1	// SPDX-License-Identifier: GPL-1.0+
2	/*
3	* n_tty.c --- implements the N_TTY line discipline.
4	*
5	* This code used to be in tty_io.c, but things are getting hairy
6	* enough that it made sense to split things off. (The N_TTY
7	* processing has changed so much that it's hardly recognizable,
8	* anyway...)
9	*
10	* Note that the open routine for N_TTY is guaranteed never to return
11	* an error. This is because Linux will fall back to setting a line
12	* to N_TTY if it can not switch to any other line discipline.
13	*
14	* Written by Theodore Ts'o, Copyright 1994.
15	*
16	* This file also contains code originally written by Linus Torvalds,
17	* Copyright 1991, 1992, 1993, and by Julian Cowley, Copyright 1994.
18	*
19	* Reduced memory usage for older ARM systems - Russell King.
20	*
21	* 2000/01/20 Fixed SMP locking on put_tty_queue using bits of
22	* the patch by Andrew J. Kroll <ag784@freenet.buffalo.edu>
23	* who actually finally proved there really was a race.
24	*
25	* 2002/03/18 Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
26	* waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
27	* Also fixed a bug in BLOCKING mode where n_tty_write returns
28	* EAGAIN
29	*/
30
31	#include <linux/bitmap.h>
32	#include <linux/bitops.h>
33	#include <linux/ctype.h>
34	#include <linux/errno.h>
35	#include <linux/export.h>
36	#include <linux/fcntl.h>
37	#include <linux/file.h>
38	#include <linux/jiffies.h>
39	#include <linux/math.h>
40	#include <linux/poll.h>
41	#include <linux/ratelimit.h>
42	#include <linux/sched.h>
43	#include <linux/signal.h>
44	#include <linux/slab.h>
45	#include <linux/string.h>
46	#include <linux/tty.h>
47	#include <linux/types.h>
48	#include <linux/uaccess.h>
49	#include <linux/vmalloc.h>
50
51	#include "tty.h"
52
53	/*
54	* Until this number of characters is queued in the xmit buffer, select will
55	* return "we have room for writes".
56	*/
57	#define WAKEUP_CHARS 256
58
59	#define N_TTY_BUF_SIZE 4096
60
61	/*
62	* This defines the low- and high-watermarks for throttling and
63	* unthrottling the TTY driver. These watermarks are used for
64	* controlling the space in the read buffer.
65	*/
66	#define TTY_THRESHOLD_THROTTLE 128 /* now based on remaining room */
67	#define TTY_THRESHOLD_UNTHROTTLE 128
68
69	/*
70	* Special byte codes used in the echo buffer to represent operations
71	* or special handling of characters. Bytes in the echo buffer that
72	* are not part of such special blocks are treated as normal character
73	* codes.
74	*/
75	#define ECHO_OP_START 0xff
76	#define ECHO_OP_MOVE_BACK_COL 0x80
77	#define ECHO_OP_SET_CANON_COL 0x81
78	#define ECHO_OP_ERASE_TAB 0x82
79
80	#define ECHO_COMMIT_WATERMARK 256
81	#define ECHO_BLOCK 256
82	#define ECHO_DISCARD_WATERMARK N_TTY_BUF_SIZE - (ECHO_BLOCK + 32)
83
84	struct n_tty_data {
85	/* producer-published */
86	size_t read_head;
87	size_t commit_head;
88	size_t canon_head;
89	size_t echo_head;
90	size_t echo_commit;
91	size_t echo_mark;
92	DECLARE_BITMAP(char_map, 256);
93
94	/* private to n_tty_receive_overrun (single-threaded) */
95	unsigned long overrun_time;
96	unsigned int num_overrun;
97
98	/* non-atomic */
99	bool no_room;
100
101	/* must hold exclusive termios_rwsem to reset these */
102	unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
103	unsigned char push:1;
104
105	/* shared by producer and consumer */
106	u8 read_buf[N_TTY_BUF_SIZE];
107	DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
108	u8 echo_buf[N_TTY_BUF_SIZE];
109
110	/* consumer-published */
111	size_t read_tail;
112	size_t line_start;
113
114	/* # of chars looked ahead (to find software flow control chars) */
115	size_t lookahead_count;
116
117	/* protected by output lock */
118	unsigned int column;
119	unsigned int canon_column;
120	size_t echo_tail;
121
122	struct mutex atomic_read_lock;
123	struct mutex output_lock;
124	};
125
126	#define MASK(x) ((x) & (N_TTY_BUF_SIZE - 1))
127
128	static inline size_t read_cnt(struct n_tty_data *ldata)
129	{
130	return ldata->read_head - ldata->read_tail;
131	}
132
133	static inline u8 read_buf(struct n_tty_data *ldata, size_t i)
134	{
135	return ldata->read_buf[MASK(i)];
136	}
137
138	static inline u8 *read_buf_addr(struct n_tty_data *ldata, size_t i)
139	{
140	return &ldata->read_buf[MASK(i)];
141	}
142
143	static inline u8 echo_buf(struct n_tty_data *ldata, size_t i)
144	{
145	smp_rmb(); /* Matches smp_wmb() in add_echo_byte(). */
146	return ldata->echo_buf[MASK(i)];
147	}
148
149	static inline u8 *echo_buf_addr(struct n_tty_data *ldata, size_t i)
150	{
151	return &ldata->echo_buf[MASK(i)];
152	}
153
154	/* If we are not echoing the data, perhaps this is a secret so erase it */
155	static void zero_buffer(const struct tty_struct *tty, u8 *buffer, size_t size)
156	{
157	if (L_ICANON(tty) && !L_ECHO(tty))
158	memset(buffer, 0, size);
159	}
160
161	static void tty_copy(const struct tty_struct *tty, void *to, size_t tail,
162	size_t n)
163	{
164	struct n_tty_data *ldata = tty->disc_data;
165	size_t size = N_TTY_BUF_SIZE - tail;
166	void *from = read_buf_addr(ldata, i: tail);
167
168	if (n > size) {
169	tty_audit_add_data(tty, data: from, size);
170	memcpy(to, from, size);
171	zero_buffer(tty, buffer: from, size);
172	to += size;
173	n -= size;
174	from = ldata->read_buf;
175	}
176
177	tty_audit_add_data(tty, data: from, size: n);
178	memcpy(to, from, n);
179	zero_buffer(tty, buffer: from, size: n);
180	}
181
182	/**
183	* n_tty_kick_worker - start input worker (if required)
184	* @tty: terminal
185	*
186	* Re-schedules the flip buffer work if it may have stopped.
187	*
188	* Locking:
189	* * Caller holds exclusive %termios_rwsem, or
190	* * n_tty_read()/consumer path:
191	* holds non-exclusive %termios_rwsem
192	*/
193	static void n_tty_kick_worker(const struct tty_struct *tty)
194	{
195	struct n_tty_data *ldata = tty->disc_data;
196
197	/* Did the input worker stop? Restart it */
198	if (unlikely(READ_ONCE(ldata->no_room))) {
199	WRITE_ONCE(ldata->no_room, 0);
200
201	WARN_RATELIMIT(tty->port->itty == NULL,
202	"scheduling with invalid itty\n");
203	/* see if ldisc has been killed - if so, this means that
204	* even though the ldisc has been halted and ->buf.work
205	* cancelled, ->buf.work is about to be rescheduled
206	*/
207	WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
208	"scheduling buffer work for halted ldisc\n");
209	tty_buffer_restart_work(port: tty->port);
210	}
211	}
212
213	static ssize_t chars_in_buffer(const struct tty_struct *tty)
214	{
215	const struct n_tty_data *ldata = tty->disc_data;
216	size_t head = ldata->icanon ? ldata->canon_head : ldata->commit_head;
217
218	return head - ldata->read_tail;
219	}
220
221	/**
222	* n_tty_write_wakeup - asynchronous I/O notifier
223	* @tty: tty device
224	*
225	* Required for the ptys, serial driver etc. since processes that attach
226	* themselves to the master and rely on ASYNC IO must be woken up.
227	*/
228	static void n_tty_write_wakeup(struct tty_struct *tty)
229	{
230	clear_bit(nr: TTY_DO_WRITE_WAKEUP, addr: &tty->flags);
231	kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
232	}
233
234	static void n_tty_check_throttle(struct tty_struct *tty)
235	{
236	struct n_tty_data *ldata = tty->disc_data;
237
238	/*
239	* Check the remaining room for the input canonicalization
240	* mode. We don't want to throttle the driver if we're in
241	* canonical mode and don't have a newline yet!
242	*/
243	if (ldata->icanon && ldata->canon_head == ldata->read_tail)
244	return;
245
246	do {
247	tty_set_flow_change(tty, val: TTY_THROTTLE_SAFE);
248	if (N_TTY_BUF_SIZE - read_cnt(ldata) >= TTY_THRESHOLD_THROTTLE)
249	break;
250	} while (!tty_throttle_safe(tty));
251
252	__tty_set_flow_change(tty, val: 0);
253	}
254
255	static void n_tty_check_unthrottle(struct tty_struct *tty)
256	{
257	if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
258	if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
259	return;
260	n_tty_kick_worker(tty);
261	tty_wakeup(tty: tty->link);
262	return;
263	}
264
265	/* If there is enough space in the read buffer now, let the
266	* low-level driver know. We use chars_in_buffer() to
267	* check the buffer, as it now knows about canonical mode.
268	* Otherwise, if the driver is throttled and the line is
269	* longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
270	* we won't get any more characters.
271	*/
272
273	do {
274	tty_set_flow_change(tty, val: TTY_UNTHROTTLE_SAFE);
275	if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
276	break;
277
278	n_tty_kick_worker(tty);
279	} while (!tty_unthrottle_safe(tty));
280
281	__tty_set_flow_change(tty, val: 0);
282	}
283
284	/**
285	* put_tty_queue - add character to tty
286	* @c: character
287	* @ldata: n_tty data
288	*
289	* Add a character to the tty read_buf queue.
290	*
291	* Locking:
292	* * n_tty_receive_buf()/producer path:
293	* caller holds non-exclusive %termios_rwsem
294	*/
295	static inline void put_tty_queue(u8 c, struct n_tty_data *ldata)
296	{
297	*read_buf_addr(ldata, i: ldata->read_head) = c;
298	ldata->read_head++;
299	}
300
301	/**
302	* reset_buffer_flags - reset buffer state
303	* @ldata: line disc data to reset
304	*
305	* Reset the read buffer counters and clear the flags. Called from
306	* n_tty_open() and n_tty_flush_buffer().
307	*
308	* Locking:
309	* * caller holds exclusive %termios_rwsem, or
310	* * (locking is not required)
311	*/
312	static void reset_buffer_flags(struct n_tty_data *ldata)
313	{
314	ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
315	ldata->commit_head = 0;
316	ldata->line_start = 0;
317
318	ldata->erasing = 0;
319	bitmap_zero(dst: ldata->read_flags, N_TTY_BUF_SIZE);
320	ldata->push = 0;
321
322	ldata->lookahead_count = 0;
323	}
324
325	static void n_tty_packet_mode_flush(struct tty_struct *tty)
326	{
327	unsigned long flags;
328
329	if (tty->link->ctrl.packet) {
330	spin_lock_irqsave(&tty->ctrl.lock, flags);
331	tty->ctrl.pktstatus |= TIOCPKT_FLUSHREAD;
332	spin_unlock_irqrestore(lock: &tty->ctrl.lock, flags);
333	wake_up_interruptible(&tty->link->read_wait);
334	}
335	}
336
337	/**
338	* n_tty_flush_buffer - clean input queue
339	* @tty: terminal device
340	*
341	* Flush the input buffer. Called when the tty layer wants the buffer flushed
342	* (eg at hangup) or when the %N_TTY line discipline internally has to clean
343	* the pending queue (for example some signals).
344	*
345	* Holds %termios_rwsem to exclude producer/consumer while buffer indices are
346	* reset.
347	*
348	* Locking: %ctrl.lock, exclusive %termios_rwsem
349	*/
350	static void n_tty_flush_buffer(struct tty_struct *tty)
351	{
352	down_write(sem: &tty->termios_rwsem);
353	reset_buffer_flags(ldata: tty->disc_data);
354	n_tty_kick_worker(tty);
355
356	if (tty->link)
357	n_tty_packet_mode_flush(tty);
358	up_write(sem: &tty->termios_rwsem);
359	}
360
361	/**
362	* is_utf8_continuation - utf8 multibyte check
363	* @c: byte to check
364	*
365	* Returns: true if the utf8 character @c is a multibyte continuation
366	* character. We use this to correctly compute the on-screen size of the
367	* character when printing.
368	*/
369	static inline int is_utf8_continuation(u8 c)
370	{
371	return (c & 0xc0) == 0x80;
372	}
373
374	/**
375	* is_continuation - multibyte check
376	* @c: byte to check
377	* @tty: terminal device
378	*
379	* Returns: true if the utf8 character @c is a multibyte continuation character
380	* and the terminal is in unicode mode.
381	*/
382	static inline int is_continuation(u8 c, const struct tty_struct *tty)
383	{
384	return I_IUTF8(tty) && is_utf8_continuation(c);
385	}
386
387	/**
388	* do_output_char - output one character
389	* @c: character (or partial unicode symbol)
390	* @tty: terminal device
391	* @space: space available in tty driver write buffer
392	*
393	* This is a helper function that handles one output character (including
394	* special characters like TAB, CR, LF, etc.), doing OPOST processing and
395	* putting the results in the tty driver's write buffer.
396	*
397	* Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY and NLDLY.
398	* They simply aren't relevant in the world today. If you ever need them, add
399	* them here.
400	*
401	* Returns: the number of bytes of buffer space used or -1 if no space left.
402	*
403	* Locking: should be called under the %output_lock to protect the column state
404	* and space left in the buffer.
405	*/
406	static int do_output_char(u8 c, struct tty_struct *tty, int space)
407	{
408	struct n_tty_data *ldata = tty->disc_data;
409	int spaces;
410
411	if (!space)
412	return -1;
413
414	switch (c) {
415	case '\n':
416	if (O_ONLRET(tty))
417	ldata->column = 0;
418	if (O_ONLCR(tty)) {
419	if (space < 2)
420	return -1;
421	ldata->canon_column = ldata->column = 0;
422	tty->ops->write(tty, "\r\n", 2);
423	return 2;
424	}
425	ldata->canon_column = ldata->column;
426	break;
427	case '\r':
428	if (O_ONOCR(tty) && ldata->column == 0)
429	return 0;
430	if (O_OCRNL(tty)) {
431	c = '\n';
432	if (O_ONLRET(tty))
433	ldata->canon_column = ldata->column = 0;
434	break;
435	}
436	ldata->canon_column = ldata->column = 0;
437	break;
438	case '\t':
439	spaces = 8 - (ldata->column & 7);
440	if (O_TABDLY(tty) == XTABS) {
441	if (space < spaces)
442	return -1;
443	ldata->column += spaces;
444	tty->ops->write(tty, " ", spaces);
445	return spaces;
446	}
447	ldata->column += spaces;
448	break;
449	case '\b':
450	if (ldata->column > 0)
451	ldata->column--;
452	break;
453	default:
454	if (!iscntrl(c)) {
455	if (O_OLCUC(tty))
456	c = toupper(c);
457	if (!is_continuation(c, tty))
458	ldata->column++;
459	}
460	break;
461	}
462
463	tty_put_char(tty, c);
464	return 1;
465	}
466
467	/**
468	* process_output - output post processor
469	* @c: character (or partial unicode symbol)
470	* @tty: terminal device
471	*
472	* Output one character with OPOST processing.
473	*
474	* Returns: -1 when the output device is full and the character must be
475	* retried.
476	*
477	* Locking: %output_lock to protect column state and space left (also, this is
478	*called from n_tty_write() under the tty layer write lock).
479	*/
480	static int process_output(u8 c, struct tty_struct *tty)
481	{
482	struct n_tty_data *ldata = tty->disc_data;
483
484	guard(mutex)(T: &ldata->output_lock);
485
486	if (do_output_char(c, tty, space: tty_write_room(tty)) < 0)
487	return -1;
488
489	return 0;
490	}
491
492	/**
493	* process_output_block - block post processor
494	* @tty: terminal device
495	* @buf: character buffer
496	* @nr: number of bytes to output
497	*
498	* Output a block of characters with OPOST processing.
499	*
500	* This path is used to speed up block console writes, among other things when
501	* processing blocks of output data. It handles only the simple cases normally
502	* found and helps to generate blocks of symbols for the console driver and
503	* thus improve performance.
504	*
505	* Returns: the number of characters output.
506	*
507	* Locking: %output_lock to protect column state and space left (also, this is
508	* called from n_tty_write() under the tty layer write lock).
509	*/
510	static ssize_t process_output_block(struct tty_struct *tty,
511	const u8 *buf, unsigned int nr)
512	{
513	struct n_tty_data *ldata = tty->disc_data;
514	unsigned int space, i;
515	const u8 *cp;
516
517	guard(mutex)(T: &ldata->output_lock);
518
519	space = tty_write_room(tty);
520	if (space == 0)
521	return 0;
522
523	if (nr > space)
524	nr = space;
525
526	for (i = 0, cp = buf; i < nr; i++, cp++) {
527	u8 c = *cp;
528
529	switch (c) {
530	case '\n':
531	if (O_ONLRET(tty))
532	ldata->column = 0;
533	if (O_ONLCR(tty))
534	goto do_write;
535	ldata->canon_column = ldata->column;
536	break;
537	case '\r':
538	if (O_ONOCR(tty) && ldata->column == 0)
539	goto do_write;
540	if (O_OCRNL(tty))
541	goto do_write;
542	ldata->canon_column = ldata->column = 0;
543	break;
544	case '\t':
545	goto do_write;
546	case '\b':
547	if (ldata->column > 0)
548	ldata->column--;
549	break;
550	default:
551	if (!iscntrl(c)) {
552	if (O_OLCUC(tty))
553	goto do_write;
554	if (!is_continuation(c, tty))
555	ldata->column++;
556	}
557	break;
558	}
559	}
560	do_write:
561	return tty->ops->write(tty, buf, i);
562	}
563
564	static int n_tty_process_echo_ops(struct tty_struct *tty, size_t *tail,
565	int space)
566	{
567	struct n_tty_data *ldata = tty->disc_data;
568	u8 op;
569
570	/*
571	* Since add_echo_byte() is called without holding output_lock, we
572	* might see only portion of multi-byte operation.
573	*/
574	if (MASK(ldata->echo_commit) == MASK(*tail + 1))
575	return -ENODATA;
576
577	/*
578	* If the buffer byte is the start of a multi-byte operation, get the
579	* next byte, which is either the op code or a control character value.
580	*/
581	op = echo_buf(ldata, i: *tail + 1);
582
583	switch (op) {
584	case ECHO_OP_ERASE_TAB: {
585	unsigned int num_chars, num_bs;
586
587	if (MASK(ldata->echo_commit) == MASK(*tail + 2))
588	return -ENODATA;
589
590	num_chars = echo_buf(ldata, i: *tail + 2);
591
592	/*
593	* Determine how many columns to go back in order to erase the
594	* tab. This depends on the number of columns used by other
595	* characters within the tab area. If this (modulo 8) count is
596	* from the start of input rather than from a previous tab, we
597	* offset by canon column. Otherwise, tab spacing is normal.
598	*/
599	if (!(num_chars & 0x80))
600	num_chars += ldata->canon_column;
601	num_bs = 8 - (num_chars & 7);
602
603	if (num_bs > space)
604	return -ENOSPC;
605
606	space -= num_bs;
607	while (num_bs--) {
608	tty_put_char(tty, c: '\b');
609	if (ldata->column > 0)
610	ldata->column--;
611	}
612	*tail += 3;
613	break;
614	}
615	case ECHO_OP_SET_CANON_COL:
616	ldata->canon_column = ldata->column;
617	*tail += 2;
618	break;
619
620	case ECHO_OP_MOVE_BACK_COL:
621	if (ldata->column > 0)
622	ldata->column--;
623	*tail += 2;
624	break;
625
626	case ECHO_OP_START:
627	/* This is an escaped echo op start code */
628	if (!space)
629	return -ENOSPC;
630
631	tty_put_char(tty, ECHO_OP_START);
632	ldata->column++;
633	space--;
634	*tail += 2;
635	break;
636
637	default:
638	/*
639	* If the op is not a special byte code, it is a ctrl char
640	* tagged to be echoed as "^X" (where X is the letter
641	* representing the control char). Note that we must ensure
642	* there is enough space for the whole ctrl pair.
643	*/
644	if (space < 2)
645	return -ENOSPC;
646
647	tty_put_char(tty, c: '^');
648	tty_put_char(tty, c: op ^ 0100);
649	ldata->column += 2;
650	space -= 2;
651	*tail += 2;
652	break;
653	}
654
655	return space;
656	}
657
658	/**
659	* __process_echoes - write pending echo characters
660	* @tty: terminal device
661	*
662	* Write previously buffered echo (and other ldisc-generated) characters to the
663	* tty.
664	*
665	* Characters generated by the ldisc (including echoes) need to be buffered
666	* because the driver's write buffer can fill during heavy program output.
667	* Echoing straight to the driver will often fail under these conditions,
668	* causing lost characters and resulting mismatches of ldisc state information.
669	*
670	* Since the ldisc state must represent the characters actually sent to the
671	* driver at the time of the write, operations like certain changes in column
672	* state are also saved in the buffer and executed here.
673	*
674	* A circular fifo buffer is used so that the most recent characters are
675	* prioritized. Also, when control characters are echoed with a prefixed "^",
676	* the pair is treated atomically and thus not separated.
677	*
678	* Locking: callers must hold %output_lock.
679	*/
680	static size_t __process_echoes(struct tty_struct *tty)
681	{
682	struct n_tty_data *ldata = tty->disc_data;
683	unsigned int space, old_space;
684	size_t tail;
685	u8 c;
686
687	old_space = space = tty_write_room(tty);
688
689	tail = ldata->echo_tail;
690	while (MASK(ldata->echo_commit) != MASK(tail)) {
691	c = echo_buf(ldata, i: tail);
692	if (c == ECHO_OP_START) {
693	int ret = n_tty_process_echo_ops(tty, tail: &tail, space);
694	if (ret == -ENODATA)
695	goto not_yet_stored;
696	if (ret < 0)
697	break;
698	space = ret;
699	} else {
700	if (O_OPOST(tty)) {
701	int retval = do_output_char(c, tty, space);
702	if (retval < 0)
703	break;
704	space -= retval;
705	} else {
706	if (!space)
707	break;
708	tty_put_char(tty, c);
709	space -= 1;
710	}
711	tail += 1;
712	}
713	}
714
715	/* If the echo buffer is nearly full (so that the possibility exists
716	* of echo overrun before the next commit), then discard enough
717	* data at the tail to prevent a subsequent overrun */
718	while (ldata->echo_commit > tail &&
719	ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
720	if (echo_buf(ldata, i: tail) == ECHO_OP_START) {
721	if (echo_buf(ldata, i: tail + 1) == ECHO_OP_ERASE_TAB)
722	tail += 3;
723	else
724	tail += 2;
725	} else
726	tail++;
727	}
728
729	not_yet_stored:
730	ldata->echo_tail = tail;
731	return old_space - space;
732	}
733
734	static void commit_echoes(struct tty_struct *tty)
735	{
736	struct n_tty_data *ldata = tty->disc_data;
737	size_t nr, old, echoed;
738	size_t head;
739
740	mutex_lock(&ldata->output_lock);
741	head = ldata->echo_head;
742	ldata->echo_mark = head;
743	old = ldata->echo_commit - ldata->echo_tail;
744
745	/* Process committed echoes if the accumulated # of bytes
746	* is over the threshold (and try again each time another
747	* block is accumulated) */
748	nr = head - ldata->echo_tail;
749	if (nr < ECHO_COMMIT_WATERMARK ||
750	(nr % ECHO_BLOCK > old % ECHO_BLOCK)) {
751	mutex_unlock(lock: &ldata->output_lock);
752	return;
753	}
754
755	ldata->echo_commit = head;
756	echoed = __process_echoes(tty);
757	mutex_unlock(lock: &ldata->output_lock);
758
759	if (echoed && tty->ops->flush_chars)
760	tty->ops->flush_chars(tty);
761	}
762
763	static void process_echoes(struct tty_struct *tty)
764	{
765	struct n_tty_data *ldata = tty->disc_data;
766	size_t echoed;
767
768	if (ldata->echo_mark == ldata->echo_tail)
769	return;
770
771	mutex_lock(&ldata->output_lock);
772	ldata->echo_commit = ldata->echo_mark;
773	echoed = __process_echoes(tty);
774	mutex_unlock(lock: &ldata->output_lock);
775
776	if (echoed && tty->ops->flush_chars)
777	tty->ops->flush_chars(tty);
778	}
779
780	/* NB: echo_mark and echo_head should be equivalent here */
781	static void flush_echoes(struct tty_struct *tty)
782	{
783	struct n_tty_data *ldata = tty->disc_data;
784
785	if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
786	ldata->echo_commit == ldata->echo_head)
787	return;
788
789	mutex_lock(&ldata->output_lock);
790	ldata->echo_commit = ldata->echo_head;
791	__process_echoes(tty);
792	mutex_unlock(lock: &ldata->output_lock);
793	}
794
795	/**
796	* add_echo_byte - add a byte to the echo buffer
797	* @c: unicode byte to echo
798	* @ldata: n_tty data
799	*
800	* Add a character or operation byte to the echo buffer.
801	*/
802	static inline void add_echo_byte(u8 c, struct n_tty_data *ldata)
803	{
804	*echo_buf_addr(ldata, i: ldata->echo_head) = c;
805	smp_wmb(); /* Matches smp_rmb() in echo_buf(). */
806	ldata->echo_head++;
807	}
808
809	/**
810	* echo_move_back_col - add operation to move back a column
811	* @ldata: n_tty data
812	*
813	* Add an operation to the echo buffer to move back one column.
814	*/
815	static void echo_move_back_col(struct n_tty_data *ldata)
816	{
817	add_echo_byte(ECHO_OP_START, ldata);
818	add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
819	}
820
821	/**
822	* echo_set_canon_col - add operation to set the canon column
823	* @ldata: n_tty data
824	*
825	* Add an operation to the echo buffer to set the canon column to the current
826	* column.
827	*/
828	static void echo_set_canon_col(struct n_tty_data *ldata)
829	{
830	add_echo_byte(ECHO_OP_START, ldata);
831	add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
832	}
833
834	/**
835	* echo_erase_tab - add operation to erase a tab
836	* @num_chars: number of character columns already used
837	* @after_tab: true if num_chars starts after a previous tab
838	* @ldata: n_tty data
839	*
840	* Add an operation to the echo buffer to erase a tab.
841	*
842	* Called by the eraser function, which knows how many character columns have
843	* been used since either a previous tab or the start of input. This
844	* information will be used later, along with canon column (if applicable), to
845	* go back the correct number of columns.
846	*/
847	static void echo_erase_tab(unsigned int num_chars, int after_tab,
848	struct n_tty_data *ldata)
849	{
850	add_echo_byte(ECHO_OP_START, ldata);
851	add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
852
853	/* We only need to know this modulo 8 (tab spacing) */
854	num_chars &= 7;
855
856	/* Set the high bit as a flag if num_chars is after a previous tab */
857	if (after_tab)
858	num_chars |= 0x80;
859
860	add_echo_byte(c: num_chars, ldata);
861	}
862
863	/**
864	* echo_char_raw - echo a character raw
865	* @c: unicode byte to echo
866	* @ldata: line disc data
867	*
868	* Echo user input back onto the screen. This must be called only when
869	* L_ECHO(tty) is true. Called from the &tty_driver.receive_buf() path.
870	*
871	* This variant does not treat control characters specially.
872	*/
873	static void echo_char_raw(u8 c, struct n_tty_data *ldata)
874	{
875	if (c == ECHO_OP_START) {
876	add_echo_byte(ECHO_OP_START, ldata);
877	add_echo_byte(ECHO_OP_START, ldata);
878	} else {
879	add_echo_byte(c, ldata);
880	}
881	}
882
883	/**
884	* echo_char - echo a character
885	* @c: unicode byte to echo
886	* @tty: terminal device
887	*
888	* Echo user input back onto the screen. This must be called only when
889	* L_ECHO(tty) is true. Called from the &tty_driver.receive_buf() path.
890	*
891	* This variant tags control characters to be echoed as "^X" (where X is the
892	* letter representing the control char).
893	*/
894	static void echo_char(u8 c, const struct tty_struct *tty)
895	{
896	struct n_tty_data *ldata = tty->disc_data;
897
898	if (c == ECHO_OP_START) {
899	add_echo_byte(ECHO_OP_START, ldata);
900	add_echo_byte(ECHO_OP_START, ldata);
901	} else {
902	if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
903	add_echo_byte(ECHO_OP_START, ldata);
904	add_echo_byte(c, ldata);
905	}
906	}
907
908	/**
909	* finish_erasing - complete erase
910	* @ldata: n_tty data
911	*/
912	static inline void finish_erasing(struct n_tty_data *ldata)
913	{
914	if (ldata->erasing) {
915	echo_char_raw(c: '/', ldata);
916	ldata->erasing = 0;
917	}
918	}
919
920	/**
921	* eraser - handle erase function
922	* @c: character input
923	* @tty: terminal device
924	*
925	* Perform erase and necessary output when an erase character is present in the
926	* stream from the driver layer. Handles the complexities of UTF-8 multibyte
927	* symbols.
928	*
929	* Locking: n_tty_receive_buf()/producer path:
930	* caller holds non-exclusive %termios_rwsem
931	*/
932	static void eraser(u8 c, const struct tty_struct *tty)
933	{
934	struct n_tty_data *ldata = tty->disc_data;
935	enum { ERASE, WERASE, KILL } kill_type;
936	size_t head;
937	size_t cnt;
938	int seen_alnums;
939
940	if (ldata->read_head == ldata->canon_head) {
941	/* process_output('\a', tty); */ /* what do you think? */
942	return;
943	}
944	if (c == ERASE_CHAR(tty))
945	kill_type = ERASE;
946	else if (c == WERASE_CHAR(tty))
947	kill_type = WERASE;
948	else {
949	if (!L_ECHO(tty)) {
950	ldata->read_head = ldata->canon_head;
951	return;
952	}
953	if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
954	ldata->read_head = ldata->canon_head;
955	finish_erasing(ldata);
956	echo_char(KILL_CHAR(tty), tty);
957	/* Add a newline if ECHOK is on and ECHOKE is off. */
958	if (L_ECHOK(tty))
959	echo_char_raw(c: '\n', ldata);
960	return;
961	}
962	kill_type = KILL;
963	}
964
965	seen_alnums = 0;
966	while (MASK(ldata->read_head) != MASK(ldata->canon_head)) {
967	head = ldata->read_head;
968
969	/* erase a single possibly multibyte character */
970	do {
971	head--;
972	c = read_buf(ldata, i: head);
973	} while (is_continuation(c, tty) &&
974	MASK(head) != MASK(ldata->canon_head));
975
976	/* do not partially erase */
977	if (is_continuation(c, tty))
978	break;
979
980	if (kill_type == WERASE) {
981	/* Equivalent to BSD's ALTWERASE. */
982	if (isalnum(c) || c == '_')
983	seen_alnums++;
984	else if (seen_alnums)
985	break;
986	}
987	cnt = ldata->read_head - head;
988	ldata->read_head = head;
989	if (L_ECHO(tty)) {
990	if (L_ECHOPRT(tty)) {
991	if (!ldata->erasing) {
992	echo_char_raw(c: '\\', ldata);
993	ldata->erasing = 1;
994	}
995	/* if cnt > 1, output a multi-byte character */
996	echo_char(c, tty);
997	while (--cnt > 0) {
998	head++;
999	echo_char_raw(c: read_buf(ldata, i: head), ldata);
1000	echo_move_back_col(ldata);
1001	}
1002	} else if (kill_type == ERASE && !L_ECHOE(tty)) {
1003	echo_char(ERASE_CHAR(tty), tty);
1004	} else if (c == '\t') {
1005	unsigned int num_chars = 0;
1006	int after_tab = 0;
1007	size_t tail = ldata->read_head;
1008
1009	/*
1010	* Count the columns used for characters
1011	* since the start of input or after a
1012	* previous tab.
1013	* This info is used to go back the correct
1014	* number of columns.
1015	*/
1016	while (MASK(tail) != MASK(ldata->canon_head)) {
1017	tail--;
1018	c = read_buf(ldata, i: tail);
1019	if (c == '\t') {
1020	after_tab = 1;
1021	break;
1022	} else if (iscntrl(c)) {
1023	if (L_ECHOCTL(tty))
1024	num_chars += 2;
1025	} else if (!is_continuation(c, tty)) {
1026	num_chars++;
1027	}
1028	}
1029	echo_erase_tab(num_chars, after_tab, ldata);
1030	} else {
1031	if (iscntrl(c) && L_ECHOCTL(tty)) {
1032	echo_char_raw(c: '\b', ldata);
1033	echo_char_raw(c: ' ', ldata);
1034	echo_char_raw(c: '\b', ldata);
1035	}
1036	if (!iscntrl(c) || L_ECHOCTL(tty)) {
1037	echo_char_raw(c: '\b', ldata);
1038	echo_char_raw(c: ' ', ldata);
1039	echo_char_raw(c: '\b', ldata);
1040	}
1041	}
1042	}
1043	if (kill_type == ERASE)
1044	break;
1045	}
1046	if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
1047	finish_erasing(ldata);
1048	}
1049
1050
1051	static void __isig(int sig, struct tty_struct *tty)
1052	{
1053	struct pid *tty_pgrp = tty_get_pgrp(tty);
1054	if (tty_pgrp) {
1055	kill_pgrp(pid: tty_pgrp, sig, priv: 1);
1056	put_pid(pid: tty_pgrp);
1057	}
1058	}
1059
1060	/**
1061	* isig - handle the ISIG optio
1062	* @sig: signal
1063	* @tty: terminal
1064	*
1065	* Called when a signal is being sent due to terminal input. Called from the
1066	* &tty_driver.receive_buf() path, so serialized.
1067	*
1068	* Performs input and output flush if !NOFLSH. In this context, the echo
1069	* buffer is 'output'. The signal is processed first to alert any current
1070	* readers or writers to discontinue and exit their i/o loops.
1071	*
1072	* Locking: %ctrl.lock
1073	*/
1074	static void isig(int sig, struct tty_struct *tty)
1075	{
1076	struct n_tty_data *ldata = tty->disc_data;
1077
1078	if (L_NOFLSH(tty)) {
1079	/* signal only */
1080	__isig(sig, tty);
1081
1082	} else { /* signal and flush */
1083	up_read(sem: &tty->termios_rwsem);
1084	down_write(sem: &tty->termios_rwsem);
1085
1086	__isig(sig, tty);
1087
1088	/* clear echo buffer */
1089	mutex_lock(&ldata->output_lock);
1090	ldata->echo_head = ldata->echo_tail = 0;
1091	ldata->echo_mark = ldata->echo_commit = 0;
1092	mutex_unlock(lock: &ldata->output_lock);
1093
1094	/* clear output buffer */
1095	tty_driver_flush_buffer(tty);
1096
1097	/* clear input buffer */
1098	reset_buffer_flags(ldata: tty->disc_data);
1099
1100	/* notify pty master of flush */
1101	if (tty->link)
1102	n_tty_packet_mode_flush(tty);
1103
1104	up_write(sem: &tty->termios_rwsem);
1105	down_read(sem: &tty->termios_rwsem);
1106	}
1107	}
1108
1109	/**
1110	* n_tty_receive_break - handle break
1111	* @tty: terminal
1112	*
1113	* An RS232 break event has been hit in the incoming bitstream. This can cause
1114	* a variety of events depending upon the termios settings.
1115	*
1116	* Locking: n_tty_receive_buf()/producer path:
1117	* caller holds non-exclusive termios_rwsem
1118	*
1119	* Note: may get exclusive %termios_rwsem if flushing input buffer
1120	*/
1121	static void n_tty_receive_break(struct tty_struct *tty)
1122	{
1123	struct n_tty_data *ldata = tty->disc_data;
1124
1125	if (I_IGNBRK(tty))
1126	return;
1127	if (I_BRKINT(tty)) {
1128	isig(SIGINT, tty);
1129	return;
1130	}
1131	if (I_PARMRK(tty)) {
1132	put_tty_queue(c: '\377', ldata);
1133	put_tty_queue(c: '\0', ldata);
1134	}
1135	put_tty_queue(c: '\0', ldata);
1136	}
1137
1138	/**
1139	* n_tty_receive_overrun - handle overrun reporting
1140	* @tty: terminal
1141	*
1142	* Data arrived faster than we could process it. While the tty driver has
1143	* flagged this the bits that were missed are gone forever.
1144	*
1145	* Called from the receive_buf path so single threaded. Does not need locking
1146	* as num_overrun and overrun_time are function private.
1147	*/
1148	static void n_tty_receive_overrun(const struct tty_struct *tty)
1149	{
1150	struct n_tty_data *ldata = tty->disc_data;
1151
1152	ldata->num_overrun++;
1153	if (time_is_before_jiffies(ldata->overrun_time + HZ)) {
1154	tty_warn(tty, "%u input overrun(s)\n", ldata->num_overrun);
1155	ldata->overrun_time = jiffies;
1156	ldata->num_overrun = 0;
1157	}
1158	}
1159
1160	/**
1161	* n_tty_receive_parity_error - error notifier
1162	* @tty: terminal device
1163	* @c: character
1164	*
1165	* Process a parity error and queue the right data to indicate the error case
1166	* if necessary.
1167	*
1168	* Locking: n_tty_receive_buf()/producer path:
1169	* caller holds non-exclusive %termios_rwsem
1170	*/
1171	static void n_tty_receive_parity_error(const struct tty_struct *tty,
1172	u8 c)
1173	{
1174	struct n_tty_data *ldata = tty->disc_data;
1175
1176	if (I_INPCK(tty)) {
1177	if (I_IGNPAR(tty))
1178	return;
1179	if (I_PARMRK(tty)) {
1180	put_tty_queue(c: '\377', ldata);
1181	put_tty_queue(c: '\0', ldata);
1182	put_tty_queue(c, ldata);
1183	} else
1184	put_tty_queue(c: '\0', ldata);
1185	} else
1186	put_tty_queue(c, ldata);
1187	}
1188
1189	static void
1190	n_tty_receive_signal_char(struct tty_struct *tty, int signal, u8 c)
1191	{
1192	isig(sig: signal, tty);
1193	if (I_IXON(tty))
1194	start_tty(tty);
1195	if (L_ECHO(tty)) {
1196	echo_char(c, tty);
1197	commit_echoes(tty);
1198	} else
1199	process_echoes(tty);
1200	}
1201
1202	static bool n_tty_is_char_flow_ctrl(struct tty_struct *tty, u8 c)
1203	{
1204	return c == START_CHAR(tty) || c == STOP_CHAR(tty);
1205	}
1206
1207	/**
1208	* n_tty_receive_char_flow_ctrl - receive flow control chars
1209	* @tty: terminal device
1210	* @c: character
1211	* @lookahead_done: lookahead has processed this character already
1212	*
1213	* Receive and process flow control character actions.
1214	*
1215	* In case lookahead for flow control chars already handled the character in
1216	* advance to the normal receive, the actions are skipped during normal
1217	* receive.
1218	*
1219	* Returns true if @c is consumed as flow-control character, the character
1220	* must not be treated as normal character.
1221	*/
1222	static bool n_tty_receive_char_flow_ctrl(struct tty_struct *tty, u8 c,
1223	bool lookahead_done)
1224	{
1225	if (!n_tty_is_char_flow_ctrl(tty, c))
1226	return false;
1227
1228	if (lookahead_done)
1229	return true;
1230
1231	if (c == START_CHAR(tty)) {
1232	start_tty(tty);
1233	process_echoes(tty);
1234	return true;
1235	}
1236
1237	/* STOP_CHAR */
1238	stop_tty(tty);
1239	return true;
1240	}
1241
1242	static void n_tty_receive_handle_newline(struct tty_struct *tty, u8 c)
1243	{
1244	struct n_tty_data *ldata = tty->disc_data;
1245
1246	set_bit(MASK(ldata->read_head), addr: ldata->read_flags);
1247	put_tty_queue(c, ldata);
1248	smp_store_release(&ldata->canon_head, ldata->read_head);
1249	kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1250	wake_up_interruptible_poll(&tty->read_wait, EPOLLIN | EPOLLRDNORM);
1251	}
1252
1253	static bool n_tty_receive_char_canon(struct tty_struct *tty, u8 c)
1254	{
1255	struct n_tty_data *ldata = tty->disc_data;
1256
1257	if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
1258	(c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
1259	eraser(c, tty);
1260	commit_echoes(tty);
1261
1262	return true;
1263	}
1264
1265	if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
1266	ldata->lnext = 1;
1267	if (L_ECHO(tty)) {
1268	finish_erasing(ldata);
1269	if (L_ECHOCTL(tty)) {
1270	echo_char_raw(c: '^', ldata);
1271	echo_char_raw(c: '\b', ldata);
1272	commit_echoes(tty);
1273	}
1274	}
1275
1276	return true;
1277	}
1278
1279	if (c == REPRINT_CHAR(tty) && L_ECHO(tty) && L_IEXTEN(tty)) {
1280	size_t tail = ldata->canon_head;
1281
1282	finish_erasing(ldata);
1283	echo_char(c, tty);
1284	echo_char_raw(c: '\n', ldata);
1285	while (MASK(tail) != MASK(ldata->read_head)) {
1286	echo_char(c: read_buf(ldata, i: tail), tty);
1287	tail++;
1288	}
1289	commit_echoes(tty);
1290
1291	return true;
1292	}
1293
1294	if (c == '\n') {
1295	if (L_ECHO(tty) || L_ECHONL(tty)) {
1296	echo_char_raw(c: '\n', ldata);
1297	commit_echoes(tty);
1298	}
1299	n_tty_receive_handle_newline(tty, c);
1300
1301	return true;
1302	}
1303
1304	if (c == EOF_CHAR(tty)) {
1305	c = __DISABLED_CHAR;
1306	n_tty_receive_handle_newline(tty, c);
1307
1308	return true;
1309	}
1310
1311	if ((c == EOL_CHAR(tty)) ||
1312	(c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
1313	/*
1314	* XXX are EOL_CHAR and EOL2_CHAR echoed?!?
1315	*/
1316	if (L_ECHO(tty)) {
1317	/* Record the column of first canon char. */
1318	if (ldata->canon_head == ldata->read_head)
1319	echo_set_canon_col(ldata);
1320	echo_char(c, tty);
1321	commit_echoes(tty);
1322	}
1323	/*
1324	* XXX does PARMRK doubling happen for
1325	* EOL_CHAR and EOL2_CHAR?
1326	*/
1327	if (c == '\377' && I_PARMRK(tty))
1328	put_tty_queue(c, ldata);
1329
1330	n_tty_receive_handle_newline(tty, c);
1331
1332	return true;
1333	}
1334
1335	return false;
1336	}
1337
1338	static void n_tty_receive_char_special(struct tty_struct *tty, u8 c,
1339	bool lookahead_done)
1340	{
1341	struct n_tty_data *ldata = tty->disc_data;
1342
1343	if (I_IXON(tty) && n_tty_receive_char_flow_ctrl(tty, c, lookahead_done))
1344	return;
1345
1346	if (L_ISIG(tty)) {
1347	if (c == INTR_CHAR(tty)) {
1348	n_tty_receive_signal_char(tty, SIGINT, c);
1349	return;
1350	} else if (c == QUIT_CHAR(tty)) {
1351	n_tty_receive_signal_char(tty, SIGQUIT, c);
1352	return;
1353	} else if (c == SUSP_CHAR(tty)) {
1354	n_tty_receive_signal_char(tty, SIGTSTP, c);
1355	return;
1356	}
1357	}
1358
1359	if (tty->flow.stopped && !tty->flow.tco_stopped && I_IXON(tty) && I_IXANY(tty)) {
1360	start_tty(tty);
1361	process_echoes(tty);
1362	}
1363
1364	if (c == '\r') {
1365	if (I_IGNCR(tty))
1366	return;
1367	if (I_ICRNL(tty))
1368	c = '\n';
1369	} else if (c == '\n' && I_INLCR(tty))
1370	c = '\r';
1371
1372	if (ldata->icanon && n_tty_receive_char_canon(tty, c))
1373	return;
1374
1375	if (L_ECHO(tty)) {
1376	finish_erasing(ldata);
1377	if (c == '\n')
1378	echo_char_raw(c: '\n', ldata);
1379	else {
1380	/* Record the column of first canon char. */
1381	if (ldata->canon_head == ldata->read_head)
1382	echo_set_canon_col(ldata);
1383	echo_char(c, tty);
1384	}
1385	commit_echoes(tty);
1386	}
1387
1388	/* PARMRK doubling check */
1389	if (c == '\377' && I_PARMRK(tty))
1390	put_tty_queue(c, ldata);
1391
1392	put_tty_queue(c, ldata);
1393	}
1394
1395	/**
1396	* n_tty_receive_char - perform processing
1397	* @tty: terminal device
1398	* @c: character
1399	*
1400	* Process an individual character of input received from the driver. This is
1401	* serialized with respect to itself by the rules for the driver above.
1402	*
1403	* Locking: n_tty_receive_buf()/producer path:
1404	* caller holds non-exclusive %termios_rwsem
1405	* publishes canon_head if canonical mode is active
1406	*/
1407	static void n_tty_receive_char(struct tty_struct *tty, u8 c)
1408	{
1409	struct n_tty_data *ldata = tty->disc_data;
1410
1411	if (tty->flow.stopped && !tty->flow.tco_stopped && I_IXON(tty) && I_IXANY(tty)) {
1412	start_tty(tty);
1413	process_echoes(tty);
1414	}
1415	if (L_ECHO(tty)) {
1416	finish_erasing(ldata);
1417	/* Record the column of first canon char. */
1418	if (ldata->canon_head == ldata->read_head)
1419	echo_set_canon_col(ldata);
1420	echo_char(c, tty);
1421	commit_echoes(tty);
1422	}
1423	/* PARMRK doubling check */
1424	if (c == '\377' && I_PARMRK(tty))
1425	put_tty_queue(c, ldata);
1426	put_tty_queue(c, ldata);
1427	}
1428
1429	static void n_tty_receive_char_closing(struct tty_struct *tty, u8 c,
1430	bool lookahead_done)
1431	{
1432	if (I_ISTRIP(tty))
1433	c &= 0x7f;
1434	if (I_IUCLC(tty) && L_IEXTEN(tty))
1435	c = tolower(c);
1436
1437	if (I_IXON(tty)) {
1438	if (!n_tty_receive_char_flow_ctrl(tty, c, lookahead_done) &&
1439	tty->flow.stopped && !tty->flow.tco_stopped && I_IXANY(tty) &&
1440	c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) &&
1441	c != SUSP_CHAR(tty)) {
1442	start_tty(tty);
1443	process_echoes(tty);
1444	}
1445	}
1446	}
1447
1448	static void
1449	n_tty_receive_char_flagged(struct tty_struct *tty, u8 c, u8 flag)
1450	{
1451	switch (flag) {
1452	case TTY_BREAK:
1453	n_tty_receive_break(tty);
1454	break;
1455	case TTY_PARITY:
1456	case TTY_FRAME:
1457	n_tty_receive_parity_error(tty, c);
1458	break;
1459	case TTY_OVERRUN:
1460	n_tty_receive_overrun(tty);
1461	break;
1462	default:
1463	tty_err(tty, "unknown flag %u\n", flag);
1464	break;
1465	}
1466	}
1467
1468	static void
1469	n_tty_receive_char_lnext(struct tty_struct *tty, u8 c, u8 flag)
1470	{
1471	struct n_tty_data *ldata = tty->disc_data;
1472
1473	ldata->lnext = 0;
1474	if (likely(flag == TTY_NORMAL)) {
1475	if (I_ISTRIP(tty))
1476	c &= 0x7f;
1477	if (I_IUCLC(tty) && L_IEXTEN(tty))
1478	c = tolower(c);
1479	n_tty_receive_char(tty, c);
1480	} else
1481	n_tty_receive_char_flagged(tty, c, flag);
1482	}
1483
1484	/* Caller must ensure count > 0 */
1485	static void n_tty_lookahead_flow_ctrl(struct tty_struct *tty, const u8 *cp,
1486	const u8 *fp, size_t count)
1487	{
1488	struct n_tty_data *ldata = tty->disc_data;
1489	u8 flag = TTY_NORMAL;
1490
1491	ldata->lookahead_count += count;
1492
1493	if (!I_IXON(tty))
1494	return;
1495
1496	while (count--) {
1497	if (fp)
1498	flag = *fp++;
1499	if (likely(flag == TTY_NORMAL))
1500	n_tty_receive_char_flow_ctrl(tty, c: *cp, lookahead_done: false);
1501	cp++;
1502	}
1503	}
1504
1505	static void
1506	n_tty_receive_buf_real_raw(const struct tty_struct *tty, const u8 *cp,
1507	size_t count)
1508	{
1509	struct n_tty_data *ldata = tty->disc_data;
1510
1511	/* handle buffer wrap-around by a loop */
1512	for (unsigned int i = 0; i < 2; i++) {
1513	size_t head = MASK(ldata->read_head);
1514	size_t n = min(count, N_TTY_BUF_SIZE - head);
1515
1516	memcpy(read_buf_addr(ldata, head), cp, n);
1517
1518	ldata->read_head += n;
1519	cp += n;
1520	count -= n;
1521	}
1522	}
1523
1524	static void
1525	n_tty_receive_buf_raw(struct tty_struct *tty, const u8 *cp, const u8 *fp,
1526	size_t count)
1527	{
1528	struct n_tty_data *ldata = tty->disc_data;
1529	u8 flag = TTY_NORMAL;
1530
1531	while (count--) {
1532	if (fp)
1533	flag = *fp++;
1534	if (likely(flag == TTY_NORMAL))
1535	put_tty_queue(c: *cp++, ldata);
1536	else
1537	n_tty_receive_char_flagged(tty, c: *cp++, flag);
1538	}
1539	}
1540
1541	static void
1542	n_tty_receive_buf_closing(struct tty_struct *tty, const u8 *cp, const u8 *fp,
1543	size_t count, bool lookahead_done)
1544	{
1545	u8 flag = TTY_NORMAL;
1546
1547	while (count--) {
1548	if (fp)
1549	flag = *fp++;
1550	if (likely(flag == TTY_NORMAL))
1551	n_tty_receive_char_closing(tty, c: *cp++, lookahead_done);
1552	}
1553	}
1554
1555	static void n_tty_receive_buf_standard(struct tty_struct *tty, const u8 *cp,
1556	const u8 *fp, size_t count,
1557	bool lookahead_done)
1558	{
1559	struct n_tty_data *ldata = tty->disc_data;
1560	u8 flag = TTY_NORMAL;
1561
1562	while (count--) {
1563	u8 c = *cp++;
1564
1565	if (fp)
1566	flag = *fp++;
1567
1568	if (ldata->lnext) {
1569	n_tty_receive_char_lnext(tty, c, flag);
1570	continue;
1571	}
1572
1573	if (unlikely(flag != TTY_NORMAL)) {
1574	n_tty_receive_char_flagged(tty, c, flag);
1575	continue;
1576	}
1577
1578	if (I_ISTRIP(tty))
1579	c &= 0x7f;
1580	if (I_IUCLC(tty) && L_IEXTEN(tty))
1581	c = tolower(c);
1582	if (L_EXTPROC(tty)) {
1583	put_tty_queue(c, ldata);
1584	continue;
1585	}
1586
1587	if (test_bit(c, ldata->char_map))
1588	n_tty_receive_char_special(tty, c, lookahead_done);
1589	else
1590	n_tty_receive_char(tty, c);
1591	}
1592	}
1593
1594	static void __receive_buf(struct tty_struct *tty, const u8 *cp, const u8 *fp,
1595	size_t count)
1596	{
1597	struct n_tty_data *ldata = tty->disc_data;
1598	bool preops = I_ISTRIP(tty) || (I_IUCLC(tty) && L_IEXTEN(tty));
1599	size_t la_count = min(ldata->lookahead_count, count);
1600
1601	if (ldata->real_raw)
1602	n_tty_receive_buf_real_raw(tty, cp, count);
1603	else if (ldata->raw || (L_EXTPROC(tty) && !preops))
1604	n_tty_receive_buf_raw(tty, cp, fp, count);
1605	else if (tty->closing && !L_EXTPROC(tty)) {
1606	if (la_count > 0) {
1607	n_tty_receive_buf_closing(tty, cp, fp, count: la_count, lookahead_done: true);
1608	cp += la_count;
1609	if (fp)
1610	fp += la_count;
1611	count -= la_count;
1612	}
1613	if (count > 0)
1614	n_tty_receive_buf_closing(tty, cp, fp, count, lookahead_done: false);
1615	} else {
1616	if (la_count > 0) {
1617	n_tty_receive_buf_standard(tty, cp, fp, count: la_count, lookahead_done: true);
1618	cp += la_count;
1619	if (fp)
1620	fp += la_count;
1621	count -= la_count;
1622	}
1623	if (count > 0)
1624	n_tty_receive_buf_standard(tty, cp, fp, count, lookahead_done: false);
1625
1626	flush_echoes(tty);
1627	if (tty->ops->flush_chars)
1628	tty->ops->flush_chars(tty);
1629	}
1630
1631	ldata->lookahead_count -= la_count;
1632
1633	if (ldata->icanon && !L_EXTPROC(tty))
1634	return;
1635
1636	/* publish read_head to consumer */
1637	smp_store_release(&ldata->commit_head, ldata->read_head);
1638
1639	if (read_cnt(ldata)) {
1640	kill_fasync(&tty->fasync, SIGIO, POLL_IN);
1641	wake_up_interruptible_poll(&tty->read_wait, EPOLLIN | EPOLLRDNORM);
1642	}
1643	}
1644
1645	/**
1646	* n_tty_receive_buf_common - process input
1647	* @tty: device to receive input
1648	* @cp: input chars
1649	* @fp: flags for each char (if %NULL, all chars are %TTY_NORMAL)
1650	* @count: number of input chars in @cp
1651	* @flow: enable flow control
1652	*
1653	* Called by the terminal driver when a block of characters has been received.
1654	* This function must be called from soft contexts not from interrupt context.
1655	* The driver is responsible for making calls one at a time and in order (or
1656	* using flush_to_ldisc()).
1657	*
1658	* Returns: the # of input chars from @cp which were processed.
1659	*
1660	* In canonical mode, the maximum line length is 4096 chars (including the line
1661	* termination char); lines longer than 4096 chars are truncated. After 4095
1662	* chars, input data is still processed but not stored. Overflow processing
1663	* ensures the tty can always receive more input until at least one line can be
1664	* read.
1665	*
1666	* In non-canonical mode, the read buffer will only accept 4095 chars; this
1667	* provides the necessary space for a newline char if the input mode is
1668	* switched to canonical.
1669	*
1670	* Note it is possible for the read buffer to _contain_ 4096 chars in
1671	* non-canonical mode: the read buffer could already contain the maximum canon
1672	* line of 4096 chars when the mode is switched to non-canonical.
1673	*
1674	* Locking: n_tty_receive_buf()/producer path:
1675	* claims non-exclusive %termios_rwsem
1676	* publishes commit_head or canon_head
1677	*/
1678	static size_t
1679	n_tty_receive_buf_common(struct tty_struct *tty, const u8 *cp, const u8 *fp,
1680	size_t count, bool flow)
1681	{
1682	struct n_tty_data *ldata = tty->disc_data;
1683	size_t n, rcvd = 0;
1684	int room, overflow;
1685
1686	down_read(sem: &tty->termios_rwsem);
1687
1688	do {
1689	/*
1690	* When PARMRK is set, each input char may take up to 3 chars
1691	* in the read buf; reduce the buffer space avail by 3x
1692	*
1693	* If we are doing input canonicalization, and there are no
1694	* pending newlines, let characters through without limit, so
1695	* that erase characters will be handled. Other excess
1696	* characters will be beeped.
1697	*
1698	* paired with store in *_copy_from_read_buf() -- guarantees
1699	* the consumer has loaded the data in read_buf up to the new
1700	* read_tail (so this producer will not overwrite unread data)
1701	*/
1702	size_t tail = smp_load_acquire(&ldata->read_tail);
1703
1704	room = N_TTY_BUF_SIZE - (ldata->read_head - tail);
1705	if (I_PARMRK(tty))
1706	room = DIV_ROUND_UP(room, 3);
1707	room--;
1708	if (room <= 0) {
1709	overflow = ldata->icanon && ldata->canon_head == tail;
1710	if (overflow && room < 0)
1711	ldata->read_head--;
1712	room = overflow;
1713	WRITE_ONCE(ldata->no_room, flow && !room);
1714	} else
1715	overflow = 0;
1716
1717	n = min_t(size_t, count, room);
1718	if (!n)
1719	break;
1720
1721	/* ignore parity errors if handling overflow */
1722	if (!overflow || !fp || *fp != TTY_PARITY)
1723	__receive_buf(tty, cp, fp, count: n);
1724
1725	cp += n;
1726	if (fp)
1727	fp += n;
1728	count -= n;
1729	rcvd += n;
1730	} while (!test_bit(TTY_LDISC_CHANGING, &tty->flags));
1731
1732	tty->receive_room = room;
1733
1734	/* Unthrottle if handling overflow on pty */
1735	if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
1736	if (overflow) {
1737	tty_set_flow_change(tty, val: TTY_UNTHROTTLE_SAFE);
1738	tty_unthrottle_safe(tty);
1739	__tty_set_flow_change(tty, val: 0);
1740	}
1741	} else
1742	n_tty_check_throttle(tty);
1743
1744	if (unlikely(ldata->no_room)) {
1745	/*
1746	* Barrier here is to ensure to read the latest read_tail in
1747	* chars_in_buffer() and to make sure that read_tail is not loaded
1748	* before ldata->no_room is set.
1749	*/
1750	smp_mb();
1751	if (!chars_in_buffer(tty))
1752	n_tty_kick_worker(tty);
1753	}
1754
1755	up_read(sem: &tty->termios_rwsem);
1756
1757	return rcvd;
1758	}
1759
1760	static void n_tty_receive_buf(struct tty_struct *tty, const u8 *cp,
1761	const u8 *fp, size_t count)
1762	{
1763	n_tty_receive_buf_common(tty, cp, fp, count, flow: false);
1764	}
1765
1766	static size_t n_tty_receive_buf2(struct tty_struct *tty, const u8 *cp,
1767	const u8 *fp, size_t count)
1768	{
1769	return n_tty_receive_buf_common(tty, cp, fp, count, flow: true);
1770	}
1771
1772	/**
1773	* n_tty_set_termios - termios data changed
1774	* @tty: terminal
1775	* @old: previous data
1776	*
1777	* Called by the tty layer when the user changes termios flags so that the line
1778	* discipline can plan ahead. This function cannot sleep and is protected from
1779	* re-entry by the tty layer. The user is guaranteed that this function will
1780	* not be re-entered or in progress when the ldisc is closed.
1781	*
1782	* Locking: Caller holds @tty->termios_rwsem
1783	*/
1784	static void n_tty_set_termios(struct tty_struct *tty, const struct ktermios *old)
1785	{
1786	struct n_tty_data *ldata = tty->disc_data;
1787
1788	if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) {
1789	bitmap_zero(dst: ldata->read_flags, N_TTY_BUF_SIZE);
1790	ldata->line_start = ldata->read_tail;
1791	if (!L_ICANON(tty) || !read_cnt(ldata)) {
1792	ldata->canon_head = ldata->read_tail;
1793	ldata->push = 0;
1794	} else {
1795	set_bit(MASK(ldata->read_head - 1), addr: ldata->read_flags);
1796	ldata->canon_head = ldata->read_head;
1797	ldata->push = 1;
1798	}
1799	ldata->commit_head = ldata->read_head;
1800	ldata->erasing = 0;
1801	ldata->lnext = 0;
1802	}
1803
1804	ldata->icanon = (L_ICANON(tty) != 0);
1805
1806	if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
1807	I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
1808	I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
1809	I_PARMRK(tty)) {
1810	bitmap_zero(dst: ldata->char_map, nbits: 256);
1811
1812	if (I_IGNCR(tty) || I_ICRNL(tty))
1813	set_bit(nr: '\r', addr: ldata->char_map);
1814	if (I_INLCR(tty))
1815	set_bit(nr: '\n', addr: ldata->char_map);
1816
1817	if (L_ICANON(tty)) {
1818	set_bit(ERASE_CHAR(tty), addr: ldata->char_map);
1819	set_bit(KILL_CHAR(tty), addr: ldata->char_map);
1820	set_bit(EOF_CHAR(tty), addr: ldata->char_map);
1821	set_bit(nr: '\n', addr: ldata->char_map);
1822	set_bit(EOL_CHAR(tty), addr: ldata->char_map);
1823	if (L_IEXTEN(tty)) {
1824	set_bit(WERASE_CHAR(tty), addr: ldata->char_map);
1825	set_bit(LNEXT_CHAR(tty), addr: ldata->char_map);
1826	set_bit(EOL2_CHAR(tty), addr: ldata->char_map);
1827	if (L_ECHO(tty))
1828	set_bit(REPRINT_CHAR(tty),
1829	addr: ldata->char_map);
1830	}
1831	}
1832	if (I_IXON(tty)) {
1833	set_bit(START_CHAR(tty), addr: ldata->char_map);
1834	set_bit(STOP_CHAR(tty), addr: ldata->char_map);
1835	}
1836	if (L_ISIG(tty)) {
1837	set_bit(INTR_CHAR(tty), addr: ldata->char_map);
1838	set_bit(QUIT_CHAR(tty), addr: ldata->char_map);
1839	set_bit(SUSP_CHAR(tty), addr: ldata->char_map);
1840	}
1841	clear_bit(__DISABLED_CHAR, addr: ldata->char_map);
1842	ldata->raw = 0;
1843	ldata->real_raw = 0;
1844	} else {
1845	ldata->raw = 1;
1846	if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
1847	(I_IGNPAR(tty) || !I_INPCK(tty)) &&
1848	(tty->driver->flags & TTY_DRIVER_REAL_RAW))
1849	ldata->real_raw = 1;
1850	else
1851	ldata->real_raw = 0;
1852	}
1853	/*
1854	* Fix tty hang when I_IXON(tty) is cleared, but the tty
1855	* been stopped by STOP_CHAR(tty) before it.
1856	*/
1857	if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow.tco_stopped) {
1858	start_tty(tty);
1859	process_echoes(tty);
1860	}
1861
1862	/* The termios change make the tty ready for I/O */
1863	wake_up_interruptible(&tty->write_wait);
1864	wake_up_interruptible(&tty->read_wait);
1865	}
1866
1867	/**
1868	* n_tty_close - close the ldisc for this tty
1869	* @tty: device
1870	*
1871	* Called from the terminal layer when this line discipline is being shut down,
1872	* either because of a close or becsuse of a discipline change. The function
1873	* will not be called while other ldisc methods are in progress.
1874	*/
1875	static void n_tty_close(struct tty_struct *tty)
1876	{
1877	struct n_tty_data *ldata = tty->disc_data;
1878
1879	if (tty->link)
1880	n_tty_packet_mode_flush(tty);
1881
1882	down_write(sem: &tty->termios_rwsem);
1883	vfree(addr: ldata);
1884	tty->disc_data = NULL;
1885	up_write(sem: &tty->termios_rwsem);
1886	}
1887
1888	/**
1889	* n_tty_open - open an ldisc
1890	* @tty: terminal to open
1891	*
1892	* Called when this line discipline is being attached to the terminal device.
1893	* Can sleep. Called serialized so that no other events will occur in parallel.
1894	* No further open will occur until a close.
1895	*/
1896	static int n_tty_open(struct tty_struct *tty)
1897	{
1898	struct n_tty_data *ldata;
1899
1900	/* Currently a malloc failure here can panic */
1901	ldata = vzalloc(sizeof(*ldata));
1902	if (!ldata)
1903	return -ENOMEM;
1904
1905	ldata->overrun_time = jiffies;
1906	mutex_init(&ldata->atomic_read_lock);
1907	mutex_init(&ldata->output_lock);
1908
1909	tty->disc_data = ldata;
1910	tty->closing = 0;
1911	/* indicate buffer work may resume */
1912	clear_bit(nr: TTY_LDISC_HALTED, addr: &tty->flags);
1913	n_tty_set_termios(tty, NULL);
1914	tty_unthrottle(tty);
1915	return 0;
1916	}
1917
1918	static inline int input_available_p(const struct tty_struct *tty, int poll)
1919	{
1920	const struct n_tty_data *ldata = tty->disc_data;
1921	int amt = poll && !TIME_CHAR(tty) && MIN_CHAR(tty) ? MIN_CHAR(tty) : 1;
1922
1923	if (ldata->icanon && !L_EXTPROC(tty))
1924	return ldata->canon_head != ldata->read_tail;
1925	else
1926	return ldata->commit_head - ldata->read_tail >= amt;
1927	}
1928
1929	/**
1930	* copy_from_read_buf - copy read data directly
1931	* @tty: terminal device
1932	* @kbp: data
1933	* @nr: size of data
1934	*
1935	* Helper function to speed up n_tty_read(). It is only called when %ICANON is
1936	* off; it copies characters straight from the tty queue.
1937	*
1938	* Returns: true if it successfully copied data, but there is still more data
1939	* to be had.
1940	*
1941	* Locking:
1942	* * called under the @ldata->atomic_read_lock sem
1943	* * n_tty_read()/consumer path:
1944	* caller holds non-exclusive %termios_rwsem;
1945	* read_tail published
1946	*/
1947	static bool copy_from_read_buf(const struct tty_struct *tty, u8 **kbp,
1948	size_t *nr)
1949
1950	{
1951	struct n_tty_data *ldata = tty->disc_data;
1952	size_t n;
1953	bool is_eof;
1954	size_t head = smp_load_acquire(&ldata->commit_head);
1955	size_t tail = MASK(ldata->read_tail);
1956
1957	n = min3(head - ldata->read_tail, N_TTY_BUF_SIZE - tail, *nr);
1958	if (!n)
1959	return false;
1960
1961	u8 *from = read_buf_addr(ldata, i: tail);
1962	memcpy(*kbp, from, n);
1963	is_eof = n == 1 && *from == EOF_CHAR(tty);
1964	tty_audit_add_data(tty, data: from, size: n);
1965	zero_buffer(tty, buffer: from, size: n);
1966	smp_store_release(&ldata->read_tail, ldata->read_tail + n);
1967
1968	/* Turn single EOF into zero-length read */
1969	if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
1970	head == ldata->read_tail)
1971	return false;
1972
1973	*kbp += n;
1974	*nr -= n;
1975
1976	/* If we have more to copy, let the caller know */
1977	return head != ldata->read_tail;
1978	}
1979
1980	/**
1981	* canon_copy_from_read_buf - copy read data in canonical mode
1982	* @tty: terminal device
1983	* @kbp: data
1984	* @nr: size of data
1985	*
1986	* Helper function for n_tty_read(). It is only called when %ICANON is on; it
1987	* copies one line of input up to and including the line-delimiting character
1988	* into the result buffer.
1989	*
1990	* Note: When termios is changed from non-canonical to canonical mode and the
1991	* read buffer contains data, n_tty_set_termios() simulates an EOF push (as if
1992	* C-d were input) _without_ the %DISABLED_CHAR in the buffer. This causes data
1993	* already processed as input to be immediately available as input although a
1994	* newline has not been received.
1995	*
1996	* Locking:
1997	* * called under the %atomic_read_lock mutex
1998	* * n_tty_read()/consumer path:
1999	* caller holds non-exclusive %termios_rwsem;
2000	* read_tail published
2001	*/
2002	static bool canon_copy_from_read_buf(const struct tty_struct *tty, u8 **kbp,
2003	size_t *nr)
2004	{
2005	struct n_tty_data *ldata = tty->disc_data;
2006	size_t n, size, more, c;
2007	size_t eol;
2008	size_t tail, canon_head;
2009	int found = 0;
2010
2011	/* N.B. avoid overrun if nr == 0 */
2012	if (!*nr)
2013	return false;
2014
2015	canon_head = smp_load_acquire(&ldata->canon_head);
2016	n = min(*nr, canon_head - ldata->read_tail);
2017
2018	tail = MASK(ldata->read_tail);
2019	size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
2020
2021	eol = find_next_bit(addr: ldata->read_flags, size, offset: tail);
2022	more = n - (size - tail);
2023	if (eol == N_TTY_BUF_SIZE && more) {
2024	/* scan wrapped without finding set bit */
2025	eol = find_first_bit(addr: ldata->read_flags, size: more);
2026	found = eol != more;
2027	} else
2028	found = eol != size;
2029
2030	n = eol - tail;
2031	if (n > N_TTY_BUF_SIZE)
2032	n += N_TTY_BUF_SIZE;
2033	c = n + found;
2034
2035	if (!found || read_buf(ldata, i: eol) != __DISABLED_CHAR)
2036	n = c;
2037
2038	tty_copy(tty, to: *kbp, tail, n);
2039	*kbp += n;
2040	*nr -= n;
2041
2042	if (found)
2043	clear_bit(nr: eol, addr: ldata->read_flags);
2044	smp_store_release(&ldata->read_tail, ldata->read_tail + c);
2045
2046	if (found) {
2047	if (!ldata->push)
2048	ldata->line_start = ldata->read_tail;
2049	else
2050	ldata->push = 0;
2051	tty_audit_push();
2052	return false;
2053	}
2054
2055	/* No EOL found - do a continuation retry if there is more data */
2056	return ldata->read_tail != canon_head;
2057	}
2058
2059	/*
2060	* If we finished a read at the exact location of an
2061	* EOF (special EOL character that's a __DISABLED_CHAR)
2062	* in the stream, silently eat the EOF.
2063	*/
2064	static void canon_skip_eof(struct n_tty_data *ldata)
2065	{
2066	size_t tail, canon_head;
2067
2068	canon_head = smp_load_acquire(&ldata->canon_head);
2069	tail = ldata->read_tail;
2070
2071	// No data?
2072	if (tail == canon_head)
2073	return;
2074
2075	// See if the tail position is EOF in the circular buffer
2076	tail &= (N_TTY_BUF_SIZE - 1);
2077	if (!test_bit(tail, ldata->read_flags))
2078	return;
2079	if (read_buf(ldata, i: tail) != __DISABLED_CHAR)
2080	return;
2081
2082	// Clear the EOL bit, skip the EOF char.
2083	clear_bit(nr: tail, addr: ldata->read_flags);
2084	smp_store_release(&ldata->read_tail, ldata->read_tail + 1);
2085	}
2086
2087	/**
2088	* job_control - check job control
2089	* @tty: tty
2090	* @file: file handle
2091	*
2092	* Perform job control management checks on this @file/@tty descriptor and if
2093	* appropriate send any needed signals and return a negative error code if
2094	* action should be taken.
2095	*
2096	* Locking:
2097	* * redirected write test is safe
2098	* * current->signal->tty check is safe
2099	* * ctrl.lock to safely reference @tty->ctrl.pgrp
2100	*/
2101	static int job_control(struct tty_struct *tty, struct file *file)
2102	{
2103	/* Job control check -- must be done at start and after
2104	every sleep (POSIX.1 7.1.1.4). */
2105	/* NOTE: not yet done after every sleep pending a thorough
2106	check of the logic of this change. -- jlc */
2107	/* don't stop on /dev/console */
2108	if (file->f_op->write_iter == redirected_tty_write)
2109	return 0;
2110
2111	return __tty_check_change(tty, SIGTTIN);
2112	}
2113
2114	/*
2115	* We still hold the atomic_read_lock and the termios_rwsem, and can just
2116	* continue to copy data.
2117	*/
2118	static ssize_t n_tty_continue_cookie(struct tty_struct *tty, u8 *kbuf,
2119	size_t nr, void **cookie)
2120	{
2121	struct n_tty_data *ldata = tty->disc_data;
2122	u8 *kb = kbuf;
2123
2124	if (ldata->icanon && !L_EXTPROC(tty)) {
2125	/*
2126	* If we have filled the user buffer, see if we should skip an
2127	* EOF character before releasing the lock and returning done.
2128	*/
2129	if (!nr)
2130	canon_skip_eof(ldata);
2131	else if (canon_copy_from_read_buf(tty, kbp: &kb, nr: &nr))
2132	return kb - kbuf;
2133	} else {
2134	if (copy_from_read_buf(tty, kbp: &kb, nr: &nr))
2135	return kb - kbuf;
2136	}
2137
2138	/* No more data - release locks and stop retries */
2139	n_tty_kick_worker(tty);
2140	n_tty_check_unthrottle(tty);
2141	up_read(sem: &tty->termios_rwsem);
2142	mutex_unlock(lock: &ldata->atomic_read_lock);
2143	*cookie = NULL;
2144
2145	return kb - kbuf;
2146	}
2147
2148	static int n_tty_wait_for_input(struct tty_struct *tty, struct file *file,
2149	struct wait_queue_entry *wait, long *timeout)
2150	{
2151	if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
2152	return -EIO;
2153	if (tty_hung_up_p(filp: file))
2154	return 0;
2155	/*
2156	* Abort readers for ttys which never actually get hung up.
2157	* See __tty_hangup().
2158	*/
2159	if (test_bit(TTY_HUPPING, &tty->flags))
2160	return 0;
2161	if (!*timeout)
2162	return 0;
2163	if (tty_io_nonblock(tty, file))
2164	return -EAGAIN;
2165	if (signal_pending(current))
2166	return -ERESTARTSYS;
2167
2168	up_read(sem: &tty->termios_rwsem);
2169	*timeout = wait_woken(wq_entry: wait, TASK_INTERRUPTIBLE, timeout: *timeout);
2170	down_read(sem: &tty->termios_rwsem);
2171
2172	return 1;
2173	}
2174
2175	/**
2176	* n_tty_read - read function for tty
2177	* @tty: tty device
2178	* @file: file object
2179	* @kbuf: kernelspace buffer pointer
2180	* @nr: size of I/O
2181	* @cookie: if non-%NULL, this is a continuation read
2182	* @offset: where to continue reading from (unused in n_tty)
2183	*
2184	* Perform reads for the line discipline. We are guaranteed that the line
2185	* discipline will not be closed under us but we may get multiple parallel
2186	* readers and must handle this ourselves. We may also get a hangup. Always
2187	* called in user context, may sleep.
2188	*
2189	* This code must be sure never to sleep through a hangup.
2190	*
2191	* Locking: n_tty_read()/consumer path:
2192	* claims non-exclusive termios_rwsem;
2193	* publishes read_tail
2194	*/
2195	static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, u8 *kbuf,
2196	size_t nr, void **cookie, unsigned long offset)
2197	{
2198	struct n_tty_data *ldata = tty->disc_data;
2199	u8 *kb = kbuf;
2200	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2201	int minimum, time;
2202	ssize_t retval;
2203	long timeout;
2204	bool packet;
2205	size_t old_tail;
2206
2207	/* Is this a continuation of a read started earlier? */
2208	if (*cookie)
2209	return n_tty_continue_cookie(tty, kbuf, nr, cookie);
2210
2211	retval = job_control(tty, file);
2212	if (retval < 0)
2213	return retval;
2214
2215	/*
2216	* Internal serialization of reads.
2217	*/
2218	if (file->f_flags & O_NONBLOCK) {
2219	if (!mutex_trylock(&ldata->atomic_read_lock))
2220	return -EAGAIN;
2221	} else {
2222	if (mutex_lock_interruptible(&ldata->atomic_read_lock))
2223	return -ERESTARTSYS;
2224	}
2225
2226	down_read(sem: &tty->termios_rwsem);
2227
2228	minimum = time = 0;
2229	timeout = MAX_SCHEDULE_TIMEOUT;
2230	if (!ldata->icanon) {
2231	minimum = MIN_CHAR(tty);
2232	if (minimum) {
2233	time = (HZ / 10) * TIME_CHAR(tty);
2234	} else {
2235	timeout = (HZ / 10) * TIME_CHAR(tty);
2236	minimum = 1;
2237	}
2238	}
2239
2240	packet = tty->ctrl.packet;
2241	old_tail = ldata->read_tail;
2242
2243	add_wait_queue(wq_head: &tty->read_wait, wq_entry: &wait);
2244	while (nr) {
2245	/* First test for status change. */
2246	if (packet && tty->link->ctrl.pktstatus) {
2247	u8 cs;
2248	if (kb != kbuf)
2249	break;
2250	spin_lock_irq(lock: &tty->link->ctrl.lock);
2251	cs = tty->link->ctrl.pktstatus;
2252	tty->link->ctrl.pktstatus = 0;
2253	spin_unlock_irq(lock: &tty->link->ctrl.lock);
2254	*kb++ = cs;
2255	nr--;
2256	break;
2257	}
2258
2259	if (!input_available_p(tty, poll: 0)) {
2260	up_read(sem: &tty->termios_rwsem);
2261	tty_buffer_flush_work(port: tty->port);
2262	down_read(sem: &tty->termios_rwsem);
2263	if (!input_available_p(tty, poll: 0)) {
2264	int ret = n_tty_wait_for_input(tty, file, wait: &wait,
2265	timeout: &timeout);
2266	if (ret <= 0) {
2267	retval = ret;
2268	break;
2269	}
2270	continue;
2271	}
2272	}
2273
2274	if (ldata->icanon && !L_EXTPROC(tty)) {
2275	if (canon_copy_from_read_buf(tty, kbp: &kb, nr: &nr))
2276	goto more_to_be_read;
2277	} else {
2278	/* Deal with packet mode. */
2279	if (packet && kb == kbuf) {
2280	*kb++ = TIOCPKT_DATA;
2281	nr--;
2282	}
2283
2284	if (copy_from_read_buf(tty, kbp: &kb, nr: &nr) && kb - kbuf >= minimum)
2285	goto more_to_be_read;
2286	}
2287
2288	n_tty_check_unthrottle(tty);
2289
2290	if (kb - kbuf >= minimum)
2291	break;
2292	if (time)
2293	timeout = time;
2294	}
2295	if (old_tail != ldata->read_tail) {
2296	/*
2297	* Make sure no_room is not read in n_tty_kick_worker()
2298	* before setting ldata->read_tail in copy_from_read_buf().
2299	*/
2300	smp_mb();
2301	n_tty_kick_worker(tty);
2302	}
2303	up_read(sem: &tty->termios_rwsem);
2304
2305	remove_wait_queue(wq_head: &tty->read_wait, wq_entry: &wait);
2306	mutex_unlock(lock: &ldata->atomic_read_lock);
2307
2308	if (kb - kbuf)
2309	retval = kb - kbuf;
2310
2311	return retval;
2312	more_to_be_read:
2313	/*
2314	* There is more to be had and we have nothing more to wait for, so
2315	* let's mark us for retries.
2316	*
2317	* NOTE! We return here with both the termios_sem and atomic_read_lock
2318	* still held, the retries will release them when done.
2319	*/
2320	remove_wait_queue(wq_head: &tty->read_wait, wq_entry: &wait);
2321	*cookie = cookie;
2322
2323	return kb - kbuf;
2324	}
2325
2326	/**
2327	* n_tty_write - write function for tty
2328	* @tty: tty device
2329	* @file: file object
2330	* @buf: userspace buffer pointer
2331	* @nr: size of I/O
2332	*
2333	* Write function of the terminal device. This is serialized with respect to
2334	* other write callers but not to termios changes, reads and other such events.
2335	* Since the receive code will echo characters, thus calling driver write
2336	* methods, the %output_lock is used in the output processing functions called
2337	* here as well as in the echo processing function to protect the column state
2338	* and space left in the buffer.
2339	*
2340	* This code must be sure never to sleep through a hangup.
2341	*
2342	* Locking: output_lock to protect column state and space left
2343	* (note that the process_output*() functions take this lock themselves)
2344	*/
2345
2346	static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
2347	const u8 *buf, size_t nr)
2348	{
2349	const u8 *b = buf;
2350	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2351	ssize_t num, retval = 0;
2352
2353	/* Job control check -- must be done at start (POSIX.1 7.1.1.4). */
2354	if (L_TOSTOP(tty) && file->f_op->write_iter != redirected_tty_write) {
2355	retval = tty_check_change(tty);
2356	if (retval)
2357	return retval;
2358	}
2359
2360	down_read(sem: &tty->termios_rwsem);
2361
2362	/* Write out any echoed characters that are still pending */
2363	process_echoes(tty);
2364
2365	add_wait_queue(wq_head: &tty->write_wait, wq_entry: &wait);
2366	while (1) {
2367	if (signal_pending(current)) {
2368	retval = -ERESTARTSYS;
2369	break;
2370	}
2371	if (tty_hung_up_p(filp: file) || (tty->link && !tty->link->count)) {
2372	retval = -EIO;
2373	break;
2374	}
2375	if (O_OPOST(tty)) {
2376	while (nr > 0) {
2377	num = process_output_block(tty, buf: b, nr);
2378	if (num < 0) {
2379	if (num == -EAGAIN)
2380	break;
2381	retval = num;
2382	goto break_out;
2383	}
2384	b += num;
2385	nr -= num;
2386	if (nr == 0)
2387	break;
2388	if (process_output(c: *b, tty) < 0)
2389	break;
2390	b++; nr--;
2391	}
2392	if (tty->ops->flush_chars)
2393	tty->ops->flush_chars(tty);
2394	} else {
2395	struct n_tty_data *ldata = tty->disc_data;
2396
2397	while (nr > 0) {
2398	mutex_lock(&ldata->output_lock);
2399	num = tty->ops->write(tty, b, nr);
2400	mutex_unlock(lock: &ldata->output_lock);
2401	if (num < 0) {
2402	retval = num;
2403	goto break_out;
2404	}
2405	if (!num)
2406	break;
2407	b += num;
2408	nr -= num;
2409	}
2410	}
2411	if (!nr)
2412	break;
2413	if (tty_io_nonblock(tty, file)) {
2414	retval = -EAGAIN;
2415	break;
2416	}
2417	up_read(sem: &tty->termios_rwsem);
2418
2419	wait_woken(wq_entry: &wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2420
2421	down_read(sem: &tty->termios_rwsem);
2422	}
2423	break_out:
2424	remove_wait_queue(wq_head: &tty->write_wait, wq_entry: &wait);
2425	if (nr && tty->fasync)
2426	set_bit(nr: TTY_DO_WRITE_WAKEUP, addr: &tty->flags);
2427	up_read(sem: &tty->termios_rwsem);
2428	return (b - buf) ? b - buf : retval;
2429	}
2430
2431	/**
2432	* n_tty_poll - poll method for N_TTY
2433	* @tty: terminal device
2434	* @file: file accessing it
2435	* @wait: poll table
2436	*
2437	* Called when the line discipline is asked to poll() for data or for special
2438	* events. This code is not serialized with respect to other events save
2439	* open/close.
2440	*
2441	* This code must be sure never to sleep through a hangup.
2442	*
2443	* Locking: called without the kernel lock held -- fine.
2444	*/
2445	static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file,
2446	poll_table *wait)
2447	{
2448	__poll_t mask = 0;
2449
2450	poll_wait(filp: file, wait_address: &tty->read_wait, p: wait);
2451	poll_wait(filp: file, wait_address: &tty->write_wait, p: wait);
2452	if (input_available_p(tty, poll: 1))
2453	mask |= EPOLLIN | EPOLLRDNORM;
2454	else {
2455	tty_buffer_flush_work(port: tty->port);
2456	if (input_available_p(tty, poll: 1))
2457	mask |= EPOLLIN | EPOLLRDNORM;
2458	}
2459	if (tty->ctrl.packet && tty->link->ctrl.pktstatus)
2460	mask |= EPOLLPRI | EPOLLIN | EPOLLRDNORM;
2461	if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
2462	mask |= EPOLLHUP;
2463	if (tty_hung_up_p(filp: file))
2464	mask |= EPOLLHUP;
2465	if (tty->ops->write && !tty_is_writelocked(tty) &&
2466	tty_chars_in_buffer(tty) < WAKEUP_CHARS &&
2467	tty_write_room(tty) > 0)
2468	mask |= EPOLLOUT | EPOLLWRNORM;
2469	return mask;
2470	}
2471
2472	static unsigned long inq_canon(struct n_tty_data *ldata)
2473	{
2474	size_t nr, head, tail;
2475
2476	if (ldata->canon_head == ldata->read_tail)
2477	return 0;
2478	head = ldata->canon_head;
2479	tail = ldata->read_tail;
2480	nr = head - tail;
2481	/* Skip EOF-chars.. */
2482	while (MASK(head) != MASK(tail)) {
2483	if (test_bit(MASK(tail), ldata->read_flags) &&
2484	read_buf(ldata, i: tail) == __DISABLED_CHAR)
2485	nr--;
2486	tail++;
2487	}
2488	return nr;
2489	}
2490
2491	static int n_tty_ioctl(struct tty_struct *tty, unsigned int cmd,
2492	unsigned long arg)
2493	{
2494	struct n_tty_data *ldata = tty->disc_data;
2495	unsigned int num;
2496
2497	switch (cmd) {
2498	case TIOCOUTQ:
2499	return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2500	case TIOCINQ:
2501	down_write(sem: &tty->termios_rwsem);
2502	if (L_ICANON(tty) && !L_EXTPROC(tty))
2503	num = inq_canon(ldata);
2504	else
2505	num = read_cnt(ldata);
2506	up_write(sem: &tty->termios_rwsem);
2507	return put_user(num, (unsigned int __user *) arg);
2508	default:
2509	return n_tty_ioctl_helper(tty, cmd, arg);
2510	}
2511	}
2512
2513	static struct tty_ldisc_ops n_tty_ops = {
2514	.owner = THIS_MODULE,
2515	.num = N_TTY,
2516	.name = "n_tty",
2517	.open = n_tty_open,
2518	.close = n_tty_close,
2519	.flush_buffer = n_tty_flush_buffer,
2520	.read = n_tty_read,
2521	.write = n_tty_write,
2522	.ioctl = n_tty_ioctl,
2523	.set_termios = n_tty_set_termios,
2524	.poll = n_tty_poll,
2525	.receive_buf = n_tty_receive_buf,
2526	.write_wakeup = n_tty_write_wakeup,
2527	.receive_buf2 = n_tty_receive_buf2,
2528	.lookahead_buf = n_tty_lookahead_flow_ctrl,
2529	};
2530
2531	/**
2532	* n_tty_inherit_ops - inherit N_TTY methods
2533	* @ops: struct tty_ldisc_ops where to save N_TTY methods
2534	*
2535	* Enables a 'subclass' line discipline to 'inherit' N_TTY methods.
2536	*/
2537
2538	void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
2539	{
2540	*ops = n_tty_ops;
2541	ops->owner = NULL;
2542	}
2543	EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
2544
2545	void __init n_tty_init(void)
2546	{
2547	tty_register_ldisc(new_ldisc: &n_tty_ops);
2548	}
2549