xref: /openbmc/linux/drivers/tty/n_tty.c (revision e23feb16)
1 /*
2  * n_tty.c --- implements the N_TTY line discipline.
3  *
4  * This code used to be in tty_io.c, but things are getting hairy
5  * enough that it made sense to split things off.  (The N_TTY
6  * processing has changed so much that it's hardly recognizable,
7  * anyway...)
8  *
9  * Note that the open routine for N_TTY is guaranteed never to return
10  * an error.  This is because Linux will fall back to setting a line
11  * to N_TTY if it can not switch to any other line discipline.
12  *
13  * Written by Theodore Ts'o, Copyright 1994.
14  *
15  * This file also contains code originally written by Linus Torvalds,
16  * Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
17  *
18  * This file may be redistributed under the terms of the GNU General Public
19  * License.
20  *
21  * Reduced memory usage for older ARM systems  - Russell King.
22  *
23  * 2000/01/20   Fixed SMP locking on put_tty_queue using bits of
24  *		the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
25  *		who actually finally proved there really was a race.
26  *
27  * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
28  *		waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
29  *		Also fixed a bug in BLOCKING mode where n_tty_write returns
30  *		EAGAIN
31  */
32 
33 #include <linux/types.h>
34 #include <linux/major.h>
35 #include <linux/errno.h>
36 #include <linux/signal.h>
37 #include <linux/fcntl.h>
38 #include <linux/sched.h>
39 #include <linux/interrupt.h>
40 #include <linux/tty.h>
41 #include <linux/timer.h>
42 #include <linux/ctype.h>
43 #include <linux/mm.h>
44 #include <linux/string.h>
45 #include <linux/slab.h>
46 #include <linux/poll.h>
47 #include <linux/bitops.h>
48 #include <linux/audit.h>
49 #include <linux/file.h>
50 #include <linux/uaccess.h>
51 #include <linux/module.h>
52 #include <linux/ratelimit.h>
53 #include <linux/vmalloc.h>
54 
55 
56 /* number of characters left in xmit buffer before select has we have room */
57 #define WAKEUP_CHARS 256
58 
59 /*
60  * This defines the low- and high-watermarks for throttling and
61  * unthrottling the TTY driver.  These watermarks are used for
62  * controlling the space in the read buffer.
63  */
64 #define TTY_THRESHOLD_THROTTLE		128 /* now based on remaining room */
65 #define TTY_THRESHOLD_UNTHROTTLE	128
66 
67 /*
68  * Special byte codes used in the echo buffer to represent operations
69  * or special handling of characters.  Bytes in the echo buffer that
70  * are not part of such special blocks are treated as normal character
71  * codes.
72  */
73 #define ECHO_OP_START 0xff
74 #define ECHO_OP_MOVE_BACK_COL 0x80
75 #define ECHO_OP_SET_CANON_COL 0x81
76 #define ECHO_OP_ERASE_TAB 0x82
77 
78 #define ECHO_COMMIT_WATERMARK	256
79 #define ECHO_BLOCK		256
80 #define ECHO_DISCARD_WATERMARK	N_TTY_BUF_SIZE - (ECHO_BLOCK + 32)
81 
82 
83 #undef N_TTY_TRACE
84 #ifdef N_TTY_TRACE
85 # define n_tty_trace(f, args...)	trace_printk(f, ##args)
86 #else
87 # define n_tty_trace(f, args...)
88 #endif
89 
90 struct n_tty_data {
91 	/* producer-published */
92 	size_t read_head;
93 	size_t canon_head;
94 	size_t echo_head;
95 	size_t echo_commit;
96 	DECLARE_BITMAP(char_map, 256);
97 
98 	/* private to n_tty_receive_overrun (single-threaded) */
99 	unsigned long overrun_time;
100 	int num_overrun;
101 
102 	/* non-atomic */
103 	bool no_room;
104 
105 	/* must hold exclusive termios_rwsem to reset these */
106 	unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
107 
108 	/* shared by producer and consumer */
109 	char read_buf[N_TTY_BUF_SIZE];
110 	DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
111 	unsigned char echo_buf[N_TTY_BUF_SIZE];
112 
113 	int minimum_to_wake;
114 
115 	/* consumer-published */
116 	size_t read_tail;
117 	size_t line_start;
118 
119 	/* protected by output lock */
120 	unsigned int column;
121 	unsigned int canon_column;
122 	size_t echo_tail;
123 
124 	struct mutex atomic_read_lock;
125 	struct mutex output_lock;
126 };
127 
128 static inline size_t read_cnt(struct n_tty_data *ldata)
129 {
130 	return ldata->read_head - ldata->read_tail;
131 }
132 
133 static inline unsigned char read_buf(struct n_tty_data *ldata, size_t i)
134 {
135 	return ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
136 }
137 
138 static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i)
139 {
140 	return &ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
141 }
142 
143 static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i)
144 {
145 	return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
146 }
147 
148 static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
149 {
150 	return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
151 }
152 
153 static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
154 			       unsigned char __user *ptr)
155 {
156 	struct n_tty_data *ldata = tty->disc_data;
157 
158 	tty_audit_add_data(tty, &x, 1, ldata->icanon);
159 	return put_user(x, ptr);
160 }
161 
162 static int receive_room(struct tty_struct *tty)
163 {
164 	struct n_tty_data *ldata = tty->disc_data;
165 	int left;
166 
167 	if (I_PARMRK(tty)) {
168 		/* Multiply read_cnt by 3, since each byte might take up to
169 		 * three times as many spaces when PARMRK is set (depending on
170 		 * its flags, e.g. parity error). */
171 		left = N_TTY_BUF_SIZE - read_cnt(ldata) * 3 - 1;
172 	} else
173 		left = N_TTY_BUF_SIZE - read_cnt(ldata) - 1;
174 
175 	/*
176 	 * If we are doing input canonicalization, and there are no
177 	 * pending newlines, let characters through without limit, so
178 	 * that erase characters will be handled.  Other excess
179 	 * characters will be beeped.
180 	 */
181 	if (left <= 0)
182 		left = ldata->icanon && ldata->canon_head == ldata->read_tail;
183 
184 	return left;
185 }
186 
187 /**
188  *	n_tty_set_room	-	receive space
189  *	@tty: terminal
190  *
191  *	Re-schedules the flip buffer work if space just became available.
192  *
193  *	Caller holds exclusive termios_rwsem
194  *	   or
195  *	n_tty_read()/consumer path:
196  *		holds non-exclusive termios_rwsem
197  */
198 
199 static void n_tty_set_room(struct tty_struct *tty)
200 {
201 	struct n_tty_data *ldata = tty->disc_data;
202 
203 	/* Did this open up the receive buffer? We may need to flip */
204 	if (unlikely(ldata->no_room) && receive_room(tty)) {
205 		ldata->no_room = 0;
206 
207 		WARN_RATELIMIT(tty->port->itty == NULL,
208 				"scheduling with invalid itty\n");
209 		/* see if ldisc has been killed - if so, this means that
210 		 * even though the ldisc has been halted and ->buf.work
211 		 * cancelled, ->buf.work is about to be rescheduled
212 		 */
213 		WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
214 			       "scheduling buffer work for halted ldisc\n");
215 		queue_work(system_unbound_wq, &tty->port->buf.work);
216 	}
217 }
218 
219 static ssize_t chars_in_buffer(struct tty_struct *tty)
220 {
221 	struct n_tty_data *ldata = tty->disc_data;
222 	ssize_t n = 0;
223 
224 	if (!ldata->icanon)
225 		n = read_cnt(ldata);
226 	else
227 		n = ldata->canon_head - ldata->read_tail;
228 	return n;
229 }
230 
231 /**
232  *	n_tty_write_wakeup	-	asynchronous I/O notifier
233  *	@tty: tty device
234  *
235  *	Required for the ptys, serial driver etc. since processes
236  *	that attach themselves to the master and rely on ASYNC
237  *	IO must be woken up
238  */
239 
240 static void n_tty_write_wakeup(struct tty_struct *tty)
241 {
242 	if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
243 		kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
244 }
245 
246 static void n_tty_check_throttle(struct tty_struct *tty)
247 {
248 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY)
249 		return;
250 	/*
251 	 * Check the remaining room for the input canonicalization
252 	 * mode.  We don't want to throttle the driver if we're in
253 	 * canonical mode and don't have a newline yet!
254 	 */
255 	while (1) {
256 		int throttled;
257 		tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
258 		if (receive_room(tty) >= TTY_THRESHOLD_THROTTLE)
259 			break;
260 		throttled = tty_throttle_safe(tty);
261 		if (!throttled)
262 			break;
263 	}
264 	__tty_set_flow_change(tty, 0);
265 }
266 
267 static void n_tty_check_unthrottle(struct tty_struct *tty)
268 {
269 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
270 	    tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
271 		if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
272 			return;
273 		if (!tty->count)
274 			return;
275 		n_tty_set_room(tty);
276 		n_tty_write_wakeup(tty->link);
277 		wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
278 		return;
279 	}
280 
281 	/* If there is enough space in the read buffer now, let the
282 	 * low-level driver know. We use chars_in_buffer() to
283 	 * check the buffer, as it now knows about canonical mode.
284 	 * Otherwise, if the driver is throttled and the line is
285 	 * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
286 	 * we won't get any more characters.
287 	 */
288 
289 	while (1) {
290 		int unthrottled;
291 		tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
292 		if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
293 			break;
294 		if (!tty->count)
295 			break;
296 		n_tty_set_room(tty);
297 		unthrottled = tty_unthrottle_safe(tty);
298 		if (!unthrottled)
299 			break;
300 	}
301 	__tty_set_flow_change(tty, 0);
302 }
303 
304 /**
305  *	put_tty_queue		-	add character to tty
306  *	@c: character
307  *	@ldata: n_tty data
308  *
309  *	Add a character to the tty read_buf queue.
310  *
311  *	n_tty_receive_buf()/producer path:
312  *		caller holds non-exclusive termios_rwsem
313  *		modifies read_head
314  *
315  *	read_head is only considered 'published' if canonical mode is
316  *	not active.
317  */
318 
319 static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
320 {
321 	*read_buf_addr(ldata, ldata->read_head++) = c;
322 }
323 
324 /**
325  *	reset_buffer_flags	-	reset buffer state
326  *	@tty: terminal to reset
327  *
328  *	Reset the read buffer counters and clear the flags.
329  *	Called from n_tty_open() and n_tty_flush_buffer().
330  *
331  *	Locking: caller holds exclusive termios_rwsem
332  *		 (or locking is not required)
333  */
334 
335 static void reset_buffer_flags(struct n_tty_data *ldata)
336 {
337 	ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
338 	ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
339 	ldata->line_start = 0;
340 
341 	ldata->erasing = 0;
342 	bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
343 }
344 
345 static void n_tty_packet_mode_flush(struct tty_struct *tty)
346 {
347 	unsigned long flags;
348 
349 	spin_lock_irqsave(&tty->ctrl_lock, flags);
350 	if (tty->link->packet) {
351 		tty->ctrl_status |= TIOCPKT_FLUSHREAD;
352 		wake_up_interruptible(&tty->link->read_wait);
353 	}
354 	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
355 }
356 
357 /**
358  *	n_tty_flush_buffer	-	clean input queue
359  *	@tty:	terminal device
360  *
361  *	Flush the input buffer. Called when the tty layer wants the
362  *	buffer flushed (eg at hangup) or when the N_TTY line discipline
363  *	internally has to clean the pending queue (for example some signals).
364  *
365  *	Holds termios_rwsem to exclude producer/consumer while
366  *	buffer indices are reset.
367  *
368  *	Locking: ctrl_lock, exclusive termios_rwsem
369  */
370 
371 static void n_tty_flush_buffer(struct tty_struct *tty)
372 {
373 	down_write(&tty->termios_rwsem);
374 	reset_buffer_flags(tty->disc_data);
375 	n_tty_set_room(tty);
376 
377 	if (tty->link)
378 		n_tty_packet_mode_flush(tty);
379 	up_write(&tty->termios_rwsem);
380 }
381 
382 /**
383  *	n_tty_chars_in_buffer	-	report available bytes
384  *	@tty: tty device
385  *
386  *	Report the number of characters buffered to be delivered to user
387  *	at this instant in time.
388  *
389  *	Locking: exclusive termios_rwsem
390  */
391 
392 static ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
393 {
394 	ssize_t n;
395 
396 	WARN_ONCE(1, "%s is deprecated and scheduled for removal.", __func__);
397 
398 	down_write(&tty->termios_rwsem);
399 	n = chars_in_buffer(tty);
400 	up_write(&tty->termios_rwsem);
401 	return n;
402 }
403 
404 /**
405  *	is_utf8_continuation	-	utf8 multibyte check
406  *	@c: byte to check
407  *
408  *	Returns true if the utf8 character 'c' is a multibyte continuation
409  *	character. We use this to correctly compute the on screen size
410  *	of the character when printing
411  */
412 
413 static inline int is_utf8_continuation(unsigned char c)
414 {
415 	return (c & 0xc0) == 0x80;
416 }
417 
418 /**
419  *	is_continuation		-	multibyte check
420  *	@c: byte to check
421  *
422  *	Returns true if the utf8 character 'c' is a multibyte continuation
423  *	character and the terminal is in unicode mode.
424  */
425 
426 static inline int is_continuation(unsigned char c, struct tty_struct *tty)
427 {
428 	return I_IUTF8(tty) && is_utf8_continuation(c);
429 }
430 
431 /**
432  *	do_output_char			-	output one character
433  *	@c: character (or partial unicode symbol)
434  *	@tty: terminal device
435  *	@space: space available in tty driver write buffer
436  *
437  *	This is a helper function that handles one output character
438  *	(including special characters like TAB, CR, LF, etc.),
439  *	doing OPOST processing and putting the results in the
440  *	tty driver's write buffer.
441  *
442  *	Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY
443  *	and NLDLY.  They simply aren't relevant in the world today.
444  *	If you ever need them, add them here.
445  *
446  *	Returns the number of bytes of buffer space used or -1 if
447  *	no space left.
448  *
449  *	Locking: should be called under the output_lock to protect
450  *		 the column state and space left in the buffer
451  */
452 
453 static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
454 {
455 	struct n_tty_data *ldata = tty->disc_data;
456 	int	spaces;
457 
458 	if (!space)
459 		return -1;
460 
461 	switch (c) {
462 	case '\n':
463 		if (O_ONLRET(tty))
464 			ldata->column = 0;
465 		if (O_ONLCR(tty)) {
466 			if (space < 2)
467 				return -1;
468 			ldata->canon_column = ldata->column = 0;
469 			tty->ops->write(tty, "\r\n", 2);
470 			return 2;
471 		}
472 		ldata->canon_column = ldata->column;
473 		break;
474 	case '\r':
475 		if (O_ONOCR(tty) && ldata->column == 0)
476 			return 0;
477 		if (O_OCRNL(tty)) {
478 			c = '\n';
479 			if (O_ONLRET(tty))
480 				ldata->canon_column = ldata->column = 0;
481 			break;
482 		}
483 		ldata->canon_column = ldata->column = 0;
484 		break;
485 	case '\t':
486 		spaces = 8 - (ldata->column & 7);
487 		if (O_TABDLY(tty) == XTABS) {
488 			if (space < spaces)
489 				return -1;
490 			ldata->column += spaces;
491 			tty->ops->write(tty, "        ", spaces);
492 			return spaces;
493 		}
494 		ldata->column += spaces;
495 		break;
496 	case '\b':
497 		if (ldata->column > 0)
498 			ldata->column--;
499 		break;
500 	default:
501 		if (!iscntrl(c)) {
502 			if (O_OLCUC(tty))
503 				c = toupper(c);
504 			if (!is_continuation(c, tty))
505 				ldata->column++;
506 		}
507 		break;
508 	}
509 
510 	tty_put_char(tty, c);
511 	return 1;
512 }
513 
514 /**
515  *	process_output			-	output post processor
516  *	@c: character (or partial unicode symbol)
517  *	@tty: terminal device
518  *
519  *	Output one character with OPOST processing.
520  *	Returns -1 when the output device is full and the character
521  *	must be retried.
522  *
523  *	Locking: output_lock to protect column state and space left
524  *		 (also, this is called from n_tty_write under the
525  *		  tty layer write lock)
526  */
527 
528 static int process_output(unsigned char c, struct tty_struct *tty)
529 {
530 	struct n_tty_data *ldata = tty->disc_data;
531 	int	space, retval;
532 
533 	mutex_lock(&ldata->output_lock);
534 
535 	space = tty_write_room(tty);
536 	retval = do_output_char(c, tty, space);
537 
538 	mutex_unlock(&ldata->output_lock);
539 	if (retval < 0)
540 		return -1;
541 	else
542 		return 0;
543 }
544 
545 /**
546  *	process_output_block		-	block post processor
547  *	@tty: terminal device
548  *	@buf: character buffer
549  *	@nr: number of bytes to output
550  *
551  *	Output a block of characters with OPOST processing.
552  *	Returns the number of characters output.
553  *
554  *	This path is used to speed up block console writes, among other
555  *	things when processing blocks of output data. It handles only
556  *	the simple cases normally found and helps to generate blocks of
557  *	symbols for the console driver and thus improve performance.
558  *
559  *	Locking: output_lock to protect column state and space left
560  *		 (also, this is called from n_tty_write under the
561  *		  tty layer write lock)
562  */
563 
564 static ssize_t process_output_block(struct tty_struct *tty,
565 				    const unsigned char *buf, unsigned int nr)
566 {
567 	struct n_tty_data *ldata = tty->disc_data;
568 	int	space;
569 	int	i;
570 	const unsigned char *cp;
571 
572 	mutex_lock(&ldata->output_lock);
573 
574 	space = tty_write_room(tty);
575 	if (!space) {
576 		mutex_unlock(&ldata->output_lock);
577 		return 0;
578 	}
579 	if (nr > space)
580 		nr = space;
581 
582 	for (i = 0, cp = buf; i < nr; i++, cp++) {
583 		unsigned char c = *cp;
584 
585 		switch (c) {
586 		case '\n':
587 			if (O_ONLRET(tty))
588 				ldata->column = 0;
589 			if (O_ONLCR(tty))
590 				goto break_out;
591 			ldata->canon_column = ldata->column;
592 			break;
593 		case '\r':
594 			if (O_ONOCR(tty) && ldata->column == 0)
595 				goto break_out;
596 			if (O_OCRNL(tty))
597 				goto break_out;
598 			ldata->canon_column = ldata->column = 0;
599 			break;
600 		case '\t':
601 			goto break_out;
602 		case '\b':
603 			if (ldata->column > 0)
604 				ldata->column--;
605 			break;
606 		default:
607 			if (!iscntrl(c)) {
608 				if (O_OLCUC(tty))
609 					goto break_out;
610 				if (!is_continuation(c, tty))
611 					ldata->column++;
612 			}
613 			break;
614 		}
615 	}
616 break_out:
617 	i = tty->ops->write(tty, buf, i);
618 
619 	mutex_unlock(&ldata->output_lock);
620 	return i;
621 }
622 
623 /**
624  *	process_echoes	-	write pending echo characters
625  *	@tty: terminal device
626  *
627  *	Write previously buffered echo (and other ldisc-generated)
628  *	characters to the tty.
629  *
630  *	Characters generated by the ldisc (including echoes) need to
631  *	be buffered because the driver's write buffer can fill during
632  *	heavy program output.  Echoing straight to the driver will
633  *	often fail under these conditions, causing lost characters and
634  *	resulting mismatches of ldisc state information.
635  *
636  *	Since the ldisc state must represent the characters actually sent
637  *	to the driver at the time of the write, operations like certain
638  *	changes in column state are also saved in the buffer and executed
639  *	here.
640  *
641  *	A circular fifo buffer is used so that the most recent characters
642  *	are prioritized.  Also, when control characters are echoed with a
643  *	prefixed "^", the pair is treated atomically and thus not separated.
644  *
645  *	Locking: callers must hold output_lock
646  */
647 
648 static size_t __process_echoes(struct tty_struct *tty)
649 {
650 	struct n_tty_data *ldata = tty->disc_data;
651 	int	space, old_space;
652 	size_t tail;
653 	unsigned char c;
654 
655 	old_space = space = tty_write_room(tty);
656 
657 	tail = ldata->echo_tail;
658 	while (ldata->echo_commit != tail) {
659 		c = echo_buf(ldata, tail);
660 		if (c == ECHO_OP_START) {
661 			unsigned char op;
662 			int no_space_left = 0;
663 
664 			/*
665 			 * If the buffer byte is the start of a multi-byte
666 			 * operation, get the next byte, which is either the
667 			 * op code or a control character value.
668 			 */
669 			op = echo_buf(ldata, tail + 1);
670 
671 			switch (op) {
672 				unsigned int num_chars, num_bs;
673 
674 			case ECHO_OP_ERASE_TAB:
675 				num_chars = echo_buf(ldata, tail + 2);
676 
677 				/*
678 				 * Determine how many columns to go back
679 				 * in order to erase the tab.
680 				 * This depends on the number of columns
681 				 * used by other characters within the tab
682 				 * area.  If this (modulo 8) count is from
683 				 * the start of input rather than from a
684 				 * previous tab, we offset by canon column.
685 				 * Otherwise, tab spacing is normal.
686 				 */
687 				if (!(num_chars & 0x80))
688 					num_chars += ldata->canon_column;
689 				num_bs = 8 - (num_chars & 7);
690 
691 				if (num_bs > space) {
692 					no_space_left = 1;
693 					break;
694 				}
695 				space -= num_bs;
696 				while (num_bs--) {
697 					tty_put_char(tty, '\b');
698 					if (ldata->column > 0)
699 						ldata->column--;
700 				}
701 				tail += 3;
702 				break;
703 
704 			case ECHO_OP_SET_CANON_COL:
705 				ldata->canon_column = ldata->column;
706 				tail += 2;
707 				break;
708 
709 			case ECHO_OP_MOVE_BACK_COL:
710 				if (ldata->column > 0)
711 					ldata->column--;
712 				tail += 2;
713 				break;
714 
715 			case ECHO_OP_START:
716 				/* This is an escaped echo op start code */
717 				if (!space) {
718 					no_space_left = 1;
719 					break;
720 				}
721 				tty_put_char(tty, ECHO_OP_START);
722 				ldata->column++;
723 				space--;
724 				tail += 2;
725 				break;
726 
727 			default:
728 				/*
729 				 * If the op is not a special byte code,
730 				 * it is a ctrl char tagged to be echoed
731 				 * as "^X" (where X is the letter
732 				 * representing the control char).
733 				 * Note that we must ensure there is
734 				 * enough space for the whole ctrl pair.
735 				 *
736 				 */
737 				if (space < 2) {
738 					no_space_left = 1;
739 					break;
740 				}
741 				tty_put_char(tty, '^');
742 				tty_put_char(tty, op ^ 0100);
743 				ldata->column += 2;
744 				space -= 2;
745 				tail += 2;
746 			}
747 
748 			if (no_space_left)
749 				break;
750 		} else {
751 			if (O_OPOST(tty)) {
752 				int retval = do_output_char(c, tty, space);
753 				if (retval < 0)
754 					break;
755 				space -= retval;
756 			} else {
757 				if (!space)
758 					break;
759 				tty_put_char(tty, c);
760 				space -= 1;
761 			}
762 			tail += 1;
763 		}
764 	}
765 
766 	/* If the echo buffer is nearly full (so that the possibility exists
767 	 * of echo overrun before the next commit), then discard enough
768 	 * data at the tail to prevent a subsequent overrun */
769 	while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
770 		if (echo_buf(ldata, tail == ECHO_OP_START)) {
771 			if (echo_buf(ldata, tail) == ECHO_OP_ERASE_TAB)
772 				tail += 3;
773 			else
774 				tail += 2;
775 		} else
776 			tail++;
777 	}
778 
779 	ldata->echo_tail = tail;
780 	return old_space - space;
781 }
782 
783 static void commit_echoes(struct tty_struct *tty)
784 {
785 	struct n_tty_data *ldata = tty->disc_data;
786 	size_t nr, old, echoed;
787 	size_t head;
788 
789 	head = ldata->echo_head;
790 	old = ldata->echo_commit - ldata->echo_tail;
791 
792 	/* Process committed echoes if the accumulated # of bytes
793 	 * is over the threshold (and try again each time another
794 	 * block is accumulated) */
795 	nr = head - ldata->echo_tail;
796 	if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK))
797 		return;
798 
799 	mutex_lock(&ldata->output_lock);
800 	ldata->echo_commit = head;
801 	echoed = __process_echoes(tty);
802 	mutex_unlock(&ldata->output_lock);
803 
804 	if (echoed && tty->ops->flush_chars)
805 		tty->ops->flush_chars(tty);
806 }
807 
808 static void process_echoes(struct tty_struct *tty)
809 {
810 	struct n_tty_data *ldata = tty->disc_data;
811 	size_t echoed;
812 
813 	if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_tail)
814 		return;
815 
816 	mutex_lock(&ldata->output_lock);
817 	echoed = __process_echoes(tty);
818 	mutex_unlock(&ldata->output_lock);
819 
820 	if (echoed && tty->ops->flush_chars)
821 		tty->ops->flush_chars(tty);
822 }
823 
824 static void flush_echoes(struct tty_struct *tty)
825 {
826 	struct n_tty_data *ldata = tty->disc_data;
827 
828 	if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_head)
829 		return;
830 
831 	mutex_lock(&ldata->output_lock);
832 	ldata->echo_commit = ldata->echo_head;
833 	__process_echoes(tty);
834 	mutex_unlock(&ldata->output_lock);
835 }
836 
837 /**
838  *	add_echo_byte	-	add a byte to the echo buffer
839  *	@c: unicode byte to echo
840  *	@ldata: n_tty data
841  *
842  *	Add a character or operation byte to the echo buffer.
843  */
844 
845 static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
846 {
847 	*echo_buf_addr(ldata, ldata->echo_head++) = c;
848 }
849 
850 /**
851  *	echo_move_back_col	-	add operation to move back a column
852  *	@ldata: n_tty data
853  *
854  *	Add an operation to the echo buffer to move back one column.
855  */
856 
857 static void echo_move_back_col(struct n_tty_data *ldata)
858 {
859 	add_echo_byte(ECHO_OP_START, ldata);
860 	add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
861 }
862 
863 /**
864  *	echo_set_canon_col	-	add operation to set the canon column
865  *	@ldata: n_tty data
866  *
867  *	Add an operation to the echo buffer to set the canon column
868  *	to the current column.
869  */
870 
871 static void echo_set_canon_col(struct n_tty_data *ldata)
872 {
873 	add_echo_byte(ECHO_OP_START, ldata);
874 	add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
875 }
876 
877 /**
878  *	echo_erase_tab	-	add operation to erase a tab
879  *	@num_chars: number of character columns already used
880  *	@after_tab: true if num_chars starts after a previous tab
881  *	@ldata: n_tty data
882  *
883  *	Add an operation to the echo buffer to erase a tab.
884  *
885  *	Called by the eraser function, which knows how many character
886  *	columns have been used since either a previous tab or the start
887  *	of input.  This information will be used later, along with
888  *	canon column (if applicable), to go back the correct number
889  *	of columns.
890  */
891 
892 static void echo_erase_tab(unsigned int num_chars, int after_tab,
893 			   struct n_tty_data *ldata)
894 {
895 	add_echo_byte(ECHO_OP_START, ldata);
896 	add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
897 
898 	/* We only need to know this modulo 8 (tab spacing) */
899 	num_chars &= 7;
900 
901 	/* Set the high bit as a flag if num_chars is after a previous tab */
902 	if (after_tab)
903 		num_chars |= 0x80;
904 
905 	add_echo_byte(num_chars, ldata);
906 }
907 
908 /**
909  *	echo_char_raw	-	echo a character raw
910  *	@c: unicode byte to echo
911  *	@tty: terminal device
912  *
913  *	Echo user input back onto the screen. This must be called only when
914  *	L_ECHO(tty) is true. Called from the driver receive_buf path.
915  *
916  *	This variant does not treat control characters specially.
917  */
918 
919 static void echo_char_raw(unsigned char c, struct n_tty_data *ldata)
920 {
921 	if (c == ECHO_OP_START) {
922 		add_echo_byte(ECHO_OP_START, ldata);
923 		add_echo_byte(ECHO_OP_START, ldata);
924 	} else {
925 		add_echo_byte(c, ldata);
926 	}
927 }
928 
929 /**
930  *	echo_char	-	echo a character
931  *	@c: unicode byte to echo
932  *	@tty: terminal device
933  *
934  *	Echo user input back onto the screen. This must be called only when
935  *	L_ECHO(tty) is true. Called from the driver receive_buf path.
936  *
937  *	This variant tags control characters to be echoed as "^X"
938  *	(where X is the letter representing the control char).
939  */
940 
941 static void echo_char(unsigned char c, struct tty_struct *tty)
942 {
943 	struct n_tty_data *ldata = tty->disc_data;
944 
945 	if (c == ECHO_OP_START) {
946 		add_echo_byte(ECHO_OP_START, ldata);
947 		add_echo_byte(ECHO_OP_START, ldata);
948 	} else {
949 		if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
950 			add_echo_byte(ECHO_OP_START, ldata);
951 		add_echo_byte(c, ldata);
952 	}
953 }
954 
955 /**
956  *	finish_erasing		-	complete erase
957  *	@ldata: n_tty data
958  */
959 
960 static inline void finish_erasing(struct n_tty_data *ldata)
961 {
962 	if (ldata->erasing) {
963 		echo_char_raw('/', ldata);
964 		ldata->erasing = 0;
965 	}
966 }
967 
968 /**
969  *	eraser		-	handle erase function
970  *	@c: character input
971  *	@tty: terminal device
972  *
973  *	Perform erase and necessary output when an erase character is
974  *	present in the stream from the driver layer. Handles the complexities
975  *	of UTF-8 multibyte symbols.
976  *
977  *	n_tty_receive_buf()/producer path:
978  *		caller holds non-exclusive termios_rwsem
979  *		modifies read_head
980  *
981  *	Modifying the read_head is not considered a publish in this context
982  *	because canonical mode is active -- only canon_head publishes
983  */
984 
985 static void eraser(unsigned char c, struct tty_struct *tty)
986 {
987 	struct n_tty_data *ldata = tty->disc_data;
988 	enum { ERASE, WERASE, KILL } kill_type;
989 	size_t head;
990 	size_t cnt;
991 	int seen_alnums;
992 
993 	if (ldata->read_head == ldata->canon_head) {
994 		/* process_output('\a', tty); */ /* what do you think? */
995 		return;
996 	}
997 	if (c == ERASE_CHAR(tty))
998 		kill_type = ERASE;
999 	else if (c == WERASE_CHAR(tty))
1000 		kill_type = WERASE;
1001 	else {
1002 		if (!L_ECHO(tty)) {
1003 			ldata->read_head = ldata->canon_head;
1004 			return;
1005 		}
1006 		if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
1007 			ldata->read_head = ldata->canon_head;
1008 			finish_erasing(ldata);
1009 			echo_char(KILL_CHAR(tty), tty);
1010 			/* Add a newline if ECHOK is on and ECHOKE is off. */
1011 			if (L_ECHOK(tty))
1012 				echo_char_raw('\n', ldata);
1013 			return;
1014 		}
1015 		kill_type = KILL;
1016 	}
1017 
1018 	seen_alnums = 0;
1019 	while (ldata->read_head != ldata->canon_head) {
1020 		head = ldata->read_head;
1021 
1022 		/* erase a single possibly multibyte character */
1023 		do {
1024 			head--;
1025 			c = read_buf(ldata, head);
1026 		} while (is_continuation(c, tty) && head != ldata->canon_head);
1027 
1028 		/* do not partially erase */
1029 		if (is_continuation(c, tty))
1030 			break;
1031 
1032 		if (kill_type == WERASE) {
1033 			/* Equivalent to BSD's ALTWERASE. */
1034 			if (isalnum(c) || c == '_')
1035 				seen_alnums++;
1036 			else if (seen_alnums)
1037 				break;
1038 		}
1039 		cnt = ldata->read_head - head;
1040 		ldata->read_head = head;
1041 		if (L_ECHO(tty)) {
1042 			if (L_ECHOPRT(tty)) {
1043 				if (!ldata->erasing) {
1044 					echo_char_raw('\\', ldata);
1045 					ldata->erasing = 1;
1046 				}
1047 				/* if cnt > 1, output a multi-byte character */
1048 				echo_char(c, tty);
1049 				while (--cnt > 0) {
1050 					head++;
1051 					echo_char_raw(read_buf(ldata, head), ldata);
1052 					echo_move_back_col(ldata);
1053 				}
1054 			} else if (kill_type == ERASE && !L_ECHOE(tty)) {
1055 				echo_char(ERASE_CHAR(tty), tty);
1056 			} else if (c == '\t') {
1057 				unsigned int num_chars = 0;
1058 				int after_tab = 0;
1059 				size_t tail = ldata->read_head;
1060 
1061 				/*
1062 				 * Count the columns used for characters
1063 				 * since the start of input or after a
1064 				 * previous tab.
1065 				 * This info is used to go back the correct
1066 				 * number of columns.
1067 				 */
1068 				while (tail != ldata->canon_head) {
1069 					tail--;
1070 					c = read_buf(ldata, tail);
1071 					if (c == '\t') {
1072 						after_tab = 1;
1073 						break;
1074 					} else if (iscntrl(c)) {
1075 						if (L_ECHOCTL(tty))
1076 							num_chars += 2;
1077 					} else if (!is_continuation(c, tty)) {
1078 						num_chars++;
1079 					}
1080 				}
1081 				echo_erase_tab(num_chars, after_tab, ldata);
1082 			} else {
1083 				if (iscntrl(c) && L_ECHOCTL(tty)) {
1084 					echo_char_raw('\b', ldata);
1085 					echo_char_raw(' ', ldata);
1086 					echo_char_raw('\b', ldata);
1087 				}
1088 				if (!iscntrl(c) || L_ECHOCTL(tty)) {
1089 					echo_char_raw('\b', ldata);
1090 					echo_char_raw(' ', ldata);
1091 					echo_char_raw('\b', ldata);
1092 				}
1093 			}
1094 		}
1095 		if (kill_type == ERASE)
1096 			break;
1097 	}
1098 	if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
1099 		finish_erasing(ldata);
1100 }
1101 
1102 /**
1103  *	isig		-	handle the ISIG optio
1104  *	@sig: signal
1105  *	@tty: terminal
1106  *
1107  *	Called when a signal is being sent due to terminal input.
1108  *	Called from the driver receive_buf path so serialized.
1109  *
1110  *	Locking: ctrl_lock
1111  */
1112 
1113 static void isig(int sig, struct tty_struct *tty)
1114 {
1115 	struct pid *tty_pgrp = tty_get_pgrp(tty);
1116 	if (tty_pgrp) {
1117 		kill_pgrp(tty_pgrp, sig, 1);
1118 		put_pid(tty_pgrp);
1119 	}
1120 }
1121 
1122 /**
1123  *	n_tty_receive_break	-	handle break
1124  *	@tty: terminal
1125  *
1126  *	An RS232 break event has been hit in the incoming bitstream. This
1127  *	can cause a variety of events depending upon the termios settings.
1128  *
1129  *	n_tty_receive_buf()/producer path:
1130  *		caller holds non-exclusive termios_rwsem
1131  *		publishes read_head via put_tty_queue()
1132  *
1133  *	Note: may get exclusive termios_rwsem if flushing input buffer
1134  */
1135 
1136 static void n_tty_receive_break(struct tty_struct *tty)
1137 {
1138 	struct n_tty_data *ldata = tty->disc_data;
1139 
1140 	if (I_IGNBRK(tty))
1141 		return;
1142 	if (I_BRKINT(tty)) {
1143 		isig(SIGINT, tty);
1144 		if (!L_NOFLSH(tty)) {
1145 			/* flushing needs exclusive termios_rwsem */
1146 			up_read(&tty->termios_rwsem);
1147 			n_tty_flush_buffer(tty);
1148 			tty_driver_flush_buffer(tty);
1149 			down_read(&tty->termios_rwsem);
1150 		}
1151 		return;
1152 	}
1153 	if (I_PARMRK(tty)) {
1154 		put_tty_queue('\377', ldata);
1155 		put_tty_queue('\0', ldata);
1156 	}
1157 	put_tty_queue('\0', ldata);
1158 	wake_up_interruptible(&tty->read_wait);
1159 }
1160 
1161 /**
1162  *	n_tty_receive_overrun	-	handle overrun reporting
1163  *	@tty: terminal
1164  *
1165  *	Data arrived faster than we could process it. While the tty
1166  *	driver has flagged this the bits that were missed are gone
1167  *	forever.
1168  *
1169  *	Called from the receive_buf path so single threaded. Does not
1170  *	need locking as num_overrun and overrun_time are function
1171  *	private.
1172  */
1173 
1174 static void n_tty_receive_overrun(struct tty_struct *tty)
1175 {
1176 	struct n_tty_data *ldata = tty->disc_data;
1177 	char buf[64];
1178 
1179 	ldata->num_overrun++;
1180 	if (time_after(jiffies, ldata->overrun_time + HZ) ||
1181 			time_after(ldata->overrun_time, jiffies)) {
1182 		printk(KERN_WARNING "%s: %d input overrun(s)\n",
1183 			tty_name(tty, buf),
1184 			ldata->num_overrun);
1185 		ldata->overrun_time = jiffies;
1186 		ldata->num_overrun = 0;
1187 	}
1188 }
1189 
1190 /**
1191  *	n_tty_receive_parity_error	-	error notifier
1192  *	@tty: terminal device
1193  *	@c: character
1194  *
1195  *	Process a parity error and queue the right data to indicate
1196  *	the error case if necessary.
1197  *
1198  *	n_tty_receive_buf()/producer path:
1199  *		caller holds non-exclusive termios_rwsem
1200  *		publishes read_head via put_tty_queue()
1201  */
1202 static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c)
1203 {
1204 	struct n_tty_data *ldata = tty->disc_data;
1205 
1206 	if (I_IGNPAR(tty))
1207 		return;
1208 	if (I_PARMRK(tty)) {
1209 		put_tty_queue('\377', ldata);
1210 		put_tty_queue('\0', ldata);
1211 		put_tty_queue(c, ldata);
1212 	} else	if (I_INPCK(tty))
1213 		put_tty_queue('\0', ldata);
1214 	else
1215 		put_tty_queue(c, ldata);
1216 	wake_up_interruptible(&tty->read_wait);
1217 }
1218 
1219 static void
1220 n_tty_receive_signal_char(struct tty_struct *tty, int signal, unsigned char c)
1221 {
1222 	if (!L_NOFLSH(tty)) {
1223 		/* flushing needs exclusive termios_rwsem */
1224 		up_read(&tty->termios_rwsem);
1225 		n_tty_flush_buffer(tty);
1226 		tty_driver_flush_buffer(tty);
1227 		down_read(&tty->termios_rwsem);
1228 	}
1229 	if (I_IXON(tty))
1230 		start_tty(tty);
1231 	if (L_ECHO(tty)) {
1232 		echo_char(c, tty);
1233 		commit_echoes(tty);
1234 	}
1235 	isig(signal, tty);
1236 	return;
1237 }
1238 
1239 /**
1240  *	n_tty_receive_char	-	perform processing
1241  *	@tty: terminal device
1242  *	@c: character
1243  *
1244  *	Process an individual character of input received from the driver.
1245  *	This is serialized with respect to itself by the rules for the
1246  *	driver above.
1247  *
1248  *	n_tty_receive_buf()/producer path:
1249  *		caller holds non-exclusive termios_rwsem
1250  *		publishes canon_head if canonical mode is active
1251  *		otherwise, publishes read_head via put_tty_queue()
1252  *
1253  *	Returns 1 if LNEXT was received, else returns 0
1254  */
1255 
1256 static int
1257 n_tty_receive_char_special(struct tty_struct *tty, unsigned char c)
1258 {
1259 	struct n_tty_data *ldata = tty->disc_data;
1260 	int parmrk;
1261 
1262 	if (I_IXON(tty)) {
1263 		if (c == START_CHAR(tty)) {
1264 			start_tty(tty);
1265 			commit_echoes(tty);
1266 			return 0;
1267 		}
1268 		if (c == STOP_CHAR(tty)) {
1269 			stop_tty(tty);
1270 			return 0;
1271 		}
1272 	}
1273 
1274 	if (L_ISIG(tty)) {
1275 		if (c == INTR_CHAR(tty)) {
1276 			n_tty_receive_signal_char(tty, SIGINT, c);
1277 			return 0;
1278 		} else if (c == QUIT_CHAR(tty)) {
1279 			n_tty_receive_signal_char(tty, SIGQUIT, c);
1280 			return 0;
1281 		} else if (c == SUSP_CHAR(tty)) {
1282 			n_tty_receive_signal_char(tty, SIGTSTP, c);
1283 			return 0;
1284 		}
1285 	}
1286 
1287 	if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1288 		start_tty(tty);
1289 		process_echoes(tty);
1290 	}
1291 
1292 	if (c == '\r') {
1293 		if (I_IGNCR(tty))
1294 			return 0;
1295 		if (I_ICRNL(tty))
1296 			c = '\n';
1297 	} else if (c == '\n' && I_INLCR(tty))
1298 		c = '\r';
1299 
1300 	if (ldata->icanon) {
1301 		if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
1302 		    (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
1303 			eraser(c, tty);
1304 			commit_echoes(tty);
1305 			return 0;
1306 		}
1307 		if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
1308 			ldata->lnext = 1;
1309 			if (L_ECHO(tty)) {
1310 				finish_erasing(ldata);
1311 				if (L_ECHOCTL(tty)) {
1312 					echo_char_raw('^', ldata);
1313 					echo_char_raw('\b', ldata);
1314 					commit_echoes(tty);
1315 				}
1316 			}
1317 			return 1;
1318 		}
1319 		if (c == REPRINT_CHAR(tty) && L_ECHO(tty) && L_IEXTEN(tty)) {
1320 			size_t tail = ldata->canon_head;
1321 
1322 			finish_erasing(ldata);
1323 			echo_char(c, tty);
1324 			echo_char_raw('\n', ldata);
1325 			while (tail != ldata->read_head) {
1326 				echo_char(read_buf(ldata, tail), tty);
1327 				tail++;
1328 			}
1329 			commit_echoes(tty);
1330 			return 0;
1331 		}
1332 		if (c == '\n') {
1333 			if (L_ECHO(tty) || L_ECHONL(tty)) {
1334 				echo_char_raw('\n', ldata);
1335 				commit_echoes(tty);
1336 			}
1337 			goto handle_newline;
1338 		}
1339 		if (c == EOF_CHAR(tty)) {
1340 			c = __DISABLED_CHAR;
1341 			goto handle_newline;
1342 		}
1343 		if ((c == EOL_CHAR(tty)) ||
1344 		    (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
1345 			parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty))
1346 				 ? 1 : 0;
1347 			/*
1348 			 * XXX are EOL_CHAR and EOL2_CHAR echoed?!?
1349 			 */
1350 			if (L_ECHO(tty)) {
1351 				/* Record the column of first canon char. */
1352 				if (ldata->canon_head == ldata->read_head)
1353 					echo_set_canon_col(ldata);
1354 				echo_char(c, tty);
1355 				commit_echoes(tty);
1356 			}
1357 			/*
1358 			 * XXX does PARMRK doubling happen for
1359 			 * EOL_CHAR and EOL2_CHAR?
1360 			 */
1361 			if (parmrk)
1362 				put_tty_queue(c, ldata);
1363 
1364 handle_newline:
1365 			set_bit(ldata->read_head & (N_TTY_BUF_SIZE - 1), ldata->read_flags);
1366 			put_tty_queue(c, ldata);
1367 			ldata->canon_head = ldata->read_head;
1368 			kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1369 			if (waitqueue_active(&tty->read_wait))
1370 				wake_up_interruptible(&tty->read_wait);
1371 			return 0;
1372 		}
1373 	}
1374 
1375 	parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
1376 	if (L_ECHO(tty)) {
1377 		finish_erasing(ldata);
1378 		if (c == '\n')
1379 			echo_char_raw('\n', ldata);
1380 		else {
1381 			/* Record the column of first canon char. */
1382 			if (ldata->canon_head == ldata->read_head)
1383 				echo_set_canon_col(ldata);
1384 			echo_char(c, tty);
1385 		}
1386 		commit_echoes(tty);
1387 	}
1388 
1389 	if (parmrk)
1390 		put_tty_queue(c, ldata);
1391 
1392 	put_tty_queue(c, ldata);
1393 	return 0;
1394 }
1395 
1396 static inline void
1397 n_tty_receive_char_inline(struct tty_struct *tty, unsigned char c)
1398 {
1399 	struct n_tty_data *ldata = tty->disc_data;
1400 	int parmrk;
1401 
1402 	if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1403 		start_tty(tty);
1404 		process_echoes(tty);
1405 	}
1406 	if (L_ECHO(tty)) {
1407 		finish_erasing(ldata);
1408 		/* Record the column of first canon char. */
1409 		if (ldata->canon_head == ldata->read_head)
1410 			echo_set_canon_col(ldata);
1411 		echo_char(c, tty);
1412 		commit_echoes(tty);
1413 	}
1414 	parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
1415 	if (parmrk)
1416 		put_tty_queue(c, ldata);
1417 	put_tty_queue(c, ldata);
1418 }
1419 
1420 static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
1421 {
1422 	n_tty_receive_char_inline(tty, c);
1423 }
1424 
1425 static inline void
1426 n_tty_receive_char_fast(struct tty_struct *tty, unsigned char c)
1427 {
1428 	struct n_tty_data *ldata = tty->disc_data;
1429 
1430 	if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1431 		start_tty(tty);
1432 		process_echoes(tty);
1433 	}
1434 	if (L_ECHO(tty)) {
1435 		finish_erasing(ldata);
1436 		/* Record the column of first canon char. */
1437 		if (ldata->canon_head == ldata->read_head)
1438 			echo_set_canon_col(ldata);
1439 		echo_char(c, tty);
1440 		commit_echoes(tty);
1441 	}
1442 	put_tty_queue(c, ldata);
1443 }
1444 
1445 static inline void
1446 n_tty_receive_char_closing(struct tty_struct *tty, unsigned char c)
1447 {
1448 	if (I_ISTRIP(tty))
1449 		c &= 0x7f;
1450 	if (I_IUCLC(tty) && L_IEXTEN(tty))
1451 		c = tolower(c);
1452 
1453 	if (I_IXON(tty)) {
1454 		if (c == STOP_CHAR(tty))
1455 			stop_tty(tty);
1456 		else if (c == START_CHAR(tty) ||
1457 			 (tty->stopped && !tty->flow_stopped && I_IXANY(tty) &&
1458 			  c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) &&
1459 			  c != SUSP_CHAR(tty))) {
1460 			start_tty(tty);
1461 			process_echoes(tty);
1462 		}
1463 	}
1464 }
1465 
1466 static void
1467 n_tty_receive_char_flagged(struct tty_struct *tty, unsigned char c, char flag)
1468 {
1469 	char buf[64];
1470 
1471 	switch (flag) {
1472 	case TTY_BREAK:
1473 		n_tty_receive_break(tty);
1474 		break;
1475 	case TTY_PARITY:
1476 	case TTY_FRAME:
1477 		n_tty_receive_parity_error(tty, c);
1478 		break;
1479 	case TTY_OVERRUN:
1480 		n_tty_receive_overrun(tty);
1481 		break;
1482 	default:
1483 		printk(KERN_ERR "%s: unknown flag %d\n",
1484 		       tty_name(tty, buf), flag);
1485 		break;
1486 	}
1487 }
1488 
1489 static void
1490 n_tty_receive_char_lnext(struct tty_struct *tty, unsigned char c, char flag)
1491 {
1492 	struct n_tty_data *ldata = tty->disc_data;
1493 
1494 	ldata->lnext = 0;
1495 	if (likely(flag == TTY_NORMAL)) {
1496 		if (I_ISTRIP(tty))
1497 			c &= 0x7f;
1498 		if (I_IUCLC(tty) && L_IEXTEN(tty))
1499 			c = tolower(c);
1500 		n_tty_receive_char(tty, c);
1501 	} else
1502 		n_tty_receive_char_flagged(tty, c, flag);
1503 }
1504 
1505 /**
1506  *	n_tty_receive_buf	-	data receive
1507  *	@tty: terminal device
1508  *	@cp: buffer
1509  *	@fp: flag buffer
1510  *	@count: characters
1511  *
1512  *	Called by the terminal driver when a block of characters has
1513  *	been received. This function must be called from soft contexts
1514  *	not from interrupt context. The driver is responsible for making
1515  *	calls one at a time and in order (or using flush_to_ldisc)
1516  *
1517  *	n_tty_receive_buf()/producer path:
1518  *		claims non-exclusive termios_rwsem
1519  *		publishes read_head and canon_head
1520  */
1521 
1522 static void
1523 n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
1524 			   char *fp, int count)
1525 {
1526 	struct n_tty_data *ldata = tty->disc_data;
1527 	size_t n, head;
1528 
1529 	head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1530 	n = N_TTY_BUF_SIZE - max(read_cnt(ldata), head);
1531 	n = min_t(size_t, count, n);
1532 	memcpy(read_buf_addr(ldata, head), cp, n);
1533 	ldata->read_head += n;
1534 	cp += n;
1535 	count -= n;
1536 
1537 	head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1538 	n = N_TTY_BUF_SIZE - max(read_cnt(ldata), head);
1539 	n = min_t(size_t, count, n);
1540 	memcpy(read_buf_addr(ldata, head), cp, n);
1541 	ldata->read_head += n;
1542 }
1543 
1544 static void
1545 n_tty_receive_buf_raw(struct tty_struct *tty, const unsigned char *cp,
1546 		      char *fp, int count)
1547 {
1548 	struct n_tty_data *ldata = tty->disc_data;
1549 	char flag = TTY_NORMAL;
1550 
1551 	while (count--) {
1552 		if (fp)
1553 			flag = *fp++;
1554 		if (likely(flag == TTY_NORMAL))
1555 			put_tty_queue(*cp++, ldata);
1556 		else
1557 			n_tty_receive_char_flagged(tty, *cp++, flag);
1558 	}
1559 }
1560 
1561 static void
1562 n_tty_receive_buf_closing(struct tty_struct *tty, const unsigned char *cp,
1563 			  char *fp, int count)
1564 {
1565 	char flag = TTY_NORMAL;
1566 
1567 	while (count--) {
1568 		if (fp)
1569 			flag = *fp++;
1570 		if (likely(flag == TTY_NORMAL))
1571 			n_tty_receive_char_closing(tty, *cp++);
1572 		else
1573 			n_tty_receive_char_flagged(tty, *cp++, flag);
1574 	}
1575 }
1576 
1577 static void
1578 n_tty_receive_buf_standard(struct tty_struct *tty, const unsigned char *cp,
1579 			  char *fp, int count)
1580 {
1581 	struct n_tty_data *ldata = tty->disc_data;
1582 	char flag = TTY_NORMAL;
1583 
1584 	while (count--) {
1585 		if (fp)
1586 			flag = *fp++;
1587 		if (likely(flag == TTY_NORMAL)) {
1588 			unsigned char c = *cp++;
1589 
1590 			if (I_ISTRIP(tty))
1591 				c &= 0x7f;
1592 			if (I_IUCLC(tty) && L_IEXTEN(tty))
1593 				c = tolower(c);
1594 			if (L_EXTPROC(tty)) {
1595 				put_tty_queue(c, ldata);
1596 				continue;
1597 			}
1598 			if (!test_bit(c, ldata->char_map))
1599 				n_tty_receive_char_inline(tty, c);
1600 			else if (n_tty_receive_char_special(tty, c) && count) {
1601 				if (fp)
1602 					flag = *fp++;
1603 				n_tty_receive_char_lnext(tty, *cp++, flag);
1604 				count--;
1605 			}
1606 		} else
1607 			n_tty_receive_char_flagged(tty, *cp++, flag);
1608 	}
1609 }
1610 
1611 static void
1612 n_tty_receive_buf_fast(struct tty_struct *tty, const unsigned char *cp,
1613 		       char *fp, int count)
1614 {
1615 	struct n_tty_data *ldata = tty->disc_data;
1616 	char flag = TTY_NORMAL;
1617 
1618 	while (count--) {
1619 		if (fp)
1620 			flag = *fp++;
1621 		if (likely(flag == TTY_NORMAL)) {
1622 			unsigned char c = *cp++;
1623 
1624 			if (!test_bit(c, ldata->char_map))
1625 				n_tty_receive_char_fast(tty, c);
1626 			else if (n_tty_receive_char_special(tty, c) && count) {
1627 				if (fp)
1628 					flag = *fp++;
1629 				n_tty_receive_char_lnext(tty, *cp++, flag);
1630 				count--;
1631 			}
1632 		} else
1633 			n_tty_receive_char_flagged(tty, *cp++, flag);
1634 	}
1635 }
1636 
1637 static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
1638 			  char *fp, int count)
1639 {
1640 	struct n_tty_data *ldata = tty->disc_data;
1641 	bool preops = I_ISTRIP(tty) || (I_IUCLC(tty) && L_IEXTEN(tty));
1642 
1643 	if (ldata->real_raw)
1644 		n_tty_receive_buf_real_raw(tty, cp, fp, count);
1645 	else if (ldata->raw || (L_EXTPROC(tty) && !preops))
1646 		n_tty_receive_buf_raw(tty, cp, fp, count);
1647 	else if (tty->closing && !L_EXTPROC(tty))
1648 		n_tty_receive_buf_closing(tty, cp, fp, count);
1649 	else {
1650 		if (ldata->lnext) {
1651 			char flag = TTY_NORMAL;
1652 
1653 			if (fp)
1654 				flag = *fp++;
1655 			n_tty_receive_char_lnext(tty, *cp++, flag);
1656 			count--;
1657 		}
1658 
1659 		if (!preops && !I_PARMRK(tty))
1660 			n_tty_receive_buf_fast(tty, cp, fp, count);
1661 		else
1662 			n_tty_receive_buf_standard(tty, cp, fp, count);
1663 
1664 		flush_echoes(tty);
1665 		if (tty->ops->flush_chars)
1666 			tty->ops->flush_chars(tty);
1667 	}
1668 
1669 	if ((!ldata->icanon && (read_cnt(ldata) >= ldata->minimum_to_wake)) ||
1670 		L_EXTPROC(tty)) {
1671 		kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1672 		if (waitqueue_active(&tty->read_wait))
1673 			wake_up_interruptible(&tty->read_wait);
1674 	}
1675 }
1676 
1677 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
1678 			      char *fp, int count)
1679 {
1680 	int room, n;
1681 
1682 	down_read(&tty->termios_rwsem);
1683 
1684 	while (1) {
1685 		room = receive_room(tty);
1686 		n = min(count, room);
1687 		if (!n)
1688 			break;
1689 		__receive_buf(tty, cp, fp, n);
1690 		cp += n;
1691 		if (fp)
1692 			fp += n;
1693 		count -= n;
1694 	}
1695 
1696 	tty->receive_room = room;
1697 	n_tty_check_throttle(tty);
1698 	up_read(&tty->termios_rwsem);
1699 }
1700 
1701 static int n_tty_receive_buf2(struct tty_struct *tty, const unsigned char *cp,
1702 			      char *fp, int count)
1703 {
1704 	struct n_tty_data *ldata = tty->disc_data;
1705 	int room, n, rcvd = 0;
1706 
1707 	down_read(&tty->termios_rwsem);
1708 
1709 	while (1) {
1710 		room = receive_room(tty);
1711 		n = min(count, room);
1712 		if (!n) {
1713 			if (!room)
1714 				ldata->no_room = 1;
1715 			break;
1716 		}
1717 		__receive_buf(tty, cp, fp, n);
1718 		cp += n;
1719 		if (fp)
1720 			fp += n;
1721 		count -= n;
1722 		rcvd += n;
1723 	}
1724 
1725 	tty->receive_room = room;
1726 	n_tty_check_throttle(tty);
1727 	up_read(&tty->termios_rwsem);
1728 
1729 	return rcvd;
1730 }
1731 
1732 int is_ignored(int sig)
1733 {
1734 	return (sigismember(&current->blocked, sig) ||
1735 		current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
1736 }
1737 
1738 /**
1739  *	n_tty_set_termios	-	termios data changed
1740  *	@tty: terminal
1741  *	@old: previous data
1742  *
1743  *	Called by the tty layer when the user changes termios flags so
1744  *	that the line discipline can plan ahead. This function cannot sleep
1745  *	and is protected from re-entry by the tty layer. The user is
1746  *	guaranteed that this function will not be re-entered or in progress
1747  *	when the ldisc is closed.
1748  *
1749  *	Locking: Caller holds tty->termios_rwsem
1750  */
1751 
1752 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
1753 {
1754 	struct n_tty_data *ldata = tty->disc_data;
1755 	int canon_change = 1;
1756 
1757 	if (old)
1758 		canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
1759 	if (canon_change) {
1760 		bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
1761 		ldata->line_start = ldata->canon_head = ldata->read_tail;
1762 		ldata->erasing = 0;
1763 		ldata->lnext = 0;
1764 	}
1765 
1766 	if (canon_change && !L_ICANON(tty) && read_cnt(ldata))
1767 		wake_up_interruptible(&tty->read_wait);
1768 
1769 	ldata->icanon = (L_ICANON(tty) != 0);
1770 
1771 	if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
1772 	    I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
1773 	    I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
1774 	    I_PARMRK(tty)) {
1775 		bitmap_zero(ldata->char_map, 256);
1776 
1777 		if (I_IGNCR(tty) || I_ICRNL(tty))
1778 			set_bit('\r', ldata->char_map);
1779 		if (I_INLCR(tty))
1780 			set_bit('\n', ldata->char_map);
1781 
1782 		if (L_ICANON(tty)) {
1783 			set_bit(ERASE_CHAR(tty), ldata->char_map);
1784 			set_bit(KILL_CHAR(tty), ldata->char_map);
1785 			set_bit(EOF_CHAR(tty), ldata->char_map);
1786 			set_bit('\n', ldata->char_map);
1787 			set_bit(EOL_CHAR(tty), ldata->char_map);
1788 			if (L_IEXTEN(tty)) {
1789 				set_bit(WERASE_CHAR(tty), ldata->char_map);
1790 				set_bit(LNEXT_CHAR(tty), ldata->char_map);
1791 				set_bit(EOL2_CHAR(tty), ldata->char_map);
1792 				if (L_ECHO(tty))
1793 					set_bit(REPRINT_CHAR(tty),
1794 						ldata->char_map);
1795 			}
1796 		}
1797 		if (I_IXON(tty)) {
1798 			set_bit(START_CHAR(tty), ldata->char_map);
1799 			set_bit(STOP_CHAR(tty), ldata->char_map);
1800 		}
1801 		if (L_ISIG(tty)) {
1802 			set_bit(INTR_CHAR(tty), ldata->char_map);
1803 			set_bit(QUIT_CHAR(tty), ldata->char_map);
1804 			set_bit(SUSP_CHAR(tty), ldata->char_map);
1805 		}
1806 		clear_bit(__DISABLED_CHAR, ldata->char_map);
1807 		ldata->raw = 0;
1808 		ldata->real_raw = 0;
1809 	} else {
1810 		ldata->raw = 1;
1811 		if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1812 		    (I_IGNPAR(tty) || !I_INPCK(tty)) &&
1813 		    (tty->driver->flags & TTY_DRIVER_REAL_RAW))
1814 			ldata->real_raw = 1;
1815 		else
1816 			ldata->real_raw = 0;
1817 	}
1818 	n_tty_set_room(tty);
1819 	/*
1820 	 * Fix tty hang when I_IXON(tty) is cleared, but the tty
1821 	 * been stopped by STOP_CHAR(tty) before it.
1822 	 */
1823 	if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) {
1824 		start_tty(tty);
1825 	}
1826 
1827 	/* The termios change make the tty ready for I/O */
1828 	wake_up_interruptible(&tty->write_wait);
1829 	wake_up_interruptible(&tty->read_wait);
1830 }
1831 
1832 /**
1833  *	n_tty_close		-	close the ldisc for this tty
1834  *	@tty: device
1835  *
1836  *	Called from the terminal layer when this line discipline is
1837  *	being shut down, either because of a close or becsuse of a
1838  *	discipline change. The function will not be called while other
1839  *	ldisc methods are in progress.
1840  */
1841 
1842 static void n_tty_close(struct tty_struct *tty)
1843 {
1844 	struct n_tty_data *ldata = tty->disc_data;
1845 
1846 	if (tty->link)
1847 		n_tty_packet_mode_flush(tty);
1848 
1849 	vfree(ldata);
1850 	tty->disc_data = NULL;
1851 }
1852 
1853 /**
1854  *	n_tty_open		-	open an ldisc
1855  *	@tty: terminal to open
1856  *
1857  *	Called when this line discipline is being attached to the
1858  *	terminal device. Can sleep. Called serialized so that no
1859  *	other events will occur in parallel. No further open will occur
1860  *	until a close.
1861  */
1862 
1863 static int n_tty_open(struct tty_struct *tty)
1864 {
1865 	struct n_tty_data *ldata;
1866 
1867 	/* Currently a malloc failure here can panic */
1868 	ldata = vmalloc(sizeof(*ldata));
1869 	if (!ldata)
1870 		goto err;
1871 
1872 	ldata->overrun_time = jiffies;
1873 	mutex_init(&ldata->atomic_read_lock);
1874 	mutex_init(&ldata->output_lock);
1875 
1876 	tty->disc_data = ldata;
1877 	reset_buffer_flags(tty->disc_data);
1878 	ldata->column = 0;
1879 	ldata->canon_column = 0;
1880 	ldata->minimum_to_wake = 1;
1881 	ldata->num_overrun = 0;
1882 	ldata->no_room = 0;
1883 	ldata->lnext = 0;
1884 	tty->closing = 0;
1885 	/* indicate buffer work may resume */
1886 	clear_bit(TTY_LDISC_HALTED, &tty->flags);
1887 	n_tty_set_termios(tty, NULL);
1888 	tty_unthrottle(tty);
1889 
1890 	return 0;
1891 err:
1892 	return -ENOMEM;
1893 }
1894 
1895 static inline int input_available_p(struct tty_struct *tty, int amt)
1896 {
1897 	struct n_tty_data *ldata = tty->disc_data;
1898 
1899 	if (ldata->icanon && !L_EXTPROC(tty)) {
1900 		if (ldata->canon_head != ldata->read_tail)
1901 			return 1;
1902 	} else if (read_cnt(ldata) >= (amt ? amt : 1))
1903 		return 1;
1904 
1905 	return 0;
1906 }
1907 
1908 /**
1909  *	copy_from_read_buf	-	copy read data directly
1910  *	@tty: terminal device
1911  *	@b: user data
1912  *	@nr: size of data
1913  *
1914  *	Helper function to speed up n_tty_read.  It is only called when
1915  *	ICANON is off; it copies characters straight from the tty queue to
1916  *	user space directly.  It can be profitably called twice; once to
1917  *	drain the space from the tail pointer to the (physical) end of the
1918  *	buffer, and once to drain the space from the (physical) beginning of
1919  *	the buffer to head pointer.
1920  *
1921  *	Called under the ldata->atomic_read_lock sem
1922  *
1923  *	n_tty_read()/consumer path:
1924  *		caller holds non-exclusive termios_rwsem
1925  *		read_tail published
1926  */
1927 
1928 static int copy_from_read_buf(struct tty_struct *tty,
1929 				      unsigned char __user **b,
1930 				      size_t *nr)
1931 
1932 {
1933 	struct n_tty_data *ldata = tty->disc_data;
1934 	int retval;
1935 	size_t n;
1936 	bool is_eof;
1937 	size_t tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1938 
1939 	retval = 0;
1940 	n = min(read_cnt(ldata), N_TTY_BUF_SIZE - tail);
1941 	n = min(*nr, n);
1942 	if (n) {
1943 		retval = copy_to_user(*b, read_buf_addr(ldata, tail), n);
1944 		n -= retval;
1945 		is_eof = n == 1 && read_buf(ldata, tail) == EOF_CHAR(tty);
1946 		tty_audit_add_data(tty, read_buf_addr(ldata, tail), n,
1947 				ldata->icanon);
1948 		ldata->read_tail += n;
1949 		/* Turn single EOF into zero-length read */
1950 		if (L_EXTPROC(tty) && ldata->icanon && is_eof && !read_cnt(ldata))
1951 			n = 0;
1952 		*b += n;
1953 		*nr -= n;
1954 	}
1955 	return retval;
1956 }
1957 
1958 /**
1959  *	canon_copy_from_read_buf	-	copy read data in canonical mode
1960  *	@tty: terminal device
1961  *	@b: user data
1962  *	@nr: size of data
1963  *
1964  *	Helper function for n_tty_read.  It is only called when ICANON is on;
1965  *	it copies one line of input up to and including the line-delimiting
1966  *	character into the user-space buffer.
1967  *
1968  *	Called under the atomic_read_lock mutex
1969  *
1970  *	n_tty_read()/consumer path:
1971  *		caller holds non-exclusive termios_rwsem
1972  *		read_tail published
1973  */
1974 
1975 static int canon_copy_from_read_buf(struct tty_struct *tty,
1976 				    unsigned char __user **b,
1977 				    size_t *nr)
1978 {
1979 	struct n_tty_data *ldata = tty->disc_data;
1980 	size_t n, size, more, c;
1981 	size_t eol;
1982 	size_t tail;
1983 	int ret, found = 0;
1984 	bool eof_push = 0;
1985 
1986 	/* N.B. avoid overrun if nr == 0 */
1987 	n = min(*nr, read_cnt(ldata));
1988 	if (!n)
1989 		return 0;
1990 
1991 	tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1992 	size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
1993 
1994 	n_tty_trace("%s: nr:%zu tail:%zu n:%zu size:%zu\n",
1995 		    __func__, *nr, tail, n, size);
1996 
1997 	eol = find_next_bit(ldata->read_flags, size, tail);
1998 	more = n - (size - tail);
1999 	if (eol == N_TTY_BUF_SIZE && more) {
2000 		/* scan wrapped without finding set bit */
2001 		eol = find_next_bit(ldata->read_flags, more, 0);
2002 		if (eol != more)
2003 			found = 1;
2004 	} else if (eol != size)
2005 		found = 1;
2006 
2007 	size = N_TTY_BUF_SIZE - tail;
2008 	n = (found + eol + size) & (N_TTY_BUF_SIZE - 1);
2009 	c = n;
2010 
2011 	if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
2012 		n--;
2013 		eof_push = !n && ldata->read_tail != ldata->line_start;
2014 	}
2015 
2016 	n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
2017 		    __func__, eol, found, n, c, size, more);
2018 
2019 	if (n > size) {
2020 		ret = copy_to_user(*b, read_buf_addr(ldata, tail), size);
2021 		if (ret)
2022 			return -EFAULT;
2023 		ret = copy_to_user(*b + size, ldata->read_buf, n - size);
2024 	} else
2025 		ret = copy_to_user(*b, read_buf_addr(ldata, tail), n);
2026 
2027 	if (ret)
2028 		return -EFAULT;
2029 	*b += n;
2030 	*nr -= n;
2031 
2032 	if (found)
2033 		clear_bit(eol, ldata->read_flags);
2034 	smp_mb__after_clear_bit();
2035 	ldata->read_tail += c;
2036 
2037 	if (found) {
2038 		ldata->line_start = ldata->read_tail;
2039 		tty_audit_push(tty);
2040 	}
2041 	return eof_push ? -EAGAIN : 0;
2042 }
2043 
2044 extern ssize_t redirected_tty_write(struct file *, const char __user *,
2045 							size_t, loff_t *);
2046 
2047 /**
2048  *	job_control		-	check job control
2049  *	@tty: tty
2050  *	@file: file handle
2051  *
2052  *	Perform job control management checks on this file/tty descriptor
2053  *	and if appropriate send any needed signals and return a negative
2054  *	error code if action should be taken.
2055  *
2056  *	Locking: redirected write test is safe
2057  *		 current->signal->tty check is safe
2058  *		 ctrl_lock to safely reference tty->pgrp
2059  */
2060 
2061 static int job_control(struct tty_struct *tty, struct file *file)
2062 {
2063 	/* Job control check -- must be done at start and after
2064 	   every sleep (POSIX.1 7.1.1.4). */
2065 	/* NOTE: not yet done after every sleep pending a thorough
2066 	   check of the logic of this change. -- jlc */
2067 	/* don't stop on /dev/console */
2068 	if (file->f_op->write == redirected_tty_write ||
2069 	    current->signal->tty != tty)
2070 		return 0;
2071 
2072 	spin_lock_irq(&tty->ctrl_lock);
2073 	if (!tty->pgrp)
2074 		printk(KERN_ERR "n_tty_read: no tty->pgrp!\n");
2075 	else if (task_pgrp(current) != tty->pgrp) {
2076 		spin_unlock_irq(&tty->ctrl_lock);
2077 		if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned())
2078 			return -EIO;
2079 		kill_pgrp(task_pgrp(current), SIGTTIN, 1);
2080 		set_thread_flag(TIF_SIGPENDING);
2081 		return -ERESTARTSYS;
2082 	}
2083 	spin_unlock_irq(&tty->ctrl_lock);
2084 	return 0;
2085 }
2086 
2087 
2088 /**
2089  *	n_tty_read		-	read function for tty
2090  *	@tty: tty device
2091  *	@file: file object
2092  *	@buf: userspace buffer pointer
2093  *	@nr: size of I/O
2094  *
2095  *	Perform reads for the line discipline. We are guaranteed that the
2096  *	line discipline will not be closed under us but we may get multiple
2097  *	parallel readers and must handle this ourselves. We may also get
2098  *	a hangup. Always called in user context, may sleep.
2099  *
2100  *	This code must be sure never to sleep through a hangup.
2101  *
2102  *	n_tty_read()/consumer path:
2103  *		claims non-exclusive termios_rwsem
2104  *		publishes read_tail
2105  */
2106 
2107 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
2108 			 unsigned char __user *buf, size_t nr)
2109 {
2110 	struct n_tty_data *ldata = tty->disc_data;
2111 	unsigned char __user *b = buf;
2112 	DECLARE_WAITQUEUE(wait, current);
2113 	int c;
2114 	int minimum, time;
2115 	ssize_t retval = 0;
2116 	long timeout;
2117 	unsigned long flags;
2118 	int packet;
2119 
2120 	c = job_control(tty, file);
2121 	if (c < 0)
2122 		return c;
2123 
2124 	/*
2125 	 *	Internal serialization of reads.
2126 	 */
2127 	if (file->f_flags & O_NONBLOCK) {
2128 		if (!mutex_trylock(&ldata->atomic_read_lock))
2129 			return -EAGAIN;
2130 	} else {
2131 		if (mutex_lock_interruptible(&ldata->atomic_read_lock))
2132 			return -ERESTARTSYS;
2133 	}
2134 
2135 	down_read(&tty->termios_rwsem);
2136 
2137 	minimum = time = 0;
2138 	timeout = MAX_SCHEDULE_TIMEOUT;
2139 	if (!ldata->icanon) {
2140 		minimum = MIN_CHAR(tty);
2141 		if (minimum) {
2142 			time = (HZ / 10) * TIME_CHAR(tty);
2143 			if (time)
2144 				ldata->minimum_to_wake = 1;
2145 			else if (!waitqueue_active(&tty->read_wait) ||
2146 				 (ldata->minimum_to_wake > minimum))
2147 				ldata->minimum_to_wake = minimum;
2148 		} else {
2149 			timeout = (HZ / 10) * TIME_CHAR(tty);
2150 			ldata->minimum_to_wake = minimum = 1;
2151 		}
2152 	}
2153 
2154 	packet = tty->packet;
2155 
2156 	add_wait_queue(&tty->read_wait, &wait);
2157 	while (nr) {
2158 		/* First test for status change. */
2159 		if (packet && tty->link->ctrl_status) {
2160 			unsigned char cs;
2161 			if (b != buf)
2162 				break;
2163 			spin_lock_irqsave(&tty->link->ctrl_lock, flags);
2164 			cs = tty->link->ctrl_status;
2165 			tty->link->ctrl_status = 0;
2166 			spin_unlock_irqrestore(&tty->link->ctrl_lock, flags);
2167 			if (tty_put_user(tty, cs, b++)) {
2168 				retval = -EFAULT;
2169 				b--;
2170 				break;
2171 			}
2172 			nr--;
2173 			break;
2174 		}
2175 		/* This statement must be first before checking for input
2176 		   so that any interrupt will set the state back to
2177 		   TASK_RUNNING. */
2178 		set_current_state(TASK_INTERRUPTIBLE);
2179 
2180 		if (((minimum - (b - buf)) < ldata->minimum_to_wake) &&
2181 		    ((minimum - (b - buf)) >= 1))
2182 			ldata->minimum_to_wake = (minimum - (b - buf));
2183 
2184 		if (!input_available_p(tty, 0)) {
2185 			if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
2186 				up_read(&tty->termios_rwsem);
2187 				tty_flush_to_ldisc(tty);
2188 				down_read(&tty->termios_rwsem);
2189 				if (!input_available_p(tty, 0)) {
2190 					retval = -EIO;
2191 					break;
2192 				}
2193 			} else {
2194 				if (tty_hung_up_p(file))
2195 					break;
2196 				if (!timeout)
2197 					break;
2198 				if (file->f_flags & O_NONBLOCK) {
2199 					retval = -EAGAIN;
2200 					break;
2201 				}
2202 				if (signal_pending(current)) {
2203 					retval = -ERESTARTSYS;
2204 					break;
2205 				}
2206 				n_tty_set_room(tty);
2207 				up_read(&tty->termios_rwsem);
2208 
2209 				timeout = schedule_timeout(timeout);
2210 
2211 				down_read(&tty->termios_rwsem);
2212 				continue;
2213 			}
2214 		}
2215 		__set_current_state(TASK_RUNNING);
2216 
2217 		/* Deal with packet mode. */
2218 		if (packet && b == buf) {
2219 			if (tty_put_user(tty, TIOCPKT_DATA, b++)) {
2220 				retval = -EFAULT;
2221 				b--;
2222 				break;
2223 			}
2224 			nr--;
2225 		}
2226 
2227 		if (ldata->icanon && !L_EXTPROC(tty)) {
2228 			retval = canon_copy_from_read_buf(tty, &b, &nr);
2229 			if (retval == -EAGAIN) {
2230 				retval = 0;
2231 				continue;
2232 			} else if (retval)
2233 				break;
2234 		} else {
2235 			int uncopied;
2236 			/* The copy function takes the read lock and handles
2237 			   locking internally for this case */
2238 			uncopied = copy_from_read_buf(tty, &b, &nr);
2239 			uncopied += copy_from_read_buf(tty, &b, &nr);
2240 			if (uncopied) {
2241 				retval = -EFAULT;
2242 				break;
2243 			}
2244 		}
2245 
2246 		n_tty_check_unthrottle(tty);
2247 
2248 		if (b - buf >= minimum)
2249 			break;
2250 		if (time)
2251 			timeout = time;
2252 	}
2253 	mutex_unlock(&ldata->atomic_read_lock);
2254 	remove_wait_queue(&tty->read_wait, &wait);
2255 
2256 	if (!waitqueue_active(&tty->read_wait))
2257 		ldata->minimum_to_wake = minimum;
2258 
2259 	__set_current_state(TASK_RUNNING);
2260 	if (b - buf)
2261 		retval = b - buf;
2262 
2263 	n_tty_set_room(tty);
2264 	up_read(&tty->termios_rwsem);
2265 	return retval;
2266 }
2267 
2268 /**
2269  *	n_tty_write		-	write function for tty
2270  *	@tty: tty device
2271  *	@file: file object
2272  *	@buf: userspace buffer pointer
2273  *	@nr: size of I/O
2274  *
2275  *	Write function of the terminal device.  This is serialized with
2276  *	respect to other write callers but not to termios changes, reads
2277  *	and other such events.  Since the receive code will echo characters,
2278  *	thus calling driver write methods, the output_lock is used in
2279  *	the output processing functions called here as well as in the
2280  *	echo processing function to protect the column state and space
2281  *	left in the buffer.
2282  *
2283  *	This code must be sure never to sleep through a hangup.
2284  *
2285  *	Locking: output_lock to protect column state and space left
2286  *		 (note that the process_output*() functions take this
2287  *		  lock themselves)
2288  */
2289 
2290 static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
2291 			   const unsigned char *buf, size_t nr)
2292 {
2293 	const unsigned char *b = buf;
2294 	DECLARE_WAITQUEUE(wait, current);
2295 	int c;
2296 	ssize_t retval = 0;
2297 
2298 	/* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
2299 	if (L_TOSTOP(tty) && file->f_op->write != redirected_tty_write) {
2300 		retval = tty_check_change(tty);
2301 		if (retval)
2302 			return retval;
2303 	}
2304 
2305 	down_read(&tty->termios_rwsem);
2306 
2307 	/* Write out any echoed characters that are still pending */
2308 	process_echoes(tty);
2309 
2310 	add_wait_queue(&tty->write_wait, &wait);
2311 	while (1) {
2312 		set_current_state(TASK_INTERRUPTIBLE);
2313 		if (signal_pending(current)) {
2314 			retval = -ERESTARTSYS;
2315 			break;
2316 		}
2317 		if (tty_hung_up_p(file) || (tty->link && !tty->link->count)) {
2318 			retval = -EIO;
2319 			break;
2320 		}
2321 		if (O_OPOST(tty)) {
2322 			while (nr > 0) {
2323 				ssize_t num = process_output_block(tty, b, nr);
2324 				if (num < 0) {
2325 					if (num == -EAGAIN)
2326 						break;
2327 					retval = num;
2328 					goto break_out;
2329 				}
2330 				b += num;
2331 				nr -= num;
2332 				if (nr == 0)
2333 					break;
2334 				c = *b;
2335 				if (process_output(c, tty) < 0)
2336 					break;
2337 				b++; nr--;
2338 			}
2339 			if (tty->ops->flush_chars)
2340 				tty->ops->flush_chars(tty);
2341 		} else {
2342 			while (nr > 0) {
2343 				c = tty->ops->write(tty, b, nr);
2344 				if (c < 0) {
2345 					retval = c;
2346 					goto break_out;
2347 				}
2348 				if (!c)
2349 					break;
2350 				b += c;
2351 				nr -= c;
2352 			}
2353 		}
2354 		if (!nr)
2355 			break;
2356 		if (file->f_flags & O_NONBLOCK) {
2357 			retval = -EAGAIN;
2358 			break;
2359 		}
2360 		up_read(&tty->termios_rwsem);
2361 
2362 		schedule();
2363 
2364 		down_read(&tty->termios_rwsem);
2365 	}
2366 break_out:
2367 	__set_current_state(TASK_RUNNING);
2368 	remove_wait_queue(&tty->write_wait, &wait);
2369 	if (b - buf != nr && tty->fasync)
2370 		set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
2371 	up_read(&tty->termios_rwsem);
2372 	return (b - buf) ? b - buf : retval;
2373 }
2374 
2375 /**
2376  *	n_tty_poll		-	poll method for N_TTY
2377  *	@tty: terminal device
2378  *	@file: file accessing it
2379  *	@wait: poll table
2380  *
2381  *	Called when the line discipline is asked to poll() for data or
2382  *	for special events. This code is not serialized with respect to
2383  *	other events save open/close.
2384  *
2385  *	This code must be sure never to sleep through a hangup.
2386  *	Called without the kernel lock held - fine
2387  */
2388 
2389 static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
2390 							poll_table *wait)
2391 {
2392 	struct n_tty_data *ldata = tty->disc_data;
2393 	unsigned int mask = 0;
2394 
2395 	poll_wait(file, &tty->read_wait, wait);
2396 	poll_wait(file, &tty->write_wait, wait);
2397 	if (input_available_p(tty, TIME_CHAR(tty) ? 0 : MIN_CHAR(tty)))
2398 		mask |= POLLIN | POLLRDNORM;
2399 	if (tty->packet && tty->link->ctrl_status)
2400 		mask |= POLLPRI | POLLIN | POLLRDNORM;
2401 	if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
2402 		mask |= POLLHUP;
2403 	if (tty_hung_up_p(file))
2404 		mask |= POLLHUP;
2405 	if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
2406 		if (MIN_CHAR(tty) && !TIME_CHAR(tty))
2407 			ldata->minimum_to_wake = MIN_CHAR(tty);
2408 		else
2409 			ldata->minimum_to_wake = 1;
2410 	}
2411 	if (tty->ops->write && !tty_is_writelocked(tty) &&
2412 			tty_chars_in_buffer(tty) < WAKEUP_CHARS &&
2413 			tty_write_room(tty) > 0)
2414 		mask |= POLLOUT | POLLWRNORM;
2415 	return mask;
2416 }
2417 
2418 static unsigned long inq_canon(struct n_tty_data *ldata)
2419 {
2420 	size_t nr, head, tail;
2421 
2422 	if (ldata->canon_head == ldata->read_tail)
2423 		return 0;
2424 	head = ldata->canon_head;
2425 	tail = ldata->read_tail;
2426 	nr = head - tail;
2427 	/* Skip EOF-chars.. */
2428 	while (head != tail) {
2429 		if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) &&
2430 		    read_buf(ldata, tail) == __DISABLED_CHAR)
2431 			nr--;
2432 		tail++;
2433 	}
2434 	return nr;
2435 }
2436 
2437 static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
2438 		       unsigned int cmd, unsigned long arg)
2439 {
2440 	struct n_tty_data *ldata = tty->disc_data;
2441 	int retval;
2442 
2443 	switch (cmd) {
2444 	case TIOCOUTQ:
2445 		return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2446 	case TIOCINQ:
2447 		down_write(&tty->termios_rwsem);
2448 		if (L_ICANON(tty))
2449 			retval = inq_canon(ldata);
2450 		else
2451 			retval = read_cnt(ldata);
2452 		up_write(&tty->termios_rwsem);
2453 		return put_user(retval, (unsigned int __user *) arg);
2454 	default:
2455 		return n_tty_ioctl_helper(tty, file, cmd, arg);
2456 	}
2457 }
2458 
2459 static void n_tty_fasync(struct tty_struct *tty, int on)
2460 {
2461 	struct n_tty_data *ldata = tty->disc_data;
2462 
2463 	if (!waitqueue_active(&tty->read_wait)) {
2464 		if (on)
2465 			ldata->minimum_to_wake = 1;
2466 		else if (!tty->fasync)
2467 			ldata->minimum_to_wake = N_TTY_BUF_SIZE;
2468 	}
2469 }
2470 
2471 struct tty_ldisc_ops tty_ldisc_N_TTY = {
2472 	.magic           = TTY_LDISC_MAGIC,
2473 	.name            = "n_tty",
2474 	.open            = n_tty_open,
2475 	.close           = n_tty_close,
2476 	.flush_buffer    = n_tty_flush_buffer,
2477 	.chars_in_buffer = n_tty_chars_in_buffer,
2478 	.read            = n_tty_read,
2479 	.write           = n_tty_write,
2480 	.ioctl           = n_tty_ioctl,
2481 	.set_termios     = n_tty_set_termios,
2482 	.poll            = n_tty_poll,
2483 	.receive_buf     = n_tty_receive_buf,
2484 	.write_wakeup    = n_tty_write_wakeup,
2485 	.fasync		 = n_tty_fasync,
2486 	.receive_buf2	 = n_tty_receive_buf2,
2487 };
2488 
2489 /**
2490  *	n_tty_inherit_ops	-	inherit N_TTY methods
2491  *	@ops: struct tty_ldisc_ops where to save N_TTY methods
2492  *
2493  *	Enables a 'subclass' line discipline to 'inherit' N_TTY
2494  *	methods.
2495  */
2496 
2497 void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
2498 {
2499 	*ops = tty_ldisc_N_TTY;
2500 	ops->owner = NULL;
2501 	ops->refcount = ops->flags = 0;
2502 }
2503 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
2504