xref: /netbsd-src/sys/kern/tty_pty.c (revision 413d532bcc3f62d122e56d92e13ac64825a40baf)
1 /*	$NetBSD: tty_pty.c,v 1.138 2014/04/04 18:11:58 christos Exp $	*/
2 
3 /*
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
32  */
33 
34 /*
35  * Pseudo-teletype Driver
36  * (Actually two drivers, requiring two entries in 'cdevsw')
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: tty_pty.c,v 1.138 2014/04/04 18:11:58 christos Exp $");
41 
42 #include "opt_ptm.h"
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/ioctl.h>
47 #include <sys/ioctl_compat.h>
48 #include <sys/proc.h>
49 #include <sys/tty.h>
50 #include <sys/stat.h>
51 #include <sys/file.h>
52 #include <sys/kernel.h>
53 #include <sys/vnode.h>
54 #include <sys/namei.h>
55 #include <sys/signalvar.h>
56 #include <sys/uio.h>
57 #include <sys/filedesc.h>
58 #include <sys/conf.h>
59 #include <sys/poll.h>
60 #include <sys/pty.h>
61 #include <sys/kauth.h>
62 
63 #define	DEFAULT_NPTYS		16	/* default number of initial ptys */
64 #define DEFAULT_MAXPTYS		992	/* default maximum number of ptys */
65 
66 #define BUFSIZ 100		/* Chunk size iomoved to/from user */
67 
68 struct	pt_softc {
69 	struct	tty *pt_tty;
70 	int	pt_flags;
71 	struct	selinfo pt_selr, pt_selw;
72 	u_char	pt_send;
73 	u_char	pt_ucntl;
74 };
75 
76 static struct pt_softc **pt_softc = NULL;	/* pty array */
77 static int maxptys = DEFAULT_MAXPTYS;	/* maximum number of ptys (sysctable) */
78 kmutex_t pt_softc_mutex;
79 int npty = 0;			/* for pstat -t */
80 
81 #define	PF_PKT		0x08		/* packet mode */
82 #define	PF_STOPPED	0x10		/* user told stopped */
83 #define	PF_REMOTE	0x20		/* remote and flow controlled input */
84 #define	PF_NOSTOP	0x40
85 #define PF_UCNTL	0x80		/* user control mode */
86 
87 void	ptyattach(int);
88 void	ptcwakeup(struct tty *, int);
89 void	ptsstart(struct tty *);
90 int	pty_maxptys(int, int);
91 
92 static struct pt_softc **ptyarralloc(int);
93 
94 dev_type_open(ptcopen);
95 dev_type_close(ptcclose);
96 dev_type_read(ptcread);
97 dev_type_write(ptcwrite);
98 dev_type_poll(ptcpoll);
99 dev_type_kqfilter(ptckqfilter);
100 
101 dev_type_open(ptsopen);
102 dev_type_close(ptsclose);
103 dev_type_read(ptsread);
104 dev_type_write(ptswrite);
105 dev_type_stop(ptsstop);
106 dev_type_poll(ptspoll);
107 
108 dev_type_ioctl(ptyioctl);
109 dev_type_tty(ptytty);
110 
111 const struct cdevsw ptc_cdevsw = {
112 	.d_open = ptcopen,
113 	.d_close = ptcclose,
114 	.d_read = ptcread,
115 	.d_write = ptcwrite,
116 	.d_ioctl = ptyioctl,
117 	.d_stop = nullstop,
118 	.d_tty = ptytty,
119 	.d_poll = ptcpoll,
120 	.d_mmap = nommap,
121 	.d_kqfilter = ptckqfilter,
122 	.d_flag = D_TTY
123 };
124 
125 const struct cdevsw pts_cdevsw = {
126 	.d_open = ptsopen,
127 	.d_close = ptsclose,
128 	.d_read = ptsread,
129 	.d_write = ptswrite,
130 	.d_ioctl = ptyioctl,
131 	.d_stop = ptsstop,
132 	.d_tty = ptytty,
133 	.d_poll = ptspoll,
134 	.d_mmap = nommap,
135 	.d_kqfilter = ttykqfilter,
136 	.d_flag = D_TTY
137 };
138 
139 #if defined(pmax)
140 /*
141  * Used by arch/pmax/conf/majors.pmax, which needs a second copy as it
142  * needs to map this stuff to two pairs of majors.
143  */
144 
145 const struct cdevsw ptc_ultrix_cdevsw = {
146 	.d_open = ptcopen,
147 	.d_close = ptcclose,
148 	.d_read = ptcread,
149 	.d_write = ptcwrite,
150 	.d_ioctl = ptyioctl,
151 	.d_stop = nullstop,
152 	.d_tty = ptytty,
153 	.d_poll = ptcpoll,
154 	.d_mmap = nommap,
155 	.d_kqfilter = ptckqfilter,
156 	.d_flag = D_TTY
157 };
158 
159 const struct cdevsw pts_ultrix_cdevsw = {
160 	.d_open = ptsopen,
161 	.d_close = ptsclose,
162 	.d_read = ptsread,
163 	.d_write = ptswrite,
164 	.d_ioctl = ptyioctl,
165 	.d_stop = ptsstop,
166 	.d_tty = ptytty,
167 	.d_poll = ptspoll,
168 	.d_mmap = nommap,
169 	.d_kqfilter = ttykqfilter,
170 	.d_flag = D_TTY
171 };
172 #endif /* defined(pmax) */
173 
174 /*
175  * Check if a pty is free to use.
176  */
177 int
178 pty_isfree(int minor, int lock)
179 {
180 	struct pt_softc *pt = pt_softc[minor];
181 	if (lock)
182 		mutex_enter(&pt_softc_mutex);
183 	minor = pt == NULL || pt->pt_tty == NULL ||
184 	    pt->pt_tty->t_oproc == NULL;
185 	if (lock)
186 		mutex_exit(&pt_softc_mutex);
187 	return minor;
188 }
189 
190 /*
191  * Allocate and zero array of nelem elements.
192  */
193 static struct pt_softc **
194 ptyarralloc(int nelem)
195 {
196 	struct pt_softc **pt;
197 	nelem += 10;
198 	pt = kmem_zalloc(nelem * sizeof(*pt), KM_SLEEP);
199 	return pt;
200 }
201 
202 static void
203 ptyarrfree(struct pt_softc **pt, int nelem)
204 {
205 
206 	nelem += 10;
207 	kmem_free(pt, nelem * sizeof(*pt));
208 }
209 
210 /*
211  * Check if the minor is correct and ensure necessary structures
212  * are properly allocated.
213  */
214 int
215 pty_check(int ptn)
216 {
217 	struct pt_softc *pti;
218 
219 	if (ptn >= npty) {
220 		struct pt_softc **newpt, **oldpt;
221 		int newnpty;
222 		int oldnpty;
223 
224 		/* check if the requested pty can be granted */
225 		if (ptn >= maxptys) {
226 	    limit_reached:
227 			tablefull("pty", "increase kern.maxptys");
228 			return ENXIO;
229 		}
230 
231 		/* Allocate a larger pty array */
232 		for (newnpty = npty; newnpty <= ptn;)
233 			newnpty *= 2;
234 		if (newnpty > maxptys)
235 			newnpty = maxptys;
236 		newpt = ptyarralloc(newnpty);
237 
238 		/*
239 		 * Now grab the pty array mutex - we need to ensure
240 		 * that the pty array is consistent while copying it's
241 		 * content to newly allocated, larger space; we also
242 		 * need to be safe against pty_maxptys().
243 		 */
244 		mutex_enter(&pt_softc_mutex);
245 
246 		if (newnpty >= maxptys) {
247 			/* limit cut away beneath us... */
248 			if (ptn >= maxptys) {
249 				mutex_exit(&pt_softc_mutex);
250 				ptyarrfree(newpt, newnpty);
251 				goto limit_reached;
252 			}
253 			newnpty = maxptys;
254 		}
255 
256 		/*
257 		 * If the pty array was not enlarged while we were waiting
258 		 * for mutex, copy current contents of pt_softc[] to newly
259 		 * allocated array and start using the new bigger array.
260 		 */
261 		if (newnpty > npty) {
262 			memcpy(newpt, pt_softc, npty*sizeof(struct pt_softc *));
263 			oldpt = pt_softc;
264 			oldnpty = npty;
265 			pt_softc = newpt;
266 			npty = newnpty;
267 		} else {
268 			/* was enlarged when waited for lock, free new space */
269 			oldpt = newpt;
270 			oldnpty = newnpty;
271 		}
272 
273 		mutex_exit(&pt_softc_mutex);
274 		ptyarrfree(oldpt, oldnpty);
275 	}
276 
277 	/*
278 	 * If the entry is not yet allocated, allocate one. The mutex is
279 	 * needed so that the state of pt_softc[] array is consistant
280 	 * in case it has been lengthened above.
281 	 */
282 	if (!pt_softc[ptn]) {
283 		pti = kmem_zalloc(sizeof(*pti), KM_SLEEP);
284 
285 		selinit(&pti->pt_selr);
286 		selinit(&pti->pt_selw);
287 		pti->pt_tty = tty_alloc();
288 
289 		mutex_enter(&pt_softc_mutex);
290 
291 		/*
292 		 * Check the entry again - it might have been
293 		 * added while we were waiting for mutex.
294 		 */
295 		if (pt_softc[ptn]) {
296 			mutex_exit(&pt_softc_mutex);
297 			tty_free(pti->pt_tty);
298 			seldestroy(&pti->pt_selr);
299 			seldestroy(&pti->pt_selw);
300 			kmem_free(pti, sizeof(*pti));
301 			return 0;
302 		}
303 		tty_attach(pti->pt_tty);
304 		pt_softc[ptn] = pti;
305 
306 		mutex_exit(&pt_softc_mutex);
307 	}
308 
309 	return 0;
310 }
311 
312 /*
313  * Set maxpty in thread-safe way. Returns 0 in case of error, otherwise
314  * new value of maxptys.
315  */
316 int
317 pty_maxptys(int newmax, int set)
318 {
319 	if (!set)
320 		return maxptys;
321 
322 	/*
323 	 * We have to grab the pt_softc lock, so that we would pick correct
324 	 * value of npty (might be modified in pty_check()).
325 	 */
326 	mutex_enter(&pt_softc_mutex);
327 
328 	/*
329 	 * The value cannot be set to value lower than the highest pty
330 	 * number ever allocated.
331 	 */
332 	if (newmax >= npty)
333 		maxptys = newmax;
334 	else
335 		newmax = 0;
336 
337 	mutex_exit(&pt_softc_mutex);
338 
339 	return newmax;
340 }
341 
342 /*
343  * Establish n (or default if n is 1) ptys in the system.
344  */
345 void
346 ptyattach(int n)
347 {
348 
349 	mutex_init(&pt_softc_mutex, MUTEX_DEFAULT, IPL_NONE);
350 
351 	/* maybe should allow 0 => none? */
352 	if (n <= 1)
353 		n = DEFAULT_NPTYS;
354 	pt_softc = ptyarralloc(n);
355 	npty = n;
356 #ifndef NO_DEV_PTM
357 	ptmattach(1);
358 #endif
359 }
360 
361 /*ARGSUSED*/
362 int
363 ptsopen(dev_t dev, int flag, int devtype, struct lwp *l)
364 {
365 	struct pt_softc *pti;
366 	struct tty *tp;
367 	int error;
368 	int ptn = minor(dev);
369 
370 	if ((error = pty_check(ptn)) != 0)
371 		return error;
372 
373 	mutex_spin_enter(&tty_lock);
374 	pti = pt_softc[ptn];
375 	tp = pti->pt_tty;
376 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
377 		tp->t_dev = dev;
378 		ttychars(tp);		/* Set up default chars */
379 		tp->t_iflag = TTYDEF_IFLAG;
380 		tp->t_oflag = TTYDEF_OFLAG;
381 		tp->t_lflag = TTYDEF_LFLAG;
382 		tp->t_cflag = TTYDEF_CFLAG;
383 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
384 		ttsetwater(tp);		/* would be done in xxparam() */
385 	} else if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_OPEN,
386 	    tp) != 0) {
387 		mutex_spin_exit(&tty_lock);
388 		return EBUSY;
389 	}
390 	if (tp->t_oproc)			/* Ctrlr still around. */
391 		SET(tp->t_state, TS_CARR_ON);
392 	if (!ISSET(flag, O_NONBLOCK)) {
393 		while (!ISSET(tp->t_state, TS_CARR_ON)) {
394 			tp->t_wopen++;
395 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
396 			tp->t_wopen--;
397 			if (error != 0) {
398 				mutex_spin_exit(&tty_lock);
399 				return error;
400 			}
401 		}
402 	}
403 	mutex_spin_exit(&tty_lock);
404 	error = (*tp->t_linesw->l_open)(dev, tp);
405 	ptcwakeup(tp, FREAD|FWRITE);
406 	return error;
407 }
408 
409 int
410 ptsclose(dev_t dev, int flag, int mode, struct lwp *l)
411 {
412 	struct pt_softc *pti = pt_softc[minor(dev)];
413 	struct tty *tp = pti->pt_tty;
414 	int error;
415 
416 	error = (*tp->t_linesw->l_close)(tp, flag);
417 	error |= ttyclose(tp);
418 	ptcwakeup(tp, FREAD|FWRITE);
419 	return error;
420 }
421 
422 int
423 ptsread(dev_t dev, struct uio *uio, int flag)
424 {
425 	struct proc *p = curproc;
426 	struct pt_softc *pti = pt_softc[minor(dev)];
427 	struct tty *tp = pti->pt_tty;
428 	int error = 0;
429 	int cc, c;
430 
431 again:
432 	if (pti->pt_flags & PF_REMOTE) {
433 		mutex_spin_enter(&tty_lock);
434 		while (isbackground(p, tp)) {	/* XXXSMP */
435 			if (sigismasked(curlwp, SIGTTIN) ||
436 			    p->p_pgrp->pg_jobc == 0 ||
437 			    p->p_lflag & PL_PPWAIT) {
438 				mutex_spin_exit(&tty_lock);
439 				return EIO;
440 			}
441 			ttysig(tp, TTYSIG_PG1, SIGTTIN);
442 			error = ttypause(tp, hz);
443 			if (error != 0) {
444 				mutex_spin_exit(&tty_lock);
445 				return error;
446 			}
447 		}
448 		if (tp->t_canq.c_cc == 0) {
449 			if (flag & IO_NDELAY) {
450 				mutex_spin_exit(&tty_lock);
451 				return EWOULDBLOCK;
452 			}
453 			error = ttysleep(tp, &tp->t_cancv, true, 0);
454 			mutex_spin_exit(&tty_lock);
455 			if (error != 0)
456 				return error;
457 			goto again;
458 		}
459 		while(error == 0 && tp->t_canq.c_cc > 1 && uio->uio_resid > 0) {
460 			c = getc(&tp->t_canq);
461 			mutex_spin_exit(&tty_lock);
462 			error = ureadc(c, uio);
463 			mutex_spin_enter(&tty_lock);
464 			/* Re-check terminal state here? */
465 		}
466 		if (tp->t_canq.c_cc == 1)
467 			(void) getc(&tp->t_canq);
468 		cc = tp->t_canq.c_cc;
469 		mutex_spin_exit(&tty_lock);
470 		if (cc)
471 			return error;
472 	} else if (tp->t_oproc)
473 		error = (*tp->t_linesw->l_read)(tp, uio, flag);
474 	ptcwakeup(tp, FWRITE);
475 	return error;
476 }
477 
478 /*
479  * Write to pseudo-tty.
480  * Wakeups of controlling tty will happen
481  * indirectly, when tty driver calls ptsstart.
482  */
483 int
484 ptswrite(dev_t dev, struct uio *uio, int flag)
485 {
486 	struct pt_softc *pti = pt_softc[minor(dev)];
487 	struct tty *tp = pti->pt_tty;
488 
489 	if (tp->t_oproc == NULL)
490 		return EIO;
491 	return (*tp->t_linesw->l_write)(tp, uio, flag);
492 }
493 
494 /*
495  * Poll pseudo-tty.
496  */
497 int
498 ptspoll(dev_t dev, int events, struct lwp *l)
499 {
500 	struct pt_softc *pti = pt_softc[minor(dev)];
501 	struct tty *tp = pti->pt_tty;
502 
503 	if (tp->t_oproc == NULL)
504 		return POLLHUP;
505 
506 	return (*tp->t_linesw->l_poll)(tp, events, l);
507 }
508 
509 /*
510  * Start output on pseudo-tty.
511  * Wake up process polling or sleeping for input from controlling tty.
512  */
513 void
514 ptsstart(struct tty *tp)
515 {
516 	struct pt_softc *pti;
517 
518 	KASSERT(tp->t_dev != NODEV);
519 	pti = pt_softc[minor(tp->t_dev)];
520 
521 	KASSERT(mutex_owned(&tty_lock));
522 
523 	if (ISSET(tp->t_state, TS_TTSTOP))
524 		return;
525 	if (pti->pt_flags & PF_STOPPED) {
526 		pti->pt_flags &= ~PF_STOPPED;
527 		pti->pt_send = TIOCPKT_START;
528 	}
529 
530 	selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
531 	cv_broadcast(&tp->t_outcvf);
532 }
533 
534 /*
535  * Stop output.
536  */
537 void
538 ptsstop(struct tty *tp, int flush)
539 {
540 	struct pt_softc *pti;
541 
542 	KASSERT(tp->t_dev != NODEV);
543 	pti = pt_softc[minor(tp->t_dev)];
544 
545 	KASSERT(mutex_owned(&tty_lock));
546 
547 	/* note: FLUSHREAD and FLUSHWRITE already ok */
548 	CTASSERT(TIOCPKT_FLUSHREAD == FREAD);
549 	CTASSERT(TIOCPKT_FLUSHWRITE == FWRITE);
550 	if (flush == 0) {
551 		flush = TIOCPKT_STOP;
552 		pti->pt_flags |= PF_STOPPED;
553 	} else
554 		pti->pt_flags &= ~PF_STOPPED;
555 	pti->pt_send |= flush;
556 
557 	/* change of perspective */
558 	if (flush & FREAD) {
559 		selnotify(&pti->pt_selw, 0, NOTE_SUBMIT);
560 		cv_broadcast(&tp->t_rawcvf);
561 	}
562 	if (flush & FWRITE) {
563 		selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
564 		cv_broadcast(&tp->t_outcvf);
565 	}
566 }
567 
568 void
569 ptcwakeup(struct tty *tp, int flag)
570 {
571 	struct pt_softc *pti;
572 
573 	if (tp->t_dev == NODEV)
574 		return;	/* client side not open yet */
575 
576 	pti = pt_softc[minor(tp->t_dev)];
577 	KASSERT(pti != NULL);
578 
579 	mutex_spin_enter(&tty_lock);
580 	if (flag & FREAD) {
581 		selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
582 		cv_broadcast(&tp->t_outcvf);
583 	}
584 	if (flag & FWRITE) {
585 		selnotify(&pti->pt_selw, 0, NOTE_SUBMIT);
586 		cv_broadcast(&tp->t_rawcvf);
587 	}
588 	mutex_spin_exit(&tty_lock);
589 }
590 
591 /*ARGSUSED*/
592 int
593 ptcopen(dev_t dev, int flag, int devtype, struct lwp *l)
594 {
595 	struct pt_softc *pti;
596 	struct tty *tp;
597 	int error;
598 	int ptn = minor(dev);
599 
600 	if ((error = pty_check(ptn)) != 0)
601 		return error;
602 
603 	pti = pt_softc[ptn];
604 	tp = pti->pt_tty;
605 
606 	mutex_spin_enter(&tty_lock);
607 	if (tp->t_oproc) {
608 		mutex_spin_exit(&tty_lock);
609 		return EIO;
610 	}
611 	tp->t_dev = dev;
612 	tp->t_oproc = ptsstart;
613 	mutex_spin_exit(&tty_lock);
614 	(void)(*tp->t_linesw->l_modem)(tp, 1);
615 	CLR(tp->t_lflag, EXTPROC);
616 	pti->pt_flags = 0;
617 	pti->pt_send = 0;
618 	pti->pt_ucntl = 0;
619 	return 0;
620 }
621 
622 /*ARGSUSED*/
623 int
624 ptcclose(dev_t dev, int flag, int devtype, struct lwp *l)
625 {
626 	struct pt_softc *pti = pt_softc[minor(dev)];
627 	struct tty *tp = pti->pt_tty;
628 
629 	(void)(*tp->t_linesw->l_modem)(tp, 0);
630 	mutex_spin_enter(&tty_lock);
631 	CLR(tp->t_state, TS_CARR_ON);
632 	tp->t_oproc = NULL;		/* mark closed */
633 	mutex_spin_exit(&tty_lock);
634 	return 0;
635 }
636 
637 int
638 ptcread(dev_t dev, struct uio *uio, int flag)
639 {
640 	struct pt_softc *pti = pt_softc[minor(dev)];
641 	struct tty *tp = pti->pt_tty;
642 	u_char bf[BUFSIZ];
643 	int error = 0, cc;
644 	int c;
645 
646 	if (uio->uio_resid <= 0)
647 		return EINVAL;
648 
649 	/*
650 	 * We want to block until the slave
651 	 * is open, and there's something to read;
652 	 * but if we lost the slave or we're NBIO,
653 	 * then return the appropriate error instead.
654 	 */
655 	mutex_spin_enter(&tty_lock);
656 	for (;;) {
657 		if (ISSET(tp->t_state, TS_ISOPEN)) {
658 			if (pti->pt_flags & PF_PKT && (c = pti->pt_send)) {
659 				pti->pt_send = 0;
660 				mutex_spin_exit(&tty_lock);
661 				error = ureadc(c, uio);
662 				if (error != 0)
663 					return error;
664 				/*
665 				 * Since we don't have the tty locked, there's
666 				 * a risk of messing up `t_termios'. This is
667 				 * relevant only if the tty got closed and then
668 				 * opened again while we were out uiomoving.
669 				 */
670 				if (c & TIOCPKT_IOCTL) {
671 					cc = min(uio->uio_resid,
672 						sizeof(tp->t_termios));
673 					uiomove((void *) &tp->t_termios,
674 						cc, uio);
675 				}
676 				return 0;
677 			}
678 			if (pti->pt_flags & PF_UCNTL && (c = pti->pt_ucntl)) {
679 				pti->pt_ucntl = 0;
680 				mutex_spin_exit(&tty_lock);
681 				error = ureadc(c, uio);
682 				if (error != 0)
683 					return error;
684 				return 0;
685 			}
686 			if (tp->t_outq.c_cc && !ISSET(tp->t_state, TS_TTSTOP))
687 				break;
688 		}
689 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
690 			error = 0;	/* EOF */
691 			goto out;
692 		}
693 		if (flag & IO_NDELAY) {
694 			error = EWOULDBLOCK;
695 			goto out;
696 		}
697 		error = cv_wait_sig(&tp->t_outcvf, &tty_lock);
698 		if (error != 0)
699 			goto out;
700 	}
701 
702 	if (pti->pt_flags & (PF_PKT|PF_UCNTL)) {
703 		mutex_spin_exit(&tty_lock);
704 		error = ureadc(0, uio);
705 		mutex_spin_enter(&tty_lock);
706 		if (error == 0 && !ISSET(tp->t_state, TS_ISOPEN))
707 			error = EIO;
708 	}
709 	while (uio->uio_resid > 0 && error == 0) {
710 		cc = q_to_b(&tp->t_outq, bf, min(uio->uio_resid, BUFSIZ));
711 		if (cc <= 0)
712 			break;
713 		mutex_spin_exit(&tty_lock);
714 		error = uiomove(bf, cc, uio);
715 		mutex_spin_enter(&tty_lock);
716 		if (error == 0 && !ISSET(tp->t_state, TS_ISOPEN))
717 			error = EIO;
718 	}
719 	ttypull(tp);
720 out:
721 	mutex_spin_exit(&tty_lock);
722 	return error;
723 }
724 
725 
726 int
727 ptcwrite(dev_t dev, struct uio *uio, int flag)
728 {
729 	struct pt_softc *pti = pt_softc[minor(dev)];
730 	struct tty *tp = pti->pt_tty;
731 	u_char *cp = NULL;
732 	int cc = 0;
733 	u_char locbuf[BUFSIZ];
734 	int cnt = 0;
735 	int error = 0;
736 
737 again:
738 	mutex_spin_enter(&tty_lock);
739 	if (!ISSET(tp->t_state, TS_ISOPEN))
740 		goto block;
741 	if (pti->pt_flags & PF_REMOTE) {
742 		if (tp->t_canq.c_cc)
743 			goto block;
744 		while (uio->uio_resid > 0 && tp->t_canq.c_cc < TTYHOG) {
745 			if (cc == 0) {
746 				cc = min(uio->uio_resid, BUFSIZ);
747 				cc = min(cc, TTYHOG - tp->t_canq.c_cc);
748 				cp = locbuf;
749 				mutex_spin_exit(&tty_lock);
750 				error = uiomove(cp, cc, uio);
751 				if (error != 0)
752 					return error;
753 				mutex_spin_enter(&tty_lock);
754 				/* check again for safety */
755 				if (!ISSET(tp->t_state, TS_ISOPEN)) {
756 					/*
757 					 * adjust for data copied in but not
758 					 * written
759 					 */
760 					uio->uio_resid += cc;
761 					error = EIO;
762 					goto out;
763 				}
764 			}
765 			if (cc) {
766 				cc = b_to_q(cp, cc, &tp->t_outq);
767 				if (cc > 0)
768 					goto block;
769 			}
770 		}
771 		(void) putc(0, &tp->t_canq);
772 		ttwakeup(tp);
773 		cv_broadcast(&tp->t_cancv);
774 		error = 0;
775 		goto out;
776 	}
777 	while (uio->uio_resid > 0) {
778 		if (cc == 0) {
779 			cc = min(uio->uio_resid, BUFSIZ);
780 			cp = locbuf;
781 			mutex_spin_exit(&tty_lock);
782 			error = uiomove(cp, cc, uio);
783 			if (error != 0)
784 				return error;
785 			mutex_spin_enter(&tty_lock);
786 			/* check again for safety */
787 			if (!ISSET(tp->t_state, TS_ISOPEN)) {
788 				/* adjust for data copied in but not written */
789 				uio->uio_resid += cc;
790 				error = EIO;
791 				goto out;
792 			}
793 		}
794 		while (cc > 0) {
795 			int used = tp->t_rawq.c_cc + tp->t_canq.c_cc;
796 			int canon = ISSET(tp->t_lflag, ICANON) ? 1 : 0;
797 			/*
798 			 * We need space for 2 characters if canonical
799 			 * because we might need to print ^C
800 			 */
801 			if (used >= (TTYHOG - canon) &&
802 			   (tp->t_canq.c_cc > 0 || !canon)) {
803 				cv_broadcast(&tp->t_rawcv);
804 				goto block;
805 			}
806 			/*
807 			 * XXX - should change l_rint to be called with lock
808 			 *	 see also tty.c:ttyinput_wlock()
809 			 */
810 			mutex_spin_exit(&tty_lock);
811 			(*tp->t_linesw->l_rint)(*cp++, tp);
812 			mutex_spin_enter(&tty_lock);
813 			cnt++;
814 			cc--;
815 		}
816 	}
817 	error = 0;
818 	goto out;
819 
820 block:
821 	/*
822 	 * Come here to wait for slave to open, for space
823 	 * in outq, or space in rawq.
824 	 */
825 	if (!ISSET(tp->t_state, TS_CARR_ON)) {
826 		/* adjust for data copied in but not written */
827 		uio->uio_resid += cc;
828 		error = EIO;
829 		goto out;
830 	}
831 	if (flag & IO_NDELAY) {
832 		/* adjust for data copied in but not written */
833 		uio->uio_resid += cc;
834 		error = cnt == 0 ? EWOULDBLOCK : 0;
835 		goto out;
836 	}
837 	error = cv_wait_sig(&tp->t_rawcvf, &tty_lock);
838 	mutex_spin_exit(&tty_lock);
839 	if (error != 0) {
840 		/* adjust for data copied in but not written */
841 		uio->uio_resid += cc;
842 		return error;
843 	}
844 	goto again;
845 
846 out:
847 	mutex_spin_exit(&tty_lock);
848 	return error;
849 }
850 
851 int
852 ptcpoll(dev_t dev, int events, struct lwp *l)
853 {
854 	struct pt_softc *pti = pt_softc[minor(dev)];
855 	struct tty *tp = pti->pt_tty;
856 	int revents = 0;
857 
858 	mutex_spin_enter(&tty_lock);
859 
860 	if (events & (POLLIN | POLLRDNORM))
861 		if (ISSET(tp->t_state, TS_ISOPEN) &&
862 		    ((tp->t_outq.c_cc > 0 && !ISSET(tp->t_state, TS_TTSTOP)) ||
863 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
864 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)))
865 			revents |= events & (POLLIN | POLLRDNORM);
866 
867 	if (events & (POLLOUT | POLLWRNORM))
868 		if (ISSET(tp->t_state, TS_ISOPEN) &&
869 		    ((pti->pt_flags & PF_REMOTE) ?
870 		     (tp->t_canq.c_cc == 0) :
871 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG-2) ||
872 		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON)))))
873 			revents |= events & (POLLOUT | POLLWRNORM);
874 
875 	if (events & POLLHUP)
876 		if (!ISSET(tp->t_state, TS_CARR_ON))
877 			revents |= POLLHUP;
878 
879 	if (revents == 0) {
880 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
881 			selrecord(l, &pti->pt_selr);
882 
883 		if (events & (POLLOUT | POLLWRNORM))
884 			selrecord(l, &pti->pt_selw);
885 	}
886 
887 	mutex_spin_exit(&tty_lock);
888 
889 	return revents;
890 }
891 
892 static void
893 filt_ptcrdetach(struct knote *kn)
894 {
895 	struct pt_softc *pti;
896 
897 	pti = kn->kn_hook;
898 
899 	mutex_spin_enter(&tty_lock);
900 	SLIST_REMOVE(&pti->pt_selr.sel_klist, kn, knote, kn_selnext);
901 	mutex_spin_exit(&tty_lock);
902 }
903 
904 static int
905 filt_ptcread(struct knote *kn, long hint)
906 {
907 	struct pt_softc *pti;
908 	struct tty	*tp;
909 	int canread;
910 
911 	pti = kn->kn_hook;
912 	tp = pti->pt_tty;
913 
914 	if ((hint & NOTE_SUBMIT) == 0) {
915 		mutex_spin_enter(&tty_lock);
916 	}
917 
918 	canread = (ISSET(tp->t_state, TS_ISOPEN) &&
919 		    ((tp->t_outq.c_cc > 0 && !ISSET(tp->t_state, TS_TTSTOP)) ||
920 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
921 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)));
922 
923 	if (canread) {
924 		/*
925 		 * c_cc is number of characters after output post-processing;
926 		 * the amount of data actually read(2) depends on
927 		 * setting of input flags for the terminal.
928 		 */
929 		kn->kn_data = tp->t_outq.c_cc;
930 		if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
931 		    ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))
932 			kn->kn_data++;
933 	}
934 
935 	if ((hint & NOTE_SUBMIT) == 0) {
936 		mutex_spin_exit(&tty_lock);
937 	}
938 
939 	return canread;
940 }
941 
942 static void
943 filt_ptcwdetach(struct knote *kn)
944 {
945 	struct pt_softc *pti;
946 
947 	pti = kn->kn_hook;
948 
949 	mutex_spin_enter(&tty_lock);
950 	SLIST_REMOVE(&pti->pt_selw.sel_klist, kn, knote, kn_selnext);
951 	mutex_spin_exit(&tty_lock);
952 }
953 
954 static int
955 filt_ptcwrite(struct knote *kn, long hint)
956 {
957 	struct pt_softc *pti;
958 	struct tty	*tp;
959 	int canwrite;
960 	int nwrite;
961 
962 	pti = kn->kn_hook;
963 	tp = pti->pt_tty;
964 
965 	if ((hint & NOTE_SUBMIT) == 0) {
966 		mutex_spin_enter(&tty_lock);
967 	}
968 
969 	canwrite = (ISSET(tp->t_state, TS_ISOPEN) &&
970 		    ((pti->pt_flags & PF_REMOTE) ?
971 		     (tp->t_canq.c_cc == 0) :
972 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG-2) ||
973 		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON)))));
974 
975 	if (canwrite) {
976 		if (pti->pt_flags & PF_REMOTE)
977 			nwrite = tp->t_canq.c_cn;
978 		else {
979 			/* this is guaranteed to be > 0 due to above check */
980 			nwrite = tp->t_canq.c_cn
981 				- (tp->t_rawq.c_cc + tp->t_canq.c_cc);
982 		}
983 		kn->kn_data = nwrite;
984 	}
985 
986 	if ((hint & NOTE_SUBMIT) == 0) {
987 		mutex_spin_exit(&tty_lock);
988 	}
989 
990 	return canwrite;
991 }
992 
993 static const struct filterops ptcread_filtops =
994 	{ 1, NULL, filt_ptcrdetach, filt_ptcread };
995 static const struct filterops ptcwrite_filtops =
996 	{ 1, NULL, filt_ptcwdetach, filt_ptcwrite };
997 
998 int
999 ptckqfilter(dev_t dev, struct knote *kn)
1000 {
1001 	struct pt_softc *pti = pt_softc[minor(dev)];
1002 	struct klist	*klist;
1003 
1004 	switch (kn->kn_filter) {
1005 	case EVFILT_READ:
1006 		klist = &pti->pt_selr.sel_klist;
1007 		kn->kn_fop = &ptcread_filtops;
1008 		break;
1009 	case EVFILT_WRITE:
1010 		klist = &pti->pt_selw.sel_klist;
1011 		kn->kn_fop = &ptcwrite_filtops;
1012 		break;
1013 	default:
1014 		return EINVAL;
1015 	}
1016 
1017 	kn->kn_hook = pti;
1018 
1019 	mutex_spin_enter(&tty_lock);
1020 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1021 	mutex_spin_exit(&tty_lock);
1022 
1023 	return 0;
1024 }
1025 
1026 struct tty *
1027 ptytty(dev_t dev)
1028 {
1029 	struct pt_softc *pti = pt_softc[minor(dev)];
1030 	struct tty *tp = pti->pt_tty;
1031 
1032 	return tp;
1033 }
1034 
1035 /*ARGSUSED*/
1036 int
1037 ptyioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
1038 {
1039 	struct pt_softc *pti = pt_softc[minor(dev)];
1040 	struct tty *tp = pti->pt_tty;
1041 	const struct cdevsw *cdev;
1042 	u_char *cc = tp->t_cc;
1043 	int stop, error, sig;
1044 #ifndef NO_DEV_PTM
1045 	struct mount *mp;
1046 #endif
1047 
1048 	/*
1049 	 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1050 	 * ttywflush(tp) will hang if there are characters in the outq.
1051 	 */
1052 	if (cmd == TIOCEXT) {
1053 		/*
1054 		 * When the EXTPROC bit is being toggled, we need
1055 		 * to send an TIOCPKT_IOCTL if the packet driver
1056 		 * is turned on.
1057 		 */
1058 		if (*(int *)data) {
1059 			if (pti->pt_flags & PF_PKT) {
1060 				pti->pt_send |= TIOCPKT_IOCTL;
1061 				ptcwakeup(tp, FREAD);
1062 			}
1063 			SET(tp->t_lflag, EXTPROC);
1064 		} else {
1065 			if (ISSET(tp->t_lflag, EXTPROC) &&
1066 			    (pti->pt_flags & PF_PKT)) {
1067 				pti->pt_send |= TIOCPKT_IOCTL;
1068 				ptcwakeup(tp, FREAD);
1069 			}
1070 			CLR(tp->t_lflag, EXTPROC);
1071 		}
1072 		return(0);
1073 	}
1074 
1075 #ifndef NO_DEV_PTM
1076 	/* Allow getting the name from either the master or the slave */
1077 	if (cmd == TIOCPTSNAME) {
1078 		if ((error = pty_getmp(l, &mp)) != 0)
1079 			return error;
1080 		return pty_fill_ptmget(l, dev, -1, -1, data, mp);
1081 	}
1082 #endif
1083 
1084 	cdev = cdevsw_lookup(dev);
1085 	if (cdev != NULL && cdev->d_open == ptcopen)
1086 		switch (cmd) {
1087 #ifndef NO_DEV_PTM
1088 		case TIOCGRANTPT:
1089 			if ((error = pty_getmp(l, &mp)) != 0)
1090 				return error;
1091 			return pty_grant_slave(l, dev, mp);
1092 #endif
1093 
1094 		case TIOCGPGRP:
1095 			/*
1096 			 * We avoid calling ttioctl on the controller since,
1097 			 * in that case, tp must be the controlling terminal.
1098 			 */
1099 			*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1100 			return 0;
1101 
1102 		case TIOCPKT:
1103 			if (*(int *)data) {
1104 				if (pti->pt_flags & PF_UCNTL)
1105 					return EINVAL;
1106 				pti->pt_flags |= PF_PKT;
1107 			} else
1108 				pti->pt_flags &= ~PF_PKT;
1109 			return 0;
1110 
1111 		case TIOCUCNTL:
1112 			if (*(int *)data) {
1113 				if (pti->pt_flags & PF_PKT)
1114 					return EINVAL;
1115 				pti->pt_flags |= PF_UCNTL;
1116 			} else
1117 				pti->pt_flags &= ~PF_UCNTL;
1118 			return 0;
1119 
1120 		case TIOCREMOTE:
1121 			if (*(int *)data)
1122 				pti->pt_flags |= PF_REMOTE;
1123 			else
1124 				pti->pt_flags &= ~PF_REMOTE;
1125 			mutex_spin_enter(&tty_lock);
1126 			ttyflush(tp, FREAD|FWRITE);
1127 			mutex_spin_exit(&tty_lock);
1128 			return 0;
1129 
1130 		case TIOCSETP:
1131 		case TIOCSETN:
1132 		case TIOCSETD:
1133 		case TIOCSETA:
1134 		case TIOCSETAW:
1135 		case TIOCSETAF:
1136 			mutex_spin_enter(&tty_lock);
1137 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
1138 			mutex_spin_exit(&tty_lock);
1139 			break;
1140 
1141 		case TIOCSIG:
1142 			sig = (int)(long)*(void **)data;
1143 			if (sig <= 0 || sig >= NSIG)
1144 				return EINVAL;
1145 			mutex_spin_enter(&tty_lock);
1146 			if (!ISSET(tp->t_lflag, NOFLSH))
1147 				ttyflush(tp, FREAD|FWRITE);
1148 			tp->t_state |= TS_SIGINFO;
1149 			ttysig(tp, TTYSIG_PG1, sig);
1150 			mutex_spin_exit(&tty_lock);
1151 			return 0;
1152 
1153 		case FIONREAD:
1154 			mutex_spin_enter(&tty_lock);
1155 			*(int *)data = tp->t_outq.c_cc;
1156 			mutex_spin_exit(&tty_lock);
1157 			return 0;
1158 		}
1159 
1160 	error = (*tp->t_linesw->l_ioctl)(tp, cmd, data, flag, l);
1161 	if (error == EPASSTHROUGH)
1162 		 error = ttioctl(tp, cmd, data, flag, l);
1163 	if (error == EPASSTHROUGH) {
1164 		if (pti->pt_flags & PF_UCNTL &&
1165 		    (cmd & ~0xff) == UIOCCMD(0)) {
1166 			if (cmd & 0xff) {
1167 				pti->pt_ucntl = (u_char)cmd;
1168 				ptcwakeup(tp, FREAD);
1169 			}
1170 			return 0;
1171 		}
1172 	}
1173 	/*
1174 	 * If external processing and packet mode send ioctl packet.
1175 	 */
1176 	if (ISSET(tp->t_lflag, EXTPROC) && (pti->pt_flags & PF_PKT)) {
1177 		switch(cmd) {
1178 		case TIOCSETA:
1179 		case TIOCSETAW:
1180 		case TIOCSETAF:
1181 		case TIOCSETP:
1182 		case TIOCSETN:
1183 		case TIOCSETC:
1184 		case TIOCSLTC:
1185 		case TIOCLBIS:
1186 		case TIOCLBIC:
1187 		case TIOCLSET:
1188 			pti->pt_send |= TIOCPKT_IOCTL;
1189 			ptcwakeup(tp, FREAD);
1190 		default:
1191 			break;
1192 		}
1193 	}
1194 	stop = ISSET(tp->t_iflag, IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1195 		&& CCEQ(cc[VSTART], CTRL('q'));
1196 	if (pti->pt_flags & PF_NOSTOP) {
1197 		if (stop) {
1198 			pti->pt_send &= ~TIOCPKT_NOSTOP;
1199 			pti->pt_send |= TIOCPKT_DOSTOP;
1200 			pti->pt_flags &= ~PF_NOSTOP;
1201 			ptcwakeup(tp, FREAD);
1202 		}
1203 	} else {
1204 		if (!stop) {
1205 			pti->pt_send &= ~TIOCPKT_DOSTOP;
1206 			pti->pt_send |= TIOCPKT_NOSTOP;
1207 			pti->pt_flags |= PF_NOSTOP;
1208 			ptcwakeup(tp, FREAD);
1209 		}
1210 	}
1211 	return error;
1212 }
1213