n_tty: Factor tty->closing receive_buf() into separate fn
[firefly-linux-kernel-4.4.55.git] / drivers / tty / n_tty.c
1 /*
2  * n_tty.c --- implements the N_TTY line discipline.
3  *
4  * This code used to be in tty_io.c, but things are getting hairy
5  * enough that it made sense to split things off.  (The N_TTY
6  * processing has changed so much that it's hardly recognizable,
7  * anyway...)
8  *
9  * Note that the open routine for N_TTY is guaranteed never to return
10  * an error.  This is because Linux will fall back to setting a line
11  * to N_TTY if it can not switch to any other line discipline.
12  *
13  * Written by Theodore Ts'o, Copyright 1994.
14  *
15  * This file also contains code originally written by Linus Torvalds,
16  * Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
17  *
18  * This file may be redistributed under the terms of the GNU General Public
19  * License.
20  *
21  * Reduced memory usage for older ARM systems  - Russell King.
22  *
23  * 2000/01/20   Fixed SMP locking on put_tty_queue using bits of
24  *              the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
25  *              who actually finally proved there really was a race.
26  *
27  * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
28  *              waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
29  *              Also fixed a bug in BLOCKING mode where n_tty_write returns
30  *              EAGAIN
31  */
32
33 #include <linux/types.h>
34 #include <linux/major.h>
35 #include <linux/errno.h>
36 #include <linux/signal.h>
37 #include <linux/fcntl.h>
38 #include <linux/sched.h>
39 #include <linux/interrupt.h>
40 #include <linux/tty.h>
41 #include <linux/timer.h>
42 #include <linux/ctype.h>
43 #include <linux/mm.h>
44 #include <linux/string.h>
45 #include <linux/slab.h>
46 #include <linux/poll.h>
47 #include <linux/bitops.h>
48 #include <linux/audit.h>
49 #include <linux/file.h>
50 #include <linux/uaccess.h>
51 #include <linux/module.h>
52 #include <linux/ratelimit.h>
53
54
55 /* number of characters left in xmit buffer before select has we have room */
56 #define WAKEUP_CHARS 256
57
58 /*
59  * This defines the low- and high-watermarks for throttling and
60  * unthrottling the TTY driver.  These watermarks are used for
61  * controlling the space in the read buffer.
62  */
63 #define TTY_THRESHOLD_THROTTLE          128 /* now based on remaining room */
64 #define TTY_THRESHOLD_UNTHROTTLE        128
65
66 /*
67  * Special byte codes used in the echo buffer to represent operations
68  * or special handling of characters.  Bytes in the echo buffer that
69  * are not part of such special blocks are treated as normal character
70  * codes.
71  */
72 #define ECHO_OP_START 0xff
73 #define ECHO_OP_MOVE_BACK_COL 0x80
74 #define ECHO_OP_SET_CANON_COL 0x81
75 #define ECHO_OP_ERASE_TAB 0x82
76
77 #define ECHO_COMMIT_WATERMARK   256
78 #define ECHO_BLOCK              256
79 #define ECHO_DISCARD_WATERMARK  N_TTY_BUF_SIZE - (ECHO_BLOCK + 32)
80
81
82 #undef N_TTY_TRACE
83 #ifdef N_TTY_TRACE
84 # define n_tty_trace(f, args...)        trace_printk(f, ##args)
85 #else
86 # define n_tty_trace(f, args...)
87 #endif
88
89 struct n_tty_data {
90         /* producer-published */
91         size_t read_head;
92         size_t canon_head;
93         size_t echo_head;
94         size_t echo_commit;
95         DECLARE_BITMAP(char_map, 256);
96
97         /* private to n_tty_receive_overrun (single-threaded) */
98         unsigned long overrun_time;
99         int num_overrun;
100
101         /* non-atomic */
102         bool no_room;
103
104         /* must hold exclusive termios_rwsem to reset these */
105         unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
106
107         /* shared by producer and consumer */
108         char read_buf[N_TTY_BUF_SIZE];
109         DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
110         unsigned char echo_buf[N_TTY_BUF_SIZE];
111
112         int minimum_to_wake;
113
114         /* consumer-published */
115         size_t read_tail;
116         size_t line_start;
117
118         /* protected by output lock */
119         unsigned int column;
120         unsigned int canon_column;
121         size_t echo_tail;
122
123         struct mutex atomic_read_lock;
124         struct mutex output_lock;
125 };
126
127 static inline size_t read_cnt(struct n_tty_data *ldata)
128 {
129         return ldata->read_head - ldata->read_tail;
130 }
131
132 static inline unsigned char read_buf(struct n_tty_data *ldata, size_t i)
133 {
134         return ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
135 }
136
137 static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i)
138 {
139         return &ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
140 }
141
142 static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i)
143 {
144         return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
145 }
146
147 static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
148 {
149         return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
150 }
151
152 static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
153                                unsigned char __user *ptr)
154 {
155         struct n_tty_data *ldata = tty->disc_data;
156
157         tty_audit_add_data(tty, &x, 1, ldata->icanon);
158         return put_user(x, ptr);
159 }
160
161 static int receive_room(struct tty_struct *tty)
162 {
163         struct n_tty_data *ldata = tty->disc_data;
164         int left;
165
166         if (I_PARMRK(tty)) {
167                 /* Multiply read_cnt by 3, since each byte might take up to
168                  * three times as many spaces when PARMRK is set (depending on
169                  * its flags, e.g. parity error). */
170                 left = N_TTY_BUF_SIZE - read_cnt(ldata) * 3 - 1;
171         } else
172                 left = N_TTY_BUF_SIZE - read_cnt(ldata) - 1;
173
174         /*
175          * If we are doing input canonicalization, and there are no
176          * pending newlines, let characters through without limit, so
177          * that erase characters will be handled.  Other excess
178          * characters will be beeped.
179          */
180         if (left <= 0)
181                 left = ldata->icanon && ldata->canon_head == ldata->read_tail;
182
183         return left;
184 }
185
186 /**
187  *      n_tty_set_room  -       receive space
188  *      @tty: terminal
189  *
190  *      Re-schedules the flip buffer work if space just became available.
191  *
192  *      Caller holds exclusive termios_rwsem
193  *         or
194  *      n_tty_read()/consumer path:
195  *              holds non-exclusive termios_rwsem
196  */
197
198 static void n_tty_set_room(struct tty_struct *tty)
199 {
200         struct n_tty_data *ldata = tty->disc_data;
201
202         /* Did this open up the receive buffer? We may need to flip */
203         if (unlikely(ldata->no_room) && receive_room(tty)) {
204                 ldata->no_room = 0;
205
206                 WARN_RATELIMIT(tty->port->itty == NULL,
207                                 "scheduling with invalid itty\n");
208                 /* see if ldisc has been killed - if so, this means that
209                  * even though the ldisc has been halted and ->buf.work
210                  * cancelled, ->buf.work is about to be rescheduled
211                  */
212                 WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
213                                "scheduling buffer work for halted ldisc\n");
214                 queue_work(system_unbound_wq, &tty->port->buf.work);
215         }
216 }
217
218 static ssize_t chars_in_buffer(struct tty_struct *tty)
219 {
220         struct n_tty_data *ldata = tty->disc_data;
221         ssize_t n = 0;
222
223         if (!ldata->icanon)
224                 n = read_cnt(ldata);
225         else
226                 n = ldata->canon_head - ldata->read_tail;
227         return n;
228 }
229
230 /**
231  *      n_tty_write_wakeup      -       asynchronous I/O notifier
232  *      @tty: tty device
233  *
234  *      Required for the ptys, serial driver etc. since processes
235  *      that attach themselves to the master and rely on ASYNC
236  *      IO must be woken up
237  */
238
239 static void n_tty_write_wakeup(struct tty_struct *tty)
240 {
241         if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
242                 kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
243 }
244
245 static void n_tty_check_throttle(struct tty_struct *tty)
246 {
247         if (tty->driver->type == TTY_DRIVER_TYPE_PTY)
248                 return;
249         /*
250          * Check the remaining room for the input canonicalization
251          * mode.  We don't want to throttle the driver if we're in
252          * canonical mode and don't have a newline yet!
253          */
254         while (1) {
255                 int throttled;
256                 tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
257                 if (receive_room(tty) >= TTY_THRESHOLD_THROTTLE)
258                         break;
259                 throttled = tty_throttle_safe(tty);
260                 if (!throttled)
261                         break;
262         }
263         __tty_set_flow_change(tty, 0);
264 }
265
266 static inline void n_tty_check_unthrottle(struct tty_struct *tty)
267 {
268         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
269             tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
270                 if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
271                         return;
272                 if (!tty->count)
273                         return;
274                 n_tty_set_room(tty);
275                 n_tty_write_wakeup(tty->link);
276                 wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
277                 return;
278         }
279
280         /* If there is enough space in the read buffer now, let the
281          * low-level driver know. We use chars_in_buffer() to
282          * check the buffer, as it now knows about canonical mode.
283          * Otherwise, if the driver is throttled and the line is
284          * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
285          * we won't get any more characters.
286          */
287
288         while (1) {
289                 int unthrottled;
290                 tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
291                 if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
292                         break;
293                 if (!tty->count)
294                         break;
295                 n_tty_set_room(tty);
296                 unthrottled = tty_unthrottle_safe(tty);
297                 if (!unthrottled)
298                         break;
299         }
300         __tty_set_flow_change(tty, 0);
301 }
302
303 /**
304  *      put_tty_queue           -       add character to tty
305  *      @c: character
306  *      @ldata: n_tty data
307  *
308  *      Add a character to the tty read_buf queue.
309  *
310  *      n_tty_receive_buf()/producer path:
311  *              caller holds non-exclusive termios_rwsem
312  *              modifies read_head
313  *
314  *      read_head is only considered 'published' if canonical mode is
315  *      not active.
316  */
317
318 static void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
319 {
320         if (read_cnt(ldata) < N_TTY_BUF_SIZE) {
321                 *read_buf_addr(ldata, ldata->read_head) = c;
322                 ldata->read_head++;
323         }
324 }
325
326 /**
327  *      reset_buffer_flags      -       reset buffer state
328  *      @tty: terminal to reset
329  *
330  *      Reset the read buffer counters and clear the flags.
331  *      Called from n_tty_open() and n_tty_flush_buffer().
332  *
333  *      Locking: caller holds exclusive termios_rwsem
334  *               (or locking is not required)
335  */
336
337 static void reset_buffer_flags(struct n_tty_data *ldata)
338 {
339         ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
340         ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
341         ldata->line_start = 0;
342
343         ldata->erasing = 0;
344         bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
345 }
346
347 static void n_tty_packet_mode_flush(struct tty_struct *tty)
348 {
349         unsigned long flags;
350
351         spin_lock_irqsave(&tty->ctrl_lock, flags);
352         if (tty->link->packet) {
353                 tty->ctrl_status |= TIOCPKT_FLUSHREAD;
354                 wake_up_interruptible(&tty->link->read_wait);
355         }
356         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
357 }
358
359 /**
360  *      n_tty_flush_buffer      -       clean input queue
361  *      @tty:   terminal device
362  *
363  *      Flush the input buffer. Called when the tty layer wants the
364  *      buffer flushed (eg at hangup) or when the N_TTY line discipline
365  *      internally has to clean the pending queue (for example some signals).
366  *
367  *      Holds termios_rwsem to exclude producer/consumer while
368  *      buffer indices are reset.
369  *
370  *      Locking: ctrl_lock, exclusive termios_rwsem
371  */
372
373 static void n_tty_flush_buffer(struct tty_struct *tty)
374 {
375         down_write(&tty->termios_rwsem);
376         reset_buffer_flags(tty->disc_data);
377         n_tty_set_room(tty);
378
379         if (tty->link)
380                 n_tty_packet_mode_flush(tty);
381         up_write(&tty->termios_rwsem);
382 }
383
384 /**
385  *      n_tty_chars_in_buffer   -       report available bytes
386  *      @tty: tty device
387  *
388  *      Report the number of characters buffered to be delivered to user
389  *      at this instant in time.
390  *
391  *      Locking: exclusive termios_rwsem
392  */
393
394 static ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
395 {
396         ssize_t n;
397
398         WARN_ONCE(1, "%s is deprecated and scheduled for removal.", __func__);
399
400         down_write(&tty->termios_rwsem);
401         n = chars_in_buffer(tty);
402         up_write(&tty->termios_rwsem);
403         return n;
404 }
405
406 /**
407  *      is_utf8_continuation    -       utf8 multibyte check
408  *      @c: byte to check
409  *
410  *      Returns true if the utf8 character 'c' is a multibyte continuation
411  *      character. We use this to correctly compute the on screen size
412  *      of the character when printing
413  */
414
415 static inline int is_utf8_continuation(unsigned char c)
416 {
417         return (c & 0xc0) == 0x80;
418 }
419
420 /**
421  *      is_continuation         -       multibyte check
422  *      @c: byte to check
423  *
424  *      Returns true if the utf8 character 'c' is a multibyte continuation
425  *      character and the terminal is in unicode mode.
426  */
427
428 static inline int is_continuation(unsigned char c, struct tty_struct *tty)
429 {
430         return I_IUTF8(tty) && is_utf8_continuation(c);
431 }
432
433 /**
434  *      do_output_char                  -       output one character
435  *      @c: character (or partial unicode symbol)
436  *      @tty: terminal device
437  *      @space: space available in tty driver write buffer
438  *
439  *      This is a helper function that handles one output character
440  *      (including special characters like TAB, CR, LF, etc.),
441  *      doing OPOST processing and putting the results in the
442  *      tty driver's write buffer.
443  *
444  *      Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY
445  *      and NLDLY.  They simply aren't relevant in the world today.
446  *      If you ever need them, add them here.
447  *
448  *      Returns the number of bytes of buffer space used or -1 if
449  *      no space left.
450  *
451  *      Locking: should be called under the output_lock to protect
452  *               the column state and space left in the buffer
453  */
454
455 static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
456 {
457         struct n_tty_data *ldata = tty->disc_data;
458         int     spaces;
459
460         if (!space)
461                 return -1;
462
463         switch (c) {
464         case '\n':
465                 if (O_ONLRET(tty))
466                         ldata->column = 0;
467                 if (O_ONLCR(tty)) {
468                         if (space < 2)
469                                 return -1;
470                         ldata->canon_column = ldata->column = 0;
471                         tty->ops->write(tty, "\r\n", 2);
472                         return 2;
473                 }
474                 ldata->canon_column = ldata->column;
475                 break;
476         case '\r':
477                 if (O_ONOCR(tty) && ldata->column == 0)
478                         return 0;
479                 if (O_OCRNL(tty)) {
480                         c = '\n';
481                         if (O_ONLRET(tty))
482                                 ldata->canon_column = ldata->column = 0;
483                         break;
484                 }
485                 ldata->canon_column = ldata->column = 0;
486                 break;
487         case '\t':
488                 spaces = 8 - (ldata->column & 7);
489                 if (O_TABDLY(tty) == XTABS) {
490                         if (space < spaces)
491                                 return -1;
492                         ldata->column += spaces;
493                         tty->ops->write(tty, "        ", spaces);
494                         return spaces;
495                 }
496                 ldata->column += spaces;
497                 break;
498         case '\b':
499                 if (ldata->column > 0)
500                         ldata->column--;
501                 break;
502         default:
503                 if (!iscntrl(c)) {
504                         if (O_OLCUC(tty))
505                                 c = toupper(c);
506                         if (!is_continuation(c, tty))
507                                 ldata->column++;
508                 }
509                 break;
510         }
511
512         tty_put_char(tty, c);
513         return 1;
514 }
515
516 /**
517  *      process_output                  -       output post processor
518  *      @c: character (or partial unicode symbol)
519  *      @tty: terminal device
520  *
521  *      Output one character with OPOST processing.
522  *      Returns -1 when the output device is full and the character
523  *      must be retried.
524  *
525  *      Locking: output_lock to protect column state and space left
526  *               (also, this is called from n_tty_write under the
527  *                tty layer write lock)
528  */
529
530 static int process_output(unsigned char c, struct tty_struct *tty)
531 {
532         struct n_tty_data *ldata = tty->disc_data;
533         int     space, retval;
534
535         mutex_lock(&ldata->output_lock);
536
537         space = tty_write_room(tty);
538         retval = do_output_char(c, tty, space);
539
540         mutex_unlock(&ldata->output_lock);
541         if (retval < 0)
542                 return -1;
543         else
544                 return 0;
545 }
546
547 /**
548  *      process_output_block            -       block post processor
549  *      @tty: terminal device
550  *      @buf: character buffer
551  *      @nr: number of bytes to output
552  *
553  *      Output a block of characters with OPOST processing.
554  *      Returns the number of characters output.
555  *
556  *      This path is used to speed up block console writes, among other
557  *      things when processing blocks of output data. It handles only
558  *      the simple cases normally found and helps to generate blocks of
559  *      symbols for the console driver and thus improve performance.
560  *
561  *      Locking: output_lock to protect column state and space left
562  *               (also, this is called from n_tty_write under the
563  *                tty layer write lock)
564  */
565
566 static ssize_t process_output_block(struct tty_struct *tty,
567                                     const unsigned char *buf, unsigned int nr)
568 {
569         struct n_tty_data *ldata = tty->disc_data;
570         int     space;
571         int     i;
572         const unsigned char *cp;
573
574         mutex_lock(&ldata->output_lock);
575
576         space = tty_write_room(tty);
577         if (!space) {
578                 mutex_unlock(&ldata->output_lock);
579                 return 0;
580         }
581         if (nr > space)
582                 nr = space;
583
584         for (i = 0, cp = buf; i < nr; i++, cp++) {
585                 unsigned char c = *cp;
586
587                 switch (c) {
588                 case '\n':
589                         if (O_ONLRET(tty))
590                                 ldata->column = 0;
591                         if (O_ONLCR(tty))
592                                 goto break_out;
593                         ldata->canon_column = ldata->column;
594                         break;
595                 case '\r':
596                         if (O_ONOCR(tty) && ldata->column == 0)
597                                 goto break_out;
598                         if (O_OCRNL(tty))
599                                 goto break_out;
600                         ldata->canon_column = ldata->column = 0;
601                         break;
602                 case '\t':
603                         goto break_out;
604                 case '\b':
605                         if (ldata->column > 0)
606                                 ldata->column--;
607                         break;
608                 default:
609                         if (!iscntrl(c)) {
610                                 if (O_OLCUC(tty))
611                                         goto break_out;
612                                 if (!is_continuation(c, tty))
613                                         ldata->column++;
614                         }
615                         break;
616                 }
617         }
618 break_out:
619         i = tty->ops->write(tty, buf, i);
620
621         mutex_unlock(&ldata->output_lock);
622         return i;
623 }
624
625 /**
626  *      process_echoes  -       write pending echo characters
627  *      @tty: terminal device
628  *
629  *      Write previously buffered echo (and other ldisc-generated)
630  *      characters to the tty.
631  *
632  *      Characters generated by the ldisc (including echoes) need to
633  *      be buffered because the driver's write buffer can fill during
634  *      heavy program output.  Echoing straight to the driver will
635  *      often fail under these conditions, causing lost characters and
636  *      resulting mismatches of ldisc state information.
637  *
638  *      Since the ldisc state must represent the characters actually sent
639  *      to the driver at the time of the write, operations like certain
640  *      changes in column state are also saved in the buffer and executed
641  *      here.
642  *
643  *      A circular fifo buffer is used so that the most recent characters
644  *      are prioritized.  Also, when control characters are echoed with a
645  *      prefixed "^", the pair is treated atomically and thus not separated.
646  *
647  *      Locking: callers must hold output_lock
648  */
649
650 static size_t __process_echoes(struct tty_struct *tty)
651 {
652         struct n_tty_data *ldata = tty->disc_data;
653         int     space, old_space;
654         size_t tail;
655         unsigned char c;
656
657         old_space = space = tty_write_room(tty);
658
659         tail = ldata->echo_tail;
660         while (ldata->echo_commit != tail) {
661                 c = echo_buf(ldata, tail);
662                 if (c == ECHO_OP_START) {
663                         unsigned char op;
664                         int no_space_left = 0;
665
666                         /*
667                          * If the buffer byte is the start of a multi-byte
668                          * operation, get the next byte, which is either the
669                          * op code or a control character value.
670                          */
671                         op = echo_buf(ldata, tail + 1);
672
673                         switch (op) {
674                                 unsigned int num_chars, num_bs;
675
676                         case ECHO_OP_ERASE_TAB:
677                                 num_chars = echo_buf(ldata, tail + 2);
678
679                                 /*
680                                  * Determine how many columns to go back
681                                  * in order to erase the tab.
682                                  * This depends on the number of columns
683                                  * used by other characters within the tab
684                                  * area.  If this (modulo 8) count is from
685                                  * the start of input rather than from a
686                                  * previous tab, we offset by canon column.
687                                  * Otherwise, tab spacing is normal.
688                                  */
689                                 if (!(num_chars & 0x80))
690                                         num_chars += ldata->canon_column;
691                                 num_bs = 8 - (num_chars & 7);
692
693                                 if (num_bs > space) {
694                                         no_space_left = 1;
695                                         break;
696                                 }
697                                 space -= num_bs;
698                                 while (num_bs--) {
699                                         tty_put_char(tty, '\b');
700                                         if (ldata->column > 0)
701                                                 ldata->column--;
702                                 }
703                                 tail += 3;
704                                 break;
705
706                         case ECHO_OP_SET_CANON_COL:
707                                 ldata->canon_column = ldata->column;
708                                 tail += 2;
709                                 break;
710
711                         case ECHO_OP_MOVE_BACK_COL:
712                                 if (ldata->column > 0)
713                                         ldata->column--;
714                                 tail += 2;
715                                 break;
716
717                         case ECHO_OP_START:
718                                 /* This is an escaped echo op start code */
719                                 if (!space) {
720                                         no_space_left = 1;
721                                         break;
722                                 }
723                                 tty_put_char(tty, ECHO_OP_START);
724                                 ldata->column++;
725                                 space--;
726                                 tail += 2;
727                                 break;
728
729                         default:
730                                 /*
731                                  * If the op is not a special byte code,
732                                  * it is a ctrl char tagged to be echoed
733                                  * as "^X" (where X is the letter
734                                  * representing the control char).
735                                  * Note that we must ensure there is
736                                  * enough space for the whole ctrl pair.
737                                  *
738                                  */
739                                 if (space < 2) {
740                                         no_space_left = 1;
741                                         break;
742                                 }
743                                 tty_put_char(tty, '^');
744                                 tty_put_char(tty, op ^ 0100);
745                                 ldata->column += 2;
746                                 space -= 2;
747                                 tail += 2;
748                         }
749
750                         if (no_space_left)
751                                 break;
752                 } else {
753                         if (O_OPOST(tty)) {
754                                 int retval = do_output_char(c, tty, space);
755                                 if (retval < 0)
756                                         break;
757                                 space -= retval;
758                         } else {
759                                 if (!space)
760                                         break;
761                                 tty_put_char(tty, c);
762                                 space -= 1;
763                         }
764                         tail += 1;
765                 }
766         }
767
768         /* If the echo buffer is nearly full (so that the possibility exists
769          * of echo overrun before the next commit), then discard enough
770          * data at the tail to prevent a subsequent overrun */
771         while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
772                 if (echo_buf(ldata, tail == ECHO_OP_START)) {
773                         if (echo_buf(ldata, tail) == ECHO_OP_ERASE_TAB)
774                                 tail += 3;
775                         else
776                                 tail += 2;
777                 } else
778                         tail++;
779         }
780
781         ldata->echo_tail = tail;
782         return old_space - space;
783 }
784
785 static void commit_echoes(struct tty_struct *tty)
786 {
787         struct n_tty_data *ldata = tty->disc_data;
788         size_t nr, old, echoed;
789         size_t head;
790
791         head = ldata->echo_head;
792         old = ldata->echo_commit - ldata->echo_tail;
793
794         /* Process committed echoes if the accumulated # of bytes
795          * is over the threshold (and try again each time another
796          * block is accumulated) */
797         nr = head - ldata->echo_tail;
798         if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK))
799                 return;
800
801         mutex_lock(&ldata->output_lock);
802         ldata->echo_commit = head;
803         echoed = __process_echoes(tty);
804         mutex_unlock(&ldata->output_lock);
805
806         if (echoed && tty->ops->flush_chars)
807                 tty->ops->flush_chars(tty);
808 }
809
810 static void process_echoes(struct tty_struct *tty)
811 {
812         struct n_tty_data *ldata = tty->disc_data;
813         size_t echoed;
814
815         if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_tail)
816                 return;
817
818         mutex_lock(&ldata->output_lock);
819         echoed = __process_echoes(tty);
820         mutex_unlock(&ldata->output_lock);
821
822         if (echoed && tty->ops->flush_chars)
823                 tty->ops->flush_chars(tty);
824 }
825
826 static void flush_echoes(struct tty_struct *tty)
827 {
828         struct n_tty_data *ldata = tty->disc_data;
829
830         if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_head)
831                 return;
832
833         mutex_lock(&ldata->output_lock);
834         ldata->echo_commit = ldata->echo_head;
835         __process_echoes(tty);
836         mutex_unlock(&ldata->output_lock);
837 }
838
839 /**
840  *      add_echo_byte   -       add a byte to the echo buffer
841  *      @c: unicode byte to echo
842  *      @ldata: n_tty data
843  *
844  *      Add a character or operation byte to the echo buffer.
845  */
846
847 static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
848 {
849         *echo_buf_addr(ldata, ldata->echo_head++) = c;
850 }
851
852 /**
853  *      echo_move_back_col      -       add operation to move back a column
854  *      @ldata: n_tty data
855  *
856  *      Add an operation to the echo buffer to move back one column.
857  */
858
859 static void echo_move_back_col(struct n_tty_data *ldata)
860 {
861         add_echo_byte(ECHO_OP_START, ldata);
862         add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
863 }
864
865 /**
866  *      echo_set_canon_col      -       add operation to set the canon column
867  *      @ldata: n_tty data
868  *
869  *      Add an operation to the echo buffer to set the canon column
870  *      to the current column.
871  */
872
873 static void echo_set_canon_col(struct n_tty_data *ldata)
874 {
875         add_echo_byte(ECHO_OP_START, ldata);
876         add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
877 }
878
879 /**
880  *      echo_erase_tab  -       add operation to erase a tab
881  *      @num_chars: number of character columns already used
882  *      @after_tab: true if num_chars starts after a previous tab
883  *      @ldata: n_tty data
884  *
885  *      Add an operation to the echo buffer to erase a tab.
886  *
887  *      Called by the eraser function, which knows how many character
888  *      columns have been used since either a previous tab or the start
889  *      of input.  This information will be used later, along with
890  *      canon column (if applicable), to go back the correct number
891  *      of columns.
892  */
893
894 static void echo_erase_tab(unsigned int num_chars, int after_tab,
895                            struct n_tty_data *ldata)
896 {
897         add_echo_byte(ECHO_OP_START, ldata);
898         add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
899
900         /* We only need to know this modulo 8 (tab spacing) */
901         num_chars &= 7;
902
903         /* Set the high bit as a flag if num_chars is after a previous tab */
904         if (after_tab)
905                 num_chars |= 0x80;
906
907         add_echo_byte(num_chars, ldata);
908 }
909
910 /**
911  *      echo_char_raw   -       echo a character raw
912  *      @c: unicode byte to echo
913  *      @tty: terminal device
914  *
915  *      Echo user input back onto the screen. This must be called only when
916  *      L_ECHO(tty) is true. Called from the driver receive_buf path.
917  *
918  *      This variant does not treat control characters specially.
919  */
920
921 static void echo_char_raw(unsigned char c, struct n_tty_data *ldata)
922 {
923         if (c == ECHO_OP_START) {
924                 add_echo_byte(ECHO_OP_START, ldata);
925                 add_echo_byte(ECHO_OP_START, ldata);
926         } else {
927                 add_echo_byte(c, ldata);
928         }
929 }
930
931 /**
932  *      echo_char       -       echo a character
933  *      @c: unicode byte to echo
934  *      @tty: terminal device
935  *
936  *      Echo user input back onto the screen. This must be called only when
937  *      L_ECHO(tty) is true. Called from the driver receive_buf path.
938  *
939  *      This variant tags control characters to be echoed as "^X"
940  *      (where X is the letter representing the control char).
941  */
942
943 static void echo_char(unsigned char c, struct tty_struct *tty)
944 {
945         struct n_tty_data *ldata = tty->disc_data;
946
947         if (c == ECHO_OP_START) {
948                 add_echo_byte(ECHO_OP_START, ldata);
949                 add_echo_byte(ECHO_OP_START, ldata);
950         } else {
951                 if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
952                         add_echo_byte(ECHO_OP_START, ldata);
953                 add_echo_byte(c, ldata);
954         }
955 }
956
957 /**
958  *      finish_erasing          -       complete erase
959  *      @ldata: n_tty data
960  */
961
962 static inline void finish_erasing(struct n_tty_data *ldata)
963 {
964         if (ldata->erasing) {
965                 echo_char_raw('/', ldata);
966                 ldata->erasing = 0;
967         }
968 }
969
970 /**
971  *      eraser          -       handle erase function
972  *      @c: character input
973  *      @tty: terminal device
974  *
975  *      Perform erase and necessary output when an erase character is
976  *      present in the stream from the driver layer. Handles the complexities
977  *      of UTF-8 multibyte symbols.
978  *
979  *      n_tty_receive_buf()/producer path:
980  *              caller holds non-exclusive termios_rwsem
981  *              modifies read_head
982  *
983  *      Modifying the read_head is not considered a publish in this context
984  *      because canonical mode is active -- only canon_head publishes
985  */
986
987 static void eraser(unsigned char c, struct tty_struct *tty)
988 {
989         struct n_tty_data *ldata = tty->disc_data;
990         enum { ERASE, WERASE, KILL } kill_type;
991         size_t head;
992         size_t cnt;
993         int seen_alnums;
994
995         if (ldata->read_head == ldata->canon_head) {
996                 /* process_output('\a', tty); */ /* what do you think? */
997                 return;
998         }
999         if (c == ERASE_CHAR(tty))
1000                 kill_type = ERASE;
1001         else if (c == WERASE_CHAR(tty))
1002                 kill_type = WERASE;
1003         else {
1004                 if (!L_ECHO(tty)) {
1005                         ldata->read_head = ldata->canon_head;
1006                         return;
1007                 }
1008                 if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
1009                         ldata->read_head = ldata->canon_head;
1010                         finish_erasing(ldata);
1011                         echo_char(KILL_CHAR(tty), tty);
1012                         /* Add a newline if ECHOK is on and ECHOKE is off. */
1013                         if (L_ECHOK(tty))
1014                                 echo_char_raw('\n', ldata);
1015                         return;
1016                 }
1017                 kill_type = KILL;
1018         }
1019
1020         seen_alnums = 0;
1021         while (ldata->read_head != ldata->canon_head) {
1022                 head = ldata->read_head;
1023
1024                 /* erase a single possibly multibyte character */
1025                 do {
1026                         head--;
1027                         c = read_buf(ldata, head);
1028                 } while (is_continuation(c, tty) && head != ldata->canon_head);
1029
1030                 /* do not partially erase */
1031                 if (is_continuation(c, tty))
1032                         break;
1033
1034                 if (kill_type == WERASE) {
1035                         /* Equivalent to BSD's ALTWERASE. */
1036                         if (isalnum(c) || c == '_')
1037                                 seen_alnums++;
1038                         else if (seen_alnums)
1039                                 break;
1040                 }
1041                 cnt = ldata->read_head - head;
1042                 ldata->read_head = head;
1043                 if (L_ECHO(tty)) {
1044                         if (L_ECHOPRT(tty)) {
1045                                 if (!ldata->erasing) {
1046                                         echo_char_raw('\\', ldata);
1047                                         ldata->erasing = 1;
1048                                 }
1049                                 /* if cnt > 1, output a multi-byte character */
1050                                 echo_char(c, tty);
1051                                 while (--cnt > 0) {
1052                                         head++;
1053                                         echo_char_raw(read_buf(ldata, head), ldata);
1054                                         echo_move_back_col(ldata);
1055                                 }
1056                         } else if (kill_type == ERASE && !L_ECHOE(tty)) {
1057                                 echo_char(ERASE_CHAR(tty), tty);
1058                         } else if (c == '\t') {
1059                                 unsigned int num_chars = 0;
1060                                 int after_tab = 0;
1061                                 size_t tail = ldata->read_head;
1062
1063                                 /*
1064                                  * Count the columns used for characters
1065                                  * since the start of input or after a
1066                                  * previous tab.
1067                                  * This info is used to go back the correct
1068                                  * number of columns.
1069                                  */
1070                                 while (tail != ldata->canon_head) {
1071                                         tail--;
1072                                         c = read_buf(ldata, tail);
1073                                         if (c == '\t') {
1074                                                 after_tab = 1;
1075                                                 break;
1076                                         } else if (iscntrl(c)) {
1077                                                 if (L_ECHOCTL(tty))
1078                                                         num_chars += 2;
1079                                         } else if (!is_continuation(c, tty)) {
1080                                                 num_chars++;
1081                                         }
1082                                 }
1083                                 echo_erase_tab(num_chars, after_tab, ldata);
1084                         } else {
1085                                 if (iscntrl(c) && L_ECHOCTL(tty)) {
1086                                         echo_char_raw('\b', ldata);
1087                                         echo_char_raw(' ', ldata);
1088                                         echo_char_raw('\b', ldata);
1089                                 }
1090                                 if (!iscntrl(c) || L_ECHOCTL(tty)) {
1091                                         echo_char_raw('\b', ldata);
1092                                         echo_char_raw(' ', ldata);
1093                                         echo_char_raw('\b', ldata);
1094                                 }
1095                         }
1096                 }
1097                 if (kill_type == ERASE)
1098                         break;
1099         }
1100         if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
1101                 finish_erasing(ldata);
1102 }
1103
1104 /**
1105  *      isig            -       handle the ISIG optio
1106  *      @sig: signal
1107  *      @tty: terminal
1108  *
1109  *      Called when a signal is being sent due to terminal input.
1110  *      Called from the driver receive_buf path so serialized.
1111  *
1112  *      Locking: ctrl_lock
1113  */
1114
1115 static inline void isig(int sig, struct tty_struct *tty)
1116 {
1117         struct pid *tty_pgrp = tty_get_pgrp(tty);
1118         if (tty_pgrp) {
1119                 kill_pgrp(tty_pgrp, sig, 1);
1120                 put_pid(tty_pgrp);
1121         }
1122 }
1123
1124 /**
1125  *      n_tty_receive_break     -       handle break
1126  *      @tty: terminal
1127  *
1128  *      An RS232 break event has been hit in the incoming bitstream. This
1129  *      can cause a variety of events depending upon the termios settings.
1130  *
1131  *      n_tty_receive_buf()/producer path:
1132  *              caller holds non-exclusive termios_rwsem
1133  *              publishes read_head via put_tty_queue()
1134  *
1135  *      Note: may get exclusive termios_rwsem if flushing input buffer
1136  */
1137
1138 static inline void n_tty_receive_break(struct tty_struct *tty)
1139 {
1140         struct n_tty_data *ldata = tty->disc_data;
1141
1142         if (I_IGNBRK(tty))
1143                 return;
1144         if (I_BRKINT(tty)) {
1145                 isig(SIGINT, tty);
1146                 if (!L_NOFLSH(tty)) {
1147                         /* flushing needs exclusive termios_rwsem */
1148                         up_read(&tty->termios_rwsem);
1149                         n_tty_flush_buffer(tty);
1150                         tty_driver_flush_buffer(tty);
1151                         down_read(&tty->termios_rwsem);
1152                 }
1153                 return;
1154         }
1155         if (I_PARMRK(tty)) {
1156                 put_tty_queue('\377', ldata);
1157                 put_tty_queue('\0', ldata);
1158         }
1159         put_tty_queue('\0', ldata);
1160         wake_up_interruptible(&tty->read_wait);
1161 }
1162
1163 /**
1164  *      n_tty_receive_overrun   -       handle overrun reporting
1165  *      @tty: terminal
1166  *
1167  *      Data arrived faster than we could process it. While the tty
1168  *      driver has flagged this the bits that were missed are gone
1169  *      forever.
1170  *
1171  *      Called from the receive_buf path so single threaded. Does not
1172  *      need locking as num_overrun and overrun_time are function
1173  *      private.
1174  */
1175
1176 static inline void n_tty_receive_overrun(struct tty_struct *tty)
1177 {
1178         struct n_tty_data *ldata = tty->disc_data;
1179         char buf[64];
1180
1181         ldata->num_overrun++;
1182         if (time_after(jiffies, ldata->overrun_time + HZ) ||
1183                         time_after(ldata->overrun_time, jiffies)) {
1184                 printk(KERN_WARNING "%s: %d input overrun(s)\n",
1185                         tty_name(tty, buf),
1186                         ldata->num_overrun);
1187                 ldata->overrun_time = jiffies;
1188                 ldata->num_overrun = 0;
1189         }
1190 }
1191
1192 /**
1193  *      n_tty_receive_parity_error      -       error notifier
1194  *      @tty: terminal device
1195  *      @c: character
1196  *
1197  *      Process a parity error and queue the right data to indicate
1198  *      the error case if necessary.
1199  *
1200  *      n_tty_receive_buf()/producer path:
1201  *              caller holds non-exclusive termios_rwsem
1202  *              publishes read_head via put_tty_queue()
1203  */
1204 static inline void n_tty_receive_parity_error(struct tty_struct *tty,
1205                                               unsigned char c)
1206 {
1207         struct n_tty_data *ldata = tty->disc_data;
1208
1209         if (I_IGNPAR(tty))
1210                 return;
1211         if (I_PARMRK(tty)) {
1212                 put_tty_queue('\377', ldata);
1213                 put_tty_queue('\0', ldata);
1214                 put_tty_queue(c, ldata);
1215         } else  if (I_INPCK(tty))
1216                 put_tty_queue('\0', ldata);
1217         else
1218                 put_tty_queue(c, ldata);
1219         wake_up_interruptible(&tty->read_wait);
1220 }
1221
1222 static void
1223 n_tty_receive_signal_char(struct tty_struct *tty, int signal, unsigned char c)
1224 {
1225         if (!L_NOFLSH(tty)) {
1226                 /* flushing needs exclusive termios_rwsem */
1227                 up_read(&tty->termios_rwsem);
1228                 n_tty_flush_buffer(tty);
1229                 tty_driver_flush_buffer(tty);
1230                 down_read(&tty->termios_rwsem);
1231         }
1232         if (I_IXON(tty))
1233                 start_tty(tty);
1234         if (L_ECHO(tty)) {
1235                 echo_char(c, tty);
1236                 commit_echoes(tty);
1237         }
1238         isig(signal, tty);
1239         return;
1240 }
1241
1242 /**
1243  *      n_tty_receive_char      -       perform processing
1244  *      @tty: terminal device
1245  *      @c: character
1246  *
1247  *      Process an individual character of input received from the driver.
1248  *      This is serialized with respect to itself by the rules for the
1249  *      driver above.
1250  *
1251  *      n_tty_receive_buf()/producer path:
1252  *              caller holds non-exclusive termios_rwsem
1253  *              publishes canon_head if canonical mode is active
1254  *              otherwise, publishes read_head via put_tty_queue()
1255  */
1256
1257 static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
1258 {
1259         struct n_tty_data *ldata = tty->disc_data;
1260         int parmrk;
1261
1262         if (I_ISTRIP(tty))
1263                 c &= 0x7f;
1264         if (I_IUCLC(tty) && L_IEXTEN(tty))
1265                 c = tolower(c);
1266
1267         if (L_EXTPROC(tty)) {
1268                 put_tty_queue(c, ldata);
1269                 return;
1270         }
1271
1272         if (tty->stopped && !tty->flow_stopped && I_IXON(tty) &&
1273             I_IXANY(tty) && c != START_CHAR(tty) && c != STOP_CHAR(tty) &&
1274             c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) && c != SUSP_CHAR(tty)) {
1275                 start_tty(tty);
1276                 process_echoes(tty);
1277         }
1278
1279         /*
1280          * If the previous character was LNEXT, or we know that this
1281          * character is not one of the characters that we'll have to
1282          * handle specially, do shortcut processing to speed things
1283          * up.
1284          */
1285         if (!test_bit(c, ldata->char_map) || ldata->lnext) {
1286                 ldata->lnext = 0;
1287                 parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
1288                 if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk - 1)) {
1289                         /* beep if no space */
1290                         if (L_ECHO(tty))
1291                                 process_output('\a', tty);
1292                         return;
1293                 }
1294                 if (L_ECHO(tty)) {
1295                         finish_erasing(ldata);
1296                         /* Record the column of first canon char. */
1297                         if (ldata->canon_head == ldata->read_head)
1298                                 echo_set_canon_col(ldata);
1299                         echo_char(c, tty);
1300                         commit_echoes(tty);
1301                 }
1302                 if (parmrk)
1303                         put_tty_queue(c, ldata);
1304                 put_tty_queue(c, ldata);
1305                 return;
1306         }
1307
1308         if (I_IXON(tty)) {
1309                 if (c == START_CHAR(tty)) {
1310                         start_tty(tty);
1311                         commit_echoes(tty);
1312                         return;
1313                 }
1314                 if (c == STOP_CHAR(tty)) {
1315                         stop_tty(tty);
1316                         return;
1317                 }
1318         }
1319
1320         if (L_ISIG(tty)) {
1321                 if (c == INTR_CHAR(tty)) {
1322                         n_tty_receive_signal_char(tty, SIGINT, c);
1323                         return;
1324                 } else if (c == QUIT_CHAR(tty)) {
1325                         n_tty_receive_signal_char(tty, SIGQUIT, c);
1326                         return;
1327                 } else if (c == SUSP_CHAR(tty)) {
1328                         n_tty_receive_signal_char(tty, SIGTSTP, c);
1329                         return;
1330                 }
1331         }
1332
1333         if (c == '\r') {
1334                 if (I_IGNCR(tty))
1335                         return;
1336                 if (I_ICRNL(tty))
1337                         c = '\n';
1338         } else if (c == '\n' && I_INLCR(tty))
1339                 c = '\r';
1340
1341         if (ldata->icanon) {
1342                 if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
1343                     (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
1344                         eraser(c, tty);
1345                         commit_echoes(tty);
1346                         return;
1347                 }
1348                 if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
1349                         ldata->lnext = 1;
1350                         if (L_ECHO(tty)) {
1351                                 finish_erasing(ldata);
1352                                 if (L_ECHOCTL(tty)) {
1353                                         echo_char_raw('^', ldata);
1354                                         echo_char_raw('\b', ldata);
1355                                         commit_echoes(tty);
1356                                 }
1357                         }
1358                         return;
1359                 }
1360                 if (c == REPRINT_CHAR(tty) && L_ECHO(tty) &&
1361                     L_IEXTEN(tty)) {
1362                         size_t tail = ldata->canon_head;
1363
1364                         finish_erasing(ldata);
1365                         echo_char(c, tty);
1366                         echo_char_raw('\n', ldata);
1367                         while (tail != ldata->read_head) {
1368                                 echo_char(read_buf(ldata, tail), tty);
1369                                 tail++;
1370                         }
1371                         commit_echoes(tty);
1372                         return;
1373                 }
1374                 if (c == '\n') {
1375                         if (read_cnt(ldata) >= N_TTY_BUF_SIZE) {
1376                                 if (L_ECHO(tty))
1377                                         process_output('\a', tty);
1378                                 return;
1379                         }
1380                         if (L_ECHO(tty) || L_ECHONL(tty)) {
1381                                 echo_char_raw('\n', ldata);
1382                                 commit_echoes(tty);
1383                         }
1384                         goto handle_newline;
1385                 }
1386                 if (c == EOF_CHAR(tty)) {
1387                         if (read_cnt(ldata) >= N_TTY_BUF_SIZE)
1388                                 return;
1389                         c = __DISABLED_CHAR;
1390                         goto handle_newline;
1391                 }
1392                 if ((c == EOL_CHAR(tty)) ||
1393                     (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
1394                         parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty))
1395                                  ? 1 : 0;
1396                         if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk)) {
1397                                 if (L_ECHO(tty))
1398                                         process_output('\a', tty);
1399                                 return;
1400                         }
1401                         /*
1402                          * XXX are EOL_CHAR and EOL2_CHAR echoed?!?
1403                          */
1404                         if (L_ECHO(tty)) {
1405                                 /* Record the column of first canon char. */
1406                                 if (ldata->canon_head == ldata->read_head)
1407                                         echo_set_canon_col(ldata);
1408                                 echo_char(c, tty);
1409                                 commit_echoes(tty);
1410                         }
1411                         /*
1412                          * XXX does PARMRK doubling happen for
1413                          * EOL_CHAR and EOL2_CHAR?
1414                          */
1415                         if (parmrk)
1416                                 put_tty_queue(c, ldata);
1417
1418 handle_newline:
1419                         set_bit(ldata->read_head & (N_TTY_BUF_SIZE - 1), ldata->read_flags);
1420                         put_tty_queue(c, ldata);
1421                         ldata->canon_head = ldata->read_head;
1422                         kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1423                         if (waitqueue_active(&tty->read_wait))
1424                                 wake_up_interruptible(&tty->read_wait);
1425                         return;
1426                 }
1427         }
1428
1429         parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
1430         if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk - 1)) {
1431                 /* beep if no space */
1432                 if (L_ECHO(tty))
1433                         process_output('\a', tty);
1434                 return;
1435         }
1436         if (L_ECHO(tty)) {
1437                 finish_erasing(ldata);
1438                 if (c == '\n')
1439                         echo_char_raw('\n', ldata);
1440                 else {
1441                         /* Record the column of first canon char. */
1442                         if (ldata->canon_head == ldata->read_head)
1443                                 echo_set_canon_col(ldata);
1444                         echo_char(c, tty);
1445                 }
1446                 commit_echoes(tty);
1447         }
1448
1449         if (parmrk)
1450                 put_tty_queue(c, ldata);
1451
1452         put_tty_queue(c, ldata);
1453 }
1454
1455 static inline void
1456 n_tty_receive_char_closing(struct tty_struct *tty, unsigned char c)
1457 {
1458         if (I_ISTRIP(tty))
1459                 c &= 0x7f;
1460         if (I_IUCLC(tty) && L_IEXTEN(tty))
1461                 c = tolower(c);
1462
1463         if (I_IXON(tty)) {
1464                 if (c == STOP_CHAR(tty))
1465                         stop_tty(tty);
1466                 else if (c == START_CHAR(tty) ||
1467                          (tty->stopped && !tty->flow_stopped && I_IXANY(tty) &&
1468                           c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) &&
1469                           c != SUSP_CHAR(tty))) {
1470                         start_tty(tty);
1471                         process_echoes(tty);
1472                 }
1473         }
1474 }
1475
1476 static void
1477 n_tty_receive_char_flagged(struct tty_struct *tty, unsigned char c, char flag)
1478 {
1479         char buf[64];
1480
1481         switch (flag) {
1482         case TTY_BREAK:
1483                 n_tty_receive_break(tty);
1484                 break;
1485         case TTY_PARITY:
1486         case TTY_FRAME:
1487                 n_tty_receive_parity_error(tty, c);
1488                 break;
1489         case TTY_OVERRUN:
1490                 n_tty_receive_overrun(tty);
1491                 break;
1492         default:
1493                 printk(KERN_ERR "%s: unknown flag %d\n",
1494                        tty_name(tty, buf), flag);
1495                 break;
1496         }
1497 }
1498
1499 /**
1500  *      n_tty_receive_buf       -       data receive
1501  *      @tty: terminal device
1502  *      @cp: buffer
1503  *      @fp: flag buffer
1504  *      @count: characters
1505  *
1506  *      Called by the terminal driver when a block of characters has
1507  *      been received. This function must be called from soft contexts
1508  *      not from interrupt context. The driver is responsible for making
1509  *      calls one at a time and in order (or using flush_to_ldisc)
1510  *
1511  *      n_tty_receive_buf()/producer path:
1512  *              claims non-exclusive termios_rwsem
1513  *              publishes read_head and canon_head
1514  */
1515
1516 static void
1517 n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
1518                            char *fp, int count)
1519 {
1520         struct n_tty_data *ldata = tty->disc_data;
1521         size_t n, head;
1522
1523         head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1524         n = N_TTY_BUF_SIZE - max(read_cnt(ldata), head);
1525         n = min_t(size_t, count, n);
1526         memcpy(read_buf_addr(ldata, head), cp, n);
1527         ldata->read_head += n;
1528         cp += n;
1529         count -= n;
1530
1531         head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1532         n = N_TTY_BUF_SIZE - max(read_cnt(ldata), head);
1533         n = min_t(size_t, count, n);
1534         memcpy(read_buf_addr(ldata, head), cp, n);
1535         ldata->read_head += n;
1536 }
1537
1538 static void
1539 n_tty_receive_buf_raw(struct tty_struct *tty, const unsigned char *cp,
1540                       char *fp, int count)
1541 {
1542         struct n_tty_data *ldata = tty->disc_data;
1543         char flag = TTY_NORMAL;
1544
1545         while (count--) {
1546                 if (fp)
1547                         flag = *fp++;
1548                 if (likely(flag == TTY_NORMAL))
1549                         put_tty_queue(*cp++, ldata);
1550                 else
1551                         n_tty_receive_char_flagged(tty, *cp++, flag);
1552         }
1553 }
1554
1555 static void
1556 n_tty_receive_buf_closing(struct tty_struct *tty, const unsigned char *cp,
1557                           char *fp, int count)
1558 {
1559         char flag = TTY_NORMAL;
1560
1561         while (count--) {
1562                 if (fp)
1563                         flag = *fp++;
1564                 if (likely(flag == TTY_NORMAL))
1565                         n_tty_receive_char_closing(tty, *cp++);
1566                 else
1567                         n_tty_receive_char_flagged(tty, *cp++, flag);
1568         }
1569 }
1570
1571 static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
1572                           char *fp, int count)
1573 {
1574         struct n_tty_data *ldata = tty->disc_data;
1575         bool preops = I_ISTRIP(tty) || (I_IUCLC(tty) && L_IEXTEN(tty));
1576
1577         if (ldata->real_raw)
1578                 n_tty_receive_buf_real_raw(tty, cp, fp, count);
1579         else if (ldata->raw || (L_EXTPROC(tty) && !preops))
1580                 n_tty_receive_buf_raw(tty, cp, fp, count);
1581         else if (tty->closing && !L_EXTPROC(tty))
1582                 n_tty_receive_buf_closing(tty, cp, fp, count);
1583         else {
1584                 char flag = TTY_NORMAL;
1585
1586                 while (count--) {
1587                         if (fp)
1588                                 flag = *fp++;
1589                         if (likely(flag == TTY_NORMAL))
1590                                 n_tty_receive_char(tty, *cp++);
1591                         else
1592                                 n_tty_receive_char_flagged(tty, *cp++, flag);
1593                 }
1594
1595                 flush_echoes(tty);
1596                 if (tty->ops->flush_chars)
1597                         tty->ops->flush_chars(tty);
1598         }
1599
1600         if ((!ldata->icanon && (read_cnt(ldata) >= ldata->minimum_to_wake)) ||
1601                 L_EXTPROC(tty)) {
1602                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1603                 if (waitqueue_active(&tty->read_wait))
1604                         wake_up_interruptible(&tty->read_wait);
1605         }
1606 }
1607
1608 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
1609                               char *fp, int count)
1610 {
1611         down_read(&tty->termios_rwsem);
1612         __receive_buf(tty, cp, fp, count);
1613         n_tty_check_throttle(tty);
1614         up_read(&tty->termios_rwsem);
1615 }
1616
1617 static int n_tty_receive_buf2(struct tty_struct *tty, const unsigned char *cp,
1618                               char *fp, int count)
1619 {
1620         struct n_tty_data *ldata = tty->disc_data;
1621         int room;
1622
1623         down_read(&tty->termios_rwsem);
1624
1625         tty->receive_room = room = receive_room(tty);
1626         if (!room)
1627                 ldata->no_room = 1;
1628         count = min(count, room);
1629         if (count) {
1630                 __receive_buf(tty, cp, fp, count);
1631                 n_tty_check_throttle(tty);
1632         }
1633
1634         up_read(&tty->termios_rwsem);
1635
1636         return count;
1637 }
1638
1639 int is_ignored(int sig)
1640 {
1641         return (sigismember(&current->blocked, sig) ||
1642                 current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
1643 }
1644
1645 /**
1646  *      n_tty_set_termios       -       termios data changed
1647  *      @tty: terminal
1648  *      @old: previous data
1649  *
1650  *      Called by the tty layer when the user changes termios flags so
1651  *      that the line discipline can plan ahead. This function cannot sleep
1652  *      and is protected from re-entry by the tty layer. The user is
1653  *      guaranteed that this function will not be re-entered or in progress
1654  *      when the ldisc is closed.
1655  *
1656  *      Locking: Caller holds tty->termios_rwsem
1657  */
1658
1659 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
1660 {
1661         struct n_tty_data *ldata = tty->disc_data;
1662         int canon_change = 1;
1663
1664         if (old)
1665                 canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
1666         if (canon_change) {
1667                 bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
1668                 ldata->line_start = 0;
1669                 ldata->canon_head = ldata->read_tail;
1670                 ldata->erasing = 0;
1671                 ldata->lnext = 0;
1672         }
1673
1674         if (canon_change && !L_ICANON(tty) && read_cnt(ldata))
1675                 wake_up_interruptible(&tty->read_wait);
1676
1677         ldata->icanon = (L_ICANON(tty) != 0);
1678
1679         if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
1680             I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
1681             I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
1682             I_PARMRK(tty)) {
1683                 bitmap_zero(ldata->char_map, 256);
1684
1685                 if (I_IGNCR(tty) || I_ICRNL(tty))
1686                         set_bit('\r', ldata->char_map);
1687                 if (I_INLCR(tty))
1688                         set_bit('\n', ldata->char_map);
1689
1690                 if (L_ICANON(tty)) {
1691                         set_bit(ERASE_CHAR(tty), ldata->char_map);
1692                         set_bit(KILL_CHAR(tty), ldata->char_map);
1693                         set_bit(EOF_CHAR(tty), ldata->char_map);
1694                         set_bit('\n', ldata->char_map);
1695                         set_bit(EOL_CHAR(tty), ldata->char_map);
1696                         if (L_IEXTEN(tty)) {
1697                                 set_bit(WERASE_CHAR(tty), ldata->char_map);
1698                                 set_bit(LNEXT_CHAR(tty), ldata->char_map);
1699                                 set_bit(EOL2_CHAR(tty), ldata->char_map);
1700                                 if (L_ECHO(tty))
1701                                         set_bit(REPRINT_CHAR(tty),
1702                                                 ldata->char_map);
1703                         }
1704                 }
1705                 if (I_IXON(tty)) {
1706                         set_bit(START_CHAR(tty), ldata->char_map);
1707                         set_bit(STOP_CHAR(tty), ldata->char_map);
1708                 }
1709                 if (L_ISIG(tty)) {
1710                         set_bit(INTR_CHAR(tty), ldata->char_map);
1711                         set_bit(QUIT_CHAR(tty), ldata->char_map);
1712                         set_bit(SUSP_CHAR(tty), ldata->char_map);
1713                 }
1714                 clear_bit(__DISABLED_CHAR, ldata->char_map);
1715                 ldata->raw = 0;
1716                 ldata->real_raw = 0;
1717         } else {
1718                 ldata->raw = 1;
1719                 if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1720                     (I_IGNPAR(tty) || !I_INPCK(tty)) &&
1721                     (tty->driver->flags & TTY_DRIVER_REAL_RAW))
1722                         ldata->real_raw = 1;
1723                 else
1724                         ldata->real_raw = 0;
1725         }
1726         n_tty_set_room(tty);
1727         /*
1728          * Fix tty hang when I_IXON(tty) is cleared, but the tty
1729          * been stopped by STOP_CHAR(tty) before it.
1730          */
1731         if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) {
1732                 start_tty(tty);
1733         }
1734
1735         /* The termios change make the tty ready for I/O */
1736         wake_up_interruptible(&tty->write_wait);
1737         wake_up_interruptible(&tty->read_wait);
1738 }
1739
1740 /**
1741  *      n_tty_close             -       close the ldisc for this tty
1742  *      @tty: device
1743  *
1744  *      Called from the terminal layer when this line discipline is
1745  *      being shut down, either because of a close or becsuse of a
1746  *      discipline change. The function will not be called while other
1747  *      ldisc methods are in progress.
1748  */
1749
1750 static void n_tty_close(struct tty_struct *tty)
1751 {
1752         struct n_tty_data *ldata = tty->disc_data;
1753
1754         if (tty->link)
1755                 n_tty_packet_mode_flush(tty);
1756
1757         vfree(ldata);
1758         tty->disc_data = NULL;
1759 }
1760
1761 /**
1762  *      n_tty_open              -       open an ldisc
1763  *      @tty: terminal to open
1764  *
1765  *      Called when this line discipline is being attached to the
1766  *      terminal device. Can sleep. Called serialized so that no
1767  *      other events will occur in parallel. No further open will occur
1768  *      until a close.
1769  */
1770
1771 static int n_tty_open(struct tty_struct *tty)
1772 {
1773         struct n_tty_data *ldata;
1774
1775         /* Currently a malloc failure here can panic */
1776         ldata = vmalloc(sizeof(*ldata));
1777         if (!ldata)
1778                 goto err;
1779
1780         ldata->overrun_time = jiffies;
1781         mutex_init(&ldata->atomic_read_lock);
1782         mutex_init(&ldata->output_lock);
1783
1784         tty->disc_data = ldata;
1785         reset_buffer_flags(tty->disc_data);
1786         ldata->column = 0;
1787         ldata->canon_column = 0;
1788         ldata->minimum_to_wake = 1;
1789         ldata->num_overrun = 0;
1790         ldata->no_room = 0;
1791         ldata->lnext = 0;
1792         tty->closing = 0;
1793         /* indicate buffer work may resume */
1794         clear_bit(TTY_LDISC_HALTED, &tty->flags);
1795         n_tty_set_termios(tty, NULL);
1796         tty_unthrottle(tty);
1797
1798         return 0;
1799 err:
1800         return -ENOMEM;
1801 }
1802
1803 static inline int input_available_p(struct tty_struct *tty, int amt)
1804 {
1805         struct n_tty_data *ldata = tty->disc_data;
1806
1807         if (ldata->icanon && !L_EXTPROC(tty)) {
1808                 if (ldata->canon_head != ldata->read_tail)
1809                         return 1;
1810         } else if (read_cnt(ldata) >= (amt ? amt : 1))
1811                 return 1;
1812
1813         return 0;
1814 }
1815
1816 /**
1817  *      copy_from_read_buf      -       copy read data directly
1818  *      @tty: terminal device
1819  *      @b: user data
1820  *      @nr: size of data
1821  *
1822  *      Helper function to speed up n_tty_read.  It is only called when
1823  *      ICANON is off; it copies characters straight from the tty queue to
1824  *      user space directly.  It can be profitably called twice; once to
1825  *      drain the space from the tail pointer to the (physical) end of the
1826  *      buffer, and once to drain the space from the (physical) beginning of
1827  *      the buffer to head pointer.
1828  *
1829  *      Called under the ldata->atomic_read_lock sem
1830  *
1831  *      n_tty_read()/consumer path:
1832  *              caller holds non-exclusive termios_rwsem
1833  *              read_tail published
1834  */
1835
1836 static int copy_from_read_buf(struct tty_struct *tty,
1837                                       unsigned char __user **b,
1838                                       size_t *nr)
1839
1840 {
1841         struct n_tty_data *ldata = tty->disc_data;
1842         int retval;
1843         size_t n;
1844         bool is_eof;
1845         size_t tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1846
1847         retval = 0;
1848         n = min(read_cnt(ldata), N_TTY_BUF_SIZE - tail);
1849         n = min(*nr, n);
1850         if (n) {
1851                 retval = copy_to_user(*b, read_buf_addr(ldata, tail), n);
1852                 n -= retval;
1853                 is_eof = n == 1 && read_buf(ldata, tail) == EOF_CHAR(tty);
1854                 tty_audit_add_data(tty, read_buf_addr(ldata, tail), n,
1855                                 ldata->icanon);
1856                 ldata->read_tail += n;
1857                 /* Turn single EOF into zero-length read */
1858                 if (L_EXTPROC(tty) && ldata->icanon && is_eof && !read_cnt(ldata))
1859                         n = 0;
1860                 *b += n;
1861                 *nr -= n;
1862         }
1863         return retval;
1864 }
1865
1866 /**
1867  *      canon_copy_from_read_buf        -       copy read data in canonical mode
1868  *      @tty: terminal device
1869  *      @b: user data
1870  *      @nr: size of data
1871  *
1872  *      Helper function for n_tty_read.  It is only called when ICANON is on;
1873  *      it copies one line of input up to and including the line-delimiting
1874  *      character into the user-space buffer.
1875  *
1876  *      Called under the atomic_read_lock mutex
1877  *
1878  *      n_tty_read()/consumer path:
1879  *              caller holds non-exclusive termios_rwsem
1880  *              read_tail published
1881  */
1882
1883 static int canon_copy_from_read_buf(struct tty_struct *tty,
1884                                     unsigned char __user **b,
1885                                     size_t *nr)
1886 {
1887         struct n_tty_data *ldata = tty->disc_data;
1888         size_t n, size, more, c;
1889         size_t eol;
1890         size_t tail;
1891         int ret, found = 0;
1892         bool eof_push = 0;
1893
1894         /* N.B. avoid overrun if nr == 0 */
1895         n = min(*nr, read_cnt(ldata));
1896         if (!n)
1897                 return 0;
1898
1899         tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1900         size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
1901
1902         n_tty_trace("%s: nr:%zu tail:%zu n:%zu size:%zu\n",
1903                     __func__, *nr, tail, n, size);
1904
1905         eol = find_next_bit(ldata->read_flags, size, tail);
1906         more = n - (size - tail);
1907         if (eol == N_TTY_BUF_SIZE && more) {
1908                 /* scan wrapped without finding set bit */
1909                 eol = find_next_bit(ldata->read_flags, more, 0);
1910                 if (eol != more)
1911                         found = 1;
1912         } else if (eol != size)
1913                 found = 1;
1914
1915         size = N_TTY_BUF_SIZE - tail;
1916         n = (found + eol + size) & (N_TTY_BUF_SIZE - 1);
1917         c = n;
1918
1919         if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
1920                 n--;
1921                 eof_push = !n && ldata->read_tail != ldata->line_start;
1922         }
1923
1924         n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
1925                     __func__, eol, found, n, c, size, more);
1926
1927         if (n > size) {
1928                 ret = copy_to_user(*b, read_buf_addr(ldata, tail), size);
1929                 if (ret)
1930                         return -EFAULT;
1931                 ret = copy_to_user(*b + size, ldata->read_buf, n - size);
1932         } else
1933                 ret = copy_to_user(*b, read_buf_addr(ldata, tail), n);
1934
1935         if (ret)
1936                 return -EFAULT;
1937         *b += n;
1938         *nr -= n;
1939
1940         if (found)
1941                 clear_bit(eol, ldata->read_flags);
1942         smp_mb__after_clear_bit();
1943         ldata->read_tail += c;
1944
1945         if (found) {
1946                 ldata->line_start = ldata->read_tail;
1947                 tty_audit_push(tty);
1948         }
1949         return eof_push ? -EAGAIN : 0;
1950 }
1951
1952 extern ssize_t redirected_tty_write(struct file *, const char __user *,
1953                                                         size_t, loff_t *);
1954
1955 /**
1956  *      job_control             -       check job control
1957  *      @tty: tty
1958  *      @file: file handle
1959  *
1960  *      Perform job control management checks on this file/tty descriptor
1961  *      and if appropriate send any needed signals and return a negative
1962  *      error code if action should be taken.
1963  *
1964  *      Locking: redirected write test is safe
1965  *               current->signal->tty check is safe
1966  *               ctrl_lock to safely reference tty->pgrp
1967  */
1968
1969 static int job_control(struct tty_struct *tty, struct file *file)
1970 {
1971         /* Job control check -- must be done at start and after
1972            every sleep (POSIX.1 7.1.1.4). */
1973         /* NOTE: not yet done after every sleep pending a thorough
1974            check of the logic of this change. -- jlc */
1975         /* don't stop on /dev/console */
1976         if (file->f_op->write == redirected_tty_write ||
1977             current->signal->tty != tty)
1978                 return 0;
1979
1980         spin_lock_irq(&tty->ctrl_lock);
1981         if (!tty->pgrp)
1982                 printk(KERN_ERR "n_tty_read: no tty->pgrp!\n");
1983         else if (task_pgrp(current) != tty->pgrp) {
1984                 spin_unlock_irq(&tty->ctrl_lock);
1985                 if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned())
1986                         return -EIO;
1987                 kill_pgrp(task_pgrp(current), SIGTTIN, 1);
1988                 set_thread_flag(TIF_SIGPENDING);
1989                 return -ERESTARTSYS;
1990         }
1991         spin_unlock_irq(&tty->ctrl_lock);
1992         return 0;
1993 }
1994
1995
1996 /**
1997  *      n_tty_read              -       read function for tty
1998  *      @tty: tty device
1999  *      @file: file object
2000  *      @buf: userspace buffer pointer
2001  *      @nr: size of I/O
2002  *
2003  *      Perform reads for the line discipline. We are guaranteed that the
2004  *      line discipline will not be closed under us but we may get multiple
2005  *      parallel readers and must handle this ourselves. We may also get
2006  *      a hangup. Always called in user context, may sleep.
2007  *
2008  *      This code must be sure never to sleep through a hangup.
2009  *
2010  *      n_tty_read()/consumer path:
2011  *              claims non-exclusive termios_rwsem
2012  *              publishes read_tail
2013  */
2014
2015 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
2016                          unsigned char __user *buf, size_t nr)
2017 {
2018         struct n_tty_data *ldata = tty->disc_data;
2019         unsigned char __user *b = buf;
2020         DECLARE_WAITQUEUE(wait, current);
2021         int c;
2022         int minimum, time;
2023         ssize_t retval = 0;
2024         long timeout;
2025         unsigned long flags;
2026         int packet;
2027
2028         c = job_control(tty, file);
2029         if (c < 0)
2030                 return c;
2031
2032         down_read(&tty->termios_rwsem);
2033
2034         minimum = time = 0;
2035         timeout = MAX_SCHEDULE_TIMEOUT;
2036         if (!ldata->icanon) {
2037                 minimum = MIN_CHAR(tty);
2038                 if (minimum) {
2039                         time = (HZ / 10) * TIME_CHAR(tty);
2040                         if (time)
2041                                 ldata->minimum_to_wake = 1;
2042                         else if (!waitqueue_active(&tty->read_wait) ||
2043                                  (ldata->minimum_to_wake > minimum))
2044                                 ldata->minimum_to_wake = minimum;
2045                 } else {
2046                         timeout = (HZ / 10) * TIME_CHAR(tty);
2047                         ldata->minimum_to_wake = minimum = 1;
2048                 }
2049         }
2050
2051         /*
2052          *      Internal serialization of reads.
2053          */
2054         if (file->f_flags & O_NONBLOCK) {
2055                 if (!mutex_trylock(&ldata->atomic_read_lock)) {
2056                         up_read(&tty->termios_rwsem);
2057                         return -EAGAIN;
2058                 }
2059         } else {
2060                 if (mutex_lock_interruptible(&ldata->atomic_read_lock)) {
2061                         up_read(&tty->termios_rwsem);
2062                         return -ERESTARTSYS;
2063                 }
2064         }
2065         packet = tty->packet;
2066
2067         add_wait_queue(&tty->read_wait, &wait);
2068         while (nr) {
2069                 /* First test for status change. */
2070                 if (packet && tty->link->ctrl_status) {
2071                         unsigned char cs;
2072                         if (b != buf)
2073                                 break;
2074                         spin_lock_irqsave(&tty->link->ctrl_lock, flags);
2075                         cs = tty->link->ctrl_status;
2076                         tty->link->ctrl_status = 0;
2077                         spin_unlock_irqrestore(&tty->link->ctrl_lock, flags);
2078                         if (tty_put_user(tty, cs, b++)) {
2079                                 retval = -EFAULT;
2080                                 b--;
2081                                 break;
2082                         }
2083                         nr--;
2084                         break;
2085                 }
2086                 /* This statement must be first before checking for input
2087                    so that any interrupt will set the state back to
2088                    TASK_RUNNING. */
2089                 set_current_state(TASK_INTERRUPTIBLE);
2090
2091                 if (((minimum - (b - buf)) < ldata->minimum_to_wake) &&
2092                     ((minimum - (b - buf)) >= 1))
2093                         ldata->minimum_to_wake = (minimum - (b - buf));
2094
2095                 if (!input_available_p(tty, 0)) {
2096                         if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
2097                                 retval = -EIO;
2098                                 break;
2099                         }
2100                         if (tty_hung_up_p(file))
2101                                 break;
2102                         if (!timeout)
2103                                 break;
2104                         if (file->f_flags & O_NONBLOCK) {
2105                                 retval = -EAGAIN;
2106                                 break;
2107                         }
2108                         if (signal_pending(current)) {
2109                                 retval = -ERESTARTSYS;
2110                                 break;
2111                         }
2112                         n_tty_set_room(tty);
2113                         up_read(&tty->termios_rwsem);
2114
2115                         timeout = schedule_timeout(timeout);
2116
2117                         down_read(&tty->termios_rwsem);
2118                         continue;
2119                 }
2120                 __set_current_state(TASK_RUNNING);
2121
2122                 /* Deal with packet mode. */
2123                 if (packet && b == buf) {
2124                         if (tty_put_user(tty, TIOCPKT_DATA, b++)) {
2125                                 retval = -EFAULT;
2126                                 b--;
2127                                 break;
2128                         }
2129                         nr--;
2130                 }
2131
2132                 if (ldata->icanon && !L_EXTPROC(tty)) {
2133                         retval = canon_copy_from_read_buf(tty, &b, &nr);
2134                         if (retval == -EAGAIN) {
2135                                 retval = 0;
2136                                 continue;
2137                         } else if (retval)
2138                                 break;
2139                 } else {
2140                         int uncopied;
2141                         /* The copy function takes the read lock and handles
2142                            locking internally for this case */
2143                         uncopied = copy_from_read_buf(tty, &b, &nr);
2144                         uncopied += copy_from_read_buf(tty, &b, &nr);
2145                         if (uncopied) {
2146                                 retval = -EFAULT;
2147                                 break;
2148                         }
2149                 }
2150
2151                 n_tty_check_unthrottle(tty);
2152
2153                 if (b - buf >= minimum)
2154                         break;
2155                 if (time)
2156                         timeout = time;
2157         }
2158         mutex_unlock(&ldata->atomic_read_lock);
2159         remove_wait_queue(&tty->read_wait, &wait);
2160
2161         if (!waitqueue_active(&tty->read_wait))
2162                 ldata->minimum_to_wake = minimum;
2163
2164         __set_current_state(TASK_RUNNING);
2165         if (b - buf)
2166                 retval = b - buf;
2167
2168         n_tty_set_room(tty);
2169         up_read(&tty->termios_rwsem);
2170         return retval;
2171 }
2172
2173 /**
2174  *      n_tty_write             -       write function for tty
2175  *      @tty: tty device
2176  *      @file: file object
2177  *      @buf: userspace buffer pointer
2178  *      @nr: size of I/O
2179  *
2180  *      Write function of the terminal device.  This is serialized with
2181  *      respect to other write callers but not to termios changes, reads
2182  *      and other such events.  Since the receive code will echo characters,
2183  *      thus calling driver write methods, the output_lock is used in
2184  *      the output processing functions called here as well as in the
2185  *      echo processing function to protect the column state and space
2186  *      left in the buffer.
2187  *
2188  *      This code must be sure never to sleep through a hangup.
2189  *
2190  *      Locking: output_lock to protect column state and space left
2191  *               (note that the process_output*() functions take this
2192  *                lock themselves)
2193  */
2194
2195 static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
2196                            const unsigned char *buf, size_t nr)
2197 {
2198         const unsigned char *b = buf;
2199         DECLARE_WAITQUEUE(wait, current);
2200         int c;
2201         ssize_t retval = 0;
2202
2203         /* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
2204         if (L_TOSTOP(tty) && file->f_op->write != redirected_tty_write) {
2205                 retval = tty_check_change(tty);
2206                 if (retval)
2207                         return retval;
2208         }
2209
2210         down_read(&tty->termios_rwsem);
2211
2212         /* Write out any echoed characters that are still pending */
2213         process_echoes(tty);
2214
2215         add_wait_queue(&tty->write_wait, &wait);
2216         while (1) {
2217                 set_current_state(TASK_INTERRUPTIBLE);
2218                 if (signal_pending(current)) {
2219                         retval = -ERESTARTSYS;
2220                         break;
2221                 }
2222                 if (tty_hung_up_p(file) || (tty->link && !tty->link->count)) {
2223                         retval = -EIO;
2224                         break;
2225                 }
2226                 if (O_OPOST(tty)) {
2227                         while (nr > 0) {
2228                                 ssize_t num = process_output_block(tty, b, nr);
2229                                 if (num < 0) {
2230                                         if (num == -EAGAIN)
2231                                                 break;
2232                                         retval = num;
2233                                         goto break_out;
2234                                 }
2235                                 b += num;
2236                                 nr -= num;
2237                                 if (nr == 0)
2238                                         break;
2239                                 c = *b;
2240                                 if (process_output(c, tty) < 0)
2241                                         break;
2242                                 b++; nr--;
2243                         }
2244                         if (tty->ops->flush_chars)
2245                                 tty->ops->flush_chars(tty);
2246                 } else {
2247                         while (nr > 0) {
2248                                 c = tty->ops->write(tty, b, nr);
2249                                 if (c < 0) {
2250                                         retval = c;
2251                                         goto break_out;
2252                                 }
2253                                 if (!c)
2254                                         break;
2255                                 b += c;
2256                                 nr -= c;
2257                         }
2258                 }
2259                 if (!nr)
2260                         break;
2261                 if (file->f_flags & O_NONBLOCK) {
2262                         retval = -EAGAIN;
2263                         break;
2264                 }
2265                 up_read(&tty->termios_rwsem);
2266
2267                 schedule();
2268
2269                 down_read(&tty->termios_rwsem);
2270         }
2271 break_out:
2272         __set_current_state(TASK_RUNNING);
2273         remove_wait_queue(&tty->write_wait, &wait);
2274         if (b - buf != nr && tty->fasync)
2275                 set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
2276         up_read(&tty->termios_rwsem);
2277         return (b - buf) ? b - buf : retval;
2278 }
2279
2280 /**
2281  *      n_tty_poll              -       poll method for N_TTY
2282  *      @tty: terminal device
2283  *      @file: file accessing it
2284  *      @wait: poll table
2285  *
2286  *      Called when the line discipline is asked to poll() for data or
2287  *      for special events. This code is not serialized with respect to
2288  *      other events save open/close.
2289  *
2290  *      This code must be sure never to sleep through a hangup.
2291  *      Called without the kernel lock held - fine
2292  */
2293
2294 static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
2295                                                         poll_table *wait)
2296 {
2297         struct n_tty_data *ldata = tty->disc_data;
2298         unsigned int mask = 0;
2299
2300         poll_wait(file, &tty->read_wait, wait);
2301         poll_wait(file, &tty->write_wait, wait);
2302         if (input_available_p(tty, TIME_CHAR(tty) ? 0 : MIN_CHAR(tty)))
2303                 mask |= POLLIN | POLLRDNORM;
2304         if (tty->packet && tty->link->ctrl_status)
2305                 mask |= POLLPRI | POLLIN | POLLRDNORM;
2306         if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
2307                 mask |= POLLHUP;
2308         if (tty_hung_up_p(file))
2309                 mask |= POLLHUP;
2310         if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
2311                 if (MIN_CHAR(tty) && !TIME_CHAR(tty))
2312                         ldata->minimum_to_wake = MIN_CHAR(tty);
2313                 else
2314                         ldata->minimum_to_wake = 1;
2315         }
2316         if (tty->ops->write && !tty_is_writelocked(tty) &&
2317                         tty_chars_in_buffer(tty) < WAKEUP_CHARS &&
2318                         tty_write_room(tty) > 0)
2319                 mask |= POLLOUT | POLLWRNORM;
2320         return mask;
2321 }
2322
2323 static unsigned long inq_canon(struct n_tty_data *ldata)
2324 {
2325         size_t nr, head, tail;
2326
2327         if (ldata->canon_head == ldata->read_tail)
2328                 return 0;
2329         head = ldata->canon_head;
2330         tail = ldata->read_tail;
2331         nr = head - tail;
2332         /* Skip EOF-chars.. */
2333         while (head != tail) {
2334                 if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) &&
2335                     read_buf(ldata, tail) == __DISABLED_CHAR)
2336                         nr--;
2337                 tail++;
2338         }
2339         return nr;
2340 }
2341
2342 static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
2343                        unsigned int cmd, unsigned long arg)
2344 {
2345         struct n_tty_data *ldata = tty->disc_data;
2346         int retval;
2347
2348         switch (cmd) {
2349         case TIOCOUTQ:
2350                 return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2351         case TIOCINQ:
2352                 down_write(&tty->termios_rwsem);
2353                 if (L_ICANON(tty))
2354                         retval = inq_canon(ldata);
2355                 else
2356                         retval = read_cnt(ldata);
2357                 up_write(&tty->termios_rwsem);
2358                 return put_user(retval, (unsigned int __user *) arg);
2359         default:
2360                 return n_tty_ioctl_helper(tty, file, cmd, arg);
2361         }
2362 }
2363
2364 static void n_tty_fasync(struct tty_struct *tty, int on)
2365 {
2366         struct n_tty_data *ldata = tty->disc_data;
2367
2368         if (!waitqueue_active(&tty->read_wait)) {
2369                 if (on)
2370                         ldata->minimum_to_wake = 1;
2371                 else if (!tty->fasync)
2372                         ldata->minimum_to_wake = N_TTY_BUF_SIZE;
2373         }
2374 }
2375
2376 struct tty_ldisc_ops tty_ldisc_N_TTY = {
2377         .magic           = TTY_LDISC_MAGIC,
2378         .name            = "n_tty",
2379         .open            = n_tty_open,
2380         .close           = n_tty_close,
2381         .flush_buffer    = n_tty_flush_buffer,
2382         .chars_in_buffer = n_tty_chars_in_buffer,
2383         .read            = n_tty_read,
2384         .write           = n_tty_write,
2385         .ioctl           = n_tty_ioctl,
2386         .set_termios     = n_tty_set_termios,
2387         .poll            = n_tty_poll,
2388         .receive_buf     = n_tty_receive_buf,
2389         .write_wakeup    = n_tty_write_wakeup,
2390         .fasync          = n_tty_fasync,
2391         .receive_buf2    = n_tty_receive_buf2,
2392 };
2393
2394 /**
2395  *      n_tty_inherit_ops       -       inherit N_TTY methods
2396  *      @ops: struct tty_ldisc_ops where to save N_TTY methods
2397  *
2398  *      Enables a 'subclass' line discipline to 'inherit' N_TTY
2399  *      methods.
2400  */
2401
2402 void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
2403 {
2404         *ops = tty_ldisc_N_TTY;
2405         ops->owner = NULL;
2406         ops->refcount = ops->flags = 0;
2407 }
2408 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);