xref: /dflybsd-src/sys/kern/tty_pty.c (revision 163625b9bf04f32ec3cbbaef7e6b242aeb8a152c)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
34  * $FreeBSD: src/sys/kern/tty_pty.c,v 1.74.2.4 2002/02/20 19:58:13 dillon Exp $
35  * $DragonFly: src/sys/kern/tty_pty.c,v 1.21 2008/08/13 10:29:38 swildner Exp $
36  */
37 
38 /*
39  * Pseudo-teletype Driver
40  * (Actually two drivers, requiring two dev_ops structures)
41  */
42 #include "use_pty.h"		/* XXX */
43 #include "opt_compat.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
48 #include <sys/ioctl_compat.h>
49 #endif
50 #include <sys/proc.h>
51 #include <sys/priv.h>
52 #include <sys/tty.h>
53 #include <sys/conf.h>
54 #include <sys/fcntl.h>
55 #include <sys/kernel.h>
56 #include <sys/vnode.h>
57 #include <sys/signalvar.h>
58 #include <sys/malloc.h>
59 #include <sys/device.h>
60 #include <sys/thread2.h>
61 #include <sys/devfs.h>
62 #include <sys/stat.h>
63 #include <sys/sysctl.h>
64 
65 #define	UNIX98_PTYS	1
66 
67 MALLOC_DEFINE(M_PTY, "ptys", "pty data structures");
68 
69 static void ptsstart (struct tty *tp);
70 static void ptsstop (struct tty *tp, int rw);
71 static void ptcwakeup (struct tty *tp, int flag);
72 static void ptyinit (int n);
73 static int  filt_ptcread (struct knote *kn, long hint);
74 static void filt_ptcrdetach (struct knote *kn);
75 static int  filt_ptcwrite (struct knote *kn, long hint);
76 static void filt_ptcwdetach (struct knote *kn);
77 
78 static	d_open_t	ptsopen;
79 static	d_close_t	ptsclose;
80 static	d_read_t	ptsread;
81 static	d_write_t	ptswrite;
82 static	d_ioctl_t	ptyioctl;
83 static	d_open_t	ptcopen;
84 static	d_close_t	ptcclose;
85 static	d_read_t	ptcread;
86 static	d_write_t	ptcwrite;
87 static	d_kqfilter_t	ptckqfilter;
88 
89 #ifdef UNIX98_PTYS
90 DEVFS_DECLARE_CLONE_BITMAP(pty);
91 
92 static	d_clone_t 	ptyclone;
93 
94 static int	pty_debug_level = 0;
95 
96 static struct dev_ops pts98_ops = {
97 	{ "pts98", 0, D_TTY | D_KQFILTER },
98 	.d_open =	ptsopen,
99 	.d_close =	ptsclose,
100 	.d_read =	ptsread,
101 	.d_write =	ptswrite,
102 	.d_ioctl =	ptyioctl,
103 	.d_kqfilter =	ttykqfilter,
104 	.d_revoke =	ttyrevoke
105 };
106 
107 static struct dev_ops ptc98_ops = {
108 	{ "ptc98", 0, D_TTY | D_KQFILTER | D_MASTER },
109 	.d_open =	ptcopen,
110 	.d_close =	ptcclose,
111 	.d_read =	ptcread,
112 	.d_write =	ptcwrite,
113 	.d_ioctl =	ptyioctl,
114 	.d_kqfilter =	ptckqfilter,
115 	.d_revoke =	ttyrevoke
116 };
117 #endif
118 
119 #define	CDEV_MAJOR_S	5
120 static struct dev_ops pts_ops = {
121 	{ "pts", CDEV_MAJOR_S, D_TTY | D_KQFILTER },
122 	.d_open =	ptsopen,
123 	.d_close =	ptsclose,
124 	.d_read =	ptsread,
125 	.d_write =	ptswrite,
126 	.d_ioctl =	ptyioctl,
127 	.d_kqfilter =	ttykqfilter,
128 	.d_revoke =	ttyrevoke
129 };
130 
131 #define	CDEV_MAJOR_C	6
132 static struct dev_ops ptc_ops = {
133 	{ "ptc", CDEV_MAJOR_C, D_TTY | D_KQFILTER | D_MASTER },
134 	.d_open =	ptcopen,
135 	.d_close =	ptcclose,
136 	.d_read =	ptcread,
137 	.d_write =	ptcwrite,
138 	.d_ioctl =	ptyioctl,
139 	.d_kqfilter =	ptckqfilter,
140 	.d_revoke =	ttyrevoke
141 };
142 
143 #define BUFSIZ 100		/* Chunk size iomoved to/from user */
144 
145 struct	pt_ioctl {
146 	int	pt_flags;
147 	int	pt_flags2;
148 	struct	selinfo pt_selr, pt_selw;
149 	u_char	pt_send;
150 	u_char	pt_ucntl;
151 	struct tty pt_tty;
152 	cdev_t	devs, devc;
153 	struct	prison *pt_prison;
154 };
155 
156 #define	PF_PKT		0x08		/* packet mode */
157 #define	PF_STOPPED	0x10		/* user told stopped */
158 #define	PF_REMOTE	0x20		/* remote and flow controlled input */
159 #define	PF_NOSTOP	0x40
160 #define PF_UCNTL	0x80		/* user control mode */
161 
162 #define	PF_UNIX98	0x01
163 #define	PF_SOPEN	0x02
164 #define	PF_MOPEN	0x04
165 
166 static int
167 ptydebug(int level, char *fmt, ...)
168 {
169 	__va_list ap;
170 
171 	__va_start(ap, fmt);
172 	if (level <= pty_debug_level)
173 		kvprintf(fmt, ap);
174 	__va_end(ap);
175 
176 	return 0;
177 }
178 
179 /*
180  * This function creates and initializes a pts/ptc pair
181  *
182  * pts == /dev/tty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
183  * ptc == /dev/pty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
184  *
185  * XXX: define and add mapping of upper minor bits to allow more
186  *      than 256 ptys.
187  */
188 static void
189 ptyinit(int n)
190 {
191 	cdev_t devs, devc;
192 	char *names = "pqrsPQRS";
193 	struct pt_ioctl *pt;
194 
195 	/* For now we only map the lower 8 bits of the minor */
196 	if (n & ~0xff)
197 		return;
198 
199 	pt = kmalloc(sizeof(*pt), M_PTY, M_WAITOK | M_ZERO);
200 	pt->devs = devs = make_dev(&pts_ops, n,
201 	    0, 0, 0666, "tty%c%r", names[n / 32], n % 32);
202 	pt->devc = devc = make_dev(&ptc_ops, n,
203 	    0, 0, 0666, "pty%c%r", names[n / 32], n % 32);
204 
205 	devs->si_drv1 = devc->si_drv1 = pt;
206 	devs->si_tty = devc->si_tty = &pt->pt_tty;
207 	devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
208 	devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
209 	pt->pt_tty.t_dev = devs;
210 	ttyregister(&pt->pt_tty);
211 }
212 
213 #ifdef UNIX98_PTYS
214 static int
215 ptyclone(struct dev_clone_args *ap)
216 {
217 	int unit;
218 	struct pt_ioctl *pt;
219 
220 	/*
221 	 * Limit the number of unix98 pty (slave) devices to 1000, as
222 	 * the utmp(5) format only allows for 8 bytes for the tty,
223 	 * "pts/XXX".
224 	 * If this limit is reached, we don't clone and return error
225 	 * to devfs.
226 	 */
227 	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), 1000);
228 
229 	if (unit < 0) {
230 		ap->a_dev = NULL;
231 		return 1;
232 	}
233 
234 	pt = kmalloc(sizeof(*pt), M_PTY, M_WAITOK | M_ZERO);
235 
236 	pt->devc = ap->a_dev = make_only_dev(&ptc98_ops, unit, ap->a_cred->cr_ruid,
237 	    0, 0600, "ptm/%d", unit);
238 	pt->devs = make_dev(&pts98_ops, unit, ap->a_cred->cr_ruid, GID_TTY, 0620,
239 	    "pts/%d", unit);
240 
241 	pt->devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
242 	pt->devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
243 
244 	pt->devs->si_drv1 = pt->devc->si_drv1 = pt;
245 	pt->devs->si_tty = pt->devc->si_tty = &pt->pt_tty;
246 	pt->pt_tty.t_dev = pt->devs;
247 	pt->pt_flags2 |= PF_UNIX98;
248 
249 	ttyregister(&pt->pt_tty);
250 
251 	return 0;
252 }
253 #endif
254 
255 /*ARGSUSED*/
256 static	int
257 ptsopen(struct dev_open_args *ap)
258 {
259 	cdev_t dev = ap->a_head.a_dev;
260 	struct tty *tp;
261 	int error;
262 	struct pt_ioctl *pti;
263 
264 	if (!dev->si_drv1)
265 		ptyinit(minor(dev));
266 	if (!dev->si_drv1)
267 		return(ENXIO);
268 	pti = dev->si_drv1;
269 	tp = dev->si_tty;
270 	if ((tp->t_state & TS_ISOPEN) == 0) {
271 		ttychars(tp);		/* Set up default chars */
272 		tp->t_iflag = TTYDEF_IFLAG;
273 		tp->t_oflag = TTYDEF_OFLAG;
274 		tp->t_lflag = TTYDEF_LFLAG;
275 		tp->t_cflag = TTYDEF_CFLAG;
276 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
277 	} else if ((tp->t_state & TS_XCLUDE) && priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) {
278 		return (EBUSY);
279 	} else if (pti->pt_prison != ap->a_cred->cr_prison) {
280 		return (EBUSY);
281 	}
282 	if (tp->t_oproc)			/* Ctrlr still around. */
283 		(void)(*linesw[tp->t_line].l_modem)(tp, 1);
284 	while ((tp->t_state & TS_CARR_ON) == 0) {
285 		if (ap->a_oflags & FNONBLOCK)
286 			break;
287 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ptsopn", 0);
288 		if (error)
289 			return (error);
290 	}
291 	error = (*linesw[tp->t_line].l_open)(dev, tp);
292 	if (error == 0)
293 		ptcwakeup(tp, FREAD|FWRITE);
294 
295 #ifdef UNIX98_PTYS
296 	/*
297 	 * Unix98 pty stuff.
298 	 * On open of the slave, we set the corresponding flag in the common
299 	 * struct.
300 	 */
301 	ptydebug(1, "ptsopen=%s | unix98? %s\n", dev->si_name,
302 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
303 
304 	if ((!error) && (pti->pt_flags2 & PF_UNIX98)) {
305 		pti->pt_flags2 |= PF_SOPEN;
306 	}
307 #endif
308 
309 	return (error);
310 }
311 
312 static	int
313 ptsclose(struct dev_close_args *ap)
314 {
315 	cdev_t dev = ap->a_head.a_dev;
316 	struct tty *tp;
317 	struct pt_ioctl *pti = dev->si_drv1;
318 	int err;
319 
320 	tp = dev->si_tty;
321 	err = (*linesw[tp->t_line].l_close)(tp, ap->a_fflag);
322 	ptsstop(tp, FREAD|FWRITE);
323 	(void) ttyclose(tp);
324 
325 #ifdef UNIX98_PTYS
326 	/*
327 	 * Unix98 pty stuff.
328 	 * On close of the slave, we unset the corresponding flag, and if the master
329 	 * isn't open anymore, we destroy the slave and unset the unit.
330 	 */
331 	ptydebug(1, "ptsclose=%s | unix98? %s\n", dev->si_name,
332 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
333 
334 	if (pti->pt_flags2 & PF_UNIX98) {
335 		pti->pt_flags2 &= ~PF_SOPEN;
336 		KKASSERT((pti->pt_flags2 & PF_SOPEN) == 0);
337 		ptydebug(1, "master open? %s\n",
338 		    (pti->pt_flags2 & PF_MOPEN)?"yes":"no");
339 
340 		if (!(pti->pt_flags2 & PF_SOPEN) && !(pti->pt_flags2 & PF_MOPEN)) {
341 			devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty), dev->si_uminor);
342 			destroy_dev(dev);
343 		}
344 	}
345 #endif
346 
347 	return (err);
348 }
349 
350 static	int
351 ptsread(struct dev_read_args *ap)
352 {
353 	cdev_t dev = ap->a_head.a_dev;
354 	struct proc *p = curproc;
355 	struct tty *tp = dev->si_tty;
356 	struct pt_ioctl *pti = dev->si_drv1;
357 	struct lwp *lp;
358 
359 	int error = 0;
360 
361 	lp = curthread->td_lwp;
362 
363 again:
364 	if (pti->pt_flags & PF_REMOTE) {
365 		while (isbackground(p, tp)) {
366 			if (SIGISMEMBER(p->p_sigignore, SIGTTIN) ||
367 			    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
368 			    p->p_pgrp->pg_jobc == 0 || p->p_flag & P_PPWAIT)
369 				return (EIO);
370 			pgsignal(p->p_pgrp, SIGTTIN, 1);
371 			error = ttysleep(tp, &lbolt, PCATCH, "ptsbg", 0);
372 			if (error)
373 				return (error);
374 		}
375 		if (tp->t_canq.c_cc == 0) {
376 			if (ap->a_ioflag & IO_NDELAY)
377 				return (EWOULDBLOCK);
378 			error = ttysleep(tp, TSA_PTS_READ(tp), PCATCH,
379 					 "ptsin", 0);
380 			if (error)
381 				return (error);
382 			goto again;
383 		}
384 		while (tp->t_canq.c_cc > 1 && ap->a_uio->uio_resid > 0)
385 			if (ureadc(clist_getc(&tp->t_canq), ap->a_uio) < 0) {
386 				error = EFAULT;
387 				break;
388 			}
389 		if (tp->t_canq.c_cc == 1)
390 			clist_getc(&tp->t_canq);
391 		if (tp->t_canq.c_cc)
392 			return (error);
393 	} else
394 		if (tp->t_oproc)
395 			error = (*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag);
396 	ptcwakeup(tp, FWRITE);
397 	return (error);
398 }
399 
400 /*
401  * Write to pseudo-tty.
402  * Wakeups of controlling tty will happen
403  * indirectly, when tty driver calls ptsstart.
404  */
405 static	int
406 ptswrite(struct dev_write_args *ap)
407 {
408 	cdev_t dev = ap->a_head.a_dev;
409 	struct tty *tp;
410 
411 	tp = dev->si_tty;
412 	if (tp->t_oproc == 0)
413 		return (EIO);
414 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
415 }
416 
417 /*
418  * Start output on pseudo-tty.
419  * Wake up process selecting or sleeping for input from controlling tty.
420  */
421 static void
422 ptsstart(struct tty *tp)
423 {
424 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
425 
426 	if (tp->t_state & TS_TTSTOP)
427 		return;
428 	if (pti->pt_flags & PF_STOPPED) {
429 		pti->pt_flags &= ~PF_STOPPED;
430 		pti->pt_send = TIOCPKT_START;
431 	}
432 	ptcwakeup(tp, FREAD);
433 }
434 
435 static void
436 ptcwakeup(struct tty *tp, int flag)
437 {
438 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
439 
440 	if (flag & FREAD) {
441 		selwakeup(&pti->pt_selr);
442 		wakeup(TSA_PTC_READ(tp));
443 		KNOTE(&tp->t_rsel.si_note, 0);
444 	}
445 	if (flag & FWRITE) {
446 		selwakeup(&pti->pt_selw);
447 		wakeup(TSA_PTC_WRITE(tp));
448 		KNOTE(&tp->t_wsel.si_note, 0);
449 	}
450 }
451 
452 static	int
453 ptcopen(struct dev_open_args *ap)
454 {
455 	cdev_t dev = ap->a_head.a_dev;
456 	struct tty *tp;
457 	struct pt_ioctl *pti;
458 
459 	if (!dev->si_drv1)
460 		ptyinit(minor(dev));
461 	if (!dev->si_drv1)
462 		return(ENXIO);
463 	pti = dev->si_drv1;
464 	if (pti->pt_prison && pti->pt_prison != ap->a_cred->cr_prison)
465 		return(EBUSY);
466 	tp = dev->si_tty;
467 	if (tp->t_oproc)
468 		return (EIO);
469 	tp->t_oproc = ptsstart;
470 	tp->t_stop = ptsstop;
471 	(void)(*linesw[tp->t_line].l_modem)(tp, 1);
472 	tp->t_lflag &= ~EXTPROC;
473 	pti->pt_prison = ap->a_cred->cr_prison;
474 	pti->pt_flags = 0;
475 	pti->pt_send = 0;
476 	pti->pt_ucntl = 0;
477 
478 	pti->devs->si_uid = ap->a_cred->cr_uid;
479 	pti->devs->si_gid = 0;
480 	pti->devs->si_perms = 0600;
481 	pti->devc->si_uid = ap->a_cred->cr_uid;
482 	pti->devc->si_gid = 0;
483 	pti->devc->si_perms = 0600;
484 
485 #ifdef UNIX98_PTYS
486 	/*
487 	 * Unix98 pty stuff.
488 	 * On open of the master, we set the corresponding flag in the common
489 	 * struct.
490 	 */
491 	ptydebug(1, "ptcopen=%s (master) | unix98? %s\n", dev->si_name,
492 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
493 
494 	if (pti->pt_flags2 & PF_UNIX98) {
495 		pti->pt_flags2 |= PF_MOPEN;
496 	}
497 #endif
498 
499 	return (0);
500 }
501 
502 static	int
503 ptcclose(struct dev_close_args *ap)
504 {
505 	cdev_t dev = ap->a_head.a_dev;
506 	struct tty *tp;
507 	struct pt_ioctl *pti = dev->si_drv1;
508 
509 	tp = dev->si_tty;
510 	(void)(*linesw[tp->t_line].l_modem)(tp, 0);
511 
512 #ifdef UNIX98_PTYS
513 	/*
514 	 * Unix98 pty stuff.
515 	 * On close of the master, we unset the corresponding flag in the common
516 	 * struct asap.
517 	 */
518 	pti->pt_flags2 &= ~PF_MOPEN;
519 #endif
520 
521 	/*
522 	 * XXX MDMBUF makes no sense for ptys but would inhibit the above
523 	 * l_modem().  CLOCAL makes sense but isn't supported.   Special
524 	 * l_modem()s that ignore carrier drop make no sense for ptys but
525 	 * may be in use because other parts of the line discipline make
526 	 * sense for ptys.  Recover by doing everything that a normal
527 	 * ttymodem() would have done except for sending a SIGHUP.
528 	 */
529 	if (tp->t_state & TS_ISOPEN) {
530 		tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
531 		tp->t_state |= TS_ZOMBIE;
532 		ttyflush(tp, FREAD | FWRITE);
533 	}
534 	tp->t_oproc = 0;		/* mark closed */
535 
536 	pti = dev->si_drv1;
537 	pti->pt_prison = NULL;
538 	pti->devs->si_uid = 0;
539 	pti->devs->si_gid = 0;
540 	pti->devs->si_perms = 0666;
541 	pti->devc->si_uid = 0;
542 	pti->devc->si_gid = 0;
543 	pti->devc->si_perms = 0666;
544 
545 #ifdef UNIX98_PTYS
546 	/*
547 	 * Unix98 pty stuff.
548 	 * On close of the master, we destroy the master and, if no slaves are open,
549 	 * we destroy the slave device and unset the unit.
550 	 */
551 	ptydebug(1, "ptcclose=%s (master) | unix98? %s\n", dev->si_name,
552 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
553 	if (pti->pt_flags2 & PF_UNIX98) {
554 		KKASSERT((pti->pt_flags2 & PF_MOPEN) == 0);
555 		destroy_dev(dev);
556 		pti->devc = NULL;
557 
558 		if (!(pti->pt_flags2 & PF_SOPEN)) {
559 			ptydebug(1, "ptcclose: slaves are not open\n");
560 			destroy_dev(pti->devs);
561 			devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty), dev->si_uminor);
562 		}
563 	}
564 #endif
565 
566 	return (0);
567 }
568 
569 static	int
570 ptcread(struct dev_read_args *ap)
571 {
572 	cdev_t dev = ap->a_head.a_dev;
573 	struct tty *tp = dev->si_tty;
574 	struct pt_ioctl *pti = dev->si_drv1;
575 	char buf[BUFSIZ];
576 	int error = 0, cc;
577 
578 	/*
579 	 * We want to block until the slave
580 	 * is open, and there's something to read;
581 	 * but if we lost the slave or we're NBIO,
582 	 * then return the appropriate error instead.
583 	 */
584 	for (;;) {
585 		if (tp->t_state&TS_ISOPEN) {
586 			if (pti->pt_flags&PF_PKT && pti->pt_send) {
587 				error = ureadc((int)pti->pt_send, ap->a_uio);
588 				if (error)
589 					return (error);
590 				if (pti->pt_send & TIOCPKT_IOCTL) {
591 					cc = (int)szmin(ap->a_uio->uio_resid,
592 							sizeof(tp->t_termios));
593 					uiomove((caddr_t)&tp->t_termios, cc,
594 						ap->a_uio);
595 				}
596 				pti->pt_send = 0;
597 				return (0);
598 			}
599 			if (pti->pt_flags&PF_UCNTL && pti->pt_ucntl) {
600 				error = ureadc((int)pti->pt_ucntl, ap->a_uio);
601 				if (error)
602 					return (error);
603 				pti->pt_ucntl = 0;
604 				return (0);
605 			}
606 			if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
607 				break;
608 		}
609 		if ((tp->t_state & TS_CONNECTED) == 0)
610 			return (0);	/* EOF */
611 		if (ap->a_ioflag & IO_NDELAY)
612 			return (EWOULDBLOCK);
613 		error = tsleep(TSA_PTC_READ(tp), PCATCH, "ptcin", 0);
614 		if (error)
615 			return (error);
616 	}
617 	if (pti->pt_flags & (PF_PKT|PF_UCNTL))
618 		error = ureadc(0, ap->a_uio);
619 	while (ap->a_uio->uio_resid > 0 && error == 0) {
620 		cc = q_to_b(&tp->t_outq, buf,
621 			    (int)szmin(ap->a_uio->uio_resid, BUFSIZ));
622 		if (cc <= 0)
623 			break;
624 		error = uiomove(buf, (size_t)cc, ap->a_uio);
625 	}
626 	ttwwakeup(tp);
627 	return (error);
628 }
629 
630 static	void
631 ptsstop(struct tty *tp, int flush)
632 {
633 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
634 	int flag;
635 
636 	/* note: FLUSHREAD and FLUSHWRITE already ok */
637 	if (flush == 0) {
638 		flush = TIOCPKT_STOP;
639 		pti->pt_flags |= PF_STOPPED;
640 	} else
641 		pti->pt_flags &= ~PF_STOPPED;
642 	pti->pt_send |= flush;
643 	/* change of perspective */
644 	flag = 0;
645 	if (flush & FREAD)
646 		flag |= FWRITE;
647 	if (flush & FWRITE)
648 		flag |= FREAD;
649 	ptcwakeup(tp, flag);
650 }
651 
652 /*
653  * kqueue ops for pseudo-terminals.
654  */
655 static struct filterops ptcread_filtops =
656 	{ 1, NULL, filt_ptcrdetach, filt_ptcread };
657 static struct filterops ptcwrite_filtops =
658 	{ 1, NULL, filt_ptcwdetach, filt_ptcwrite };
659 
660 static	int
661 ptckqfilter(struct dev_kqfilter_args *ap)
662 {
663 	cdev_t dev = ap->a_head.a_dev;
664 	struct knote *kn = ap->a_kn;
665 	struct tty *tp = dev->si_tty;
666 	struct klist *klist;
667 
668 	ap->a_result = 0;
669 	switch (kn->kn_filter) {
670 	case EVFILT_READ:
671 		klist = &tp->t_rsel.si_note;
672 		kn->kn_fop = &ptcread_filtops;
673 		break;
674 	case EVFILT_WRITE:
675 		klist = &tp->t_wsel.si_note;
676 		kn->kn_fop = &ptcwrite_filtops;
677 		break;
678 	default:
679 		ap->a_result = EOPNOTSUPP;
680 		return (0);
681 	}
682 
683 	kn->kn_hook = (caddr_t)dev;
684 
685 	crit_enter();
686 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
687 	crit_exit();
688 
689 	return (0);
690 }
691 
692 static int
693 filt_ptcread (struct knote *kn, long hint)
694 {
695 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
696 	struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
697 
698 	if ((tp->t_state & TS_ISOPEN) &&
699 	    ((tp->t_outq.c_cc && (tp->t_state & TS_TTSTOP) == 0) ||
700 	     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
701 	     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))) {
702 		kn->kn_data = tp->t_outq.c_cc;
703 		return(1);
704 	} else {
705 		return(0);
706 	}
707 }
708 
709 static int
710 filt_ptcwrite (struct knote *kn, long hint)
711 {
712 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
713 	struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
714 
715 	if (tp->t_state & TS_ISOPEN &&
716 	    ((pti->pt_flags & PF_REMOTE) ?
717 	     (tp->t_canq.c_cc == 0) :
718 	     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
719 	      (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON))))) {
720 		kn->kn_data = tp->t_canq.c_cc + tp->t_rawq.c_cc;
721 		return(1);
722 	} else {
723 		return(0);
724 	}
725 }
726 
727 static void
728 filt_ptcrdetach (struct knote *kn)
729 {
730 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
731 
732 	crit_enter();
733 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
734 	crit_exit();
735 }
736 
737 static void
738 filt_ptcwdetach (struct knote *kn)
739 {
740 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
741 
742 	crit_enter();
743 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
744 	crit_exit();
745 }
746 
747 /*
748  * I/O ops
749  */
750 static	int
751 ptcwrite(struct dev_write_args *ap)
752 {
753 	cdev_t dev = ap->a_head.a_dev;
754 	struct tty *tp = dev->si_tty;
755 	u_char *cp = 0;
756 	int cc = 0;
757 	u_char locbuf[BUFSIZ];
758 	int cnt = 0;
759 	struct pt_ioctl *pti = dev->si_drv1;
760 	int error = 0;
761 
762 again:
763 	if ((tp->t_state&TS_ISOPEN) == 0)
764 		goto block;
765 	if (pti->pt_flags & PF_REMOTE) {
766 		if (tp->t_canq.c_cc)
767 			goto block;
768 		while ((ap->a_uio->uio_resid > 0 || cc > 0) &&
769 		       tp->t_canq.c_cc < TTYHOG - 1) {
770 			if (cc == 0) {
771 				cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
772 				cc = imin(cc, TTYHOG - 1 - tp->t_canq.c_cc);
773 				cp = locbuf;
774 				error = uiomove(cp, (size_t)cc, ap->a_uio);
775 				if (error)
776 					return (error);
777 				/* check again for safety */
778 				if ((tp->t_state & TS_ISOPEN) == 0) {
779 					/* adjust as usual */
780 					ap->a_uio->uio_resid += cc;
781 					return (EIO);
782 				}
783 			}
784 			if (cc > 0) {
785 				cc = b_to_q((char *)cp, cc, &tp->t_canq);
786 				/*
787 				 * XXX we don't guarantee that the canq size
788 				 * is >= TTYHOG, so the above b_to_q() may
789 				 * leave some bytes uncopied.  However, space
790 				 * is guaranteed for the null terminator if
791 				 * we don't fail here since (TTYHOG - 1) is
792 				 * not a multiple of CBSIZE.
793 				 */
794 				if (cc > 0)
795 					break;
796 			}
797 		}
798 		/* adjust for data copied in but not written */
799 		ap->a_uio->uio_resid += cc;
800 		clist_putc(0, &tp->t_canq);
801 		ttwakeup(tp);
802 		wakeup(TSA_PTS_READ(tp));
803 		return (0);
804 	}
805 	while (ap->a_uio->uio_resid > 0 || cc > 0) {
806 		if (cc == 0) {
807 			cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
808 			cp = locbuf;
809 			error = uiomove(cp, (size_t)cc, ap->a_uio);
810 			if (error)
811 				return (error);
812 			/* check again for safety */
813 			if ((tp->t_state & TS_ISOPEN) == 0) {
814 				/* adjust for data copied in but not written */
815 				ap->a_uio->uio_resid += cc;
816 				return (EIO);
817 			}
818 		}
819 		while (cc > 0) {
820 			if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
821 			   (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
822 				wakeup(TSA_HUP_OR_INPUT(tp));
823 				goto block;
824 			}
825 			(*linesw[tp->t_line].l_rint)(*cp++, tp);
826 			cnt++;
827 			cc--;
828 		}
829 		cc = 0;
830 	}
831 	return (0);
832 block:
833 	/*
834 	 * Come here to wait for slave to open, for space
835 	 * in outq, or space in rawq, or an empty canq.
836 	 */
837 	if ((tp->t_state & TS_CONNECTED) == 0) {
838 		/* adjust for data copied in but not written */
839 		ap->a_uio->uio_resid += cc;
840 		return (EIO);
841 	}
842 	if (ap->a_ioflag & IO_NDELAY) {
843 		/* adjust for data copied in but not written */
844 		ap->a_uio->uio_resid += cc;
845 		if (cnt == 0)
846 			return (EWOULDBLOCK);
847 		return (0);
848 	}
849 	error = tsleep(TSA_PTC_WRITE(tp), PCATCH, "ptcout", 0);
850 	if (error) {
851 		/* adjust for data copied in but not written */
852 		ap->a_uio->uio_resid += cc;
853 		return (error);
854 	}
855 	goto again;
856 }
857 
858 /*ARGSUSED*/
859 static	int
860 ptyioctl(struct dev_ioctl_args *ap)
861 {
862 	cdev_t dev = ap->a_head.a_dev;
863 	struct tty *tp = dev->si_tty;
864 	struct pt_ioctl *pti = dev->si_drv1;
865 	u_char *cc = tp->t_cc;
866 	int stop, error;
867 
868 	if (dev_dflags(dev) & D_MASTER) {
869 		switch (ap->a_cmd) {
870 
871 		case TIOCGPGRP:
872 			/*
873 			 * We avoid calling ttioctl on the controller since,
874 			 * in that case, tp must be the controlling terminal.
875 			 */
876 			*(int *)ap->a_data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
877 			return (0);
878 
879 		case TIOCPKT:
880 			if (*(int *)ap->a_data) {
881 				if (pti->pt_flags & PF_UCNTL)
882 					return (EINVAL);
883 				pti->pt_flags |= PF_PKT;
884 			} else
885 				pti->pt_flags &= ~PF_PKT;
886 			return (0);
887 
888 		case TIOCUCNTL:
889 			if (*(int *)ap->a_data) {
890 				if (pti->pt_flags & PF_PKT)
891 					return (EINVAL);
892 				pti->pt_flags |= PF_UCNTL;
893 			} else
894 				pti->pt_flags &= ~PF_UCNTL;
895 			return (0);
896 
897 		case TIOCREMOTE:
898 			if (*(int *)ap->a_data)
899 				pti->pt_flags |= PF_REMOTE;
900 			else
901 				pti->pt_flags &= ~PF_REMOTE;
902 			ttyflush(tp, FREAD|FWRITE);
903 			return (0);
904 
905 		case TIOCISPTMASTER:
906 			if ((pti->pt_flags2 & PF_UNIX98) && (pti->devc == dev))
907 				return (0);
908 			else
909 				return (EINVAL);
910 		}
911 
912 		/*
913 		 * The rest of the ioctls shouldn't be called until
914 		 * the slave is open.
915 		 */
916 		if ((tp->t_state & TS_ISOPEN) == 0)
917 			return (EAGAIN);
918 
919 		switch (ap->a_cmd) {
920 #ifdef COMPAT_43
921 		case TIOCSETP:
922 		case TIOCSETN:
923 #endif
924 		case TIOCSETD:
925 		case TIOCSETA:
926 		case TIOCSETAW:
927 		case TIOCSETAF:
928 			/*
929 			 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
930 			 * ttywflush(tp) will hang if there are characters in
931 			 * the outq.
932 			 */
933 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
934 			break;
935 
936 		case TIOCSIG:
937 			if (*(unsigned int *)ap->a_data >= NSIG ||
938 			    *(unsigned int *)ap->a_data == 0)
939 				return(EINVAL);
940 			if ((tp->t_lflag&NOFLSH) == 0)
941 				ttyflush(tp, FREAD|FWRITE);
942 			pgsignal(tp->t_pgrp, *(unsigned int *)ap->a_data, 1);
943 			if ((*(unsigned int *)ap->a_data == SIGINFO) &&
944 			    ((tp->t_lflag&NOKERNINFO) == 0))
945 				ttyinfo(tp);
946 			return(0);
947 		}
948 	}
949 	if (ap->a_cmd == TIOCEXT) {
950 		/*
951 		 * When the EXTPROC bit is being toggled, we need
952 		 * to send an TIOCPKT_IOCTL if the packet driver
953 		 * is turned on.
954 		 */
955 		if (*(int *)ap->a_data) {
956 			if (pti->pt_flags & PF_PKT) {
957 				pti->pt_send |= TIOCPKT_IOCTL;
958 				ptcwakeup(tp, FREAD);
959 			}
960 			tp->t_lflag |= EXTPROC;
961 		} else {
962 			if ((tp->t_lflag & EXTPROC) &&
963 			    (pti->pt_flags & PF_PKT)) {
964 				pti->pt_send |= TIOCPKT_IOCTL;
965 				ptcwakeup(tp, FREAD);
966 			}
967 			tp->t_lflag &= ~EXTPROC;
968 		}
969 		return(0);
970 	}
971 	error = (*linesw[tp->t_line].l_ioctl)(tp, ap->a_cmd, ap->a_data,
972 					      ap->a_fflag, ap->a_cred);
973 	if (error == ENOIOCTL)
974 		 error = ttioctl(tp, ap->a_cmd, ap->a_data, ap->a_fflag);
975 	if (error == ENOIOCTL) {
976 		if (pti->pt_flags & PF_UCNTL &&
977 		    (ap->a_cmd & ~0xff) == UIOCCMD(0)) {
978 			if (ap->a_cmd & 0xff) {
979 				pti->pt_ucntl = (u_char)ap->a_cmd;
980 				ptcwakeup(tp, FREAD);
981 			}
982 			return (0);
983 		}
984 		error = ENOTTY;
985 	}
986 	/*
987 	 * If external processing and packet mode send ioctl packet.
988 	 */
989 	if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
990 		switch(ap->a_cmd) {
991 		case TIOCSETA:
992 		case TIOCSETAW:
993 		case TIOCSETAF:
994 #ifdef COMPAT_43
995 		case TIOCSETP:
996 		case TIOCSETN:
997 #endif
998 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
999 		case TIOCSETC:
1000 		case TIOCSLTC:
1001 		case TIOCLBIS:
1002 		case TIOCLBIC:
1003 		case TIOCLSET:
1004 #endif
1005 			pti->pt_send |= TIOCPKT_IOCTL;
1006 			ptcwakeup(tp, FREAD);
1007 		default:
1008 			break;
1009 		}
1010 	}
1011 	stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1012 		&& CCEQ(cc[VSTART], CTRL('q'));
1013 	if (pti->pt_flags & PF_NOSTOP) {
1014 		if (stop) {
1015 			pti->pt_send &= ~TIOCPKT_NOSTOP;
1016 			pti->pt_send |= TIOCPKT_DOSTOP;
1017 			pti->pt_flags &= ~PF_NOSTOP;
1018 			ptcwakeup(tp, FREAD);
1019 		}
1020 	} else {
1021 		if (!stop) {
1022 			pti->pt_send &= ~TIOCPKT_DOSTOP;
1023 			pti->pt_send |= TIOCPKT_NOSTOP;
1024 			pti->pt_flags |= PF_NOSTOP;
1025 			ptcwakeup(tp, FREAD);
1026 		}
1027 	}
1028 	return (error);
1029 }
1030 
1031 
1032 static void ptc_drvinit (void *unused);
1033 
1034 #ifdef UNIX98_PTYS
1035 SYSCTL_INT(_kern, OID_AUTO, pty_debug, CTLFLAG_RW, &pty_debug_level,
1036 		0, "Change pty debug level");
1037 #endif
1038 
1039 static void
1040 ptc_drvinit(void *unused)
1041 {
1042 	int i;
1043 
1044 #ifdef UNIX98_PTYS
1045 	/*
1046 	 * Unix98 pty stuff.
1047 	 * Create the clonable base device.
1048 	 */
1049 	make_autoclone_dev(&ptc_ops, &DEVFS_CLONE_BITMAP(pty), ptyclone,
1050 	    0, 0, 0666, "ptmx");
1051 #endif
1052 
1053 	for (i = 0; i < 256; i++) {
1054 		ptyinit(i);
1055 	}
1056 }
1057 
1058 SYSINIT(ptcdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR_C,ptc_drvinit,NULL)
1059