drivers/tty/n_tty.c

   1 /*
   2  * n_tty.c --- implements the N_TTY line discipline.
   3  *
   4  * This code used to be in tty_io.c, but things are getting hairy
   5  * enough that it made sense to split things off.  (The N_TTY
   6  * processing has changed so much that it's hardly recognizable,
   7  * anyway...)
   8  *
   9  * Note that the open routine for N_TTY is guaranteed never to return
  10  * an error.  This is because Linux will fall back to setting a line
  11  * to N_TTY if it can not switch to any other line discipline.
  12  *
  13  * Written by Theodore Ts'o, Copyright 1994.
  14  *
  15  * This file also contains code originally written by Linus Torvalds,
  16  * Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
  17  *
  18  * This file may be redistributed under the terms of the GNU General Public
  19  * License.
  20  *
  21  * Reduced memory usage for older ARM systems  - Russell King.
  22  *
  23  * 2000/01/20   Fixed SMP locking on put_tty_queue using bits of
  24  *              the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
  25  *              who actually finally proved there really was a race.
  26  *
  27  * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
  28  *              waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
  29  *              Also fixed a bug in BLOCKING mode where n_tty_write returns
  30  *              EAGAIN
  31  */
  32
  33 #include <linux/types.h>
  34 #include <linux/major.h>
  35 #include <linux/errno.h>
  36 #include <linux/signal.h>
  37 #include <linux/fcntl.h>
  38 #include <linux/sched.h>
  39 #include <linux/interrupt.h>
  40 #include <linux/tty.h>
  41 #include <linux/timer.h>
  42 #include <linux/ctype.h>
  43 #include <linux/mm.h>
  44 #include <linux/string.h>
  45 #include <linux/slab.h>
  46 #include <linux/poll.h>
  47 #include <linux/bitops.h>
  48 #include <linux/audit.h>
  49 #include <linux/file.h>
  50 #include <linux/uaccess.h>
  51 #include <linux/module.h>
  52 #include <linux/ratelimit.h>
  53
  54
  55 /* number of characters left in xmit buffer before select has we have room */
  56 #define WAKEUP_CHARS 256
  57
  58 /*
  59  * This defines the low- and high-watermarks for throttling and
  60  * unthrottling the TTY driver.  These watermarks are used for
  61  * controlling the space in the read buffer.
  62  */
  63 #define TTY_THRESHOLD_THROTTLE          128 /* now based on remaining room */
  64 #define TTY_THRESHOLD_UNTHROTTLE        128
  65
  66 /*
  67  * Special byte codes used in the echo buffer to represent operations
  68  * or special handling of characters.  Bytes in the echo buffer that
  69  * are not part of such special blocks are treated as normal character
  70  * codes.
  71  */
  72 #define ECHO_OP_START 0xff
  73 #define ECHO_OP_MOVE_BACK_COL 0x80
  74 #define ECHO_OP_SET_CANON_COL 0x81
  75 #define ECHO_OP_ERASE_TAB 0x82
  76
  77 #define ECHO_COMMIT_WATERMARK   256
  78 #define ECHO_BLOCK              256
  79 #define ECHO_DISCARD_WATERMARK  N_TTY_BUF_SIZE - (ECHO_BLOCK + 32)
  80
  81
  82 #undef N_TTY_TRACE
  83 #ifdef N_TTY_TRACE
  84 # define n_tty_trace(f, args...)        trace_printk(f, ##args)
  85 #else
  86 # define n_tty_trace(f, args...)
  87 #endif
  88
  89 struct n_tty_data {
  90         /* producer-published */
  91         size_t read_head;
  92         size_t canon_head;
  93         size_t echo_head;
  94         size_t echo_commit;
  95         DECLARE_BITMAP(char_map, 256);
  96
  97         /* private to n_tty_receive_overrun (single-threaded) */
  98         unsigned long overrun_time;
  99         int num_overrun;
 100
 101         /* non-atomic */
 102         bool no_room;
 103
 104         /* must hold exclusive termios_rwsem to reset these */
 105         unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
 106
 107         /* shared by producer and consumer */
 108         char read_buf[N_TTY_BUF_SIZE];
 109         DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
 110         unsigned char echo_buf[N_TTY_BUF_SIZE];
 111
 112         int minimum_to_wake;
 113
 114         /* consumer-published */
 115         size_t read_tail;
 116         size_t line_start;
 117
 118         /* protected by output lock */
 119         unsigned int column;
 120         unsigned int canon_column;
 121         size_t echo_tail;
 122
 123         struct mutex atomic_read_lock;
 124         struct mutex output_lock;
 125 };
 126
 127 static inline size_t read_cnt(struct n_tty_data *ldata)
 128 {
 129         return ldata->read_head - ldata->read_tail;
 130 }
 131
 132 static inline unsigned char read_buf(struct n_tty_data *ldata, size_t i)
 133 {
 134         return ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
 135 }
 136
 137 static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i)
 138 {
 139         return &ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
 140 }
 141
 142 static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i)
 143 {
 144         return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
 145 }
 146
 147 static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
 148 {
 149         return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
 150 }
 151
 152 static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
 153                                unsigned char __user *ptr)
 154 {
 155         struct n_tty_data *ldata = tty->disc_data;
 156
 157         tty_audit_add_data(tty, &x, 1, ldata->icanon);
 158         return put_user(x, ptr);
 159 }
 160
 161 static int receive_room(struct tty_struct *tty)
 162 {
 163         struct n_tty_data *ldata = tty->disc_data;
 164         int left;
 165
 166         if (I_PARMRK(tty)) {
 167                 /* Multiply read_cnt by 3, since each byte might take up to
 168                  * three times as many spaces when PARMRK is set (depending on
 169                  * its flags, e.g. parity error). */
 170                 left = N_TTY_BUF_SIZE - read_cnt(ldata) * 3 - 1;
 171         } else
 172                 left = N_TTY_BUF_SIZE - read_cnt(ldata) - 1;
 173
 174         /*
 175          * If we are doing input canonicalization, and there are no
 176          * pending newlines, let characters through without limit, so
 177          * that erase characters will be handled.  Other excess
 178          * characters will be beeped.
 179          */
 180         if (left <= 0)
 181                 left = ldata->icanon && ldata->canon_head == ldata->read_tail;
 182
 183         return left;
 184 }
 185
 186 /**
 187  *      n_tty_set_room  -       receive space
 188  *      @tty: terminal
 189  *
 190  *      Re-schedules the flip buffer work if space just became available.
 191  *
 192  *      Caller holds exclusive termios_rwsem
 193  *         or
 194  *      n_tty_read()/consumer path:
 195  *              holds non-exclusive termios_rwsem
 196  */
 197
 198 static void n_tty_set_room(struct tty_struct *tty)
 199 {
 200         struct n_tty_data *ldata = tty->disc_data;
 201
 202         /* Did this open up the receive buffer? We may need to flip */
 203         if (unlikely(ldata->no_room) && receive_room(tty)) {
 204                 ldata->no_room = 0;
 205
 206                 WARN_RATELIMIT(tty->port->itty == NULL,
 207                                 "scheduling with invalid itty\n");
 208                 /* see if ldisc has been killed - if so, this means that
 209                  * even though the ldisc has been halted and ->buf.work
 210                  * cancelled, ->buf.work is about to be rescheduled
 211                  */
 212                 WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
 213                                "scheduling buffer work for halted ldisc\n");
 214                 queue_work(system_unbound_wq, &tty->port->buf.work);
 215         }
 216 }
 217
 218 static ssize_t chars_in_buffer(struct tty_struct *tty)
 219 {
 220         struct n_tty_data *ldata = tty->disc_data;
 221         ssize_t n = 0;
 222
 223         if (!ldata->icanon)
 224                 n = read_cnt(ldata);
 225         else
 226                 n = ldata->canon_head - ldata->read_tail;
 227         return n;
 228 }
 229
 230 /**
 231  *      n_tty_write_wakeup      -       asynchronous I/O notifier
 232  *      @tty: tty device
 233  *
 234  *      Required for the ptys, serial driver etc. since processes
 235  *      that attach themselves to the master and rely on ASYNC
 236  *      IO must be woken up
 237  */
 238
 239 static void n_tty_write_wakeup(struct tty_struct *tty)
 240 {
 241         if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
 242                 kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
 243 }
 244
 245 static void n_tty_check_throttle(struct tty_struct *tty)
 246 {
 247         if (tty->driver->type == TTY_DRIVER_TYPE_PTY)
 248                 return;
 249         /*
 250          * Check the remaining room for the input canonicalization
 251          * mode.  We don't want to throttle the driver if we're in
 252          * canonical mode and don't have a newline yet!
 253          */
 254         while (1) {
 255                 int throttled;
 256                 tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
 257                 if (receive_room(tty) >= TTY_THRESHOLD_THROTTLE)
 258                         break;
 259                 throttled = tty_throttle_safe(tty);
 260                 if (!throttled)
 261                         break;
 262         }
 263         __tty_set_flow_change(tty, 0);
 264 }
 265
 266 static inline void n_tty_check_unthrottle(struct tty_struct *tty)
 267 {
 268         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
 269             tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
 270                 if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
 271                         return;
 272                 if (!tty->count)
 273                         return;
 274                 n_tty_set_room(tty);
 275                 n_tty_write_wakeup(tty->link);
 276                 wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
 277                 return;
 278         }
 279
 280         /* If there is enough space in the read buffer now, let the
 281          * low-level driver know. We use chars_in_buffer() to
 282          * check the buffer, as it now knows about canonical mode.
 283          * Otherwise, if the driver is throttled and the line is
 284          * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
 285          * we won't get any more characters.
 286          */
 287
 288         while (1) {
 289                 int unthrottled;
 290                 tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
 291                 if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
 292                         break;
 293                 if (!tty->count)
 294                         break;
 295                 n_tty_set_room(tty);
 296                 unthrottled = tty_unthrottle_safe(tty);
 297                 if (!unthrottled)
 298                         break;
 299         }
 300         __tty_set_flow_change(tty, 0);
 301 }
 302
 303 /**
 304  *      put_tty_queue           -       add character to tty
 305  *      @c: character
 306  *      @ldata: n_tty data
 307  *
 308  *      Add a character to the tty read_buf queue.
 309  *
 310  *      n_tty_receive_buf()/producer path:
 311  *              caller holds non-exclusive termios_rwsem
 312  *              modifies read_head
 313  *
 314  *      read_head is only considered 'published' if canonical mode is
 315  *      not active.
 316  */
 317
 318 static void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
 319 {
 320         if (read_cnt(ldata) < N_TTY_BUF_SIZE) {
 321                 *read_buf_addr(ldata, ldata->read_head) = c;
 322                 ldata->read_head++;
 323         }
 324 }
 325
 326 /**
 327  *      reset_buffer_flags      -       reset buffer state
 328  *      @tty: terminal to reset
 329  *
 330  *      Reset the read buffer counters and clear the flags.
 331  *      Called from n_tty_open() and n_tty_flush_buffer().
 332  *
 333  *      Locking: caller holds exclusive termios_rwsem
 334  *               (or locking is not required)
 335  */
 336
 337 static void reset_buffer_flags(struct n_tty_data *ldata)
 338 {
 339         ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
 340         ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
 341         ldata->line_start = 0;
 342
 343         ldata->erasing = 0;
 344         bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
 345 }
 346
 347 static void n_tty_packet_mode_flush(struct tty_struct *tty)
 348 {
 349         unsigned long flags;
 350
 351         spin_lock_irqsave(&tty->ctrl_lock, flags);
 352         if (tty->link->packet) {
 353                 tty->ctrl_status |= TIOCPKT_FLUSHREAD;
 354                 wake_up_interruptible(&tty->link->read_wait);
 355         }
 356         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 357 }
 358
 359 /**
 360  *      n_tty_flush_buffer      -       clean input queue
 361  *      @tty:   terminal device
 362  *
 363  *      Flush the input buffer. Called when the tty layer wants the
 364  *      buffer flushed (eg at hangup) or when the N_TTY line discipline
 365  *      internally has to clean the pending queue (for example some signals).
 366  *
 367  *      Holds termios_rwsem to exclude producer/consumer while
 368  *      buffer indices are reset.
 369  *
 370  *      Locking: ctrl_lock, exclusive termios_rwsem
 371  */
 372
 373 static void n_tty_flush_buffer(struct tty_struct *tty)
 374 {
 375         down_write(&tty->termios_rwsem);
 376         reset_buffer_flags(tty->disc_data);
 377         n_tty_set_room(tty);
 378
 379         if (tty->link)
 380                 n_tty_packet_mode_flush(tty);
 381         up_write(&tty->termios_rwsem);
 382 }
 383
 384 /**
 385  *      n_tty_chars_in_buffer   -       report available bytes
 386  *      @tty: tty device
 387  *
 388  *      Report the number of characters buffered to be delivered to user
 389  *      at this instant in time.
 390  *
 391  *      Locking: exclusive termios_rwsem
 392  */
 393
 394 static ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
 395 {
 396         ssize_t n;
 397
 398         WARN_ONCE(1, "%s is deprecated and scheduled for removal.", __func__);
 399
 400         down_write(&tty->termios_rwsem);
 401         n = chars_in_buffer(tty);
 402         up_write(&tty->termios_rwsem);
 403         return n;
 404 }
 405
 406 /**
 407  *      is_utf8_continuation    -       utf8 multibyte check
 408  *      @c: byte to check
 409  *
 410  *      Returns true if the utf8 character 'c' is a multibyte continuation
 411  *      character. We use this to correctly compute the on screen size
 412  *      of the character when printing
 413  */
 414
 415 static inline int is_utf8_continuation(unsigned char c)
 416 {
 417         return (c & 0xc0) == 0x80;
 418 }
 419
 420 /**
 421  *      is_continuation         -       multibyte check
 422  *      @c: byte to check
 423  *
 424  *      Returns true if the utf8 character 'c' is a multibyte continuation
 425  *      character and the terminal is in unicode mode.
 426  */
 427
 428 static inline int is_continuation(unsigned char c, struct tty_struct *tty)
 429 {
 430         return I_IUTF8(tty) && is_utf8_continuation(c);
 431 }
 432
 433 /**
 434  *      do_output_char                  -       output one character
 435  *      @c: character (or partial unicode symbol)
 436  *      @tty: terminal device
 437  *      @space: space available in tty driver write buffer
 438  *
 439  *      This is a helper function that handles one output character
 440  *      (including special characters like TAB, CR, LF, etc.),
 441  *      doing OPOST processing and putting the results in the
 442  *      tty driver's write buffer.
 443  *
 444  *      Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY
 445  *      and NLDLY.  They simply aren't relevant in the world today.
 446  *      If you ever need them, add them here.
 447  *
 448  *      Returns the number of bytes of buffer space used or -1 if
 449  *      no space left.
 450  *
 451  *      Locking: should be called under the output_lock to protect
 452  *               the column state and space left in the buffer
 453  */
 454
 455 static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
 456 {
 457         struct n_tty_data *ldata = tty->disc_data;
 458         int     spaces;
 459
 460         if (!space)
 461                 return -1;
 462
 463         switch (c) {
 464         case '\n':
 465                 if (O_ONLRET(tty))
 466                         ldata->column = 0;
 467                 if (O_ONLCR(tty)) {
 468                         if (space < 2)
 469                                 return -1;
 470                         ldata->canon_column = ldata->column = 0;
 471                         tty->ops->write(tty, "\r\n", 2);
 472                         return 2;
 473                 }
 474                 ldata->canon_column = ldata->column;
 475                 break;
 476         case '\r':
 477                 if (O_ONOCR(tty) && ldata->column == 0)
 478                         return 0;
 479                 if (O_OCRNL(tty)) {
 480                         c = '\n';
 481                         if (O_ONLRET(tty))
 482                                 ldata->canon_column = ldata->column = 0;
 483                         break;
 484                 }
 485                 ldata->canon_column = ldata->column = 0;
 486                 break;
 487         case '\t':
 488                 spaces = 8 - (ldata->column & 7);
 489                 if (O_TABDLY(tty) == XTABS) {
 490                         if (space < spaces)
 491                                 return -1;
 492                         ldata->column += spaces;
 493                         tty->ops->write(tty, "        ", spaces);
 494                         return spaces;
 495                 }
 496                 ldata->column += spaces;
 497                 break;
 498         case '\b':
 499                 if (ldata->column > 0)
 500                         ldata->column--;
 501                 break;
 502         default:
 503                 if (!iscntrl(c)) {
 504                         if (O_OLCUC(tty))
 505                                 c = toupper(c);
 506                         if (!is_continuation(c, tty))
 507                                 ldata->column++;
 508                 }
 509                 break;
 510         }
 511
 512         tty_put_char(tty, c);
 513         return 1;
 514 }
 515
 516 /**
 517  *      process_output                  -       output post processor
 518  *      @c: character (or partial unicode symbol)
 519  *      @tty: terminal device
 520  *
 521  *      Output one character with OPOST processing.
 522  *      Returns -1 when the output device is full and the character
 523  *      must be retried.
 524  *
 525  *      Locking: output_lock to protect column state and space left
 526  *               (also, this is called from n_tty_write under the
 527  *                tty layer write lock)
 528  */
 529
 530 static int process_output(unsigned char c, struct tty_struct *tty)
 531 {
 532         struct n_tty_data *ldata = tty->disc_data;
 533         int     space, retval;
 534
 535         mutex_lock(&ldata->output_lock);
 536
 537         space = tty_write_room(tty);
 538         retval = do_output_char(c, tty, space);
 539
 540         mutex_unlock(&ldata->output_lock);
 541         if (retval < 0)
 542                 return -1;
 543         else
 544                 return 0;
 545 }
 546
 547 /**
 548  *      process_output_block            -       block post processor
 549  *      @tty: terminal device
 550  *      @buf: character buffer
 551  *      @nr: number of bytes to output
 552  *
 553  *      Output a block of characters with OPOST processing.
 554  *      Returns the number of characters output.
 555  *
 556  *      This path is used to speed up block console writes, among other
 557  *      things when processing blocks of output data. It handles only
 558  *      the simple cases normally found and helps to generate blocks of
 559  *      symbols for the console driver and thus improve performance.
 560  *
 561  *      Locking: output_lock to protect column state and space left
 562  *               (also, this is called from n_tty_write under the
 563  *                tty layer write lock)
 564  */
 565
 566 static ssize_t process_output_block(struct tty_struct *tty,
 567                                     const unsigned char *buf, unsigned int nr)
 568 {
 569         struct n_tty_data *ldata = tty->disc_data;
 570         int     space;
 571         int     i;
 572         const unsigned char *cp;
 573
 574         mutex_lock(&ldata->output_lock);
 575
 576         space = tty_write_room(tty);
 577         if (!space) {
 578                 mutex_unlock(&ldata->output_lock);
 579                 return 0;
 580         }
 581         if (nr > space)
 582                 nr = space;
 583
 584         for (i = 0, cp = buf; i < nr; i++, cp++) {
 585                 unsigned char c = *cp;
 586
 587                 switch (c) {
 588                 case '\n':
 589                         if (O_ONLRET(tty))
 590                                 ldata->column = 0;
 591                         if (O_ONLCR(tty))
 592                                 goto break_out;
 593                         ldata->canon_column = ldata->column;
 594                         break;
 595                 case '\r':
 596                         if (O_ONOCR(tty) && ldata->column == 0)
 597                                 goto break_out;
 598                         if (O_OCRNL(tty))
 599                                 goto break_out;
 600                         ldata->canon_column = ldata->column = 0;
 601                         break;
 602                 case '\t':
 603                         goto break_out;
 604                 case '\b':
 605                         if (ldata->column > 0)
 606                                 ldata->column--;
 607                         break;
 608                 default:
 609                         if (!iscntrl(c)) {
 610                                 if (O_OLCUC(tty))
 611                                         goto break_out;
 612                                 if (!is_continuation(c, tty))
 613                                         ldata->column++;
 614                         }
 615                         break;
 616                 }
 617         }
 618 break_out:
 619         i = tty->ops->write(tty, buf, i);
 620
 621         mutex_unlock(&ldata->output_lock);
 622         return i;
 623 }
 624
 625 /**
 626  *      process_echoes  -       write pending echo characters
 627  *      @tty: terminal device
 628  *
 629  *      Write previously buffered echo (and other ldisc-generated)
 630  *      characters to the tty.
 631  *
 632  *      Characters generated by the ldisc (including echoes) need to
 633  *      be buffered because the driver's write buffer can fill during
 634  *      heavy program output.  Echoing straight to the driver will
 635  *      often fail under these conditions, causing lost characters and
 636  *      resulting mismatches of ldisc state information.
 637  *
 638  *      Since the ldisc state must represent the characters actually sent
 639  *      to the driver at the time of the write, operations like certain
 640  *      changes in column state are also saved in the buffer and executed
 641  *      here.
 642  *
 643  *      A circular fifo buffer is used so that the most recent characters
 644  *      are prioritized.  Also, when control characters are echoed with a
 645  *      prefixed "^", the pair is treated atomically and thus not separated.
 646  *
 647  *      Locking: callers must hold output_lock
 648  */
 649
 650 static size_t __process_echoes(struct tty_struct *tty)
 651 {
 652         struct n_tty_data *ldata = tty->disc_data;
 653         int     space, old_space;
 654         size_t tail;
 655         unsigned char c;
 656
 657         old_space = space = tty_write_room(tty);
 658
 659         tail = ldata->echo_tail;
 660         while (ldata->echo_commit != tail) {
 661                 c = echo_buf(ldata, tail);
 662                 if (c == ECHO_OP_START) {
 663                         unsigned char op;
 664                         int no_space_left = 0;
 665
 666                         /*
 667                          * If the buffer byte is the start of a multi-byte
 668                          * operation, get the next byte, which is either the
 669                          * op code or a control character value.
 670                          */
 671                         op = echo_buf(ldata, tail + 1);
 672
 673                         switch (op) {
 674                                 unsigned int num_chars, num_bs;
 675
 676                         case ECHO_OP_ERASE_TAB:
 677                                 num_chars = echo_buf(ldata, tail + 2);
 678
 679                                 /*
 680                                  * Determine how many columns to go back
 681                                  * in order to erase the tab.
 682                                  * This depends on the number of columns
 683                                  * used by other characters within the tab
 684                                  * area.  If this (modulo 8) count is from
 685                                  * the start of input rather than from a
 686                                  * previous tab, we offset by canon column.
 687                                  * Otherwise, tab spacing is normal.
 688                                  */
 689                                 if (!(num_chars & 0x80))
 690                                         num_chars += ldata->canon_column;
 691                                 num_bs = 8 - (num_chars & 7);
 692
 693                                 if (num_bs > space) {
 694                                         no_space_left = 1;
 695                                         break;
 696                                 }
 697                                 space -= num_bs;
 698                                 while (num_bs--) {
 699                                         tty_put_char(tty, '\b');
 700                                         if (ldata->column > 0)
 701                                                 ldata->column--;
 702                                 }
 703                                 tail += 3;
 704                                 break;
 705
 706                         case ECHO_OP_SET_CANON_COL:
 707                                 ldata->canon_column = ldata->column;
 708                                 tail += 2;
 709                                 break;
 710
 711                         case ECHO_OP_MOVE_BACK_COL:
 712                                 if (ldata->column > 0)
 713                                         ldata->column--;
 714                                 tail += 2;
 715                                 break;
 716
 717                         case ECHO_OP_START:
 718                                 /* This is an escaped echo op start code */
 719                                 if (!space) {
 720                                         no_space_left = 1;
 721                                         break;
 722                                 }
 723                                 tty_put_char(tty, ECHO_OP_START);
 724                                 ldata->column++;
 725                                 space--;
 726                                 tail += 2;
 727                                 break;
 728
 729                         default:
 730                                 /*
 731                                  * If the op is not a special byte code,
 732                                  * it is a ctrl char tagged to be echoed
 733                                  * as "^X" (where X is the letter
 734                                  * representing the control char).
 735                                  * Note that we must ensure there is
 736                                  * enough space for the whole ctrl pair.
 737                                  *
 738                                  */
 739                                 if (space < 2) {
 740                                         no_space_left = 1;
 741                                         break;
 742                                 }
 743                                 tty_put_char(tty, '^');
 744                                 tty_put_char(tty, op ^ 0100);
 745                                 ldata->column += 2;
 746                                 space -= 2;
 747                                 tail += 2;
 748                         }
 749
 750                         if (no_space_left)
 751                                 break;
 752                 } else {
 753                         if (O_OPOST(tty)) {
 754                                 int retval = do_output_char(c, tty, space);
 755                                 if (retval < 0)
 756                                         break;
 757                                 space -= retval;
 758                         } else {
 759                                 if (!space)
 760                                         break;
 761                                 tty_put_char(tty, c);
 762                                 space -= 1;
 763                         }
 764                         tail += 1;
 765                 }
 766         }
 767
 768         /* If the echo buffer is nearly full (so that the possibility exists
 769          * of echo overrun before the next commit), then discard enough
 770          * data at the tail to prevent a subsequent overrun */
 771         while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
 772                 if (echo_buf(ldata, tail == ECHO_OP_START)) {
 773                         if (echo_buf(ldata, tail) == ECHO_OP_ERASE_TAB)
 774                                 tail += 3;
 775                         else
 776                                 tail += 2;
 777                 } else
 778                         tail++;
 779         }
 780
 781         ldata->echo_tail = tail;
 782         return old_space - space;
 783 }
 784
 785 static void commit_echoes(struct tty_struct *tty)
 786 {
 787         struct n_tty_data *ldata = tty->disc_data;
 788         size_t nr, old, echoed;
 789         size_t head;
 790
 791         head = ldata->echo_head;
 792         old = ldata->echo_commit - ldata->echo_tail;
 793
 794         /* Process committed echoes if the accumulated # of bytes
 795          * is over the threshold (and try again each time another
 796          * block is accumulated) */
 797         nr = head - ldata->echo_tail;
 798         if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK))
 799                 return;
 800
 801         mutex_lock(&ldata->output_lock);
 802         ldata->echo_commit = head;
 803         echoed = __process_echoes(tty);
 804         mutex_unlock(&ldata->output_lock);
 805
 806         if (echoed && tty->ops->flush_chars)
 807                 tty->ops->flush_chars(tty);
 808 }
 809
 810 static void process_echoes(struct tty_struct *tty)
 811 {
 812         struct n_tty_data *ldata = tty->disc_data;
 813         size_t echoed;
 814
 815         if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_tail)
 816                 return;
 817
 818         mutex_lock(&ldata->output_lock);
 819         echoed = __process_echoes(tty);
 820         mutex_unlock(&ldata->output_lock);
 821
 822         if (echoed && tty->ops->flush_chars)
 823                 tty->ops->flush_chars(tty);
 824 }
 825
 826 static void flush_echoes(struct tty_struct *tty)
 827 {
 828         struct n_tty_data *ldata = tty->disc_data;
 829
 830         if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_head)
 831                 return;
 832
 833         mutex_lock(&ldata->output_lock);
 834         ldata->echo_commit = ldata->echo_head;
 835         __process_echoes(tty);
 836         mutex_unlock(&ldata->output_lock);
 837 }
 838
 839 /**
 840  *      add_echo_byte   -       add a byte to the echo buffer
 841  *      @c: unicode byte to echo
 842  *      @ldata: n_tty data
 843  *
 844  *      Add a character or operation byte to the echo buffer.
 845  */
 846
 847 static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
 848 {
 849         *echo_buf_addr(ldata, ldata->echo_head++) = c;
 850 }
 851
 852 /**
 853  *      echo_move_back_col      -       add operation to move back a column
 854  *      @ldata: n_tty data
 855  *
 856  *      Add an operation to the echo buffer to move back one column.
 857  */
 858
 859 static void echo_move_back_col(struct n_tty_data *ldata)
 860 {
 861         add_echo_byte(ECHO_OP_START, ldata);
 862         add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
 863 }
 864
 865 /**
 866  *      echo_set_canon_col      -       add operation to set the canon column
 867  *      @ldata: n_tty data
 868  *
 869  *      Add an operation to the echo buffer to set the canon column
 870  *      to the current column.
 871  */
 872
 873 static void echo_set_canon_col(struct n_tty_data *ldata)
 874 {
 875         add_echo_byte(ECHO_OP_START, ldata);
 876         add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
 877 }
 878
 879 /**
 880  *      echo_erase_tab  -       add operation to erase a tab
 881  *      @num_chars: number of character columns already used
 882  *      @after_tab: true if num_chars starts after a previous tab
 883  *      @ldata: n_tty data
 884  *
 885  *      Add an operation to the echo buffer to erase a tab.
 886  *
 887  *      Called by the eraser function, which knows how many character
 888  *      columns have been used since either a previous tab or the start
 889  *      of input.  This information will be used later, along with
 890  *      canon column (if applicable), to go back the correct number
 891  *      of columns.
 892  */
 893
 894 static void echo_erase_tab(unsigned int num_chars, int after_tab,
 895                            struct n_tty_data *ldata)
 896 {
 897         add_echo_byte(ECHO_OP_START, ldata);
 898         add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
 899
 900         /* We only need to know this modulo 8 (tab spacing) */
 901         num_chars &= 7;
 902
 903         /* Set the high bit as a flag if num_chars is after a previous tab */
 904         if (after_tab)
 905                 num_chars |= 0x80;
 906
 907         add_echo_byte(num_chars, ldata);
 908 }
 909
 910 /**
 911  *      echo_char_raw   -       echo a character raw
 912  *      @c: unicode byte to echo
 913  *      @tty: terminal device
 914  *
 915  *      Echo user input back onto the screen. This must be called only when
 916  *      L_ECHO(tty) is true. Called from the driver receive_buf path.
 917  *
 918  *      This variant does not treat control characters specially.
 919  */
 920
 921 static void echo_char_raw(unsigned char c, struct n_tty_data *ldata)
 922 {
 923         if (c == ECHO_OP_START) {
 924                 add_echo_byte(ECHO_OP_START, ldata);
 925                 add_echo_byte(ECHO_OP_START, ldata);
 926         } else {
 927                 add_echo_byte(c, ldata);
 928         }
 929 }
 930
 931 /**
 932  *      echo_char       -       echo a character
 933  *      @c: unicode byte to echo
 934  *      @tty: terminal device
 935  *
 936  *      Echo user input back onto the screen. This must be called only when
 937  *      L_ECHO(tty) is true. Called from the driver receive_buf path.
 938  *
 939  *      This variant tags control characters to be echoed as "^X"
 940  *      (where X is the letter representing the control char).
 941  */
 942
 943 static void echo_char(unsigned char c, struct tty_struct *tty)
 944 {
 945         struct n_tty_data *ldata = tty->disc_data;
 946
 947         if (c == ECHO_OP_START) {
 948                 add_echo_byte(ECHO_OP_START, ldata);
 949                 add_echo_byte(ECHO_OP_START, ldata);
 950         } else {
 951                 if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
 952                         add_echo_byte(ECHO_OP_START, ldata);
 953                 add_echo_byte(c, ldata);
 954         }
 955 }
 956
 957 /**
 958  *      finish_erasing          -       complete erase
 959  *      @ldata: n_tty data
 960  */
 961
 962 static inline void finish_erasing(struct n_tty_data *ldata)
 963 {
 964         if (ldata->erasing) {
 965                 echo_char_raw('/', ldata);
 966                 ldata->erasing = 0;
 967         }
 968 }
 969
 970 /**
 971  *      eraser          -       handle erase function
 972  *      @c: character input
 973  *      @tty: terminal device
 974  *
 975  *      Perform erase and necessary output when an erase character is
 976  *      present in the stream from the driver layer. Handles the complexities
 977  *      of UTF-8 multibyte symbols.
 978  *
 979  *      n_tty_receive_buf()/producer path:
 980  *              caller holds non-exclusive termios_rwsem
 981  *              modifies read_head
 982  *
 983  *      Modifying the read_head is not considered a publish in this context
 984  *      because canonical mode is active -- only canon_head publishes
 985  */
 986
 987 static void eraser(unsigned char c, struct tty_struct *tty)
 988 {
 989         struct n_tty_data *ldata = tty->disc_data;
 990         enum { ERASE, WERASE, KILL } kill_type;
 991         size_t head;
 992         size_t cnt;
 993         int seen_alnums;
 994
 995         if (ldata->read_head == ldata->canon_head) {
 996                 /* process_output('\a', tty); */ /* what do you think? */
 997                 return;
 998         }
 999         if (c == ERASE_CHAR(tty))
1000                 kill_type = ERASE;
1001         else if (c == WERASE_CHAR(tty))
1002                 kill_type = WERASE;
1003         else {
1004                 if (!L_ECHO(tty)) {
1005                         ldata->read_head = ldata->canon_head;
1006                         return;
1007                 }
1008                 if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
1009                         ldata->read_head = ldata->canon_head;
1010                         finish_erasing(ldata);
1011                         echo_char(KILL_CHAR(tty), tty);
1012                         /* Add a newline if ECHOK is on and ECHOKE is off. */
1013                         if (L_ECHOK(tty))
1014                                 echo_char_raw('\n', ldata);
1015                         return;
1016                 }
1017                 kill_type = KILL;
1018         }
1019
1020         seen_alnums = 0;
1021         while (ldata->read_head != ldata->canon_head) {
1022                 head = ldata->read_head;
1023
1024                 /* erase a single possibly multibyte character */
1025                 do {
1026                         head--;
1027                         c = read_buf(ldata, head);
1028                 } while (is_continuation(c, tty) && head != ldata->canon_head);
1029
1030                 /* do not partially erase */
1031                 if (is_continuation(c, tty))
1032                         break;
1033
1034                 if (kill_type == WERASE) {
1035                         /* Equivalent to BSD's ALTWERASE. */
1036                         if (isalnum(c) || c == '_')
1037                                 seen_alnums++;
1038                         else if (seen_alnums)
1039                                 break;
1040                 }
1041                 cnt = ldata->read_head - head;
1042                 ldata->read_head = head;
1043                 if (L_ECHO(tty)) {
1044                         if (L_ECHOPRT(tty)) {
1045                                 if (!ldata->erasing) {
1046                                         echo_char_raw('\\', ldata);
1047                                         ldata->erasing = 1;
1048                                 }
1049                                 /* if cnt > 1, output a multi-byte character */
1050                                 echo_char(c, tty);
1051                                 while (--cnt > 0) {
1052                                         head++;
1053                                         echo_char_raw(read_buf(ldata, head), ldata);
1054                                         echo_move_back_col(ldata);
1055                                 }
1056                         } else if (kill_type == ERASE && !L_ECHOE(tty)) {
1057                                 echo_char(ERASE_CHAR(tty), tty);
1058                         } else if (c == '\t') {
1059                                 unsigned int num_chars = 0;
1060                                 int after_tab = 0;
1061                                 size_t tail = ldata->read_head;
1062
1063                                 /*
1064                                  * Count the columns used for characters
1065                                  * since the start of input or after a
1066                                  * previous tab.
1067                                  * This info is used to go back the correct
1068                                  * number of columns.
1069                                  */
1070                                 while (tail != ldata->canon_head) {
1071                                         tail--;
1072                                         c = read_buf(ldata, tail);
1073                                         if (c == '\t') {
1074                                                 after_tab = 1;
1075                                                 break;
1076                                         } else if (iscntrl(c)) {
1077                                                 if (L_ECHOCTL(tty))
1078                                                         num_chars += 2;
1079                                         } else if (!is_continuation(c, tty)) {
1080                                                 num_chars++;
1081                                         }
1082                                 }
1083                                 echo_erase_tab(num_chars, after_tab, ldata);
1084                         } else {
1085                                 if (iscntrl(c) && L_ECHOCTL(tty)) {
1086                                         echo_char_raw('\b', ldata);
1087                                         echo_char_raw(' ', ldata);
1088                                         echo_char_raw('\b', ldata);
1089                                 }
1090                                 if (!iscntrl(c) || L_ECHOCTL(tty)) {
1091                                         echo_char_raw('\b', ldata);
1092                                         echo_char_raw(' ', ldata);
1093                                         echo_char_raw('\b', ldata);
1094                                 }
1095                         }
1096                 }
1097                 if (kill_type == ERASE)
1098                         break;
1099         }
1100         if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
1101                 finish_erasing(ldata);
1102 }
1103
1104 /**
1105  *      isig            -       handle the ISIG optio
1106  *      @sig: signal
1107  *      @tty: terminal
1108  *
1109  *      Called when a signal is being sent due to terminal input.
1110  *      Called from the driver receive_buf path so serialized.
1111  *
1112  *      Locking: ctrl_lock
1113  */
1114
1115 static inline void isig(int sig, struct tty_struct *tty)
1116 {
1117         struct pid *tty_pgrp = tty_get_pgrp(tty);
1118         if (tty_pgrp) {
1119                 kill_pgrp(tty_pgrp, sig, 1);
1120                 put_pid(tty_pgrp);
1121         }
1122 }
1123
1124 /**
1125  *      n_tty_receive_break     -       handle break
1126  *      @tty: terminal
1127  *
1128  *      An RS232 break event has been hit in the incoming bitstream. This
1129  *      can cause a variety of events depending upon the termios settings.
1130  *
1131  *      n_tty_receive_buf()/producer path:
1132  *              caller holds non-exclusive termios_rwsem
1133  *              publishes read_head via put_tty_queue()
1134  *
1135  *      Note: may get exclusive termios_rwsem if flushing input buffer
1136  */
1137
1138 static inline void n_tty_receive_break(struct tty_struct *tty)
1139 {
1140         struct n_tty_data *ldata = tty->disc_data;
1141
1142         if (I_IGNBRK(tty))
1143                 return;
1144         if (I_BRKINT(tty)) {
1145                 isig(SIGINT, tty);
1146                 if (!L_NOFLSH(tty)) {
1147                         /* flushing needs exclusive termios_rwsem */
1148                         up_read(&tty->termios_rwsem);
1149                         n_tty_flush_buffer(tty);
1150                         tty_driver_flush_buffer(tty);
1151                         down_read(&tty->termios_rwsem);
1152                 }
1153                 return;
1154         }
1155         if (I_PARMRK(tty)) {
1156                 put_tty_queue('\377', ldata);
1157                 put_tty_queue('\0', ldata);
1158         }
1159         put_tty_queue('\0', ldata);
1160         wake_up_interruptible(&tty->read_wait);
1161 }
1162
1163 /**
1164  *      n_tty_receive_overrun   -       handle overrun reporting
1165  *      @tty: terminal
1166  *
1167  *      Data arrived faster than we could process it. While the tty
1168  *      driver has flagged this the bits that were missed are gone
1169  *      forever.
1170  *
1171  *      Called from the receive_buf path so single threaded. Does not
1172  *      need locking as num_overrun and overrun_time are function
1173  *      private.
1174  */
1175
1176 static inline void n_tty_receive_overrun(struct tty_struct *tty)
1177 {
1178         struct n_tty_data *ldata = tty->disc_data;
1179         char buf[64];
1180
1181         ldata->num_overrun++;
1182         if (time_after(jiffies, ldata->overrun_time + HZ) ||
1183                         time_after(ldata->overrun_time, jiffies)) {
1184                 printk(KERN_WARNING "%s: %d input overrun(s)\n",
1185                         tty_name(tty, buf),
1186                         ldata->num_overrun);
1187                 ldata->overrun_time = jiffies;
1188                 ldata->num_overrun = 0;
1189         }
1190 }
1191
1192 /**
1193  *      n_tty_receive_parity_error      -       error notifier
1194  *      @tty: terminal device
1195  *      @c: character
1196  *
1197  *      Process a parity error and queue the right data to indicate
1198  *      the error case if necessary.
1199  *
1200  *      n_tty_receive_buf()/producer path:
1201  *              caller holds non-exclusive termios_rwsem
1202  *              publishes read_head via put_tty_queue()
1203  */
1204 static inline void n_tty_receive_parity_error(struct tty_struct *tty,
1205                                               unsigned char c)
1206 {
1207         struct n_tty_data *ldata = tty->disc_data;
1208
1209         if (I_IGNPAR(tty))
1210                 return;
1211         if (I_PARMRK(tty)) {
1212                 put_tty_queue('\377', ldata);
1213                 put_tty_queue('\0', ldata);
1214                 put_tty_queue(c, ldata);
1215         } else  if (I_INPCK(tty))
1216                 put_tty_queue('\0', ldata);
1217         else
1218                 put_tty_queue(c, ldata);
1219         wake_up_interruptible(&tty->read_wait);
1220 }
1221
1222 static void
1223 n_tty_receive_signal_char(struct tty_struct *tty, int signal, unsigned char c)
1224 {
1225         if (!L_NOFLSH(tty)) {
1226                 /* flushing needs exclusive termios_rwsem */
1227                 up_read(&tty->termios_rwsem);
1228                 n_tty_flush_buffer(tty);
1229                 tty_driver_flush_buffer(tty);
1230                 down_read(&tty->termios_rwsem);
1231         }
1232         if (I_IXON(tty))
1233                 start_tty(tty);
1234         if (L_ECHO(tty)) {
1235                 echo_char(c, tty);
1236                 commit_echoes(tty);
1237         }
1238         isig(signal, tty);
1239         return;
1240 }
1241
1242 /**
1243  *      n_tty_receive_char      -       perform processing
1244  *      @tty: terminal device
1245  *      @c: character
1246  *
1247  *      Process an individual character of input received from the driver.
1248  *      This is serialized with respect to itself by the rules for the
1249  *      driver above.
1250  *
1251  *      n_tty_receive_buf()/producer path:
1252  *              caller holds non-exclusive termios_rwsem
1253  *              publishes canon_head if canonical mode is active
1254  *              otherwise, publishes read_head via put_tty_queue()
1255  */
1256
1257 static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
1258 {
1259         struct n_tty_data *ldata = tty->disc_data;
1260         int parmrk;
1261
1262         if (ldata->raw) {
1263                 put_tty_queue(c, ldata);
1264                 return;
1265         }
1266
1267         if (I_ISTRIP(tty))
1268                 c &= 0x7f;
1269         if (I_IUCLC(tty) && L_IEXTEN(tty))
1270                 c = tolower(c);
1271
1272         if (L_EXTPROC(tty)) {
1273                 put_tty_queue(c, ldata);
1274                 return;
1275         }
1276
1277         if (tty->stopped && !tty->flow_stopped && I_IXON(tty) &&
1278             I_IXANY(tty) && c != START_CHAR(tty) && c != STOP_CHAR(tty) &&
1279             c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) && c != SUSP_CHAR(tty)) {
1280                 start_tty(tty);
1281                 process_echoes(tty);
1282         }
1283
1284         if (tty->closing) {
1285                 if (I_IXON(tty)) {
1286                         if (c == START_CHAR(tty)) {
1287                                 start_tty(tty);
1288                                 process_echoes(tty);
1289                         } else if (c == STOP_CHAR(tty))
1290                                 stop_tty(tty);
1291                 }
1292                 return;
1293         }
1294
1295         /*
1296          * If the previous character was LNEXT, or we know that this
1297          * character is not one of the characters that we'll have to
1298          * handle specially, do shortcut processing to speed things
1299          * up.
1300          */
1301         if (!test_bit(c, ldata->char_map) || ldata->lnext) {
1302                 ldata->lnext = 0;
1303                 parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
1304                 if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk - 1)) {
1305                         /* beep if no space */
1306                         if (L_ECHO(tty))
1307                                 process_output('\a', tty);
1308                         return;
1309                 }
1310                 if (L_ECHO(tty)) {
1311                         finish_erasing(ldata);
1312                         /* Record the column of first canon char. */
1313                         if (ldata->canon_head == ldata->read_head)
1314                                 echo_set_canon_col(ldata);
1315                         echo_char(c, tty);
1316                         commit_echoes(tty);
1317                 }
1318                 if (parmrk)
1319                         put_tty_queue(c, ldata);
1320                 put_tty_queue(c, ldata);
1321                 return;
1322         }
1323
1324         if (I_IXON(tty)) {
1325                 if (c == START_CHAR(tty)) {
1326                         start_tty(tty);
1327                         commit_echoes(tty);
1328                         return;
1329                 }
1330                 if (c == STOP_CHAR(tty)) {
1331                         stop_tty(tty);
1332                         return;
1333                 }
1334         }
1335
1336         if (L_ISIG(tty)) {
1337                 if (c == INTR_CHAR(tty)) {
1338                         n_tty_receive_signal_char(tty, SIGINT, c);
1339                         return;
1340                 } else if (c == QUIT_CHAR(tty)) {
1341                         n_tty_receive_signal_char(tty, SIGQUIT, c);
1342                         return;
1343                 } else if (c == SUSP_CHAR(tty)) {
1344                         n_tty_receive_signal_char(tty, SIGTSTP, c);
1345                         return;
1346                 }
1347         }
1348
1349         if (c == '\r') {
1350                 if (I_IGNCR(tty))
1351                         return;
1352                 if (I_ICRNL(tty))
1353                         c = '\n';
1354         } else if (c == '\n' && I_INLCR(tty))
1355                 c = '\r';
1356
1357         if (ldata->icanon) {
1358                 if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
1359                     (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
1360                         eraser(c, tty);
1361                         commit_echoes(tty);
1362                         return;
1363                 }
1364                 if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
1365                         ldata->lnext = 1;
1366                         if (L_ECHO(tty)) {
1367                                 finish_erasing(ldata);
1368                                 if (L_ECHOCTL(tty)) {
1369                                         echo_char_raw('^', ldata);
1370                                         echo_char_raw('\b', ldata);
1371                                         commit_echoes(tty);
1372                                 }
1373                         }
1374                         return;
1375                 }
1376                 if (c == REPRINT_CHAR(tty) && L_ECHO(tty) &&
1377                     L_IEXTEN(tty)) {
1378                         size_t tail = ldata->canon_head;
1379
1380                         finish_erasing(ldata);
1381                         echo_char(c, tty);
1382                         echo_char_raw('\n', ldata);
1383                         while (tail != ldata->read_head) {
1384                                 echo_char(read_buf(ldata, tail), tty);
1385                                 tail++;
1386                         }
1387                         commit_echoes(tty);
1388                         return;
1389                 }
1390                 if (c == '\n') {
1391                         if (read_cnt(ldata) >= N_TTY_BUF_SIZE) {
1392                                 if (L_ECHO(tty))
1393                                         process_output('\a', tty);
1394                                 return;
1395                         }
1396                         if (L_ECHO(tty) || L_ECHONL(tty)) {
1397                                 echo_char_raw('\n', ldata);
1398                                 commit_echoes(tty);
1399                         }
1400                         goto handle_newline;
1401                 }
1402                 if (c == EOF_CHAR(tty)) {
1403                         if (read_cnt(ldata) >= N_TTY_BUF_SIZE)
1404                                 return;
1405                         c = __DISABLED_CHAR;
1406                         goto handle_newline;
1407                 }
1408                 if ((c == EOL_CHAR(tty)) ||
1409                     (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
1410                         parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty))
1411                                  ? 1 : 0;
1412                         if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk)) {
1413                                 if (L_ECHO(tty))
1414                                         process_output('\a', tty);
1415                                 return;
1416                         }
1417                         /*
1418                          * XXX are EOL_CHAR and EOL2_CHAR echoed?!?
1419                          */
1420                         if (L_ECHO(tty)) {
1421                                 /* Record the column of first canon char. */
1422                                 if (ldata->canon_head == ldata->read_head)
1423                                         echo_set_canon_col(ldata);
1424                                 echo_char(c, tty);
1425                                 commit_echoes(tty);
1426                         }
1427                         /*
1428                          * XXX does PARMRK doubling happen for
1429                          * EOL_CHAR and EOL2_CHAR?
1430                          */
1431                         if (parmrk)
1432                                 put_tty_queue(c, ldata);
1433
1434 handle_newline:
1435                         set_bit(ldata->read_head & (N_TTY_BUF_SIZE - 1), ldata->read_flags);
1436                         put_tty_queue(c, ldata);
1437                         ldata->canon_head = ldata->read_head;
1438                         kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1439                         if (waitqueue_active(&tty->read_wait))
1440                                 wake_up_interruptible(&tty->read_wait);
1441                         return;
1442                 }
1443         }
1444
1445         parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
1446         if (read_cnt(ldata) >= (N_TTY_BUF_SIZE - parmrk - 1)) {
1447                 /* beep if no space */
1448                 if (L_ECHO(tty))
1449                         process_output('\a', tty);
1450                 return;
1451         }
1452         if (L_ECHO(tty)) {
1453                 finish_erasing(ldata);
1454                 if (c == '\n')
1455                         echo_char_raw('\n', ldata);
1456                 else {
1457                         /* Record the column of first canon char. */
1458                         if (ldata->canon_head == ldata->read_head)
1459                                 echo_set_canon_col(ldata);
1460                         echo_char(c, tty);
1461                 }
1462                 commit_echoes(tty);
1463         }
1464
1465         if (parmrk)
1466                 put_tty_queue(c, ldata);
1467
1468         put_tty_queue(c, ldata);
1469 }
1470
1471 static void
1472 n_tty_receive_char_flagged(struct tty_struct *tty, unsigned char c, char flag)
1473 {
1474         char buf[64];
1475
1476         switch (flag) {
1477         case TTY_BREAK:
1478                 n_tty_receive_break(tty);
1479                 break;
1480         case TTY_PARITY:
1481         case TTY_FRAME:
1482                 n_tty_receive_parity_error(tty, c);
1483                 break;
1484         case TTY_OVERRUN:
1485                 n_tty_receive_overrun(tty);
1486                 break;
1487         default:
1488                 printk(KERN_ERR "%s: unknown flag %d\n",
1489                        tty_name(tty, buf), flag);
1490                 break;
1491         }
1492 }
1493
1494 /**
1495  *      n_tty_receive_buf       -       data receive
1496  *      @tty: terminal device
1497  *      @cp: buffer
1498  *      @fp: flag buffer
1499  *      @count: characters
1500  *
1501  *      Called by the terminal driver when a block of characters has
1502  *      been received. This function must be called from soft contexts
1503  *      not from interrupt context. The driver is responsible for making
1504  *      calls one at a time and in order (or using flush_to_ldisc)
1505  *
1506  *      n_tty_receive_buf()/producer path:
1507  *              claims non-exclusive termios_rwsem
1508  *              publishes read_head and canon_head
1509  */
1510
1511 static void
1512 n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
1513                            char *fp, int count)
1514 {
1515         struct n_tty_data *ldata = tty->disc_data;
1516         size_t n, head;
1517
1518         head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1519         n = N_TTY_BUF_SIZE - max(read_cnt(ldata), head);
1520         n = min_t(size_t, count, n);
1521         memcpy(read_buf_addr(ldata, head), cp, n);
1522         ldata->read_head += n;
1523         cp += n;
1524         count -= n;
1525
1526         head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1527         n = N_TTY_BUF_SIZE - max(read_cnt(ldata), head);
1528         n = min_t(size_t, count, n);
1529         memcpy(read_buf_addr(ldata, head), cp, n);
1530         ldata->read_head += n;
1531 }
1532
1533 static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
1534                           char *fp, int count)
1535 {
1536         struct n_tty_data *ldata = tty->disc_data;
1537
1538         if (ldata->real_raw)
1539                 n_tty_receive_buf_real_raw(tty, cp, fp, count);
1540         else {
1541                 char flag = TTY_NORMAL;
1542
1543                 while (count--) {
1544                         if (fp)
1545                                 flag = *fp++;
1546                         if (likely(flag == TTY_NORMAL))
1547                                 n_tty_receive_char(tty, *cp++);
1548                         else
1549                                 n_tty_receive_char_flagged(tty, *cp++, flag);
1550                 }
1551
1552                 flush_echoes(tty);
1553                 if (tty->ops->flush_chars)
1554                         tty->ops->flush_chars(tty);
1555         }
1556
1557         if ((!ldata->icanon && (read_cnt(ldata) >= ldata->minimum_to_wake)) ||
1558                 L_EXTPROC(tty)) {
1559                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1560                 if (waitqueue_active(&tty->read_wait))
1561                         wake_up_interruptible(&tty->read_wait);
1562         }
1563 }
1564
1565 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
1566                               char *fp, int count)
1567 {
1568         down_read(&tty->termios_rwsem);
1569         __receive_buf(tty, cp, fp, count);
1570         n_tty_check_throttle(tty);
1571         up_read(&tty->termios_rwsem);
1572 }
1573
1574 static int n_tty_receive_buf2(struct tty_struct *tty, const unsigned char *cp,
1575                               char *fp, int count)
1576 {
1577         struct n_tty_data *ldata = tty->disc_data;
1578         int room;
1579
1580         down_read(&tty->termios_rwsem);
1581
1582         tty->receive_room = room = receive_room(tty);
1583         if (!room)
1584                 ldata->no_room = 1;
1585         count = min(count, room);
1586         if (count) {
1587                 __receive_buf(tty, cp, fp, count);
1588                 n_tty_check_throttle(tty);
1589         }
1590
1591         up_read(&tty->termios_rwsem);
1592
1593         return count;
1594 }
1595
1596 int is_ignored(int sig)
1597 {
1598         return (sigismember(&current->blocked, sig) ||
1599                 current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
1600 }
1601
1602 /**
1603  *      n_tty_set_termios       -       termios data changed
1604  *      @tty: terminal
1605  *      @old: previous data
1606  *
1607  *      Called by the tty layer when the user changes termios flags so
1608  *      that the line discipline can plan ahead. This function cannot sleep
1609  *      and is protected from re-entry by the tty layer. The user is
1610  *      guaranteed that this function will not be re-entered or in progress
1611  *      when the ldisc is closed.
1612  *
1613  *      Locking: Caller holds tty->termios_rwsem
1614  */
1615
1616 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
1617 {
1618         struct n_tty_data *ldata = tty->disc_data;
1619         int canon_change = 1;
1620
1621         if (old)
1622                 canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
1623         if (canon_change) {
1624                 bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
1625                 ldata->line_start = 0;
1626                 ldata->canon_head = ldata->read_tail;
1627                 ldata->erasing = 0;
1628                 ldata->lnext = 0;
1629         }
1630
1631         if (canon_change && !L_ICANON(tty) && read_cnt(ldata))
1632                 wake_up_interruptible(&tty->read_wait);
1633
1634         ldata->icanon = (L_ICANON(tty) != 0);
1635
1636         if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
1637             I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
1638             I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
1639             I_PARMRK(tty)) {
1640                 bitmap_zero(ldata->char_map, 256);
1641
1642                 if (I_IGNCR(tty) || I_ICRNL(tty))
1643                         set_bit('\r', ldata->char_map);
1644                 if (I_INLCR(tty))
1645                         set_bit('\n', ldata->char_map);
1646
1647                 if (L_ICANON(tty)) {
1648                         set_bit(ERASE_CHAR(tty), ldata->char_map);
1649                         set_bit(KILL_CHAR(tty), ldata->char_map);
1650                         set_bit(EOF_CHAR(tty), ldata->char_map);
1651                         set_bit('\n', ldata->char_map);
1652                         set_bit(EOL_CHAR(tty), ldata->char_map);
1653                         if (L_IEXTEN(tty)) {
1654                                 set_bit(WERASE_CHAR(tty), ldata->char_map);
1655                                 set_bit(LNEXT_CHAR(tty), ldata->char_map);
1656                                 set_bit(EOL2_CHAR(tty), ldata->char_map);
1657                                 if (L_ECHO(tty))
1658                                         set_bit(REPRINT_CHAR(tty),
1659                                                 ldata->char_map);
1660                         }
1661                 }
1662                 if (I_IXON(tty)) {
1663                         set_bit(START_CHAR(tty), ldata->char_map);
1664                         set_bit(STOP_CHAR(tty), ldata->char_map);
1665                 }
1666                 if (L_ISIG(tty)) {
1667                         set_bit(INTR_CHAR(tty), ldata->char_map);
1668                         set_bit(QUIT_CHAR(tty), ldata->char_map);
1669                         set_bit(SUSP_CHAR(tty), ldata->char_map);
1670                 }
1671                 clear_bit(__DISABLED_CHAR, ldata->char_map);
1672                 ldata->raw = 0;
1673                 ldata->real_raw = 0;
1674         } else {
1675                 ldata->raw = 1;
1676                 if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1677                     (I_IGNPAR(tty) || !I_INPCK(tty)) &&
1678                     (tty->driver->flags & TTY_DRIVER_REAL_RAW))
1679                         ldata->real_raw = 1;
1680                 else
1681                         ldata->real_raw = 0;
1682         }
1683         n_tty_set_room(tty);
1684         /*
1685          * Fix tty hang when I_IXON(tty) is cleared, but the tty
1686          * been stopped by STOP_CHAR(tty) before it.
1687          */
1688         if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) {
1689                 start_tty(tty);
1690         }
1691
1692         /* The termios change make the tty ready for I/O */
1693         wake_up_interruptible(&tty->write_wait);
1694         wake_up_interruptible(&tty->read_wait);
1695 }
1696
1697 /**
1698  *      n_tty_close             -       close the ldisc for this tty
1699  *      @tty: device
1700  *
1701  *      Called from the terminal layer when this line discipline is
1702  *      being shut down, either because of a close or becsuse of a
1703  *      discipline change. The function will not be called while other
1704  *      ldisc methods are in progress.
1705  */
1706
1707 static void n_tty_close(struct tty_struct *tty)
1708 {
1709         struct n_tty_data *ldata = tty->disc_data;
1710
1711         if (tty->link)
1712                 n_tty_packet_mode_flush(tty);
1713
1714         vfree(ldata);
1715         tty->disc_data = NULL;
1716 }
1717
1718 /**
1719  *      n_tty_open              -       open an ldisc
1720  *      @tty: terminal to open
1721  *
1722  *      Called when this line discipline is being attached to the
1723  *      terminal device. Can sleep. Called serialized so that no
1724  *      other events will occur in parallel. No further open will occur
1725  *      until a close.
1726  */
1727
1728 static int n_tty_open(struct tty_struct *tty)
1729 {
1730         struct n_tty_data *ldata;
1731
1732         /* Currently a malloc failure here can panic */
1733         ldata = vmalloc(sizeof(*ldata));
1734         if (!ldata)
1735                 goto err;
1736
1737         ldata->overrun_time = jiffies;
1738         mutex_init(&ldata->atomic_read_lock);
1739         mutex_init(&ldata->output_lock);
1740
1741         tty->disc_data = ldata;
1742         reset_buffer_flags(tty->disc_data);
1743         ldata->column = 0;
1744         ldata->canon_column = 0;
1745         ldata->minimum_to_wake = 1;
1746         ldata->num_overrun = 0;
1747         ldata->no_room = 0;
1748         ldata->lnext = 0;
1749         tty->closing = 0;
1750         /* indicate buffer work may resume */
1751         clear_bit(TTY_LDISC_HALTED, &tty->flags);
1752         n_tty_set_termios(tty, NULL);
1753         tty_unthrottle(tty);
1754
1755         return 0;
1756 err:
1757         return -ENOMEM;
1758 }
1759
1760 static inline int input_available_p(struct tty_struct *tty, int amt)
1761 {
1762         struct n_tty_data *ldata = tty->disc_data;
1763
1764         if (ldata->icanon && !L_EXTPROC(tty)) {
1765                 if (ldata->canon_head != ldata->read_tail)
1766                         return 1;
1767         } else if (read_cnt(ldata) >= (amt ? amt : 1))
1768                 return 1;
1769
1770         return 0;
1771 }
1772
1773 /**
1774  *      copy_from_read_buf      -       copy read data directly
1775  *      @tty: terminal device
1776  *      @b: user data
1777  *      @nr: size of data
1778  *
1779  *      Helper function to speed up n_tty_read.  It is only called when
1780  *      ICANON is off; it copies characters straight from the tty queue to
1781  *      user space directly.  It can be profitably called twice; once to
1782  *      drain the space from the tail pointer to the (physical) end of the
1783  *      buffer, and once to drain the space from the (physical) beginning of
1784  *      the buffer to head pointer.
1785  *
1786  *      Called under the ldata->atomic_read_lock sem
1787  *
1788  *      n_tty_read()/consumer path:
1789  *              caller holds non-exclusive termios_rwsem
1790  *              read_tail published
1791  */
1792
1793 static int copy_from_read_buf(struct tty_struct *tty,
1794                                       unsigned char __user **b,
1795                                       size_t *nr)
1796
1797 {
1798         struct n_tty_data *ldata = tty->disc_data;
1799         int retval;
1800         size_t n;
1801         bool is_eof;
1802         size_t tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1803
1804         retval = 0;
1805         n = min(read_cnt(ldata), N_TTY_BUF_SIZE - tail);
1806         n = min(*nr, n);
1807         if (n) {
1808                 retval = copy_to_user(*b, read_buf_addr(ldata, tail), n);
1809                 n -= retval;
1810                 is_eof = n == 1 && read_buf(ldata, tail) == EOF_CHAR(tty);
1811                 tty_audit_add_data(tty, read_buf_addr(ldata, tail), n,
1812                                 ldata->icanon);
1813                 ldata->read_tail += n;
1814                 /* Turn single EOF into zero-length read */
1815                 if (L_EXTPROC(tty) && ldata->icanon && is_eof && !read_cnt(ldata))
1816                         n = 0;
1817                 *b += n;
1818                 *nr -= n;
1819         }
1820         return retval;
1821 }
1822
1823 /**
1824  *      canon_copy_from_read_buf        -       copy read data in canonical mode
1825  *      @tty: terminal device
1826  *      @b: user data
1827  *      @nr: size of data
1828  *
1829  *      Helper function for n_tty_read.  It is only called when ICANON is on;
1830  *      it copies one line of input up to and including the line-delimiting
1831  *      character into the user-space buffer.
1832  *
1833  *      Called under the atomic_read_lock mutex
1834  *
1835  *      n_tty_read()/consumer path:
1836  *              caller holds non-exclusive termios_rwsem
1837  *              read_tail published
1838  */
1839
1840 static int canon_copy_from_read_buf(struct tty_struct *tty,
1841                                     unsigned char __user **b,
1842                                     size_t *nr)
1843 {
1844         struct n_tty_data *ldata = tty->disc_data;
1845         size_t n, size, more, c;
1846         size_t eol;
1847         size_t tail;
1848         int ret, found = 0;
1849         bool eof_push = 0;
1850
1851         /* N.B. avoid overrun if nr == 0 */
1852         n = min(*nr, read_cnt(ldata));
1853         if (!n)
1854                 return 0;
1855
1856         tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1857         size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
1858
1859         n_tty_trace("%s: nr:%zu tail:%zu n:%zu size:%zu\n",
1860                     __func__, *nr, tail, n, size);
1861
1862         eol = find_next_bit(ldata->read_flags, size, tail);
1863         more = n - (size - tail);
1864         if (eol == N_TTY_BUF_SIZE && more) {
1865                 /* scan wrapped without finding set bit */
1866                 eol = find_next_bit(ldata->read_flags, more, 0);
1867                 if (eol != more)
1868                         found = 1;
1869         } else if (eol != size)
1870                 found = 1;
1871
1872         size = N_TTY_BUF_SIZE - tail;
1873         n = (found + eol + size) & (N_TTY_BUF_SIZE - 1);
1874         c = n;
1875
1876         if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
1877                 n--;
1878                 eof_push = !n && ldata->read_tail != ldata->line_start;
1879         }
1880
1881         n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
1882                     __func__, eol, found, n, c, size, more);
1883
1884         if (n > size) {
1885                 ret = copy_to_user(*b, read_buf_addr(ldata, tail), size);
1886                 if (ret)
1887                         return -EFAULT;
1888                 ret = copy_to_user(*b + size, ldata->read_buf, n - size);
1889         } else
1890                 ret = copy_to_user(*b, read_buf_addr(ldata, tail), n);
1891
1892         if (ret)
1893                 return -EFAULT;
1894         *b += n;
1895         *nr -= n;
1896
1897         if (found)
1898                 clear_bit(eol, ldata->read_flags);
1899         smp_mb__after_clear_bit();
1900         ldata->read_tail += c;
1901
1902         if (found) {
1903                 ldata->line_start = ldata->read_tail;
1904                 tty_audit_push(tty);
1905         }
1906         return eof_push ? -EAGAIN : 0;
1907 }
1908
1909 extern ssize_t redirected_tty_write(struct file *, const char __user *,
1910                                                         size_t, loff_t *);
1911
1912 /**
1913  *      job_control             -       check job control
1914  *      @tty: tty
1915  *      @file: file handle
1916  *
1917  *      Perform job control management checks on this file/tty descriptor
1918  *      and if appropriate send any needed signals and return a negative
1919  *      error code if action should be taken.
1920  *
1921  *      Locking: redirected write test is safe
1922  *               current->signal->tty check is safe
1923  *               ctrl_lock to safely reference tty->pgrp
1924  */
1925
1926 static int job_control(struct tty_struct *tty, struct file *file)
1927 {
1928         /* Job control check -- must be done at start and after
1929            every sleep (POSIX.1 7.1.1.4). */
1930         /* NOTE: not yet done after every sleep pending a thorough
1931            check of the logic of this change. -- jlc */
1932         /* don't stop on /dev/console */
1933         if (file->f_op->write == redirected_tty_write ||
1934             current->signal->tty != tty)
1935                 return 0;
1936
1937         spin_lock_irq(&tty->ctrl_lock);
1938         if (!tty->pgrp)
1939                 printk(KERN_ERR "n_tty_read: no tty->pgrp!\n");
1940         else if (task_pgrp(current) != tty->pgrp) {
1941                 spin_unlock_irq(&tty->ctrl_lock);
1942                 if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned())
1943                         return -EIO;
1944                 kill_pgrp(task_pgrp(current), SIGTTIN, 1);
1945                 set_thread_flag(TIF_SIGPENDING);
1946                 return -ERESTARTSYS;
1947         }
1948         spin_unlock_irq(&tty->ctrl_lock);
1949         return 0;
1950 }
1951
1952
1953 /**
1954  *      n_tty_read              -       read function for tty
1955  *      @tty: tty device
1956  *      @file: file object
1957  *      @buf: userspace buffer pointer
1958  *      @nr: size of I/O
1959  *
1960  *      Perform reads for the line discipline. We are guaranteed that the
1961  *      line discipline will not be closed under us but we may get multiple
1962  *      parallel readers and must handle this ourselves. We may also get
1963  *      a hangup. Always called in user context, may sleep.
1964  *
1965  *      This code must be sure never to sleep through a hangup.
1966  *
1967  *      n_tty_read()/consumer path:
1968  *              claims non-exclusive termios_rwsem
1969  *              publishes read_tail
1970  */
1971
1972 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
1973                          unsigned char __user *buf, size_t nr)
1974 {
1975         struct n_tty_data *ldata = tty->disc_data;
1976         unsigned char __user *b = buf;
1977         DECLARE_WAITQUEUE(wait, current);
1978         int c;
1979         int minimum, time;
1980         ssize_t retval = 0;
1981         long timeout;
1982         unsigned long flags;
1983         int packet;
1984
1985         c = job_control(tty, file);
1986         if (c < 0)
1987                 return c;
1988
1989         down_read(&tty->termios_rwsem);
1990
1991         minimum = time = 0;
1992         timeout = MAX_SCHEDULE_TIMEOUT;
1993         if (!ldata->icanon) {
1994                 minimum = MIN_CHAR(tty);
1995                 if (minimum) {
1996                         time = (HZ / 10) * TIME_CHAR(tty);
1997                         if (time)
1998                                 ldata->minimum_to_wake = 1;
1999                         else if (!waitqueue_active(&tty->read_wait) ||
2000                                  (ldata->minimum_to_wake > minimum))
2001                                 ldata->minimum_to_wake = minimum;
2002                 } else {
2003                         timeout = (HZ / 10) * TIME_CHAR(tty);
2004                         ldata->minimum_to_wake = minimum = 1;
2005                 }
2006         }
2007
2008         /*
2009          *      Internal serialization of reads.
2010          */
2011         if (file->f_flags & O_NONBLOCK) {
2012                 if (!mutex_trylock(&ldata->atomic_read_lock)) {
2013                         up_read(&tty->termios_rwsem);
2014                         return -EAGAIN;
2015                 }
2016         } else {
2017                 if (mutex_lock_interruptible(&ldata->atomic_read_lock)) {
2018                         up_read(&tty->termios_rwsem);
2019                         return -ERESTARTSYS;
2020                 }
2021         }
2022         packet = tty->packet;
2023
2024         add_wait_queue(&tty->read_wait, &wait);
2025         while (nr) {
2026                 /* First test for status change. */
2027                 if (packet && tty->link->ctrl_status) {
2028                         unsigned char cs;
2029                         if (b != buf)
2030                                 break;
2031                         spin_lock_irqsave(&tty->link->ctrl_lock, flags);
2032                         cs = tty->link->ctrl_status;
2033                         tty->link->ctrl_status = 0;
2034                         spin_unlock_irqrestore(&tty->link->ctrl_lock, flags);
2035                         if (tty_put_user(tty, cs, b++)) {
2036                                 retval = -EFAULT;
2037                                 b--;
2038                                 break;
2039                         }
2040                         nr--;
2041                         break;
2042                 }
2043                 /* This statement must be first before checking for input
2044                    so that any interrupt will set the state back to
2045                    TASK_RUNNING. */
2046                 set_current_state(TASK_INTERRUPTIBLE);
2047
2048                 if (((minimum - (b - buf)) < ldata->minimum_to_wake) &&
2049                     ((minimum - (b - buf)) >= 1))
2050                         ldata->minimum_to_wake = (minimum - (b - buf));
2051
2052                 if (!input_available_p(tty, 0)) {
2053                         if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
2054                                 retval = -EIO;
2055                                 break;
2056                         }
2057                         if (tty_hung_up_p(file))
2058                                 break;
2059                         if (!timeout)
2060                                 break;
2061                         if (file->f_flags & O_NONBLOCK) {
2062                                 retval = -EAGAIN;
2063                                 break;
2064                         }
2065                         if (signal_pending(current)) {
2066                                 retval = -ERESTARTSYS;
2067                                 break;
2068                         }
2069                         n_tty_set_room(tty);
2070                         up_read(&tty->termios_rwsem);
2071
2072                         timeout = schedule_timeout(timeout);
2073
2074                         down_read(&tty->termios_rwsem);
2075                         continue;
2076                 }
2077                 __set_current_state(TASK_RUNNING);
2078
2079                 /* Deal with packet mode. */
2080                 if (packet && b == buf) {
2081                         if (tty_put_user(tty, TIOCPKT_DATA, b++)) {
2082                                 retval = -EFAULT;
2083                                 b--;
2084                                 break;
2085                         }
2086                         nr--;
2087                 }
2088
2089                 if (ldata->icanon && !L_EXTPROC(tty)) {
2090                         retval = canon_copy_from_read_buf(tty, &b, &nr);
2091                         if (retval == -EAGAIN) {
2092                                 retval = 0;
2093                                 continue;
2094                         } else if (retval)
2095                                 break;
2096                 } else {
2097                         int uncopied;
2098                         /* The copy function takes the read lock and handles
2099                            locking internally for this case */
2100                         uncopied = copy_from_read_buf(tty, &b, &nr);
2101                         uncopied += copy_from_read_buf(tty, &b, &nr);
2102                         if (uncopied) {
2103                                 retval = -EFAULT;
2104                                 break;
2105                         }
2106                 }
2107
2108                 n_tty_check_unthrottle(tty);
2109
2110                 if (b - buf >= minimum)
2111                         break;
2112                 if (time)
2113                         timeout = time;
2114         }
2115         mutex_unlock(&ldata->atomic_read_lock);
2116         remove_wait_queue(&tty->read_wait, &wait);
2117
2118         if (!waitqueue_active(&tty->read_wait))
2119                 ldata->minimum_to_wake = minimum;
2120
2121         __set_current_state(TASK_RUNNING);
2122         if (b - buf)
2123                 retval = b - buf;
2124
2125         n_tty_set_room(tty);
2126         up_read(&tty->termios_rwsem);
2127         return retval;
2128 }
2129
2130 /**
2131  *      n_tty_write             -       write function for tty
2132  *      @tty: tty device
2133  *      @file: file object
2134  *      @buf: userspace buffer pointer
2135  *      @nr: size of I/O
2136  *
2137  *      Write function of the terminal device.  This is serialized with
2138  *      respect to other write callers but not to termios changes, reads
2139  *      and other such events.  Since the receive code will echo characters,
2140  *      thus calling driver write methods, the output_lock is used in
2141  *      the output processing functions called here as well as in the
2142  *      echo processing function to protect the column state and space
2143  *      left in the buffer.
2144  *
2145  *      This code must be sure never to sleep through a hangup.
2146  *
2147  *      Locking: output_lock to protect column state and space left
2148  *               (note that the process_output*() functions take this
2149  *                lock themselves)
2150  */
2151
2152 static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
2153                            const unsigned char *buf, size_t nr)
2154 {
2155         const unsigned char *b = buf;
2156         DECLARE_WAITQUEUE(wait, current);
2157         int c;
2158         ssize_t retval = 0;
2159
2160         /* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
2161         if (L_TOSTOP(tty) && file->f_op->write != redirected_tty_write) {
2162                 retval = tty_check_change(tty);
2163                 if (retval)
2164                         return retval;
2165         }
2166
2167         down_read(&tty->termios_rwsem);
2168
2169         /* Write out any echoed characters that are still pending */
2170         process_echoes(tty);
2171
2172         add_wait_queue(&tty->write_wait, &wait);
2173         while (1) {
2174                 set_current_state(TASK_INTERRUPTIBLE);
2175                 if (signal_pending(current)) {
2176                         retval = -ERESTARTSYS;
2177                         break;
2178                 }
2179                 if (tty_hung_up_p(file) || (tty->link && !tty->link->count)) {
2180                         retval = -EIO;
2181                         break;
2182                 }
2183                 if (O_OPOST(tty)) {
2184                         while (nr > 0) {
2185                                 ssize_t num = process_output_block(tty, b, nr);
2186                                 if (num < 0) {
2187                                         if (num == -EAGAIN)
2188                                                 break;
2189                                         retval = num;
2190                                         goto break_out;
2191                                 }
2192                                 b += num;
2193                                 nr -= num;
2194                                 if (nr == 0)
2195                                         break;
2196                                 c = *b;
2197                                 if (process_output(c, tty) < 0)
2198                                         break;
2199                                 b++; nr--;
2200                         }
2201                         if (tty->ops->flush_chars)
2202                                 tty->ops->flush_chars(tty);
2203                 } else {
2204                         while (nr > 0) {
2205                                 c = tty->ops->write(tty, b, nr);
2206                                 if (c < 0) {
2207                                         retval = c;
2208                                         goto break_out;
2209                                 }
2210                                 if (!c)
2211                                         break;
2212                                 b += c;
2213                                 nr -= c;
2214                         }
2215                 }
2216                 if (!nr)
2217                         break;
2218                 if (file->f_flags & O_NONBLOCK) {
2219                         retval = -EAGAIN;
2220                         break;
2221                 }
2222                 up_read(&tty->termios_rwsem);
2223
2224                 schedule();
2225
2226                 down_read(&tty->termios_rwsem);
2227         }
2228 break_out:
2229         __set_current_state(TASK_RUNNING);
2230         remove_wait_queue(&tty->write_wait, &wait);
2231         if (b - buf != nr && tty->fasync)
2232                 set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
2233         up_read(&tty->termios_rwsem);
2234         return (b - buf) ? b - buf : retval;
2235 }
2236
2237 /**
2238  *      n_tty_poll              -       poll method for N_TTY
2239  *      @tty: terminal device
2240  *      @file: file accessing it
2241  *      @wait: poll table
2242  *
2243  *      Called when the line discipline is asked to poll() for data or
2244  *      for special events. This code is not serialized with respect to
2245  *      other events save open/close.
2246  *
2247  *      This code must be sure never to sleep through a hangup.
2248  *      Called without the kernel lock held - fine
2249  */
2250
2251 static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
2252                                                         poll_table *wait)
2253 {
2254         struct n_tty_data *ldata = tty->disc_data;
2255         unsigned int mask = 0;
2256
2257         poll_wait(file, &tty->read_wait, wait);
2258         poll_wait(file, &tty->write_wait, wait);
2259         if (input_available_p(tty, TIME_CHAR(tty) ? 0 : MIN_CHAR(tty)))
2260                 mask |= POLLIN | POLLRDNORM;
2261         if (tty->packet && tty->link->ctrl_status)
2262                 mask |= POLLPRI | POLLIN | POLLRDNORM;
2263         if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
2264                 mask |= POLLHUP;
2265         if (tty_hung_up_p(file))
2266                 mask |= POLLHUP;
2267         if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
2268                 if (MIN_CHAR(tty) && !TIME_CHAR(tty))
2269                         ldata->minimum_to_wake = MIN_CHAR(tty);
2270                 else
2271                         ldata->minimum_to_wake = 1;
2272         }
2273         if (tty->ops->write && !tty_is_writelocked(tty) &&
2274                         tty_chars_in_buffer(tty) < WAKEUP_CHARS &&
2275                         tty_write_room(tty) > 0)
2276                 mask |= POLLOUT | POLLWRNORM;
2277         return mask;
2278 }
2279
2280 static unsigned long inq_canon(struct n_tty_data *ldata)
2281 {
2282         size_t nr, head, tail;
2283
2284         if (ldata->canon_head == ldata->read_tail)
2285                 return 0;
2286         head = ldata->canon_head;
2287         tail = ldata->read_tail;
2288         nr = head - tail;
2289         /* Skip EOF-chars.. */
2290         while (head != tail) {
2291                 if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) &&
2292                     read_buf(ldata, tail) == __DISABLED_CHAR)
2293                         nr--;
2294                 tail++;
2295         }
2296         return nr;
2297 }
2298
2299 static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
2300                        unsigned int cmd, unsigned long arg)
2301 {
2302         struct n_tty_data *ldata = tty->disc_data;
2303         int retval;
2304
2305         switch (cmd) {
2306         case TIOCOUTQ:
2307                 return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2308         case TIOCINQ:
2309                 down_write(&tty->termios_rwsem);
2310                 if (L_ICANON(tty))
2311                         retval = inq_canon(ldata);
2312                 else
2313                         retval = read_cnt(ldata);
2314                 up_write(&tty->termios_rwsem);
2315                 return put_user(retval, (unsigned int __user *) arg);
2316         default:
2317                 return n_tty_ioctl_helper(tty, file, cmd, arg);
2318         }
2319 }
2320
2321 static void n_tty_fasync(struct tty_struct *tty, int on)
2322 {
2323         struct n_tty_data *ldata = tty->disc_data;
2324
2325         if (!waitqueue_active(&tty->read_wait)) {
2326                 if (on)
2327                         ldata->minimum_to_wake = 1;
2328                 else if (!tty->fasync)
2329                         ldata->minimum_to_wake = N_TTY_BUF_SIZE;
2330         }
2331 }
2332
2333 struct tty_ldisc_ops tty_ldisc_N_TTY = {
2334         .magic           = TTY_LDISC_MAGIC,
2335         .name            = "n_tty",
2336         .open            = n_tty_open,
2337         .close           = n_tty_close,
2338         .flush_buffer    = n_tty_flush_buffer,
2339         .chars_in_buffer = n_tty_chars_in_buffer,
2340         .read            = n_tty_read,
2341         .write           = n_tty_write,
2342         .ioctl           = n_tty_ioctl,
2343         .set_termios     = n_tty_set_termios,
2344         .poll            = n_tty_poll,
2345         .receive_buf     = n_tty_receive_buf,
2346         .write_wakeup    = n_tty_write_wakeup,
2347         .fasync          = n_tty_fasync,
2348         .receive_buf2    = n_tty_receive_buf2,
2349 };
2350
2351 /**
2352  *      n_tty_inherit_ops       -       inherit N_TTY methods
2353  *      @ops: struct tty_ldisc_ops where to save N_TTY methods
2354  *
2355  *      Enables a 'subclass' line discipline to 'inherit' N_TTY
2356  *      methods.
2357  */
2358
2359 void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
2360 {
2361         *ops = tty_ldisc_N_TTY;
2362         ops->owner = NULL;
2363         ops->refcount = ops->flags = 0;
2364 }
2365 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);