xref: /dflybsd-src/sys/kern/tty_pty.c (revision ae788f37fe53d5d1ca1e12a184a662192caad3c5)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
34  * $FreeBSD: src/sys/kern/tty_pty.c,v 1.74.2.4 2002/02/20 19:58:13 dillon Exp $
35  * $DragonFly: src/sys/kern/tty_pty.c,v 1.21 2008/08/13 10:29:38 swildner Exp $
36  */
37 
38 /*
39  * Pseudo-teletype Driver
40  * (Actually two drivers, requiring two dev_ops structures)
41  */
42 #include "use_pty.h"		/* XXX */
43 #include "opt_compat.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
48 #include <sys/ioctl_compat.h>
49 #endif
50 #include <sys/proc.h>
51 #include <sys/priv.h>
52 #include <sys/tty.h>
53 #include <sys/conf.h>
54 #include <sys/fcntl.h>
55 #include <sys/poll.h>
56 #include <sys/kernel.h>
57 #include <sys/vnode.h>
58 #include <sys/signalvar.h>
59 #include <sys/malloc.h>
60 #include <sys/device.h>
61 #include <sys/thread2.h>
62 #include <sys/devfs.h>
63 #include <sys/stat.h>
64 #include <sys/sysctl.h>
65 
66 #define	UNIX98_PTYS	1
67 
68 MALLOC_DEFINE(M_PTY, "ptys", "pty data structures");
69 
70 static void ptsstart (struct tty *tp);
71 static void ptsstop (struct tty *tp, int rw);
72 static void ptcwakeup (struct tty *tp, int flag);
73 static void ptyinit (int n);
74 
75 static	d_open_t	ptsopen;
76 static	d_close_t	ptsclose;
77 static	d_read_t	ptsread;
78 static	d_write_t	ptswrite;
79 static	d_ioctl_t	ptyioctl;
80 static	d_open_t	ptcopen;
81 static	d_close_t	ptcclose;
82 static	d_read_t	ptcread;
83 static	d_write_t	ptcwrite;
84 static	d_poll_t	ptcpoll;
85 
86 #ifdef UNIX98_PTYS
87 DEVFS_DECLARE_CLONE_BITMAP(pty);
88 
89 static	d_clone_t 	ptyclone;
90 
91 static int	pty_debug_level = 0;
92 
93 static struct dev_ops pts98_ops = {
94 	{ "pts98", 0, D_TTY | D_KQFILTER },
95 	.d_open =	ptsopen,
96 	.d_close =	ptsclose,
97 	.d_read =	ptsread,
98 	.d_write =	ptswrite,
99 	.d_ioctl =	ptyioctl,
100 	.d_poll =	ttypoll,
101 	.d_kqfilter =	ttykqfilter,
102 	.d_revoke =	ttyrevoke
103 };
104 
105 static struct dev_ops ptc98_ops = {
106 	{ "ptc98", 0, D_TTY | D_KQFILTER | D_MASTER },
107 	.d_open =	ptcopen,
108 	.d_close =	ptcclose,
109 	.d_read =	ptcread,
110 	.d_write =	ptcwrite,
111 	.d_ioctl =	ptyioctl,
112 	.d_poll =	ptcpoll,
113 	.d_kqfilter =	ttykqfilter,
114 	.d_revoke =	ttyrevoke
115 };
116 #endif
117 
118 #define	CDEV_MAJOR_S	5
119 static struct dev_ops pts_ops = {
120 	{ "pts", CDEV_MAJOR_S, D_TTY | D_KQFILTER },
121 	.d_open =	ptsopen,
122 	.d_close =	ptsclose,
123 	.d_read =	ptsread,
124 	.d_write =	ptswrite,
125 	.d_ioctl =	ptyioctl,
126 	.d_poll =	ttypoll,
127 	.d_kqfilter =	ttykqfilter,
128 	.d_revoke =	ttyrevoke
129 };
130 
131 #define	CDEV_MAJOR_C	6
132 static struct dev_ops ptc_ops = {
133 	{ "ptc", CDEV_MAJOR_C, D_TTY | D_KQFILTER | D_MASTER },
134 	.d_open =	ptcopen,
135 	.d_close =	ptcclose,
136 	.d_read =	ptcread,
137 	.d_write =	ptcwrite,
138 	.d_ioctl =	ptyioctl,
139 	.d_poll =	ptcpoll,
140 	.d_kqfilter =	ttykqfilter,
141 	.d_revoke =	ttyrevoke
142 };
143 
144 #define BUFSIZ 100		/* Chunk size iomoved to/from user */
145 
146 struct	pt_ioctl {
147 	int	pt_flags;
148 	int	pt_flags2;
149 	struct	selinfo pt_selr, pt_selw;
150 	u_char	pt_send;
151 	u_char	pt_ucntl;
152 	struct tty pt_tty;
153 	cdev_t	devs, devc;
154 	struct	prison *pt_prison;
155 };
156 
157 #define	PF_PKT		0x08		/* packet mode */
158 #define	PF_STOPPED	0x10		/* user told stopped */
159 #define	PF_REMOTE	0x20		/* remote and flow controlled input */
160 #define	PF_NOSTOP	0x40
161 #define PF_UCNTL	0x80		/* user control mode */
162 
163 #define	PF_UNIX98	0x01
164 #define	PF_SOPEN	0x02
165 #define	PF_MOPEN	0x04
166 
167 static int
168 ptydebug(int level, char *fmt, ...)
169 {
170 	__va_list ap;
171 
172 	__va_start(ap, fmt);
173 	if (level <= pty_debug_level)
174 		kvprintf(fmt, ap);
175 	__va_end(ap);
176 
177 	return 0;
178 }
179 
180 /*
181  * This function creates and initializes a pts/ptc pair
182  *
183  * pts == /dev/tty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
184  * ptc == /dev/pty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
185  *
186  * XXX: define and add mapping of upper minor bits to allow more
187  *      than 256 ptys.
188  */
189 static void
190 ptyinit(int n)
191 {
192 	cdev_t devs, devc;
193 	char *names = "pqrsPQRS";
194 	struct pt_ioctl *pt;
195 
196 	/* For now we only map the lower 8 bits of the minor */
197 	if (n & ~0xff)
198 		return;
199 
200 	pt = kmalloc(sizeof(*pt), M_PTY, M_WAITOK | M_ZERO);
201 	pt->devs = devs = make_dev(&pts_ops, n,
202 	    0, 0, 0666, "tty%c%r", names[n / 32], n % 32);
203 	pt->devc = devc = make_dev(&ptc_ops, n,
204 	    0, 0, 0666, "pty%c%r", names[n / 32], n % 32);
205 
206 	devs->si_drv1 = devc->si_drv1 = pt;
207 	devs->si_tty = devc->si_tty = &pt->pt_tty;
208 	devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
209 	devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
210 	pt->pt_tty.t_dev = devs;
211 	ttyregister(&pt->pt_tty);
212 }
213 
214 #ifdef UNIX98_PTYS
215 static int
216 ptyclone(struct dev_clone_args *ap)
217 {
218 	int unit;
219 	struct pt_ioctl *pt;
220 
221 	/*
222 	 * Limit the number of unix98 pty (slave) devices to 1000, as
223 	 * the utmp(5) format only allows for 8 bytes for the tty,
224 	 * "pts/XXX".
225 	 * If this limit is reached, we don't clone and return error
226 	 * to devfs.
227 	 */
228 	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), 1000);
229 
230 	if (unit < 0) {
231 		ap->a_dev = NULL;
232 		return 1;
233 	}
234 
235 	pt = kmalloc(sizeof(*pt), M_PTY, M_WAITOK | M_ZERO);
236 
237 	pt->devc = ap->a_dev = make_only_dev(&ptc98_ops, unit, ap->a_cred->cr_ruid,
238 	    0, 0600, "ptm/%d", unit);
239 	pt->devs = make_dev(&pts98_ops, unit, ap->a_cred->cr_ruid, GID_TTY, 0620,
240 	    "pts/%d", unit);
241 
242 	pt->devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
243 	pt->devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
244 
245 	pt->devs->si_drv1 = pt->devc->si_drv1 = pt;
246 	pt->devs->si_tty = pt->devc->si_tty = &pt->pt_tty;
247 	pt->pt_tty.t_dev = pt->devs;
248 	pt->pt_flags2 |= PF_UNIX98;
249 
250 	ttyregister(&pt->pt_tty);
251 
252 	return 0;
253 }
254 #endif
255 
256 /*ARGSUSED*/
257 static	int
258 ptsopen(struct dev_open_args *ap)
259 {
260 	cdev_t dev = ap->a_head.a_dev;
261 	struct tty *tp;
262 	int error;
263 	struct pt_ioctl *pti;
264 
265 	if (!dev->si_drv1)
266 		ptyinit(minor(dev));
267 	if (!dev->si_drv1)
268 		return(ENXIO);
269 	pti = dev->si_drv1;
270 	tp = dev->si_tty;
271 	if ((tp->t_state & TS_ISOPEN) == 0) {
272 		ttychars(tp);		/* Set up default chars */
273 		tp->t_iflag = TTYDEF_IFLAG;
274 		tp->t_oflag = TTYDEF_OFLAG;
275 		tp->t_lflag = TTYDEF_LFLAG;
276 		tp->t_cflag = TTYDEF_CFLAG;
277 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
278 	} else if ((tp->t_state & TS_XCLUDE) && priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) {
279 		return (EBUSY);
280 	} else if (pti->pt_prison != ap->a_cred->cr_prison) {
281 		return (EBUSY);
282 	}
283 	if (tp->t_oproc)			/* Ctrlr still around. */
284 		(void)(*linesw[tp->t_line].l_modem)(tp, 1);
285 	while ((tp->t_state & TS_CARR_ON) == 0) {
286 		if (ap->a_oflags & FNONBLOCK)
287 			break;
288 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ptsopn", 0);
289 		if (error)
290 			return (error);
291 	}
292 	error = (*linesw[tp->t_line].l_open)(dev, tp);
293 	if (error == 0)
294 		ptcwakeup(tp, FREAD|FWRITE);
295 
296 #ifdef UNIX98_PTYS
297 	/*
298 	 * Unix98 pty stuff.
299 	 * On open of the slave, we set the corresponding flag in the common
300 	 * struct.
301 	 */
302 	ptydebug(1, "ptsopen=%s | unix98? %s\n", dev->si_name,
303 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
304 
305 	if ((!error) && (pti->pt_flags2 & PF_UNIX98)) {
306 		pti->pt_flags2 |= PF_SOPEN;
307 	}
308 #endif
309 
310 	return (error);
311 }
312 
313 static	int
314 ptsclose(struct dev_close_args *ap)
315 {
316 	cdev_t dev = ap->a_head.a_dev;
317 	struct tty *tp;
318 	struct pt_ioctl *pti = dev->si_drv1;
319 	int err;
320 
321 	tp = dev->si_tty;
322 	err = (*linesw[tp->t_line].l_close)(tp, ap->a_fflag);
323 	ptsstop(tp, FREAD|FWRITE);
324 	(void) ttyclose(tp);
325 
326 #ifdef UNIX98_PTYS
327 	/*
328 	 * Unix98 pty stuff.
329 	 * On close of the slave, we unset the corresponding flag, and if the master
330 	 * isn't open anymore, we destroy the slave and unset the unit.
331 	 */
332 	ptydebug(1, "ptsclose=%s | unix98? %s\n", dev->si_name,
333 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
334 
335 	if (pti->pt_flags2 & PF_UNIX98) {
336 		pti->pt_flags2 &= ~PF_SOPEN;
337 		KKASSERT((pti->pt_flags2 & PF_SOPEN) == 0);
338 		ptydebug(1, "master open? %s\n",
339 		    (pti->pt_flags2 & PF_MOPEN)?"yes":"no");
340 
341 		if (!(pti->pt_flags2 & PF_SOPEN) && !(pti->pt_flags2 & PF_MOPEN)) {
342 			devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty), dev->si_uminor);
343 			destroy_dev(dev);
344 		}
345 	}
346 #endif
347 
348 	return (err);
349 }
350 
351 static	int
352 ptsread(struct dev_read_args *ap)
353 {
354 	cdev_t dev = ap->a_head.a_dev;
355 	struct proc *p = curproc;
356 	struct tty *tp = dev->si_tty;
357 	struct pt_ioctl *pti = dev->si_drv1;
358 	struct lwp *lp;
359 
360 	int error = 0;
361 
362 	lp = curthread->td_lwp;
363 
364 again:
365 	if (pti->pt_flags & PF_REMOTE) {
366 		while (isbackground(p, tp)) {
367 			if (SIGISMEMBER(p->p_sigignore, SIGTTIN) ||
368 			    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
369 			    p->p_pgrp->pg_jobc == 0 || p->p_flag & P_PPWAIT)
370 				return (EIO);
371 			pgsignal(p->p_pgrp, SIGTTIN, 1);
372 			error = ttysleep(tp, &lbolt, PCATCH, "ptsbg", 0);
373 			if (error)
374 				return (error);
375 		}
376 		if (tp->t_canq.c_cc == 0) {
377 			if (ap->a_ioflag & IO_NDELAY)
378 				return (EWOULDBLOCK);
379 			error = ttysleep(tp, TSA_PTS_READ(tp), PCATCH,
380 					 "ptsin", 0);
381 			if (error)
382 				return (error);
383 			goto again;
384 		}
385 		while (tp->t_canq.c_cc > 1 && ap->a_uio->uio_resid > 0)
386 			if (ureadc(clist_getc(&tp->t_canq), ap->a_uio) < 0) {
387 				error = EFAULT;
388 				break;
389 			}
390 		if (tp->t_canq.c_cc == 1)
391 			clist_getc(&tp->t_canq);
392 		if (tp->t_canq.c_cc)
393 			return (error);
394 	} else
395 		if (tp->t_oproc)
396 			error = (*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag);
397 	ptcwakeup(tp, FWRITE);
398 	return (error);
399 }
400 
401 /*
402  * Write to pseudo-tty.
403  * Wakeups of controlling tty will happen
404  * indirectly, when tty driver calls ptsstart.
405  */
406 static	int
407 ptswrite(struct dev_write_args *ap)
408 {
409 	cdev_t dev = ap->a_head.a_dev;
410 	struct tty *tp;
411 
412 	tp = dev->si_tty;
413 	if (tp->t_oproc == 0)
414 		return (EIO);
415 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
416 }
417 
418 /*
419  * Start output on pseudo-tty.
420  * Wake up process selecting or sleeping for input from controlling tty.
421  */
422 static void
423 ptsstart(struct tty *tp)
424 {
425 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
426 
427 	if (tp->t_state & TS_TTSTOP)
428 		return;
429 	if (pti->pt_flags & PF_STOPPED) {
430 		pti->pt_flags &= ~PF_STOPPED;
431 		pti->pt_send = TIOCPKT_START;
432 	}
433 	ptcwakeup(tp, FREAD);
434 }
435 
436 static void
437 ptcwakeup(struct tty *tp, int flag)
438 {
439 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
440 
441 	if (flag & FREAD) {
442 		selwakeup(&pti->pt_selr);
443 		wakeup(TSA_PTC_READ(tp));
444 	}
445 	if (flag & FWRITE) {
446 		selwakeup(&pti->pt_selw);
447 		wakeup(TSA_PTC_WRITE(tp));
448 	}
449 }
450 
451 static	int
452 ptcopen(struct dev_open_args *ap)
453 {
454 	cdev_t dev = ap->a_head.a_dev;
455 	struct tty *tp;
456 	struct pt_ioctl *pti;
457 
458 	if (!dev->si_drv1)
459 		ptyinit(minor(dev));
460 	if (!dev->si_drv1)
461 		return(ENXIO);
462 	pti = dev->si_drv1;
463 	if (pti->pt_prison && pti->pt_prison != ap->a_cred->cr_prison)
464 		return(EBUSY);
465 	tp = dev->si_tty;
466 	if (tp->t_oproc)
467 		return (EIO);
468 	tp->t_oproc = ptsstart;
469 	tp->t_stop = ptsstop;
470 	(void)(*linesw[tp->t_line].l_modem)(tp, 1);
471 	tp->t_lflag &= ~EXTPROC;
472 	pti->pt_prison = ap->a_cred->cr_prison;
473 	pti->pt_flags = 0;
474 	pti->pt_send = 0;
475 	pti->pt_ucntl = 0;
476 
477 	pti->devs->si_uid = ap->a_cred->cr_uid;
478 	pti->devs->si_gid = 0;
479 	pti->devs->si_perms = 0600;
480 	pti->devc->si_uid = ap->a_cred->cr_uid;
481 	pti->devc->si_gid = 0;
482 	pti->devc->si_perms = 0600;
483 
484 #ifdef UNIX98_PTYS
485 	/*
486 	 * Unix98 pty stuff.
487 	 * On open of the master, we set the corresponding flag in the common
488 	 * struct.
489 	 */
490 	ptydebug(1, "ptcopen=%s (master) | unix98? %s\n", dev->si_name,
491 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
492 
493 	if (pti->pt_flags2 & PF_UNIX98) {
494 		pti->pt_flags2 |= PF_MOPEN;
495 	}
496 #endif
497 
498 	return (0);
499 }
500 
501 static	int
502 ptcclose(struct dev_close_args *ap)
503 {
504 	cdev_t dev = ap->a_head.a_dev;
505 	struct tty *tp;
506 	struct pt_ioctl *pti = dev->si_drv1;
507 
508 	tp = dev->si_tty;
509 	(void)(*linesw[tp->t_line].l_modem)(tp, 0);
510 
511 #ifdef UNIX98_PTYS
512 	/*
513 	 * Unix98 pty stuff.
514 	 * On close of the master, we unset the corresponding flag in the common
515 	 * struct asap.
516 	 */
517 	pti->pt_flags2 &= ~PF_MOPEN;
518 #endif
519 
520 	/*
521 	 * XXX MDMBUF makes no sense for ptys but would inhibit the above
522 	 * l_modem().  CLOCAL makes sense but isn't supported.   Special
523 	 * l_modem()s that ignore carrier drop make no sense for ptys but
524 	 * may be in use because other parts of the line discipline make
525 	 * sense for ptys.  Recover by doing everything that a normal
526 	 * ttymodem() would have done except for sending a SIGHUP.
527 	 */
528 	if (tp->t_state & TS_ISOPEN) {
529 		tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
530 		tp->t_state |= TS_ZOMBIE;
531 		ttyflush(tp, FREAD | FWRITE);
532 	}
533 	tp->t_oproc = 0;		/* mark closed */
534 
535 	pti = dev->si_drv1;
536 	pti->pt_prison = NULL;
537 	pti->devs->si_uid = 0;
538 	pti->devs->si_gid = 0;
539 	pti->devs->si_perms = 0666;
540 	pti->devc->si_uid = 0;
541 	pti->devc->si_gid = 0;
542 	pti->devc->si_perms = 0666;
543 
544 #ifdef UNIX98_PTYS
545 	/*
546 	 * Unix98 pty stuff.
547 	 * On close of the master, we destroy the master and, if no slaves are open,
548 	 * we destroy the slave device and unset the unit.
549 	 */
550 	ptydebug(1, "ptcclose=%s (master) | unix98? %s\n", dev->si_name,
551 	    (pti->pt_flags2 & PF_UNIX98)?"yes":"no");
552 	if (pti->pt_flags2 & PF_UNIX98) {
553 		KKASSERT((pti->pt_flags2 & PF_MOPEN) == 0);
554 		destroy_dev(dev);
555 		pti->devc = NULL;
556 
557 		if (!(pti->pt_flags2 & PF_SOPEN)) {
558 			ptydebug(1, "ptcclose: slaves are not open\n");
559 			destroy_dev(pti->devs);
560 			devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty), dev->si_uminor);
561 		}
562 	}
563 #endif
564 
565 	return (0);
566 }
567 
568 static	int
569 ptcread(struct dev_read_args *ap)
570 {
571 	cdev_t dev = ap->a_head.a_dev;
572 	struct tty *tp = dev->si_tty;
573 	struct pt_ioctl *pti = dev->si_drv1;
574 	char buf[BUFSIZ];
575 	int error = 0, cc;
576 
577 	/*
578 	 * We want to block until the slave
579 	 * is open, and there's something to read;
580 	 * but if we lost the slave or we're NBIO,
581 	 * then return the appropriate error instead.
582 	 */
583 	for (;;) {
584 		if (tp->t_state&TS_ISOPEN) {
585 			if (pti->pt_flags&PF_PKT && pti->pt_send) {
586 				error = ureadc((int)pti->pt_send, ap->a_uio);
587 				if (error)
588 					return (error);
589 				if (pti->pt_send & TIOCPKT_IOCTL) {
590 					cc = (int)szmin(ap->a_uio->uio_resid,
591 							sizeof(tp->t_termios));
592 					uiomove((caddr_t)&tp->t_termios, cc,
593 						ap->a_uio);
594 				}
595 				pti->pt_send = 0;
596 				return (0);
597 			}
598 			if (pti->pt_flags&PF_UCNTL && pti->pt_ucntl) {
599 				error = ureadc((int)pti->pt_ucntl, ap->a_uio);
600 				if (error)
601 					return (error);
602 				pti->pt_ucntl = 0;
603 				return (0);
604 			}
605 			if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
606 				break;
607 		}
608 		if ((tp->t_state & TS_CONNECTED) == 0)
609 			return (0);	/* EOF */
610 		if (ap->a_ioflag & IO_NDELAY)
611 			return (EWOULDBLOCK);
612 		error = tsleep(TSA_PTC_READ(tp), PCATCH, "ptcin", 0);
613 		if (error)
614 			return (error);
615 	}
616 	if (pti->pt_flags & (PF_PKT|PF_UCNTL))
617 		error = ureadc(0, ap->a_uio);
618 	while (ap->a_uio->uio_resid > 0 && error == 0) {
619 		cc = q_to_b(&tp->t_outq, buf,
620 			    (int)szmin(ap->a_uio->uio_resid, BUFSIZ));
621 		if (cc <= 0)
622 			break;
623 		error = uiomove(buf, (size_t)cc, ap->a_uio);
624 	}
625 	ttwwakeup(tp);
626 	return (error);
627 }
628 
629 static	void
630 ptsstop(struct tty *tp, int flush)
631 {
632 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
633 	int flag;
634 
635 	/* note: FLUSHREAD and FLUSHWRITE already ok */
636 	if (flush == 0) {
637 		flush = TIOCPKT_STOP;
638 		pti->pt_flags |= PF_STOPPED;
639 	} else
640 		pti->pt_flags &= ~PF_STOPPED;
641 	pti->pt_send |= flush;
642 	/* change of perspective */
643 	flag = 0;
644 	if (flush & FREAD)
645 		flag |= FWRITE;
646 	if (flush & FWRITE)
647 		flag |= FREAD;
648 	ptcwakeup(tp, flag);
649 }
650 
651 static	int
652 ptcpoll(struct dev_poll_args *ap)
653 {
654 	cdev_t dev = ap->a_head.a_dev;
655 	struct tty *tp = dev->si_tty;
656 	struct pt_ioctl *pti = dev->si_drv1;
657 	int revents = 0;
658 
659 	if ((tp->t_state & TS_CONNECTED) == 0) {
660 		ap->a_events = seltrue(dev, ap->a_events) | POLLHUP;
661 		return(0);
662 	}
663 
664 	/*
665 	 * Need to block timeouts (ttrstart).
666 	 */
667 	crit_enter();
668 
669 	if (ap->a_events & (POLLIN | POLLRDNORM))
670 		if ((tp->t_state & TS_ISOPEN) &&
671 		    ((tp->t_outq.c_cc && (tp->t_state & TS_TTSTOP) == 0) ||
672 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
673 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)))
674 			revents |= ap->a_events & (POLLIN | POLLRDNORM);
675 
676 	if (ap->a_events & (POLLOUT | POLLWRNORM))
677 		if (tp->t_state & TS_ISOPEN &&
678 		    ((pti->pt_flags & PF_REMOTE) ?
679 		     (tp->t_canq.c_cc == 0) :
680 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
681 		      (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON)))))
682 			revents |= ap->a_events & (POLLOUT | POLLWRNORM);
683 
684 	if (ap->a_events & POLLHUP)
685 		if ((tp->t_state & TS_CARR_ON) == 0)
686 			revents |= POLLHUP;
687 
688 	if (revents == 0) {
689 		if (ap->a_events & (POLLIN | POLLRDNORM))
690 			selrecord(curthread, &pti->pt_selr);
691 
692 		if (ap->a_events & (POLLOUT | POLLWRNORM))
693 			selrecord(curthread, &pti->pt_selw);
694 	}
695 	crit_exit();
696 
697 	ap->a_events = revents;
698 	return (0);
699 }
700 
701 static	int
702 ptcwrite(struct dev_write_args *ap)
703 {
704 	cdev_t dev = ap->a_head.a_dev;
705 	struct tty *tp = dev->si_tty;
706 	u_char *cp = 0;
707 	int cc = 0;
708 	u_char locbuf[BUFSIZ];
709 	int cnt = 0;
710 	struct pt_ioctl *pti = dev->si_drv1;
711 	int error = 0;
712 
713 again:
714 	if ((tp->t_state&TS_ISOPEN) == 0)
715 		goto block;
716 	if (pti->pt_flags & PF_REMOTE) {
717 		if (tp->t_canq.c_cc)
718 			goto block;
719 		while ((ap->a_uio->uio_resid > 0 || cc > 0) &&
720 		       tp->t_canq.c_cc < TTYHOG - 1) {
721 			if (cc == 0) {
722 				cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
723 				cc = imin(cc, TTYHOG - 1 - tp->t_canq.c_cc);
724 				cp = locbuf;
725 				error = uiomove(cp, (size_t)cc, ap->a_uio);
726 				if (error)
727 					return (error);
728 				/* check again for safety */
729 				if ((tp->t_state & TS_ISOPEN) == 0) {
730 					/* adjust as usual */
731 					ap->a_uio->uio_resid += cc;
732 					return (EIO);
733 				}
734 			}
735 			if (cc > 0) {
736 				cc = b_to_q((char *)cp, cc, &tp->t_canq);
737 				/*
738 				 * XXX we don't guarantee that the canq size
739 				 * is >= TTYHOG, so the above b_to_q() may
740 				 * leave some bytes uncopied.  However, space
741 				 * is guaranteed for the null terminator if
742 				 * we don't fail here since (TTYHOG - 1) is
743 				 * not a multiple of CBSIZE.
744 				 */
745 				if (cc > 0)
746 					break;
747 			}
748 		}
749 		/* adjust for data copied in but not written */
750 		ap->a_uio->uio_resid += cc;
751 		clist_putc(0, &tp->t_canq);
752 		ttwakeup(tp);
753 		wakeup(TSA_PTS_READ(tp));
754 		return (0);
755 	}
756 	while (ap->a_uio->uio_resid > 0 || cc > 0) {
757 		if (cc == 0) {
758 			cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
759 			cp = locbuf;
760 			error = uiomove(cp, (size_t)cc, ap->a_uio);
761 			if (error)
762 				return (error);
763 			/* check again for safety */
764 			if ((tp->t_state & TS_ISOPEN) == 0) {
765 				/* adjust for data copied in but not written */
766 				ap->a_uio->uio_resid += cc;
767 				return (EIO);
768 			}
769 		}
770 		while (cc > 0) {
771 			if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
772 			   (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
773 				wakeup(TSA_HUP_OR_INPUT(tp));
774 				goto block;
775 			}
776 			(*linesw[tp->t_line].l_rint)(*cp++, tp);
777 			cnt++;
778 			cc--;
779 		}
780 		cc = 0;
781 	}
782 	return (0);
783 block:
784 	/*
785 	 * Come here to wait for slave to open, for space
786 	 * in outq, or space in rawq, or an empty canq.
787 	 */
788 	if ((tp->t_state & TS_CONNECTED) == 0) {
789 		/* adjust for data copied in but not written */
790 		ap->a_uio->uio_resid += cc;
791 		return (EIO);
792 	}
793 	if (ap->a_ioflag & IO_NDELAY) {
794 		/* adjust for data copied in but not written */
795 		ap->a_uio->uio_resid += cc;
796 		if (cnt == 0)
797 			return (EWOULDBLOCK);
798 		return (0);
799 	}
800 	error = tsleep(TSA_PTC_WRITE(tp), PCATCH, "ptcout", 0);
801 	if (error) {
802 		/* adjust for data copied in but not written */
803 		ap->a_uio->uio_resid += cc;
804 		return (error);
805 	}
806 	goto again;
807 }
808 
809 /*ARGSUSED*/
810 static	int
811 ptyioctl(struct dev_ioctl_args *ap)
812 {
813 	cdev_t dev = ap->a_head.a_dev;
814 	struct tty *tp = dev->si_tty;
815 	struct pt_ioctl *pti = dev->si_drv1;
816 	u_char *cc = tp->t_cc;
817 	int stop, error;
818 
819 	if (dev_dflags(dev) & D_MASTER) {
820 		switch (ap->a_cmd) {
821 
822 		case TIOCGPGRP:
823 			/*
824 			 * We avoid calling ttioctl on the controller since,
825 			 * in that case, tp must be the controlling terminal.
826 			 */
827 			*(int *)ap->a_data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
828 			return (0);
829 
830 		case TIOCPKT:
831 			if (*(int *)ap->a_data) {
832 				if (pti->pt_flags & PF_UCNTL)
833 					return (EINVAL);
834 				pti->pt_flags |= PF_PKT;
835 			} else
836 				pti->pt_flags &= ~PF_PKT;
837 			return (0);
838 
839 		case TIOCUCNTL:
840 			if (*(int *)ap->a_data) {
841 				if (pti->pt_flags & PF_PKT)
842 					return (EINVAL);
843 				pti->pt_flags |= PF_UCNTL;
844 			} else
845 				pti->pt_flags &= ~PF_UCNTL;
846 			return (0);
847 
848 		case TIOCREMOTE:
849 			if (*(int *)ap->a_data)
850 				pti->pt_flags |= PF_REMOTE;
851 			else
852 				pti->pt_flags &= ~PF_REMOTE;
853 			ttyflush(tp, FREAD|FWRITE);
854 			return (0);
855 
856 		case TIOCISPTMASTER:
857 			if ((pti->pt_flags2 & PF_UNIX98) && (pti->devc == dev))
858 				return (0);
859 			else
860 				return (EINVAL);
861 		}
862 
863 		/*
864 		 * The rest of the ioctls shouldn't be called until
865 		 * the slave is open.
866 		 */
867 		if ((tp->t_state & TS_ISOPEN) == 0)
868 			return (EAGAIN);
869 
870 		switch (ap->a_cmd) {
871 #ifdef COMPAT_43
872 		case TIOCSETP:
873 		case TIOCSETN:
874 #endif
875 		case TIOCSETD:
876 		case TIOCSETA:
877 		case TIOCSETAW:
878 		case TIOCSETAF:
879 			/*
880 			 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
881 			 * ttywflush(tp) will hang if there are characters in
882 			 * the outq.
883 			 */
884 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
885 			break;
886 
887 		case TIOCSIG:
888 			if (*(unsigned int *)ap->a_data >= NSIG ||
889 			    *(unsigned int *)ap->a_data == 0)
890 				return(EINVAL);
891 			if ((tp->t_lflag&NOFLSH) == 0)
892 				ttyflush(tp, FREAD|FWRITE);
893 			pgsignal(tp->t_pgrp, *(unsigned int *)ap->a_data, 1);
894 			if ((*(unsigned int *)ap->a_data == SIGINFO) &&
895 			    ((tp->t_lflag&NOKERNINFO) == 0))
896 				ttyinfo(tp);
897 			return(0);
898 		}
899 	}
900 	if (ap->a_cmd == TIOCEXT) {
901 		/*
902 		 * When the EXTPROC bit is being toggled, we need
903 		 * to send an TIOCPKT_IOCTL if the packet driver
904 		 * is turned on.
905 		 */
906 		if (*(int *)ap->a_data) {
907 			if (pti->pt_flags & PF_PKT) {
908 				pti->pt_send |= TIOCPKT_IOCTL;
909 				ptcwakeup(tp, FREAD);
910 			}
911 			tp->t_lflag |= EXTPROC;
912 		} else {
913 			if ((tp->t_lflag & EXTPROC) &&
914 			    (pti->pt_flags & PF_PKT)) {
915 				pti->pt_send |= TIOCPKT_IOCTL;
916 				ptcwakeup(tp, FREAD);
917 			}
918 			tp->t_lflag &= ~EXTPROC;
919 		}
920 		return(0);
921 	}
922 	error = (*linesw[tp->t_line].l_ioctl)(tp, ap->a_cmd, ap->a_data,
923 					      ap->a_fflag, ap->a_cred);
924 	if (error == ENOIOCTL)
925 		 error = ttioctl(tp, ap->a_cmd, ap->a_data, ap->a_fflag);
926 	if (error == ENOIOCTL) {
927 		if (pti->pt_flags & PF_UCNTL &&
928 		    (ap->a_cmd & ~0xff) == UIOCCMD(0)) {
929 			if (ap->a_cmd & 0xff) {
930 				pti->pt_ucntl = (u_char)ap->a_cmd;
931 				ptcwakeup(tp, FREAD);
932 			}
933 			return (0);
934 		}
935 		error = ENOTTY;
936 	}
937 	/*
938 	 * If external processing and packet mode send ioctl packet.
939 	 */
940 	if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
941 		switch(ap->a_cmd) {
942 		case TIOCSETA:
943 		case TIOCSETAW:
944 		case TIOCSETAF:
945 #ifdef COMPAT_43
946 		case TIOCSETP:
947 		case TIOCSETN:
948 #endif
949 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
950 		case TIOCSETC:
951 		case TIOCSLTC:
952 		case TIOCLBIS:
953 		case TIOCLBIC:
954 		case TIOCLSET:
955 #endif
956 			pti->pt_send |= TIOCPKT_IOCTL;
957 			ptcwakeup(tp, FREAD);
958 		default:
959 			break;
960 		}
961 	}
962 	stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
963 		&& CCEQ(cc[VSTART], CTRL('q'));
964 	if (pti->pt_flags & PF_NOSTOP) {
965 		if (stop) {
966 			pti->pt_send &= ~TIOCPKT_NOSTOP;
967 			pti->pt_send |= TIOCPKT_DOSTOP;
968 			pti->pt_flags &= ~PF_NOSTOP;
969 			ptcwakeup(tp, FREAD);
970 		}
971 	} else {
972 		if (!stop) {
973 			pti->pt_send &= ~TIOCPKT_DOSTOP;
974 			pti->pt_send |= TIOCPKT_NOSTOP;
975 			pti->pt_flags |= PF_NOSTOP;
976 			ptcwakeup(tp, FREAD);
977 		}
978 	}
979 	return (error);
980 }
981 
982 
983 static void ptc_drvinit (void *unused);
984 
985 #ifdef UNIX98_PTYS
986 SYSCTL_INT(_kern, OID_AUTO, pty_debug, CTLFLAG_RW, &pty_debug_level,
987 		0, "Change pty debug level");
988 #endif
989 
990 static void
991 ptc_drvinit(void *unused)
992 {
993 	int i;
994 
995 #ifdef UNIX98_PTYS
996 	/*
997 	 * Unix98 pty stuff.
998 	 * Create the clonable base device.
999 	 */
1000 	make_autoclone_dev(&ptc_ops, &DEVFS_CLONE_BITMAP(pty), ptyclone,
1001 	    0, 0, 0666, "ptmx");
1002 #endif
1003 
1004 	for (i = 0; i < 256; i++) {
1005 		ptyinit(i);
1006 	}
1007 }
1008 
1009 SYSINIT(ptcdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR_C,ptc_drvinit,NULL)
1010