output('\a', tty); */ /* what do you think? */
998                 return;
999         }
1000         if (c == ERASE_CHAR(tty))
1001                 kill_type = ERASE;
1002         else if (c == WERASE_CHAR(tty))
1003                 kill_type = WERASE;
1004         else {
1005                 if (!L_ECHO(tty)) {
1006                         ldata->read_head = ldata->canon_head;
1007                         return;
1008                 }
1009                 if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
1010                         ldata->read_head = ldata->canon_head;
1011                         finish_erasing(ldata);
1012                         echo_char(KILL_CHAR(tty), tty);
1013                         /* Add a newline if ECHOK is on and ECHOKE is off. */
1014                         if (L_ECHOK(tty))
1015                                 echo_char_raw('\n', ldata);
1016                         return;
1017                 }
1018                 kill_type = KILL;
1019         }
1020
1021         seen_alnums = 0;
1022         while (ldata->read_head != ldata->canon_head) {
1023                 head = ldata->read_head;
1024
1025                 /* erase a single possibly multibyte character */
1026                 do {
1027                         head--;
1028                         c = read_buf(ldata, head);
1029                 } while (is_continuation(c, tty) && head != ldata->canon_head);
1030
1031                 /* do not partially erase */
1032                 if (is_continuation(c, tty))
1033                         break;
1034
1035                 if (kill_type == WERASE) {
1036                         /* Equivalent to BSD's ALTWERASE. */
1037                         if (isalnum(c) || c == '_')
1038                                 seen_alnums++;
1039                         else if (seen_alnums)
1040                                 break;
1041                 }
1042                 cnt = ldata->read_head - head;
1043                 ldata->read_head = head;
1044                 if (L_ECHO(tty)) {
1045                         if (L_ECHOPRT(tty)) {
1046                                 if (!ldata->erasing) {
1047                                         echo_char_raw('\\', ldata);
1048                                         ldata->erasing = 1;
1049                                 }
1050                                 /* if cnt > 1, output a multi-byte character */
1051                                 echo_char(c, tty);
1052                                 while (--cnt > 0) {
1053                                         head++;
1054                                         echo_char_raw(read_buf(ldata, head), ldata);
1055                                         echo_move_back_col(ldata);
1056                                 }
1057                         } else if (kill_type == ERASE && !L_ECHOE(tty)) {
1058                                 echo_char(ERASE_CHAR(tty), tty);
1059                         } else if (c == '\t') {
1060                                 unsigned int num_chars = 0;
1061                                 int after_tab = 0;
1062                                 size_t tail = ldata->read_head;
1063
1064                                 /*
1065                                  * Count the columns used for characters
1066                                  * since the start of input or after a
1067                                  * previous tab.
1068                                  * This info is used to go back the correct
1069                                  * number of columns.
1070                                  */
1071                                 while (tail != ldata->canon_head) {
1072                                         tail--;
1073                                         c = read_buf(ldata, tail);
1074                                         if (c == '\t') {
1075                                                 after_tab = 1;
1076                                                 break;
1077                                         } else if (iscntrl(c)) {
1078                                                 if (L_ECHOCTL(tty))
1079                                                         num_chars += 2;
1080                                         } else if (!is_continuation(c, tty)) {
1081                                                 num_chars++;
1082                                         }
1083                                 }
1084                                 echo_erase_tab(num_chars, after_tab, ldata);
1085                         } else {
1086                                 if (iscntrl(c) && L_ECHOCTL(tty)) {
1087                                         echo_char_raw('\b', ldata);
1088                                         echo_char_raw(' ', ldata);
1089                                         echo_char_raw('\b', ldata);
1090                                 }
1091                                 if (!iscntrl(c) || L_ECHOCTL(tty)) {
1092                                         echo_char_raw('\b', ldata);
1093                                         echo_char_raw(' ', ldata);
1094                                         echo_char_raw('\b', ldata);
1095                                 }
1096                         }
1097                 }
1098                 if (kill_type == ERASE)
1099                         break;
1100         }
1101         if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
1102                 finish_erasing(ldata);
1103 }
1104
1105 /**
1106  *      isig            -       handle the ISIG optio
1107  *      @sig: signal
1108  *      @tty: terminal
1109  *
1110  *      Called when a signal is being sent due to terminal input.
1111  *      Called from the driver receive_buf path so serialized.
1112  *
1113  *      Locking: ctrl_lock
1114  */
1115
1116 static inline void isig(int sig, struct tty_struct *tty)
1117 {
1118         struct pid *tty_pgrp = tty_get_pgrp(tty);
1119         if (tty_pgrp) {
1120                 kill_pgrp(tty_pgrp, sig, 1);
1121                 put_pid(tty_pgrp);
1122         }
1123 }
1124
1125 /**
1126  *      n_tty_receive_break     -       handle break
1127  *      @tty: terminal
1128  *
1129  *      An RS232 break event has been hit in the incoming bitstream. This
1130  *      can cause a variety of events depending upon the termios settings.
1131  *
1132  *      n_tty_receive_buf()/producer path:
1133  *              caller holds non-exclusive termios_rwsem
1134  *              publishes read_head via put_tty_queue()
1135  *
1136  *      Note: may get exclusive termios_rwsem if flushing input buffer
1137  */
1138
1139 static inline void n_tty_receive_break(struct tty_struct *tty)
1140 {
1141         struct n_tty_data *ldata = tty->disc_data;
1142
1143         if (I_IGNBRK(tty))
1144                 return;
1145         if (I_BRKINT(tty)) {
1146                 isig(SIGINT, tty);
1147                 if (!L_NOFLSH(tty)) {
1148                         /* flushing needs exclusive termios_rwsem */
1149                         up_read(&tty->termios_rwsem);
1150                         n_tty_flush_buffer(tty);
1151                         tty_driver_flush_buffer(tty);
1152                         down_read(&tty->termios_rwsem);
1153                 }
1154                 return;
1155         }
1156         if (I_PARMRK(tty)) {
1157                 put_tty_queue('\377', ldata);
1158                 put_tty_queue('\0', ldata);
1159         }
1160         put_tty_queue('\0', ldata);
1161         wake_up_interruptible(&tty->read_wait);
1162 }
1163
1164 /**
1165  *      n_tty_receive_overrun   -       handle overrun reporting
1166  *      @tty: terminal
1167  *
1168  *      Data arrived faster than we could process it. While the tty
1169  *      driver has flagged this the bits that were missed are gone
1170  *      forever.
1171  *
1172  *      Called from the receive_buf path so single threaded. Does not
1173  *      need locking as num_overrun and overrun_time are function
1174  *      private.
1175  */
1176
1177 static inline void n_tty_receive_overrun(struct tty_struct *tty)
1178 {
1179         struct n_tty_data *ldata = tty->disc_data;
1180         char buf[64];
1181
1182         ldata->num_overrun++;
1183         if (time_after(jiffies, ldata->overrun_time + HZ) ||
1184                         time_after(ldata->overrun_time, jiffies)) {
1185                 printk(KERN_WARNING "%s: %d input overrun(s)\n",
1186                         tty_name(tty, buf),
1187                         ldata->num_overrun);
1188                 ldata->overrun_time = jiffies;
1189                 ldata->num_overrun = 0;
1190         }
1191 }
1192
1193 /**
1194  *      n_tty_receive_parity_error      -       error notifier
1195  *      @tty: terminal device
1196  *      @c: character
1197  *
1198  *      Process a parity error and queue the right data to indicate
1199  *      the error case if necessary.
1200  *
1201  *      n_tty_receive_buf()/producer path:
1202  *              caller holds non-exclusive termios_rwsem
1203  *              publishes read_head via put_tty_queue()
1204  */
1205 static inline void n_tty_receive_parity_error(struct tty_struct *tty,
1206                                               unsigned char c)
1207 {
1208         struct n_tty_data *ldata = tty->disc_data;
1209
1210         if (I_IGNPAR(tty))
1211                 return;
1212         if (I_PARMRK(tty)) {
1213                 put_tty_queue('\377', ldata);
1214                 put_tty_queue('\0', ldata);
1215                 put_tty_queue(c, ldata);
1216         } else  if (I_INPCK(tty))
1217                 put_tty_queue('\0', ldata);
1218         else
1219                 put_tty_queue(c, ldata);
1220         wake_up_interruptible(&tty->read_wait);
1221 }
1222
1223 static void
1224 n_tty_receive_signal_char(struct tty_struct *tty, int signal, unsigned char c)
1225 {
1226         if (!L_NOFLSH(tty)) {
1227                 /* flushing needs exclusive termios_rwsem */
1228                 up_read(&tty->termios_rwsem);
1229                 n_tty_flush_buffer(tty);
1230                 tty_driver_flush_buffer(tty);
1231                 down_read(&tty->termios_rwsem);
1232         }
1233         if (I_IXON(tty))
1234                 start_tty(tty);
1235         if (L_ECHO(tty)) {
1236                 echo_char(c, tty);
1237                 commit_echoes(tty);
1238         }
1239         isig(signal, tty);
1240         return;
1241 }
1242
1243 /**
1244  *      n_tty_receive_char      -       perform processing
1245  *      @tty: terminal device
1246  *      @c: character
1247  *
1248  *      Process an individual character of input received from the driver.
1249  *      This is serialized with respect to itself by the rules for the
1250  *      driver above.
1251  *
1252  *      n_tty_receive_buf()/producer path:
1253  *              caller holds non-exclusive termios_rwsem
1254  *              publishes canon_head if canonical mode is active
1255  *              otherwise, publishes read_head via put_tty_queue()
1256  */
1257
1258 static void
1259 n_tty_receive_char_special(struct tty_struct *tty, unsigned char c)
1260 {
1261         struct n_tty_data *ldata = tty->disc_data;
1262         int parmrk;
1263
1264         if (I_IXON(tty)) {
1265                 if (c == START_CHAR(tty)) {
1266                         start_tty(tty);
1267                         commit_echoes(tty);
1268                         return;
1269                 }
1270                 if (c == STOP_CHAR(tty)) {
1271                         stop_tty(tty);
1272                         return;
1273                 }
1274         }
1275
1276         if (L_ISIG(tty)) {
1277                 if (c == INTR_CHAR(tty)) {
1278                         n_tty_receive_signal_char(tty, SIGINT, c);
1279                         return;
1280                 } else if (c == QUIT_CHAR(tty)) {
1281                         n_tty_receive_signal_char(tty, SIGQUIT, c);
1282                         return;
1283                 } else if (c == SUSP_CHAR(tty)) {
1284                         n_tty_receive_signal_char(tty, SIGTSTP, c);
1285                         return;
1286                 }
1287         }
1288
1289         if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1290                 start_tty(tty);
1291                 process_echoes(tty);
1292         }
1293
1294         if (c == '\r') {
1295                 if (I_IGNCR(tty))
1296                         return;
1297                 if (I_ICRNL(tty))
1298                         c = '\n';
1299         } else if (c == '\n' && I_INLCR(tty))
1300                 c = '\r';
1301
1302         if (ldata->icanon) {
1303                 if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
1304                     (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
1305                         eraser(c, tty);
1306                         commit_echoes(tty);
1307                         return;
1308                 }
1309                 if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
1310                         ldata->lnext = 1;
1311                         if (L_ECHO(tty)) {
1312                                 finish_erasing(ldata);
1313                                 if (L_ECHOCTL(tty)) {
1314                                         echo_char_raw('^', ldata);
1315                                         echo_char_raw('\b', ldata);
1316                                         commit_echoes(tty);
1317                                 }
1318                         }
1319                         return;
1320                 }
1321                 if (c == REPRINT_CHAR(tty) && L_ECHO(tty) &&
1322                     L_IEXTEN(tty)) {
1323                         size_t tail = ldata->canon_head;
1324
1325                         finish_erasing(ldata);
1326                         echo_char(c, tty);
1327                         echo_char_raw('\n', ldata);
1328                         while (tail != ldata->read_head) {
1329                                 echo_char(read_buf(ldata, tail), tty);
1330                                 tail++;
1331                         }
1332                         commit_echoes(tty);
1333                         return;
1334                 }
1335                 if (c == '\n') {
1336                         if (read_cnt(ldata) >= N_TTY_BUF_SIZE) {
1337                                 if (L_ECHO(tty))
1338                                         process_output('\a', tty);
1339                                 return;
1340                         }
1341                         if (L_ECHO(tty) || L_ECHONL(tty)) {
1342                                 echo_char_raw('\n', ldata);
1343                                 commit_echoes(tty);
1344                         }
1345                         goto handle_newline;
1346                 }
1347                 if (c == EOF_CHAR(tty)) {
1348                         if (read_cnt(ldata) >= N_TTY_BUF_SIZE)
1349                                 return;
1350                         c = __DISABLED_CHAR;
1351                         goto handle_newline;
1352                 }
1353                 if ((c == EOL_CHAR(tty)) ||
1354                     (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
1355                         parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty))
1356                                  ? 1 : 0;
1357                         if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk)) {
1358                                 if (L_ECHO(tty))
1359                                         process_output('\a', tty);
1360                                 return;
1361                         }
1362                         /*
1363                          * XXX are EOL_CHAR and EOL2_CHAR echoed?!?
1364                          */
1365                         if (L_ECHO(tty)) {
1366                                 /* Record the column of first canon char. */
1367                                 if (ldata->canon_head == ldata->read_head)
1368                                         echo_set_canon_col(ldata);
1369                                 echo_char(c, tty);
1370                                 commit_echoes(tty);
1371                         }
1372                         /*
1373                          * XXX does PARMRK doubling happen for
1374                          * EOL_CHAR and EOL2_CHAR?
1375                          */
1376                         if (parmrk)
1377                                 put_tty_queue(c, ldata);
1378
1379 handle_newline:
1380                         set_bit(ldata->read_head & (N_TTY_BUF_SIZE - 1), ldata->read_flags);
1381                         put_tty_queue(c, ldata);
1382                         ldata->canon_head = ldata->read_head;
1383                         kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1384                         if (waitqueue_active(&tty->read_wait))
1385                                 wake_up_interruptible(&tty->read_wait);
1386                         return;
1387                 }
1388         }
1389
1390         parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
1391         if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk - 1)) {
1392                 /* beep if no space */
1393                 if (L_ECHO(tty))
1394                         process_output('\a', tty);
1395                 return;
1396         }
1397         if (L_ECHO(tty)) {
1398                 finish_erasing(ldata);
1399                 if (c == '\n')
1400                         echo_char_raw('\n', ldata);
1401                 else {
1402                         /* Record the column of first canon char. */
1403                         if (ldata->canon_head == ldata->read_head)
1404                                 echo_set_canon_col(ldata);
1405                         echo_char(c, tty);
1406                 }
1407                 commit_echoes(tty);
1408         }
1409
1410         if (parmrk)
1411                 put_tty_queue(c, ldata);
1412
1413         put_tty_queue(c, ldata);
1414 }
1415
1416 static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
1417 {
1418         struct n_tty_data *ldata = tty->disc_data;
1419         int parmrk;
1420
1421         if (I_ISTRIP(tty))
1422                 c &= 0x7f;
1423         if (I_IUCLC(tty) && L_IEXTEN(tty))
1424                 c = tolower(c);
1425
1426         if (L_EXTPROC(tty)) {
1427                 put_tty_queue(c, ldata);
1428                 return;
1429         }
1430
1431         /*
1432          * If the previous character was LNEXT, or we know that this
1433          * character is not one of the characters that we'll have to
1434          * handle specially, do shortcut processing to speed things
1435          * up.
1436          */
1437         if (!test_bit(c, ldata->char_map) || ldata->lnext) {
1438                 ldata->lnext = 0;
1439
1440                 if (tty->stopped && !tty->flow_stopped && I_IXON(tty) &&
1441                     I_IXANY(tty)) {
1442                         start_tty(tty);
1443                         process_echoes(tty);
1444                 }
1445
1446                 parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
1447                 if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk - 1)) {
1448                         /* beep if no space */
1449                         if (L_ECHO(tty))
1450                                 process_output('\a', tty);
1451                         return;
1452                 }
1453                 if (L_ECHO(tty)) {
1454                         finish_erasing(ldata);
1455                         /* Record the column of first canon char. */
1456                         if (ldata->canon_head == ldata->read_head)
1457                                 echo_set_canon_col(ldata);
1458                         echo_char(c, tty);
1459                         commit_echoes(tty);
1460                 }
1461                 if (parmrk)
1462                         put_tty_queue(c, ldata);
1463                 put_tty_queue(c, ldata);
1464                 return;
1465         }
1466
1467         n_tty_receive_char_special(tty, c);
1468 }
1469
1470 static inline void
1471 n_tty_receive_char_closing(struct tty_struct *tty, unsigned char c)
1472 {
1473         if (I_ISTRIP(tty))
1474                 c &= 0x7f;
1475         if (I_IUCLC(tty) && L_IEXTEN(tty))
1476                 c = tolower(c);
1477
1478         if (I_IXON(tty)) {
1479                 if (c == STOP_CHAR(tty))
1480                         stop_tty(tty);
1481                 else if (c == START_CHAR(tty) ||
1482                          (tty->stopped && !tty->flow_stopped && I_IXANY(tty) &&
1483                           c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) &&
1484                           c != SUSP_CHAR(tty))) {
1485                         start_tty(tty);
1486                         process_echoes(tty);
1487                 }
1488         }
1489 }
1490
1491 static void
1492 n_tty_receive_char_flagged(struct tty_struct *tty, unsigned char c, char flag)
1493 {
1494         char buf[64];
1495
1496         switch (flag) {
1497         case TTY_BREAK:
1498                 n_tty_receive_break(tty);
1499                 break;
1500         case TTY_PARITY:
1501         case TTY_FRAME:
1502                 n_tty_receive_parity_error(tty, c);
1503                 break;
1504         case TTY_OVERRUN:
1505                 n_tty_receive_overrun(tty);
1506                 break;
1507         default:
1508                 printk(KERN_ERR "%s: unknown flag %d\n",
1509                        tty_name(tty, buf), flag);
1510                 break;
1511         }
1512 }
1513
1514 /**
1515  *      n_tty_receive_buf       -       data receive
1516  *      @tty: terminal device
1517  *      @cp: buffer
1518  *      @fp: flag buffer
1519  *      @count: characters
1520  *
1521  *      Called by the terminal driver when a block of characters has
1522  *      been received. This function must be called from soft contexts
1523  *      not from interrupt context. The driver is responsible for making
1524  *      calls one at a time and in order (or using flush_to_ldisc)
1525  *
1526  *      n_tty_receive_buf()/producer path:
1527  *              claims non-exclusive termios_rwsem
1528  *              publishes read_head and canon_head
1529  */
1530
1531 static void
1532 n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
1533                            char *fp, int count)
1534 {
1535         struct n_tty_data *ldata = tty->disc_data;
1536         size_t n, head;
1537
1538         head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1539         n = N_TTY_BUF_SIZE - max(read_cnt(ldata), head);
1540         n = min_t(size_t, count, n);
1541         memcpy(read_buf_addr(ldata, head), cp, n);
1542         ldata->read_head += n;
1543         cp += n;
1544         count -= n;
1545
1546         head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1547         n = N_TTY_BUF_SIZE - max(read_cnt(ldata), head);
1548         n = min_t(size_t, count, n);
1549         memcpy(read_buf_addr(ldata, head), cp, n);
1550         ldata->read_head += n;
1551 }
1552
1553 static void
1554 n_tty_receive_buf_raw(struct tty_struct *tty, const unsigned char *cp,
1555                       char *fp, int count)
1556 {
1557         struct n_tty_data *ldata = tty->disc_data;
1558         char flag = TTY_NORMAL;
1559
1560         while (count--) {
1561                 if (fp)
1562                         flag = *fp++;
1563                 if (likely(flag == TTY_NORMAL))
1564                         put_tty_queue(*cp++, ldata);
1565                 else
1566                         n_tty_receive_char_flagged(tty, *cp++, flag);
1567         }
1568 }
1569
1570 static void
1571 n_tty_receive_buf_closing(struct tty_struct *tty, const unsigned char *cp,
1572                           char *fp, int count)
1573 {
1574         char flag = TTY_NORMAL;
1575
1576         while (count--) {
1577                 if (fp)
1578                         flag = *fp++;
1579                 if (likely(flag == TTY_NORMAL))
1580                         n_tty_receive_char_closing(tty, *cp++);
1581                 else
1582                         n_tty_receive_char_flagged(tty, *cp++, flag);
1583         }
1584 }
1585
1586 static void
1587 n_tty_receive_buf_standard(struct tty_struct *tty, const unsigned char *cp,
1588                            char *fp, int count)
1589 {
1590         char flag = TTY_NORMAL;
1591
1592         while (count--) {
1593                 if (fp)
1594                         flag = *fp++;
1595                 if (likely(flag == TTY_NORMAL))
1596                         n_tty_receive_char(tty, *cp++);
1597                 else
1598                         n_tty_receive_char_flagged(tty, *cp++, flag);
1599         }
1600 }
1601
1602 static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
1603                           char *fp, int count)
1604 {
1605         struct n_tty_data *ldata = tty->disc_data;
1606         bool preops = I_ISTRIP(tty) || (I_IUCLC(tty) && L_IEXTEN(tty));
1607
1608         if (ldata->real_raw)
1609                 n_tty_receive_buf_real_raw(tty, cp, fp, count);
1610         else if (ldata->raw || (L_EXTPROC(tty) && !preops))
1611                 n_tty_receive_buf_raw(tty, cp, fp, count);
1612         else if (tty->closing && !L_EXTPROC(tty))
1613                 n_tty_receive_buf_closing(tty, cp, fp, count);
1614         else {
1615                 n_tty_receive_buf_standard(tty, cp, fp, count);
1616
1617                 flush_echoes(tty);
1618                 if (tty->ops->flush_chars)
1619                         tty->ops->flush_chars(tty);
1620         }
1621
1622         if ((!ldata->icanon && (read_cnt(ldata) >= ldata->minimum_to_wake)) ||
1623                 L_EXTPROC(tty)) {
1624                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1625                 if (waitqueue_active(&tty->read_wait))
1626                         wake_up_interruptible(&tty->read_wait);
1627         }
1628 }
1629
1630 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
1631                               char *fp, int count)
1632 {
1633         down_read(&tty->termios_rwsem);
1634         __receive_buf(tty, cp, fp, count);
1635         n_tty_check_throttle(tty);
1636         up_read(&tty->termios_rwsem);
1637 }
1638
1639 static int n_tty_receive_buf2(struct tty_struct *tty, const unsigned char *cp,
1640                               char *fp, int count)
1641 {
1642         struct n_tty_data *ldata = tty->disc_data;
1643         int room;
1644
1645         down_read(&tty->termios_rwsem);
1646
1647         tty->receive_room = room = receive_room(tty);
1648         if (!room)
1649                 ldata->no_room = 1;
1650         count = min(count, room);
1651         if (count) {
1652                 __receive_buf(tty, cp, fp, count);
1653                 n_tty_check_throttle(tty);
1654         }
1655
1656         up_read(&tty->termios_rwsem);
1657
1658         return count;
1659 }
1660
1661 int is_ignored(int sig)
1662 {
1663         return (sigismember(&current->blocked, sig) ||
1664                 current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
1665 }
1666
1667 /**
1668  *      n_tty_set_termios       -       termios data changed
1669  *      @tty: terminal
1670  *      @old: previous data
1671  *
1672  *      Called by the tty layer when the user changes termios flags so
1673  *      that the line discipline can plan ahead. This function cannot sleep
1674  *      and is protected from re-entry by the tty layer. The user is
1675  *      guaranteed that this function will not be re-entered or in progress
1676  *      when the ldisc is closed.
1677  *
1678  *      Locking: Caller holds tty->termios_rwsem
1679  */
1680
1681 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
1682 {
1683         struct n_tty_data *ldata = tty->disc_data;
1684         int canon_change = 1;
1685
1686         if (old)
1687                 canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
1688         if (canon_change) {
1689                 bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
1690                 ldata->line_start = 0;
1691                 ldata->canon_head = ldata->read_tail;
1692                 ldata->erasing = 0;
1693                 ldata->lnext = 0;
1694         }
1695
1696         if (canon_change && !L_ICANON(tty) && read_cnt(ldata))
1697                 wake_up_interruptible(&tty->read_wait);
1698
1699         ldata->icanon = (L_ICANON(tty) != 0);
1700
1701         if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
1702             I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
1703             I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
1704             I_PARMRK(tty)) {
1705                 bitmap_zero(ldata->char_map, 256);
1706
1707                 if (I_IGNCR(tty) || I_ICRNL(tty))
1708                         set_bit('\r', ldata->char_map);
1709                 if (I_INLCR(tty))
1710                         set_bit('\n', ldata->char_map);
1711
1712                 if (L_ICANON(tty)) {
1713                         set_bit(ERASE_CHAR(tty), ldata->char_map);
1714                         set_bit(KILL_CHAR(tty), ldata->char_map);
1715                         set_bit(EOF_CHAR(tty), ldata->char_map);
1716                         set_bit('\n', ldata->char_map);
1717                         set_bit(EOL_CHAR(tty), ldata->char_map);
1718                         if (L_IEXTEN(tty)) {
1719                                 set_bit(WERASE_CHAR(tty), ldata->char_map);
1720                                 set_bit(LNEXT_CHAR(tty), ldata->char_map);
1721                                 set_bit(EOL2_CHAR(tty), ldata->char_map);
1722                                 if (L_ECHO(tty))
1723                                         set_bit(REPRINT_CHAR(tty),
1724                                                 ldata->char_map);
1725                         }
1726                 }
1727                 if (I_IXON(tty)) {
1728                         set_bit(START_CHAR(tty), ldata->char_map);
1729                         set_bit(STOP_CHAR(tty), ldata->char_map);
1730                 }
1731                 if (L_ISIG(tty)) {
1732                         set_bit(INTR_CHAR(tty), ldata->char_map);
1733                         set_bit(QUIT_CHAR(tty), ldata->char_map);
1734                         set_bit(SUSP_CHAR(tty), ldata->char_map);
1735                 }
1736                 clear_bit(__DISABLED_CHAR, ldata->char_map);
1737                 ldata->raw = 0;
1738                 ldata->real_raw = 0;
1739         } else {
1740                 ldata->raw = 1;
1741                 if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1742                     (I_IGNPAR(tty) || !I_INPCK(tty)) &&
1743                     (tty->driver->flags & TTY_DRIVER_REAL_RAW))
1744                         ldata->real_raw = 1;
1745                 else
1746                         ldata->real_raw = 0;
1747         }
1748         n_tty_set_room(tty);
1749         /*
1750          * Fix tty hang when I_IXON(tty) is cleared, but the tty
1751          * been stopped by STOP_CHAR(tty) before it.
1752          */
1753         if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) {
1754                 start_tty(tty);
1755         }
1756
1757         /* The termios change make the tty ready for I/O */
1758         wake_up_interruptible(&tty->write_wait);
1759         wake_up_interruptible(&tty->read_wait);
1760 }
1761
1762 /**
1763  *      n_tty_close             -       close the ldisc for this tty
1764  *      @tty: device
1765  *
1766  *      Called from the terminal layer when this line discipline is
1767  *      being shut down, either because of a close or becsuse of a
1768  *      discipline change. The function will not be called while other
1769  *      ldisc methods are in progress.
1770  */
1771
1772 static void n_tty_close(struct tty_struct *tty)
1773 {
1774         struct n_tty_data *ldata = tty->disc_data;
1775
1776         if (tty->link)
1777                 n_tty_packet_mode_flush(tty);
1778
1779         vfree(ldata);
1780         tty->disc_data = NULL;
1781 }
1782
1783 /**
1784  *      n_tty_open              -       open an ldisc
1785  *      @tty: terminal to open
1786  *
1787  *      Called when this line discipline is being attached to the
1788  *      terminal device. Can sleep. Called serialized so that no
1789  *      other events will occur in parallel. No further open will occur
1790  *      until a close.
1791  */
1792
1793 static int n_tty_open(struct tty_struct *tty)
1794 {
1795         struct n_tty_data *ldata;
1796
1797         /* Currently a malloc failure here can panic */
1798         ldata = vmalloc(sizeof(*ldata));
1799         if (!ldata)
1800                 goto err;
1801
1802         ldata->overrun_time = jiffies;
1803         mutex_init(&ldata->atomic_read_lock);
1804         mutex_init(&ldata->output_lock);
1805
1806         tty->disc_data = ldata;
1807         reset_buffer_flags(tty->disc_data);
1808         ldata->column = 0;
1809         ldata->canon_column = 0;
1810         ldata->minimum_to_wake = 1;
1811         ldata->num_overrun = 0;
1812         ldata->no_room = 0;
1813         ldata->lnext = 0;
1814         tty->closing = 0;
1815         /* indicate buffer work may resume */
1816         clear_bit(TTY_LDISC_HALTED, &tty->flags);
1817         n_tty_set_termios(tty, NULL);
1818         tty_unthrottle(tty);
1819
1820         return 0;
1821 err:
1822         return -ENOMEM;
1823 }
1824
1825 static inline int input_available_p(struct tty_struct *tty, int amt)
1826 {
1827         struct n_tty_data *ldata = tty->disc_data;
1828
1829         if (ldata->icanon && !L_EXTPROC(tty)) {
1830                 if (ldata->canon_head != ldata->read_tail)
1831                         return 1;
1832         } else if (read_cnt(ldata) >= (amt ? amt : 1))
1833                 return 1;
1834
1835         return 0;
1836 }
1837
1838 /**
1839  *      copy_from_read_buf      -       copy read data directly
1840  *      @tty: terminal device
1841  *      @b: user data
1842  *      @nr: size of data
1843  *
1844  *      Helper function to speed up n_tty_read.  It is only called when
1845  *      ICANON is off; it copies characters straight from the tty queue to
1846  *      user space directly.  It can be profitably called twice; once to
1847  *      drain the space from the tail pointer to the (physical) end of the
1848  *      buffer, and once to drain the space from the (physical) beginning of
1849  *      the buffer to head pointer.
1850  *
1851  *      Called under the ldata->atomic_read_lock sem
1852  *
1853  *      n_tty_read()/consumer path:
1854  *              caller holds non-exclusive termios_rwsem
1855  *              read_tail published
1856  */
1857
1858 static int copy_from_read_buf(struct tty_struct *tty,
1859                                       unsigned char __user **b,
1860                                       size_t *nr)
1861
1862 {
1863         struct n_tty_data *ldata = tty->disc_data;
1864         int retval;
1865         size_t n;
1866         bool is_eof;
1867         size_t tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1868
1869         retval = 0;
1870         n = min(read_cnt(ldata), N_TTY_BUF_SIZE - tail);
1871         n = min(*nr, n);
1872         if (n) {
1873                 retval = copy_to_user(*b, read_buf_addr(ldata, tail), n);
1874                 n -= retval;
1875                 is_eof = n == 1 && read_buf(ldata, tail) == EOF_CHAR(tty);
1876                 tty_audit_add_data(tty, read_buf_addr(ldata, tail), n,
1877                                 ldata->icanon);
1878                 ldata->read_tail += n;
1879                 /* Turn single EOF into zero-length read */
1880                 if (L_EXTPROC(tty) && ldata->icanon && is_eof && !read_cnt(ldata))
1881                         n = 0;
1882                 *b += n;
1883                 *nr -= n;
1884         }
1885         return retval;
1886 }
1887
1888 /**
1889  *      canon_copy_from_read_buf        -       copy read data in canonical mode
1890  *      @tty: terminal device
1891  *      @b: user data
1892  *      @nr: size of data
1893  *
1894  *      Helper function for n_tty_read.  It is only called when ICANON is on;
1895  *      it copies one line of input up to and including the line-delimiting
1896  *      character into the user-space buffer.
1897  *
1898  *      Called under the atomic_read_lock mutex
1899  *
1900  *      n_tty_read()/consumer path:
1901  *              caller holds non-exclusive termios_rwsem
1902  *              read_tail published
1903  */
1904
1905 static int canon_copy_from_read_buf(struct tty_struct *tty,
1906                                     unsigned char __user **b,
1907                                     size_t *nr)
1908 {
1909         struct n_tty_data *ldata = tty->disc_data;
1910         size_t n, size, more, c;
1911         size_t eol;
1912         size_t tail;
1913         int ret, found = 0;
1914         bool eof_push = 0;
1915
1916         /* N.B. avoid overrun if nr == 0 */
1917         n = min(*nr, read_cnt(ldata));
1918         if (!n)
1919                 return 0;
1920
1921         tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1922         size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
1923
1924         n_tty_trace("%s: nr:%zu tail:%zu n:%zu size:%zu\n",
1925                     __func__, *nr, tail, n, size);
1926
1927         eol = find_next_bit(ldata->read_flags, size, tail);
1928         more = n - (size - tail);
1929         if (eol == N_TTY_BUF_SIZE && more) {
1930                 /* scan wrapped without finding set bit */
1931                 eol = find_next_bit(ldata->read_flags, more, 0);
1932                 if (eol != more)
1933                         found = 1;
1934         } else if (eol != size)
1935                 found = 1;
1936
1937         size = N_TTY_BUF_SIZE - tail;
1938         n = (found + eol + size) & (N_TTY_BUF_SIZE - 1);
1939         c = n;
1940
1941         if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
1942                 n--;
1943                 eof_push = !n && ldata->read_tail != ldata->line_start;
1944         }
1945
1946         n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
1947                     __func__, eol, found, n, c, size, more);
1948
1949         if (n > size) {
1950                 ret = copy_to_user(*b, read_buf_addr(ldata, tail), size);
1951                 if (ret)
1952                         return -EFAULT;
1953                 ret = copy_to_user(*b + size, ldata->read_buf, n - size);
1954         } else
1955                 ret = copy_to_user(*b, read_buf_addr(ldata, tail), n);
1956
1957         if (ret)
1958                 return -EFAULT;
1959         *b += n;
1960         *nr -= n;
1961
1962         if (found)
1963                 clear_bit(eol, ldata->read_flags);
1964         smp_mb__after_clear_bit();
1965         ldata->read_tail += c;
1966
1967         if (found) {
1968                 ldata->line_start = ldata->read_tail;
1969                 tty_audit_push(tty);
1970         }
1971         return eof_push ? -EAGAIN : 0;
1972 }
1973
1974 extern ssize_t redirected_tty_write(struct file *, const char __user *,
1975                                                         size_t, loff_t *);
1976
1977 /**
1978  *      job_control             -       check job control
1979  *      @tty: tty
1980  *      @file: file handle
1981  *
1982  *      Perform job control management checks on this file/tty descriptor
1983  *      and if appropriate send any needed signals and return a negative
1984  *      error code if action should be taken.
1985  *
1986  *      Locking: redirected write test is safe
1987  *               current->signal->tty check is safe
1988  *               ctrl_lock to safely reference tty->pgrp
1989  */
1990
1991 static int job_control(struct tty_struct *tty, struct file *file)
1992 {
1993         /* Job control check -- must be done at start and after
1994            every sleep (POSIX.1 7.1.1.4). */
1995         /* NOTE: not yet done after every sleep pending a thorough
1996            check of the logic of this change. -- jlc */
1997         /* don't stop on /dev/console */
1998         if (file->f_op->write == redirected_tty_write ||
1999             current->signal->tty != tty)
2000                 return 0;
2001
2002         spin_lock_irq(&tty->ctrl_lock);
2003         if (!tty->pgrp)
2004                 printk(KERN_ERR "n_tty_read: no tty->pgrp!\n");
2005         else if (task_pgrp(current) != tty->pgrp) {
2006                 spin_unlock_irq(&tty->ctrl_lock);
2007                 if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned())
2008                         return -EIO;
2009                 kill_pgrp(task_pgrp(current), SIGTTIN, 1);
2010                 set_thread_flag(TIF_SIGPENDING);
2011                 return -ERESTARTSYS;
2012         }
2013         spin_unlock_irq(&tty->ctrl_lock);
2014         return 0;
2015 }
2016
2017
2018 /**
2019  *      n_tty_read              -       read function for tty
2020  *      @tty: tty device
2021  *      @file: file object
2022  *      @buf: userspace buffer pointer
2023  *      @nr: size of I/O
2024  *
2025  *      Perform reads for the line discipline. We are guaranteed that the
2026  *      line discipline will not be closed under us but we may get multiple
2027  *      parallel readers and must handle this ourselves. We may also get
2028  *      a hangup. Always called in user context, may sleep.
2029  *
2030  *      This code must be sure never to sleep through a hangup.
2031  *
2032  *      n_tty_read()/consumer path:
2033  *              claims non-exclusive termios_rwsem
2034  *              publishes read_tail
2035  */
2036
2037 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
2038                          unsigned char __user *buf, size_t nr)
2039 {
2040         struct n_tty_data *ldata = tty->disc_data;
2041         unsigned char __user *b = buf;
2042         DECLARE_WAITQUEUE(wait, current);
2043         int c;
2044         int minimum, time;
2045         ssize_t retval = 0;
2046         long timeout;
2047         unsigned long flags;
2048         int packet;
2049
2050         c = job_control(tty, file);
2051         if (c < 0)
2052                 return c;
2053
2054         down_read(&tty->termios_rwsem);
2055
2056         minimum = time = 0;
2057         timeout = MAX_SCHEDULE_TIMEOUT;
2058         if (!ldata->icanon) {
2059                 minimum = MIN_CHAR(tty);
2060                 if (minimum) {
2061                         time = (HZ / 10) * TIME_CHAR(tty);
2062                         if (time)
2063                                 ldata->minimum_to_wake = 1;
2064                         else if (!waitqueue_active(&tty->read_wait) ||
2065                                  (ldata->minimum_to_wake > minimum))
2066                                 ldata->minimum_to_wake = minimum;
2067                 } else {
2068                         timeout = (HZ / 10) * TIME_CHAR(tty);
2069                         ldata->minimum_to_wake = minimum = 1;
2070                 }
2071         }
2072
2073         /*
2074          *      Internal serialization of reads.
2075          */
2076         if (file->f_flags & O_NONBLOCK) {
2077                 if (!mutex_trylock(&ldata->atomic_read_lock)) {
2078                         up_read(&tty->termios_rwsem);
2079                         return -EAGAIN;
2080                 }
2081         } else {
2082                 if (mutex_lock_interruptible(&ldata->atomic_read_lock)) {
2083                         up_read(&tty->termios_rwsem);
2084                         return -ERESTARTSYS;
2085                 }
2086         }
2087         packet = tty->packet;
2088
2089         add_wait_queue(&tty->read_wait, &wait);
2090         while (nr) {
2091                 /* First test for status change. */
2092                 if (packet && tty->link->ctrl_status) {
2093                         unsigned char cs;
2094                         if (b != buf)
2095                                 break;
2096                         spin_lock_irqsave(&tty->link->ctrl_lock, flags);
2097                         cs = tty->link->ctrl_status;
2098                         tty->link->ctrl_status = 0;
2099                         spin_unlock_irqrestore(&tty->link->ctrl_lock, flags);
2100                         if (tty_put_user(tty, cs, b++)) {
2101                                 retval = -EFAULT;
2102                                 b--;
2103                                 break;
2104                         }
2105                         nr--;
2106                         break;
2107                 }
2108                 /* This statement must be first before checking for input
2109                    so that any interrupt will set the state back to
2110                    TASK_RUNNING. */
2111                 set_current_state(TASK_INTERRUPTIBLE);
2112
2113                 if (((minimum - (b - buf)) < ldata->minimum_to_wake) &&
2114                     ((minimum - (b - buf)) >= 1))
2115                         ldata->minimum_to_wake = (minimum - (b - buf));
2116
2117                 if (!input_available_p(tty, 0)) {
2118                         if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
2119                                 retval = -EIO;
2120                                 break;
2121                         }
2122                         if (tty_hung_up_p(file))
2123                                 break;
2124                         if (!timeout)
2125                                 break;
2126                         if (file->f_flags & O_NONBLOCK) {
2127                                 retval = -EAGAIN;
2128                                 break;
2129                         }
2130                         if (signal_pending(current)) {
2131                                 retval = -ERESTARTSYS;
2132                                 break;
2133                         }
2134                         n_tty_set_room(tty);
2135                         up_read(&tty->termios_rwsem);
2136
2137                         timeout = schedule_timeout(timeout);
2138
2139                         down_read(&tty->termios_rwsem);
2140                         continue;
2141                 }
2142                 __set_current_state(TASK_RUNNING);
2143
2144                 /* Deal with packet mode. */
2145                 if (packet && b == buf) {
2146                         if (tty_put_user(tty, TIOCPKT_DATA, b++)) {
2147                                 retval = -EFAULT;
2148                                 b--;
2149                                 break;
2150                         }
2151                         nr--;
2152                 }
2153
2154                 if (ldata->icanon && !L_EXTPROC(tty)) {
2155                         retval = canon_copy_from_read_buf(tty, &b, &nr);
2156                         if (retval == -EAGAIN) {
2157                                 retval = 0;
2158                                 continue;
2159                         } else if (retval)
2160                                 break;
2161                 } else {
2162                         int uncopied;
2163                         /* The copy function takes the read lock and handles
2164                            locking internally for this case */
2165                         uncopied = copy_from_read_buf(tty, &b, &nr);
2166                         uncopied += copy_from_read_buf(tty, &b, &nr);
2167                         if (uncopied) {
2168                                 retval = -EFAULT;
2169                                 break;
2170                         }
2171                 }
2172
2173                 n_tty_check_unthrottle(tty);
2174
2175                 if (b - buf >= minimum)
2176                         break;
2177                 if (time)
2178                         timeout = time;
2179         }
2180         mutex_unlock(&ldata->atomic_read_lock);
2181         remove_wait_queue(&tty->read_wait, &wait);
2182
2183         if (!waitqueue_active(&tty->read_wait))
2184                 ldata->minimum_to_wake = minimum;
2185
2186         __set_current_state(TASK_RUNNING);
2187         if (b - buf)
2188                 retval = b - buf;
2189
2190         n_tty_set_room(tty);
2191         up_read(&tty->termios_rwsem);
2192         return retval;
2193 }
2194
2195 /**
2196  *      n_tty_write             -       write function for tty
2197  *      @tty: tty device
2198  *      @file: file object
2199  *      @buf: userspace buffer pointer
2200  *      @nr: size of I/O
2201  *
2202  *      Write function of the terminal device.  This is serialized with
2203  *      respect to other write callers but not to termios changes, reads
2204  *      and other such events.  Since the receive code will echo characters,
2205  *      thus calling driver write methods, the output_lock is used in
2206  *      the output processing functions called here as well as in the
2207  *      echo processing function to protect the column state and space
2208  *      left in the buffer.
2209  *
2210  *      This code must be sure never to sleep through a hangup.
2211  *
2212  *      Locking: output_lock to protect column state and space left
2213  *               (note that the process_output*() functions take this
2214  *                lock themselves)
2215  */
2216
2217 static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
2218                            const unsigned char *buf, size_t nr)
2219 {
2220         const unsigned char *b = buf;
2221         DECLARE_WAITQUEUE(wait, current);
2222         int c;
2223         ssize_t retval = 0;
2224
2225         /* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
2226         if (L_TOSTOP(tty) && file->f_op->write != redirected_tty_write) {
2227                 retval = tty_check_change(tty);
2228                 if (retval)
2229                         return retval;
2230         }
2231
2232         down_read(&tty->termios_rwsem);
2233
2234         /* Write out any echoed characters that are still pending */
2235         process_echoes(tty);
2236
2237         add_wait_queue(&tty->write_wait, &wait);
2238         while (1) {
2239                 set_current_state(TASK_INTERRUPTIBLE);
2240                 if (signal_pending(current)) {
2241                         retval = -ERESTARTSYS;
2242                         break;
2243                 }
2244                 if (tty_hung_up_p(file) || (tty->link && !tty->link->count)) {
2245                         retval = -EIO;
2246                         break;
2247                 }
2248                 if (O_OPOST(tty)) {
2249                         while (nr > 0) {
2250                                 ssize_t num = process_output_block(tty, b, nr);
2251                                 if (num < 0) {
2252                                         if (num == -EAGAIN)
2253                                                 break;
2254                                         retval = num;
2255                                         goto break_out;
2256                                 }
2257                                 b += num;
2258                                 nr -= num;
2259                                 if (nr == 0)
2260                                         break;
2261                                 c = *b;
2262                                 if (process_output(c, tty) < 0)
2263                                         break;
2264                                 b++; nr--;
2265                         }
2266                         if (tty->ops->flush_chars)
2267                                 tty->ops->flush_chars(tty);
2268                 } else {
2269                         while (nr > 0) {
2270                                 c = tty->ops->write(tty, b, nr);
2271                                 if (c < 0) {
2272                                         retval = c;
2273                                         goto break_out;
2274                                 }
2275                                 if (!c)
2276                                         break;
2277                                 b += c;
2278                                 nr -= c;
2279                         }
2280                 }
2281                 if (!nr)
2282                         break;
2283                 if (file->f_flags & O_NONBLOCK) {
2284                         retval = -EAGAIN;
2285                         break;
2286                 }
2287                 up_read(&tty->termios_rwsem);
2288
2289                 schedule();
2290
2291                 down_read(&tty->termios_rwsem);
2292         }
2293 break_out:
2294         __set_current_state(TASK_RUNNING);
2295         remove_wait_queue(&tty->write_wait, &wait);
2296         if (b - buf != nr && tty->fasync)
2297                 set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
2298         up_read(&tty->termios_rwsem);
2299         return (b - buf) ? b - buf : retval;
2300 }
2301
2302 /**
2303  *      n_tty_poll              -       poll method for N_TTY
2304  *      @tty: terminal device
2305  *      @file: file accessing it
2306  *      @wait: poll table
2307  *
2308  *      Called when the line discipline is asked to poll() for data or
2309  *      for special events. This code is not serialized with respect to
2310  *      other events save open/close.
2311  *
2312  *      This code must be sure never to sleep through a hangup.
2313  *      Called without the kernel lock held - fine
2314  */
2315
2316 static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
2317                                                         poll_table *wait)
2318 {
2319         struct n_tty_data *ldata = tty->disc_data;
2320         unsigned int mask = 0;
2321
2322         poll_wait(file, &tty->read_wait, wait);
2323         poll_wait(file, &tty->write_wait, wait);
2324         if (input_available_p(tty, TIME_CHAR(tty) ? 0 : MIN_CHAR(tty)))
2325                 mask |= POLLIN | POLLRDNORM;
2326         if (tty->packet && tty->link->ctrl_status)
2327                 mask |= POLLPRI | POLLIN | POLLRDNORM;
2328         if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
2329                 mask |= POLLHUP;
2330         if (tty_hung_up_p(file))
2331                 mask |= POLLHUP;
2332         if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
2333                 if (MIN_CHAR(tty) && !TIME_CHAR(tty))
2334                         ldata->minimum_to_wake = MIN_CHAR(tty);
2335                 else
2336                         ldata->minimum_to_wake = 1;
2337         }
2338         if (tty->ops->write && !tty_is_writelocked(tty) &&
2339                         tty_chars_in_buffer(tty) < WAKEUP_CHARS &&
2340                         tty_write_room(tty) > 0)
2341                 mask |= POLLOUT | POLLWRNORM;
2342         return mask;
2343 }
2344
2345 static unsigned long inq_canon(struct n_tty_data *ldata)
2346 {
2347         size_t nr, head, tail;
2348
2349         if (ldata->canon_head == ldata->read_tail)
2350                 return 0;
2351         head = ldata->canon_head;
2352         tail = ldata->read_tail;
2353         nr = head - tail;
2354         /* Skip EOF-chars.. */
2355         while (head != tail) {
2356                 if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) &&
2357                     read_buf(ldata, tail) == __DISABLED_CHAR)
2358                         nr--;
2359                 tail++;
2360         }
2361         return nr;
2362 }
2363
2364 static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
2365                        unsigned int cmd, unsigned long arg)
2366 {
2367         struct n_tty_data *ldata = tty->disc_data;
2368         int retval;
2369
2370         switch (cmd) {
2371         case TIOCOUTQ:
2372                 return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2373         case TIOCINQ:
2374                 down_write(&tty->termios_rwsem);
2375                 if (L_ICANON(tty))
2376                         retval = inq_canon(ldata);
2377                 else
2378                         retval = read_cnt(ldata);
2379                 up_write(&tty->termios_rwsem);
2380                 return put_user(retval, (unsigned int __user *) arg);
2381         default:
2382                 return n_tty_ioctl_helper(tty, file, cmd, arg);
2383         }
2384 }
2385
2386 static void n_tty_fasync(struct tty_struct *tty, int on)
2387 {
2388         struct n_tty_data *ldata = tty->disc_data;
2389
2390         if (!waitqueue_active(&tty->read_wait)) {
2391                 if (on)
2392                         ldata->minimum_to_wake = 1;
2393                 else if (!tty->fasync)
2394                         ldata->minimum_to_wake = N_TTY_BUF_SIZE;
2395         }
2396 }
2397
2398 struct tty_ldisc_ops tty_ldisc_N_TTY = {
2399         .magic           = TTY_LDISC_MAGIC,
2400         .name            = "n_tty",
2401         .open            = n_tty_open,
2402         .close           = n_tty_close,
2403         .flush_buffer    = n_tty_flush_buffer,
2404         .chars_in_buffer = n_tty_chars_in_buffer,
2405         .read            = n_tty_read,
2406         .write           = n_tty_write,
2407         .ioctl           = n_tty_ioctl,
2408         .set_termios     = n_tty_set_termios,
2409         .poll            = n_tty_poll,
2410         .receive_buf     = n_tty_receive_buf,
2411         .write_wakeup    = n_tty_write_wakeup,
2412         .fasync          = n_tty_fasync,
2413         .receive_buf2    = n_tty_receive_buf2,
2414 };
2415
2416 /**
2417  *      n_tty_inherit_ops       -       inherit N_TTY methods
2418  *      @ops: struct tty_ldisc_ops where to save N_TTY methods
2419  *
2420  *      Enables a 'subclass' line discipline to 'inherit' N_TTY
2421  *      methods.
2422  */
2423
2424 void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
2425 {
2426         *ops = tty_ldisc_N_TTY;
2427         ops->owner = NULL;
2428         ops->refcount = ops->flags = 0;
2429 }
2430 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);