xref: /openbmc/linux/drivers/tty/n_tty.c (revision e2f1cf25)
1 /*
2  * n_tty.c --- implements the N_TTY line discipline.
3  *
4  * This code used to be in tty_io.c, but things are getting hairy
5  * enough that it made sense to split things off.  (The N_TTY
6  * processing has changed so much that it's hardly recognizable,
7  * anyway...)
8  *
9  * Note that the open routine for N_TTY is guaranteed never to return
10  * an error.  This is because Linux will fall back to setting a line
11  * to N_TTY if it can not switch to any other line discipline.
12  *
13  * Written by Theodore Ts'o, Copyright 1994.
14  *
15  * This file also contains code originally written by Linus Torvalds,
16  * Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
17  *
18  * This file may be redistributed under the terms of the GNU General Public
19  * License.
20  *
21  * Reduced memory usage for older ARM systems  - Russell King.
22  *
23  * 2000/01/20   Fixed SMP locking on put_tty_queue using bits of
24  *		the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
25  *		who actually finally proved there really was a race.
26  *
27  * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
28  *		waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
29  *		Also fixed a bug in BLOCKING mode where n_tty_write returns
30  *		EAGAIN
31  */
32 
33 #include <linux/types.h>
34 #include <linux/major.h>
35 #include <linux/errno.h>
36 #include <linux/signal.h>
37 #include <linux/fcntl.h>
38 #include <linux/sched.h>
39 #include <linux/interrupt.h>
40 #include <linux/tty.h>
41 #include <linux/timer.h>
42 #include <linux/ctype.h>
43 #include <linux/mm.h>
44 #include <linux/string.h>
45 #include <linux/slab.h>
46 #include <linux/poll.h>
47 #include <linux/bitops.h>
48 #include <linux/audit.h>
49 #include <linux/file.h>
50 #include <linux/uaccess.h>
51 #include <linux/module.h>
52 #include <linux/ratelimit.h>
53 #include <linux/vmalloc.h>
54 
55 
56 /* number of characters left in xmit buffer before select has we have room */
57 #define WAKEUP_CHARS 256
58 
59 /*
60  * This defines the low- and high-watermarks for throttling and
61  * unthrottling the TTY driver.  These watermarks are used for
62  * controlling the space in the read buffer.
63  */
64 #define TTY_THRESHOLD_THROTTLE		128 /* now based on remaining room */
65 #define TTY_THRESHOLD_UNTHROTTLE	128
66 
67 /*
68  * Special byte codes used in the echo buffer to represent operations
69  * or special handling of characters.  Bytes in the echo buffer that
70  * are not part of such special blocks are treated as normal character
71  * codes.
72  */
73 #define ECHO_OP_START 0xff
74 #define ECHO_OP_MOVE_BACK_COL 0x80
75 #define ECHO_OP_SET_CANON_COL 0x81
76 #define ECHO_OP_ERASE_TAB 0x82
77 
78 #define ECHO_COMMIT_WATERMARK	256
79 #define ECHO_BLOCK		256
80 #define ECHO_DISCARD_WATERMARK	N_TTY_BUF_SIZE - (ECHO_BLOCK + 32)
81 
82 
83 #undef N_TTY_TRACE
84 #ifdef N_TTY_TRACE
85 # define n_tty_trace(f, args...)	trace_printk(f, ##args)
86 #else
87 # define n_tty_trace(f, args...)
88 #endif
89 
90 struct n_tty_data {
91 	/* producer-published */
92 	size_t read_head;
93 	size_t commit_head;
94 	size_t canon_head;
95 	size_t echo_head;
96 	size_t echo_commit;
97 	size_t echo_mark;
98 	DECLARE_BITMAP(char_map, 256);
99 
100 	/* private to n_tty_receive_overrun (single-threaded) */
101 	unsigned long overrun_time;
102 	int num_overrun;
103 
104 	/* non-atomic */
105 	bool no_room;
106 
107 	/* must hold exclusive termios_rwsem to reset these */
108 	unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
109 	unsigned char push:1;
110 
111 	/* shared by producer and consumer */
112 	char read_buf[N_TTY_BUF_SIZE];
113 	DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
114 	unsigned char echo_buf[N_TTY_BUF_SIZE];
115 
116 	int minimum_to_wake;
117 
118 	/* consumer-published */
119 	size_t read_tail;
120 	size_t line_start;
121 
122 	/* protected by output lock */
123 	unsigned int column;
124 	unsigned int canon_column;
125 	size_t echo_tail;
126 
127 	struct mutex atomic_read_lock;
128 	struct mutex output_lock;
129 };
130 
131 static inline size_t read_cnt(struct n_tty_data *ldata)
132 {
133 	return ldata->read_head - ldata->read_tail;
134 }
135 
136 static inline unsigned char read_buf(struct n_tty_data *ldata, size_t i)
137 {
138 	return ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
139 }
140 
141 static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i)
142 {
143 	return &ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
144 }
145 
146 static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i)
147 {
148 	return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
149 }
150 
151 static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
152 {
153 	return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
154 }
155 
156 static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
157 			       unsigned char __user *ptr)
158 {
159 	struct n_tty_data *ldata = tty->disc_data;
160 
161 	tty_audit_add_data(tty, &x, 1, ldata->icanon);
162 	return put_user(x, ptr);
163 }
164 
165 static inline int tty_copy_to_user(struct tty_struct *tty,
166 					void __user *to,
167 					const void *from,
168 					unsigned long n)
169 {
170 	struct n_tty_data *ldata = tty->disc_data;
171 
172 	tty_audit_add_data(tty, to, n, ldata->icanon);
173 	return copy_to_user(to, from, n);
174 }
175 
176 /**
177  *	n_tty_kick_worker - start input worker (if required)
178  *	@tty: terminal
179  *
180  *	Re-schedules the flip buffer work if it may have stopped
181  *
182  *	Caller holds exclusive termios_rwsem
183  *	   or
184  *	n_tty_read()/consumer path:
185  *		holds non-exclusive termios_rwsem
186  */
187 
188 static void n_tty_kick_worker(struct tty_struct *tty)
189 {
190 	struct n_tty_data *ldata = tty->disc_data;
191 
192 	/* Did the input worker stop? Restart it */
193 	if (unlikely(ldata->no_room)) {
194 		ldata->no_room = 0;
195 
196 		WARN_RATELIMIT(tty->port->itty == NULL,
197 				"scheduling with invalid itty\n");
198 		/* see if ldisc has been killed - if so, this means that
199 		 * even though the ldisc has been halted and ->buf.work
200 		 * cancelled, ->buf.work is about to be rescheduled
201 		 */
202 		WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
203 			       "scheduling buffer work for halted ldisc\n");
204 		queue_work(system_unbound_wq, &tty->port->buf.work);
205 	}
206 }
207 
208 static ssize_t chars_in_buffer(struct tty_struct *tty)
209 {
210 	struct n_tty_data *ldata = tty->disc_data;
211 	ssize_t n = 0;
212 
213 	if (!ldata->icanon)
214 		n = ldata->commit_head - ldata->read_tail;
215 	else
216 		n = ldata->canon_head - ldata->read_tail;
217 	return n;
218 }
219 
220 /**
221  *	n_tty_write_wakeup	-	asynchronous I/O notifier
222  *	@tty: tty device
223  *
224  *	Required for the ptys, serial driver etc. since processes
225  *	that attach themselves to the master and rely on ASYNC
226  *	IO must be woken up
227  */
228 
229 static void n_tty_write_wakeup(struct tty_struct *tty)
230 {
231 	if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
232 		kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
233 }
234 
235 static void n_tty_check_throttle(struct tty_struct *tty)
236 {
237 	struct n_tty_data *ldata = tty->disc_data;
238 
239 	/*
240 	 * Check the remaining room for the input canonicalization
241 	 * mode.  We don't want to throttle the driver if we're in
242 	 * canonical mode and don't have a newline yet!
243 	 */
244 	if (ldata->icanon && ldata->canon_head == ldata->read_tail)
245 		return;
246 
247 	while (1) {
248 		int throttled;
249 		tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
250 		if (N_TTY_BUF_SIZE - read_cnt(ldata) >= TTY_THRESHOLD_THROTTLE)
251 			break;
252 		throttled = tty_throttle_safe(tty);
253 		if (!throttled)
254 			break;
255 	}
256 	__tty_set_flow_change(tty, 0);
257 }
258 
259 static void n_tty_check_unthrottle(struct tty_struct *tty)
260 {
261 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
262 	    tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
263 		if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
264 			return;
265 		if (!tty->count)
266 			return;
267 		n_tty_kick_worker(tty);
268 		n_tty_write_wakeup(tty->link);
269 		if (waitqueue_active(&tty->link->write_wait))
270 			wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
271 		return;
272 	}
273 
274 	/* If there is enough space in the read buffer now, let the
275 	 * low-level driver know. We use chars_in_buffer() to
276 	 * check the buffer, as it now knows about canonical mode.
277 	 * Otherwise, if the driver is throttled and the line is
278 	 * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
279 	 * we won't get any more characters.
280 	 */
281 
282 	while (1) {
283 		int unthrottled;
284 		tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
285 		if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
286 			break;
287 		if (!tty->count)
288 			break;
289 		n_tty_kick_worker(tty);
290 		unthrottled = tty_unthrottle_safe(tty);
291 		if (!unthrottled)
292 			break;
293 	}
294 	__tty_set_flow_change(tty, 0);
295 }
296 
297 /**
298  *	put_tty_queue		-	add character to tty
299  *	@c: character
300  *	@ldata: n_tty data
301  *
302  *	Add a character to the tty read_buf queue.
303  *
304  *	n_tty_receive_buf()/producer path:
305  *		caller holds non-exclusive termios_rwsem
306  */
307 
308 static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
309 {
310 	*read_buf_addr(ldata, ldata->read_head) = c;
311 	ldata->read_head++;
312 }
313 
314 /**
315  *	reset_buffer_flags	-	reset buffer state
316  *	@tty: terminal to reset
317  *
318  *	Reset the read buffer counters and clear the flags.
319  *	Called from n_tty_open() and n_tty_flush_buffer().
320  *
321  *	Locking: caller holds exclusive termios_rwsem
322  *		 (or locking is not required)
323  */
324 
325 static void reset_buffer_flags(struct n_tty_data *ldata)
326 {
327 	ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
328 	ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
329 	ldata->commit_head = 0;
330 	ldata->echo_mark = 0;
331 	ldata->line_start = 0;
332 
333 	ldata->erasing = 0;
334 	bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
335 	ldata->push = 0;
336 }
337 
338 static void n_tty_packet_mode_flush(struct tty_struct *tty)
339 {
340 	unsigned long flags;
341 
342 	if (tty->link->packet) {
343 		spin_lock_irqsave(&tty->ctrl_lock, flags);
344 		tty->ctrl_status |= TIOCPKT_FLUSHREAD;
345 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
346 		if (waitqueue_active(&tty->link->read_wait))
347 			wake_up_interruptible(&tty->link->read_wait);
348 	}
349 }
350 
351 /**
352  *	n_tty_flush_buffer	-	clean input queue
353  *	@tty:	terminal device
354  *
355  *	Flush the input buffer. Called when the tty layer wants the
356  *	buffer flushed (eg at hangup) or when the N_TTY line discipline
357  *	internally has to clean the pending queue (for example some signals).
358  *
359  *	Holds termios_rwsem to exclude producer/consumer while
360  *	buffer indices are reset.
361  *
362  *	Locking: ctrl_lock, exclusive termios_rwsem
363  */
364 
365 static void n_tty_flush_buffer(struct tty_struct *tty)
366 {
367 	down_write(&tty->termios_rwsem);
368 	reset_buffer_flags(tty->disc_data);
369 	n_tty_kick_worker(tty);
370 
371 	if (tty->link)
372 		n_tty_packet_mode_flush(tty);
373 	up_write(&tty->termios_rwsem);
374 }
375 
376 /**
377  *	n_tty_chars_in_buffer	-	report available bytes
378  *	@tty: tty device
379  *
380  *	Report the number of characters buffered to be delivered to user
381  *	at this instant in time.
382  *
383  *	Locking: exclusive termios_rwsem
384  */
385 
386 static ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
387 {
388 	ssize_t n;
389 
390 	WARN_ONCE(1, "%s is deprecated and scheduled for removal.", __func__);
391 
392 	down_write(&tty->termios_rwsem);
393 	n = chars_in_buffer(tty);
394 	up_write(&tty->termios_rwsem);
395 	return n;
396 }
397 
398 /**
399  *	is_utf8_continuation	-	utf8 multibyte check
400  *	@c: byte to check
401  *
402  *	Returns true if the utf8 character 'c' is a multibyte continuation
403  *	character. We use this to correctly compute the on screen size
404  *	of the character when printing
405  */
406 
407 static inline int is_utf8_continuation(unsigned char c)
408 {
409 	return (c & 0xc0) == 0x80;
410 }
411 
412 /**
413  *	is_continuation		-	multibyte check
414  *	@c: byte to check
415  *
416  *	Returns true if the utf8 character 'c' is a multibyte continuation
417  *	character and the terminal is in unicode mode.
418  */
419 
420 static inline int is_continuation(unsigned char c, struct tty_struct *tty)
421 {
422 	return I_IUTF8(tty) && is_utf8_continuation(c);
423 }
424 
425 /**
426  *	do_output_char			-	output one character
427  *	@c: character (or partial unicode symbol)
428  *	@tty: terminal device
429  *	@space: space available in tty driver write buffer
430  *
431  *	This is a helper function that handles one output character
432  *	(including special characters like TAB, CR, LF, etc.),
433  *	doing OPOST processing and putting the results in the
434  *	tty driver's write buffer.
435  *
436  *	Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY
437  *	and NLDLY.  They simply aren't relevant in the world today.
438  *	If you ever need them, add them here.
439  *
440  *	Returns the number of bytes of buffer space used or -1 if
441  *	no space left.
442  *
443  *	Locking: should be called under the output_lock to protect
444  *		 the column state and space left in the buffer
445  */
446 
447 static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
448 {
449 	struct n_tty_data *ldata = tty->disc_data;
450 	int	spaces;
451 
452 	if (!space)
453 		return -1;
454 
455 	switch (c) {
456 	case '\n':
457 		if (O_ONLRET(tty))
458 			ldata->column = 0;
459 		if (O_ONLCR(tty)) {
460 			if (space < 2)
461 				return -1;
462 			ldata->canon_column = ldata->column = 0;
463 			tty->ops->write(tty, "\r\n", 2);
464 			return 2;
465 		}
466 		ldata->canon_column = ldata->column;
467 		break;
468 	case '\r':
469 		if (O_ONOCR(tty) && ldata->column == 0)
470 			return 0;
471 		if (O_OCRNL(tty)) {
472 			c = '\n';
473 			if (O_ONLRET(tty))
474 				ldata->canon_column = ldata->column = 0;
475 			break;
476 		}
477 		ldata->canon_column = ldata->column = 0;
478 		break;
479 	case '\t':
480 		spaces = 8 - (ldata->column & 7);
481 		if (O_TABDLY(tty) == XTABS) {
482 			if (space < spaces)
483 				return -1;
484 			ldata->column += spaces;
485 			tty->ops->write(tty, "        ", spaces);
486 			return spaces;
487 		}
488 		ldata->column += spaces;
489 		break;
490 	case '\b':
491 		if (ldata->column > 0)
492 			ldata->column--;
493 		break;
494 	default:
495 		if (!iscntrl(c)) {
496 			if (O_OLCUC(tty))
497 				c = toupper(c);
498 			if (!is_continuation(c, tty))
499 				ldata->column++;
500 		}
501 		break;
502 	}
503 
504 	tty_put_char(tty, c);
505 	return 1;
506 }
507 
508 /**
509  *	process_output			-	output post processor
510  *	@c: character (or partial unicode symbol)
511  *	@tty: terminal device
512  *
513  *	Output one character with OPOST processing.
514  *	Returns -1 when the output device is full and the character
515  *	must be retried.
516  *
517  *	Locking: output_lock to protect column state and space left
518  *		 (also, this is called from n_tty_write under the
519  *		  tty layer write lock)
520  */
521 
522 static int process_output(unsigned char c, struct tty_struct *tty)
523 {
524 	struct n_tty_data *ldata = tty->disc_data;
525 	int	space, retval;
526 
527 	mutex_lock(&ldata->output_lock);
528 
529 	space = tty_write_room(tty);
530 	retval = do_output_char(c, tty, space);
531 
532 	mutex_unlock(&ldata->output_lock);
533 	if (retval < 0)
534 		return -1;
535 	else
536 		return 0;
537 }
538 
539 /**
540  *	process_output_block		-	block post processor
541  *	@tty: terminal device
542  *	@buf: character buffer
543  *	@nr: number of bytes to output
544  *
545  *	Output a block of characters with OPOST processing.
546  *	Returns the number of characters output.
547  *
548  *	This path is used to speed up block console writes, among other
549  *	things when processing blocks of output data. It handles only
550  *	the simple cases normally found and helps to generate blocks of
551  *	symbols for the console driver and thus improve performance.
552  *
553  *	Locking: output_lock to protect column state and space left
554  *		 (also, this is called from n_tty_write under the
555  *		  tty layer write lock)
556  */
557 
558 static ssize_t process_output_block(struct tty_struct *tty,
559 				    const unsigned char *buf, unsigned int nr)
560 {
561 	struct n_tty_data *ldata = tty->disc_data;
562 	int	space;
563 	int	i;
564 	const unsigned char *cp;
565 
566 	mutex_lock(&ldata->output_lock);
567 
568 	space = tty_write_room(tty);
569 	if (!space) {
570 		mutex_unlock(&ldata->output_lock);
571 		return 0;
572 	}
573 	if (nr > space)
574 		nr = space;
575 
576 	for (i = 0, cp = buf; i < nr; i++, cp++) {
577 		unsigned char c = *cp;
578 
579 		switch (c) {
580 		case '\n':
581 			if (O_ONLRET(tty))
582 				ldata->column = 0;
583 			if (O_ONLCR(tty))
584 				goto break_out;
585 			ldata->canon_column = ldata->column;
586 			break;
587 		case '\r':
588 			if (O_ONOCR(tty) && ldata->column == 0)
589 				goto break_out;
590 			if (O_OCRNL(tty))
591 				goto break_out;
592 			ldata->canon_column = ldata->column = 0;
593 			break;
594 		case '\t':
595 			goto break_out;
596 		case '\b':
597 			if (ldata->column > 0)
598 				ldata->column--;
599 			break;
600 		default:
601 			if (!iscntrl(c)) {
602 				if (O_OLCUC(tty))
603 					goto break_out;
604 				if (!is_continuation(c, tty))
605 					ldata->column++;
606 			}
607 			break;
608 		}
609 	}
610 break_out:
611 	i = tty->ops->write(tty, buf, i);
612 
613 	mutex_unlock(&ldata->output_lock);
614 	return i;
615 }
616 
617 /**
618  *	process_echoes	-	write pending echo characters
619  *	@tty: terminal device
620  *
621  *	Write previously buffered echo (and other ldisc-generated)
622  *	characters to the tty.
623  *
624  *	Characters generated by the ldisc (including echoes) need to
625  *	be buffered because the driver's write buffer can fill during
626  *	heavy program output.  Echoing straight to the driver will
627  *	often fail under these conditions, causing lost characters and
628  *	resulting mismatches of ldisc state information.
629  *
630  *	Since the ldisc state must represent the characters actually sent
631  *	to the driver at the time of the write, operations like certain
632  *	changes in column state are also saved in the buffer and executed
633  *	here.
634  *
635  *	A circular fifo buffer is used so that the most recent characters
636  *	are prioritized.  Also, when control characters are echoed with a
637  *	prefixed "^", the pair is treated atomically and thus not separated.
638  *
639  *	Locking: callers must hold output_lock
640  */
641 
642 static size_t __process_echoes(struct tty_struct *tty)
643 {
644 	struct n_tty_data *ldata = tty->disc_data;
645 	int	space, old_space;
646 	size_t tail;
647 	unsigned char c;
648 
649 	old_space = space = tty_write_room(tty);
650 
651 	tail = ldata->echo_tail;
652 	while (ldata->echo_commit != tail) {
653 		c = echo_buf(ldata, tail);
654 		if (c == ECHO_OP_START) {
655 			unsigned char op;
656 			int no_space_left = 0;
657 
658 			/*
659 			 * If the buffer byte is the start of a multi-byte
660 			 * operation, get the next byte, which is either the
661 			 * op code or a control character value.
662 			 */
663 			op = echo_buf(ldata, tail + 1);
664 
665 			switch (op) {
666 				unsigned int num_chars, num_bs;
667 
668 			case ECHO_OP_ERASE_TAB:
669 				num_chars = echo_buf(ldata, tail + 2);
670 
671 				/*
672 				 * Determine how many columns to go back
673 				 * in order to erase the tab.
674 				 * This depends on the number of columns
675 				 * used by other characters within the tab
676 				 * area.  If this (modulo 8) count is from
677 				 * the start of input rather than from a
678 				 * previous tab, we offset by canon column.
679 				 * Otherwise, tab spacing is normal.
680 				 */
681 				if (!(num_chars & 0x80))
682 					num_chars += ldata->canon_column;
683 				num_bs = 8 - (num_chars & 7);
684 
685 				if (num_bs > space) {
686 					no_space_left = 1;
687 					break;
688 				}
689 				space -= num_bs;
690 				while (num_bs--) {
691 					tty_put_char(tty, '\b');
692 					if (ldata->column > 0)
693 						ldata->column--;
694 				}
695 				tail += 3;
696 				break;
697 
698 			case ECHO_OP_SET_CANON_COL:
699 				ldata->canon_column = ldata->column;
700 				tail += 2;
701 				break;
702 
703 			case ECHO_OP_MOVE_BACK_COL:
704 				if (ldata->column > 0)
705 					ldata->column--;
706 				tail += 2;
707 				break;
708 
709 			case ECHO_OP_START:
710 				/* This is an escaped echo op start code */
711 				if (!space) {
712 					no_space_left = 1;
713 					break;
714 				}
715 				tty_put_char(tty, ECHO_OP_START);
716 				ldata->column++;
717 				space--;
718 				tail += 2;
719 				break;
720 
721 			default:
722 				/*
723 				 * If the op is not a special byte code,
724 				 * it is a ctrl char tagged to be echoed
725 				 * as "^X" (where X is the letter
726 				 * representing the control char).
727 				 * Note that we must ensure there is
728 				 * enough space for the whole ctrl pair.
729 				 *
730 				 */
731 				if (space < 2) {
732 					no_space_left = 1;
733 					break;
734 				}
735 				tty_put_char(tty, '^');
736 				tty_put_char(tty, op ^ 0100);
737 				ldata->column += 2;
738 				space -= 2;
739 				tail += 2;
740 			}
741 
742 			if (no_space_left)
743 				break;
744 		} else {
745 			if (O_OPOST(tty)) {
746 				int retval = do_output_char(c, tty, space);
747 				if (retval < 0)
748 					break;
749 				space -= retval;
750 			} else {
751 				if (!space)
752 					break;
753 				tty_put_char(tty, c);
754 				space -= 1;
755 			}
756 			tail += 1;
757 		}
758 	}
759 
760 	/* If the echo buffer is nearly full (so that the possibility exists
761 	 * of echo overrun before the next commit), then discard enough
762 	 * data at the tail to prevent a subsequent overrun */
763 	while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
764 		if (echo_buf(ldata, tail) == ECHO_OP_START) {
765 			if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB)
766 				tail += 3;
767 			else
768 				tail += 2;
769 		} else
770 			tail++;
771 	}
772 
773 	ldata->echo_tail = tail;
774 	return old_space - space;
775 }
776 
777 static void commit_echoes(struct tty_struct *tty)
778 {
779 	struct n_tty_data *ldata = tty->disc_data;
780 	size_t nr, old, echoed;
781 	size_t head;
782 
783 	head = ldata->echo_head;
784 	ldata->echo_mark = head;
785 	old = ldata->echo_commit - ldata->echo_tail;
786 
787 	/* Process committed echoes if the accumulated # of bytes
788 	 * is over the threshold (and try again each time another
789 	 * block is accumulated) */
790 	nr = head - ldata->echo_tail;
791 	if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK))
792 		return;
793 
794 	mutex_lock(&ldata->output_lock);
795 	ldata->echo_commit = head;
796 	echoed = __process_echoes(tty);
797 	mutex_unlock(&ldata->output_lock);
798 
799 	if (echoed && tty->ops->flush_chars)
800 		tty->ops->flush_chars(tty);
801 }
802 
803 static void process_echoes(struct tty_struct *tty)
804 {
805 	struct n_tty_data *ldata = tty->disc_data;
806 	size_t echoed;
807 
808 	if (ldata->echo_mark == ldata->echo_tail)
809 		return;
810 
811 	mutex_lock(&ldata->output_lock);
812 	ldata->echo_commit = ldata->echo_mark;
813 	echoed = __process_echoes(tty);
814 	mutex_unlock(&ldata->output_lock);
815 
816 	if (echoed && tty->ops->flush_chars)
817 		tty->ops->flush_chars(tty);
818 }
819 
820 /* NB: echo_mark and echo_head should be equivalent here */
821 static void flush_echoes(struct tty_struct *tty)
822 {
823 	struct n_tty_data *ldata = tty->disc_data;
824 
825 	if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
826 	    ldata->echo_commit == ldata->echo_head)
827 		return;
828 
829 	mutex_lock(&ldata->output_lock);
830 	ldata->echo_commit = ldata->echo_head;
831 	__process_echoes(tty);
832 	mutex_unlock(&ldata->output_lock);
833 }
834 
835 /**
836  *	add_echo_byte	-	add a byte to the echo buffer
837  *	@c: unicode byte to echo
838  *	@ldata: n_tty data
839  *
840  *	Add a character or operation byte to the echo buffer.
841  */
842 
843 static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
844 {
845 	*echo_buf_addr(ldata, ldata->echo_head++) = c;
846 }
847 
848 /**
849  *	echo_move_back_col	-	add operation to move back a column
850  *	@ldata: n_tty data
851  *
852  *	Add an operation to the echo buffer to move back one column.
853  */
854 
855 static void echo_move_back_col(struct n_tty_data *ldata)
856 {
857 	add_echo_byte(ECHO_OP_START, ldata);
858 	add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
859 }
860 
861 /**
862  *	echo_set_canon_col	-	add operation to set the canon column
863  *	@ldata: n_tty data
864  *
865  *	Add an operation to the echo buffer to set the canon column
866  *	to the current column.
867  */
868 
869 static void echo_set_canon_col(struct n_tty_data *ldata)
870 {
871 	add_echo_byte(ECHO_OP_START, ldata);
872 	add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
873 }
874 
875 /**
876  *	echo_erase_tab	-	add operation to erase a tab
877  *	@num_chars: number of character columns already used
878  *	@after_tab: true if num_chars starts after a previous tab
879  *	@ldata: n_tty data
880  *
881  *	Add an operation to the echo buffer to erase a tab.
882  *
883  *	Called by the eraser function, which knows how many character
884  *	columns have been used since either a previous tab or the start
885  *	of input.  This information will be used later, along with
886  *	canon column (if applicable), to go back the correct number
887  *	of columns.
888  */
889 
890 static void echo_erase_tab(unsigned int num_chars, int after_tab,
891 			   struct n_tty_data *ldata)
892 {
893 	add_echo_byte(ECHO_OP_START, ldata);
894 	add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
895 
896 	/* We only need to know this modulo 8 (tab spacing) */
897 	num_chars &= 7;
898 
899 	/* Set the high bit as a flag if num_chars is after a previous tab */
900 	if (after_tab)
901 		num_chars |= 0x80;
902 
903 	add_echo_byte(num_chars, ldata);
904 }
905 
906 /**
907  *	echo_char_raw	-	echo a character raw
908  *	@c: unicode byte to echo
909  *	@tty: terminal device
910  *
911  *	Echo user input back onto the screen. This must be called only when
912  *	L_ECHO(tty) is true. Called from the driver receive_buf path.
913  *
914  *	This variant does not treat control characters specially.
915  */
916 
917 static void echo_char_raw(unsigned char c, struct n_tty_data *ldata)
918 {
919 	if (c == ECHO_OP_START) {
920 		add_echo_byte(ECHO_OP_START, ldata);
921 		add_echo_byte(ECHO_OP_START, ldata);
922 	} else {
923 		add_echo_byte(c, ldata);
924 	}
925 }
926 
927 /**
928  *	echo_char	-	echo a character
929  *	@c: unicode byte to echo
930  *	@tty: terminal device
931  *
932  *	Echo user input back onto the screen. This must be called only when
933  *	L_ECHO(tty) is true. Called from the driver receive_buf path.
934  *
935  *	This variant tags control characters to be echoed as "^X"
936  *	(where X is the letter representing the control char).
937  */
938 
939 static void echo_char(unsigned char c, struct tty_struct *tty)
940 {
941 	struct n_tty_data *ldata = tty->disc_data;
942 
943 	if (c == ECHO_OP_START) {
944 		add_echo_byte(ECHO_OP_START, ldata);
945 		add_echo_byte(ECHO_OP_START, ldata);
946 	} else {
947 		if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
948 			add_echo_byte(ECHO_OP_START, ldata);
949 		add_echo_byte(c, ldata);
950 	}
951 }
952 
953 /**
954  *	finish_erasing		-	complete erase
955  *	@ldata: n_tty data
956  */
957 
958 static inline void finish_erasing(struct n_tty_data *ldata)
959 {
960 	if (ldata->erasing) {
961 		echo_char_raw('/', ldata);
962 		ldata->erasing = 0;
963 	}
964 }
965 
966 /**
967  *	eraser		-	handle erase function
968  *	@c: character input
969  *	@tty: terminal device
970  *
971  *	Perform erase and necessary output when an erase character is
972  *	present in the stream from the driver layer. Handles the complexities
973  *	of UTF-8 multibyte symbols.
974  *
975  *	n_tty_receive_buf()/producer path:
976  *		caller holds non-exclusive termios_rwsem
977  */
978 
979 static void eraser(unsigned char c, struct tty_struct *tty)
980 {
981 	struct n_tty_data *ldata = tty->disc_data;
982 	enum { ERASE, WERASE, KILL } kill_type;
983 	size_t head;
984 	size_t cnt;
985 	int seen_alnums;
986 
987 	if (ldata->read_head == ldata->canon_head) {
988 		/* process_output('\a', tty); */ /* what do you think? */
989 		return;
990 	}
991 	if (c == ERASE_CHAR(tty))
992 		kill_type = ERASE;
993 	else if (c == WERASE_CHAR(tty))
994 		kill_type = WERASE;
995 	else {
996 		if (!L_ECHO(tty)) {
997 			ldata->read_head = ldata->canon_head;
998 			return;
999 		}
1000 		if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
1001 			ldata->read_head = ldata->canon_head;
1002 			finish_erasing(ldata);
1003 			echo_char(KILL_CHAR(tty), tty);
1004 			/* Add a newline if ECHOK is on and ECHOKE is off. */
1005 			if (L_ECHOK(tty))
1006 				echo_char_raw('\n', ldata);
1007 			return;
1008 		}
1009 		kill_type = KILL;
1010 	}
1011 
1012 	seen_alnums = 0;
1013 	while (ldata->read_head != ldata->canon_head) {
1014 		head = ldata->read_head;
1015 
1016 		/* erase a single possibly multibyte character */
1017 		do {
1018 			head--;
1019 			c = read_buf(ldata, head);
1020 		} while (is_continuation(c, tty) && head != ldata->canon_head);
1021 
1022 		/* do not partially erase */
1023 		if (is_continuation(c, tty))
1024 			break;
1025 
1026 		if (kill_type == WERASE) {
1027 			/* Equivalent to BSD's ALTWERASE. */
1028 			if (isalnum(c) || c == '_')
1029 				seen_alnums++;
1030 			else if (seen_alnums)
1031 				break;
1032 		}
1033 		cnt = ldata->read_head - head;
1034 		ldata->read_head = head;
1035 		if (L_ECHO(tty)) {
1036 			if (L_ECHOPRT(tty)) {
1037 				if (!ldata->erasing) {
1038 					echo_char_raw('\\', ldata);
1039 					ldata->erasing = 1;
1040 				}
1041 				/* if cnt > 1, output a multi-byte character */
1042 				echo_char(c, tty);
1043 				while (--cnt > 0) {
1044 					head++;
1045 					echo_char_raw(read_buf(ldata, head), ldata);
1046 					echo_move_back_col(ldata);
1047 				}
1048 			} else if (kill_type == ERASE && !L_ECHOE(tty)) {
1049 				echo_char(ERASE_CHAR(tty), tty);
1050 			} else if (c == '\t') {
1051 				unsigned int num_chars = 0;
1052 				int after_tab = 0;
1053 				size_t tail = ldata->read_head;
1054 
1055 				/*
1056 				 * Count the columns used for characters
1057 				 * since the start of input or after a
1058 				 * previous tab.
1059 				 * This info is used to go back the correct
1060 				 * number of columns.
1061 				 */
1062 				while (tail != ldata->canon_head) {
1063 					tail--;
1064 					c = read_buf(ldata, tail);
1065 					if (c == '\t') {
1066 						after_tab = 1;
1067 						break;
1068 					} else if (iscntrl(c)) {
1069 						if (L_ECHOCTL(tty))
1070 							num_chars += 2;
1071 					} else if (!is_continuation(c, tty)) {
1072 						num_chars++;
1073 					}
1074 				}
1075 				echo_erase_tab(num_chars, after_tab, ldata);
1076 			} else {
1077 				if (iscntrl(c) && L_ECHOCTL(tty)) {
1078 					echo_char_raw('\b', ldata);
1079 					echo_char_raw(' ', ldata);
1080 					echo_char_raw('\b', ldata);
1081 				}
1082 				if (!iscntrl(c) || L_ECHOCTL(tty)) {
1083 					echo_char_raw('\b', ldata);
1084 					echo_char_raw(' ', ldata);
1085 					echo_char_raw('\b', ldata);
1086 				}
1087 			}
1088 		}
1089 		if (kill_type == ERASE)
1090 			break;
1091 	}
1092 	if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
1093 		finish_erasing(ldata);
1094 }
1095 
1096 /**
1097  *	isig		-	handle the ISIG optio
1098  *	@sig: signal
1099  *	@tty: terminal
1100  *
1101  *	Called when a signal is being sent due to terminal input.
1102  *	Called from the driver receive_buf path so serialized.
1103  *
1104  *	Performs input and output flush if !NOFLSH. In this context, the echo
1105  *	buffer is 'output'. The signal is processed first to alert any current
1106  *	readers or writers to discontinue and exit their i/o loops.
1107  *
1108  *	Locking: ctrl_lock
1109  */
1110 
1111 static void __isig(int sig, struct tty_struct *tty)
1112 {
1113 	struct pid *tty_pgrp = tty_get_pgrp(tty);
1114 	if (tty_pgrp) {
1115 		kill_pgrp(tty_pgrp, sig, 1);
1116 		put_pid(tty_pgrp);
1117 	}
1118 }
1119 
1120 static void isig(int sig, struct tty_struct *tty)
1121 {
1122 	struct n_tty_data *ldata = tty->disc_data;
1123 
1124 	if (L_NOFLSH(tty)) {
1125 		/* signal only */
1126 		__isig(sig, tty);
1127 
1128 	} else { /* signal and flush */
1129 		up_read(&tty->termios_rwsem);
1130 		down_write(&tty->termios_rwsem);
1131 
1132 		__isig(sig, tty);
1133 
1134 		/* clear echo buffer */
1135 		mutex_lock(&ldata->output_lock);
1136 		ldata->echo_head = ldata->echo_tail = 0;
1137 		ldata->echo_mark = ldata->echo_commit = 0;
1138 		mutex_unlock(&ldata->output_lock);
1139 
1140 		/* clear output buffer */
1141 		tty_driver_flush_buffer(tty);
1142 
1143 		/* clear input buffer */
1144 		reset_buffer_flags(tty->disc_data);
1145 
1146 		/* notify pty master of flush */
1147 		if (tty->link)
1148 			n_tty_packet_mode_flush(tty);
1149 
1150 		up_write(&tty->termios_rwsem);
1151 		down_read(&tty->termios_rwsem);
1152 	}
1153 }
1154 
1155 /**
1156  *	n_tty_receive_break	-	handle break
1157  *	@tty: terminal
1158  *
1159  *	An RS232 break event has been hit in the incoming bitstream. This
1160  *	can cause a variety of events depending upon the termios settings.
1161  *
1162  *	n_tty_receive_buf()/producer path:
1163  *		caller holds non-exclusive termios_rwsem
1164  *
1165  *	Note: may get exclusive termios_rwsem if flushing input buffer
1166  */
1167 
1168 static void n_tty_receive_break(struct tty_struct *tty)
1169 {
1170 	struct n_tty_data *ldata = tty->disc_data;
1171 
1172 	if (I_IGNBRK(tty))
1173 		return;
1174 	if (I_BRKINT(tty)) {
1175 		isig(SIGINT, tty);
1176 		return;
1177 	}
1178 	if (I_PARMRK(tty)) {
1179 		put_tty_queue('\377', ldata);
1180 		put_tty_queue('\0', ldata);
1181 	}
1182 	put_tty_queue('\0', ldata);
1183 	if (waitqueue_active(&tty->read_wait))
1184 		wake_up_interruptible_poll(&tty->read_wait, POLLIN);
1185 }
1186 
1187 /**
1188  *	n_tty_receive_overrun	-	handle overrun reporting
1189  *	@tty: terminal
1190  *
1191  *	Data arrived faster than we could process it. While the tty
1192  *	driver has flagged this the bits that were missed are gone
1193  *	forever.
1194  *
1195  *	Called from the receive_buf path so single threaded. Does not
1196  *	need locking as num_overrun and overrun_time are function
1197  *	private.
1198  */
1199 
1200 static void n_tty_receive_overrun(struct tty_struct *tty)
1201 {
1202 	struct n_tty_data *ldata = tty->disc_data;
1203 
1204 	ldata->num_overrun++;
1205 	if (time_after(jiffies, ldata->overrun_time + HZ) ||
1206 			time_after(ldata->overrun_time, jiffies)) {
1207 		printk(KERN_WARNING "%s: %d input overrun(s)\n",
1208 			tty_name(tty),
1209 			ldata->num_overrun);
1210 		ldata->overrun_time = jiffies;
1211 		ldata->num_overrun = 0;
1212 	}
1213 }
1214 
1215 /**
1216  *	n_tty_receive_parity_error	-	error notifier
1217  *	@tty: terminal device
1218  *	@c: character
1219  *
1220  *	Process a parity error and queue the right data to indicate
1221  *	the error case if necessary.
1222  *
1223  *	n_tty_receive_buf()/producer path:
1224  *		caller holds non-exclusive termios_rwsem
1225  */
1226 static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c)
1227 {
1228 	struct n_tty_data *ldata = tty->disc_data;
1229 
1230 	if (I_INPCK(tty)) {
1231 		if (I_IGNPAR(tty))
1232 			return;
1233 		if (I_PARMRK(tty)) {
1234 			put_tty_queue('\377', ldata);
1235 			put_tty_queue('\0', ldata);
1236 			put_tty_queue(c, ldata);
1237 		} else
1238 			put_tty_queue('\0', ldata);
1239 	} else
1240 		put_tty_queue(c, ldata);
1241 	if (waitqueue_active(&tty->read_wait))
1242 		wake_up_interruptible_poll(&tty->read_wait, POLLIN);
1243 }
1244 
1245 static void
1246 n_tty_receive_signal_char(struct tty_struct *tty, int signal, unsigned char c)
1247 {
1248 	isig(signal, tty);
1249 	if (I_IXON(tty))
1250 		start_tty(tty);
1251 	if (L_ECHO(tty)) {
1252 		echo_char(c, tty);
1253 		commit_echoes(tty);
1254 	} else
1255 		process_echoes(tty);
1256 	return;
1257 }
1258 
1259 /**
1260  *	n_tty_receive_char	-	perform processing
1261  *	@tty: terminal device
1262  *	@c: character
1263  *
1264  *	Process an individual character of input received from the driver.
1265  *	This is serialized with respect to itself by the rules for the
1266  *	driver above.
1267  *
1268  *	n_tty_receive_buf()/producer path:
1269  *		caller holds non-exclusive termios_rwsem
1270  *		publishes canon_head if canonical mode is active
1271  *
1272  *	Returns 1 if LNEXT was received, else returns 0
1273  */
1274 
1275 static int
1276 n_tty_receive_char_special(struct tty_struct *tty, unsigned char c)
1277 {
1278 	struct n_tty_data *ldata = tty->disc_data;
1279 
1280 	if (I_IXON(tty)) {
1281 		if (c == START_CHAR(tty)) {
1282 			start_tty(tty);
1283 			process_echoes(tty);
1284 			return 0;
1285 		}
1286 		if (c == STOP_CHAR(tty)) {
1287 			stop_tty(tty);
1288 			return 0;
1289 		}
1290 	}
1291 
1292 	if (L_ISIG(tty)) {
1293 		if (c == INTR_CHAR(tty)) {
1294 			n_tty_receive_signal_char(tty, SIGINT, c);
1295 			return 0;
1296 		} else if (c == QUIT_CHAR(tty)) {
1297 			n_tty_receive_signal_char(tty, SIGQUIT, c);
1298 			return 0;
1299 		} else if (c == SUSP_CHAR(tty)) {
1300 			n_tty_receive_signal_char(tty, SIGTSTP, c);
1301 			return 0;
1302 		}
1303 	}
1304 
1305 	if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1306 		start_tty(tty);
1307 		process_echoes(tty);
1308 	}
1309 
1310 	if (c == '\r') {
1311 		if (I_IGNCR(tty))
1312 			return 0;
1313 		if (I_ICRNL(tty))
1314 			c = '\n';
1315 	} else if (c == '\n' && I_INLCR(tty))
1316 		c = '\r';
1317 
1318 	if (ldata->icanon) {
1319 		if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
1320 		    (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
1321 			eraser(c, tty);
1322 			commit_echoes(tty);
1323 			return 0;
1324 		}
1325 		if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
1326 			ldata->lnext = 1;
1327 			if (L_ECHO(tty)) {
1328 				finish_erasing(ldata);
1329 				if (L_ECHOCTL(tty)) {
1330 					echo_char_raw('^', ldata);
1331 					echo_char_raw('\b', ldata);
1332 					commit_echoes(tty);
1333 				}
1334 			}
1335 			return 1;
1336 		}
1337 		if (c == REPRINT_CHAR(tty) && L_ECHO(tty) && L_IEXTEN(tty)) {
1338 			size_t tail = ldata->canon_head;
1339 
1340 			finish_erasing(ldata);
1341 			echo_char(c, tty);
1342 			echo_char_raw('\n', ldata);
1343 			while (tail != ldata->read_head) {
1344 				echo_char(read_buf(ldata, tail), tty);
1345 				tail++;
1346 			}
1347 			commit_echoes(tty);
1348 			return 0;
1349 		}
1350 		if (c == '\n') {
1351 			if (L_ECHO(tty) || L_ECHONL(tty)) {
1352 				echo_char_raw('\n', ldata);
1353 				commit_echoes(tty);
1354 			}
1355 			goto handle_newline;
1356 		}
1357 		if (c == EOF_CHAR(tty)) {
1358 			c = __DISABLED_CHAR;
1359 			goto handle_newline;
1360 		}
1361 		if ((c == EOL_CHAR(tty)) ||
1362 		    (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
1363 			/*
1364 			 * XXX are EOL_CHAR and EOL2_CHAR echoed?!?
1365 			 */
1366 			if (L_ECHO(tty)) {
1367 				/* Record the column of first canon char. */
1368 				if (ldata->canon_head == ldata->read_head)
1369 					echo_set_canon_col(ldata);
1370 				echo_char(c, tty);
1371 				commit_echoes(tty);
1372 			}
1373 			/*
1374 			 * XXX does PARMRK doubling happen for
1375 			 * EOL_CHAR and EOL2_CHAR?
1376 			 */
1377 			if (c == (unsigned char) '\377' && I_PARMRK(tty))
1378 				put_tty_queue(c, ldata);
1379 
1380 handle_newline:
1381 			set_bit(ldata->read_head & (N_TTY_BUF_SIZE - 1), ldata->read_flags);
1382 			put_tty_queue(c, ldata);
1383 			smp_store_release(&ldata->canon_head, ldata->read_head);
1384 			kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1385 			if (waitqueue_active(&tty->read_wait))
1386 				wake_up_interruptible_poll(&tty->read_wait, POLLIN);
1387 			return 0;
1388 		}
1389 	}
1390 
1391 	if (L_ECHO(tty)) {
1392 		finish_erasing(ldata);
1393 		if (c == '\n')
1394 			echo_char_raw('\n', ldata);
1395 		else {
1396 			/* Record the column of first canon char. */
1397 			if (ldata->canon_head == ldata->read_head)
1398 				echo_set_canon_col(ldata);
1399 			echo_char(c, tty);
1400 		}
1401 		commit_echoes(tty);
1402 	}
1403 
1404 	/* PARMRK doubling check */
1405 	if (c == (unsigned char) '\377' && I_PARMRK(tty))
1406 		put_tty_queue(c, ldata);
1407 
1408 	put_tty_queue(c, ldata);
1409 	return 0;
1410 }
1411 
1412 static inline void
1413 n_tty_receive_char_inline(struct tty_struct *tty, unsigned char c)
1414 {
1415 	struct n_tty_data *ldata = tty->disc_data;
1416 
1417 	if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1418 		start_tty(tty);
1419 		process_echoes(tty);
1420 	}
1421 	if (L_ECHO(tty)) {
1422 		finish_erasing(ldata);
1423 		/* Record the column of first canon char. */
1424 		if (ldata->canon_head == ldata->read_head)
1425 			echo_set_canon_col(ldata);
1426 		echo_char(c, tty);
1427 		commit_echoes(tty);
1428 	}
1429 	/* PARMRK doubling check */
1430 	if (c == (unsigned char) '\377' && I_PARMRK(tty))
1431 		put_tty_queue(c, ldata);
1432 	put_tty_queue(c, ldata);
1433 }
1434 
1435 static void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
1436 {
1437 	n_tty_receive_char_inline(tty, c);
1438 }
1439 
1440 static inline void
1441 n_tty_receive_char_fast(struct tty_struct *tty, unsigned char c)
1442 {
1443 	struct n_tty_data *ldata = tty->disc_data;
1444 
1445 	if (tty->stopped && !tty->flow_stopped && I_IXON(tty) && I_IXANY(tty)) {
1446 		start_tty(tty);
1447 		process_echoes(tty);
1448 	}
1449 	if (L_ECHO(tty)) {
1450 		finish_erasing(ldata);
1451 		/* Record the column of first canon char. */
1452 		if (ldata->canon_head == ldata->read_head)
1453 			echo_set_canon_col(ldata);
1454 		echo_char(c, tty);
1455 		commit_echoes(tty);
1456 	}
1457 	put_tty_queue(c, ldata);
1458 }
1459 
1460 static void n_tty_receive_char_closing(struct tty_struct *tty, unsigned char c)
1461 {
1462 	if (I_ISTRIP(tty))
1463 		c &= 0x7f;
1464 	if (I_IUCLC(tty) && L_IEXTEN(tty))
1465 		c = tolower(c);
1466 
1467 	if (I_IXON(tty)) {
1468 		if (c == STOP_CHAR(tty))
1469 			stop_tty(tty);
1470 		else if (c == START_CHAR(tty) ||
1471 			 (tty->stopped && !tty->flow_stopped && I_IXANY(tty) &&
1472 			  c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) &&
1473 			  c != SUSP_CHAR(tty))) {
1474 			start_tty(tty);
1475 			process_echoes(tty);
1476 		}
1477 	}
1478 }
1479 
1480 static void
1481 n_tty_receive_char_flagged(struct tty_struct *tty, unsigned char c, char flag)
1482 {
1483 	switch (flag) {
1484 	case TTY_BREAK:
1485 		n_tty_receive_break(tty);
1486 		break;
1487 	case TTY_PARITY:
1488 	case TTY_FRAME:
1489 		n_tty_receive_parity_error(tty, c);
1490 		break;
1491 	case TTY_OVERRUN:
1492 		n_tty_receive_overrun(tty);
1493 		break;
1494 	default:
1495 		printk(KERN_ERR "%s: unknown flag %d\n",
1496 		       tty_name(tty), flag);
1497 		break;
1498 	}
1499 }
1500 
1501 static void
1502 n_tty_receive_char_lnext(struct tty_struct *tty, unsigned char c, char flag)
1503 {
1504 	struct n_tty_data *ldata = tty->disc_data;
1505 
1506 	ldata->lnext = 0;
1507 	if (likely(flag == TTY_NORMAL)) {
1508 		if (I_ISTRIP(tty))
1509 			c &= 0x7f;
1510 		if (I_IUCLC(tty) && L_IEXTEN(tty))
1511 			c = tolower(c);
1512 		n_tty_receive_char(tty, c);
1513 	} else
1514 		n_tty_receive_char_flagged(tty, c, flag);
1515 }
1516 
1517 static void
1518 n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
1519 			   char *fp, int count)
1520 {
1521 	struct n_tty_data *ldata = tty->disc_data;
1522 	size_t n, head;
1523 
1524 	head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1525 	n = min_t(size_t, count, N_TTY_BUF_SIZE - head);
1526 	memcpy(read_buf_addr(ldata, head), cp, n);
1527 	ldata->read_head += n;
1528 	cp += n;
1529 	count -= n;
1530 
1531 	head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1532 	n = min_t(size_t, count, N_TTY_BUF_SIZE - head);
1533 	memcpy(read_buf_addr(ldata, head), cp, n);
1534 	ldata->read_head += n;
1535 }
1536 
1537 static void
1538 n_tty_receive_buf_raw(struct tty_struct *tty, const unsigned char *cp,
1539 		      char *fp, int count)
1540 {
1541 	struct n_tty_data *ldata = tty->disc_data;
1542 	char flag = TTY_NORMAL;
1543 
1544 	while (count--) {
1545 		if (fp)
1546 			flag = *fp++;
1547 		if (likely(flag == TTY_NORMAL))
1548 			put_tty_queue(*cp++, ldata);
1549 		else
1550 			n_tty_receive_char_flagged(tty, *cp++, flag);
1551 	}
1552 }
1553 
1554 static void
1555 n_tty_receive_buf_closing(struct tty_struct *tty, const unsigned char *cp,
1556 			  char *fp, int count)
1557 {
1558 	char flag = TTY_NORMAL;
1559 
1560 	while (count--) {
1561 		if (fp)
1562 			flag = *fp++;
1563 		if (likely(flag == TTY_NORMAL))
1564 			n_tty_receive_char_closing(tty, *cp++);
1565 		else
1566 			n_tty_receive_char_flagged(tty, *cp++, flag);
1567 	}
1568 }
1569 
1570 static void
1571 n_tty_receive_buf_standard(struct tty_struct *tty, const unsigned char *cp,
1572 			  char *fp, int count)
1573 {
1574 	struct n_tty_data *ldata = tty->disc_data;
1575 	char flag = TTY_NORMAL;
1576 
1577 	while (count--) {
1578 		if (fp)
1579 			flag = *fp++;
1580 		if (likely(flag == TTY_NORMAL)) {
1581 			unsigned char c = *cp++;
1582 
1583 			if (I_ISTRIP(tty))
1584 				c &= 0x7f;
1585 			if (I_IUCLC(tty) && L_IEXTEN(tty))
1586 				c = tolower(c);
1587 			if (L_EXTPROC(tty)) {
1588 				put_tty_queue(c, ldata);
1589 				continue;
1590 			}
1591 			if (!test_bit(c, ldata->char_map))
1592 				n_tty_receive_char_inline(tty, c);
1593 			else if (n_tty_receive_char_special(tty, c) && count) {
1594 				if (fp)
1595 					flag = *fp++;
1596 				n_tty_receive_char_lnext(tty, *cp++, flag);
1597 				count--;
1598 			}
1599 		} else
1600 			n_tty_receive_char_flagged(tty, *cp++, flag);
1601 	}
1602 }
1603 
1604 static void
1605 n_tty_receive_buf_fast(struct tty_struct *tty, const unsigned char *cp,
1606 		       char *fp, int count)
1607 {
1608 	struct n_tty_data *ldata = tty->disc_data;
1609 	char flag = TTY_NORMAL;
1610 
1611 	while (count--) {
1612 		if (fp)
1613 			flag = *fp++;
1614 		if (likely(flag == TTY_NORMAL)) {
1615 			unsigned char c = *cp++;
1616 
1617 			if (!test_bit(c, ldata->char_map))
1618 				n_tty_receive_char_fast(tty, c);
1619 			else if (n_tty_receive_char_special(tty, c) && count) {
1620 				if (fp)
1621 					flag = *fp++;
1622 				n_tty_receive_char_lnext(tty, *cp++, flag);
1623 				count--;
1624 			}
1625 		} else
1626 			n_tty_receive_char_flagged(tty, *cp++, flag);
1627 	}
1628 }
1629 
1630 static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
1631 			  char *fp, int count)
1632 {
1633 	struct n_tty_data *ldata = tty->disc_data;
1634 	bool preops = I_ISTRIP(tty) || (I_IUCLC(tty) && L_IEXTEN(tty));
1635 
1636 	if (ldata->real_raw)
1637 		n_tty_receive_buf_real_raw(tty, cp, fp, count);
1638 	else if (ldata->raw || (L_EXTPROC(tty) && !preops))
1639 		n_tty_receive_buf_raw(tty, cp, fp, count);
1640 	else if (tty->closing && !L_EXTPROC(tty))
1641 		n_tty_receive_buf_closing(tty, cp, fp, count);
1642 	else {
1643 		if (ldata->lnext) {
1644 			char flag = TTY_NORMAL;
1645 
1646 			if (fp)
1647 				flag = *fp++;
1648 			n_tty_receive_char_lnext(tty, *cp++, flag);
1649 			count--;
1650 		}
1651 
1652 		if (!preops && !I_PARMRK(tty))
1653 			n_tty_receive_buf_fast(tty, cp, fp, count);
1654 		else
1655 			n_tty_receive_buf_standard(tty, cp, fp, count);
1656 
1657 		flush_echoes(tty);
1658 		if (tty->ops->flush_chars)
1659 			tty->ops->flush_chars(tty);
1660 	}
1661 
1662 	if (ldata->icanon && !L_EXTPROC(tty))
1663 		return;
1664 
1665 	/* publish read_head to consumer */
1666 	smp_store_release(&ldata->commit_head, ldata->read_head);
1667 
1668 	if ((read_cnt(ldata) >= ldata->minimum_to_wake) || L_EXTPROC(tty)) {
1669 		kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1670 		if (waitqueue_active(&tty->read_wait))
1671 			wake_up_interruptible_poll(&tty->read_wait, POLLIN);
1672 	}
1673 }
1674 
1675 /**
1676  *	n_tty_receive_buf_common	-	process input
1677  *	@tty: device to receive input
1678  *	@cp: input chars
1679  *	@fp: flags for each char (if NULL, all chars are TTY_NORMAL)
1680  *	@count: number of input chars in @cp
1681  *
1682  *	Called by the terminal driver when a block of characters has
1683  *	been received. This function must be called from soft contexts
1684  *	not from interrupt context. The driver is responsible for making
1685  *	calls one at a time and in order (or using flush_to_ldisc)
1686  *
1687  *	Returns the # of input chars from @cp which were processed.
1688  *
1689  *	In canonical mode, the maximum line length is 4096 chars (including
1690  *	the line termination char); lines longer than 4096 chars are
1691  *	truncated. After 4095 chars, input data is still processed but
1692  *	not stored. Overflow processing ensures the tty can always
1693  *	receive more input until at least one line can be read.
1694  *
1695  *	In non-canonical mode, the read buffer will only accept 4095 chars;
1696  *	this provides the necessary space for a newline char if the input
1697  *	mode is switched to canonical.
1698  *
1699  *	Note it is possible for the read buffer to _contain_ 4096 chars
1700  *	in non-canonical mode: the read buffer could already contain the
1701  *	maximum canon line of 4096 chars when the mode is switched to
1702  *	non-canonical.
1703  *
1704  *	n_tty_receive_buf()/producer path:
1705  *		claims non-exclusive termios_rwsem
1706  *		publishes commit_head or canon_head
1707  */
1708 static int
1709 n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
1710 			 char *fp, int count, int flow)
1711 {
1712 	struct n_tty_data *ldata = tty->disc_data;
1713 	int room, n, rcvd = 0, overflow;
1714 
1715 	down_read(&tty->termios_rwsem);
1716 
1717 	while (1) {
1718 		/*
1719 		 * When PARMRK is set, each input char may take up to 3 chars
1720 		 * in the read buf; reduce the buffer space avail by 3x
1721 		 *
1722 		 * If we are doing input canonicalization, and there are no
1723 		 * pending newlines, let characters through without limit, so
1724 		 * that erase characters will be handled.  Other excess
1725 		 * characters will be beeped.
1726 		 *
1727 		 * paired with store in *_copy_from_read_buf() -- guarantees
1728 		 * the consumer has loaded the data in read_buf up to the new
1729 		 * read_tail (so this producer will not overwrite unread data)
1730 		 */
1731 		size_t tail = smp_load_acquire(&ldata->read_tail);
1732 
1733 		room = N_TTY_BUF_SIZE - (ldata->read_head - tail);
1734 		if (I_PARMRK(tty))
1735 			room = (room + 2) / 3;
1736 		room--;
1737 		if (room <= 0) {
1738 			overflow = ldata->icanon && ldata->canon_head == tail;
1739 			if (overflow && room < 0)
1740 				ldata->read_head--;
1741 			room = overflow;
1742 			ldata->no_room = flow && !room;
1743 		} else
1744 			overflow = 0;
1745 
1746 		n = min(count, room);
1747 		if (!n)
1748 			break;
1749 
1750 		/* ignore parity errors if handling overflow */
1751 		if (!overflow || !fp || *fp != TTY_PARITY)
1752 			__receive_buf(tty, cp, fp, n);
1753 
1754 		cp += n;
1755 		if (fp)
1756 			fp += n;
1757 		count -= n;
1758 		rcvd += n;
1759 	}
1760 
1761 	tty->receive_room = room;
1762 
1763 	/* Unthrottle if handling overflow on pty */
1764 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
1765 		if (overflow) {
1766 			tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
1767 			tty_unthrottle_safe(tty);
1768 			__tty_set_flow_change(tty, 0);
1769 		}
1770 	} else
1771 		n_tty_check_throttle(tty);
1772 
1773 	up_read(&tty->termios_rwsem);
1774 
1775 	return rcvd;
1776 }
1777 
1778 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
1779 			      char *fp, int count)
1780 {
1781 	n_tty_receive_buf_common(tty, cp, fp, count, 0);
1782 }
1783 
1784 static int n_tty_receive_buf2(struct tty_struct *tty, const unsigned char *cp,
1785 			      char *fp, int count)
1786 {
1787 	return n_tty_receive_buf_common(tty, cp, fp, count, 1);
1788 }
1789 
1790 int is_ignored(int sig)
1791 {
1792 	return (sigismember(&current->blocked, sig) ||
1793 		current->sighand->action[sig-1].sa.sa_handler == SIG_IGN);
1794 }
1795 
1796 /**
1797  *	n_tty_set_termios	-	termios data changed
1798  *	@tty: terminal
1799  *	@old: previous data
1800  *
1801  *	Called by the tty layer when the user changes termios flags so
1802  *	that the line discipline can plan ahead. This function cannot sleep
1803  *	and is protected from re-entry by the tty layer. The user is
1804  *	guaranteed that this function will not be re-entered or in progress
1805  *	when the ldisc is closed.
1806  *
1807  *	Locking: Caller holds tty->termios_rwsem
1808  */
1809 
1810 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
1811 {
1812 	struct n_tty_data *ldata = tty->disc_data;
1813 
1814 	if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) {
1815 		bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
1816 		ldata->line_start = ldata->read_tail;
1817 		if (!L_ICANON(tty) || !read_cnt(ldata)) {
1818 			ldata->canon_head = ldata->read_tail;
1819 			ldata->push = 0;
1820 		} else {
1821 			set_bit((ldata->read_head - 1) & (N_TTY_BUF_SIZE - 1),
1822 				ldata->read_flags);
1823 			ldata->canon_head = ldata->read_head;
1824 			ldata->push = 1;
1825 		}
1826 		ldata->commit_head = ldata->read_head;
1827 		ldata->erasing = 0;
1828 		ldata->lnext = 0;
1829 	}
1830 
1831 	ldata->icanon = (L_ICANON(tty) != 0);
1832 
1833 	if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
1834 	    I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
1835 	    I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
1836 	    I_PARMRK(tty)) {
1837 		bitmap_zero(ldata->char_map, 256);
1838 
1839 		if (I_IGNCR(tty) || I_ICRNL(tty))
1840 			set_bit('\r', ldata->char_map);
1841 		if (I_INLCR(tty))
1842 			set_bit('\n', ldata->char_map);
1843 
1844 		if (L_ICANON(tty)) {
1845 			set_bit(ERASE_CHAR(tty), ldata->char_map);
1846 			set_bit(KILL_CHAR(tty), ldata->char_map);
1847 			set_bit(EOF_CHAR(tty), ldata->char_map);
1848 			set_bit('\n', ldata->char_map);
1849 			set_bit(EOL_CHAR(tty), ldata->char_map);
1850 			if (L_IEXTEN(tty)) {
1851 				set_bit(WERASE_CHAR(tty), ldata->char_map);
1852 				set_bit(LNEXT_CHAR(tty), ldata->char_map);
1853 				set_bit(EOL2_CHAR(tty), ldata->char_map);
1854 				if (L_ECHO(tty))
1855 					set_bit(REPRINT_CHAR(tty),
1856 						ldata->char_map);
1857 			}
1858 		}
1859 		if (I_IXON(tty)) {
1860 			set_bit(START_CHAR(tty), ldata->char_map);
1861 			set_bit(STOP_CHAR(tty), ldata->char_map);
1862 		}
1863 		if (L_ISIG(tty)) {
1864 			set_bit(INTR_CHAR(tty), ldata->char_map);
1865 			set_bit(QUIT_CHAR(tty), ldata->char_map);
1866 			set_bit(SUSP_CHAR(tty), ldata->char_map);
1867 		}
1868 		clear_bit(__DISABLED_CHAR, ldata->char_map);
1869 		ldata->raw = 0;
1870 		ldata->real_raw = 0;
1871 	} else {
1872 		ldata->raw = 1;
1873 		if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1874 		    (I_IGNPAR(tty) || !I_INPCK(tty)) &&
1875 		    (tty->driver->flags & TTY_DRIVER_REAL_RAW))
1876 			ldata->real_raw = 1;
1877 		else
1878 			ldata->real_raw = 0;
1879 	}
1880 	/*
1881 	 * Fix tty hang when I_IXON(tty) is cleared, but the tty
1882 	 * been stopped by STOP_CHAR(tty) before it.
1883 	 */
1884 	if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) {
1885 		start_tty(tty);
1886 		process_echoes(tty);
1887 	}
1888 
1889 	/* The termios change make the tty ready for I/O */
1890 	if (waitqueue_active(&tty->write_wait))
1891 		wake_up_interruptible(&tty->write_wait);
1892 	if (waitqueue_active(&tty->read_wait))
1893 		wake_up_interruptible(&tty->read_wait);
1894 }
1895 
1896 /**
1897  *	n_tty_close		-	close the ldisc for this tty
1898  *	@tty: device
1899  *
1900  *	Called from the terminal layer when this line discipline is
1901  *	being shut down, either because of a close or becsuse of a
1902  *	discipline change. The function will not be called while other
1903  *	ldisc methods are in progress.
1904  */
1905 
1906 static void n_tty_close(struct tty_struct *tty)
1907 {
1908 	struct n_tty_data *ldata = tty->disc_data;
1909 
1910 	if (tty->link)
1911 		n_tty_packet_mode_flush(tty);
1912 
1913 	vfree(ldata);
1914 	tty->disc_data = NULL;
1915 }
1916 
1917 /**
1918  *	n_tty_open		-	open an ldisc
1919  *	@tty: terminal to open
1920  *
1921  *	Called when this line discipline is being attached to the
1922  *	terminal device. Can sleep. Called serialized so that no
1923  *	other events will occur in parallel. No further open will occur
1924  *	until a close.
1925  */
1926 
1927 static int n_tty_open(struct tty_struct *tty)
1928 {
1929 	struct n_tty_data *ldata;
1930 
1931 	/* Currently a malloc failure here can panic */
1932 	ldata = vmalloc(sizeof(*ldata));
1933 	if (!ldata)
1934 		goto err;
1935 
1936 	ldata->overrun_time = jiffies;
1937 	mutex_init(&ldata->atomic_read_lock);
1938 	mutex_init(&ldata->output_lock);
1939 
1940 	tty->disc_data = ldata;
1941 	reset_buffer_flags(tty->disc_data);
1942 	ldata->column = 0;
1943 	ldata->canon_column = 0;
1944 	ldata->minimum_to_wake = 1;
1945 	ldata->num_overrun = 0;
1946 	ldata->no_room = 0;
1947 	ldata->lnext = 0;
1948 	tty->closing = 0;
1949 	/* indicate buffer work may resume */
1950 	clear_bit(TTY_LDISC_HALTED, &tty->flags);
1951 	n_tty_set_termios(tty, NULL);
1952 	tty_unthrottle(tty);
1953 
1954 	return 0;
1955 err:
1956 	return -ENOMEM;
1957 }
1958 
1959 static inline int input_available_p(struct tty_struct *tty, int poll)
1960 {
1961 	struct n_tty_data *ldata = tty->disc_data;
1962 	int amt = poll && !TIME_CHAR(tty) && MIN_CHAR(tty) ? MIN_CHAR(tty) : 1;
1963 
1964 	if (ldata->icanon && !L_EXTPROC(tty))
1965 		return ldata->canon_head != ldata->read_tail;
1966 	else
1967 		return ldata->commit_head - ldata->read_tail >= amt;
1968 }
1969 
1970 static inline int check_other_done(struct tty_struct *tty)
1971 {
1972 	int done = test_bit(TTY_OTHER_DONE, &tty->flags);
1973 	if (done) {
1974 		/* paired with cmpxchg() in check_other_closed(); ensures
1975 		 * read buffer head index is not stale
1976 		 */
1977 		smp_mb__after_atomic();
1978 	}
1979 	return done;
1980 }
1981 
1982 /**
1983  *	copy_from_read_buf	-	copy read data directly
1984  *	@tty: terminal device
1985  *	@b: user data
1986  *	@nr: size of data
1987  *
1988  *	Helper function to speed up n_tty_read.  It is only called when
1989  *	ICANON is off; it copies characters straight from the tty queue to
1990  *	user space directly.  It can be profitably called twice; once to
1991  *	drain the space from the tail pointer to the (physical) end of the
1992  *	buffer, and once to drain the space from the (physical) beginning of
1993  *	the buffer to head pointer.
1994  *
1995  *	Called under the ldata->atomic_read_lock sem
1996  *
1997  *	n_tty_read()/consumer path:
1998  *		caller holds non-exclusive termios_rwsem
1999  *		read_tail published
2000  */
2001 
2002 static int copy_from_read_buf(struct tty_struct *tty,
2003 				      unsigned char __user **b,
2004 				      size_t *nr)
2005 
2006 {
2007 	struct n_tty_data *ldata = tty->disc_data;
2008 	int retval;
2009 	size_t n;
2010 	bool is_eof;
2011 	size_t head = smp_load_acquire(&ldata->commit_head);
2012 	size_t tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
2013 
2014 	retval = 0;
2015 	n = min(head - ldata->read_tail, N_TTY_BUF_SIZE - tail);
2016 	n = min(*nr, n);
2017 	if (n) {
2018 		retval = copy_to_user(*b, read_buf_addr(ldata, tail), n);
2019 		n -= retval;
2020 		is_eof = n == 1 && read_buf(ldata, tail) == EOF_CHAR(tty);
2021 		tty_audit_add_data(tty, read_buf_addr(ldata, tail), n,
2022 				ldata->icanon);
2023 		smp_store_release(&ldata->read_tail, ldata->read_tail + n);
2024 		/* Turn single EOF into zero-length read */
2025 		if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
2026 		    (head == ldata->read_tail))
2027 			n = 0;
2028 		*b += n;
2029 		*nr -= n;
2030 	}
2031 	return retval;
2032 }
2033 
2034 /**
2035  *	canon_copy_from_read_buf	-	copy read data in canonical mode
2036  *	@tty: terminal device
2037  *	@b: user data
2038  *	@nr: size of data
2039  *
2040  *	Helper function for n_tty_read.  It is only called when ICANON is on;
2041  *	it copies one line of input up to and including the line-delimiting
2042  *	character into the user-space buffer.
2043  *
2044  *	NB: When termios is changed from non-canonical to canonical mode and
2045  *	the read buffer contains data, n_tty_set_termios() simulates an EOF
2046  *	push (as if C-d were input) _without_ the DISABLED_CHAR in the buffer.
2047  *	This causes data already processed as input to be immediately available
2048  *	as input although a newline has not been received.
2049  *
2050  *	Called under the atomic_read_lock mutex
2051  *
2052  *	n_tty_read()/consumer path:
2053  *		caller holds non-exclusive termios_rwsem
2054  *		read_tail published
2055  */
2056 
2057 static int canon_copy_from_read_buf(struct tty_struct *tty,
2058 				    unsigned char __user **b,
2059 				    size_t *nr)
2060 {
2061 	struct n_tty_data *ldata = tty->disc_data;
2062 	size_t n, size, more, c;
2063 	size_t eol;
2064 	size_t tail;
2065 	int ret, found = 0;
2066 	bool eof_push = 0;
2067 
2068 	/* N.B. avoid overrun if nr == 0 */
2069 	n = min(*nr, smp_load_acquire(&ldata->canon_head) - ldata->read_tail);
2070 	if (!n)
2071 		return 0;
2072 
2073 	tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
2074 	size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
2075 
2076 	n_tty_trace("%s: nr:%zu tail:%zu n:%zu size:%zu\n",
2077 		    __func__, *nr, tail, n, size);
2078 
2079 	eol = find_next_bit(ldata->read_flags, size, tail);
2080 	more = n - (size - tail);
2081 	if (eol == N_TTY_BUF_SIZE && more) {
2082 		/* scan wrapped without finding set bit */
2083 		eol = find_next_bit(ldata->read_flags, more, 0);
2084 		if (eol != more)
2085 			found = 1;
2086 	} else if (eol != size)
2087 		found = 1;
2088 
2089 	size = N_TTY_BUF_SIZE - tail;
2090 	n = eol - tail;
2091 	if (n > N_TTY_BUF_SIZE)
2092 		n += N_TTY_BUF_SIZE;
2093 	n += found;
2094 	c = n;
2095 
2096 	if (found && !ldata->push && read_buf(ldata, eol) == __DISABLED_CHAR) {
2097 		n--;
2098 		eof_push = !n && ldata->read_tail != ldata->line_start;
2099 	}
2100 
2101 	n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
2102 		    __func__, eol, found, n, c, size, more);
2103 
2104 	if (n > size) {
2105 		ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), size);
2106 		if (ret)
2107 			return -EFAULT;
2108 		ret = tty_copy_to_user(tty, *b + size, ldata->read_buf, n - size);
2109 	} else
2110 		ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), n);
2111 
2112 	if (ret)
2113 		return -EFAULT;
2114 	*b += n;
2115 	*nr -= n;
2116 
2117 	if (found)
2118 		clear_bit(eol, ldata->read_flags);
2119 	smp_store_release(&ldata->read_tail, ldata->read_tail + c);
2120 
2121 	if (found) {
2122 		if (!ldata->push)
2123 			ldata->line_start = ldata->read_tail;
2124 		else
2125 			ldata->push = 0;
2126 		tty_audit_push(tty);
2127 	}
2128 	return eof_push ? -EAGAIN : 0;
2129 }
2130 
2131 extern ssize_t redirected_tty_write(struct file *, const char __user *,
2132 							size_t, loff_t *);
2133 
2134 /**
2135  *	job_control		-	check job control
2136  *	@tty: tty
2137  *	@file: file handle
2138  *
2139  *	Perform job control management checks on this file/tty descriptor
2140  *	and if appropriate send any needed signals and return a negative
2141  *	error code if action should be taken.
2142  *
2143  *	Locking: redirected write test is safe
2144  *		 current->signal->tty check is safe
2145  *		 ctrl_lock to safely reference tty->pgrp
2146  */
2147 
2148 static int job_control(struct tty_struct *tty, struct file *file)
2149 {
2150 	/* Job control check -- must be done at start and after
2151 	   every sleep (POSIX.1 7.1.1.4). */
2152 	/* NOTE: not yet done after every sleep pending a thorough
2153 	   check of the logic of this change. -- jlc */
2154 	/* don't stop on /dev/console */
2155 	if (file->f_op->write == redirected_tty_write ||
2156 	    current->signal->tty != tty)
2157 		return 0;
2158 
2159 	spin_lock_irq(&tty->ctrl_lock);
2160 	if (!tty->pgrp)
2161 		printk(KERN_ERR "n_tty_read: no tty->pgrp!\n");
2162 	else if (task_pgrp(current) != tty->pgrp) {
2163 		spin_unlock_irq(&tty->ctrl_lock);
2164 		if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned())
2165 			return -EIO;
2166 		kill_pgrp(task_pgrp(current), SIGTTIN, 1);
2167 		set_thread_flag(TIF_SIGPENDING);
2168 		return -ERESTARTSYS;
2169 	}
2170 	spin_unlock_irq(&tty->ctrl_lock);
2171 	return 0;
2172 }
2173 
2174 
2175 /**
2176  *	n_tty_read		-	read function for tty
2177  *	@tty: tty device
2178  *	@file: file object
2179  *	@buf: userspace buffer pointer
2180  *	@nr: size of I/O
2181  *
2182  *	Perform reads for the line discipline. We are guaranteed that the
2183  *	line discipline will not be closed under us but we may get multiple
2184  *	parallel readers and must handle this ourselves. We may also get
2185  *	a hangup. Always called in user context, may sleep.
2186  *
2187  *	This code must be sure never to sleep through a hangup.
2188  *
2189  *	n_tty_read()/consumer path:
2190  *		claims non-exclusive termios_rwsem
2191  *		publishes read_tail
2192  */
2193 
2194 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
2195 			 unsigned char __user *buf, size_t nr)
2196 {
2197 	struct n_tty_data *ldata = tty->disc_data;
2198 	unsigned char __user *b = buf;
2199 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2200 	int c, done;
2201 	int minimum, time;
2202 	ssize_t retval = 0;
2203 	long timeout;
2204 	int packet;
2205 	size_t tail;
2206 
2207 	c = job_control(tty, file);
2208 	if (c < 0)
2209 		return c;
2210 
2211 	/*
2212 	 *	Internal serialization of reads.
2213 	 */
2214 	if (file->f_flags & O_NONBLOCK) {
2215 		if (!mutex_trylock(&ldata->atomic_read_lock))
2216 			return -EAGAIN;
2217 	} else {
2218 		if (mutex_lock_interruptible(&ldata->atomic_read_lock))
2219 			return -ERESTARTSYS;
2220 	}
2221 
2222 	down_read(&tty->termios_rwsem);
2223 
2224 	minimum = time = 0;
2225 	timeout = MAX_SCHEDULE_TIMEOUT;
2226 	if (!ldata->icanon) {
2227 		minimum = MIN_CHAR(tty);
2228 		if (minimum) {
2229 			time = (HZ / 10) * TIME_CHAR(tty);
2230 			if (time)
2231 				ldata->minimum_to_wake = 1;
2232 			else if (!waitqueue_active(&tty->read_wait) ||
2233 				 (ldata->minimum_to_wake > minimum))
2234 				ldata->minimum_to_wake = minimum;
2235 		} else {
2236 			timeout = (HZ / 10) * TIME_CHAR(tty);
2237 			ldata->minimum_to_wake = minimum = 1;
2238 		}
2239 	}
2240 
2241 	packet = tty->packet;
2242 	tail = ldata->read_tail;
2243 
2244 	add_wait_queue(&tty->read_wait, &wait);
2245 	while (nr) {
2246 		/* First test for status change. */
2247 		if (packet && tty->link->ctrl_status) {
2248 			unsigned char cs;
2249 			if (b != buf)
2250 				break;
2251 			spin_lock_irq(&tty->link->ctrl_lock);
2252 			cs = tty->link->ctrl_status;
2253 			tty->link->ctrl_status = 0;
2254 			spin_unlock_irq(&tty->link->ctrl_lock);
2255 			if (tty_put_user(tty, cs, b++)) {
2256 				retval = -EFAULT;
2257 				b--;
2258 				break;
2259 			}
2260 			nr--;
2261 			break;
2262 		}
2263 
2264 		if (((minimum - (b - buf)) < ldata->minimum_to_wake) &&
2265 		    ((minimum - (b - buf)) >= 1))
2266 			ldata->minimum_to_wake = (minimum - (b - buf));
2267 
2268 		done = check_other_done(tty);
2269 
2270 		if (!input_available_p(tty, 0)) {
2271 			if (done) {
2272 				retval = -EIO;
2273 				break;
2274 			}
2275 			if (tty_hung_up_p(file))
2276 				break;
2277 			if (!timeout)
2278 				break;
2279 			if (file->f_flags & O_NONBLOCK) {
2280 				retval = -EAGAIN;
2281 				break;
2282 			}
2283 			if (signal_pending(current)) {
2284 				retval = -ERESTARTSYS;
2285 				break;
2286 			}
2287 			up_read(&tty->termios_rwsem);
2288 
2289 			timeout = wait_woken(&wait, TASK_INTERRUPTIBLE,
2290 					     timeout);
2291 
2292 			down_read(&tty->termios_rwsem);
2293 			continue;
2294 		}
2295 
2296 		if (ldata->icanon && !L_EXTPROC(tty)) {
2297 			retval = canon_copy_from_read_buf(tty, &b, &nr);
2298 			if (retval == -EAGAIN) {
2299 				retval = 0;
2300 				continue;
2301 			} else if (retval)
2302 				break;
2303 		} else {
2304 			int uncopied;
2305 
2306 			/* Deal with packet mode. */
2307 			if (packet && b == buf) {
2308 				if (tty_put_user(tty, TIOCPKT_DATA, b++)) {
2309 					retval = -EFAULT;
2310 					b--;
2311 					break;
2312 				}
2313 				nr--;
2314 			}
2315 
2316 			uncopied = copy_from_read_buf(tty, &b, &nr);
2317 			uncopied += copy_from_read_buf(tty, &b, &nr);
2318 			if (uncopied) {
2319 				retval = -EFAULT;
2320 				break;
2321 			}
2322 		}
2323 
2324 		n_tty_check_unthrottle(tty);
2325 
2326 		if (b - buf >= minimum)
2327 			break;
2328 		if (time)
2329 			timeout = time;
2330 	}
2331 	if (tail != ldata->read_tail)
2332 		n_tty_kick_worker(tty);
2333 	up_read(&tty->termios_rwsem);
2334 
2335 	remove_wait_queue(&tty->read_wait, &wait);
2336 	if (!waitqueue_active(&tty->read_wait))
2337 		ldata->minimum_to_wake = minimum;
2338 
2339 	mutex_unlock(&ldata->atomic_read_lock);
2340 
2341 	if (b - buf)
2342 		retval = b - buf;
2343 
2344 	return retval;
2345 }
2346 
2347 /**
2348  *	n_tty_write		-	write function for tty
2349  *	@tty: tty device
2350  *	@file: file object
2351  *	@buf: userspace buffer pointer
2352  *	@nr: size of I/O
2353  *
2354  *	Write function of the terminal device.  This is serialized with
2355  *	respect to other write callers but not to termios changes, reads
2356  *	and other such events.  Since the receive code will echo characters,
2357  *	thus calling driver write methods, the output_lock is used in
2358  *	the output processing functions called here as well as in the
2359  *	echo processing function to protect the column state and space
2360  *	left in the buffer.
2361  *
2362  *	This code must be sure never to sleep through a hangup.
2363  *
2364  *	Locking: output_lock to protect column state and space left
2365  *		 (note that the process_output*() functions take this
2366  *		  lock themselves)
2367  */
2368 
2369 static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
2370 			   const unsigned char *buf, size_t nr)
2371 {
2372 	const unsigned char *b = buf;
2373 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2374 	int c;
2375 	ssize_t retval = 0;
2376 
2377 	/* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
2378 	if (L_TOSTOP(tty) && file->f_op->write != redirected_tty_write) {
2379 		retval = tty_check_change(tty);
2380 		if (retval)
2381 			return retval;
2382 	}
2383 
2384 	down_read(&tty->termios_rwsem);
2385 
2386 	/* Write out any echoed characters that are still pending */
2387 	process_echoes(tty);
2388 
2389 	add_wait_queue(&tty->write_wait, &wait);
2390 	while (1) {
2391 		if (signal_pending(current)) {
2392 			retval = -ERESTARTSYS;
2393 			break;
2394 		}
2395 		if (tty_hung_up_p(file) || (tty->link && !tty->link->count)) {
2396 			retval = -EIO;
2397 			break;
2398 		}
2399 		if (O_OPOST(tty)) {
2400 			while (nr > 0) {
2401 				ssize_t num = process_output_block(tty, b, nr);
2402 				if (num < 0) {
2403 					if (num == -EAGAIN)
2404 						break;
2405 					retval = num;
2406 					goto break_out;
2407 				}
2408 				b += num;
2409 				nr -= num;
2410 				if (nr == 0)
2411 					break;
2412 				c = *b;
2413 				if (process_output(c, tty) < 0)
2414 					break;
2415 				b++; nr--;
2416 			}
2417 			if (tty->ops->flush_chars)
2418 				tty->ops->flush_chars(tty);
2419 		} else {
2420 			struct n_tty_data *ldata = tty->disc_data;
2421 
2422 			while (nr > 0) {
2423 				mutex_lock(&ldata->output_lock);
2424 				c = tty->ops->write(tty, b, nr);
2425 				mutex_unlock(&ldata->output_lock);
2426 				if (c < 0) {
2427 					retval = c;
2428 					goto break_out;
2429 				}
2430 				if (!c)
2431 					break;
2432 				b += c;
2433 				nr -= c;
2434 			}
2435 		}
2436 		if (!nr)
2437 			break;
2438 		if (file->f_flags & O_NONBLOCK) {
2439 			retval = -EAGAIN;
2440 			break;
2441 		}
2442 		up_read(&tty->termios_rwsem);
2443 
2444 		wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2445 
2446 		down_read(&tty->termios_rwsem);
2447 	}
2448 break_out:
2449 	remove_wait_queue(&tty->write_wait, &wait);
2450 	if (b - buf != nr && tty->fasync)
2451 		set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
2452 	up_read(&tty->termios_rwsem);
2453 	return (b - buf) ? b - buf : retval;
2454 }
2455 
2456 /**
2457  *	n_tty_poll		-	poll method for N_TTY
2458  *	@tty: terminal device
2459  *	@file: file accessing it
2460  *	@wait: poll table
2461  *
2462  *	Called when the line discipline is asked to poll() for data or
2463  *	for special events. This code is not serialized with respect to
2464  *	other events save open/close.
2465  *
2466  *	This code must be sure never to sleep through a hangup.
2467  *	Called without the kernel lock held - fine
2468  */
2469 
2470 static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
2471 							poll_table *wait)
2472 {
2473 	struct n_tty_data *ldata = tty->disc_data;
2474 	unsigned int mask = 0;
2475 
2476 	poll_wait(file, &tty->read_wait, wait);
2477 	poll_wait(file, &tty->write_wait, wait);
2478 	if (check_other_done(tty))
2479 		mask |= POLLHUP;
2480 	if (input_available_p(tty, 1))
2481 		mask |= POLLIN | POLLRDNORM;
2482 	if (tty->packet && tty->link->ctrl_status)
2483 		mask |= POLLPRI | POLLIN | POLLRDNORM;
2484 	if (tty_hung_up_p(file))
2485 		mask |= POLLHUP;
2486 	if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
2487 		if (MIN_CHAR(tty) && !TIME_CHAR(tty))
2488 			ldata->minimum_to_wake = MIN_CHAR(tty);
2489 		else
2490 			ldata->minimum_to_wake = 1;
2491 	}
2492 	if (tty->ops->write && !tty_is_writelocked(tty) &&
2493 			tty_chars_in_buffer(tty) < WAKEUP_CHARS &&
2494 			tty_write_room(tty) > 0)
2495 		mask |= POLLOUT | POLLWRNORM;
2496 	return mask;
2497 }
2498 
2499 static unsigned long inq_canon(struct n_tty_data *ldata)
2500 {
2501 	size_t nr, head, tail;
2502 
2503 	if (ldata->canon_head == ldata->read_tail)
2504 		return 0;
2505 	head = ldata->canon_head;
2506 	tail = ldata->read_tail;
2507 	nr = head - tail;
2508 	/* Skip EOF-chars.. */
2509 	while (head != tail) {
2510 		if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) &&
2511 		    read_buf(ldata, tail) == __DISABLED_CHAR)
2512 			nr--;
2513 		tail++;
2514 	}
2515 	return nr;
2516 }
2517 
2518 static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
2519 		       unsigned int cmd, unsigned long arg)
2520 {
2521 	struct n_tty_data *ldata = tty->disc_data;
2522 	int retval;
2523 
2524 	switch (cmd) {
2525 	case TIOCOUTQ:
2526 		return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2527 	case TIOCINQ:
2528 		down_write(&tty->termios_rwsem);
2529 		if (L_ICANON(tty))
2530 			retval = inq_canon(ldata);
2531 		else
2532 			retval = read_cnt(ldata);
2533 		up_write(&tty->termios_rwsem);
2534 		return put_user(retval, (unsigned int __user *) arg);
2535 	default:
2536 		return n_tty_ioctl_helper(tty, file, cmd, arg);
2537 	}
2538 }
2539 
2540 static void n_tty_fasync(struct tty_struct *tty, int on)
2541 {
2542 	struct n_tty_data *ldata = tty->disc_data;
2543 
2544 	if (!waitqueue_active(&tty->read_wait)) {
2545 		if (on)
2546 			ldata->minimum_to_wake = 1;
2547 		else if (!tty->fasync)
2548 			ldata->minimum_to_wake = N_TTY_BUF_SIZE;
2549 	}
2550 }
2551 
2552 struct tty_ldisc_ops tty_ldisc_N_TTY = {
2553 	.magic           = TTY_LDISC_MAGIC,
2554 	.name            = "n_tty",
2555 	.open            = n_tty_open,
2556 	.close           = n_tty_close,
2557 	.flush_buffer    = n_tty_flush_buffer,
2558 	.chars_in_buffer = n_tty_chars_in_buffer,
2559 	.read            = n_tty_read,
2560 	.write           = n_tty_write,
2561 	.ioctl           = n_tty_ioctl,
2562 	.set_termios     = n_tty_set_termios,
2563 	.poll            = n_tty_poll,
2564 	.receive_buf     = n_tty_receive_buf,
2565 	.write_wakeup    = n_tty_write_wakeup,
2566 	.fasync		 = n_tty_fasync,
2567 	.receive_buf2	 = n_tty_receive_buf2,
2568 };
2569 
2570 /**
2571  *	n_tty_inherit_ops	-	inherit N_TTY methods
2572  *	@ops: struct tty_ldisc_ops where to save N_TTY methods
2573  *
2574  *	Enables a 'subclass' line discipline to 'inherit' N_TTY
2575  *	methods.
2576  */
2577 
2578 void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
2579 {
2580 	*ops = tty_ldisc_N_TTY;
2581 	ops->owner = NULL;
2582 	ops->refcount = ops->flags = 0;
2583 }
2584 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
2585