]> git.kernelconcepts.de Git - karo-tx-linux.git/blob - drivers/tty/n_tty.c
Merge remote-tracking branch 'ubifs/linux-next'
[karo-tx-linux.git] / drivers / tty / n_tty.c
1 /*
2  * n_tty.c --- implements the N_TTY line discipline.
3  *
4  * This code used to be in tty_io.c, but things are getting hairy
5  * enough that it made sense to split things off.  (The N_TTY
6  * processing has changed so much that it's hardly recognizable,
7  * anyway...)
8  *
9  * Note that the open routine for N_TTY is guaranteed never to return
10  * an error.  This is because Linux will fall back to setting a line
11  * to N_TTY if it can not switch to any other line discipline.
12  *
13  * Written by Theodore Ts'o, Copyright 1994.
14  *
15  * This file also contains code originally written by Linus Torvalds,
16  * Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
17  *
18  * This file may be redistributed under the terms of the GNU General Public
19  * License.
20  *
21  * Reduced memory usage for older ARM systems  - Russell King.
22  *
23  * 2000/01/20   Fixed SMP locking on put_tty_queue using bits of
24  *              the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
25  *              who actually finally proved there really was a race.
26  *
27  * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
28  *              waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
29  *              Also fixed a bug in BLOCKING mode where n_tty_write returns
30  *              EAGAIN
31  */
32
33 #include <linux/types.h>
34 #include <linux/major.h>
35 #include <linux/errno.h>
36 #include <linux/signal.h>
37 #include <linux/fcntl.h>
38 #include <linux/sched.h>
39 #include <linux/interrupt.h>
40 #include <linux/tty.h>
41 #include <linux/timer.h>
42 #include <linux/ctype.h>
43 #include <linux/mm.h>
44 #include <linux/string.h>
45 #include <linux/slab.h>
46 #include <linux/poll.h>
47 #include <linux/bitops.h>
48 #include <linux/audit.h>
49 #include <linux/file.h>
50 #include <linux/uaccess.h>
51 #include <linux/module.h>
52 #include <linux/ratelimit.h>
53 #include <linux/vmalloc.h>
54
55
56 /* number of characters left in xmit buffer before select has we have room */
57 #define WAKEUP_CHARS 256
58
59 /*
60  * This defines the low- and high-watermarks for throttling and
61  * unthrottling the TTY driver.  These watermarks are used for
62  * controlling the space in the read buffer.
63  */
64 #define TTY_THRESHOLD_THROTTLE          128 /* now based on remaining room */
65 #define TTY_THRESHOLD_UNTHROTTLE        128
66
67 /*
68  * Special byte codes used in the echo buffer to represent operations
69  * or special handling of characters.  Bytes in the echo buffer that
70  * are not part of such special blocks are treated as normal character
71  * codes.
72  */
73 #define ECHO_OP_START 0xff
74 #define ECHO_OP_MOVE_BACK_COL 0x80
75 #define ECHO_OP_SET_CANON_COL 0x81
76 #define ECHO_OP_ERASE_TAB 0x82
77
78 #define ECHO_COMMIT_WATERMARK   256
79 #define ECHO_BLOCK              256
80 #define ECHO_DISCARD_WATERMARK  N_TTY_BUF_SIZE - (ECHO_BLOCK + 32)
81
82
83 #undef N_TTY_TRACE
84 #ifdef N_TTY_TRACE
85 # define n_tty_trace(f, args...)        trace_printk(f, ##args)
86 #else
87 # define n_tty_trace(f, args...)
88 #endif
89
90 struct n_tty_data {
91         /* producer-published */
92         size_t read_head;
93         size_t commit_head;
94         size_t canon_head;
95         size_t echo_head;
96         size_t echo_commit;
97         size_t echo_mark;
98         DECLARE_BITMAP(char_map, 256);
99
100         /* private to n_tty_receive_overrun (single-threaded) */
101         unsigned long overrun_time;
102         int num_overrun;
103
104         /* non-atomic */
105         bool no_room;
106
107         /* must hold exclusive termios_rwsem to reset these */
108         unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
109         unsigned char push:1;
110
111         /* shared by producer and consumer */
112         char read_buf[N_TTY_BUF_SIZE];
113         DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
114         unsigned char echo_buf[N_TTY_BUF_SIZE];
115
116         int minimum_to_wake;
117
118         /* consumer-published */
119         size_t read_tail;
120         size_t line_start;
121
122         /* protected by output lock */
123         unsigned int column;
124         unsigned int canon_column;
125         size_t echo_tail;
126
127         struct mutex atomic_read_lock;
128         struct mutex output_lock;
129 };
130
131 static inline size_t read_cnt(struct n_tty_data *ldata)
132 {
133         return ldata->read_head - ldata->read_tail;
134 }
135
136 static inline unsigned char read_buf(struct n_tty_data *ldata, size_t i)
137 {
138         return ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
139 }
140
141 static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i)
142 {
143         return &ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
144 }
145
146 static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i)
147 {
148         return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
149 }
150
151 static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
152 {
153         return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
154 }
155
156 static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
157                                unsigned char __user *ptr)
158 {
159         struct n_tty_data *ldata = tty->disc_data;
160
161         tty_audit_add_data(tty, &x, 1, ldata->icanon);
162         return put_user(x, ptr);
163 }
164
165 static inline int tty_copy_to_user(struct tty_struct *tty,
166                                         void __user *to,
167                                         const void *from,
168                                         unsigned long n)
169 {
170         struct n_tty_data *ldata = tty->disc_data;
171
172         tty_audit_add_data(tty, to, n, ldata->icanon);
173         return copy_to_user(to, from, n);
174 }
175
176 /**
177  *      n_tty_kick_worker - start input worker (if required)
178  *      @tty: terminal
179  *
180  *      Re-schedules the flip buffer work if it may have stopped
181  *
182  *      Caller holds exclusive termios_rwsem
183  *         or
184  *      n_tty_read()/consumer path:
185  *              holds non-exclusive termios_rwsem
186  */
187
188 static void n_tty_kick_worker(struct tty_struct *tty)
189 {
190         struct n_tty_data *ldata = tty->disc_data;
191
192         /* Did the input worker stop? Restart it */
193         if (unlikely(ldata->no_room)) {
194                 ldata->no_room = 0;
195
196                 WARN_RATELIMIT(tty->port->itty == NULL,
197                                 "scheduling with invalid itty\n");
198                 /* see if ldisc has been killed - if so, this means that
199                  * even though the ldisc has been halted and ->buf.work
200                  * cancelled, ->buf.work is about to be rescheduled
201                  */
202                 WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
203                                "scheduling buffer work for halted ldisc\n");
204                 queue_work(system_unbound_wq, &tty->port->buf.work);
205         }
206 }
207
208 static ssize_t chars_in_buffer(struct tty_struct *tty)
209 {
210         struct n_tty_data *ldata = tty->disc_data;
211         ssize_t n = 0;
212
213         if (!ldata->icanon)
214                 n = ldata->commit_head - ldata->read_tail;
215         else
216                 n = ldata->canon_head - ldata->read_tail;
217         return n;
218 }
219
220 /**
221  *      n_tty_write_wakeup      -       asynchronous I/O notifier
222  *      @tty: tty device
223  *
224  *      Required for the ptys, serial driver etc. since processes
225  *      that attach themselves to the master and rely on ASYNC
226  *      IO must be woken up
227  */
228
229 static void n_tty_write_wakeup(struct tty_struct *tty)
230 {
231         if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
232                 kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
233 }
234
235 static void n_tty_check_throttle(struct tty_struct *tty)
236 {
237         struct n_tty_data *ldata = tty->disc_data;
238
239         /*
240          * Check the remaining room for the input canonicalization
241          * mode.  We don't want to throttle the driver if we're in
242          * canonical mode and don't have a newline yet!
243          */
244         if (ldata->icanon && ldata->canon_head == ldata->read_tail)
245                 return;
246
247         while (1) {
248                 int throttled;
249                 tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
250                 if (N_TTY_BUF_SIZE - read_cnt(ldata) >= TTY_THRESHOLD_THROTTLE)
251                         break;
252                 throttled = tty_throttle_safe(tty);
253                 if (!throttled)
254                         break;
255         }
256         __tty_set_flow_change(tty, 0);
257 }
258
259 static void n_tty_check_unthrottle(struct tty_struct *tty)
260 {
261         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
262             tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
263                 if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
264                         return;
265                 if (!tty->count)
266                         return;
267                 n_tty_kick_worker(tty);
268                 n_tty_write_wakeup(tty->link);
269                 if (waitqueue_active(&tty->link->write_wait))
270                         wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
271                 return;
272         }
273
274         /* If there is enough space in the read buffer now, let the
275          * low-level driver know. We use chars_in_buffer() to
276          * check the buffer, as it now knows about canonical mode.
277          * Otherwise, if the driver is throttled and the line is
278          * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
279          * we won't get any more characters.
280          */
281
282         while (1) {
283                 int unthrottled;
284                 tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
285                 if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
286                         break;
287                 if (!tty->count)
288                         break;
289                 n_tty_kick_worker(tty);
290                 unthrottled = tty_unthrottle_safe(tty);
291                 if (!unthrottled)
292                         break;
293         }
294         __tty_set_flow_change(tty, 0);
295 }
296
297 /**
298  *      put_tty_queue           -       add character to tty
299  *      @c: character
300  *      @ldata: n_tty data
301  *
302  *      Add a character to the tty read_buf queue.
303  *
304  *      n_tty_receive_buf()/producer path:
305  *              caller holds non-exclusive termios_rwsem
306  */
307
308 static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
309 {
310         *read_buf_addr(ldata, ldata->read_head) = c;
311         ldata->read_head++;
312 }
313
314 /**
315  *      reset_buffer_flags      -       reset buffer state
316  *      @tty: terminal to reset
317  *
318  *      Reset the read buffer counters and clear the flags.
319  *      Called from n_tty_open() and n_tty_flush_buffer().
320  *
321  *      Locking: caller holds exclusive termios_rwsem
322  *               (or locking is not required)
323  */
324
325 static void reset_buffer_flags(struct n_tty_data *ldata)
326 {
327         ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
328         ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
329         ldata->commit_head = 0;
330         ldata->echo_mark = 0;
331         ldata->line_start = 0;
332
333         ldata->erasing = 0;
334         bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
335         ldata->push = 0;
336 }
337
338 static void n_tty_packet_mode_flush(struct tty_struct *tty)
339 {
340         unsigned long flags;
341
342         if (tty->link->packet) {
343                 spin_lock_irqsave(&tty->ctrl_lock, flags);
344                 tty->ctrl_status |= TIOCPKT_FLUSHREAD;
345                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
346                 wake_up_interruptible(&tty->link->read_wait);
347         }
348 }
349
350 /**
351  *      n_tty_flush_buffer      -       clean input queue
352  *      @tty:   terminal device
353  *
354  *      Flush the input buffer. Called when the tty layer wants the
355  *      buffer flushed (eg at hangup) or when the N_TTY line discipline
356  *      internally has to clean the pending queue (for example some signals).
357  *
358  *      Holds termios_rwsem to exclude producer/consumer while
359  *      buffer indices are reset.
360  *
361  *      Locking: ctrl_lock, exclusive termios_rwsem
362  */
363
364 static void n_tty_flush_buffer(struct tty_struct *tty)
365 {
366         down_write(&tty->termios_rwsem);
367         reset_buffer_flags(tty->disc_data);
368         n_tty_kick_worker(tty);
369
370         if (tty->link)
371                 n_tty_packet_mode_flush(tty);
372         up_write(&tty->termios_rwsem);
373 }
374
375 /**
376  *      n_tty_chars_in_buffer   -       report available bytes
377  *      @tty: tty device
378  *
379  *      Report the number of characters buffered to be delivered to user
380  *      at this instant in time.
381  *
382  *      Locking: exclusive termios_rwsem
383  */
384
385 static ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
386 {
387         ssize_t n;
388
389         WARN_ONCE(1, "%s is deprecated and scheduled for removal.", __func__);
390
391         down_write(&tty->termios_rwsem);
392         n = chars_in_buffer(tty);
393         up_write(&tty->termios_rwsem);
394         return n;
395 }
396
397 /**
398  *      is_utf8_continuation    -       utf8 multibyte check
399  *      @c: byte to check
400  *
401  *      Returns true if the utf8 character 'c' is a multibyte continuation
402  *      character. We use this to correctly compute the on screen size
403  *      of the character when printing
404  */
405
406 static inline int is_utf8_continuation(unsigned char c)
407 {
408         return (c & 0xc0) == 0x80;
409 }
410
411 /**
412  *      is_continuation         -       multibyte check
413  *      @c: byte to check
414  *
415  *      Returns true if the utf8 character 'c' is a multibyte continuation
416  *      character and the terminal is in unicode mode.
417  */
418
419 static inline int is_continuation(unsigned char c, struct tty_struct *tty)
420 {
421         return I_IUTF8(tty) && is_utf8_continuation(c);
422 }
423
424 /**
425  *      do_output_char                  -       output one character
426  *      @c: character (or partial unicode symbol)
427  *      @tty: terminal device
428  *      @space: space available in tty driver write buffer
429  *
430  *      This is a helper function that handles one output character
431  *      (including special characters like TAB, CR, LF, etc.),
432  *      doing OPOST processing and putting the results in the
433  *      tty driver's write buffer.
434  *
435  *      Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY
436  *      and NLDLY.  They simply aren't relevant in the world today.
437  *      If you ever need them, add them here.
438  *
439  *      Returns the number of bytes of buffer space used or -1 if
440  *      no space left.
441  *
442  *      Locking: should be called under the output_lock to protect
443  *               the column state and space left in the buffer
444  */
445
446 static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
447 {
448         struct n_tty_data *ldata = tty->disc_data;
449         int     spaces;
450
451         if (!space)
452                 return -1;
453
454         switch (c) {
455         case '\n':
456                 if (O_ONLRET(tty))
457                         ldata->column = 0;
458                 if (O_ONLCR(tty)) {
459                         if (space < 2)
460                                 return -1;
461                         ldata->canon_column = ldata->column = 0;
462                         tty->ops->write(tty, "\r\n", 2);
463                         return 2;
464                 }
465                 ldata->canon_column = ldata->column;
466                 break;
467         case '\r':
468                 if (O_ONOCR(tty) && ldata->column == 0)
469                         return 0;
470                 if (O_OCRNL(tty)) {
471                         c = '\n';
472                         if (O_ONLRET(tty))
473                                 ldata->canon_column = ldata->column = 0;
474                         break;
475                 }
476                 ldata->canon_column = ldata->column = 0;
477                 break;
478         case '\t':
479                 spaces = 8 - (ldata->column & 7);
480                 if (O_TABDLY(tty) == XTABS) {
481                         if (space < spaces)
482                                 return -1;
483                         ldata->column += spaces;
484                         tty->ops->write(tty, "        ", spaces);
485                         return spaces;
486                 }
487                 ldata->column += spaces;
488                 break;
489         case '\b':
490                 if (ldata->column > 0)
491                         ldata->column--;
492                 break;
493         default:
494                 if (!iscntrl(c)) {
495                         if (O_OLCUC(tty))
496                                 c = toupper(c);
497                         if (!is_continuation(c, tty))
498                                 ldata->column++;
499                 }
500                 break;
501         }
502
503         tty_put_char(tty, c);
504         return 1;
505 }
506
507 /**
508  *      process_output                  -       output post processor
509  *      @c: character (or partial unicode symbol)
510  *      @tty: terminal device
511  *
512  *      Output one character with OPOST processing.
513  *      Returns -1 when the output device is full and the character
514  *      must be retried.
515  *
516  *      Locking: output_lock to protect column state and space left
517  *               (also, this is called from n_tty_write under the
518  *                tty layer write lock)
519  */
520
521 static int process_output(unsigned char c, struct tty_struct *tty)
522 {
523         struct n_tty_data *ldata = tty->disc_data;
524         int     space, retval;
525
526         mutex_lock(&ldata->output_lock);
527
528         space = tty_write_room(tty);
529         retval = do_output_char(c, tty, space);
530
531         mutex_unlock(&ldata->output_lock);
532         if (retval < 0)
533                 return -1;
534         else
535                 return 0;
536 }
537
538 /**
539  *      process_output_block            -       block post processor
540  *      @tty: terminal device
541  *      @buf: character buffer
542  *      @nr: number of bytes to output
543  *
544  *      Output a block of characters with OPOST processing.
545  *      Returns the number of characters output.
546  *
547  *      This path is used to speed up block console writes, among other
548  *      things when processing blocks of output data. It handles only
549  *      the simple cases normally found and helps to generate blocks of
550  *      symbols for the console driver and thus improve performance.
551  *
552  *      Locking: output_lock to protect column state and space left
553  *               (also, this is called from n_tty_write under the
554  *                tty layer write lock)
555  */
556
557 static ssize_t process_output_block(struct tty_struct *tty,
558                                     const unsigned char *buf, unsigned int nr)
559 {
560         struct n_tty_data *ldata = tty->disc_data;
561         int     space;
562         int     i;
563         const unsigned char *cp;
564
565         mutex_lock(&ldata->output_lock);
566
567         space = tty_write_room(tty);
568         if (!space) {
569                 mutex_unlock(&ldata->output_lock);
570                 return 0;
571         }
572         if (nr > space)
573                 nr = space;
574
575         for (i = 0, cp = buf; i < nr; i++, cp++) {
576                 unsigned char c = *cp;
577
578                 switch (c) {
579                 case '\n':
580                         if (O_ONLRET(tty))
581                                 ldata->column = 0;
582                         if (O_ONLCR(tty))
583                                 goto break_out;
584                         ldata->canon_column = ldata->column;
585                         break;
586                 case '\r':
587                         if (O_ONOCR(tty) && ldata->column == 0)
588                                 goto break_out;
589                         if (O_OCRNL(tty))
590                                 goto break_out;
591                         ldata->canon_column = ldata->column = 0;
592                         break;
593                 case '\t':
594                         goto break_out;
595                 case '\b':
596                         if (ldata->column > 0)
597                                 ldata->column--;
598                         break;
599                 default:
600                         if (!iscntrl(c)) {
601                                 if (O_OLCUC(tty))
602                                         goto break_out;
603                                 if (!is_continuation(c, tty))
604                                         ldata->column++;
605                         }
606                         break;
607                 }
608         }
609 break_out:
610         i = tty->ops->write(tty, buf, i);
611
612         mutex_unlock(&ldata->output_lock);
613         return i;
614 }
615
616 /**
617  *      process_echoes  -       write pending echo characters
618  *      @tty: terminal device
619  *
620  *      Write previously buffered echo (and other ldisc-generated)
621  *      characters to the tty.
622  *
623  *      Characters generated by the ldisc (including echoes) need to
624  *      be buffered because the driver's write buffer can fill during
625  *      heavy program output.  Echoing straight to the driver will
626  *      often fail under these conditions, causing lost characters and
627  *      resulting mismatches of ldisc state information.
628  *
629  *      Since the ldisc state must represent the characters actually sent
630  *      to the driver at the time of the write, operations like certain
631  *      changes in column state are also saved in the buffer and executed
632  *      here.
633  *
634  *      A circular fifo buffer is used so that the most recent characters
635  *      are prioritized.  Also, when control characters are echoed with a
636  *      prefixed "^", the pair is treated atomically and thus not separated.
637  *
638  *      Locking: callers must hold output_lock
639  */
640
641 static size_t __process_echoes(struct tty_struct *tty)
642 {
643         struct n_tty_data *ldata = tty->disc_data;
644         int     space, old_space;
645         size_t tail;
646         unsigned char c;
647
648         old_space = space = tty_write_room(tty);
649
650         tail = ldata->echo_tail;
651         while (ldata->echo_commit != tail) {
652                 c = echo_buf(ldata, tail);
653                 if (c == ECHO_OP_START) {
654                         unsigned char op;
655                         int no_space_left = 0;
656
657                         /*
658                          * If the buffer byte is the start of a multi-byte
659                          * operation, get the next byte, which is either the
660                          * op code or a control character value.
661                          */
662                         op = echo_buf(ldata, tail + 1);
663
664                         switch (op) {
665                                 unsigned int num_chars, num_bs;
666
667                         case ECHO_OP_ERASE_TAB:
668                                 num_chars = echo_buf(ldata, tail + 2);
669
670                                 /*
671                                  * Determine how many columns to go back
672                                  * in order to erase the tab.
673                                  * This depends on the number of columns
674                                  * used by other characters within the tab
675                                  * area.  If this (modulo 8) count is from
676                                  * the start of input rather than from a
677                                  * previous tab, we offset by canon column.
678                                  * Otherwise, tab spacing is normal.
679                                  */
680                                 if (!(num_chars & 0x80))
681                                         num_chars += ldata->canon_column;
682                                 num_bs = 8 - (num_chars & 7);
683
684                                 if (num_bs > space) {
685                                         no_space_left = 1;
686                                         break;
687                                 }
688                                 space -= num_bs;
689                                 while (num_bs--) {
690                                         tty_put_char(tty, '\b');
691                                         if (ldata->column > 0)
692                                                 ldata->column--;
693                                 }
694                                 tail += 3;
695                                 break;
696
697                         case ECHO_OP_SET_CANON_COL:
698                                 ldata->canon_column = ldata->column;
699                                 tail += 2;
700                                 break;
701
702                         case ECHO_OP_MOVE_BACK_COL:
703                                 if (ldata->column > 0)
704                                         ldata->column--;
705                                 tail += 2;
706                                 break;
707
708                         case ECHO_OP_START:
709                                 /* This is an escaped echo op start code */
710                                 if (!space) {
711                                         no_space_left = 1;
712                                         break;
713                                 }
714                                 tty_put_char(tty, ECHO_OP_START);
715                                 ldata->column++;
716                                 space--;
717                                 tail += 2;
718                                 break;
719
720                         default:
721                                 /*
722                                  * If the op is not a special byte code,
723                                  * it is a ctrl char tagged to be echoed
724                                  * as "^X" (where X is the letter
725                                  * representing the control char).
726                                  * Note that we must ensure there is
727                                  * enough space for the whole ctrl pair.
728                                  *
729                                  */
730                                 if (space < 2) {
731                                         no_space_left = 1;
732                                         break;
733                                 }
734                                 tty_put_char(tty, '^');
735                                 tty_put_char(tty, op ^ 0100);
736                                 ldata->column += 2;
737                                 space -= 2;
738                                 tail += 2;
739                         }
740
741                         if (no_space_left)
742                                 break;
743                 } else {
744                         if (O_OPOST(tty)) {
745                                 int retval = do_output_char(c, tty, space);
746                                 if (retval < 0)
747                                         break;
748                                 space -= retval;
749                         } else {
750                                 if (!space)
751                                         break;
752                                 tty_put_char(tty, c);
753                                 space -= 1;
754                         }
755                         tail += 1;
756                 }
757         }
758
759         /* If the echo buffer is nearly full (so that the possibility exists
760          * of echo overrun before the next commit), then discard enough
761          * data at the tail to prevent a subsequent overrun */
762         while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
763                 if (echo_buf(ldata, tail) == ECHO_OP_START) {
764                         if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB)
765                                 tail += 3;
766                         else
767                                 tail += 2;
768                 } else
769                         tail++;
770         }
771
772         ldata->echo_tail = tail;
773         return old_space - space;
774 }
775
776 static void commit_echoes(struct tty_struct *tty)
777 {
778         struct n_tty_data *ldata = tty->disc_data;
779         size_t nr, old, echoed;
780         size_t head;
781
782         head = ldata->echo_head;
783         ldata->echo_mark = head;
784         old = ldata->echo_commit - ldata->echo_tail;
785
786         /* Process committed echoes if the accumulated # of bytes
787          * is over the threshold (and try again each time another
788          * block is accumulated) */
789         nr = head - ldata->echo_tail;
790         if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK))
791                 return;
792
793         mutex_lock(&ldata->output_lock);
794         ldata->echo_commit = head;
795         echoed = __process_echoes(tty);
796         mutex_unlock(&ldata->output_lock);
797
798         if (echoed && tty->ops->flush_chars)
799                 tty->ops->flush_chars(tty);
800 }
801
802 static void process_echoes(struct tty_struct *tty)
803 {
804         struct n_tty_data *ldata = tty->disc_data;
805         size_t echoed;
806
807         if (ldata->echo_mark == ldata->echo_tail)
808                 return;
809
810         mutex_lock(&ldata->output_lock);
811         ldata->echo_commit = ldata->echo_mark;
812         echoed = __process_echoes(tty);
813         mutex_unlock(&ldata->output_lock);
814
815         if (echoed && tty->ops->flush_chars)
816                 tty->ops->flush_chars(tty);
817 }
818
819 /* NB: echo_mark and echo_head should be equivalent here */
820 static void flush_echoes(struct tty_struct *tty)
821 {
822         struct n_tty_data *ldata = tty->disc_data;
823
824         if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
825             ldata->echo_commit == ldata->echo_head)
826                 return;
827
828         mutex_lock(&ldata->output_lock);
829         ldata->echo_commit = ldata->echo_head;
830         __process_echoes(tty);
831         mutex_unlock(&ldata->output_lock);
832 }
833
834 /**
835  *      add_echo_byte   -       add a byte to the echo buffer
836  *      @c: unicode byte to echo
837  *      @ldata: n_tty data
838  *
839  *      Add a character or operation byte to the echo buffer.
840  */
841
842 static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
843 {
844         *echo_buf_addr(ldata, ldata->echo_head++) = c;
845 }
846
847 /**
848  *      echo_move_back_col      -       add operation to move back a column
849  *      @ldata: n_tty data
850  *
851  *      Add an operation to the echo buffer to move back one column.
852  */
853
854 static void echo_move_back_col(struct n_tty_data *ldata)
855 {
856         add_echo_byte(ECHO_OP_START, ldata);
857         add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
858 }
859
860 /**
861  *      echo_set_canon_col      -       add operation to set the canon column
862  *      @ldata: n_tty data
863  *
864  *      Add an operation to the echo buffer to set the canon column
865  *      to the current column.
866  */
867
868 static void echo_set_canon_col(struct n_tty_data *ldata)
869 {
870         add_echo_byte(ECHO_OP_START, ldata);
871         add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
872 }
873
874 /**
875  *      echo_erase_tab  -       add operation to erase a tab
876  *      @num_chars: number of character columns already used
877  *      @after_tab: true if num_chars starts after a previous tab
878  *      @ldata: n_tty data
879  *
880  *      Add an operation to the echo buffer to erase a tab.
881  *
882  *      Called by the eraser function, which knows how many character
883  *      columns have been used since either a previous tab or the start
884  *      of input.  This information will be used later, along with
885  *      canon column (if applicable), to go back the correct number
886  *      of columns.
887  */
888
889 static void echo_erase_tab(unsigned int num_chars, int after_tab,
890                            struct n_tty_data *ldata)
891 {
892         add_echo_byte(ECHO_OP_START, ldata);
893         add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
894
895         /* We only need to know this modulo 8 (tab spacing) */
896         num_chars &= 7;
897
898         /* Set the high bit as a flag if num_chars is after a previous tab */
899         if (after_tab)
900                 num_chars |= 0x80;
901
902         add_echo_byte(num_chars, ldata);
903 }
904
905 /**
906  *      echo_char_raw   -       echo a character raw
907  *      @c: unicode byte to echo
908  *      @tty: terminal device
909  *
910  *      Echo user input back onto the screen. This must be called only when
911  *      L_ECHO(tty) is true. Called from the driver receive_buf path.
912  *
913  *      This variant does not treat control characters specially.
914  */
915
916 static void echo_char_raw(unsigned char c, struct n_tty_data *ldata)
917 {
918         if (c == ECHO_OP_START) {
919                 add_echo_byte(ECHO_OP_START, ldata);
920                 add_echo_byte(ECHO_OP_START, ldata);
921         } else {
922                 add_echo_byte(c, ldata);
923         }
924 }
925
926 /**
927  *      echo_char       -       echo a character
928  *      @c: unicode byte to echo
929  *      @tty: terminal device
930  *
931  *      Echo user input back onto the screen. This must be called only when
932  *      L_ECHO(tty) is true. Called from the driver receive_buf path.
933  *
934  *      This variant tags control characters to be echoed as "^X"
935  *      (where X is the letter representing the control char).
936  */
937
938 static void echo_char(unsigned char c, struct tty_struct *tty)
939 {
940         struct n_tty_data *ldata = tty->disc_data;
941
942         if (c == ECHO_OP_START) {
943                 add_echo_byte(ECHO_OP_START, ldata);
944                 add_echo_byte(ECHO_OP_START, ldata);
945         } else {
946                 if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
947                         add_echo_byte(ECHO_OP_START, ldata);
948                 add_echo_byte(c, ldata);
949         }
950 }
951
952 /**
953  *      finish_erasing          -       complete erase
954  *      @ldata: n_tty data
955  */
956
957 static inline void finish_erasing(struct n_tty_data *ldata)
958 {
959         if (ldata->erasing) {
960                 echo_char_raw('/', ldata);
961                 ldata->erasing = 0;
962         }
963 }
964
965 /**
966  *      eraser          -       handle erase function
967  *      @c: character input
968  *      @tty: terminal device
969  *
970  *      Perform erase and necessary output when an erase character is
971  *      present in the stream from the driver layer. Handles the complexities
972  *      of UTF-8 multibyte symbols.
973  *
974  *      n_tty_receive_buf()/producer path:
975  *              caller holds non-exclusive termios_rwsem
976  */
977
978 static void eraser(unsigned char c, struct tty_struct *tty)
979 {
980         struct n_tty_data *ldata = tty->disc_data;
981         enum { ERASE, WERASE, KILL } kill_type;
982         size_t head;
983         size_t cnt;
984         int seen_alnums;
985
986         if (ldata->read_head == ldata->canon_head) {
987                 /* process_output('\a', tty); */ /* what do you think? */
988                 return;
989         }
990         if (c == ERASE_CHAR(tty))
991                 kill_type = ERASE;
992         else if (c == WERASE_CHAR(tty))
993                 kill_type = WERASE;
994         else {
995                 if (!L_ECHO(tty)) {
996                         ldata->read_head = ldata->canon_head;
997                         return;
998                 }
999                 if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
1000                         ldata->read_head = ldata->canon_head;
1001                         finish_erasing(ldata);
1002                         echo_char(KILL_CHAR(tty), tty);
1003                         /* Add a newline if ECHOK is on and ECHOKE is off. */
1004                         if (L_ECHOK(tty))
1005                                 echo_char_raw('\n', ldata);
1006                         return;
1007                 }
1008                 kill_type = KILL;
1009         }
1010
1011         seen_alnums = 0;
1012         while (ldata->read_head != ldata->canon_head) {
1013                 head = ldata->read_head;
1014
1015                 /* erase a single possibly multibyte character */
1016                 do {
1017                         head--;
1018                         c = read_buf(ldata, head);
1019                 } while (is_continuation(c, tty) && head != ldata->canon_head);
1020
1021                 /* do not partially erase */
1022                 if (is_continuation(c, tty))
1023                         break;
1024
1025                 if (kill_type == WERASE) {
1026                         /* Equivalent to BSD's ALTWERASE. */
1027                         if (isalnum(c) || c == '_')
1028                                 seen_alnums++;
1029                         else if (seen_alnums)
1030                                 break;
1031                 }
1032                 cnt = ldata->read_head - head;
1033                 ldata->read_head = head;
1034                 if (L_ECHO(tty)) {
1035                         if (L_ECHOPRT(tty)) {
1036                                 if (!ldata->erasing) {
1037                                         echo_char_raw('\\', ldata);
1038                                         ldata->erasing = 1;
1039                                 }
1040                                 /* if cnt > 1, output a multi-byte character */
1041                                 echo_char(c, tty);
1042                                 while (--cnt > 0) {
1043                                         head++;
1044                                         echo_char_raw(read_buf(ldata, head), ldata);
1045                                         echo_move_back_col(ldata);
1046                                 }
1047                         } else if (kill_type == ERASE && !L_ECHOE(tty)) {
1048                                 echo_char(ERASE_CHAR(tty), tty);
1049                         } else if (c == '\t') {
1050                                 unsigned int num_chars = 0;
1051                                 int after_tab = 0;
1052                                 size_t tail = ldata->read_head;
1053
1054                                 /*
1055                                  * Count the columns used for characters
1056                                  * since the start of input or after a
1057                                  * previous tab.
1058                                  * This info is used to go back the correct
1059                                  * number of columns.
1060                                  */
1061                                 while (tail != ldata->canon_head) {
1062                                         tail--;
1063                                         c = read_buf(ldata, tail);
1064                                         if (c == '\t') {
1065                                                 after_tab = 1;
1066                                                 break;
1067                                         } else if (iscntrl(c)) {
1068                                                 if (L_ECHOCTL(tty))
1069                                                         num_chars += 2;
1070                                         } else if (!is_continuation(c, tty)) {
1071                                                 num_chars++;
1072                                         }
1073                                 }
1074                                 echo_erase_tab(num_chars, after_tab, ldata);
1075                         } else {
1076                                 if (iscntrl(c) && L_ECHOCTL(tty)) {
1077                                         echo_char_raw('\b', ldata);
1078                                         echo_char_raw(' ', ldata);
1079                                         echo_char_raw('\b', ldata);
1080                                 }
1081                                 if (!iscntrl(c) || L_ECHOCTL(tty)) {
1082                                         echo_char_raw('\b', ldata);
1083                                         echo_char_raw(' ', ldata);
1084                                         echo_char_raw('\b', ldata);
1085                                 }
1086                         }
1087                 }
1088                 if (kill_type == ERASE)
1089                         break;
1090         }
1091         if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
1092                 finish_erasing(ldata);
1093 }
1094
1095 /**
1096  *      isig            -       handle the ISIG optio
1097  *      @sig: signal
1098  *      @tty: terminal
1099  *
1100  *      Called when a signal is being sent due to terminal input.
1101  *      Called from the driver receive_buf path so serialized.
1102  *
1103  *      Performs input and output flush if !NOFLSH. In this context, the echo
1104  *      buffer is 'output'. The signal is processed first to alert any current
1105  *      readers or writers to discontinue and exit their i/o loops.
1106  *
1107  *      Locking: ctrl_lock
1108  */
1109
1110 static void __isig(int sig, struct tty_struct *tty)
1111 {
1112         struct pid *tty_pgrp = tty_get_pgrp(tty);
1113         if (tty_pgrp) {
1114                 kill_pgrp(tty_pgrp, sig, 1);
1115                 put_pid(tty_pgrp);
1116         }
1117 }
1118
1119 static void isig(int sig, struct tty_struct *tty)
1120 {
1121         struct n_tty_data *ldata = tty->disc_data;
1122
1123         if (L_NOFLSH(tty)) {
1124                 /* signal only */
1125                 __isig(sig, tty);
1126
1127         } else { /* signal and flush */
1128                 up_read(&tty->termios_rwsem);
1129                 down_write(&tty->termios_rwsem);
1130
1131                 __isig(sig, tty);
1132
1133                 /* clear echo buffer */
1134                 mutex_lock(&ldata->output_lock);
1135                 ldata->echo_head = ldata->echo_tail = 0;
1136                 ldata->echo_mark = ldata->echo_commit = 0;
1137                 mutex_unlock(&ldata->output_lock);
1138
1139                 /* clear output buffer */
1140                 tty_driver_flush_buffer(tty);
1141
1142                 /* clear input buffer */
1143                 reset_buffer_flags(tty->disc_data);
1144
1145                 /* notify pty master of flush */
1146                 if (tty->link)
1147                         n_tty_packet_mode_flush(tty);
1148
1149                 up_write(&tty->termios_rwsem);
1150                 down_read(&tty->termios_rwsem);
1151         }
1152 }
1153
1154 /**
1155  *      n_tty_receive_break     -       handle break
1156  *      @tty: terminal
1157  *
1158  *      An RS232 break event has been hit in the incoming bitstream. This
1159  *      can cause a variety of events depending upon the termios settings.
1160  *
1161  *      n_tty_receive_buf()/producer path:
1162  *              caller holds non-exclusive termios_rwsem
1163  *
1164  *      Note: may get exclusive termios_rwsem if flushing input buffer
1165  */
1166
1167 static void n_tty_receive_break(struct tty_struct *tty)
1168 {
1169         struct n_tty_data *ldata = tty->disc_data;
1170
1171         if (I_IGNBRK(tty))
1172                 return;
1173         if (I_BRKINT(tty)) {
1174                 isig(SIGINT, tty);
1175                 return;
1176         }
1177         if (I_PARMRK(tty)) {
1178                 put_tty_queue('\377', ldata);
1179                 put_tty_queue('\0', ldata);
1180         }
1181         put_tty_queue('\0', ldata);
1182         if (waitqueue_active(&tty->read_wait))
1183                 wake_up_interruptible_poll(&tty->read_wait, POLLIN);
1184 }
1185
1186 /**
1187  *      n_tty_receive_overrun   -       handle overrun reporting
1188  *      @tty: terminal
1189  *
1190  *      Data arrived faster than we could process it. While the tty
1191  *      driver has flagged this the bits that were missed are gone
1192  *      forever.
1193  *
1194  *      Called from the receive_buf path so single threaded. Does not
1195  *      need locking as num_overrun and overrun_time are function
1196  *      private.
1197  */
1198
1199 static void n_tty_receive_overrun(struct tty_struct *tty)
1200 {
1201         struct n_tty_data *ldata = tty->disc_data;
1202
1203         ldata->num_overrun++;
1204         if (time_after(jiffies, ldata->overrun_time + HZ) ||
1205                         time_after(ldata->overrun_time, jiffies)) {
1206                 printk(KERN_WARNING "%s: %d input overrun(s)\n",
1207                         tty_name(tty),
1208                         ldata->num_overrun);
1209                 ldata->overrun_time = jiffies;
1210                 ldata->num_overrun = 0;
1211         }
1212 }
1213
1214 /**
1215  *      n_tty_receive_parity_error      -       error notifier
1216  *      @tty: terminal device
1217  *      @c: character
1218  *
1219  *      Process a parity error and queue the right data to indicate
1220  *      the error case if necessary.
1221  *
1222  *      n_tty_receive_buf()/producer path:
1223  *              caller holds non-exclusive termios_rwsem
1224  */
1225 static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c)
1226 {
1227         struct n_tty_data *ldata = tty->disc_data;
1228
1229         if (I_INPCK(tty)) {
1230                 if (I_IGNPAR(tty))
1231                         return;
1232                 if (I_PARMRK(tty)) {
1233                         put_tty_queue('\377', ldata);
1234                         put_tty_queue('\0', ldata);
1235                         put_tty_queue(c, ldata);
1236                 } else
1237                         put_tty_queue('\0', ldata);
1238         } else
1239                 put_tty_queue(c, ldata);
1240         if (waitqueue_active(&tty->read_wait))
1241                 wake_up_interruptible_poll(&tty->read_wait, POLLIN);
1242 }
1243
1244 static void
1245 n_tty_receive_signal_char(struct tty_struct *tty, int signal, unsigned char c)
1246 {
1247         isig(signal, tty);
1248         if (I_IXON(tty))
1249                 start_tty(tty);
1250         if (L_ECHO(tty)) {
1251                 echo_char(c, tty);
1252                 commit_echoes(tty);
1253         } else
1254                 process_echoes(tty);
1255         return;
1256 }
1257
1258 /**
1259  *      n_tty_receive_char      -       perform processing
1260  *      @tty: terminal device
1261  *      @c: character
1262  *
1263  *      Process an individual character of input received from the driver.
1264  *      This is serialized with respect to itself by the rules for the
1265  *      driver above.
1266  *
1267  *      n_tty_receive_buf()/producer path:
1268  *              caller holds non-exclusive termios_rwsem
1269  *              publishes canon_head if canonical mode is active
1270  *
1271  *      Returns 1 if LNEXT was received, else returns 0
1272  */
1273
1274 static int
1275 n_tty_receive_char_special(struct tty_struct *tty, unsigned char c)
1276 {
1277         struct n_tty_data *ldata = tty->disc_data;
1278
1279         if (I_IXON(tty)) {
1280                 if (c == START_CHAR(tty)) {
1281                         start_tty(tty);
1282                         process_echoes(tty);
1283                         return 0;
1284                 }
1285                 if (c == STOP_CHAR(tty)) {
1286                         stop_tty(tty);
1287                         return 0;
1288                 }
1289         }
1290
1291         if (L_ISIG(tty)) {
1292                 if (c == INTR_CHAR(tty)) {
1293                         n_tty_receive_signal_char(tty, SIGINT, c);
1294                         return 0;
1295                 } else if (c == QUIT_CHAR(tty)) {
1296                         n_tty_receive_signal_char(tty, SIGQUIT, c);
1297                         return 0;
1298                 } else if (c == SUSP_CHAR(tty)) {
1299                         n_tty_receive_signal_char(tty, SIGTSTP, c);
1300                         return 0;
1301                 }
1302         }
1303
1304         if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1305                 start_tty(tty);
1306                 process_echoes(tty);
1307         }
1308
1309         if (c == '\r') {
1310                 if (I_IGNCR(tty))
1311                         return 0;
1312                 if (I_ICRNL(tty))
1313                         c = '\n';
1314         } else if (c == '\n' && I_INLCR(tty))
1315                 c = '\r';
1316
1317         if (ldata->icanon) {
1318                 if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
1319                     (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
1320                         eraser(c, tty);
1321                         commit_echoes(tty);
1322                         return 0;
1323                 }
1324                 if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
1325                         ldata->lnext = 1;
1326                         if (L_ECHO(tty)) {
1327                                 finish_erasing(ldata);
1328                                 if (L_ECHOCTL(tty)) {
1329                                         echo_char_raw('^', ldata);
1330                                         echo_char_raw('\b', ldata);
1331                                         commit_echoes(tty);
1332                                 }
1333                         }
1334                         return 1;
1335                 }
1336                 if (c == REPRINT_CHAR(tty) && L_ECHO(tty) && L_IEXTEN(tty)) {
1337                         size_t tail = ldata->canon_head;
1338
1339                         finish_erasing(ldata);
1340                         echo_char(c, tty);
1341                         echo_char_raw('\n', ldata);
1342                         while (tail != ldata->read_head) {
1343                                 echo_char(read_buf(ldata, tail), tty);
1344                                 tail++;
1345                         }
1346                         commit_echoes(tty);
1347                         return 0;
1348                 }
1349                 if (c == '\n') {
1350                         if (L_ECHO(tty) || L_ECHONL(tty)) {
1351                                 echo_char_raw('\n', ldata);
1352                                 commit_echoes(tty);
1353                         }
1354                         goto handle_newline;
1355                 }
1356                 if (c == EOF_CHAR(tty)) {
1357                         c = __DISABLED_CHAR;
1358                         goto handle_newline;
1359                 }
1360                 if ((c == EOL_CHAR(tty)) ||
1361                     (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
1362                         /*
1363                          * XXX are EOL_CHAR and EOL2_CHAR echoed?!?
1364                          */
1365                         if (L_ECHO(tty)) {
1366                                 /* Record the column of first canon char. */
1367                                 if (ldata->canon_head == ldata->read_head)
1368                                         echo_set_canon_col(ldata);
1369                                 echo_char(c, tty);
1370                                 commit_echoes(tty);
1371                         }
1372                         /*
1373                          * XXX does PARMRK doubling happen for
1374                          * EOL_CHAR and EOL2_CHAR?
1375                          */
1376                         if (c == (unsigned char) '\377' && I_PARMRK(tty))
1377                                 put_tty_queue(c, ldata);
1378
1379 handle_newline:
1380                         set_bit(ldata->read_head & (N_TTY_BUF_SIZE - 1), ldata->read_flags);
1381                         put_tty_queue(c, ldata);
1382                         smp_store_release(&ldata->canon_head, ldata->read_head);
1383                         kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1384                         wake_up_interruptible_poll(&tty->read_wait, POLLIN);
1385                         return 0;
1386                 }
1387         }
1388
1389         if (L_ECHO(tty)) {
1390                 finish_erasing(ldata);
1391                 if (c == '\n')
1392                         echo_char_raw('\n', ldata);
1393                 else {
1394                         /* Record the column of first canon char. */
1395                         if (ldata->canon_head == ldata->read_head)
1396                                 echo_set_canon_col(ldata);
1397                         echo_char(c, tty);
1398                 }
1399                 commit_echoes(tty);
1400         }
1401
1402         /* PARMRK doubling check */
1403         if (c == (unsigned char) '\377' && I_PARMRK(tty))
1404                 put_tty_queue(c, ldata);
1405
1406         put_tty_queue(c, ldata);
1407         return 0;
1408 }
1409
1410 static inline void
1411 n_tty_receive_char_inline(struct tty_struct *tty, unsigned char c)
1412 {
1413         struct n_tty_data *ldata = tty->disc_data;
1414
1415         if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1416                 start_tty(tty);
1417                 process_echoes(tty);
1418         }
1419         if (L_ECHO(tty)) {
1420                 finish_erasing(ldata);
1421                 /* Record the column of first canon char. */
1422                 if (ldata->canon_head == ldata->read_head)
1423                         echo_set_canon_col(ldata);
1424                 echo_char(c, tty);
1425                 commit_echoes(tty);
1426         }
1427         /* PARMRK doubling check */
1428         if (c == (unsigned char) '\377' && I_PARMRK(tty))
1429                 put_tty_queue(c, ldata);
1430         put_tty_queue(c, ldata);
1431 }
1432
1433 static void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
1434 {
1435         n_tty_receive_char_inline(tty, c);
1436 }
1437
1438 static inline void
1439 n_tty_receive_char_fast(struct tty_struct *tty, unsigned char c)
1440 {
1441         struct n_tty_data *ldata = tty->disc_data;
1442
1443         if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1444                 start_tty(tty);
1445                 process_echoes(tty);
1446         }
1447         if (L_ECHO(tty)) {
1448                 finish_erasing(ldata);
1449                 /* Record the column of first canon char. */
1450                 if (ldata->canon_head == ldata->read_head)
1451                         echo_set_canon_col(ldata);
1452                 echo_char(c, tty);
1453                 commit_echoes(tty);
1454         }
1455         put_tty_queue(c, ldata);
1456 }
1457
1458 static void n_tty_receive_char_closing(struct tty_struct *tty, unsigned char c)
1459 {
1460         if (I_ISTRIP(tty))
1461                 c &= 0x7f;
1462         if (I_IUCLC(tty) && L_IEXTEN(tty))
1463                 c = tolower(c);
1464
1465         if (I_IXON(tty)) {
1466                 if (c == STOP_CHAR(tty))
1467                         stop_tty(tty);
1468                 else if (c == START_CHAR(tty) ||
1469                          (tty->stopped && !tty->flow_stopped && I_IXANY(tty) &&
1470                           c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) &&
1471                           c != SUSP_CHAR(tty))) {
1472                         start_tty(tty);
1473                         process_echoes(tty);
1474                 }
1475         }
1476 }
1477
1478 static void
1479 n_tty_receive_char_flagged(struct tty_struct *tty, unsigned char c, char flag)
1480 {
1481         switch (flag) {
1482         case TTY_BREAK:
1483                 n_tty_receive_break(tty);
1484                 break;
1485         case TTY_PARITY:
1486         case TTY_FRAME:
1487                 n_tty_receive_parity_error(tty, c);
1488                 break;
1489         case TTY_OVERRUN:
1490                 n_tty_receive_overrun(tty);
1491                 break;
1492         default:
1493                 printk(KERN_ERR "%s: unknown flag %d\n",
1494                        tty_name(tty), flag);
1495                 break;
1496         }
1497 }
1498
1499 static void
1500 n_tty_receive_char_lnext(struct tty_struct *tty, unsigned char c, char flag)
1501 {
1502         struct n_tty_data *ldata = tty->disc_data;
1503
1504         ldata->lnext = 0;
1505         if (likely(flag == TTY_NORMAL)) {
1506                 if (I_ISTRIP(tty))
1507                         c &= 0x7f;
1508                 if (I_IUCLC(tty) && L_IEXTEN(tty))
1509                         c = tolower(c);
1510                 n_tty_receive_char(tty, c);
1511         } else
1512                 n_tty_receive_char_flagged(tty, c, flag);
1513 }
1514
1515 static void
1516 n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
1517                            char *fp, int count)
1518 {
1519         struct n_tty_data *ldata = tty->disc_data;
1520         size_t n, head;
1521
1522         head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1523         n = min_t(size_t, count, N_TTY_BUF_SIZE - head);
1524         memcpy(read_buf_addr(ldata, head), cp, n);
1525         ldata->read_head += n;
1526         cp += n;
1527         count -= n;
1528
1529         head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1530         n = min_t(size_t, count, N_TTY_BUF_SIZE - head);
1531         memcpy(read_buf_addr(ldata, head), cp, n);
1532         ldata->read_head += n;
1533 }
1534
1535 static void
1536 n_tty_receive_buf_raw(struct tty_struct *tty, const unsigned char *cp,
1537                       char *fp, int count)
1538 {
1539         struct n_tty_data *ldata = tty->disc_data;
1540         char flag = TTY_NORMAL;
1541
1542         while (count--) {
1543                 if (fp)
1544                         flag = *fp++;
1545                 if (likely(flag == TTY_NORMAL))
1546                         put_tty_queue(*cp++, ldata);
1547                 else
1548                         n_tty_receive_char_flagged(tty, *cp++, flag);
1549         }
1550 }
1551
1552 static void
1553 n_tty_receive_buf_closing(struct tty_struct *tty, const unsigned char *cp,
1554                           char *fp, int count)
1555 {
1556         char flag = TTY_NORMAL;
1557
1558         while (count--) {
1559                 if (fp)
1560                         flag = *fp++;
1561                 if (likely(flag == TTY_NORMAL))
1562                         n_tty_receive_char_closing(tty, *cp++);
1563                 else
1564                         n_tty_receive_char_flagged(tty, *cp++, flag);
1565         }
1566 }
1567
1568 static void
1569 n_tty_receive_buf_standard(struct tty_struct *tty, const unsigned char *cp,
1570                           char *fp, int count)
1571 {
1572         struct n_tty_data *ldata = tty->disc_data;
1573         char flag = TTY_NORMAL;
1574
1575         while (count--) {
1576                 if (fp)
1577                         flag = *fp++;
1578                 if (likely(flag == TTY_NORMAL)) {
1579                         unsigned char c = *cp++;
1580
1581                         if (I_ISTRIP(tty))
1582                                 c &= 0x7f;
1583                         if (I_IUCLC(tty) && L_IEXTEN(tty))
1584                                 c = tolower(c);
1585                         if (L_EXTPROC(tty)) {
1586                                 put_tty_queue(c, ldata);
1587                                 continue;
1588                         }
1589                         if (!test_bit(c, ldata->char_map))
1590                                 n_tty_receive_char_inline(tty, c);
1591                         else if (n_tty_receive_char_special(tty, c) && count) {
1592                                 if (fp)
1593                                         flag = *fp++;
1594                                 n_tty_receive_char_lnext(tty, *cp++, flag);
1595                                 count--;
1596                         }
1597                 } else
1598                         n_tty_receive_char_flagged(tty, *cp++, flag);
1599         }
1600 }
1601
1602 static void
1603 n_tty_receive_buf_fast(struct tty_struct *tty, const unsigned char *cp,
1604                        char *fp, int count)
1605 {
1606         struct n_tty_data *ldata = tty->disc_data;
1607         char flag = TTY_NORMAL;
1608
1609         while (count--) {
1610                 if (fp)
1611                         flag = *fp++;
1612                 if (likely(flag == TTY_NORMAL)) {
1613                         unsigned char c = *cp++;
1614
1615                         if (!test_bit(c, ldata->char_map))
1616                                 n_tty_receive_char_fast(tty, c);
1617                         else if (n_tty_receive_char_special(tty, c) && count) {
1618                                 if (fp)
1619                                         flag = *fp++;
1620                                 n_tty_receive_char_lnext(tty, *cp++, flag);
1621                                 count--;
1622                         }
1623                 } else
1624                         n_tty_receive_char_flagged(tty, *cp++, flag);
1625         }
1626 }
1627
1628 static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
1629                           char *fp, int count)
1630 {
1631         struct n_tty_data *ldata = tty->disc_data;
1632         bool preops = I_ISTRIP(tty) || (I_IUCLC(tty) && L_IEXTEN(tty));
1633
1634         if (ldata->real_raw)
1635                 n_tty_receive_buf_real_raw(tty, cp, fp, count);
1636         else if (ldata->raw || (L_EXTPROC(tty) && !preops))
1637                 n_tty_receive_buf_raw(tty, cp, fp, count);
1638         else if (tty->closing && !L_EXTPROC(tty))
1639                 n_tty_receive_buf_closing(tty, cp, fp, count);
1640         else {
1641                 if (ldata->lnext) {
1642                         char flag = TTY_NORMAL;
1643
1644                         if (fp)
1645                                 flag = *fp++;
1646                         n_tty_receive_char_lnext(tty, *cp++, flag);
1647                         count--;
1648                 }
1649
1650                 if (!preops && !I_PARMRK(tty))
1651                         n_tty_receive_buf_fast(tty, cp, fp, count);
1652                 else
1653                         n_tty_receive_buf_standard(tty, cp, fp, count);
1654
1655                 flush_echoes(tty);
1656                 if (tty->ops->flush_chars)
1657                         tty->ops->flush_chars(tty);
1658         }
1659
1660         if (ldata->icanon && !L_EXTPROC(tty))
1661                 return;
1662
1663         /* publish read_head to consumer */
1664         smp_store_release(&ldata->commit_head, ldata->read_head);
1665
1666         if ((read_cnt(ldata) >= ldata->minimum_to_wake) || L_EXTPROC(tty)) {
1667                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1668                 wake_up_interruptible_poll(&tty->read_wait, POLLIN);
1669         }
1670 }
1671
1672 /**
1673  *      n_tty_receive_buf_common        -       process input
1674  *      @tty: device to receive input
1675  *      @cp: input chars
1676  *      @fp: flags for each char (if NULL, all chars are TTY_NORMAL)
1677  *      @count: number of input chars in @cp
1678  *
1679  *      Called by the terminal driver when a block of characters has
1680  *      been received. This function must be called from soft contexts
1681  *      not from interrupt context. The driver is responsible for making
1682  *      calls one at a time and in order (or using flush_to_ldisc)
1683  *
1684  *      Returns the # of input chars from @cp which were processed.
1685  *
1686  *      In canonical mode, the maximum line length is 4096 chars (including
1687  *      the line termination char); lines longer than 4096 chars are
1688  *      truncated. After 4095 chars, input data is still processed but
1689  *      not stored. Overflow processing ensures the tty can always
1690  *      receive more input until at least one line can be read.
1691  *
1692  *      In non-canonical mode, the read buffer will only accept 4095 chars;
1693  *      this provides the necessary space for a newline char if the input
1694  *      mode is switched to canonical.
1695  *
1696  *      Note it is possible for the read buffer to _contain_ 4096 chars
1697  *      in non-canonical mode: the read buffer could already contain the
1698  *      maximum canon line of 4096 chars when the mode is switched to
1699  *      non-canonical.
1700  *
1701  *      n_tty_receive_buf()/producer path:
1702  *              claims non-exclusive termios_rwsem
1703  *              publishes commit_head or canon_head
1704  */
1705 static int
1706 n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
1707                          char *fp, int count, int flow)
1708 {
1709         struct n_tty_data *ldata = tty->disc_data;
1710         int room, n, rcvd = 0, overflow;
1711
1712         down_read(&tty->termios_rwsem);
1713
1714         while (1) {
1715                 /*
1716                  * When PARMRK is set, each input char may take up to 3 chars
1717                  * in the read buf; reduce the buffer space avail by 3x
1718                  *
1719                  * If we are doing input canonicalization, and there are no
1720                  * pending newlines, let characters through without limit, so
1721                  * that erase characters will be handled.  Other excess
1722                  * characters will be beeped.
1723                  *
1724                  * paired with store in *_copy_from_read_buf() -- guarantees
1725                  * the consumer has loaded the data in read_buf up to the new
1726                  * read_tail (so this producer will not overwrite unread data)
1727                  */
1728                 size_t tail = smp_load_acquire(&ldata->read_tail);
1729
1730                 room = N_TTY_BUF_SIZE - (ldata->read_head - tail);
1731                 if (I_PARMRK(tty))
1732                         room = (room + 2) / 3;
1733                 room--;
1734                 if (room <= 0) {
1735                         overflow = ldata->icanon && ldata->canon_head == tail;
1736                         if (overflow && room < 0)
1737                                 ldata->read_head--;
1738                         room = overflow;
1739                         ldata->no_room = flow && !room;
1740                 } else
1741                         overflow = 0;
1742
1743                 n = min(count, room);
1744                 if (!n)
1745                         break;
1746
1747                 /* ignore parity errors if handling overflow */
1748                 if (!overflow || !fp || *fp != TTY_PARITY)
1749                         __receive_buf(tty, cp, fp, n);
1750
1751                 cp += n;
1752                 if (fp)
1753                         fp += n;
1754                 count -= n;
1755                 rcvd += n;
1756         }
1757
1758         tty->receive_room = room;
1759
1760         /* Unthrottle if handling overflow on pty */
1761         if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
1762                 if (overflow) {
1763                         tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
1764                         tty_unthrottle_safe(tty);
1765                         __tty_set_flow_change(tty, 0);
1766                 }
1767         } else
1768                 n_tty_check_throttle(tty);
1769
1770         up_read(&tty->termios_rwsem);
1771
1772         return rcvd;
1773 }
1774
1775 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
1776                               char *fp, int count)
1777 {
1778         n_tty_receive_buf_common(tty, cp, fp, count, 0);
1779 }
1780
1781 static int n_tty_receive_buf2(struct tty_struct *tty, const unsigned char *cp,
1782                               char *fp, int count)
1783 {
1784         return n_tty_receive_buf_common(tty, cp, fp, count, 1);
1785 }
1786
1787 int is_ignored(int sig)
1788 {
1789         return (sigismember(&current->blocked, sig) ||
1790                 current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
1791 }
1792
1793 /**
1794  *      n_tty_set_termios       -       termios data changed
1795  *      @tty: terminal
1796  *      @old: previous data
1797  *
1798  *      Called by the tty layer when the user changes termios flags so
1799  *      that the line discipline can plan ahead. This function cannot sleep
1800  *      and is protected from re-entry by the tty layer. The user is
1801  *      guaranteed that this function will not be re-entered or in progress
1802  *      when the ldisc is closed.
1803  *
1804  *      Locking: Caller holds tty->termios_rwsem
1805  */
1806
1807 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
1808 {
1809         struct n_tty_data *ldata = tty->disc_data;
1810
1811         if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) {
1812                 bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
1813                 ldata->line_start = ldata->read_tail;
1814                 if (!L_ICANON(tty) || !read_cnt(ldata)) {
1815                         ldata->canon_head = ldata->read_tail;
1816                         ldata->push = 0;
1817                 } else {
1818                         set_bit((ldata->read_head - 1) & (N_TTY_BUF_SIZE - 1),
1819                                 ldata->read_flags);
1820                         ldata->canon_head = ldata->read_head;
1821                         ldata->push = 1;
1822                 }
1823                 ldata->commit_head = ldata->read_head;
1824                 ldata->erasing = 0;
1825                 ldata->lnext = 0;
1826         }
1827
1828         ldata->icanon = (L_ICANON(tty) != 0);
1829
1830         if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
1831             I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
1832             I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
1833             I_PARMRK(tty)) {
1834                 bitmap_zero(ldata->char_map, 256);
1835
1836                 if (I_IGNCR(tty) || I_ICRNL(tty))
1837                         set_bit('\r', ldata->char_map);
1838                 if (I_INLCR(tty))
1839                         set_bit('\n', ldata->char_map);
1840
1841                 if (L_ICANON(tty)) {
1842                         set_bit(ERASE_CHAR(tty), ldata->char_map);
1843                         set_bit(KILL_CHAR(tty), ldata->char_map);
1844                         set_bit(EOF_CHAR(tty), ldata->char_map);
1845                         set_bit('\n', ldata->char_map);
1846                         set_bit(EOL_CHAR(tty), ldata->char_map);
1847                         if (L_IEXTEN(tty)) {
1848                                 set_bit(WERASE_CHAR(tty), ldata->char_map);
1849                                 set_bit(LNEXT_CHAR(tty), ldata->char_map);
1850                                 set_bit(EOL2_CHAR(tty), ldata->char_map);
1851                                 if (L_ECHO(tty))
1852                                         set_bit(REPRINT_CHAR(tty),
1853                                                 ldata->char_map);
1854                         }
1855                 }
1856                 if (I_IXON(tty)) {
1857                         set_bit(START_CHAR(tty), ldata->char_map);
1858                         set_bit(STOP_CHAR(tty), ldata->char_map);
1859                 }
1860                 if (L_ISIG(tty)) {
1861                         set_bit(INTR_CHAR(tty), ldata->char_map);
1862                         set_bit(QUIT_CHAR(tty), ldata->char_map);
1863                         set_bit(SUSP_CHAR(tty), ldata->char_map);
1864                 }
1865                 clear_bit(__DISABLED_CHAR, ldata->char_map);
1866                 ldata->raw = 0;
1867                 ldata->real_raw = 0;
1868         } else {
1869                 ldata->raw = 1;
1870                 if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1871                     (I_IGNPAR(tty) || !I_INPCK(tty)) &&
1872                     (tty->driver->flags & TTY_DRIVER_REAL_RAW))
1873                         ldata->real_raw = 1;
1874                 else
1875                         ldata->real_raw = 0;
1876         }
1877         /*
1878          * Fix tty hang when I_IXON(tty) is cleared, but the tty
1879          * been stopped by STOP_CHAR(tty) before it.
1880          */
1881         if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) {
1882                 start_tty(tty);
1883                 process_echoes(tty);
1884         }
1885
1886         /* The termios change make the tty ready for I/O */
1887         wake_up_interruptible(&tty->write_wait);
1888         wake_up_interruptible(&tty->read_wait);
1889 }
1890
1891 /**
1892  *      n_tty_close             -       close the ldisc for this tty
1893  *      @tty: device
1894  *
1895  *      Called from the terminal layer when this line discipline is
1896  *      being shut down, either because of a close or becsuse of a
1897  *      discipline change. The function will not be called while other
1898  *      ldisc methods are in progress.
1899  */
1900
1901 static void n_tty_close(struct tty_struct *tty)
1902 {
1903         struct n_tty_data *ldata = tty->disc_data;
1904
1905         if (tty->link)
1906                 n_tty_packet_mode_flush(tty);
1907
1908         vfree(ldata);
1909         tty->disc_data = NULL;
1910 }
1911
1912 /**
1913  *      n_tty_open              -       open an ldisc
1914  *      @tty: terminal to open
1915  *
1916  *      Called when this line discipline is being attached to the
1917  *      terminal device. Can sleep. Called serialized so that no
1918  *      other events will occur in parallel. No further open will occur
1919  *      until a close.
1920  */
1921
1922 static int n_tty_open(struct tty_struct *tty)
1923 {
1924         struct n_tty_data *ldata;
1925
1926         /* Currently a malloc failure here can panic */
1927         ldata = vmalloc(sizeof(*ldata));
1928         if (!ldata)
1929                 goto err;
1930
1931         ldata->overrun_time = jiffies;
1932         mutex_init(&ldata->atomic_read_lock);
1933         mutex_init(&ldata->output_lock);
1934
1935         tty->disc_data = ldata;
1936         reset_buffer_flags(tty->disc_data);
1937         ldata->column = 0;
1938         ldata->canon_column = 0;
1939         ldata->minimum_to_wake = 1;
1940         ldata->num_overrun = 0;
1941         ldata->no_room = 0;
1942         ldata->lnext = 0;
1943         tty->closing = 0;
1944         /* indicate buffer work may resume */
1945         clear_bit(TTY_LDISC_HALTED, &tty->flags);
1946         n_tty_set_termios(tty, NULL);
1947         tty_unthrottle(tty);
1948
1949         return 0;
1950 err:
1951         return -ENOMEM;
1952 }
1953
1954 static inline int input_available_p(struct tty_struct *tty, int poll)
1955 {
1956         struct n_tty_data *ldata = tty->disc_data;
1957         int amt = poll && !TIME_CHAR(tty) && MIN_CHAR(tty) ? MIN_CHAR(tty) : 1;
1958
1959         if (ldata->icanon && !L_EXTPROC(tty))
1960                 return ldata->canon_head != ldata->read_tail;
1961         else
1962                 return ldata->commit_head - ldata->read_tail >= amt;
1963 }
1964
1965 static inline int check_other_done(struct tty_struct *tty)
1966 {
1967         int done = test_bit(TTY_OTHER_DONE, &tty->flags);
1968         if (done) {
1969                 /* paired with cmpxchg() in check_other_closed(); ensures
1970                  * read buffer head index is not stale
1971                  */
1972                 smp_mb__after_atomic();
1973         }
1974         return done;
1975 }
1976
1977 /**
1978  *      copy_from_read_buf      -       copy read data directly
1979  *      @tty: terminal device
1980  *      @b: user data
1981  *      @nr: size of data
1982  *
1983  *      Helper function to speed up n_tty_read.  It is only called when
1984  *      ICANON is off; it copies characters straight from the tty queue to
1985  *      user space directly.  It can be profitably called twice; once to
1986  *      drain the space from the tail pointer to the (physical) end of the
1987  *      buffer, and once to drain the space from the (physical) beginning of
1988  *      the buffer to head pointer.
1989  *
1990  *      Called under the ldata->atomic_read_lock sem
1991  *
1992  *      n_tty_read()/consumer path:
1993  *              caller holds non-exclusive termios_rwsem
1994  *              read_tail published
1995  */
1996
1997 static int copy_from_read_buf(struct tty_struct *tty,
1998                                       unsigned char __user **b,
1999                                       size_t *nr)
2000
2001 {
2002         struct n_tty_data *ldata = tty->disc_data;
2003         int retval;
2004         size_t n;
2005         bool is_eof;
2006         size_t head = smp_load_acquire(&ldata->commit_head);
2007         size_t tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
2008
2009         retval = 0;
2010         n = min(head - ldata->read_tail, N_TTY_BUF_SIZE - tail);
2011         n = min(*nr, n);
2012         if (n) {
2013                 retval = copy_to_user(*b, read_buf_addr(ldata, tail), n);
2014                 n -= retval;
2015                 is_eof = n == 1 && read_buf(ldata, tail) == EOF_CHAR(tty);
2016                 tty_audit_add_data(tty, read_buf_addr(ldata, tail), n,
2017                                 ldata->icanon);
2018                 smp_store_release(&ldata->read_tail, ldata->read_tail + n);
2019                 /* Turn single EOF into zero-length read */
2020                 if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
2021                     (head == ldata->read_tail))
2022                         n = 0;
2023                 *b += n;
2024                 *nr -= n;
2025         }
2026         return retval;
2027 }
2028
2029 /**
2030  *      canon_copy_from_read_buf        -       copy read data in canonical mode
2031  *      @tty: terminal device
2032  *      @b: user data
2033  *      @nr: size of data
2034  *
2035  *      Helper function for n_tty_read.  It is only called when ICANON is on;
2036  *      it copies one line of input up to and including the line-delimiting
2037  *      character into the user-space buffer.
2038  *
2039  *      NB: When termios is changed from non-canonical to canonical mode and
2040  *      the read buffer contains data, n_tty_set_termios() simulates an EOF
2041  *      push (as if C-d were input) _without_ the DISABLED_CHAR in the buffer.
2042  *      This causes data already processed as input to be immediately available
2043  *      as input although a newline has not been received.
2044  *
2045  *      Called under the atomic_read_lock mutex
2046  *
2047  *      n_tty_read()/consumer path:
2048  *              caller holds non-exclusive termios_rwsem
2049  *              read_tail published
2050  */
2051
2052 static int canon_copy_from_read_buf(struct tty_struct *tty,
2053                                     unsigned char __user **b,
2054                                     size_t *nr)
2055 {
2056         struct n_tty_data *ldata = tty->disc_data;
2057         size_t n, size, more, c;
2058         size_t eol;
2059         size_t tail;
2060         int ret, found = 0;
2061         bool eof_push = 0;
2062
2063         /* N.B. avoid overrun if nr == 0 */
2064         n = min(*nr, smp_load_acquire(&ldata->canon_head) - ldata->read_tail);
2065         if (!n)
2066                 return 0;
2067
2068         tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
2069         size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
2070
2071         n_tty_trace("%s: nr:%zu tail:%zu n:%zu size:%zu\n",
2072                     __func__, *nr, tail, n, size);
2073
2074         eol = find_next_bit(ldata->read_flags, size, tail);
2075         more = n - (size - tail);
2076         if (eol == N_TTY_BUF_SIZE && more) {
2077                 /* scan wrapped without finding set bit */
2078                 eol = find_next_bit(ldata->read_flags, more, 0);
2079                 if (eol != more)
2080                         found = 1;
2081         } else if (eol != size)
2082                 found = 1;
2083
2084         size = N_TTY_BUF_SIZE - tail;
2085         n = eol - tail;
2086         if (n > N_TTY_BUF_SIZE)
2087                 n += N_TTY_BUF_SIZE;
2088         n += found;
2089         c = n;
2090
2091         if (found && !ldata->push && read_buf(ldata, eol) == __DISABLED_CHAR) {
2092                 n--;
2093                 eof_push = !n && ldata->read_tail != ldata->line_start;
2094         }
2095
2096         n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
2097                     __func__, eol, found, n, c, size, more);
2098
2099         if (n > size) {
2100                 ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), size);
2101                 if (ret)
2102                         return -EFAULT;
2103                 ret = tty_copy_to_user(tty, *b + size, ldata->read_buf, n - size);
2104         } else
2105                 ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), n);
2106
2107         if (ret)
2108                 return -EFAULT;
2109         *b += n;
2110         *nr -= n;
2111
2112         if (found)
2113                 clear_bit(eol, ldata->read_flags);
2114         smp_store_release(&ldata->read_tail, ldata->read_tail + c);
2115
2116         if (found) {
2117                 if (!ldata->push)
2118                         ldata->line_start = ldata->read_tail;
2119                 else
2120                         ldata->push = 0;
2121                 tty_audit_push(tty);
2122         }
2123         return eof_push ? -EAGAIN : 0;
2124 }
2125
2126 extern ssize_t redirected_tty_write(struct file *, const char __user *,
2127                                                         size_t, loff_t *);
2128
2129 /**
2130  *      job_control             -       check job control
2131  *      @tty: tty
2132  *      @file: file handle
2133  *
2134  *      Perform job control management checks on this file/tty descriptor
2135  *      and if appropriate send any needed signals and return a negative
2136  *      error code if action should be taken.
2137  *
2138  *      Locking: redirected write test is safe
2139  *               current->signal->tty check is safe
2140  *               ctrl_lock to safely reference tty->pgrp
2141  */
2142
2143 static int job_control(struct tty_struct *tty, struct file *file)
2144 {
2145         struct pid *pgrp;
2146
2147         /* Job control check -- must be done at start and after
2148            every sleep (POSIX.1 7.1.1.4). */
2149         /* NOTE: not yet done after every sleep pending a thorough
2150            check of the logic of this change. -- jlc */
2151         /* don't stop on /dev/console */
2152         if (file->f_op->write == redirected_tty_write ||
2153             current->signal->tty != tty)
2154                 return 0;
2155
2156         rcu_read_lock();
2157         pgrp = task_pgrp(current);
2158
2159         spin_lock_irq(&tty->ctrl_lock);
2160         if (!tty->pgrp)
2161                 printk(KERN_ERR "n_tty_read: no tty->pgrp!\n");
2162         else if (pgrp != tty->pgrp) {
2163                 spin_unlock_irq(&tty->ctrl_lock);
2164                 if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned()) {
2165                         rcu_read_unlock();
2166                         return -EIO;
2167                 }
2168                 kill_pgrp(pgrp, SIGTTIN, 1);
2169                 rcu_read_unlock();
2170                 set_thread_flag(TIF_SIGPENDING);
2171                 return -ERESTARTSYS;
2172         }
2173         spin_unlock_irq(&tty->ctrl_lock);
2174         rcu_read_unlock();
2175         return 0;
2176 }
2177
2178
2179 /**
2180  *      n_tty_read              -       read function for tty
2181  *      @tty: tty device
2182  *      @file: file object
2183  *      @buf: userspace buffer pointer
2184  *      @nr: size of I/O
2185  *
2186  *      Perform reads for the line discipline. We are guaranteed that the
2187  *      line discipline will not be closed under us but we may get multiple
2188  *      parallel readers and must handle this ourselves. We may also get
2189  *      a hangup. Always called in user context, may sleep.
2190  *
2191  *      This code must be sure never to sleep through a hangup.
2192  *
2193  *      n_tty_read()/consumer path:
2194  *              claims non-exclusive termios_rwsem
2195  *              publishes read_tail
2196  */
2197
2198 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
2199                          unsigned char __user *buf, size_t nr)
2200 {
2201         struct n_tty_data *ldata = tty->disc_data;
2202         unsigned char __user *b = buf;
2203         DEFINE_WAIT_FUNC(wait, woken_wake_function);
2204         int c, done;
2205         int minimum, time;
2206         ssize_t retval = 0;
2207         long timeout;
2208         int packet;
2209         size_t tail;
2210
2211         c = job_control(tty, file);
2212         if (c < 0)
2213                 return c;
2214
2215         /*
2216          *      Internal serialization of reads.
2217          */
2218         if (file->f_flags & O_NONBLOCK) {
2219                 if (!mutex_trylock(&ldata->atomic_read_lock))
2220                         return -EAGAIN;
2221         } else {
2222                 if (mutex_lock_interruptible(&ldata->atomic_read_lock))
2223                         return -ERESTARTSYS;
2224         }
2225
2226         down_read(&tty->termios_rwsem);
2227
2228         minimum = time = 0;
2229         timeout = MAX_SCHEDULE_TIMEOUT;
2230         if (!ldata->icanon) {
2231                 minimum = MIN_CHAR(tty);
2232                 if (minimum) {
2233                         time = (HZ / 10) * TIME_CHAR(tty);
2234                         if (time)
2235                                 ldata->minimum_to_wake = 1;
2236                         else if (!waitqueue_active(&tty->read_wait) ||
2237                                  (ldata->minimum_to_wake > minimum))
2238                                 ldata->minimum_to_wake = minimum;
2239                 } else {
2240                         timeout = (HZ / 10) * TIME_CHAR(tty);
2241                         ldata->minimum_to_wake = minimum = 1;
2242                 }
2243         }
2244
2245         packet = tty->packet;
2246         tail = ldata->read_tail;
2247
2248         add_wait_queue(&tty->read_wait, &wait);
2249         while (nr) {
2250                 /* First test for status change. */
2251                 if (packet && tty->link->ctrl_status) {
2252                         unsigned char cs;
2253                         if (b != buf)
2254                                 break;
2255                         spin_lock_irq(&tty->link->ctrl_lock);
2256                         cs = tty->link->ctrl_status;
2257                         tty->link->ctrl_status = 0;
2258                         spin_unlock_irq(&tty->link->ctrl_lock);
2259                         if (tty_put_user(tty, cs, b++)) {
2260                                 retval = -EFAULT;
2261                                 b--;
2262                                 break;
2263                         }
2264                         nr--;
2265                         break;
2266                 }
2267
2268                 if (((minimum - (b - buf)) < ldata->minimum_to_wake) &&
2269                     ((minimum - (b - buf)) >= 1))
2270                         ldata->minimum_to_wake = (minimum - (b - buf));
2271
2272                 done = check_other_done(tty);
2273
2274                 if (!input_available_p(tty, 0)) {
2275                         if (done) {
2276                                 retval = -EIO;
2277                                 break;
2278                         }
2279                         if (tty_hung_up_p(file))
2280                                 break;
2281                         if (!timeout)
2282                                 break;
2283                         if (file->f_flags & O_NONBLOCK) {
2284                                 retval = -EAGAIN;
2285                                 break;
2286                         }
2287                         if (signal_pending(current)) {
2288                                 retval = -ERESTARTSYS;
2289                                 break;
2290                         }
2291                         up_read(&tty->termios_rwsem);
2292
2293                         timeout = wait_woken(&wait, TASK_INTERRUPTIBLE,
2294                                              timeout);
2295
2296                         down_read(&tty->termios_rwsem);
2297                         continue;
2298                 }
2299
2300                 if (ldata->icanon && !L_EXTPROC(tty)) {
2301                         retval = canon_copy_from_read_buf(tty, &b, &nr);
2302                         if (retval == -EAGAIN) {
2303                                 retval = 0;
2304                                 continue;
2305                         } else if (retval)
2306                                 break;
2307                 } else {
2308                         int uncopied;
2309
2310                         /* Deal with packet mode. */
2311                         if (packet && b == buf) {
2312                                 if (tty_put_user(tty, TIOCPKT_DATA, b++)) {
2313                                         retval = -EFAULT;
2314                                         b--;
2315                                         break;
2316                                 }
2317                                 nr--;
2318                         }
2319
2320                         uncopied = copy_from_read_buf(tty, &b, &nr);
2321                         uncopied += copy_from_read_buf(tty, &b, &nr);
2322                         if (uncopied) {
2323                                 retval = -EFAULT;
2324                                 break;
2325                         }
2326                 }
2327
2328                 n_tty_check_unthrottle(tty);
2329
2330                 if (b - buf >= minimum)
2331                         break;
2332                 if (time)
2333                         timeout = time;
2334         }
2335         if (tail != ldata->read_tail)
2336                 n_tty_kick_worker(tty);
2337         up_read(&tty->termios_rwsem);
2338
2339         remove_wait_queue(&tty->read_wait, &wait);
2340         if (!waitqueue_active(&tty->read_wait))
2341                 ldata->minimum_to_wake = minimum;
2342
2343         mutex_unlock(&ldata->atomic_read_lock);
2344
2345         if (b - buf)
2346                 retval = b - buf;
2347
2348         return retval;
2349 }
2350
2351 /**
2352  *      n_tty_write             -       write function for tty
2353  *      @tty: tty device
2354  *      @file: file object
2355  *      @buf: userspace buffer pointer
2356  *      @nr: size of I/O
2357  *
2358  *      Write function of the terminal device.  This is serialized with
2359  *      respect to other write callers but not to termios changes, reads
2360  *      and other such events.  Since the receive code will echo characters,
2361  *      thus calling driver write methods, the output_lock is used in
2362  *      the output processing functions called here as well as in the
2363  *      echo processing function to protect the column state and space
2364  *      left in the buffer.
2365  *
2366  *      This code must be sure never to sleep through a hangup.
2367  *
2368  *      Locking: output_lock to protect column state and space left
2369  *               (note that the process_output*() functions take this
2370  *                lock themselves)
2371  */
2372
2373 static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
2374                            const unsigned char *buf, size_t nr)
2375 {
2376         const unsigned char *b = buf;
2377         DEFINE_WAIT_FUNC(wait, woken_wake_function);
2378         int c;
2379         ssize_t retval = 0;
2380
2381         /* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
2382         if (L_TOSTOP(tty) && file->f_op->write != redirected_tty_write) {
2383                 retval = tty_check_change(tty);
2384                 if (retval)
2385                         return retval;
2386         }
2387
2388         down_read(&tty->termios_rwsem);
2389
2390         /* Write out any echoed characters that are still pending */
2391         process_echoes(tty);
2392
2393         add_wait_queue(&tty->write_wait, &wait);
2394         while (1) {
2395                 if (signal_pending(current)) {
2396                         retval = -ERESTARTSYS;
2397                         break;
2398                 }
2399                 if (tty_hung_up_p(file) || (tty->link && !tty->link->count)) {
2400                         retval = -EIO;
2401                         break;
2402                 }
2403                 if (O_OPOST(tty)) {
2404                         while (nr > 0) {
2405                                 ssize_t num = process_output_block(tty, b, nr);
2406                                 if (num < 0) {
2407                                         if (num == -EAGAIN)
2408                                                 break;
2409                                         retval = num;
2410                                         goto break_out;
2411                                 }
2412                                 b += num;
2413                                 nr -= num;
2414                                 if (nr == 0)
2415                                         break;
2416                                 c = *b;
2417                                 if (process_output(c, tty) < 0)
2418                                         break;
2419                                 b++; nr--;
2420                         }
2421                         if (tty->ops->flush_chars)
2422                                 tty->ops->flush_chars(tty);
2423                 } else {
2424                         struct n_tty_data *ldata = tty->disc_data;
2425
2426                         while (nr > 0) {
2427                                 mutex_lock(&ldata->output_lock);
2428                                 c = tty->ops->write(tty, b, nr);
2429                                 mutex_unlock(&ldata->output_lock);
2430                                 if (c < 0) {
2431                                         retval = c;
2432                                         goto break_out;
2433                                 }
2434                                 if (!c)
2435                                         break;
2436                                 b += c;
2437                                 nr -= c;
2438                         }
2439                 }
2440                 if (!nr)
2441                         break;
2442                 if (file->f_flags & O_NONBLOCK) {
2443                         retval = -EAGAIN;
2444                         break;
2445                 }
2446                 up_read(&tty->termios_rwsem);
2447
2448                 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2449
2450                 down_read(&tty->termios_rwsem);
2451         }
2452 break_out:
2453         remove_wait_queue(&tty->write_wait, &wait);
2454         if (b - buf != nr && tty->fasync)
2455                 set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
2456         up_read(&tty->termios_rwsem);
2457         return (b - buf) ? b - buf : retval;
2458 }
2459
2460 /**
2461  *      n_tty_poll              -       poll method for N_TTY
2462  *      @tty: terminal device
2463  *      @file: file accessing it
2464  *      @wait: poll table
2465  *
2466  *      Called when the line discipline is asked to poll() for data or
2467  *      for special events. This code is not serialized with respect to
2468  *      other events save open/close.
2469  *
2470  *      This code must be sure never to sleep through a hangup.
2471  *      Called without the kernel lock held - fine
2472  */
2473
2474 static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
2475                                                         poll_table *wait)
2476 {
2477         struct n_tty_data *ldata = tty->disc_data;
2478         unsigned int mask = 0;
2479
2480         poll_wait(file, &tty->read_wait, wait);
2481         poll_wait(file, &tty->write_wait, wait);
2482         if (check_other_done(tty))
2483                 mask |= POLLHUP;
2484         if (input_available_p(tty, 1))
2485                 mask |= POLLIN | POLLRDNORM;
2486         if (tty->packet && tty->link->ctrl_status)
2487                 mask |= POLLPRI | POLLIN | POLLRDNORM;
2488         if (tty_hung_up_p(file))
2489                 mask |= POLLHUP;
2490         if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
2491                 if (MIN_CHAR(tty) && !TIME_CHAR(tty))
2492                         ldata->minimum_to_wake = MIN_CHAR(tty);
2493                 else
2494                         ldata->minimum_to_wake = 1;
2495         }
2496         if (tty->ops->write && !tty_is_writelocked(tty) &&
2497                         tty_chars_in_buffer(tty) < WAKEUP_CHARS &&
2498                         tty_write_room(tty) > 0)
2499                 mask |= POLLOUT | POLLWRNORM;
2500         return mask;
2501 }
2502
2503 static unsigned long inq_canon(struct n_tty_data *ldata)
2504 {
2505         size_t nr, head, tail;
2506
2507         if (ldata->canon_head == ldata->read_tail)
2508                 return 0;
2509         head = ldata->canon_head;
2510         tail = ldata->read_tail;
2511         nr = head - tail;
2512         /* Skip EOF-chars.. */
2513         while (head != tail) {
2514                 if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) &&
2515                     read_buf(ldata, tail) == __DISABLED_CHAR)
2516                         nr--;
2517                 tail++;
2518         }
2519         return nr;
2520 }
2521
2522 static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
2523                        unsigned int cmd, unsigned long arg)
2524 {
2525         struct n_tty_data *ldata = tty->disc_data;
2526         int retval;
2527
2528         switch (cmd) {
2529         case TIOCOUTQ:
2530                 return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2531         case TIOCINQ:
2532                 down_write(&tty->termios_rwsem);
2533                 if (L_ICANON(tty))
2534                         retval = inq_canon(ldata);
2535                 else
2536                         retval = read_cnt(ldata);
2537                 up_write(&tty->termios_rwsem);
2538                 return put_user(retval, (unsigned int __user *) arg);
2539         default:
2540                 return n_tty_ioctl_helper(tty, file, cmd, arg);
2541         }
2542 }
2543
2544 static void n_tty_fasync(struct tty_struct *tty, int on)
2545 {
2546         struct n_tty_data *ldata = tty->disc_data;
2547
2548         if (!waitqueue_active(&tty->read_wait)) {
2549                 if (on)
2550                         ldata->minimum_to_wake = 1;
2551                 else if (!tty->fasync)
2552                         ldata->minimum_to_wake = N_TTY_BUF_SIZE;
2553         }
2554 }
2555
2556 struct tty_ldisc_ops tty_ldisc_N_TTY = {
2557         .magic           = TTY_LDISC_MAGIC,
2558         .name            = "n_tty",
2559         .open            = n_tty_open,
2560         .close           = n_tty_close,
2561         .flush_buffer    = n_tty_flush_buffer,
2562         .chars_in_buffer = n_tty_chars_in_buffer,
2563         .read            = n_tty_read,
2564         .write           = n_tty_write,
2565         .ioctl           = n_tty_ioctl,
2566         .set_termios     = n_tty_set_termios,
2567         .poll            = n_tty_poll,
2568         .receive_buf     = n_tty_receive_buf,
2569         .write_wakeup    = n_tty_write_wakeup,
2570         .fasync          = n_tty_fasync,
2571         .receive_buf2    = n_tty_receive_buf2,
2572 };
2573
2574 /**
2575  *      n_tty_inherit_ops       -       inherit N_TTY methods
2576  *      @ops: struct tty_ldisc_ops where to save N_TTY methods
2577  *
2578  *      Enables a 'subclass' line discipline to 'inherit' N_TTY
2579  *      methods.
2580  */
2581
2582 void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
2583 {
2584         *ops = tty_ldisc_N_TTY;
2585         ops->owner = NULL;
2586         ops->refcount = ops->flags = 0;
2587 }
2588 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);