1 /*
2  * n_tty.c --- implements the N_TTY line discipline.
3  *
4  * This code used to be in tty_io.c, but things are getting hairy
5  * enough that it made sense to split things off.  (The N_TTY
6  * processing has changed so much that it's hardly recognizable,
7  * anyway...)
8  *
9  * Note that the open routine for N_TTY is guaranteed never to return
10  * an error.  This is because Linux will fall back to setting a line
11  * to N_TTY if it can not switch to any other line discipline.
12  *
13  * Written by Theodore Ts'o, Copyright 1994.
14  *
15  * This file also contains code originally written by Linus Torvalds,
16  * Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
17  *
18  * This file may be redistributed under the terms of the GNU General Public
19  * License.
20  *
21  * Reduced memory usage for older ARM systems  - Russell King.
22  *
23  * 2000/01/20   Fixed SMP locking on put_tty_queue using bits of
24  *		the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
25  *		who actually finally proved there really was a race.
26  *
27  * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
28  *		waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
29  *		Also fixed a bug in BLOCKING mode where write_chan returns
30  *		EAGAIN
31  */
32 
33 #include <linux/types.h>
34 #include <linux/major.h>
35 #include <linux/errno.h>
36 #include <linux/signal.h>
37 #include <linux/fcntl.h>
38 #include <linux/sched.h>
39 #include <linux/interrupt.h>
40 #include <linux/tty.h>
41 #include <linux/timer.h>
42 #include <linux/ctype.h>
43 #include <linux/kd.h>
44 #include <linux/mm.h>
45 #include <linux/string.h>
46 #include <linux/slab.h>
47 #include <linux/poll.h>
48 
49 #include <asm/uaccess.h>
50 #include <asm/system.h>
51 #include <asm/bitops.h>
52 
53 #define CONSOLE_DEV MKDEV(TTY_MAJOR,0)
54 #define SYSCONS_DEV  MKDEV(TTYAUX_MAJOR,1)
55 
56 #ifndef MIN
57 #define MIN(a,b)	((a) < (b) ? (a) : (b))
58 #endif
59 
60 /* number of characters left in xmit buffer before select has we have room */
61 #define WAKEUP_CHARS 256
62 
63 /*
64  * This defines the low- and high-watermarks for throttling and
65  * unthrottling the TTY driver.  These watermarks are used for
66  * controlling the space in the read buffer.
67  */
68 #define TTY_THRESHOLD_THROTTLE		128 /* now based on remaining room */
69 #define TTY_THRESHOLD_UNTHROTTLE 	128
70 
alloc_buf(void)71 static inline unsigned char *alloc_buf(void)
72 {
73 	unsigned char *p;
74 	int prio = in_interrupt() ? GFP_ATOMIC : GFP_KERNEL;
75 
76 	if (PAGE_SIZE != N_TTY_BUF_SIZE) {
77 		p = kmalloc(N_TTY_BUF_SIZE, prio);
78 		if (p)
79 			memset(p, 0, N_TTY_BUF_SIZE);
80 	} else
81 		p = (unsigned char *)get_zeroed_page(prio);
82 
83 	return p;
84 }
85 
free_buf(unsigned char * buf)86 static inline void free_buf(unsigned char *buf)
87 {
88 	if (PAGE_SIZE != N_TTY_BUF_SIZE)
89 		kfree(buf);
90 	else
91 		free_page((unsigned long) buf);
92 }
93 
put_tty_queue_nolock(unsigned char c,struct tty_struct * tty)94 static inline void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
95 {
96 	if (tty->read_cnt < N_TTY_BUF_SIZE) {
97 		tty->read_buf[tty->read_head] = c;
98 		tty->read_head = (tty->read_head + 1) & (N_TTY_BUF_SIZE-1);
99 		tty->read_cnt++;
100 	}
101 }
102 
put_tty_queue(unsigned char c,struct tty_struct * tty)103 static inline void put_tty_queue(unsigned char c, struct tty_struct *tty)
104 {
105 	unsigned long flags;
106 	/*
107 	 *	The problem of stomping on the buffers ends here.
108 	 *	Why didn't anyone see this one coming? --AJK
109 	*/
110 	spin_lock_irqsave(&tty->read_lock, flags);
111 	put_tty_queue_nolock(c, tty);
112 	spin_unlock_irqrestore(&tty->read_lock, flags);
113 }
114 
115 /**
116  *	check_unthrottle	-	allow new receive data
117  *	@tty; tty device
118  *
119  *	Check whether to call the driver.unthrottle function.
120  *	We test the TTY_THROTTLED bit first so that it always
121  *	indicates the current state. The decision about whether
122  *	it is worth allowing more input has been taken by the caller.
123  *	Can sleep, may be called under the atomic_read semaphore but
124  *	this is not guaranteed.
125  */
126 
check_unthrottle(struct tty_struct * tty)127 static void check_unthrottle(struct tty_struct * tty)
128 {
129 	if (tty->count &&
130 	    test_and_clear_bit(TTY_THROTTLED, &tty->flags) &&
131 	    tty->driver.unthrottle)
132 		tty->driver.unthrottle(tty);
133 }
134 
135 /**
136  *	reset_buffer_flags	-	reset buffer state
137  *	@tty: terminal to reset
138  *
139  *	Reset the read buffer counters, clear the flags,
140  *	and make sure the driver is unthrottled. Called
141  *	from n_tty_open() and n_tty_flush_buffer().
142  */
reset_buffer_flags(struct tty_struct * tty)143 static void reset_buffer_flags(struct tty_struct *tty)
144 {
145 	unsigned long flags;
146 
147 	spin_lock_irqsave(&tty->read_lock, flags);
148 	tty->read_head = tty->read_tail = tty->read_cnt = 0;
149 	spin_unlock_irqrestore(&tty->read_lock, flags);
150 	tty->canon_head = tty->canon_data = tty->erasing = 0;
151 	memset(&tty->read_flags, 0, sizeof tty->read_flags);
152 	check_unthrottle(tty);
153 }
154 
155 /**
156  *	n_tty_flush_buffer	-	clean input queue
157  *	@tty:	terminal device
158  *
159  *	Flush the input buffer. Called when the line discipline is
160  *	being closed, when the tty layer wants the buffer flushed (eg
161  *	at hangup) or when the N_TTY line discipline internally has to
162  *	clean the pending queue (for example some signals).
163  *
164  *	FIXME: tty->ctrl_status is not spinlocked and relies on
165  *	lock_kernel() still.
166  */
167 
n_tty_flush_buffer(struct tty_struct * tty)168 void n_tty_flush_buffer(struct tty_struct * tty)
169 {
170 	/* clear everything and unthrottle the driver */
171 	reset_buffer_flags(tty);
172 
173 	if (!tty->link)
174 		return;
175 
176 	if (tty->link->packet) {
177 		tty->ctrl_status |= TIOCPKT_FLUSHREAD;
178 		wake_up_interruptible(&tty->link->read_wait);
179 	}
180 }
181 
182 /**
183  *	n_tty_chars_in_buffer	-	report available bytes
184  *	@tty: tty device
185  *
186  *	Report the number of characters buffered to be delivered to user
187  *	at this instant in time.
188  */
189 
n_tty_chars_in_buffer(struct tty_struct * tty)190 ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
191 {
192 	unsigned long flags;
193 	ssize_t n = 0;
194 
195 	spin_lock_irqsave(&tty->read_lock, flags);
196 	if (!tty->icanon) {
197 		n = tty->read_cnt;
198 	} else if (tty->canon_data) {
199 		n = (tty->canon_head > tty->read_tail) ?
200 			tty->canon_head - tty->read_tail :
201 			tty->canon_head + (N_TTY_BUF_SIZE - tty->read_tail);
202 	}
203 	spin_unlock_irqrestore(&tty->read_lock, flags);
204 	return n;
205 }
206 
207 /*
208  * Perform OPOST processing.  Returns -1 when the output device is
209  * full and the character must be retried.
210  */
opost(unsigned char c,struct tty_struct * tty)211 static int opost(unsigned char c, struct tty_struct *tty)
212 {
213 	int	space, spaces;
214 
215 	space = tty->driver.write_room(tty);
216 	if (!space)
217 		return -1;
218 
219 	if (O_OPOST(tty)) {
220 		switch (c) {
221 		case '\n':
222 			if (O_ONLRET(tty))
223 				tty->column = 0;
224 			if (O_ONLCR(tty)) {
225 				if (space < 2)
226 					return -1;
227 				tty->driver.put_char(tty, '\r');
228 				tty->column = 0;
229 			}
230 			tty->canon_column = tty->column;
231 			break;
232 		case '\r':
233 			if (O_ONOCR(tty) && tty->column == 0)
234 				return 0;
235 			if (O_OCRNL(tty)) {
236 				c = '\n';
237 				if (O_ONLRET(tty))
238 					tty->canon_column = tty->column = 0;
239 				break;
240 			}
241 			tty->canon_column = tty->column = 0;
242 			break;
243 		case '\t':
244 			spaces = 8 - (tty->column & 7);
245 			if (O_TABDLY(tty) == XTABS) {
246 				if (space < spaces)
247 					return -1;
248 				tty->column += spaces;
249 				tty->driver.write(tty, 0, "        ", spaces);
250 				return 0;
251 			}
252 			tty->column += spaces;
253 			break;
254 		case '\b':
255 			if (tty->column > 0)
256 				tty->column--;
257 			break;
258 		default:
259 			if (O_OLCUC(tty))
260 				c = toupper(c);
261 			if (!iscntrl(c))
262 				tty->column++;
263 			break;
264 		}
265 	}
266 	tty->driver.put_char(tty, c);
267 	return 0;
268 }
269 
270 /**
271  *	opost_block		-	block postprocess
272  *	@tty: terminal device
273  *	@inbuf: user buffer
274  *	@nr: number of bytes
275  *
276  *	This path is used to speed up block console writes, among other
277  *	things when processing blocks of output data. It handles only
278  *	the simple cases normally found and helps to generate blocks of
279  *	symbols for the console driver and thus improve performance.
280  *
281  *	Called from write_chan under the tty layer write lock.
282  */
283 
opost_block(struct tty_struct * tty,const unsigned char * inbuf,unsigned int nr)284 static ssize_t opost_block(struct tty_struct * tty,
285 		       const unsigned char * inbuf, unsigned int nr)
286 {
287 	char	buf[80];
288 	int	space;
289 	int 	i;
290 	char	*cp;
291 
292 	space = tty->driver.write_room(tty);
293 	if (!space)
294 		return 0;
295 	if (nr > space)
296 		nr = space;
297 	if (nr > sizeof(buf))
298 	    nr = sizeof(buf);
299 
300 	if (copy_from_user(buf, inbuf, nr))
301 		return -EFAULT;
302 
303 	for (i = 0, cp = buf; i < nr; i++, cp++) {
304 		switch (*cp) {
305 		case '\n':
306 			if (O_ONLRET(tty))
307 				tty->column = 0;
308 			if (O_ONLCR(tty))
309 				goto break_out;
310 			tty->canon_column = tty->column;
311 			break;
312 		case '\r':
313 			if (O_ONOCR(tty) && tty->column == 0)
314 				goto break_out;
315 			if (O_OCRNL(tty)) {
316 				*cp = '\n';
317 				if (O_ONLRET(tty))
318 					tty->canon_column = tty->column = 0;
319 				break;
320 			}
321 			tty->canon_column = tty->column = 0;
322 			break;
323 		case '\t':
324 			goto break_out;
325 		case '\b':
326 			if (tty->column > 0)
327 				tty->column--;
328 			break;
329 		default:
330 			if (O_OLCUC(tty))
331 				*cp = toupper(*cp);
332 			if (!iscntrl(*cp))
333 				tty->column++;
334 			break;
335 		}
336 	}
337 break_out:
338 	if (tty->driver.flush_chars)
339 		tty->driver.flush_chars(tty);
340 	i = tty->driver.write(tty, 0, buf, i);
341 	return i;
342 }
343 
344 
345 
put_char(unsigned char c,struct tty_struct * tty)346 static inline void put_char(unsigned char c, struct tty_struct *tty)
347 {
348 	tty->driver.put_char(tty, c);
349 }
350 
351 /* Must be called only when L_ECHO(tty) is true. */
352 
echo_char(unsigned char c,struct tty_struct * tty)353 static void echo_char(unsigned char c, struct tty_struct *tty)
354 {
355 	if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t') {
356 		put_char('^', tty);
357 		put_char(c ^ 0100, tty);
358 		tty->column += 2;
359 	} else
360 		opost(c, tty);
361 }
362 
finish_erasing(struct tty_struct * tty)363 static inline void finish_erasing(struct tty_struct *tty)
364 {
365 	if (tty->erasing) {
366 		put_char('/', tty);
367 		tty->column += 2;
368 		tty->erasing = 0;
369 	}
370 }
371 
372 /**
373  *	eraser		-	handle erase function
374  *	@c: character input
375  *	@tty: terminal device
376  *
377  *	Perform erase and neccessary output when an erase character is
378  *	present in the stream from the driver layer. Handles the complexities
379  *	of UTF-8 multibyte symbols.
380  */
381 
eraser(unsigned char c,struct tty_struct * tty)382 static void eraser(unsigned char c, struct tty_struct *tty)
383 {
384 	enum { ERASE, WERASE, KILL } kill_type;
385 	int head, seen_alnums;
386 	unsigned long flags;
387 
388 	if (tty->read_head == tty->canon_head) {
389 		/* opost('\a', tty); */		/* what do you think? */
390 		return;
391 	}
392 	if (c == ERASE_CHAR(tty))
393 		kill_type = ERASE;
394 	else if (c == WERASE_CHAR(tty))
395 		kill_type = WERASE;
396 	else {
397 		if (!L_ECHO(tty)) {
398 			spin_lock_irqsave(&tty->read_lock, flags);
399 			tty->read_cnt -= ((tty->read_head - tty->canon_head) &
400 					  (N_TTY_BUF_SIZE - 1));
401 			tty->read_head = tty->canon_head;
402 			spin_unlock_irqrestore(&tty->read_lock, flags);
403 			return;
404 		}
405 		if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
406 			spin_lock_irqsave(&tty->read_lock, flags);
407 			tty->read_cnt -= ((tty->read_head - tty->canon_head) &
408 					  (N_TTY_BUF_SIZE - 1));
409 			tty->read_head = tty->canon_head;
410 			spin_unlock_irqrestore(&tty->read_lock, flags);
411 			finish_erasing(tty);
412 			echo_char(KILL_CHAR(tty), tty);
413 			/* Add a newline if ECHOK is on and ECHOKE is off. */
414 			if (L_ECHOK(tty))
415 				opost('\n', tty);
416 			return;
417 		}
418 		kill_type = KILL;
419 	}
420 
421 	seen_alnums = 0;
422 	while (tty->read_head != tty->canon_head) {
423 		head = (tty->read_head - 1) & (N_TTY_BUF_SIZE-1);
424 		c = tty->read_buf[head];
425 		if (kill_type == WERASE) {
426 			/* Equivalent to BSD's ALTWERASE. */
427 			if (isalnum(c) || c == '_')
428 				seen_alnums++;
429 			else if (seen_alnums)
430 				break;
431 		}
432 		spin_lock_irqsave(&tty->read_lock, flags);
433 		tty->read_head = head;
434 		tty->read_cnt--;
435 		spin_unlock_irqrestore(&tty->read_lock, flags);
436 		if (L_ECHO(tty)) {
437 			if (L_ECHOPRT(tty)) {
438 				if (!tty->erasing) {
439 					put_char('\\', tty);
440 					tty->column++;
441 					tty->erasing = 1;
442 				}
443 				echo_char(c, tty);
444 			} else if (kill_type == ERASE && !L_ECHOE(tty)) {
445 				echo_char(ERASE_CHAR(tty), tty);
446 			} else if (c == '\t') {
447 				unsigned int col = tty->canon_column;
448 				unsigned long tail = tty->canon_head;
449 
450 				/* Find the column of the last char. */
451 				while (tail != tty->read_head) {
452 					c = tty->read_buf[tail];
453 					if (c == '\t')
454 						col = (col | 7) + 1;
455 					else if (iscntrl(c)) {
456 						if (L_ECHOCTL(tty))
457 							col += 2;
458 					} else
459 						col++;
460 					tail = (tail+1) & (N_TTY_BUF_SIZE-1);
461 				}
462 
463 				/* should never happen */
464 				if (tty->column > 0x80000000)
465 					tty->column = 0;
466 
467 				/* Now backup to that column. */
468 				while (tty->column > col) {
469 					/* Can't use opost here. */
470 					put_char('\b', tty);
471 					if (tty->column > 0)
472 						tty->column--;
473 				}
474 			} else {
475 				if (iscntrl(c) && L_ECHOCTL(tty)) {
476 					put_char('\b', tty);
477 					put_char(' ', tty);
478 					put_char('\b', tty);
479 					if (tty->column > 0)
480 						tty->column--;
481 				}
482 				if (!iscntrl(c) || L_ECHOCTL(tty)) {
483 					put_char('\b', tty);
484 					put_char(' ', tty);
485 					put_char('\b', tty);
486 					if (tty->column > 0)
487 						tty->column--;
488 				}
489 			}
490 		}
491 		if (kill_type == ERASE)
492 			break;
493 	}
494 	if (tty->read_head == tty->canon_head)
495 		finish_erasing(tty);
496 }
497 
498 /**
499  *	isig		-	handle the ISIG optio
500  *	@sig: signal
501  *	@tty: terminal
502  *	@flush: force flush
503  *
504  *	Called when a signal is being sent due to terminal input. This
505  *	may caus terminal flushing to take place according to the termios
506  *	settings and character used. Called from the driver receive_buf
507  *	path so serialized.
508  */
509 
isig(int sig,struct tty_struct * tty,int flush)510 static inline void isig(int sig, struct tty_struct *tty, int flush)
511 {
512 	if (tty->pgrp > 0)
513 		kill_pg(tty->pgrp, sig, 1);
514 	if (flush || !L_NOFLSH(tty)) {
515 		n_tty_flush_buffer(tty);
516 		if (tty->driver.flush_buffer)
517 			tty->driver.flush_buffer(tty);
518 	}
519 }
520 
521 /**
522  *	n_tty_receive_break	-	handle break
523  *	@tty: terminal
524  *
525  *	An RS232 break event has been hit in the incoming bitstream. This
526  *	can cause a variety of events depending upon the termios settings.
527  *
528  *	Called from the receive_buf path so single threaded.
529  */
530 
n_tty_receive_break(struct tty_struct * tty)531 static inline void n_tty_receive_break(struct tty_struct *tty)
532 {
533 	if (I_IGNBRK(tty))
534 		return;
535 	if (I_BRKINT(tty)) {
536 		isig(SIGINT, tty, 1);
537 		return;
538 	}
539 	if (I_PARMRK(tty)) {
540 		put_tty_queue('\377', tty);
541 		put_tty_queue('\0', tty);
542 	}
543 	put_tty_queue('\0', tty);
544 	wake_up_interruptible(&tty->read_wait);
545 }
546 
547 /**
548  *	n_tty_receive_overrun	-	handle overrun reporting
549  *	@tty: terminal
550  *
551  *	Data arrived faster than we could process it. While the tty
552  *	driver has flagged this the bits that were missed are gone
553  *	forever.
554  *
555  *	Called from the receive_buf path so single threaded. Does not
556  *	need locking as num_overrun and overrun_time are function
557  *	private.
558  */
559 
n_tty_receive_overrun(struct tty_struct * tty)560 static inline void n_tty_receive_overrun(struct tty_struct *tty)
561 {
562 	char buf[64];
563 
564 	tty->num_overrun++;
565 	if (time_before(tty->overrun_time, jiffies - HZ)) {
566 		printk(KERN_WARNING "%s: %d input overrun(s)\n", tty_name(tty, buf),
567 		       tty->num_overrun);
568 		tty->overrun_time = jiffies;
569 		tty->num_overrun = 0;
570 	}
571 }
572 
573 /**
574  *	n_tty_receive_parity_error	-	error notifier
575  *	@tty: terminal device
576  *	@c: character
577  *
578  *	Process a parity error and queue the right data to indicate
579  *	the error case if neccessary. Locking as per n_tty_receive_buf.
580  */
n_tty_receive_parity_error(struct tty_struct * tty,unsigned char c)581 static inline void n_tty_receive_parity_error(struct tty_struct *tty,
582 					      unsigned char c)
583 {
584 	if (I_IGNPAR(tty)) {
585 		return;
586 	}
587 	if (I_PARMRK(tty)) {
588 		put_tty_queue('\377', tty);
589 		put_tty_queue('\0', tty);
590 		put_tty_queue(c, tty);
591 	} else	if (I_INPCK(tty))
592 		put_tty_queue('\0', tty);
593 	else
594 		put_tty_queue(c, tty);
595 	wake_up_interruptible(&tty->read_wait);
596 }
597 
598 /**
599  *	n_tty_receive_char	-	perform processing
600  *	@tty: terminal device
601  *	@c: character
602  *
603  *	Process an individual character of input received from the driver.
604  *	This is serialized with respect to itself by the rules for the
605  *	driver above.
606  */
607 
n_tty_receive_char(struct tty_struct * tty,unsigned char c)608 static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
609 {
610 	unsigned long flags;
611 
612 	if (tty->raw) {
613 		put_tty_queue(c, tty);
614 		return;
615 	}
616 
617 	if (tty->stopped && !tty->flow_stopped &&
618 	    I_IXON(tty) && I_IXANY(tty)) {
619 		start_tty(tty);
620 		return;
621 	}
622 
623 	if (I_ISTRIP(tty))
624 		c &= 0x7f;
625 	if (I_IUCLC(tty) && L_IEXTEN(tty))
626 		c=tolower(c);
627 
628 	if (tty->closing) {
629 		if (I_IXON(tty)) {
630 			if (c == START_CHAR(tty))
631 				start_tty(tty);
632 			else if (c == STOP_CHAR(tty))
633 				stop_tty(tty);
634 		}
635 		return;
636 	}
637 
638 	/*
639 	 * If the previous character was LNEXT, or we know that this
640 	 * character is not one of the characters that we'll have to
641 	 * handle specially, do shortcut processing to speed things
642 	 * up.
643 	 */
644 	if (!test_bit(c, &tty->process_char_map) || tty->lnext) {
645 		finish_erasing(tty);
646 		tty->lnext = 0;
647 		if (L_ECHO(tty)) {
648 			if (tty->read_cnt >= N_TTY_BUF_SIZE-1) {
649 				put_char('\a', tty); /* beep if no space */
650 				return;
651 			}
652 			/* Record the column of first canon char. */
653 			if (tty->canon_head == tty->read_head)
654 				tty->canon_column = tty->column;
655 			echo_char(c, tty);
656 		}
657 		if (I_PARMRK(tty) && c == (unsigned char) '\377')
658 			put_tty_queue(c, tty);
659 		put_tty_queue(c, tty);
660 		return;
661 	}
662 
663 	if (c == '\r') {
664 		if (I_IGNCR(tty))
665 			return;
666 		if (I_ICRNL(tty))
667 			c = '\n';
668 	} else if (c == '\n' && I_INLCR(tty))
669 		c = '\r';
670 	if (I_IXON(tty)) {
671 		if (c == START_CHAR(tty)) {
672 			start_tty(tty);
673 			return;
674 		}
675 		if (c == STOP_CHAR(tty)) {
676 			stop_tty(tty);
677 			return;
678 		}
679 	}
680 	if (L_ISIG(tty)) {
681 		int signal;
682 		signal = SIGINT;
683 		if (c == INTR_CHAR(tty))
684 			goto send_signal;
685 		signal = SIGQUIT;
686 		if (c == QUIT_CHAR(tty))
687 			goto send_signal;
688 		signal = SIGTSTP;
689 		if (c == SUSP_CHAR(tty)) {
690 send_signal:
691 			isig(signal, tty, 0);
692 			return;
693 		}
694 	}
695 	if (tty->icanon) {
696 		if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
697 		    (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
698 			eraser(c, tty);
699 			return;
700 		}
701 		if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
702 			tty->lnext = 1;
703 			if (L_ECHO(tty)) {
704 				finish_erasing(tty);
705 				if (L_ECHOCTL(tty)) {
706 					put_char('^', tty);
707 					put_char('\b', tty);
708 				}
709 			}
710 			return;
711 		}
712 		if (c == REPRINT_CHAR(tty) && L_ECHO(tty) &&
713 		    L_IEXTEN(tty)) {
714 			unsigned long tail = tty->canon_head;
715 
716 			finish_erasing(tty);
717 			echo_char(c, tty);
718 			opost('\n', tty);
719 			while (tail != tty->read_head) {
720 				echo_char(tty->read_buf[tail], tty);
721 				tail = (tail+1) & (N_TTY_BUF_SIZE-1);
722 			}
723 			return;
724 		}
725 		if (c == '\n') {
726 			if (L_ECHO(tty) || L_ECHONL(tty)) {
727 				if (tty->read_cnt >= N_TTY_BUF_SIZE-1) {
728 					put_char('\a', tty);
729 					return;
730 				}
731 				opost('\n', tty);
732 			}
733 			goto handle_newline;
734 		}
735 		if (c == EOF_CHAR(tty)) {
736 		        if (tty->canon_head != tty->read_head)
737 			        set_bit(TTY_PUSH, &tty->flags);
738 			c = __DISABLED_CHAR;
739 			goto handle_newline;
740 		}
741 		if ((c == EOL_CHAR(tty)) ||
742 		    (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
743 			/*
744 			 * XXX are EOL_CHAR and EOL2_CHAR echoed?!?
745 			 */
746 			if (L_ECHO(tty)) {
747 				if (tty->read_cnt >= N_TTY_BUF_SIZE-1) {
748 					put_char('\a', tty);
749 					return;
750 				}
751 				/* Record the column of first canon char. */
752 				if (tty->canon_head == tty->read_head)
753 					tty->canon_column = tty->column;
754 				echo_char(c, tty);
755 			}
756 			/*
757 			 * XXX does PARMRK doubling happen for
758 			 * EOL_CHAR and EOL2_CHAR?
759 			 */
760 			if (I_PARMRK(tty) && c == (unsigned char) '\377')
761 				put_tty_queue(c, tty);
762 
763 		handle_newline:
764 			spin_lock_irqsave(&tty->read_lock, flags);
765 			set_bit(tty->read_head, &tty->read_flags);
766 			put_tty_queue_nolock(c, tty);
767 			tty->canon_head = tty->read_head;
768 			tty->canon_data++;
769 			spin_unlock_irqrestore(&tty->read_lock, flags);
770 			kill_fasync(&tty->fasync, SIGIO, POLL_IN);
771 			if (waitqueue_active(&tty->read_wait))
772 				wake_up_interruptible(&tty->read_wait);
773 			return;
774 		}
775 	}
776 
777 	finish_erasing(tty);
778 	if (L_ECHO(tty)) {
779 		if (tty->read_cnt >= N_TTY_BUF_SIZE-1) {
780 			put_char('\a', tty); /* beep if no space */
781 			return;
782 		}
783 		if (c == '\n')
784 			opost('\n', tty);
785 		else {
786 			/* Record the column of first canon char. */
787 			if (tty->canon_head == tty->read_head)
788 				tty->canon_column = tty->column;
789 			echo_char(c, tty);
790 		}
791 	}
792 
793 	if (I_PARMRK(tty) && c == (unsigned char) '\377')
794 		put_tty_queue(c, tty);
795 
796 	put_tty_queue(c, tty);
797 }
798 
799 /**
800  *	n_tty_receive_room	-	receive space
801  *	@tty: terminal
802  *
803  *	Called by the driver to find out how much data it is
804  *	permitted to feed to the line discipline without any being lost
805  *	and thus to manage flow control. Not serialized. Answers for the
806  *	"instant".
807  */
808 
n_tty_receive_room(struct tty_struct * tty)809 static int n_tty_receive_room(struct tty_struct *tty)
810 {
811 	int	left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
812 
813 	/*
814 	 * If we are doing input canonicalization, and there are no
815 	 * pending newlines, let characters through without limit, so
816 	 * that erase characters will be handled.  Other excess
817 	 * characters will be beeped.
818 	 */
819 	if (tty->icanon && !tty->canon_data)
820 		return N_TTY_BUF_SIZE;
821 
822 	if (left > 0)
823 		return left;
824 	return 0;
825 }
826 
827 /**
828  *	n_tty_write_wakeup	-	asynchronous I/O notifier
829  *	@tty: tty device
830  *
831  *	Required for the ptys, serial driver etc. since processes
832  *	that attach themselves to the master and rely on ASYNC
833  *	IO must be woken up
834  */
835 
n_tty_write_wakeup(struct tty_struct * tty)836 static void n_tty_write_wakeup(struct tty_struct *tty)
837 {
838 	if (tty->fasync)
839 	{
840  		set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
841 		kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
842 	}
843 	return;
844 }
845 
846 /**
847  *	n_tty_receive_buf	-	data receive
848  *	@tty: terminal device
849  *	@cp: buffer
850  *	@fp: flag buffer
851  *	@count: characters
852  *
853  *	Called by the terminal driver when a block of characters has
854  *	been received. This function must be called from soft contexts
855  *	not from interrupt context. The driver is responsible for making
856  *	calls one at a time and in order (or using queue_ldisc)
857  */
858 
n_tty_receive_buf(struct tty_struct * tty,const unsigned char * cp,char * fp,int count)859 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
860 			      char *fp, int count)
861 {
862 	const unsigned char *p;
863 	char *f, flags = TTY_NORMAL;
864 	int	i;
865 	char	buf[64];
866 	unsigned long cpuflags;
867 
868 	if (!tty->read_buf)
869 		return;
870 
871 	if (tty->real_raw) {
872 		spin_lock_irqsave(&tty->read_lock, cpuflags);
873 		i = MIN(count, MIN(N_TTY_BUF_SIZE - tty->read_cnt,
874 				   N_TTY_BUF_SIZE - tty->read_head));
875 		memcpy(tty->read_buf + tty->read_head, cp, i);
876 		tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
877 		tty->read_cnt += i;
878 		cp += i;
879 		count -= i;
880 
881 		i = MIN(count, MIN(N_TTY_BUF_SIZE - tty->read_cnt,
882 			       N_TTY_BUF_SIZE - tty->read_head));
883 		memcpy(tty->read_buf + tty->read_head, cp, i);
884 		tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
885 		tty->read_cnt += i;
886 		spin_unlock_irqrestore(&tty->read_lock, cpuflags);
887 	} else {
888 		for (i=count, p = cp, f = fp; i; i--, p++) {
889 			if (f)
890 				flags = *f++;
891 			switch (flags) {
892 			case TTY_NORMAL:
893 				n_tty_receive_char(tty, *p);
894 				break;
895 			case TTY_BREAK:
896 				n_tty_receive_break(tty);
897 				break;
898 			case TTY_PARITY:
899 			case TTY_FRAME:
900 				n_tty_receive_parity_error(tty, *p);
901 				break;
902 			case TTY_OVERRUN:
903 				n_tty_receive_overrun(tty);
904 				break;
905 			default:
906 				printk("%s: unknown flag %d\n",
907 				       tty_name(tty, buf), flags);
908 				break;
909 			}
910 		}
911 		if (tty->driver.flush_chars)
912 			tty->driver.flush_chars(tty);
913 	}
914 
915 	if (!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) {
916 		kill_fasync(&tty->fasync, SIGIO, POLL_IN);
917 		if (waitqueue_active(&tty->read_wait))
918 			wake_up_interruptible(&tty->read_wait);
919 	}
920 
921 	/*
922 	 * Check the remaining room for the input canonicalization
923 	 * mode.  We don't want to throttle the driver if we're in
924 	 * canonical mode and don't have a newline yet!
925 	 */
926 	if (n_tty_receive_room(tty) < TTY_THRESHOLD_THROTTLE) {
927 		/* check TTY_THROTTLED first so it indicates our state */
928 		if (!test_and_set_bit(TTY_THROTTLED, &tty->flags) &&
929 		    tty->driver.throttle)
930 			tty->driver.throttle(tty);
931 	}
932 }
933 
is_ignored(int sig)934 int is_ignored(int sig)
935 {
936 	return (sigismember(&current->blocked, sig) ||
937 	        current->sig->action[sig-1].sa.sa_handler == SIG_IGN);
938 }
939 
940 /**
941  *	n_tty_set_termios	-	termios data changed
942  *	@tty: terminal
943  *	@old: previous data
944  *
945  *	Called by the tty layer when the user changes termios flags so
946  *	that the line discipline can plan ahead. This function cannot sleep
947  *	and is protected from re-entry by the tty layer. The user is
948  *	guaranteed that this function will not be re-entered or in progress
949  *	when the ldisc is closed.
950  */
951 
n_tty_set_termios(struct tty_struct * tty,struct termios * old)952 static void n_tty_set_termios(struct tty_struct *tty, struct termios * old)
953 {
954 	if (!tty)
955 		return;
956 
957 	tty->icanon = (L_ICANON(tty) != 0);
958 	if (test_bit(TTY_HW_COOK_IN, &tty->flags)) {
959 		tty->raw = 1;
960 		tty->real_raw = 1;
961 		return;
962 	}
963 	if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
964 	    I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
965 	    I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
966 	    I_PARMRK(tty)) {
967 		memset(tty->process_char_map, 0, 256/8);
968 
969 		if (I_IGNCR(tty) || I_ICRNL(tty))
970 			set_bit('\r', &tty->process_char_map);
971 		if (I_INLCR(tty))
972 			set_bit('\n', &tty->process_char_map);
973 
974 		if (L_ICANON(tty)) {
975 			set_bit(ERASE_CHAR(tty), &tty->process_char_map);
976 			set_bit(KILL_CHAR(tty), &tty->process_char_map);
977 			set_bit(EOF_CHAR(tty), &tty->process_char_map);
978 			set_bit('\n', &tty->process_char_map);
979 			set_bit(EOL_CHAR(tty), &tty->process_char_map);
980 			if (L_IEXTEN(tty)) {
981 				set_bit(WERASE_CHAR(tty),
982 					&tty->process_char_map);
983 				set_bit(LNEXT_CHAR(tty),
984 					&tty->process_char_map);
985 				set_bit(EOL2_CHAR(tty),
986 					&tty->process_char_map);
987 				if (L_ECHO(tty))
988 					set_bit(REPRINT_CHAR(tty),
989 						&tty->process_char_map);
990 			}
991 		}
992 		if (I_IXON(tty)) {
993 			set_bit(START_CHAR(tty), &tty->process_char_map);
994 			set_bit(STOP_CHAR(tty), &tty->process_char_map);
995 		}
996 		if (L_ISIG(tty)) {
997 			set_bit(INTR_CHAR(tty), &tty->process_char_map);
998 			set_bit(QUIT_CHAR(tty), &tty->process_char_map);
999 			set_bit(SUSP_CHAR(tty), &tty->process_char_map);
1000 		}
1001 		clear_bit(__DISABLED_CHAR, &tty->process_char_map);
1002 		tty->raw = 0;
1003 		tty->real_raw = 0;
1004 	} else {
1005 		tty->raw = 1;
1006 		if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1007 		    (I_IGNPAR(tty) || !I_INPCK(tty)) &&
1008 		    (tty->driver.flags & TTY_DRIVER_REAL_RAW))
1009 			tty->real_raw = 1;
1010 		else
1011 			tty->real_raw = 0;
1012 	}
1013 }
1014 
1015 /**
1016  *	n_tty_close		-	close the ldisc for this tty
1017  *	@tty: device
1018  *
1019  *	Called from the terminal layer when this line discipline is
1020  *	being shut down, either because of a close or becsuse of a
1021  *	discipline change. The function will not be called while other
1022  *	ldisc methods are in progress.
1023  */
1024 
n_tty_close(struct tty_struct * tty)1025 static void n_tty_close(struct tty_struct *tty)
1026 {
1027 	n_tty_flush_buffer(tty);
1028 	if (tty->read_buf) {
1029 		free_buf(tty->read_buf);
1030 		tty->read_buf = 0;
1031 	}
1032 }
1033 
1034 /**
1035  *	n_tty_open		-	open an ldisc
1036  *	@tty: terminal to open
1037  *
1038  *	Called when this line discipline is being attached to the
1039  *	terminal device. Can sleep. Called serialized so that no
1040  *	other events will occur in parallel. No further open will occur
1041  *	until a close.
1042  */
1043 
n_tty_open(struct tty_struct * tty)1044 static int n_tty_open(struct tty_struct *tty)
1045 {
1046 	if (!tty)
1047 		return -EINVAL;
1048 
1049 	/* This one is ugly. Currently a malloc failure here can panic */
1050 	if (!tty->read_buf) {
1051 		tty->read_buf = alloc_buf();
1052 		if (!tty->read_buf)
1053 			return -ENOMEM;
1054 	}
1055 	memset(tty->read_buf, 0, N_TTY_BUF_SIZE);
1056 	reset_buffer_flags(tty);
1057 	tty->column = 0;
1058 	n_tty_set_termios(tty, 0);
1059 	tty->minimum_to_wake = 1;
1060 	tty->closing = 0;
1061 	return 0;
1062 }
1063 
input_available_p(struct tty_struct * tty,int amt)1064 static inline int input_available_p(struct tty_struct *tty, int amt)
1065 {
1066 	if (tty->icanon) {
1067 		if (tty->canon_data)
1068 			return 1;
1069 	} else if (tty->read_cnt >= (amt ? amt : 1))
1070 		return 1;
1071 
1072 	return 0;
1073 }
1074 
1075 /**
1076  * 	copy_from_read_buf	-	copy read data directly
1077  *	@tty: terminal device
1078  *	@b: user data
1079  *	@nr: size of data
1080  *
1081  *	Helper function to speed up read_chan.  It is only called when
1082  *	ICANON is off; it copies characters straight from the tty queue to
1083  *	user space directly.  It can be profitably called twice; once to
1084  *	drain the space from the tail pointer to the (physical) end of the
1085  *	buffer, and once to drain the space from the (physical) beginning of
1086  *	the buffer to head pointer.
1087  *
1088  *	Called under the tty->atomic_read sem and with TTY_DONT_FLIP set
1089  *
1090  */
1091 
copy_from_read_buf(struct tty_struct * tty,unsigned char ** b,size_t * nr)1092 static inline int copy_from_read_buf(struct tty_struct *tty,
1093 				      unsigned char **b,
1094 				      size_t *nr)
1095 
1096 {
1097 	int retval;
1098 	ssize_t n;
1099 	unsigned long flags;
1100 
1101 	retval = 0;
1102 	spin_lock_irqsave(&tty->read_lock, flags);
1103 	n = MIN(*nr, MIN(tty->read_cnt, N_TTY_BUF_SIZE - tty->read_tail));
1104 	spin_unlock_irqrestore(&tty->read_lock, flags);
1105 	if (n) {
1106 		mb();
1107 		retval = copy_to_user(*b, &tty->read_buf[tty->read_tail], n);
1108 		n -= retval;
1109 		spin_lock_irqsave(&tty->read_lock, flags);
1110 		tty->read_tail = (tty->read_tail + n) & (N_TTY_BUF_SIZE-1);
1111 		tty->read_cnt -= n;
1112 		spin_unlock_irqrestore(&tty->read_lock, flags);
1113 		*b += n;
1114 		*nr -= n;
1115 	}
1116 	return retval;
1117 }
1118 
1119 /**
1120  *     job_control             -       check job control
1121  *     @tty: tty
1122  *     @file: file handle
1123  *
1124  *     Perform job control management checks on this file/tty descriptor
1125  *     and if appropriate send any needed signals and return a negative
1126  *     error code if action should be taken.
1127  */
1128 
job_control(struct tty_struct * tty,struct file * file)1129 static int job_control(struct tty_struct *tty, struct file *file)
1130 {
1131 	/* Job control check -- must be done at start and after
1132 	   every sleep (POSIX.1 7.1.1.4). */
1133 	/* NOTE: not yet done after every sleep pending a thorough
1134 	   check of the logic of this change. -- jlc */
1135 	/* don't stop on /dev/console */
1136 	if (file->f_dentry->d_inode->i_rdev != CONSOLE_DEV &&
1137 	    file->f_dentry->d_inode->i_rdev != SYSCONS_DEV &&
1138 	    current->tty == tty) {
1139 		if (tty->pgrp <= 0)
1140 			printk("read_chan: tty->pgrp <= 0!\n");
1141 		else if (current->pgrp != tty->pgrp) {
1142 			if (is_ignored(SIGTTIN) ||
1143 			    is_orphaned_pgrp(current->pgrp))
1144 				return -EIO;
1145 			kill_pg(current->pgrp, SIGTTIN, 1);
1146 			return -ERESTARTSYS;
1147 		}
1148 	}
1149 	return 0;
1150 }
1151 
1152 
1153 /**
1154  *	read_chan		-	read function for tty
1155  *	@tty: tty device
1156  *	@file: file object
1157  *	@buf: userspace buffer pointer
1158  *	@nr: size of I/O
1159  *
1160  *	Perform reads for the line discipline. We are guaranteed that the
1161  *	line discipline will not be closed under us but we may get multiple
1162  *	parallel readers and must handle this ourselves. We may also get
1163  *	a hangup. Always called in user context, may sleep.
1164  *
1165  *	This code must be sure never to sleep through a hangup.
1166  */
1167 
read_chan(struct tty_struct * tty,struct file * file,unsigned char __user * buf,size_t nr)1168 static ssize_t read_chan(struct tty_struct *tty, struct file *file,
1169 			 unsigned char __user *buf, size_t nr)
1170 {
1171 	unsigned char __user *b = buf;
1172 	DECLARE_WAITQUEUE(wait, current);
1173 	int c;
1174 	int minimum, time;
1175 	ssize_t retval = 0;
1176 	ssize_t size;
1177 	long timeout;
1178 	unsigned long flags;
1179 
1180 do_it_again:
1181 
1182 	if (!tty->read_buf) {
1183 		printk("n_tty_read_chan: called with read_buf == NULL?!?\n");
1184 		return -EIO;
1185 	}
1186 
1187 	c = job_control(tty, file);
1188 	if(c < 0)
1189 		return c;
1190 
1191 	minimum = time = 0;
1192 	timeout = MAX_SCHEDULE_TIMEOUT;
1193 	if (!tty->icanon) {
1194 		time = (HZ / 10) * TIME_CHAR(tty);
1195 		minimum = MIN_CHAR(tty);
1196 		if (minimum) {
1197 			if (time)
1198 				tty->minimum_to_wake = 1;
1199 			else if (!waitqueue_active(&tty->read_wait) ||
1200 				 (tty->minimum_to_wake > minimum))
1201 				tty->minimum_to_wake = minimum;
1202 		} else {
1203 			timeout = 0;
1204 			if (time) {
1205 				timeout = time;
1206 				time = 0;
1207 			}
1208 			tty->minimum_to_wake = minimum = 1;
1209 		}
1210 	}
1211 
1212 	/*
1213 	 *	Internal serialization of reads.
1214 	 */
1215 	if (file->f_flags & O_NONBLOCK) {
1216 		if (down_trylock(&tty->atomic_read))
1217 			return -EAGAIN;
1218 	}
1219 	else {
1220 		if (down_interruptible(&tty->atomic_read))
1221 			return -ERESTARTSYS;
1222 	}
1223 
1224 	add_wait_queue(&tty->read_wait, &wait);
1225 	set_bit(TTY_DONT_FLIP, &tty->flags);
1226 	while (nr) {
1227 		/* First test for status change. */
1228 		if (tty->packet && tty->link->ctrl_status) {
1229 			unsigned char cs;
1230 			if (b != buf)
1231 				break;
1232 			cs = tty->link->ctrl_status;
1233 			tty->link->ctrl_status = 0;
1234 			put_user(cs, b++);
1235 			nr--;
1236 			break;
1237 		}
1238 		/* This statement must be first before checking for input
1239 		   so that any interrupt will set the state back to
1240 		   TASK_RUNNING. */
1241 		set_current_state(TASK_INTERRUPTIBLE);
1242 
1243 		if (((minimum - (b - buf)) < tty->minimum_to_wake) &&
1244 		    ((minimum - (b - buf)) >= 1))
1245 			tty->minimum_to_wake = (minimum - (b - buf));
1246 
1247 		if (!input_available_p(tty, 0)) {
1248 			if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
1249 				retval = -EIO;
1250 				break;
1251 			}
1252 			if (tty_hung_up_p(file))
1253 				break;
1254 			if (!timeout)
1255 				break;
1256 			if (file->f_flags & O_NONBLOCK) {
1257 				retval = -EAGAIN;
1258 				break;
1259 			}
1260 			if (signal_pending(current)) {
1261 				retval = -ERESTARTSYS;
1262 				break;
1263 			}
1264 			clear_bit(TTY_DONT_FLIP, &tty->flags);
1265 			timeout = schedule_timeout(timeout);
1266 			set_bit(TTY_DONT_FLIP, &tty->flags);
1267 			continue;
1268 		}
1269 		current->state = TASK_RUNNING;
1270 
1271 		/* Deal with packet mode. */
1272 		if (tty->packet && b == buf) {
1273 			put_user(TIOCPKT_DATA, b++);
1274 			nr--;
1275 		}
1276 
1277 		if (tty->icanon) {
1278 			/* N.B. avoid overrun if nr == 0 */
1279 			while (nr && tty->read_cnt) {
1280  				int eol;
1281 
1282 				eol = test_and_clear_bit(tty->read_tail,
1283 						&tty->read_flags);
1284 				c = tty->read_buf[tty->read_tail];
1285 				spin_lock_irqsave(&tty->read_lock, flags);
1286 				tty->read_tail = ((tty->read_tail+1) &
1287 						  (N_TTY_BUF_SIZE-1));
1288 				tty->read_cnt--;
1289 				if (eol) {
1290 					/* this test should be redundant:
1291 					 * we shouldn't be reading data if
1292 					 * canon_data is 0
1293 					 */
1294 					if (--tty->canon_data < 0)
1295 						tty->canon_data = 0;
1296 				}
1297 				spin_unlock_irqrestore(&tty->read_lock, flags);
1298 
1299 				if (!eol || (c != __DISABLED_CHAR)) {
1300 					put_user(c, b++);
1301 					nr--;
1302 				}
1303 				if (eol)
1304 					break;
1305 			}
1306 		} else {
1307 			int uncopied;
1308 			uncopied = copy_from_read_buf(tty, &b, &nr);
1309 			uncopied += copy_from_read_buf(tty, &b, &nr);
1310 			if (uncopied) {
1311 				retval = -EFAULT;
1312 				break;
1313 			}
1314 		}
1315 
1316 		/* If there is enough space in the read buffer now, let the
1317 		 * low-level driver know. We use n_tty_chars_in_buffer() to
1318 		 * check the buffer, as it now knows about canonical mode.
1319 		 * Otherwise, if the driver is throttled and the line is
1320 		 * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
1321 		 * we won't get any more characters.
1322 		 */
1323 		if (n_tty_chars_in_buffer(tty) <= TTY_THRESHOLD_UNTHROTTLE)
1324 			check_unthrottle(tty);
1325 
1326 		if (b - buf >= minimum)
1327 			break;
1328 		if (time)
1329 			timeout = time;
1330 	}
1331 	clear_bit(TTY_DONT_FLIP, &tty->flags);
1332 	up(&tty->atomic_read);
1333 	remove_wait_queue(&tty->read_wait, &wait);
1334 
1335 	if (!waitqueue_active(&tty->read_wait))
1336 		tty->minimum_to_wake = minimum;
1337 
1338 	current->state = TASK_RUNNING;
1339 	size = b - buf;
1340 	if (size) {
1341 		retval = size;
1342 		if (nr)
1343 	       		clear_bit(TTY_PUSH, &tty->flags);
1344 	} else if (test_and_clear_bit(TTY_PUSH, &tty->flags))
1345 		 goto do_it_again;
1346 
1347 	return retval;
1348 }
1349 
1350 /**
1351  *	write_chan		-	write function for tty
1352  *	@tty: tty device
1353  *	@file: file object
1354  *	@buf: userspace buffer pointer
1355  *	@nr: size of I/O
1356  *
1357  *	Write function of the terminal device. This is serialized with
1358  *	respect to other write callers but not to termios changes, reads
1359  *	and other such events. We must be careful with N_TTY as the receive
1360  *	code will echo characters, thus calling driver write methods.
1361  *
1362  *	This code must be sure never to sleep through a hangup.
1363  */
1364 
write_chan(struct tty_struct * tty,struct file * file,const unsigned char * buf,size_t nr)1365 static ssize_t write_chan(struct tty_struct * tty, struct file * file,
1366 			  const unsigned char * buf, size_t nr)
1367 {
1368 	const unsigned char *b = buf;
1369 	DECLARE_WAITQUEUE(wait, current);
1370 	int c;
1371 	ssize_t retval = 0;
1372 
1373 	/* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
1374 	if (L_TOSTOP(tty) &&
1375 	    file->f_dentry->d_inode->i_rdev != CONSOLE_DEV &&
1376 	    file->f_dentry->d_inode->i_rdev != SYSCONS_DEV) {
1377 		retval = tty_check_change(tty);
1378 		if (retval)
1379 			return retval;
1380 	}
1381 
1382 	add_wait_queue(&tty->write_wait, &wait);
1383 	while (1) {
1384 		set_current_state(TASK_INTERRUPTIBLE);
1385 		if (signal_pending(current)) {
1386 			retval = -ERESTARTSYS;
1387 			break;
1388 		}
1389 		if (tty_hung_up_p(file) || (tty->link && !tty->link->count)) {
1390 			retval = -EIO;
1391 			break;
1392 		}
1393 		if (O_OPOST(tty) && !(test_bit(TTY_HW_COOK_OUT, &tty->flags))) {
1394 			while (nr > 0) {
1395 				ssize_t num = opost_block(tty, b, nr);
1396 				if (num < 0) {
1397 					if (num == -EAGAIN)
1398 						break;
1399 					retval = num;
1400 					goto break_out;
1401 				}
1402 				b += num;
1403 				nr -= num;
1404 				if (nr == 0)
1405 					break;
1406 				get_user(c, b);
1407 				if (opost(c, tty) < 0)
1408 					break;
1409 				b++; nr--;
1410 			}
1411 			if (tty->driver.flush_chars)
1412 				tty->driver.flush_chars(tty);
1413 		} else {
1414 			c = tty->driver.write(tty, 1, b, nr);
1415 			if (c < 0) {
1416 				retval = c;
1417 				goto break_out;
1418 			}
1419 			b += c;
1420 			nr -= c;
1421 		}
1422 		if (!nr)
1423 			break;
1424 		if (file->f_flags & O_NONBLOCK) {
1425 			retval = -EAGAIN;
1426 			break;
1427 		}
1428 		schedule();
1429 	}
1430 break_out:
1431 	current->state = TASK_RUNNING;
1432 	remove_wait_queue(&tty->write_wait, &wait);
1433 	return (b - buf) ? b - buf : retval;
1434 }
1435 
1436 /**
1437  *	normal_poll		-	poll method for N_TTY
1438  *	@tty: terminal device
1439  *	@file: file accessing it
1440  *	@wait: poll table
1441  *
1442  *	Called when the line discipline is asked to poll() for data or
1443  *	for special events. This code is not serialized with respect to
1444  *	other events save open/close.
1445  *
1446  *	This code must be sure never to sleep through a hangup.
1447  *	Called without the kernel lock held - fine
1448  *
1449  *	FIXME: if someone changes the VMIN or discipline settings for the
1450  *	terminal while another process is in poll() the poll does not
1451  *	recompute the new limits. Possibly set_termios should issue
1452  *	a read wakeup to fix this bug.
1453  */
1454 
normal_poll(struct tty_struct * tty,struct file * file,poll_table * wait)1455 static unsigned int normal_poll(struct tty_struct * tty, struct file * file, poll_table *wait)
1456 {
1457 	unsigned int mask = 0;
1458 
1459 	poll_wait(file, &tty->read_wait, wait);
1460 	poll_wait(file, &tty->write_wait, wait);
1461 	if (input_available_p(tty, TIME_CHAR(tty) ? 0 : MIN_CHAR(tty)))
1462 		mask |= POLLIN | POLLRDNORM;
1463 	if (tty->packet && tty->link->ctrl_status)
1464 		mask |= POLLPRI | POLLIN | POLLRDNORM;
1465 	if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
1466 		mask |= POLLHUP;
1467 	if (tty_hung_up_p(file))
1468 		mask |= POLLHUP;
1469 	if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
1470 		if (MIN_CHAR(tty) && !TIME_CHAR(tty))
1471 			tty->minimum_to_wake = MIN_CHAR(tty);
1472 		else
1473 			tty->minimum_to_wake = 1;
1474 	}
1475 	if (tty->driver.chars_in_buffer(tty) < WAKEUP_CHARS &&
1476 			tty->driver.write_room(tty) > 0)
1477 		mask |= POLLOUT | POLLWRNORM;
1478 	return mask;
1479 }
1480 
1481 struct tty_ldisc tty_ldisc_N_TTY = {
1482 	TTY_LDISC_MAGIC,	/* magic */
1483 	"n_tty",		/* name */
1484 	0,			/* num */
1485 	0,			/* flags */
1486 	n_tty_open,		/* open */
1487 	n_tty_close,		/* close */
1488 	n_tty_flush_buffer,	/* flush_buffer */
1489 	n_tty_chars_in_buffer,	/* chars_in_buffer */
1490 	read_chan,		/* read */
1491 	write_chan,		/* write */
1492 	n_tty_ioctl,		/* ioctl */
1493 	n_tty_set_termios,	/* set_termios */
1494 	normal_poll,		/* poll */
1495 	NULL,			/* hangup */
1496 	n_tty_receive_buf,	/* receive_buf */
1497 	n_tty_receive_room,	/* receive_room */
1498 	n_tty_write_wakeup	/* write_wakeup */
1499 };
1500 
1501