xref: /dflybsd-src/sys/kern/tty_pty.c (revision 70e491c09b1cb18f96facdbc91052080f2a455c3)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
34  * $FreeBSD: src/sys/kern/tty_pty.c,v 1.74.2.4 2002/02/20 19:58:13 dillon Exp $
35  * $DragonFly: src/sys/kern/tty_pty.c,v 1.21 2008/08/13 10:29:38 swildner Exp $
36  */
37 
38 /*
39  * Pseudo-teletype Driver
40  * (Actually two drivers, requiring two dev_ops structures)
41  */
42 #include "use_pty.h"		/* XXX */
43 #include "opt_compat.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
48 #include <sys/ioctl_compat.h>
49 #endif
50 #include <sys/proc.h>
51 #include <sys/priv.h>
52 #include <sys/tty.h>
53 #include <sys/conf.h>
54 #include <sys/fcntl.h>
55 #include <sys/poll.h>
56 #include <sys/kernel.h>
57 #include <sys/vnode.h>
58 #include <sys/signalvar.h>
59 #include <sys/malloc.h>
60 #include <sys/device.h>
61 #include <sys/thread2.h>
62 #include <sys/devfs.h>
63 #include <sys/stat.h>
64 #include <sys/sysctl.h>
65 
66 #define	UNIX98_PTYS	1
67 
68 MALLOC_DEFINE(M_PTY, "ptys", "pty data structures");
69 
70 static void ptsstart (struct tty *tp);
71 static void ptsstop (struct tty *tp, int rw);
72 static void ptcwakeup (struct tty *tp, int flag);
73 static void ptyinit (int n);
74 static int  filt_ptcread (struct knote *kn, long hint);
75 static void filt_ptcrdetach (struct knote *kn);
76 static int  filt_ptcwrite (struct knote *kn, long hint);
77 static void filt_ptcwdetach (struct knote *kn);
78 
79 static	d_open_t	ptsopen;
80 static	d_close_t	ptsclose;
81 static	d_read_t	ptsread;
82 static	d_write_t	ptswrite;
83 static	d_ioctl_t	ptyioctl;
84 static	d_open_t	ptcopen;
85 static	d_close_t	ptcclose;
86 static	d_read_t	ptcread;
87 static	d_write_t	ptcwrite;
88 static	d_poll_t	ptcpoll;
89 static	d_kqfilter_t	ptckqfilter;
90 
91 #ifdef UNIX98_PTYS
92 DEVFS_DECLARE_CLONE_BITMAP(pty);
93 
94 static	d_clone_t 	ptyclone;
95 
96 static int	pty_debug_level = 0;
97 
98 static struct dev_ops pts98_ops = {
99 	{ "pts98", 0, D_TTY | D_KQFILTER },
100 	.d_open =	ptsopen,
101 	.d_close =	ptsclose,
102 	.d_read =	ptsread,
103 	.d_write =	ptswrite,
104 	.d_ioctl =	ptyioctl,
105 	.d_poll =	ttypoll,
106 	.d_kqfilter =	ttykqfilter,
107 	.d_revoke =	ttyrevoke
108 };
109 
110 static struct dev_ops ptc98_ops = {
111 	{ "ptc98", 0, D_TTY | D_KQFILTER | D_MASTER },
112 	.d_open =	ptcopen,
113 	.d_close =	ptcclose,
114 	.d_read =	ptcread,
115 	.d_write =	ptcwrite,
116 	.d_ioctl =	ptyioctl,
117 	.d_poll =	ptcpoll,
118 	.d_kqfilter =	ptckqfilter,
119 	.d_revoke =	ttyrevoke
120 };
121 #endif
122 
123 #define	CDEV_MAJOR_S	5
124 static struct dev_ops pts_ops = {
125 	{ "pts", CDEV_MAJOR_S, D_TTY | D_KQFILTER },
126 	.d_open =	ptsopen,
127 	.d_close =	ptsclose,
128 	.d_read =	ptsread,
129 	.d_write =	ptswrite,
130 	.d_ioctl =	ptyioctl,
131 	.d_poll =	ttypoll,
132 	.d_kqfilter =	ttykqfilter,
133 	.d_revoke =	ttyrevoke
134 };
135 
136 #define	CDEV_MAJOR_C	6
137 static struct dev_ops ptc_ops = {
138 	{ "ptc", CDEV_MAJOR_C, D_TTY | D_KQFILTER | D_MASTER },
139 	.d_open =	ptcopen,
140 	.d_close =	ptcclose,
141 	.d_read =	ptcread,
142 	.d_write =	ptcwrite,
143 	.d_ioctl =	ptyioctl,
144 	.d_poll =	ptcpoll,
145 	.d_kqfilter =	ptckqfilter,
146 	.d_revoke =	ttyrevoke
147 };
148 
149 #define BUFSIZ 100		/* Chunk size iomoved to/from user */
150 
151 struct	pt_ioctl {
152 	int	pt_flags;
153 	int	pt_flags2;
154 	struct	selinfo pt_selr, pt_selw;
155 	u_char	pt_send;
156 	u_char	pt_ucntl;
157 	struct tty pt_tty;
158 	cdev_t	devs, devc;
159 	struct	prison *pt_prison;
160 };
161 
162 #define	PF_PKT		0x08		/* packet mode */
163 #define	PF_STOPPED	0x10		/* user told stopped */
164 #define	PF_REMOTE	0x20		/* remote and flow controlled input */
165 #define	PF_NOSTOP	0x40
166 #define PF_UCNTL	0x80		/* user control mode */
167 
168 #define	PF_UNIX98	0x01
169 #define	PF_SOPEN	0x02
170 #define	PF_MOPEN	0x04
171 
172 static int
173 ptydebug(int level, char *fmt, ...)
174 {
175 	__va_list ap;
176 
177 	__va_start(ap, fmt);
178 	if (level <= pty_debug_level)
179 		kvprintf(fmt, ap);
180 	__va_end(ap);
181 
182 	return 0;
183 }
184 
185 /*
186  * This function creates and initializes a pts/ptc pair
187  *
188  * pts == /dev/tty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
189  * ptc == /dev/pty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
190  *
191  * XXX: define and add mapping of upper minor bits to allow more
192  *      than 256 ptys.
193  */
194 static void
195 ptyinit(int n)
196 {
197 	cdev_t devs, devc;
198 	char *names = "pqrsPQRS";
199 	struct pt_ioctl *pt;
200 
201 	/* For now we only map the lower 8 bits of the minor */
202 	if (n & ~0xff)
203 		return;
204 
205 	pt = kmalloc(sizeof(*pt), M_PTY, M_WAITOK | M_ZERO);
206 	pt->devs = devs = make_dev(&pts_ops, n,
207 	    0, 0, 0666, "tty%c%r", names[n / 32], n % 32);
208 	pt->devc = devc = make_dev(&ptc_ops, n,
209 	    0, 0, 0666, "pty%c%r", names[n / 32], n % 32);
210 
211 	devs->si_drv1 = devc->si_drv1 = pt;
212 	devs->si_tty = devc->si_tty = &pt->pt_tty;
213 	devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
214 	devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
215 	pt->pt_tty.t_dev = devs;
216 	ttyregister(&pt->pt_tty);
217 }
218 
219 #ifdef UNIX98_PTYS
220 static int
221 ptyclone(struct dev_clone_args *ap)
222 {
223 	int unit;
224 	struct pt_ioctl *pt;
225 
226 	/*
227 	 * Limit the number of unix98 pty (slave) devices to 1000, as
228 	 * the utmp(5) format only allows for 8 bytes for the tty,
229 	 * "pts/XXX".
230 	 * If this limit is reached, we don't clone and return error
231 	 * to devfs.
232 	 */
233 	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), 1000);
234 
235 	if (unit < 0) {
236 		ap->a_dev = NULL;
237 		return 1;
238 	}
239 
240 	pt = kmalloc(sizeof(*pt), M_PTY, M_WAITOK | M_ZERO);
241 
242 	pt->devc = ap->a_dev = make_only_dev(&ptc98_ops, unit, ap->a_cred->cr_ruid,
243 	    0, 0600, "ptm/%d", unit);
244 	pt->devs = make_dev(&pts98_ops, unit, ap->a_cred->cr_ruid, GID_TTY, 0620,
245 	    "pts/%d", unit);
246 
247 	pt->devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
248 	pt->devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
249 
250 	pt->devs->si_drv1 = pt->devc->si_drv1 = pt;
251 	pt->devs->si_tty = pt->devc->si_tty = &pt->pt_tty;
252 	pt->pt_tty.t_dev = pt->devs;
253 	pt->pt_flags2 |= PF_UNIX98;
254 
255 	ttyregister(&pt->pt_tty);
256 
257 	return 0;
258 }
259 #endif
260 
261 /*ARGSUSED*/
262 static	int
263 ptsopen(struct dev_open_args *ap)
264 {
265 	cdev_t dev = ap->a_head.a_dev;
266 	struct tty *tp;
267 	int error;
268 	struct pt_ioctl *pti;
269 
270 	if (!dev->si_drv1)
271 		ptyinit(minor(dev));
272 	if (!dev->si_drv1)
273 		return(ENXIO);
274 	pti = dev->si_drv1;
275 	tp = dev->si_tty;
276 	if ((tp->t_state & TS_ISOPEN) == 0) {
277 		ttychars(tp);		/* Set up default chars */
278 		tp->t_iflag = TTYDEF_IFLAG;
279 		tp->t_oflag = TTYDEF_OFLAG;
280 		tp->t_lflag = TTYDEF_LFLAG;
281 		tp->t_cflag = TTYDEF_CFLAG;
282 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
283 	} else if ((tp->t_state & TS_XCLUDE) && priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) {
284 		return (EBUSY);
285 	} else if (pti->pt_prison != ap->a_cred->cr_prison) {
286 		return (EBUSY);
287 	}
288 	if (tp->t_oproc)			/* Ctrlr still around. */
289 		(void)(*linesw[tp->t_line].l_modem)(tp, 1);
290 	while ((tp->t_state & TS_CARR_ON) == 0) {
291 		if (ap->a_oflags & FNONBLOCK)
292 			break;
293 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ptsopn", 0);
294 		if (error)
295 			return (error);
296 	}
297 	error = (*linesw[tp->t_line].l_open)(dev, tp);
298 	if (error == 0)
299 		ptcwakeup(tp, FREAD|FWRITE);
300 
301 #ifdef UNIX98_PTYS
302 	/*
303 	 * Unix98 pty stuff.
304 	 * On open of the slave, we set the corresponding flag in the common
305 	 * struct.
306 	 */
307 	ptydebug(1, "ptsopen=%s | unix98? %s\n", dev->si_name,
308 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
309 
310 	if ((!error) && (pti->pt_flags2 & PF_UNIX98)) {
311 		pti->pt_flags2 |= PF_SOPEN;
312 	}
313 #endif
314 
315 	return (error);
316 }
317 
318 static	int
319 ptsclose(struct dev_close_args *ap)
320 {
321 	cdev_t dev = ap->a_head.a_dev;
322 	struct tty *tp;
323 	struct pt_ioctl *pti = dev->si_drv1;
324 	int err;
325 
326 	tp = dev->si_tty;
327 	err = (*linesw[tp->t_line].l_close)(tp, ap->a_fflag);
328 	ptsstop(tp, FREAD|FWRITE);
329 	(void) ttyclose(tp);
330 
331 #ifdef UNIX98_PTYS
332 	/*
333 	 * Unix98 pty stuff.
334 	 * On close of the slave, we unset the corresponding flag, and if the master
335 	 * isn't open anymore, we destroy the slave and unset the unit.
336 	 */
337 	ptydebug(1, "ptsclose=%s | unix98? %s\n", dev->si_name,
338 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
339 
340 	if (pti->pt_flags2 & PF_UNIX98) {
341 		pti->pt_flags2 &= ~PF_SOPEN;
342 		KKASSERT((pti->pt_flags2 & PF_SOPEN) == 0);
343 		ptydebug(1, "master open? %s\n",
344 		    (pti->pt_flags2 & PF_MOPEN)?"yes":"no");
345 
346 		if (!(pti->pt_flags2 & PF_SOPEN) && !(pti->pt_flags2 & PF_MOPEN)) {
347 			devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty), dev->si_uminor);
348 			destroy_dev(dev);
349 		}
350 	}
351 #endif
352 
353 	return (err);
354 }
355 
356 static	int
357 ptsread(struct dev_read_args *ap)
358 {
359 	cdev_t dev = ap->a_head.a_dev;
360 	struct proc *p = curproc;
361 	struct tty *tp = dev->si_tty;
362 	struct pt_ioctl *pti = dev->si_drv1;
363 	struct lwp *lp;
364 
365 	int error = 0;
366 
367 	lp = curthread->td_lwp;
368 
369 again:
370 	if (pti->pt_flags & PF_REMOTE) {
371 		while (isbackground(p, tp)) {
372 			if (SIGISMEMBER(p->p_sigignore, SIGTTIN) ||
373 			    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
374 			    p->p_pgrp->pg_jobc == 0 || p->p_flag & P_PPWAIT)
375 				return (EIO);
376 			pgsignal(p->p_pgrp, SIGTTIN, 1);
377 			error = ttysleep(tp, &lbolt, PCATCH, "ptsbg", 0);
378 			if (error)
379 				return (error);
380 		}
381 		if (tp->t_canq.c_cc == 0) {
382 			if (ap->a_ioflag & IO_NDELAY)
383 				return (EWOULDBLOCK);
384 			error = ttysleep(tp, TSA_PTS_READ(tp), PCATCH,
385 					 "ptsin", 0);
386 			if (error)
387 				return (error);
388 			goto again;
389 		}
390 		while (tp->t_canq.c_cc > 1 && ap->a_uio->uio_resid > 0)
391 			if (ureadc(clist_getc(&tp->t_canq), ap->a_uio) < 0) {
392 				error = EFAULT;
393 				break;
394 			}
395 		if (tp->t_canq.c_cc == 1)
396 			clist_getc(&tp->t_canq);
397 		if (tp->t_canq.c_cc)
398 			return (error);
399 	} else
400 		if (tp->t_oproc)
401 			error = (*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag);
402 	ptcwakeup(tp, FWRITE);
403 	return (error);
404 }
405 
406 /*
407  * Write to pseudo-tty.
408  * Wakeups of controlling tty will happen
409  * indirectly, when tty driver calls ptsstart.
410  */
411 static	int
412 ptswrite(struct dev_write_args *ap)
413 {
414 	cdev_t dev = ap->a_head.a_dev;
415 	struct tty *tp;
416 
417 	tp = dev->si_tty;
418 	if (tp->t_oproc == 0)
419 		return (EIO);
420 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
421 }
422 
423 /*
424  * Start output on pseudo-tty.
425  * Wake up process selecting or sleeping for input from controlling tty.
426  */
427 static void
428 ptsstart(struct tty *tp)
429 {
430 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
431 
432 	if (tp->t_state & TS_TTSTOP)
433 		return;
434 	if (pti->pt_flags & PF_STOPPED) {
435 		pti->pt_flags &= ~PF_STOPPED;
436 		pti->pt_send = TIOCPKT_START;
437 	}
438 	ptcwakeup(tp, FREAD);
439 }
440 
441 static void
442 ptcwakeup(struct tty *tp, int flag)
443 {
444 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
445 
446 	if (flag & FREAD) {
447 		selwakeup(&pti->pt_selr);
448 		wakeup(TSA_PTC_READ(tp));
449 		KNOTE(&tp->t_rsel.si_note, 0);
450 	}
451 	if (flag & FWRITE) {
452 		selwakeup(&pti->pt_selw);
453 		wakeup(TSA_PTC_WRITE(tp));
454 		KNOTE(&tp->t_wsel.si_note, 0);
455 	}
456 }
457 
458 static	int
459 ptcopen(struct dev_open_args *ap)
460 {
461 	cdev_t dev = ap->a_head.a_dev;
462 	struct tty *tp;
463 	struct pt_ioctl *pti;
464 
465 	if (!dev->si_drv1)
466 		ptyinit(minor(dev));
467 	if (!dev->si_drv1)
468 		return(ENXIO);
469 	pti = dev->si_drv1;
470 	if (pti->pt_prison && pti->pt_prison != ap->a_cred->cr_prison)
471 		return(EBUSY);
472 	tp = dev->si_tty;
473 	if (tp->t_oproc)
474 		return (EIO);
475 	tp->t_oproc = ptsstart;
476 	tp->t_stop = ptsstop;
477 	(void)(*linesw[tp->t_line].l_modem)(tp, 1);
478 	tp->t_lflag &= ~EXTPROC;
479 	pti->pt_prison = ap->a_cred->cr_prison;
480 	pti->pt_flags = 0;
481 	pti->pt_send = 0;
482 	pti->pt_ucntl = 0;
483 
484 	pti->devs->si_uid = ap->a_cred->cr_uid;
485 	pti->devs->si_gid = 0;
486 	pti->devs->si_perms = 0600;
487 	pti->devc->si_uid = ap->a_cred->cr_uid;
488 	pti->devc->si_gid = 0;
489 	pti->devc->si_perms = 0600;
490 
491 #ifdef UNIX98_PTYS
492 	/*
493 	 * Unix98 pty stuff.
494 	 * On open of the master, we set the corresponding flag in the common
495 	 * struct.
496 	 */
497 	ptydebug(1, "ptcopen=%s (master) | unix98? %s\n", dev->si_name,
498 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
499 
500 	if (pti->pt_flags2 & PF_UNIX98) {
501 		pti->pt_flags2 |= PF_MOPEN;
502 	}
503 #endif
504 
505 	return (0);
506 }
507 
508 static	int
509 ptcclose(struct dev_close_args *ap)
510 {
511 	cdev_t dev = ap->a_head.a_dev;
512 	struct tty *tp;
513 	struct pt_ioctl *pti = dev->si_drv1;
514 
515 	tp = dev->si_tty;
516 	(void)(*linesw[tp->t_line].l_modem)(tp, 0);
517 
518 #ifdef UNIX98_PTYS
519 	/*
520 	 * Unix98 pty stuff.
521 	 * On close of the master, we unset the corresponding flag in the common
522 	 * struct asap.
523 	 */
524 	pti->pt_flags2 &= ~PF_MOPEN;
525 #endif
526 
527 	/*
528 	 * XXX MDMBUF makes no sense for ptys but would inhibit the above
529 	 * l_modem().  CLOCAL makes sense but isn't supported.   Special
530 	 * l_modem()s that ignore carrier drop make no sense for ptys but
531 	 * may be in use because other parts of the line discipline make
532 	 * sense for ptys.  Recover by doing everything that a normal
533 	 * ttymodem() would have done except for sending a SIGHUP.
534 	 */
535 	if (tp->t_state & TS_ISOPEN) {
536 		tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
537 		tp->t_state |= TS_ZOMBIE;
538 		ttyflush(tp, FREAD | FWRITE);
539 	}
540 	tp->t_oproc = 0;		/* mark closed */
541 
542 	pti = dev->si_drv1;
543 	pti->pt_prison = NULL;
544 	pti->devs->si_uid = 0;
545 	pti->devs->si_gid = 0;
546 	pti->devs->si_perms = 0666;
547 	pti->devc->si_uid = 0;
548 	pti->devc->si_gid = 0;
549 	pti->devc->si_perms = 0666;
550 
551 #ifdef UNIX98_PTYS
552 	/*
553 	 * Unix98 pty stuff.
554 	 * On close of the master, we destroy the master and, if no slaves are open,
555 	 * we destroy the slave device and unset the unit.
556 	 */
557 	ptydebug(1, "ptcclose=%s (master) | unix98? %s\n", dev->si_name,
558 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
559 	if (pti->pt_flags2 & PF_UNIX98) {
560 		KKASSERT((pti->pt_flags2 & PF_MOPEN) == 0);
561 		destroy_dev(dev);
562 		pti->devc = NULL;
563 
564 		if (!(pti->pt_flags2 & PF_SOPEN)) {
565 			ptydebug(1, "ptcclose: slaves are not open\n");
566 			destroy_dev(pti->devs);
567 			devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty), dev->si_uminor);
568 		}
569 	}
570 #endif
571 
572 	return (0);
573 }
574 
575 static	int
576 ptcread(struct dev_read_args *ap)
577 {
578 	cdev_t dev = ap->a_head.a_dev;
579 	struct tty *tp = dev->si_tty;
580 	struct pt_ioctl *pti = dev->si_drv1;
581 	char buf[BUFSIZ];
582 	int error = 0, cc;
583 
584 	/*
585 	 * We want to block until the slave
586 	 * is open, and there's something to read;
587 	 * but if we lost the slave or we're NBIO,
588 	 * then return the appropriate error instead.
589 	 */
590 	for (;;) {
591 		if (tp->t_state&TS_ISOPEN) {
592 			if (pti->pt_flags&PF_PKT && pti->pt_send) {
593 				error = ureadc((int)pti->pt_send, ap->a_uio);
594 				if (error)
595 					return (error);
596 				if (pti->pt_send & TIOCPKT_IOCTL) {
597 					cc = (int)szmin(ap->a_uio->uio_resid,
598 							sizeof(tp->t_termios));
599 					uiomove((caddr_t)&tp->t_termios, cc,
600 						ap->a_uio);
601 				}
602 				pti->pt_send = 0;
603 				return (0);
604 			}
605 			if (pti->pt_flags&PF_UCNTL && pti->pt_ucntl) {
606 				error = ureadc((int)pti->pt_ucntl, ap->a_uio);
607 				if (error)
608 					return (error);
609 				pti->pt_ucntl = 0;
610 				return (0);
611 			}
612 			if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
613 				break;
614 		}
615 		if ((tp->t_state & TS_CONNECTED) == 0)
616 			return (0);	/* EOF */
617 		if (ap->a_ioflag & IO_NDELAY)
618 			return (EWOULDBLOCK);
619 		error = tsleep(TSA_PTC_READ(tp), PCATCH, "ptcin", 0);
620 		if (error)
621 			return (error);
622 	}
623 	if (pti->pt_flags & (PF_PKT|PF_UCNTL))
624 		error = ureadc(0, ap->a_uio);
625 	while (ap->a_uio->uio_resid > 0 && error == 0) {
626 		cc = q_to_b(&tp->t_outq, buf,
627 			    (int)szmin(ap->a_uio->uio_resid, BUFSIZ));
628 		if (cc <= 0)
629 			break;
630 		error = uiomove(buf, (size_t)cc, ap->a_uio);
631 	}
632 	ttwwakeup(tp);
633 	return (error);
634 }
635 
636 static	void
637 ptsstop(struct tty *tp, int flush)
638 {
639 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
640 	int flag;
641 
642 	/* note: FLUSHREAD and FLUSHWRITE already ok */
643 	if (flush == 0) {
644 		flush = TIOCPKT_STOP;
645 		pti->pt_flags |= PF_STOPPED;
646 	} else
647 		pti->pt_flags &= ~PF_STOPPED;
648 	pti->pt_send |= flush;
649 	/* change of perspective */
650 	flag = 0;
651 	if (flush & FREAD)
652 		flag |= FWRITE;
653 	if (flush & FWRITE)
654 		flag |= FREAD;
655 	ptcwakeup(tp, flag);
656 }
657 
658 static	int
659 ptcpoll(struct dev_poll_args *ap)
660 {
661 	cdev_t dev = ap->a_head.a_dev;
662 	struct tty *tp = dev->si_tty;
663 	struct pt_ioctl *pti = dev->si_drv1;
664 	int revents = 0;
665 
666 	if ((tp->t_state & TS_CONNECTED) == 0) {
667 		ap->a_events = seltrue(dev, ap->a_events) | POLLHUP;
668 		return(0);
669 	}
670 
671 	/*
672 	 * Need to block timeouts (ttrstart).
673 	 */
674 	crit_enter();
675 
676 	if (ap->a_events & (POLLIN | POLLRDNORM))
677 		if ((tp->t_state & TS_ISOPEN) &&
678 		    ((tp->t_outq.c_cc && (tp->t_state & TS_TTSTOP) == 0) ||
679 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
680 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)))
681 			revents |= ap->a_events & (POLLIN | POLLRDNORM);
682 
683 	if (ap->a_events & (POLLOUT | POLLWRNORM))
684 		if (tp->t_state & TS_ISOPEN &&
685 		    ((pti->pt_flags & PF_REMOTE) ?
686 		     (tp->t_canq.c_cc == 0) :
687 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
688 		      (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON)))))
689 			revents |= ap->a_events & (POLLOUT | POLLWRNORM);
690 
691 	if (ap->a_events & POLLHUP)
692 		if ((tp->t_state & TS_CARR_ON) == 0)
693 			revents |= POLLHUP;
694 
695 	if (revents == 0) {
696 		if (ap->a_events & (POLLIN | POLLRDNORM))
697 			selrecord(curthread, &pti->pt_selr);
698 
699 		if (ap->a_events & (POLLOUT | POLLWRNORM))
700 			selrecord(curthread, &pti->pt_selw);
701 	}
702 	crit_exit();
703 
704 	ap->a_events = revents;
705 	return (0);
706 }
707 
708 /*
709  * kqueue ops for pseudo-terminals.
710  */
711 static struct filterops ptcread_filtops =
712 	{ 1, NULL, filt_ptcrdetach, filt_ptcread };
713 static struct filterops ptcwrite_filtops =
714 	{ 1, NULL, filt_ptcwdetach, filt_ptcwrite };
715 
716 static	int
717 ptckqfilter(struct dev_kqfilter_args *ap)
718 {
719 	cdev_t dev = ap->a_head.a_dev;
720 	struct knote *kn = ap->a_kn;
721 	struct tty *tp = dev->si_tty;
722 	struct klist *klist;
723 
724 	ap->a_result = 0;
725 	switch (kn->kn_filter) {
726 	case EVFILT_READ:
727 		klist = &tp->t_rsel.si_note;
728 		kn->kn_fop = &ptcread_filtops;
729 		break;
730 	case EVFILT_WRITE:
731 		klist = &tp->t_wsel.si_note;
732 		kn->kn_fop = &ptcwrite_filtops;
733 		break;
734 	default:
735 		ap->a_result = 1;
736 		return (0);
737 	}
738 
739 	kn->kn_hook = (caddr_t)dev;
740 
741 	crit_enter();
742 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
743 	crit_exit();
744 
745 	return (0);
746 }
747 
748 static int
749 filt_ptcread (struct knote *kn, long hint)
750 {
751 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
752 	struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
753 
754 	if ((tp->t_state & TS_ISOPEN) &&
755 	    ((tp->t_outq.c_cc && (tp->t_state & TS_TTSTOP) == 0) ||
756 	     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
757 	     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))) {
758 		kn->kn_data = tp->t_outq.c_cc;
759 		return(1);
760 	} else {
761 		return(0);
762 	}
763 }
764 
765 static int
766 filt_ptcwrite (struct knote *kn, long hint)
767 {
768 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
769 	struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
770 
771 	if (tp->t_state & TS_ISOPEN &&
772 	    ((pti->pt_flags & PF_REMOTE) ?
773 	     (tp->t_canq.c_cc == 0) :
774 	     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
775 	      (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON))))) {
776 		kn->kn_data = tp->t_canq.c_cc + tp->t_rawq.c_cc;
777 		return(1);
778 	} else {
779 		return(0);
780 	}
781 }
782 
783 static void
784 filt_ptcrdetach (struct knote *kn)
785 {
786 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
787 
788 	crit_enter();
789 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
790 	crit_exit();
791 }
792 
793 static void
794 filt_ptcwdetach (struct knote *kn)
795 {
796 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
797 
798 	crit_enter();
799 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
800 	crit_exit();
801 }
802 
803 /*
804  * I/O ops
805  */
806 static	int
807 ptcwrite(struct dev_write_args *ap)
808 {
809 	cdev_t dev = ap->a_head.a_dev;
810 	struct tty *tp = dev->si_tty;
811 	u_char *cp = 0;
812 	int cc = 0;
813 	u_char locbuf[BUFSIZ];
814 	int cnt = 0;
815 	struct pt_ioctl *pti = dev->si_drv1;
816 	int error = 0;
817 
818 again:
819 	if ((tp->t_state&TS_ISOPEN) == 0)
820 		goto block;
821 	if (pti->pt_flags & PF_REMOTE) {
822 		if (tp->t_canq.c_cc)
823 			goto block;
824 		while ((ap->a_uio->uio_resid > 0 || cc > 0) &&
825 		       tp->t_canq.c_cc < TTYHOG - 1) {
826 			if (cc == 0) {
827 				cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
828 				cc = imin(cc, TTYHOG - 1 - tp->t_canq.c_cc);
829 				cp = locbuf;
830 				error = uiomove(cp, (size_t)cc, ap->a_uio);
831 				if (error)
832 					return (error);
833 				/* check again for safety */
834 				if ((tp->t_state & TS_ISOPEN) == 0) {
835 					/* adjust as usual */
836 					ap->a_uio->uio_resid += cc;
837 					return (EIO);
838 				}
839 			}
840 			if (cc > 0) {
841 				cc = b_to_q((char *)cp, cc, &tp->t_canq);
842 				/*
843 				 * XXX we don't guarantee that the canq size
844 				 * is >= TTYHOG, so the above b_to_q() may
845 				 * leave some bytes uncopied.  However, space
846 				 * is guaranteed for the null terminator if
847 				 * we don't fail here since (TTYHOG - 1) is
848 				 * not a multiple of CBSIZE.
849 				 */
850 				if (cc > 0)
851 					break;
852 			}
853 		}
854 		/* adjust for data copied in but not written */
855 		ap->a_uio->uio_resid += cc;
856 		clist_putc(0, &tp->t_canq);
857 		ttwakeup(tp);
858 		wakeup(TSA_PTS_READ(tp));
859 		return (0);
860 	}
861 	while (ap->a_uio->uio_resid > 0 || cc > 0) {
862 		if (cc == 0) {
863 			cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
864 			cp = locbuf;
865 			error = uiomove(cp, (size_t)cc, ap->a_uio);
866 			if (error)
867 				return (error);
868 			/* check again for safety */
869 			if ((tp->t_state & TS_ISOPEN) == 0) {
870 				/* adjust for data copied in but not written */
871 				ap->a_uio->uio_resid += cc;
872 				return (EIO);
873 			}
874 		}
875 		while (cc > 0) {
876 			if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
877 			   (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
878 				wakeup(TSA_HUP_OR_INPUT(tp));
879 				goto block;
880 			}
881 			(*linesw[tp->t_line].l_rint)(*cp++, tp);
882 			cnt++;
883 			cc--;
884 		}
885 		cc = 0;
886 	}
887 	return (0);
888 block:
889 	/*
890 	 * Come here to wait for slave to open, for space
891 	 * in outq, or space in rawq, or an empty canq.
892 	 */
893 	if ((tp->t_state & TS_CONNECTED) == 0) {
894 		/* adjust for data copied in but not written */
895 		ap->a_uio->uio_resid += cc;
896 		return (EIO);
897 	}
898 	if (ap->a_ioflag & IO_NDELAY) {
899 		/* adjust for data copied in but not written */
900 		ap->a_uio->uio_resid += cc;
901 		if (cnt == 0)
902 			return (EWOULDBLOCK);
903 		return (0);
904 	}
905 	error = tsleep(TSA_PTC_WRITE(tp), PCATCH, "ptcout", 0);
906 	if (error) {
907 		/* adjust for data copied in but not written */
908 		ap->a_uio->uio_resid += cc;
909 		return (error);
910 	}
911 	goto again;
912 }
913 
914 /*ARGSUSED*/
915 static	int
916 ptyioctl(struct dev_ioctl_args *ap)
917 {
918 	cdev_t dev = ap->a_head.a_dev;
919 	struct tty *tp = dev->si_tty;
920 	struct pt_ioctl *pti = dev->si_drv1;
921 	u_char *cc = tp->t_cc;
922 	int stop, error;
923 
924 	if (dev_dflags(dev) & D_MASTER) {
925 		switch (ap->a_cmd) {
926 
927 		case TIOCGPGRP:
928 			/*
929 			 * We avoid calling ttioctl on the controller since,
930 			 * in that case, tp must be the controlling terminal.
931 			 */
932 			*(int *)ap->a_data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
933 			return (0);
934 
935 		case TIOCPKT:
936 			if (*(int *)ap->a_data) {
937 				if (pti->pt_flags & PF_UCNTL)
938 					return (EINVAL);
939 				pti->pt_flags |= PF_PKT;
940 			} else
941 				pti->pt_flags &= ~PF_PKT;
942 			return (0);
943 
944 		case TIOCUCNTL:
945 			if (*(int *)ap->a_data) {
946 				if (pti->pt_flags & PF_PKT)
947 					return (EINVAL);
948 				pti->pt_flags |= PF_UCNTL;
949 			} else
950 				pti->pt_flags &= ~PF_UCNTL;
951 			return (0);
952 
953 		case TIOCREMOTE:
954 			if (*(int *)ap->a_data)
955 				pti->pt_flags |= PF_REMOTE;
956 			else
957 				pti->pt_flags &= ~PF_REMOTE;
958 			ttyflush(tp, FREAD|FWRITE);
959 			return (0);
960 
961 		case TIOCISPTMASTER:
962 			if ((pti->pt_flags2 & PF_UNIX98) && (pti->devc == dev))
963 				return (0);
964 			else
965 				return (EINVAL);
966 		}
967 
968 		/*
969 		 * The rest of the ioctls shouldn't be called until
970 		 * the slave is open.
971 		 */
972 		if ((tp->t_state & TS_ISOPEN) == 0)
973 			return (EAGAIN);
974 
975 		switch (ap->a_cmd) {
976 #ifdef COMPAT_43
977 		case TIOCSETP:
978 		case TIOCSETN:
979 #endif
980 		case TIOCSETD:
981 		case TIOCSETA:
982 		case TIOCSETAW:
983 		case TIOCSETAF:
984 			/*
985 			 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
986 			 * ttywflush(tp) will hang if there are characters in
987 			 * the outq.
988 			 */
989 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
990 			break;
991 
992 		case TIOCSIG:
993 			if (*(unsigned int *)ap->a_data >= NSIG ||
994 			    *(unsigned int *)ap->a_data == 0)
995 				return(EINVAL);
996 			if ((tp->t_lflag&NOFLSH) == 0)
997 				ttyflush(tp, FREAD|FWRITE);
998 			pgsignal(tp->t_pgrp, *(unsigned int *)ap->a_data, 1);
999 			if ((*(unsigned int *)ap->a_data == SIGINFO) &&
1000 			    ((tp->t_lflag&NOKERNINFO) == 0))
1001 				ttyinfo(tp);
1002 			return(0);
1003 		}
1004 	}
1005 	if (ap->a_cmd == TIOCEXT) {
1006 		/*
1007 		 * When the EXTPROC bit is being toggled, we need
1008 		 * to send an TIOCPKT_IOCTL if the packet driver
1009 		 * is turned on.
1010 		 */
1011 		if (*(int *)ap->a_data) {
1012 			if (pti->pt_flags & PF_PKT) {
1013 				pti->pt_send |= TIOCPKT_IOCTL;
1014 				ptcwakeup(tp, FREAD);
1015 			}
1016 			tp->t_lflag |= EXTPROC;
1017 		} else {
1018 			if ((tp->t_lflag & EXTPROC) &&
1019 			    (pti->pt_flags & PF_PKT)) {
1020 				pti->pt_send |= TIOCPKT_IOCTL;
1021 				ptcwakeup(tp, FREAD);
1022 			}
1023 			tp->t_lflag &= ~EXTPROC;
1024 		}
1025 		return(0);
1026 	}
1027 	error = (*linesw[tp->t_line].l_ioctl)(tp, ap->a_cmd, ap->a_data,
1028 					      ap->a_fflag, ap->a_cred);
1029 	if (error == ENOIOCTL)
1030 		 error = ttioctl(tp, ap->a_cmd, ap->a_data, ap->a_fflag);
1031 	if (error == ENOIOCTL) {
1032 		if (pti->pt_flags & PF_UCNTL &&
1033 		    (ap->a_cmd & ~0xff) == UIOCCMD(0)) {
1034 			if (ap->a_cmd & 0xff) {
1035 				pti->pt_ucntl = (u_char)ap->a_cmd;
1036 				ptcwakeup(tp, FREAD);
1037 			}
1038 			return (0);
1039 		}
1040 		error = ENOTTY;
1041 	}
1042 	/*
1043 	 * If external processing and packet mode send ioctl packet.
1044 	 */
1045 	if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
1046 		switch(ap->a_cmd) {
1047 		case TIOCSETA:
1048 		case TIOCSETAW:
1049 		case TIOCSETAF:
1050 #ifdef COMPAT_43
1051 		case TIOCSETP:
1052 		case TIOCSETN:
1053 #endif
1054 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1055 		case TIOCSETC:
1056 		case TIOCSLTC:
1057 		case TIOCLBIS:
1058 		case TIOCLBIC:
1059 		case TIOCLSET:
1060 #endif
1061 			pti->pt_send |= TIOCPKT_IOCTL;
1062 			ptcwakeup(tp, FREAD);
1063 		default:
1064 			break;
1065 		}
1066 	}
1067 	stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1068 		&& CCEQ(cc[VSTART], CTRL('q'));
1069 	if (pti->pt_flags & PF_NOSTOP) {
1070 		if (stop) {
1071 			pti->pt_send &= ~TIOCPKT_NOSTOP;
1072 			pti->pt_send |= TIOCPKT_DOSTOP;
1073 			pti->pt_flags &= ~PF_NOSTOP;
1074 			ptcwakeup(tp, FREAD);
1075 		}
1076 	} else {
1077 		if (!stop) {
1078 			pti->pt_send &= ~TIOCPKT_DOSTOP;
1079 			pti->pt_send |= TIOCPKT_NOSTOP;
1080 			pti->pt_flags |= PF_NOSTOP;
1081 			ptcwakeup(tp, FREAD);
1082 		}
1083 	}
1084 	return (error);
1085 }
1086 
1087 
1088 static void ptc_drvinit (void *unused);
1089 
1090 #ifdef UNIX98_PTYS
1091 SYSCTL_INT(_kern, OID_AUTO, pty_debug, CTLFLAG_RW, &pty_debug_level,
1092 		0, "Change pty debug level");
1093 #endif
1094 
1095 static void
1096 ptc_drvinit(void *unused)
1097 {
1098 	int i;
1099 
1100 #ifdef UNIX98_PTYS
1101 	/*
1102 	 * Unix98 pty stuff.
1103 	 * Create the clonable base device.
1104 	 */
1105 	make_autoclone_dev(&ptc_ops, &DEVFS_CLONE_BITMAP(pty), ptyclone,
1106 	    0, 0, 0666, "ptmx");
1107 #endif
1108 
1109 	for (i = 0; i < 256; i++) {
1110 		ptyinit(i);
1111 	}
1112 }
1113 
1114 SYSINIT(ptcdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR_C,ptc_drvinit,NULL)
1115