xref: /openbmc/linux/drivers/tty/n_tty.c (revision f1bc423f)
1 // SPDX-License-Identifier: GPL-1.0+
2 /*
3  * n_tty.c --- implements the N_TTY line discipline.
4  *
5  * This code used to be in tty_io.c, but things are getting hairy
6  * enough that it made sense to split things off.  (The N_TTY
7  * processing has changed so much that it's hardly recognizable,
8  * anyway...)
9  *
10  * Note that the open routine for N_TTY is guaranteed never to return
11  * an error.  This is because Linux will fall back to setting a line
12  * to N_TTY if it can not switch to any other line discipline.
13  *
14  * Written by Theodore Ts'o, Copyright 1994.
15  *
16  * This file also contains code originally written by Linus Torvalds,
17  * Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
18  *
19  * Reduced memory usage for older ARM systems  - Russell King.
20  *
21  * 2000/01/20   Fixed SMP locking on put_tty_queue using bits of
22  *		the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
23  *		who actually finally proved there really was a race.
24  *
25  * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
26  *		waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
27  *		Also fixed a bug in BLOCKING mode where n_tty_write returns
28  *		EAGAIN
29  */
30 
31 #include <linux/types.h>
32 #include <linux/major.h>
33 #include <linux/errno.h>
34 #include <linux/signal.h>
35 #include <linux/fcntl.h>
36 #include <linux/sched.h>
37 #include <linux/interrupt.h>
38 #include <linux/tty.h>
39 #include <linux/timer.h>
40 #include <linux/ctype.h>
41 #include <linux/mm.h>
42 #include <linux/string.h>
43 #include <linux/slab.h>
44 #include <linux/poll.h>
45 #include <linux/bitops.h>
46 #include <linux/audit.h>
47 #include <linux/file.h>
48 #include <linux/uaccess.h>
49 #include <linux/module.h>
50 #include <linux/ratelimit.h>
51 #include <linux/vmalloc.h>
52 #include "tty.h"
53 
54 /*
55  * Until this number of characters is queued in the xmit buffer, select will
56  * return "we have room for writes".
57  */
58 #define WAKEUP_CHARS 256
59 
60 /*
61  * This defines the low- and high-watermarks for throttling and
62  * unthrottling the TTY driver.  These watermarks are used for
63  * controlling the space in the read buffer.
64  */
65 #define TTY_THRESHOLD_THROTTLE		128 /* now based on remaining room */
66 #define TTY_THRESHOLD_UNTHROTTLE	128
67 
68 /*
69  * Special byte codes used in the echo buffer to represent operations
70  * or special handling of characters.  Bytes in the echo buffer that
71  * are not part of such special blocks are treated as normal character
72  * codes.
73  */
74 #define ECHO_OP_START 0xff
75 #define ECHO_OP_MOVE_BACK_COL 0x80
76 #define ECHO_OP_SET_CANON_COL 0x81
77 #define ECHO_OP_ERASE_TAB 0x82
78 
79 #define ECHO_COMMIT_WATERMARK	256
80 #define ECHO_BLOCK		256
81 #define ECHO_DISCARD_WATERMARK	N_TTY_BUF_SIZE - (ECHO_BLOCK + 32)
82 
83 
84 #undef N_TTY_TRACE
85 #ifdef N_TTY_TRACE
86 # define n_tty_trace(f, args...)	trace_printk(f, ##args)
87 #else
88 # define n_tty_trace(f, args...)	no_printk(f, ##args)
89 #endif
90 
91 struct n_tty_data {
92 	/* producer-published */
93 	size_t read_head;
94 	size_t commit_head;
95 	size_t canon_head;
96 	size_t echo_head;
97 	size_t echo_commit;
98 	size_t echo_mark;
99 	DECLARE_BITMAP(char_map, 256);
100 
101 	/* private to n_tty_receive_overrun (single-threaded) */
102 	unsigned long overrun_time;
103 	int num_overrun;
104 
105 	/* non-atomic */
106 	bool no_room;
107 
108 	/* must hold exclusive termios_rwsem to reset these */
109 	unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
110 	unsigned char push:1;
111 
112 	/* shared by producer and consumer */
113 	char read_buf[N_TTY_BUF_SIZE];
114 	DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
115 	unsigned char echo_buf[N_TTY_BUF_SIZE];
116 
117 	/* consumer-published */
118 	size_t read_tail;
119 	size_t line_start;
120 
121 	/* protected by output lock */
122 	unsigned int column;
123 	unsigned int canon_column;
124 	size_t echo_tail;
125 
126 	struct mutex atomic_read_lock;
127 	struct mutex output_lock;
128 };
129 
130 #define MASK(x) ((x) & (N_TTY_BUF_SIZE - 1))
131 
132 static inline size_t read_cnt(struct n_tty_data *ldata)
133 {
134 	return ldata->read_head - ldata->read_tail;
135 }
136 
137 static inline unsigned char read_buf(struct n_tty_data *ldata, size_t i)
138 {
139 	return ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
140 }
141 
142 static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i)
143 {
144 	return &ldata->read_buf[i & (N_TTY_BUF_SIZE - 1)];
145 }
146 
147 static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i)
148 {
149 	smp_rmb(); /* Matches smp_wmb() in add_echo_byte(). */
150 	return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
151 }
152 
153 static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
154 {
155 	return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
156 }
157 
158 /* If we are not echoing the data, perhaps this is a secret so erase it */
159 static void zero_buffer(struct tty_struct *tty, u8 *buffer, int size)
160 {
161 	bool icanon = !!L_ICANON(tty);
162 	bool no_echo = !L_ECHO(tty);
163 
164 	if (icanon && no_echo)
165 		memset(buffer, 0x00, size);
166 }
167 
168 static void tty_copy(struct tty_struct *tty, void *to, size_t tail, size_t n)
169 {
170 	struct n_tty_data *ldata = tty->disc_data;
171 	size_t size = N_TTY_BUF_SIZE - tail;
172 	void *from = read_buf_addr(ldata, tail);
173 
174 	if (n > size) {
175 		tty_audit_add_data(tty, from, size);
176 		memcpy(to, from, size);
177 		zero_buffer(tty, from, size);
178 		to += size;
179 		n -= size;
180 		from = ldata->read_buf;
181 	}
182 
183 	tty_audit_add_data(tty, from, n);
184 	memcpy(to, from, n);
185 	zero_buffer(tty, from, n);
186 }
187 
188 /**
189  * n_tty_kick_worker - start input worker (if required)
190  * @tty: terminal
191  *
192  * Re-schedules the flip buffer work if it may have stopped.
193  *
194  * Locking:
195  *  * Caller holds exclusive %termios_rwsem, or
196  *  * n_tty_read()/consumer path:
197  *	holds non-exclusive %termios_rwsem
198  */
199 static void n_tty_kick_worker(struct tty_struct *tty)
200 {
201 	struct n_tty_data *ldata = tty->disc_data;
202 
203 	/* Did the input worker stop? Restart it */
204 	if (unlikely(ldata->no_room)) {
205 		ldata->no_room = 0;
206 
207 		WARN_RATELIMIT(tty->port->itty == NULL,
208 				"scheduling with invalid itty\n");
209 		/* see if ldisc has been killed - if so, this means that
210 		 * even though the ldisc has been halted and ->buf.work
211 		 * cancelled, ->buf.work is about to be rescheduled
212 		 */
213 		WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
214 			       "scheduling buffer work for halted ldisc\n");
215 		tty_buffer_restart_work(tty->port);
216 	}
217 }
218 
219 static ssize_t chars_in_buffer(struct tty_struct *tty)
220 {
221 	struct n_tty_data *ldata = tty->disc_data;
222 	ssize_t n = 0;
223 
224 	if (!ldata->icanon)
225 		n = ldata->commit_head - ldata->read_tail;
226 	else
227 		n = ldata->canon_head - ldata->read_tail;
228 	return n;
229 }
230 
231 /**
232  * n_tty_write_wakeup	-	asynchronous I/O notifier
233  * @tty: tty device
234  *
235  * Required for the ptys, serial driver etc. since processes that attach
236  * themselves to the master and rely on ASYNC IO must be woken up.
237  */
238 static void n_tty_write_wakeup(struct tty_struct *tty)
239 {
240 	clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
241 	kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
242 }
243 
244 static void n_tty_check_throttle(struct tty_struct *tty)
245 {
246 	struct n_tty_data *ldata = tty->disc_data;
247 
248 	/*
249 	 * Check the remaining room for the input canonicalization
250 	 * mode.  We don't want to throttle the driver if we're in
251 	 * canonical mode and don't have a newline yet!
252 	 */
253 	if (ldata->icanon && ldata->canon_head == ldata->read_tail)
254 		return;
255 
256 	while (1) {
257 		int throttled;
258 		tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
259 		if (N_TTY_BUF_SIZE - read_cnt(ldata) >= TTY_THRESHOLD_THROTTLE)
260 			break;
261 		throttled = tty_throttle_safe(tty);
262 		if (!throttled)
263 			break;
264 	}
265 	__tty_set_flow_change(tty, 0);
266 }
267 
268 static void n_tty_check_unthrottle(struct tty_struct *tty)
269 {
270 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
271 		if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
272 			return;
273 		n_tty_kick_worker(tty);
274 		tty_wakeup(tty->link);
275 		return;
276 	}
277 
278 	/* If there is enough space in the read buffer now, let the
279 	 * low-level driver know. We use chars_in_buffer() to
280 	 * check the buffer, as it now knows about canonical mode.
281 	 * Otherwise, if the driver is throttled and the line is
282 	 * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
283 	 * we won't get any more characters.
284 	 */
285 
286 	while (1) {
287 		int unthrottled;
288 		tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
289 		if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
290 			break;
291 		n_tty_kick_worker(tty);
292 		unthrottled = tty_unthrottle_safe(tty);
293 		if (!unthrottled)
294 			break;
295 	}
296 	__tty_set_flow_change(tty, 0);
297 }
298 
299 /**
300  * put_tty_queue		-	add character to tty
301  * @c: character
302  * @ldata: n_tty data
303  *
304  * Add a character to the tty read_buf queue.
305  *
306  * Locking:
307  *  * n_tty_receive_buf()/producer path:
308  *	caller holds non-exclusive %termios_rwsem
309  */
310 static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
311 {
312 	*read_buf_addr(ldata, ldata->read_head) = c;
313 	ldata->read_head++;
314 }
315 
316 /**
317  * reset_buffer_flags	-	reset buffer state
318  * @ldata: line disc data to reset
319  *
320  * Reset the read buffer counters and clear the flags. Called from
321  * n_tty_open() and n_tty_flush_buffer().
322  *
323  * Locking:
324  *  * caller holds exclusive %termios_rwsem, or
325  *  * (locking is not required)
326  */
327 static void reset_buffer_flags(struct n_tty_data *ldata)
328 {
329 	ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
330 	ldata->commit_head = 0;
331 	ldata->line_start = 0;
332 
333 	ldata->erasing = 0;
334 	bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
335 	ldata->push = 0;
336 }
337 
338 static void n_tty_packet_mode_flush(struct tty_struct *tty)
339 {
340 	unsigned long flags;
341 
342 	if (tty->link->ctrl.packet) {
343 		spin_lock_irqsave(&tty->ctrl.lock, flags);
344 		tty->ctrl.pktstatus |= TIOCPKT_FLUSHREAD;
345 		spin_unlock_irqrestore(&tty->ctrl.lock, flags);
346 		wake_up_interruptible(&tty->link->read_wait);
347 	}
348 }
349 
350 /**
351  * n_tty_flush_buffer	-	clean input queue
352  * @tty: terminal device
353  *
354  * Flush the input buffer. Called when the tty layer wants the buffer flushed
355  * (eg at hangup) or when the %N_TTY line discipline internally has to clean
356  * the pending queue (for example some signals).
357  *
358  * Holds %termios_rwsem to exclude producer/consumer while buffer indices are
359  * reset.
360  *
361  * Locking: %ctrl.lock, exclusive %termios_rwsem
362  */
363 static void n_tty_flush_buffer(struct tty_struct *tty)
364 {
365 	down_write(&tty->termios_rwsem);
366 	reset_buffer_flags(tty->disc_data);
367 	n_tty_kick_worker(tty);
368 
369 	if (tty->link)
370 		n_tty_packet_mode_flush(tty);
371 	up_write(&tty->termios_rwsem);
372 }
373 
374 /**
375  * is_utf8_continuation	-	utf8 multibyte check
376  * @c: byte to check
377  *
378  * Returns: true if the utf8 character @c is a multibyte continuation
379  * character. We use this to correctly compute the on-screen size of the
380  * character when printing.
381  */
382 static inline int is_utf8_continuation(unsigned char c)
383 {
384 	return (c & 0xc0) == 0x80;
385 }
386 
387 /**
388  * is_continuation	-	multibyte check
389  * @c: byte to check
390  * @tty: terminal device
391  *
392  * Returns: true if the utf8 character @c is a multibyte continuation character
393  * and the terminal is in unicode mode.
394  */
395 static inline int is_continuation(unsigned char c, struct tty_struct *tty)
396 {
397 	return I_IUTF8(tty) && is_utf8_continuation(c);
398 }
399 
400 /**
401  * do_output_char	-	output one character
402  * @c: character (or partial unicode symbol)
403  * @tty: terminal device
404  * @space: space available in tty driver write buffer
405  *
406  * This is a helper function that handles one output character (including
407  * special characters like TAB, CR, LF, etc.), doing OPOST processing and
408  * putting the results in the tty driver's write buffer.
409  *
410  * Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY and NLDLY.
411  * They simply aren't relevant in the world today. If you ever need them, add
412  * them here.
413  *
414  * Returns: the number of bytes of buffer space used or -1 if no space left.
415  *
416  * Locking: should be called under the %output_lock to protect the column state
417  * and space left in the buffer.
418  */
419 static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
420 {
421 	struct n_tty_data *ldata = tty->disc_data;
422 	int	spaces;
423 
424 	if (!space)
425 		return -1;
426 
427 	switch (c) {
428 	case '\n':
429 		if (O_ONLRET(tty))
430 			ldata->column = 0;
431 		if (O_ONLCR(tty)) {
432 			if (space < 2)
433 				return -1;
434 			ldata->canon_column = ldata->column = 0;
435 			tty->ops->write(tty, "\r\n", 2);
436 			return 2;
437 		}
438 		ldata->canon_column = ldata->column;
439 		break;
440 	case '\r':
441 		if (O_ONOCR(tty) && ldata->column == 0)
442 			return 0;
443 		if (O_OCRNL(tty)) {
444 			c = '\n';
445 			if (O_ONLRET(tty))
446 				ldata->canon_column = ldata->column = 0;
447 			break;
448 		}
449 		ldata->canon_column = ldata->column = 0;
450 		break;
451 	case '\t':
452 		spaces = 8 - (ldata->column & 7);
453 		if (O_TABDLY(tty) == XTABS) {
454 			if (space < spaces)
455 				return -1;
456 			ldata->column += spaces;
457 			tty->ops->write(tty, "        ", spaces);
458 			return spaces;
459 		}
460 		ldata->column += spaces;
461 		break;
462 	case '\b':
463 		if (ldata->column > 0)
464 			ldata->column--;
465 		break;
466 	default:
467 		if (!iscntrl(c)) {
468 			if (O_OLCUC(tty))
469 				c = toupper(c);
470 			if (!is_continuation(c, tty))
471 				ldata->column++;
472 		}
473 		break;
474 	}
475 
476 	tty_put_char(tty, c);
477 	return 1;
478 }
479 
480 /**
481  * process_output	-	output post processor
482  * @c: character (or partial unicode symbol)
483  * @tty: terminal device
484  *
485  * Output one character with OPOST processing.
486  *
487  * Returns: -1 when the output device is full and the character must be
488  * retried.
489  *
490  * Locking: %output_lock to protect column state and space left (also, this is
491  *called from n_tty_write() under the tty layer write lock).
492  */
493 static int process_output(unsigned char c, struct tty_struct *tty)
494 {
495 	struct n_tty_data *ldata = tty->disc_data;
496 	int	space, retval;
497 
498 	mutex_lock(&ldata->output_lock);
499 
500 	space = tty_write_room(tty);
501 	retval = do_output_char(c, tty, space);
502 
503 	mutex_unlock(&ldata->output_lock);
504 	if (retval < 0)
505 		return -1;
506 	else
507 		return 0;
508 }
509 
510 /**
511  * process_output_block	-	block post processor
512  * @tty: terminal device
513  * @buf: character buffer
514  * @nr: number of bytes to output
515  *
516  * Output a block of characters with OPOST processing.
517  *
518  * This path is used to speed up block console writes, among other things when
519  * processing blocks of output data. It handles only the simple cases normally
520  * found and helps to generate blocks of symbols for the console driver and
521  * thus improve performance.
522  *
523  * Returns: the number of characters output.
524  *
525  * Locking: %output_lock to protect column state and space left (also, this is
526  * called from n_tty_write() under the tty layer write lock).
527  */
528 static ssize_t process_output_block(struct tty_struct *tty,
529 				    const unsigned char *buf, unsigned int nr)
530 {
531 	struct n_tty_data *ldata = tty->disc_data;
532 	int	space;
533 	int	i;
534 	const unsigned char *cp;
535 
536 	mutex_lock(&ldata->output_lock);
537 
538 	space = tty_write_room(tty);
539 	if (space <= 0) {
540 		mutex_unlock(&ldata->output_lock);
541 		return space;
542 	}
543 	if (nr > space)
544 		nr = space;
545 
546 	for (i = 0, cp = buf; i < nr; i++, cp++) {
547 		unsigned char c = *cp;
548 
549 		switch (c) {
550 		case '\n':
551 			if (O_ONLRET(tty))
552 				ldata->column = 0;
553 			if (O_ONLCR(tty))
554 				goto break_out;
555 			ldata->canon_column = ldata->column;
556 			break;
557 		case '\r':
558 			if (O_ONOCR(tty) && ldata->column == 0)
559 				goto break_out;
560 			if (O_OCRNL(tty))
561 				goto break_out;
562 			ldata->canon_column = ldata->column = 0;
563 			break;
564 		case '\t':
565 			goto break_out;
566 		case '\b':
567 			if (ldata->column > 0)
568 				ldata->column--;
569 			break;
570 		default:
571 			if (!iscntrl(c)) {
572 				if (O_OLCUC(tty))
573 					goto break_out;
574 				if (!is_continuation(c, tty))
575 					ldata->column++;
576 			}
577 			break;
578 		}
579 	}
580 break_out:
581 	i = tty->ops->write(tty, buf, i);
582 
583 	mutex_unlock(&ldata->output_lock);
584 	return i;
585 }
586 
587 /**
588  * __process_echoes	-	write pending echo characters
589  * @tty: terminal device
590  *
591  * Write previously buffered echo (and other ldisc-generated) characters to the
592  * tty.
593  *
594  * Characters generated by the ldisc (including echoes) need to be buffered
595  * because the driver's write buffer can fill during heavy program output.
596  * Echoing straight to the driver will often fail under these conditions,
597  * causing lost characters and resulting mismatches of ldisc state information.
598  *
599  * Since the ldisc state must represent the characters actually sent to the
600  * driver at the time of the write, operations like certain changes in column
601  * state are also saved in the buffer and executed here.
602  *
603  * A circular fifo buffer is used so that the most recent characters are
604  * prioritized. Also, when control characters are echoed with a prefixed "^",
605  * the pair is treated atomically and thus not separated.
606  *
607  * Locking: callers must hold %output_lock.
608  */
609 static size_t __process_echoes(struct tty_struct *tty)
610 {
611 	struct n_tty_data *ldata = tty->disc_data;
612 	int	space, old_space;
613 	size_t tail;
614 	unsigned char c;
615 
616 	old_space = space = tty_write_room(tty);
617 
618 	tail = ldata->echo_tail;
619 	while (MASK(ldata->echo_commit) != MASK(tail)) {
620 		c = echo_buf(ldata, tail);
621 		if (c == ECHO_OP_START) {
622 			unsigned char op;
623 			int no_space_left = 0;
624 
625 			/*
626 			 * Since add_echo_byte() is called without holding
627 			 * output_lock, we might see only portion of multi-byte
628 			 * operation.
629 			 */
630 			if (MASK(ldata->echo_commit) == MASK(tail + 1))
631 				goto not_yet_stored;
632 			/*
633 			 * If the buffer byte is the start of a multi-byte
634 			 * operation, get the next byte, which is either the
635 			 * op code or a control character value.
636 			 */
637 			op = echo_buf(ldata, tail + 1);
638 
639 			switch (op) {
640 			case ECHO_OP_ERASE_TAB: {
641 				unsigned int num_chars, num_bs;
642 
643 				if (MASK(ldata->echo_commit) == MASK(tail + 2))
644 					goto not_yet_stored;
645 				num_chars = echo_buf(ldata, tail + 2);
646 
647 				/*
648 				 * Determine how many columns to go back
649 				 * in order to erase the tab.
650 				 * This depends on the number of columns
651 				 * used by other characters within the tab
652 				 * area.  If this (modulo 8) count is from
653 				 * the start of input rather than from a
654 				 * previous tab, we offset by canon column.
655 				 * Otherwise, tab spacing is normal.
656 				 */
657 				if (!(num_chars & 0x80))
658 					num_chars += ldata->canon_column;
659 				num_bs = 8 - (num_chars & 7);
660 
661 				if (num_bs > space) {
662 					no_space_left = 1;
663 					break;
664 				}
665 				space -= num_bs;
666 				while (num_bs--) {
667 					tty_put_char(tty, '\b');
668 					if (ldata->column > 0)
669 						ldata->column--;
670 				}
671 				tail += 3;
672 				break;
673 			}
674 			case ECHO_OP_SET_CANON_COL:
675 				ldata->canon_column = ldata->column;
676 				tail += 2;
677 				break;
678 
679 			case ECHO_OP_MOVE_BACK_COL:
680 				if (ldata->column > 0)
681 					ldata->column--;
682 				tail += 2;
683 				break;
684 
685 			case ECHO_OP_START:
686 				/* This is an escaped echo op start code */
687 				if (!space) {
688 					no_space_left = 1;
689 					break;
690 				}
691 				tty_put_char(tty, ECHO_OP_START);
692 				ldata->column++;
693 				space--;
694 				tail += 2;
695 				break;
696 
697 			default:
698 				/*
699 				 * If the op is not a special byte code,
700 				 * it is a ctrl char tagged to be echoed
701 				 * as "^X" (where X is the letter
702 				 * representing the control char).
703 				 * Note that we must ensure there is
704 				 * enough space for the whole ctrl pair.
705 				 *
706 				 */
707 				if (space < 2) {
708 					no_space_left = 1;
709 					break;
710 				}
711 				tty_put_char(tty, '^');
712 				tty_put_char(tty, op ^ 0100);
713 				ldata->column += 2;
714 				space -= 2;
715 				tail += 2;
716 			}
717 
718 			if (no_space_left)
719 				break;
720 		} else {
721 			if (O_OPOST(tty)) {
722 				int retval = do_output_char(c, tty, space);
723 				if (retval < 0)
724 					break;
725 				space -= retval;
726 			} else {
727 				if (!space)
728 					break;
729 				tty_put_char(tty, c);
730 				space -= 1;
731 			}
732 			tail += 1;
733 		}
734 	}
735 
736 	/* If the echo buffer is nearly full (so that the possibility exists
737 	 * of echo overrun before the next commit), then discard enough
738 	 * data at the tail to prevent a subsequent overrun */
739 	while (ldata->echo_commit > tail &&
740 	       ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
741 		if (echo_buf(ldata, tail) == ECHO_OP_START) {
742 			if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB)
743 				tail += 3;
744 			else
745 				tail += 2;
746 		} else
747 			tail++;
748 	}
749 
750  not_yet_stored:
751 	ldata->echo_tail = tail;
752 	return old_space - space;
753 }
754 
755 static void commit_echoes(struct tty_struct *tty)
756 {
757 	struct n_tty_data *ldata = tty->disc_data;
758 	size_t nr, old, echoed;
759 	size_t head;
760 
761 	mutex_lock(&ldata->output_lock);
762 	head = ldata->echo_head;
763 	ldata->echo_mark = head;
764 	old = ldata->echo_commit - ldata->echo_tail;
765 
766 	/* Process committed echoes if the accumulated # of bytes
767 	 * is over the threshold (and try again each time another
768 	 * block is accumulated) */
769 	nr = head - ldata->echo_tail;
770 	if (nr < ECHO_COMMIT_WATERMARK ||
771 	    (nr % ECHO_BLOCK > old % ECHO_BLOCK)) {
772 		mutex_unlock(&ldata->output_lock);
773 		return;
774 	}
775 
776 	ldata->echo_commit = head;
777 	echoed = __process_echoes(tty);
778 	mutex_unlock(&ldata->output_lock);
779 
780 	if (echoed && tty->ops->flush_chars)
781 		tty->ops->flush_chars(tty);
782 }
783 
784 static void process_echoes(struct tty_struct *tty)
785 {
786 	struct n_tty_data *ldata = tty->disc_data;
787 	size_t echoed;
788 
789 	if (ldata->echo_mark == ldata->echo_tail)
790 		return;
791 
792 	mutex_lock(&ldata->output_lock);
793 	ldata->echo_commit = ldata->echo_mark;
794 	echoed = __process_echoes(tty);
795 	mutex_unlock(&ldata->output_lock);
796 
797 	if (echoed && tty->ops->flush_chars)
798 		tty->ops->flush_chars(tty);
799 }
800 
801 /* NB: echo_mark and echo_head should be equivalent here */
802 static void flush_echoes(struct tty_struct *tty)
803 {
804 	struct n_tty_data *ldata = tty->disc_data;
805 
806 	if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
807 	    ldata->echo_commit == ldata->echo_head)
808 		return;
809 
810 	mutex_lock(&ldata->output_lock);
811 	ldata->echo_commit = ldata->echo_head;
812 	__process_echoes(tty);
813 	mutex_unlock(&ldata->output_lock);
814 }
815 
816 /**
817  * add_echo_byte	-	add a byte to the echo buffer
818  * @c: unicode byte to echo
819  * @ldata: n_tty data
820  *
821  * Add a character or operation byte to the echo buffer.
822  */
823 static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
824 {
825 	*echo_buf_addr(ldata, ldata->echo_head) = c;
826 	smp_wmb(); /* Matches smp_rmb() in echo_buf(). */
827 	ldata->echo_head++;
828 }
829 
830 /**
831  * echo_move_back_col	-	add operation to move back a column
832  * @ldata: n_tty data
833  *
834  * Add an operation to the echo buffer to move back one column.
835  */
836 static void echo_move_back_col(struct n_tty_data *ldata)
837 {
838 	add_echo_byte(ECHO_OP_START, ldata);
839 	add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
840 }
841 
842 /**
843  * echo_set_canon_col	-	add operation to set the canon column
844  * @ldata: n_tty data
845  *
846  * Add an operation to the echo buffer to set the canon column to the current
847  * column.
848  */
849 static void echo_set_canon_col(struct n_tty_data *ldata)
850 {
851 	add_echo_byte(ECHO_OP_START, ldata);
852 	add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
853 }
854 
855 /**
856  * echo_erase_tab	-	add operation to erase a tab
857  * @num_chars: number of character columns already used
858  * @after_tab: true if num_chars starts after a previous tab
859  * @ldata: n_tty data
860  *
861  * Add an operation to the echo buffer to erase a tab.
862  *
863  * Called by the eraser function, which knows how many character columns have
864  * been used since either a previous tab or the start of input. This
865  * information will be used later, along with canon column (if applicable), to
866  * go back the correct number of columns.
867  */
868 static void echo_erase_tab(unsigned int num_chars, int after_tab,
869 			   struct n_tty_data *ldata)
870 {
871 	add_echo_byte(ECHO_OP_START, ldata);
872 	add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
873 
874 	/* We only need to know this modulo 8 (tab spacing) */
875 	num_chars &= 7;
876 
877 	/* Set the high bit as a flag if num_chars is after a previous tab */
878 	if (after_tab)
879 		num_chars |= 0x80;
880 
881 	add_echo_byte(num_chars, ldata);
882 }
883 
884 /**
885  * echo_char_raw	-	echo a character raw
886  * @c: unicode byte to echo
887  * @ldata: line disc data
888  *
889  * Echo user input back onto the screen. This must be called only when
890  * L_ECHO(tty) is true. Called from the &tty_driver.receive_buf() path.
891  *
892  * This variant does not treat control characters specially.
893  */
894 static void echo_char_raw(unsigned char c, struct n_tty_data *ldata)
895 {
896 	if (c == ECHO_OP_START) {
897 		add_echo_byte(ECHO_OP_START, ldata);
898 		add_echo_byte(ECHO_OP_START, ldata);
899 	} else {
900 		add_echo_byte(c, ldata);
901 	}
902 }
903 
904 /**
905  * echo_char		-	echo a character
906  * @c: unicode byte to echo
907  * @tty: terminal device
908  *
909  * Echo user input back onto the screen. This must be called only when
910  * L_ECHO(tty) is true. Called from the &tty_driver.receive_buf() path.
911  *
912  * This variant tags control characters to be echoed as "^X" (where X is the
913  * letter representing the control char).
914  */
915 static void echo_char(unsigned char c, struct tty_struct *tty)
916 {
917 	struct n_tty_data *ldata = tty->disc_data;
918 
919 	if (c == ECHO_OP_START) {
920 		add_echo_byte(ECHO_OP_START, ldata);
921 		add_echo_byte(ECHO_OP_START, ldata);
922 	} else {
923 		if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
924 			add_echo_byte(ECHO_OP_START, ldata);
925 		add_echo_byte(c, ldata);
926 	}
927 }
928 
929 /**
930  * finish_erasing	-	complete erase
931  * @ldata: n_tty data
932  */
933 static inline void finish_erasing(struct n_tty_data *ldata)
934 {
935 	if (ldata->erasing) {
936 		echo_char_raw('/', ldata);
937 		ldata->erasing = 0;
938 	}
939 }
940 
941 /**
942  * eraser		-	handle erase function
943  * @c: character input
944  * @tty: terminal device
945  *
946  * Perform erase and necessary output when an erase character is present in the
947  * stream from the driver layer. Handles the complexities of UTF-8 multibyte
948  * symbols.
949  *
950  * Locking: n_tty_receive_buf()/producer path:
951  *	caller holds non-exclusive %termios_rwsem
952  */
953 static void eraser(unsigned char c, struct tty_struct *tty)
954 {
955 	struct n_tty_data *ldata = tty->disc_data;
956 	enum { ERASE, WERASE, KILL } kill_type;
957 	size_t head;
958 	size_t cnt;
959 	int seen_alnums;
960 
961 	if (ldata->read_head == ldata->canon_head) {
962 		/* process_output('\a', tty); */ /* what do you think? */
963 		return;
964 	}
965 	if (c == ERASE_CHAR(tty))
966 		kill_type = ERASE;
967 	else if (c == WERASE_CHAR(tty))
968 		kill_type = WERASE;
969 	else {
970 		if (!L_ECHO(tty)) {
971 			ldata->read_head = ldata->canon_head;
972 			return;
973 		}
974 		if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
975 			ldata->read_head = ldata->canon_head;
976 			finish_erasing(ldata);
977 			echo_char(KILL_CHAR(tty), tty);
978 			/* Add a newline if ECHOK is on and ECHOKE is off. */
979 			if (L_ECHOK(tty))
980 				echo_char_raw('\n', ldata);
981 			return;
982 		}
983 		kill_type = KILL;
984 	}
985 
986 	seen_alnums = 0;
987 	while (MASK(ldata->read_head) != MASK(ldata->canon_head)) {
988 		head = ldata->read_head;
989 
990 		/* erase a single possibly multibyte character */
991 		do {
992 			head--;
993 			c = read_buf(ldata, head);
994 		} while (is_continuation(c, tty) &&
995 			 MASK(head) != MASK(ldata->canon_head));
996 
997 		/* do not partially erase */
998 		if (is_continuation(c, tty))
999 			break;
1000 
1001 		if (kill_type == WERASE) {
1002 			/* Equivalent to BSD's ALTWERASE. */
1003 			if (isalnum(c) || c == '_')
1004 				seen_alnums++;
1005 			else if (seen_alnums)
1006 				break;
1007 		}
1008 		cnt = ldata->read_head - head;
1009 		ldata->read_head = head;
1010 		if (L_ECHO(tty)) {
1011 			if (L_ECHOPRT(tty)) {
1012 				if (!ldata->erasing) {
1013 					echo_char_raw('\\', ldata);
1014 					ldata->erasing = 1;
1015 				}
1016 				/* if cnt > 1, output a multi-byte character */
1017 				echo_char(c, tty);
1018 				while (--cnt > 0) {
1019 					head++;
1020 					echo_char_raw(read_buf(ldata, head), ldata);
1021 					echo_move_back_col(ldata);
1022 				}
1023 			} else if (kill_type == ERASE && !L_ECHOE(tty)) {
1024 				echo_char(ERASE_CHAR(tty), tty);
1025 			} else if (c == '\t') {
1026 				unsigned int num_chars = 0;
1027 				int after_tab = 0;
1028 				size_t tail = ldata->read_head;
1029 
1030 				/*
1031 				 * Count the columns used for characters
1032 				 * since the start of input or after a
1033 				 * previous tab.
1034 				 * This info is used to go back the correct
1035 				 * number of columns.
1036 				 */
1037 				while (MASK(tail) != MASK(ldata->canon_head)) {
1038 					tail--;
1039 					c = read_buf(ldata, tail);
1040 					if (c == '\t') {
1041 						after_tab = 1;
1042 						break;
1043 					} else if (iscntrl(c)) {
1044 						if (L_ECHOCTL(tty))
1045 							num_chars += 2;
1046 					} else if (!is_continuation(c, tty)) {
1047 						num_chars++;
1048 					}
1049 				}
1050 				echo_erase_tab(num_chars, after_tab, ldata);
1051 			} else {
1052 				if (iscntrl(c) && L_ECHOCTL(tty)) {
1053 					echo_char_raw('\b', ldata);
1054 					echo_char_raw(' ', ldata);
1055 					echo_char_raw('\b', ldata);
1056 				}
1057 				if (!iscntrl(c) || L_ECHOCTL(tty)) {
1058 					echo_char_raw('\b', ldata);
1059 					echo_char_raw(' ', ldata);
1060 					echo_char_raw('\b', ldata);
1061 				}
1062 			}
1063 		}
1064 		if (kill_type == ERASE)
1065 			break;
1066 	}
1067 	if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
1068 		finish_erasing(ldata);
1069 }
1070 
1071 
1072 static void __isig(int sig, struct tty_struct *tty)
1073 {
1074 	struct pid *tty_pgrp = tty_get_pgrp(tty);
1075 	if (tty_pgrp) {
1076 		kill_pgrp(tty_pgrp, sig, 1);
1077 		put_pid(tty_pgrp);
1078 	}
1079 }
1080 
1081 /**
1082  * isig			-	handle the ISIG optio
1083  * @sig: signal
1084  * @tty: terminal
1085  *
1086  * Called when a signal is being sent due to terminal input. Called from the
1087  * &tty_driver.receive_buf() path, so serialized.
1088  *
1089  * Performs input and output flush if !NOFLSH. In this context, the echo
1090  * buffer is 'output'. The signal is processed first to alert any current
1091  * readers or writers to discontinue and exit their i/o loops.
1092  *
1093  * Locking: %ctrl.lock
1094  */
1095 static void isig(int sig, struct tty_struct *tty)
1096 {
1097 	struct n_tty_data *ldata = tty->disc_data;
1098 
1099 	if (L_NOFLSH(tty)) {
1100 		/* signal only */
1101 		__isig(sig, tty);
1102 
1103 	} else { /* signal and flush */
1104 		up_read(&tty->termios_rwsem);
1105 		down_write(&tty->termios_rwsem);
1106 
1107 		__isig(sig, tty);
1108 
1109 		/* clear echo buffer */
1110 		mutex_lock(&ldata->output_lock);
1111 		ldata->echo_head = ldata->echo_tail = 0;
1112 		ldata->echo_mark = ldata->echo_commit = 0;
1113 		mutex_unlock(&ldata->output_lock);
1114 
1115 		/* clear output buffer */
1116 		tty_driver_flush_buffer(tty);
1117 
1118 		/* clear input buffer */
1119 		reset_buffer_flags(tty->disc_data);
1120 
1121 		/* notify pty master of flush */
1122 		if (tty->link)
1123 			n_tty_packet_mode_flush(tty);
1124 
1125 		up_write(&tty->termios_rwsem);
1126 		down_read(&tty->termios_rwsem);
1127 	}
1128 }
1129 
1130 /**
1131  * n_tty_receive_break	-	handle break
1132  * @tty: terminal
1133  *
1134  * An RS232 break event has been hit in the incoming bitstream. This can cause
1135  * a variety of events depending upon the termios settings.
1136  *
1137  * Locking: n_tty_receive_buf()/producer path:
1138  *	caller holds non-exclusive termios_rwsem
1139  *
1140  * Note: may get exclusive %termios_rwsem if flushing input buffer
1141  */
1142 static void n_tty_receive_break(struct tty_struct *tty)
1143 {
1144 	struct n_tty_data *ldata = tty->disc_data;
1145 
1146 	if (I_IGNBRK(tty))
1147 		return;
1148 	if (I_BRKINT(tty)) {
1149 		isig(SIGINT, tty);
1150 		return;
1151 	}
1152 	if (I_PARMRK(tty)) {
1153 		put_tty_queue('\377', ldata);
1154 		put_tty_queue('\0', ldata);
1155 	}
1156 	put_tty_queue('\0', ldata);
1157 }
1158 
1159 /**
1160  * n_tty_receive_overrun	-	handle overrun reporting
1161  * @tty: terminal
1162  *
1163  * Data arrived faster than we could process it. While the tty driver has
1164  * flagged this the bits that were missed are gone forever.
1165  *
1166  * Called from the receive_buf path so single threaded. Does not need locking
1167  * as num_overrun and overrun_time are function private.
1168  */
1169 static void n_tty_receive_overrun(struct tty_struct *tty)
1170 {
1171 	struct n_tty_data *ldata = tty->disc_data;
1172 
1173 	ldata->num_overrun++;
1174 	if (time_after(jiffies, ldata->overrun_time + HZ) ||
1175 			time_after(ldata->overrun_time, jiffies)) {
1176 		tty_warn(tty, "%d input overrun(s)\n", ldata->num_overrun);
1177 		ldata->overrun_time = jiffies;
1178 		ldata->num_overrun = 0;
1179 	}
1180 }
1181 
1182 /**
1183  * n_tty_receive_parity_error	-	error notifier
1184  * @tty: terminal device
1185  * @c: character
1186  *
1187  * Process a parity error and queue the right data to indicate the error case
1188  * if necessary.
1189  *
1190  * Locking: n_tty_receive_buf()/producer path:
1191  * 	caller holds non-exclusive %termios_rwsem
1192  */
1193 static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c)
1194 {
1195 	struct n_tty_data *ldata = tty->disc_data;
1196 
1197 	if (I_INPCK(tty)) {
1198 		if (I_IGNPAR(tty))
1199 			return;
1200 		if (I_PARMRK(tty)) {
1201 			put_tty_queue('\377', ldata);
1202 			put_tty_queue('\0', ldata);
1203 			put_tty_queue(c, ldata);
1204 		} else
1205 			put_tty_queue('\0', ldata);
1206 	} else
1207 		put_tty_queue(c, ldata);
1208 }
1209 
1210 static void
1211 n_tty_receive_signal_char(struct tty_struct *tty, int signal, unsigned char c)
1212 {
1213 	isig(signal, tty);
1214 	if (I_IXON(tty))
1215 		start_tty(tty);
1216 	if (L_ECHO(tty)) {
1217 		echo_char(c, tty);
1218 		commit_echoes(tty);
1219 	} else
1220 		process_echoes(tty);
1221 }
1222 
1223 static void n_tty_receive_char_special(struct tty_struct *tty, unsigned char c)
1224 {
1225 	struct n_tty_data *ldata = tty->disc_data;
1226 
1227 	if (I_IXON(tty)) {
1228 		if (c == START_CHAR(tty)) {
1229 			start_tty(tty);
1230 			process_echoes(tty);
1231 			return;
1232 		}
1233 		if (c == STOP_CHAR(tty)) {
1234 			stop_tty(tty);
1235 			return;
1236 		}
1237 	}
1238 
1239 	if (L_ISIG(tty)) {
1240 		if (c == INTR_CHAR(tty)) {
1241 			n_tty_receive_signal_char(tty, SIGINT, c);
1242 			return;
1243 		} else if (c == QUIT_CHAR(tty)) {
1244 			n_tty_receive_signal_char(tty, SIGQUIT, c);
1245 			return;
1246 		} else if (c == SUSP_CHAR(tty)) {
1247 			n_tty_receive_signal_char(tty, SIGTSTP, c);
1248 			return;
1249 		}
1250 	}
1251 
1252 	if (tty->flow.stopped && !tty->flow.tco_stopped && I_IXON(tty) && I_IXANY(tty)) {
1253 		start_tty(tty);
1254 		process_echoes(tty);
1255 	}
1256 
1257 	if (c == '\r') {
1258 		if (I_IGNCR(tty))
1259 			return;
1260 		if (I_ICRNL(tty))
1261 			c = '\n';
1262 	} else if (c == '\n' && I_INLCR(tty))
1263 		c = '\r';
1264 
1265 	if (ldata->icanon) {
1266 		if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
1267 		    (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
1268 			eraser(c, tty);
1269 			commit_echoes(tty);
1270 			return;
1271 		}
1272 		if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
1273 			ldata->lnext = 1;
1274 			if (L_ECHO(tty)) {
1275 				finish_erasing(ldata);
1276 				if (L_ECHOCTL(tty)) {
1277 					echo_char_raw('^', ldata);
1278 					echo_char_raw('\b', ldata);
1279 					commit_echoes(tty);
1280 				}
1281 			}
1282 			return;
1283 		}
1284 		if (c == REPRINT_CHAR(tty) && L_ECHO(tty) && L_IEXTEN(tty)) {
1285 			size_t tail = ldata->canon_head;
1286 
1287 			finish_erasing(ldata);
1288 			echo_char(c, tty);
1289 			echo_char_raw('\n', ldata);
1290 			while (MASK(tail) != MASK(ldata->read_head)) {
1291 				echo_char(read_buf(ldata, tail), tty);
1292 				tail++;
1293 			}
1294 			commit_echoes(tty);
1295 			return;
1296 		}
1297 		if (c == '\n') {
1298 			if (L_ECHO(tty) || L_ECHONL(tty)) {
1299 				echo_char_raw('\n', ldata);
1300 				commit_echoes(tty);
1301 			}
1302 			goto handle_newline;
1303 		}
1304 		if (c == EOF_CHAR(tty)) {
1305 			c = __DISABLED_CHAR;
1306 			goto handle_newline;
1307 		}
1308 		if ((c == EOL_CHAR(tty)) ||
1309 		    (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
1310 			/*
1311 			 * XXX are EOL_CHAR and EOL2_CHAR echoed?!?
1312 			 */
1313 			if (L_ECHO(tty)) {
1314 				/* Record the column of first canon char. */
1315 				if (ldata->canon_head == ldata->read_head)
1316 					echo_set_canon_col(ldata);
1317 				echo_char(c, tty);
1318 				commit_echoes(tty);
1319 			}
1320 			/*
1321 			 * XXX does PARMRK doubling happen for
1322 			 * EOL_CHAR and EOL2_CHAR?
1323 			 */
1324 			if (c == (unsigned char) '\377' && I_PARMRK(tty))
1325 				put_tty_queue(c, ldata);
1326 
1327 handle_newline:
1328 			set_bit(ldata->read_head & (N_TTY_BUF_SIZE - 1), ldata->read_flags);
1329 			put_tty_queue(c, ldata);
1330 			smp_store_release(&ldata->canon_head, ldata->read_head);
1331 			kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1332 			wake_up_interruptible_poll(&tty->read_wait, EPOLLIN | EPOLLRDNORM);
1333 			return;
1334 		}
1335 	}
1336 
1337 	if (L_ECHO(tty)) {
1338 		finish_erasing(ldata);
1339 		if (c == '\n')
1340 			echo_char_raw('\n', ldata);
1341 		else {
1342 			/* Record the column of first canon char. */
1343 			if (ldata->canon_head == ldata->read_head)
1344 				echo_set_canon_col(ldata);
1345 			echo_char(c, tty);
1346 		}
1347 		commit_echoes(tty);
1348 	}
1349 
1350 	/* PARMRK doubling check */
1351 	if (c == (unsigned char) '\377' && I_PARMRK(tty))
1352 		put_tty_queue(c, ldata);
1353 
1354 	put_tty_queue(c, ldata);
1355 }
1356 
1357 /**
1358  * n_tty_receive_char	-	perform processing
1359  * @tty: terminal device
1360  * @c: character
1361  *
1362  * Process an individual character of input received from the driver.  This is
1363  * serialized with respect to itself by the rules for the driver above.
1364  *
1365  * Locking: n_tty_receive_buf()/producer path:
1366  *	caller holds non-exclusive %termios_rwsem
1367  *	publishes canon_head if canonical mode is active
1368  */
1369 static void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
1370 {
1371 	struct n_tty_data *ldata = tty->disc_data;
1372 
1373 	if (tty->flow.stopped && !tty->flow.tco_stopped && I_IXON(tty) && I_IXANY(tty)) {
1374 		start_tty(tty);
1375 		process_echoes(tty);
1376 	}
1377 	if (L_ECHO(tty)) {
1378 		finish_erasing(ldata);
1379 		/* Record the column of first canon char. */
1380 		if (ldata->canon_head == ldata->read_head)
1381 			echo_set_canon_col(ldata);
1382 		echo_char(c, tty);
1383 		commit_echoes(tty);
1384 	}
1385 	/* PARMRK doubling check */
1386 	if (c == (unsigned char) '\377' && I_PARMRK(tty))
1387 		put_tty_queue(c, ldata);
1388 	put_tty_queue(c, ldata);
1389 }
1390 
1391 static void n_tty_receive_char_closing(struct tty_struct *tty, unsigned char c)
1392 {
1393 	if (I_ISTRIP(tty))
1394 		c &= 0x7f;
1395 	if (I_IUCLC(tty) && L_IEXTEN(tty))
1396 		c = tolower(c);
1397 
1398 	if (I_IXON(tty)) {
1399 		if (c == STOP_CHAR(tty))
1400 			stop_tty(tty);
1401 		else if (c == START_CHAR(tty) ||
1402 			 (tty->flow.stopped && !tty->flow.tco_stopped && I_IXANY(tty) &&
1403 			  c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) &&
1404 			  c != SUSP_CHAR(tty))) {
1405 			start_tty(tty);
1406 			process_echoes(tty);
1407 		}
1408 	}
1409 }
1410 
1411 static void
1412 n_tty_receive_char_flagged(struct tty_struct *tty, unsigned char c, char flag)
1413 {
1414 	switch (flag) {
1415 	case TTY_BREAK:
1416 		n_tty_receive_break(tty);
1417 		break;
1418 	case TTY_PARITY:
1419 	case TTY_FRAME:
1420 		n_tty_receive_parity_error(tty, c);
1421 		break;
1422 	case TTY_OVERRUN:
1423 		n_tty_receive_overrun(tty);
1424 		break;
1425 	default:
1426 		tty_err(tty, "unknown flag %d\n", flag);
1427 		break;
1428 	}
1429 }
1430 
1431 static void
1432 n_tty_receive_char_lnext(struct tty_struct *tty, unsigned char c, char flag)
1433 {
1434 	struct n_tty_data *ldata = tty->disc_data;
1435 
1436 	ldata->lnext = 0;
1437 	if (likely(flag == TTY_NORMAL)) {
1438 		if (I_ISTRIP(tty))
1439 			c &= 0x7f;
1440 		if (I_IUCLC(tty) && L_IEXTEN(tty))
1441 			c = tolower(c);
1442 		n_tty_receive_char(tty, c);
1443 	} else
1444 		n_tty_receive_char_flagged(tty, c, flag);
1445 }
1446 
1447 static void
1448 n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
1449 			   const char *fp, int count)
1450 {
1451 	struct n_tty_data *ldata = tty->disc_data;
1452 	size_t n, head;
1453 
1454 	head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1455 	n = min_t(size_t, count, N_TTY_BUF_SIZE - head);
1456 	memcpy(read_buf_addr(ldata, head), cp, n);
1457 	ldata->read_head += n;
1458 	cp += n;
1459 	count -= n;
1460 
1461 	head = ldata->read_head & (N_TTY_BUF_SIZE - 1);
1462 	n = min_t(size_t, count, N_TTY_BUF_SIZE - head);
1463 	memcpy(read_buf_addr(ldata, head), cp, n);
1464 	ldata->read_head += n;
1465 }
1466 
1467 static void
1468 n_tty_receive_buf_raw(struct tty_struct *tty, const unsigned char *cp,
1469 		      const char *fp, int count)
1470 {
1471 	struct n_tty_data *ldata = tty->disc_data;
1472 	char flag = TTY_NORMAL;
1473 
1474 	while (count--) {
1475 		if (fp)
1476 			flag = *fp++;
1477 		if (likely(flag == TTY_NORMAL))
1478 			put_tty_queue(*cp++, ldata);
1479 		else
1480 			n_tty_receive_char_flagged(tty, *cp++, flag);
1481 	}
1482 }
1483 
1484 static void
1485 n_tty_receive_buf_closing(struct tty_struct *tty, const unsigned char *cp,
1486 			  const char *fp, int count)
1487 {
1488 	char flag = TTY_NORMAL;
1489 
1490 	while (count--) {
1491 		if (fp)
1492 			flag = *fp++;
1493 		if (likely(flag == TTY_NORMAL))
1494 			n_tty_receive_char_closing(tty, *cp++);
1495 	}
1496 }
1497 
1498 static void n_tty_receive_buf_standard(struct tty_struct *tty,
1499 		const unsigned char *cp, const char *fp, int count)
1500 {
1501 	struct n_tty_data *ldata = tty->disc_data;
1502 	char flag = TTY_NORMAL;
1503 
1504 	while (count--) {
1505 		unsigned char c = *cp++;
1506 
1507 		if (fp)
1508 			flag = *fp++;
1509 
1510 		if (ldata->lnext) {
1511 			n_tty_receive_char_lnext(tty, c, flag);
1512 			continue;
1513 		}
1514 
1515 		if (unlikely(flag != TTY_NORMAL)) {
1516 			n_tty_receive_char_flagged(tty, c, flag);
1517 			continue;
1518 		}
1519 
1520 		if (I_ISTRIP(tty))
1521 			c &= 0x7f;
1522 		if (I_IUCLC(tty) && L_IEXTEN(tty))
1523 			c = tolower(c);
1524 		if (L_EXTPROC(tty)) {
1525 			put_tty_queue(c, ldata);
1526 			continue;
1527 		}
1528 
1529 		if (test_bit(c, ldata->char_map))
1530 			n_tty_receive_char_special(tty, c);
1531 		else
1532 			n_tty_receive_char(tty, c);
1533 	}
1534 }
1535 
1536 static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
1537 			  const char *fp, int count)
1538 {
1539 	struct n_tty_data *ldata = tty->disc_data;
1540 	bool preops = I_ISTRIP(tty) || (I_IUCLC(tty) && L_IEXTEN(tty));
1541 
1542 	if (ldata->real_raw)
1543 		n_tty_receive_buf_real_raw(tty, cp, fp, count);
1544 	else if (ldata->raw || (L_EXTPROC(tty) && !preops))
1545 		n_tty_receive_buf_raw(tty, cp, fp, count);
1546 	else if (tty->closing && !L_EXTPROC(tty))
1547 		n_tty_receive_buf_closing(tty, cp, fp, count);
1548 	else {
1549 		n_tty_receive_buf_standard(tty, cp, fp, count);
1550 
1551 		flush_echoes(tty);
1552 		if (tty->ops->flush_chars)
1553 			tty->ops->flush_chars(tty);
1554 	}
1555 
1556 	if (ldata->icanon && !L_EXTPROC(tty))
1557 		return;
1558 
1559 	/* publish read_head to consumer */
1560 	smp_store_release(&ldata->commit_head, ldata->read_head);
1561 
1562 	if (read_cnt(ldata)) {
1563 		kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1564 		wake_up_interruptible_poll(&tty->read_wait, EPOLLIN | EPOLLRDNORM);
1565 	}
1566 }
1567 
1568 /**
1569  * n_tty_receive_buf_common	-	process input
1570  * @tty: device to receive input
1571  * @cp: input chars
1572  * @fp: flags for each char (if %NULL, all chars are %TTY_NORMAL)
1573  * @count: number of input chars in @cp
1574  * @flow: enable flow control
1575  *
1576  * Called by the terminal driver when a block of characters has been received.
1577  * This function must be called from soft contexts not from interrupt context.
1578  * The driver is responsible for making calls one at a time and in order (or
1579  * using flush_to_ldisc()).
1580  *
1581  * Returns: the # of input chars from @cp which were processed.
1582  *
1583  * In canonical mode, the maximum line length is 4096 chars (including the line
1584  * termination char); lines longer than 4096 chars are truncated. After 4095
1585  * chars, input data is still processed but not stored. Overflow processing
1586  * ensures the tty can always receive more input until at least one line can be
1587  * read.
1588  *
1589  * In non-canonical mode, the read buffer will only accept 4095 chars; this
1590  * provides the necessary space for a newline char if the input mode is
1591  * switched to canonical.
1592  *
1593  * Note it is possible for the read buffer to _contain_ 4096 chars in
1594  * non-canonical mode: the read buffer could already contain the maximum canon
1595  * line of 4096 chars when the mode is switched to non-canonical.
1596  *
1597  * Locking: n_tty_receive_buf()/producer path:
1598  *	claims non-exclusive %termios_rwsem
1599  *	publishes commit_head or canon_head
1600  */
1601 static int
1602 n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
1603 			 const char *fp, int count, int flow)
1604 {
1605 	struct n_tty_data *ldata = tty->disc_data;
1606 	int room, n, rcvd = 0, overflow;
1607 
1608 	down_read(&tty->termios_rwsem);
1609 
1610 	do {
1611 		/*
1612 		 * When PARMRK is set, each input char may take up to 3 chars
1613 		 * in the read buf; reduce the buffer space avail by 3x
1614 		 *
1615 		 * If we are doing input canonicalization, and there are no
1616 		 * pending newlines, let characters through without limit, so
1617 		 * that erase characters will be handled.  Other excess
1618 		 * characters will be beeped.
1619 		 *
1620 		 * paired with store in *_copy_from_read_buf() -- guarantees
1621 		 * the consumer has loaded the data in read_buf up to the new
1622 		 * read_tail (so this producer will not overwrite unread data)
1623 		 */
1624 		size_t tail = smp_load_acquire(&ldata->read_tail);
1625 
1626 		room = N_TTY_BUF_SIZE - (ldata->read_head - tail);
1627 		if (I_PARMRK(tty))
1628 			room = (room + 2) / 3;
1629 		room--;
1630 		if (room <= 0) {
1631 			overflow = ldata->icanon && ldata->canon_head == tail;
1632 			if (overflow && room < 0)
1633 				ldata->read_head--;
1634 			room = overflow;
1635 			ldata->no_room = flow && !room;
1636 		} else
1637 			overflow = 0;
1638 
1639 		n = min(count, room);
1640 		if (!n)
1641 			break;
1642 
1643 		/* ignore parity errors if handling overflow */
1644 		if (!overflow || !fp || *fp != TTY_PARITY)
1645 			__receive_buf(tty, cp, fp, n);
1646 
1647 		cp += n;
1648 		if (fp)
1649 			fp += n;
1650 		count -= n;
1651 		rcvd += n;
1652 	} while (!test_bit(TTY_LDISC_CHANGING, &tty->flags));
1653 
1654 	tty->receive_room = room;
1655 
1656 	/* Unthrottle if handling overflow on pty */
1657 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
1658 		if (overflow) {
1659 			tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
1660 			tty_unthrottle_safe(tty);
1661 			__tty_set_flow_change(tty, 0);
1662 		}
1663 	} else
1664 		n_tty_check_throttle(tty);
1665 
1666 	up_read(&tty->termios_rwsem);
1667 
1668 	return rcvd;
1669 }
1670 
1671 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
1672 			      const char *fp, int count)
1673 {
1674 	n_tty_receive_buf_common(tty, cp, fp, count, 0);
1675 }
1676 
1677 static int n_tty_receive_buf2(struct tty_struct *tty, const unsigned char *cp,
1678 			      const char *fp, int count)
1679 {
1680 	return n_tty_receive_buf_common(tty, cp, fp, count, 1);
1681 }
1682 
1683 /**
1684  * n_tty_set_termios	-	termios data changed
1685  * @tty: terminal
1686  * @old: previous data
1687  *
1688  * Called by the tty layer when the user changes termios flags so that the line
1689  * discipline can plan ahead. This function cannot sleep and is protected from
1690  * re-entry by the tty layer. The user is guaranteed that this function will
1691  * not be re-entered or in progress when the ldisc is closed.
1692  *
1693  * Locking: Caller holds @tty->termios_rwsem
1694  */
1695 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
1696 {
1697 	struct n_tty_data *ldata = tty->disc_data;
1698 
1699 	if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) {
1700 		bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
1701 		ldata->line_start = ldata->read_tail;
1702 		if (!L_ICANON(tty) || !read_cnt(ldata)) {
1703 			ldata->canon_head = ldata->read_tail;
1704 			ldata->push = 0;
1705 		} else {
1706 			set_bit((ldata->read_head - 1) & (N_TTY_BUF_SIZE - 1),
1707 				ldata->read_flags);
1708 			ldata->canon_head = ldata->read_head;
1709 			ldata->push = 1;
1710 		}
1711 		ldata->commit_head = ldata->read_head;
1712 		ldata->erasing = 0;
1713 		ldata->lnext = 0;
1714 	}
1715 
1716 	ldata->icanon = (L_ICANON(tty) != 0);
1717 
1718 	if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
1719 	    I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
1720 	    I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
1721 	    I_PARMRK(tty)) {
1722 		bitmap_zero(ldata->char_map, 256);
1723 
1724 		if (I_IGNCR(tty) || I_ICRNL(tty))
1725 			set_bit('\r', ldata->char_map);
1726 		if (I_INLCR(tty))
1727 			set_bit('\n', ldata->char_map);
1728 
1729 		if (L_ICANON(tty)) {
1730 			set_bit(ERASE_CHAR(tty), ldata->char_map);
1731 			set_bit(KILL_CHAR(tty), ldata->char_map);
1732 			set_bit(EOF_CHAR(tty), ldata->char_map);
1733 			set_bit('\n', ldata->char_map);
1734 			set_bit(EOL_CHAR(tty), ldata->char_map);
1735 			if (L_IEXTEN(tty)) {
1736 				set_bit(WERASE_CHAR(tty), ldata->char_map);
1737 				set_bit(LNEXT_CHAR(tty), ldata->char_map);
1738 				set_bit(EOL2_CHAR(tty), ldata->char_map);
1739 				if (L_ECHO(tty))
1740 					set_bit(REPRINT_CHAR(tty),
1741 						ldata->char_map);
1742 			}
1743 		}
1744 		if (I_IXON(tty)) {
1745 			set_bit(START_CHAR(tty), ldata->char_map);
1746 			set_bit(STOP_CHAR(tty), ldata->char_map);
1747 		}
1748 		if (L_ISIG(tty)) {
1749 			set_bit(INTR_CHAR(tty), ldata->char_map);
1750 			set_bit(QUIT_CHAR(tty), ldata->char_map);
1751 			set_bit(SUSP_CHAR(tty), ldata->char_map);
1752 		}
1753 		clear_bit(__DISABLED_CHAR, ldata->char_map);
1754 		ldata->raw = 0;
1755 		ldata->real_raw = 0;
1756 	} else {
1757 		ldata->raw = 1;
1758 		if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1759 		    (I_IGNPAR(tty) || !I_INPCK(tty)) &&
1760 		    (tty->driver->flags & TTY_DRIVER_REAL_RAW))
1761 			ldata->real_raw = 1;
1762 		else
1763 			ldata->real_raw = 0;
1764 	}
1765 	/*
1766 	 * Fix tty hang when I_IXON(tty) is cleared, but the tty
1767 	 * been stopped by STOP_CHAR(tty) before it.
1768 	 */
1769 	if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow.tco_stopped) {
1770 		start_tty(tty);
1771 		process_echoes(tty);
1772 	}
1773 
1774 	/* The termios change make the tty ready for I/O */
1775 	wake_up_interruptible(&tty->write_wait);
1776 	wake_up_interruptible(&tty->read_wait);
1777 }
1778 
1779 /**
1780  * n_tty_close		-	close the ldisc for this tty
1781  * @tty: device
1782  *
1783  * Called from the terminal layer when this line discipline is being shut down,
1784  * either because of a close or becsuse of a discipline change. The function
1785  * will not be called while other ldisc methods are in progress.
1786  */
1787 static void n_tty_close(struct tty_struct *tty)
1788 {
1789 	struct n_tty_data *ldata = tty->disc_data;
1790 
1791 	if (tty->link)
1792 		n_tty_packet_mode_flush(tty);
1793 
1794 	down_write(&tty->termios_rwsem);
1795 	vfree(ldata);
1796 	tty->disc_data = NULL;
1797 	up_write(&tty->termios_rwsem);
1798 }
1799 
1800 /**
1801  * n_tty_open		-	open an ldisc
1802  * @tty: terminal to open
1803  *
1804  * Called when this line discipline is being attached to the terminal device.
1805  * Can sleep. Called serialized so that no other events will occur in parallel.
1806  * No further open will occur until a close.
1807  */
1808 static int n_tty_open(struct tty_struct *tty)
1809 {
1810 	struct n_tty_data *ldata;
1811 
1812 	/* Currently a malloc failure here can panic */
1813 	ldata = vzalloc(sizeof(*ldata));
1814 	if (!ldata)
1815 		return -ENOMEM;
1816 
1817 	ldata->overrun_time = jiffies;
1818 	mutex_init(&ldata->atomic_read_lock);
1819 	mutex_init(&ldata->output_lock);
1820 
1821 	tty->disc_data = ldata;
1822 	tty->closing = 0;
1823 	/* indicate buffer work may resume */
1824 	clear_bit(TTY_LDISC_HALTED, &tty->flags);
1825 	n_tty_set_termios(tty, NULL);
1826 	tty_unthrottle(tty);
1827 	return 0;
1828 }
1829 
1830 static inline int input_available_p(struct tty_struct *tty, int poll)
1831 {
1832 	struct n_tty_data *ldata = tty->disc_data;
1833 	int amt = poll && !TIME_CHAR(tty) && MIN_CHAR(tty) ? MIN_CHAR(tty) : 1;
1834 
1835 	if (ldata->icanon && !L_EXTPROC(tty))
1836 		return ldata->canon_head != ldata->read_tail;
1837 	else
1838 		return ldata->commit_head - ldata->read_tail >= amt;
1839 }
1840 
1841 /**
1842  * copy_from_read_buf	-	copy read data directly
1843  * @tty: terminal device
1844  * @kbp: data
1845  * @nr: size of data
1846  *
1847  * Helper function to speed up n_tty_read(). It is only called when %ICANON is
1848  * off; it copies characters straight from the tty queue.
1849  *
1850  * Returns: true if it successfully copied data, but there is still more data
1851  * to be had.
1852  *
1853  * Locking:
1854  *  * called under the @ldata->atomic_read_lock sem
1855  *  * n_tty_read()/consumer path:
1856  *		caller holds non-exclusive %termios_rwsem;
1857  *		read_tail published
1858  */
1859 static bool copy_from_read_buf(struct tty_struct *tty,
1860 				      unsigned char **kbp,
1861 				      size_t *nr)
1862 
1863 {
1864 	struct n_tty_data *ldata = tty->disc_data;
1865 	size_t n;
1866 	bool is_eof;
1867 	size_t head = smp_load_acquire(&ldata->commit_head);
1868 	size_t tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1869 
1870 	n = min(head - ldata->read_tail, N_TTY_BUF_SIZE - tail);
1871 	n = min(*nr, n);
1872 	if (n) {
1873 		unsigned char *from = read_buf_addr(ldata, tail);
1874 		memcpy(*kbp, from, n);
1875 		is_eof = n == 1 && *from == EOF_CHAR(tty);
1876 		tty_audit_add_data(tty, from, n);
1877 		zero_buffer(tty, from, n);
1878 		smp_store_release(&ldata->read_tail, ldata->read_tail + n);
1879 		/* Turn single EOF into zero-length read */
1880 		if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
1881 		    (head == ldata->read_tail))
1882 			return false;
1883 		*kbp += n;
1884 		*nr -= n;
1885 
1886 		/* If we have more to copy, let the caller know */
1887 		return head != ldata->read_tail;
1888 	}
1889 	return false;
1890 }
1891 
1892 /**
1893  * canon_copy_from_read_buf	-	copy read data in canonical mode
1894  * @tty: terminal device
1895  * @kbp: data
1896  * @nr: size of data
1897  *
1898  * Helper function for n_tty_read(). It is only called when %ICANON is on; it
1899  * copies one line of input up to and including the line-delimiting character
1900  * into the result buffer.
1901  *
1902  * Note: When termios is changed from non-canonical to canonical mode and the
1903  * read buffer contains data, n_tty_set_termios() simulates an EOF push (as if
1904  * C-d were input) _without_ the %DISABLED_CHAR in the buffer. This causes data
1905  * already processed as input to be immediately available as input although a
1906  * newline has not been received.
1907  *
1908  * Locking:
1909  *  * called under the %atomic_read_lock mutex
1910  *  * n_tty_read()/consumer path:
1911  *	caller holds non-exclusive %termios_rwsem;
1912  *	read_tail published
1913  */
1914 static bool canon_copy_from_read_buf(struct tty_struct *tty,
1915 				     unsigned char **kbp,
1916 				     size_t *nr)
1917 {
1918 	struct n_tty_data *ldata = tty->disc_data;
1919 	size_t n, size, more, c;
1920 	size_t eol;
1921 	size_t tail, canon_head;
1922 	int found = 0;
1923 
1924 	/* N.B. avoid overrun if nr == 0 */
1925 	if (!*nr)
1926 		return false;
1927 
1928 	canon_head = smp_load_acquire(&ldata->canon_head);
1929 	n = min(*nr, canon_head - ldata->read_tail);
1930 
1931 	tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
1932 	size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
1933 
1934 	n_tty_trace("%s: nr:%zu tail:%zu n:%zu size:%zu\n",
1935 		    __func__, *nr, tail, n, size);
1936 
1937 	eol = find_next_bit(ldata->read_flags, size, tail);
1938 	more = n - (size - tail);
1939 	if (eol == N_TTY_BUF_SIZE && more) {
1940 		/* scan wrapped without finding set bit */
1941 		eol = find_first_bit(ldata->read_flags, more);
1942 		found = eol != more;
1943 	} else
1944 		found = eol != size;
1945 
1946 	n = eol - tail;
1947 	if (n > N_TTY_BUF_SIZE)
1948 		n += N_TTY_BUF_SIZE;
1949 	c = n + found;
1950 
1951 	if (!found || read_buf(ldata, eol) != __DISABLED_CHAR)
1952 		n = c;
1953 
1954 	n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu tail:%zu more:%zu\n",
1955 		    __func__, eol, found, n, c, tail, more);
1956 
1957 	tty_copy(tty, *kbp, tail, n);
1958 	*kbp += n;
1959 	*nr -= n;
1960 
1961 	if (found)
1962 		clear_bit(eol, ldata->read_flags);
1963 	smp_store_release(&ldata->read_tail, ldata->read_tail + c);
1964 
1965 	if (found) {
1966 		if (!ldata->push)
1967 			ldata->line_start = ldata->read_tail;
1968 		else
1969 			ldata->push = 0;
1970 		tty_audit_push();
1971 		return false;
1972 	}
1973 
1974 	/* No EOL found - do a continuation retry if there is more data */
1975 	return ldata->read_tail != canon_head;
1976 }
1977 
1978 /**
1979  * job_control		-	check job control
1980  * @tty: tty
1981  * @file: file handle
1982  *
1983  * Perform job control management checks on this @file/@tty descriptor and if
1984  * appropriate send any needed signals and return a negative error code if
1985  * action should be taken.
1986  *
1987  * Locking:
1988  *  * redirected write test is safe
1989  *  * current->signal->tty check is safe
1990  *  * ctrl.lock to safely reference @tty->ctrl.pgrp
1991  */
1992 static int job_control(struct tty_struct *tty, struct file *file)
1993 {
1994 	/* Job control check -- must be done at start and after
1995 	   every sleep (POSIX.1 7.1.1.4). */
1996 	/* NOTE: not yet done after every sleep pending a thorough
1997 	   check of the logic of this change. -- jlc */
1998 	/* don't stop on /dev/console */
1999 	if (file->f_op->write_iter == redirected_tty_write)
2000 		return 0;
2001 
2002 	return __tty_check_change(tty, SIGTTIN);
2003 }
2004 
2005 
2006 /**
2007  * n_tty_read		-	read function for tty
2008  * @tty: tty device
2009  * @file: file object
2010  * @kbuf: kernelspace buffer pointer
2011  * @nr: size of I/O
2012  * @cookie: if non-%NULL, this is a continuation read
2013  * @offset: where to continue reading from (unused in n_tty)
2014  *
2015  * Perform reads for the line discipline. We are guaranteed that the line
2016  * discipline will not be closed under us but we may get multiple parallel
2017  * readers and must handle this ourselves. We may also get a hangup. Always
2018  * called in user context, may sleep.
2019  *
2020  * This code must be sure never to sleep through a hangup.
2021  *
2022  * Locking: n_tty_read()/consumer path:
2023  *	claims non-exclusive termios_rwsem;
2024  *	publishes read_tail
2025  */
2026 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
2027 			  unsigned char *kbuf, size_t nr,
2028 			  void **cookie, unsigned long offset)
2029 {
2030 	struct n_tty_data *ldata = tty->disc_data;
2031 	unsigned char *kb = kbuf;
2032 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2033 	int c;
2034 	int minimum, time;
2035 	ssize_t retval = 0;
2036 	long timeout;
2037 	bool packet;
2038 	size_t tail;
2039 
2040 	/*
2041 	 * Is this a continuation of a read started earler?
2042 	 *
2043 	 * If so, we still hold the atomic_read_lock and the
2044 	 * termios_rwsem, and can just continue to copy data.
2045 	 */
2046 	if (*cookie) {
2047 		if (ldata->icanon && !L_EXTPROC(tty)) {
2048 			if (canon_copy_from_read_buf(tty, &kb, &nr))
2049 				return kb - kbuf;
2050 		} else {
2051 			if (copy_from_read_buf(tty, &kb, &nr))
2052 				return kb - kbuf;
2053 		}
2054 
2055 		/* No more data - release locks and stop retries */
2056 		n_tty_kick_worker(tty);
2057 		n_tty_check_unthrottle(tty);
2058 		up_read(&tty->termios_rwsem);
2059 		mutex_unlock(&ldata->atomic_read_lock);
2060 		*cookie = NULL;
2061 		return kb - kbuf;
2062 	}
2063 
2064 	c = job_control(tty, file);
2065 	if (c < 0)
2066 		return c;
2067 
2068 	/*
2069 	 *	Internal serialization of reads.
2070 	 */
2071 	if (file->f_flags & O_NONBLOCK) {
2072 		if (!mutex_trylock(&ldata->atomic_read_lock))
2073 			return -EAGAIN;
2074 	} else {
2075 		if (mutex_lock_interruptible(&ldata->atomic_read_lock))
2076 			return -ERESTARTSYS;
2077 	}
2078 
2079 	down_read(&tty->termios_rwsem);
2080 
2081 	minimum = time = 0;
2082 	timeout = MAX_SCHEDULE_TIMEOUT;
2083 	if (!ldata->icanon) {
2084 		minimum = MIN_CHAR(tty);
2085 		if (minimum) {
2086 			time = (HZ / 10) * TIME_CHAR(tty);
2087 		} else {
2088 			timeout = (HZ / 10) * TIME_CHAR(tty);
2089 			minimum = 1;
2090 		}
2091 	}
2092 
2093 	packet = tty->ctrl.packet;
2094 	tail = ldata->read_tail;
2095 
2096 	add_wait_queue(&tty->read_wait, &wait);
2097 	while (nr) {
2098 		/* First test for status change. */
2099 		if (packet && tty->link->ctrl.pktstatus) {
2100 			unsigned char cs;
2101 			if (kb != kbuf)
2102 				break;
2103 			spin_lock_irq(&tty->link->ctrl.lock);
2104 			cs = tty->link->ctrl.pktstatus;
2105 			tty->link->ctrl.pktstatus = 0;
2106 			spin_unlock_irq(&tty->link->ctrl.lock);
2107 			*kb++ = cs;
2108 			nr--;
2109 			break;
2110 		}
2111 
2112 		if (!input_available_p(tty, 0)) {
2113 			up_read(&tty->termios_rwsem);
2114 			tty_buffer_flush_work(tty->port);
2115 			down_read(&tty->termios_rwsem);
2116 			if (!input_available_p(tty, 0)) {
2117 				if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
2118 					retval = -EIO;
2119 					break;
2120 				}
2121 				if (tty_hung_up_p(file))
2122 					break;
2123 				/*
2124 				 * Abort readers for ttys which never actually
2125 				 * get hung up.  See __tty_hangup().
2126 				 */
2127 				if (test_bit(TTY_HUPPING, &tty->flags))
2128 					break;
2129 				if (!timeout)
2130 					break;
2131 				if (tty_io_nonblock(tty, file)) {
2132 					retval = -EAGAIN;
2133 					break;
2134 				}
2135 				if (signal_pending(current)) {
2136 					retval = -ERESTARTSYS;
2137 					break;
2138 				}
2139 				up_read(&tty->termios_rwsem);
2140 
2141 				timeout = wait_woken(&wait, TASK_INTERRUPTIBLE,
2142 						timeout);
2143 
2144 				down_read(&tty->termios_rwsem);
2145 				continue;
2146 			}
2147 		}
2148 
2149 		if (ldata->icanon && !L_EXTPROC(tty)) {
2150 			if (canon_copy_from_read_buf(tty, &kb, &nr))
2151 				goto more_to_be_read;
2152 		} else {
2153 			/* Deal with packet mode. */
2154 			if (packet && kb == kbuf) {
2155 				*kb++ = TIOCPKT_DATA;
2156 				nr--;
2157 			}
2158 
2159 			/*
2160 			 * Copy data, and if there is more to be had
2161 			 * and we have nothing more to wait for, then
2162 			 * let's mark us for retries.
2163 			 *
2164 			 * NOTE! We return here with both the termios_sem
2165 			 * and atomic_read_lock still held, the retries
2166 			 * will release them when done.
2167 			 */
2168 			if (copy_from_read_buf(tty, &kb, &nr) && kb - kbuf >= minimum) {
2169 more_to_be_read:
2170 				remove_wait_queue(&tty->read_wait, &wait);
2171 				*cookie = cookie;
2172 				return kb - kbuf;
2173 			}
2174 		}
2175 
2176 		n_tty_check_unthrottle(tty);
2177 
2178 		if (kb - kbuf >= minimum)
2179 			break;
2180 		if (time)
2181 			timeout = time;
2182 	}
2183 	if (tail != ldata->read_tail)
2184 		n_tty_kick_worker(tty);
2185 	up_read(&tty->termios_rwsem);
2186 
2187 	remove_wait_queue(&tty->read_wait, &wait);
2188 	mutex_unlock(&ldata->atomic_read_lock);
2189 
2190 	if (kb - kbuf)
2191 		retval = kb - kbuf;
2192 
2193 	return retval;
2194 }
2195 
2196 /**
2197  * n_tty_write		-	write function for tty
2198  * @tty: tty device
2199  * @file: file object
2200  * @buf: userspace buffer pointer
2201  * @nr: size of I/O
2202  *
2203  * Write function of the terminal device. This is serialized with respect to
2204  * other write callers but not to termios changes, reads and other such events.
2205  * Since the receive code will echo characters, thus calling driver write
2206  * methods, the %output_lock is used in the output processing functions called
2207  * here as well as in the echo processing function to protect the column state
2208  * and space left in the buffer.
2209  *
2210  * This code must be sure never to sleep through a hangup.
2211  *
2212  * Locking: output_lock to protect column state and space left
2213  *	 (note that the process_output*() functions take this lock themselves)
2214  */
2215 
2216 static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
2217 			   const unsigned char *buf, size_t nr)
2218 {
2219 	const unsigned char *b = buf;
2220 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2221 	int c;
2222 	ssize_t retval = 0;
2223 
2224 	/* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
2225 	if (L_TOSTOP(tty) && file->f_op->write_iter != redirected_tty_write) {
2226 		retval = tty_check_change(tty);
2227 		if (retval)
2228 			return retval;
2229 	}
2230 
2231 	down_read(&tty->termios_rwsem);
2232 
2233 	/* Write out any echoed characters that are still pending */
2234 	process_echoes(tty);
2235 
2236 	add_wait_queue(&tty->write_wait, &wait);
2237 	while (1) {
2238 		if (signal_pending(current)) {
2239 			retval = -ERESTARTSYS;
2240 			break;
2241 		}
2242 		if (tty_hung_up_p(file) || (tty->link && !tty->link->count)) {
2243 			retval = -EIO;
2244 			break;
2245 		}
2246 		if (O_OPOST(tty)) {
2247 			while (nr > 0) {
2248 				ssize_t num = process_output_block(tty, b, nr);
2249 				if (num < 0) {
2250 					if (num == -EAGAIN)
2251 						break;
2252 					retval = num;
2253 					goto break_out;
2254 				}
2255 				b += num;
2256 				nr -= num;
2257 				if (nr == 0)
2258 					break;
2259 				c = *b;
2260 				if (process_output(c, tty) < 0)
2261 					break;
2262 				b++; nr--;
2263 			}
2264 			if (tty->ops->flush_chars)
2265 				tty->ops->flush_chars(tty);
2266 		} else {
2267 			struct n_tty_data *ldata = tty->disc_data;
2268 
2269 			while (nr > 0) {
2270 				mutex_lock(&ldata->output_lock);
2271 				c = tty->ops->write(tty, b, nr);
2272 				mutex_unlock(&ldata->output_lock);
2273 				if (c < 0) {
2274 					retval = c;
2275 					goto break_out;
2276 				}
2277 				if (!c)
2278 					break;
2279 				b += c;
2280 				nr -= c;
2281 			}
2282 		}
2283 		if (!nr)
2284 			break;
2285 		if (tty_io_nonblock(tty, file)) {
2286 			retval = -EAGAIN;
2287 			break;
2288 		}
2289 		up_read(&tty->termios_rwsem);
2290 
2291 		wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2292 
2293 		down_read(&tty->termios_rwsem);
2294 	}
2295 break_out:
2296 	remove_wait_queue(&tty->write_wait, &wait);
2297 	if (nr && tty->fasync)
2298 		set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
2299 	up_read(&tty->termios_rwsem);
2300 	return (b - buf) ? b - buf : retval;
2301 }
2302 
2303 /**
2304  * n_tty_poll		-	poll method for N_TTY
2305  * @tty: terminal device
2306  * @file: file accessing it
2307  * @wait: poll table
2308  *
2309  * Called when the line discipline is asked to poll() for data or for special
2310  * events. This code is not serialized with respect to other events save
2311  * open/close.
2312  *
2313  * This code must be sure never to sleep through a hangup.
2314  *
2315  * Locking: called without the kernel lock held -- fine.
2316  */
2317 static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file,
2318 							poll_table *wait)
2319 {
2320 	__poll_t mask = 0;
2321 
2322 	poll_wait(file, &tty->read_wait, wait);
2323 	poll_wait(file, &tty->write_wait, wait);
2324 	if (input_available_p(tty, 1))
2325 		mask |= EPOLLIN | EPOLLRDNORM;
2326 	else {
2327 		tty_buffer_flush_work(tty->port);
2328 		if (input_available_p(tty, 1))
2329 			mask |= EPOLLIN | EPOLLRDNORM;
2330 	}
2331 	if (tty->ctrl.packet && tty->link->ctrl.pktstatus)
2332 		mask |= EPOLLPRI | EPOLLIN | EPOLLRDNORM;
2333 	if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
2334 		mask |= EPOLLHUP;
2335 	if (tty_hung_up_p(file))
2336 		mask |= EPOLLHUP;
2337 	if (tty->ops->write && !tty_is_writelocked(tty) &&
2338 			tty_chars_in_buffer(tty) < WAKEUP_CHARS &&
2339 			tty_write_room(tty) > 0)
2340 		mask |= EPOLLOUT | EPOLLWRNORM;
2341 	return mask;
2342 }
2343 
2344 static unsigned long inq_canon(struct n_tty_data *ldata)
2345 {
2346 	size_t nr, head, tail;
2347 
2348 	if (ldata->canon_head == ldata->read_tail)
2349 		return 0;
2350 	head = ldata->canon_head;
2351 	tail = ldata->read_tail;
2352 	nr = head - tail;
2353 	/* Skip EOF-chars.. */
2354 	while (MASK(head) != MASK(tail)) {
2355 		if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) &&
2356 		    read_buf(ldata, tail) == __DISABLED_CHAR)
2357 			nr--;
2358 		tail++;
2359 	}
2360 	return nr;
2361 }
2362 
2363 static int n_tty_ioctl(struct tty_struct *tty, unsigned int cmd,
2364 		       unsigned long arg)
2365 {
2366 	struct n_tty_data *ldata = tty->disc_data;
2367 	int retval;
2368 
2369 	switch (cmd) {
2370 	case TIOCOUTQ:
2371 		return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2372 	case TIOCINQ:
2373 		down_write(&tty->termios_rwsem);
2374 		if (L_ICANON(tty) && !L_EXTPROC(tty))
2375 			retval = inq_canon(ldata);
2376 		else
2377 			retval = read_cnt(ldata);
2378 		up_write(&tty->termios_rwsem);
2379 		return put_user(retval, (unsigned int __user *) arg);
2380 	default:
2381 		return n_tty_ioctl_helper(tty, cmd, arg);
2382 	}
2383 }
2384 
2385 static struct tty_ldisc_ops n_tty_ops = {
2386 	.owner		 = THIS_MODULE,
2387 	.num		 = N_TTY,
2388 	.name            = "n_tty",
2389 	.open            = n_tty_open,
2390 	.close           = n_tty_close,
2391 	.flush_buffer    = n_tty_flush_buffer,
2392 	.read            = n_tty_read,
2393 	.write           = n_tty_write,
2394 	.ioctl           = n_tty_ioctl,
2395 	.set_termios     = n_tty_set_termios,
2396 	.poll            = n_tty_poll,
2397 	.receive_buf     = n_tty_receive_buf,
2398 	.write_wakeup    = n_tty_write_wakeup,
2399 	.receive_buf2	 = n_tty_receive_buf2,
2400 };
2401 
2402 /**
2403  *	n_tty_inherit_ops	-	inherit N_TTY methods
2404  *	@ops: struct tty_ldisc_ops where to save N_TTY methods
2405  *
2406  *	Enables a 'subclass' line discipline to 'inherit' N_TTY methods.
2407  */
2408 
2409 void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
2410 {
2411 	*ops = n_tty_ops;
2412 	ops->owner = NULL;
2413 }
2414 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
2415 
2416 void __init n_tty_init(void)
2417 {
2418 	tty_register_ldisc(&n_tty_ops);
2419 }
2420