xref: /netbsd-src/sys/kern/tty_pty.c (revision 6a493d6bc668897c91594964a732d38505b70cbb)
1 /*	$NetBSD: tty_pty.c,v 1.133 2013/09/15 14:56:26 martin Exp $	*/
2 
3 /*
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
32  */
33 
34 /*
35  * Pseudo-teletype Driver
36  * (Actually two drivers, requiring two entries in 'cdevsw')
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: tty_pty.c,v 1.133 2013/09/15 14:56:26 martin Exp $");
41 
42 #include "opt_ptm.h"
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/ioctl.h>
47 #include <sys/ioctl_compat.h>
48 #include <sys/proc.h>
49 #include <sys/tty.h>
50 #include <sys/stat.h>
51 #include <sys/file.h>
52 #include <sys/kernel.h>
53 #include <sys/vnode.h>
54 #include <sys/namei.h>
55 #include <sys/signalvar.h>
56 #include <sys/uio.h>
57 #include <sys/filedesc.h>
58 #include <sys/conf.h>
59 #include <sys/poll.h>
60 #include <sys/pty.h>
61 #include <sys/kauth.h>
62 
63 #define	DEFAULT_NPTYS		16	/* default number of initial ptys */
64 #define DEFAULT_MAXPTYS		992	/* default maximum number of ptys */
65 
66 #define BUFSIZ 100		/* Chunk size iomoved to/from user */
67 
68 struct	pt_softc {
69 	struct	tty *pt_tty;
70 	int	pt_flags;
71 	struct	selinfo pt_selr, pt_selw;
72 	u_char	pt_send;
73 	u_char	pt_ucntl;
74 };
75 
76 static struct pt_softc **pt_softc = NULL;	/* pty array */
77 static int maxptys = DEFAULT_MAXPTYS;	/* maximum number of ptys (sysctable) */
78 kmutex_t pt_softc_mutex;
79 int npty = 0;			/* for pstat -t */
80 
81 #define	PF_PKT		0x08		/* packet mode */
82 #define	PF_STOPPED	0x10		/* user told stopped */
83 #define	PF_REMOTE	0x20		/* remote and flow controlled input */
84 #define	PF_NOSTOP	0x40
85 #define PF_UCNTL	0x80		/* user control mode */
86 
87 void	ptyattach(int);
88 void	ptcwakeup(struct tty *, int);
89 void	ptsstart(struct tty *);
90 int	pty_maxptys(int, int);
91 
92 static struct pt_softc **ptyarralloc(int);
93 
94 dev_type_open(ptcopen);
95 dev_type_close(ptcclose);
96 dev_type_read(ptcread);
97 dev_type_write(ptcwrite);
98 dev_type_poll(ptcpoll);
99 dev_type_kqfilter(ptckqfilter);
100 
101 dev_type_open(ptsopen);
102 dev_type_close(ptsclose);
103 dev_type_read(ptsread);
104 dev_type_write(ptswrite);
105 dev_type_stop(ptsstop);
106 dev_type_poll(ptspoll);
107 
108 dev_type_ioctl(ptyioctl);
109 dev_type_tty(ptytty);
110 
111 const struct cdevsw ptc_cdevsw = {
112 	ptcopen, ptcclose, ptcread, ptcwrite, ptyioctl,
113 	nullstop, ptytty, ptcpoll, nommap, ptckqfilter, D_TTY
114 };
115 
116 const struct cdevsw pts_cdevsw = {
117 	ptsopen, ptsclose, ptsread, ptswrite, ptyioctl,
118 	ptsstop, ptytty, ptspoll, nommap, ttykqfilter, D_TTY
119 };
120 
121 #if defined(pmax)
122 /*
123  * Used by arch/pmax/conf/majors.pmax, which needs a second copy as it
124  * needs to map this stuff to two pairs of majors.
125  */
126 
127 const struct cdevsw ptc_ultrix_cdevsw = {
128 	ptcopen, ptcclose, ptcread, ptcwrite, ptyioctl,
129 	nullstop, ptytty, ptcpoll, nommap, ptckqfilter, D_TTY
130 };
131 
132 const struct cdevsw pts_ultrix_cdevsw = {
133 	ptsopen, ptsclose, ptsread, ptswrite, ptyioctl,
134 	ptsstop, ptytty, ptspoll, nommap, ttykqfilter, D_TTY
135 };
136 #endif /* defined(pmax) */
137 
138 /*
139  * Check if a pty is free to use.
140  */
141 int
142 pty_isfree(int minor, int lock)
143 {
144 	struct pt_softc *pt = pt_softc[minor];
145 	if (lock)
146 		mutex_enter(&pt_softc_mutex);
147 	minor = pt == NULL || pt->pt_tty == NULL ||
148 	    pt->pt_tty->t_oproc == NULL;
149 	if (lock)
150 		mutex_exit(&pt_softc_mutex);
151 	return minor;
152 }
153 
154 /*
155  * Allocate and zero array of nelem elements.
156  */
157 static struct pt_softc **
158 ptyarralloc(int nelem)
159 {
160 	struct pt_softc **pt;
161 	nelem += 10;
162 	pt = kmem_zalloc(nelem * sizeof(*pt), KM_SLEEP);
163 	return pt;
164 }
165 
166 static void
167 ptyarrfree(struct pt_softc **pt, int nelem)
168 {
169 
170 	nelem += 10;
171 	kmem_free(pt, nelem * sizeof(*pt));
172 }
173 
174 /*
175  * Check if the minor is correct and ensure necessary structures
176  * are properly allocated.
177  */
178 int
179 pty_check(int ptn)
180 {
181 	struct pt_softc *pti;
182 
183 	if (ptn >= npty) {
184 		struct pt_softc **newpt, **oldpt;
185 		int newnpty;
186 		int oldnpty;
187 
188 		/* check if the requested pty can be granted */
189 		if (ptn >= maxptys) {
190 	    limit_reached:
191 			tablefull("pty", "increase kern.maxptys");
192 			return ENXIO;
193 		}
194 
195 		/* Allocate a larger pty array */
196 		for (newnpty = npty; newnpty <= ptn;)
197 			newnpty *= 2;
198 		if (newnpty > maxptys)
199 			newnpty = maxptys;
200 		newpt = ptyarralloc(newnpty);
201 
202 		/*
203 		 * Now grab the pty array mutex - we need to ensure
204 		 * that the pty array is consistent while copying it's
205 		 * content to newly allocated, larger space; we also
206 		 * need to be safe against pty_maxptys().
207 		 */
208 		mutex_enter(&pt_softc_mutex);
209 
210 		if (newnpty >= maxptys) {
211 			/* limit cut away beneath us... */
212 			if (ptn >= maxptys) {
213 				mutex_exit(&pt_softc_mutex);
214 				ptyarrfree(newpt, newnpty);
215 				goto limit_reached;
216 			}
217 			newnpty = maxptys;
218 		}
219 
220 		/*
221 		 * If the pty array was not enlarged while we were waiting
222 		 * for mutex, copy current contents of pt_softc[] to newly
223 		 * allocated array and start using the new bigger array.
224 		 */
225 		if (newnpty > npty) {
226 			memcpy(newpt, pt_softc, npty*sizeof(struct pt_softc *));
227 			oldpt = pt_softc;
228 			oldnpty = npty;
229 			pt_softc = newpt;
230 			npty = newnpty;
231 		} else {
232 			/* was enlarged when waited for lock, free new space */
233 			oldpt = newpt;
234 			oldnpty = newnpty;
235 		}
236 
237 		mutex_exit(&pt_softc_mutex);
238 		ptyarrfree(oldpt, oldnpty);
239 	}
240 
241 	/*
242 	 * If the entry is not yet allocated, allocate one. The mutex is
243 	 * needed so that the state of pt_softc[] array is consistant
244 	 * in case it has been lengthened above.
245 	 */
246 	if (!pt_softc[ptn]) {
247 		pti = kmem_zalloc(sizeof(*pti), KM_SLEEP);
248 
249 		selinit(&pti->pt_selr);
250 		selinit(&pti->pt_selw);
251 		pti->pt_tty = tty_alloc();
252 
253 		mutex_enter(&pt_softc_mutex);
254 
255 		/*
256 		 * Check the entry again - it might have been
257 		 * added while we were waiting for mutex.
258 		 */
259 		if (pt_softc[ptn]) {
260 			mutex_exit(&pt_softc_mutex);
261 			tty_free(pti->pt_tty);
262 			seldestroy(&pti->pt_selr);
263 			seldestroy(&pti->pt_selw);
264 			kmem_free(pti, sizeof(*pti));
265 			return 0;
266 		}
267 		tty_attach(pti->pt_tty);
268 		pt_softc[ptn] = pti;
269 
270 		mutex_exit(&pt_softc_mutex);
271 	}
272 
273 	return 0;
274 }
275 
276 /*
277  * Set maxpty in thread-safe way. Returns 0 in case of error, otherwise
278  * new value of maxptys.
279  */
280 int
281 pty_maxptys(int newmax, int set)
282 {
283 	if (!set)
284 		return maxptys;
285 
286 	/*
287 	 * We have to grab the pt_softc lock, so that we would pick correct
288 	 * value of npty (might be modified in pty_check()).
289 	 */
290 	mutex_enter(&pt_softc_mutex);
291 
292 	/*
293 	 * The value cannot be set to value lower than the highest pty
294 	 * number ever allocated.
295 	 */
296 	if (newmax >= npty)
297 		maxptys = newmax;
298 	else
299 		newmax = 0;
300 
301 	mutex_exit(&pt_softc_mutex);
302 
303 	return newmax;
304 }
305 
306 /*
307  * Establish n (or default if n is 1) ptys in the system.
308  */
309 void
310 ptyattach(int n)
311 {
312 
313 	mutex_init(&pt_softc_mutex, MUTEX_DEFAULT, IPL_NONE);
314 
315 	/* maybe should allow 0 => none? */
316 	if (n <= 1)
317 		n = DEFAULT_NPTYS;
318 	pt_softc = ptyarralloc(n);
319 	npty = n;
320 #ifndef NO_DEV_PTM
321 	ptmattach(1);
322 #endif
323 }
324 
325 /*ARGSUSED*/
326 int
327 ptsopen(dev_t dev, int flag, int devtype, struct lwp *l)
328 {
329 	struct pt_softc *pti;
330 	struct tty *tp;
331 	int error;
332 	int ptn = minor(dev);
333 
334 	if ((error = pty_check(ptn)) != 0)
335 		return error;
336 
337 	mutex_spin_enter(&tty_lock);
338 	pti = pt_softc[ptn];
339 	tp = pti->pt_tty;
340 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
341 		tp->t_dev = dev;
342 		ttychars(tp);		/* Set up default chars */
343 		tp->t_iflag = TTYDEF_IFLAG;
344 		tp->t_oflag = TTYDEF_OFLAG;
345 		tp->t_lflag = TTYDEF_LFLAG;
346 		tp->t_cflag = TTYDEF_CFLAG;
347 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
348 		ttsetwater(tp);		/* would be done in xxparam() */
349 	} else if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_OPEN,
350 	    tp) != 0) {
351 		mutex_spin_exit(&tty_lock);
352 		return EBUSY;
353 	}
354 	if (tp->t_oproc)			/* Ctrlr still around. */
355 		SET(tp->t_state, TS_CARR_ON);
356 	if (!ISSET(flag, O_NONBLOCK)) {
357 		while (!ISSET(tp->t_state, TS_CARR_ON)) {
358 			tp->t_wopen++;
359 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
360 			tp->t_wopen--;
361 			if (error != 0) {
362 				mutex_spin_exit(&tty_lock);
363 				return error;
364 			}
365 		}
366 	}
367 	mutex_spin_exit(&tty_lock);
368 	error = (*tp->t_linesw->l_open)(dev, tp);
369 	ptcwakeup(tp, FREAD|FWRITE);
370 	return error;
371 }
372 
373 int
374 ptsclose(dev_t dev, int flag, int mode, struct lwp *l)
375 {
376 	struct pt_softc *pti = pt_softc[minor(dev)];
377 	struct tty *tp = pti->pt_tty;
378 	int error;
379 
380 	error = (*tp->t_linesw->l_close)(tp, flag);
381 	error |= ttyclose(tp);
382 	ptcwakeup(tp, FREAD|FWRITE);
383 	return error;
384 }
385 
386 int
387 ptsread(dev_t dev, struct uio *uio, int flag)
388 {
389 	struct proc *p = curproc;
390 	struct pt_softc *pti = pt_softc[minor(dev)];
391 	struct tty *tp = pti->pt_tty;
392 	int error = 0;
393 	int cc, c;
394 
395 again:
396 	if (pti->pt_flags & PF_REMOTE) {
397 		mutex_spin_enter(&tty_lock);
398 		while (isbackground(p, tp)) {	/* XXXSMP */
399 			if (sigismasked(curlwp, SIGTTIN) ||
400 			    p->p_pgrp->pg_jobc == 0 ||
401 			    p->p_lflag & PL_PPWAIT) {
402 				mutex_spin_exit(&tty_lock);
403 				return EIO;
404 			}
405 			ttysig(tp, TTYSIG_PG1, SIGTTIN);
406 			error = ttypause(tp, hz);
407 			if (error != 0) {
408 				mutex_spin_exit(&tty_lock);
409 				return error;
410 			}
411 		}
412 		if (tp->t_canq.c_cc == 0) {
413 			if (flag & IO_NDELAY) {
414 				mutex_spin_exit(&tty_lock);
415 				return EWOULDBLOCK;
416 			}
417 			error = ttysleep(tp, &tp->t_cancv, true, 0);
418 			mutex_spin_exit(&tty_lock);
419 			if (error != 0)
420 				return error;
421 			goto again;
422 		}
423 		while(error == 0 && tp->t_canq.c_cc > 1 && uio->uio_resid > 0) {
424 			c = getc(&tp->t_canq);
425 			mutex_spin_exit(&tty_lock);
426 			error = ureadc(c, uio);
427 			mutex_spin_enter(&tty_lock);
428 			/* Re-check terminal state here? */
429 		}
430 		if (tp->t_canq.c_cc == 1)
431 			(void) getc(&tp->t_canq);
432 		cc = tp->t_canq.c_cc;
433 		mutex_spin_exit(&tty_lock);
434 		if (cc)
435 			return error;
436 	} else if (tp->t_oproc)
437 		error = (*tp->t_linesw->l_read)(tp, uio, flag);
438 	ptcwakeup(tp, FWRITE);
439 	return error;
440 }
441 
442 /*
443  * Write to pseudo-tty.
444  * Wakeups of controlling tty will happen
445  * indirectly, when tty driver calls ptsstart.
446  */
447 int
448 ptswrite(dev_t dev, struct uio *uio, int flag)
449 {
450 	struct pt_softc *pti = pt_softc[minor(dev)];
451 	struct tty *tp = pti->pt_tty;
452 
453 	if (tp->t_oproc == NULL)
454 		return EIO;
455 	return (*tp->t_linesw->l_write)(tp, uio, flag);
456 }
457 
458 /*
459  * Poll pseudo-tty.
460  */
461 int
462 ptspoll(dev_t dev, int events, struct lwp *l)
463 {
464 	struct pt_softc *pti = pt_softc[minor(dev)];
465 	struct tty *tp = pti->pt_tty;
466 
467 	if (tp->t_oproc == NULL)
468 		return POLLHUP;
469 
470 	return (*tp->t_linesw->l_poll)(tp, events, l);
471 }
472 
473 /*
474  * Start output on pseudo-tty.
475  * Wake up process polling or sleeping for input from controlling tty.
476  */
477 void
478 ptsstart(struct tty *tp)
479 {
480 	struct pt_softc *pti;
481 
482 	KASSERT(tp->t_dev != NODEV);
483 	pti = pt_softc[minor(tp->t_dev)];
484 
485 	KASSERT(mutex_owned(&tty_lock));
486 
487 	if (ISSET(tp->t_state, TS_TTSTOP))
488 		return;
489 	if (pti->pt_flags & PF_STOPPED) {
490 		pti->pt_flags &= ~PF_STOPPED;
491 		pti->pt_send = TIOCPKT_START;
492 	}
493 
494 	selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
495 	cv_broadcast(&tp->t_outcvf);
496 }
497 
498 /*
499  * Stop output.
500  */
501 void
502 ptsstop(struct tty *tp, int flush)
503 {
504 	struct pt_softc *pti;
505 
506 	KASSERT(tp->t_dev != NODEV);
507 	pti = pt_softc[minor(tp->t_dev)];
508 
509 	KASSERT(mutex_owned(&tty_lock));
510 
511 	/* note: FLUSHREAD and FLUSHWRITE already ok */
512 	if (flush == 0) {
513 		flush = TIOCPKT_STOP;
514 		pti->pt_flags |= PF_STOPPED;
515 	} else
516 		pti->pt_flags &= ~PF_STOPPED;
517 	pti->pt_send |= flush;
518 
519 	/* change of perspective */
520 	if (flush & FREAD) {
521 		selnotify(&pti->pt_selw, 0, NOTE_SUBMIT);
522 		cv_broadcast(&tp->t_rawcvf);
523 	}
524 	if (flush & FWRITE) {
525 		selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
526 		cv_broadcast(&tp->t_outcvf);
527 	}
528 }
529 
530 void
531 ptcwakeup(struct tty *tp, int flag)
532 {
533 	struct pt_softc *pti;
534 
535 	if (tp->t_dev == NODEV)
536 		return;	/* client side not open yet */
537 
538 	pti = pt_softc[minor(tp->t_dev)];
539 	KASSERT(pti != NULL);
540 
541 	mutex_spin_enter(&tty_lock);
542 	if (flag & FREAD) {
543 		selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
544 		cv_broadcast(&tp->t_outcvf);
545 	}
546 	if (flag & FWRITE) {
547 		selnotify(&pti->pt_selw, 0, NOTE_SUBMIT);
548 		cv_broadcast(&tp->t_rawcvf);
549 	}
550 	mutex_spin_exit(&tty_lock);
551 }
552 
553 /*ARGSUSED*/
554 int
555 ptcopen(dev_t dev, int flag, int devtype, struct lwp *l)
556 {
557 	struct pt_softc *pti;
558 	struct tty *tp;
559 	int error;
560 	int ptn = minor(dev);
561 
562 	if ((error = pty_check(ptn)) != 0)
563 		return error;
564 
565 	pti = pt_softc[ptn];
566 	tp = pti->pt_tty;
567 
568 	mutex_spin_enter(&tty_lock);
569 	if (tp->t_oproc) {
570 		mutex_spin_exit(&tty_lock);
571 		return EIO;
572 	}
573 	tp->t_dev = dev;
574 	tp->t_oproc = ptsstart;
575 	mutex_spin_exit(&tty_lock);
576 	(void)(*tp->t_linesw->l_modem)(tp, 1);
577 	CLR(tp->t_lflag, EXTPROC);
578 	pti->pt_flags = 0;
579 	pti->pt_send = 0;
580 	pti->pt_ucntl = 0;
581 	return 0;
582 }
583 
584 /*ARGSUSED*/
585 int
586 ptcclose(dev_t dev, int flag, int devtype, struct lwp *l)
587 {
588 	struct pt_softc *pti = pt_softc[minor(dev)];
589 	struct tty *tp = pti->pt_tty;
590 
591 	(void)(*tp->t_linesw->l_modem)(tp, 0);
592 	mutex_spin_enter(&tty_lock);
593 	CLR(tp->t_state, TS_CARR_ON);
594 	tp->t_oproc = NULL;		/* mark closed */
595 	mutex_spin_exit(&tty_lock);
596 	return 0;
597 }
598 
599 int
600 ptcread(dev_t dev, struct uio *uio, int flag)
601 {
602 	struct pt_softc *pti = pt_softc[minor(dev)];
603 	struct tty *tp = pti->pt_tty;
604 	u_char bf[BUFSIZ];
605 	int error = 0, cc;
606 	int c;
607 
608 	if (uio->uio_resid <= 0)
609 		return EINVAL;
610 
611 	/*
612 	 * We want to block until the slave
613 	 * is open, and there's something to read;
614 	 * but if we lost the slave or we're NBIO,
615 	 * then return the appropriate error instead.
616 	 */
617 	mutex_spin_enter(&tty_lock);
618 	for (;;) {
619 		if (ISSET(tp->t_state, TS_ISOPEN)) {
620 			if (pti->pt_flags & PF_PKT && (c = pti->pt_send)) {
621 				pti->pt_send = 0;
622 				mutex_spin_exit(&tty_lock);
623 				error = ureadc(c, uio);
624 				if (error != 0)
625 					return error;
626 				/*
627 				 * Since we don't have the tty locked, there's
628 				 * a risk of messing up `t_termios'. This is
629 				 * relevant only if the tty got closed and then
630 				 * opened again while we were out uiomoving.
631 				 */
632 				if (c & TIOCPKT_IOCTL) {
633 					cc = min(uio->uio_resid,
634 						sizeof(tp->t_termios));
635 					uiomove((void *) &tp->t_termios,
636 						cc, uio);
637 				}
638 				return 0;
639 			}
640 			if (pti->pt_flags & PF_UCNTL && (c = pti->pt_ucntl)) {
641 				pti->pt_ucntl = 0;
642 				mutex_spin_exit(&tty_lock);
643 				error = ureadc(c, uio);
644 				if (error != 0)
645 					return error;
646 				return 0;
647 			}
648 			if (tp->t_outq.c_cc && !ISSET(tp->t_state, TS_TTSTOP))
649 				break;
650 		}
651 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
652 			error = 0;	/* EOF */
653 			goto out;
654 		}
655 		if (flag & IO_NDELAY) {
656 			error = EWOULDBLOCK;
657 			goto out;
658 		}
659 		error = cv_wait_sig(&tp->t_outcvf, &tty_lock);
660 		if (error != 0)
661 			goto out;
662 	}
663 
664 	if (pti->pt_flags & (PF_PKT|PF_UCNTL)) {
665 		mutex_spin_exit(&tty_lock);
666 		error = ureadc(0, uio);
667 		mutex_spin_enter(&tty_lock);
668 		if (error == 0 && !ISSET(tp->t_state, TS_ISOPEN))
669 			error = EIO;
670 	}
671 	while (uio->uio_resid > 0 && error == 0) {
672 		cc = q_to_b(&tp->t_outq, bf, min(uio->uio_resid, BUFSIZ));
673 		if (cc <= 0)
674 			break;
675 		mutex_spin_exit(&tty_lock);
676 		error = uiomove(bf, cc, uio);
677 		mutex_spin_enter(&tty_lock);
678 		if (error == 0 && !ISSET(tp->t_state, TS_ISOPEN))
679 			error = EIO;
680 	}
681 	ttypull(tp);
682 out:
683 	mutex_spin_exit(&tty_lock);
684 	return error;
685 }
686 
687 
688 int
689 ptcwrite(dev_t dev, struct uio *uio, int flag)
690 {
691 	struct pt_softc *pti = pt_softc[minor(dev)];
692 	struct tty *tp = pti->pt_tty;
693 	u_char *cp = NULL;
694 	int cc = 0;
695 	u_char locbuf[BUFSIZ];
696 	int cnt = 0;
697 	int error = 0;
698 
699 again:
700 	mutex_spin_enter(&tty_lock);
701 	if (!ISSET(tp->t_state, TS_ISOPEN))
702 		goto block;
703 	if (pti->pt_flags & PF_REMOTE) {
704 		if (tp->t_canq.c_cc)
705 			goto block;
706 		while (uio->uio_resid > 0 && tp->t_canq.c_cc < TTYHOG) {
707 			if (cc == 0) {
708 				cc = min(uio->uio_resid, BUFSIZ);
709 				cc = min(cc, TTYHOG - tp->t_canq.c_cc);
710 				cp = locbuf;
711 				mutex_spin_exit(&tty_lock);
712 				error = uiomove(cp, cc, uio);
713 				if (error != 0)
714 					return error;
715 				mutex_spin_enter(&tty_lock);
716 				/* check again for safety */
717 				if (!ISSET(tp->t_state, TS_ISOPEN)) {
718 					/*
719 					 * adjust for data copied in but not
720 					 * written
721 					 */
722 					uio->uio_resid += cc;
723 					error = EIO;
724 					goto out;
725 				}
726 			}
727 			if (cc) {
728 				cc = b_to_q(cp, cc, &tp->t_outq);
729 				if (cc > 0)
730 					goto block;
731 			}
732 		}
733 		(void) putc(0, &tp->t_canq);
734 		ttwakeup(tp);
735 		cv_broadcast(&tp->t_cancv);
736 		error = 0;
737 		goto out;
738 	}
739 	while (uio->uio_resid > 0) {
740 		if (cc == 0) {
741 			cc = min(uio->uio_resid, BUFSIZ);
742 			cp = locbuf;
743 			mutex_spin_exit(&tty_lock);
744 			error = uiomove(cp, cc, uio);
745 			if (error != 0)
746 				return error;
747 			mutex_spin_enter(&tty_lock);
748 			/* check again for safety */
749 			if (!ISSET(tp->t_state, TS_ISOPEN)) {
750 				/* adjust for data copied in but not written */
751 				uio->uio_resid += cc;
752 				error = EIO;
753 				goto out;
754 			}
755 		}
756 		while (cc > 0) {
757 			int used = tp->t_rawq.c_cc + tp->t_canq.c_cc;
758 			int canon = ISSET(tp->t_lflag, ICANON) ? 1 : 0;
759 			/*
760 			 * We need space for 2 characters if canonical
761 			 * because we might need to print ^C
762 			 */
763 			if (used >= (TTYHOG - canon) &&
764 			   (tp->t_canq.c_cc > 0 || !canon)) {
765 				cv_broadcast(&tp->t_rawcv);
766 				goto block;
767 			}
768 			/*
769 			 * XXX - should change l_rint to be called with lock
770 			 *	 see also tty.c:ttyinput_wlock()
771 			 */
772 			mutex_spin_exit(&tty_lock);
773 			(*tp->t_linesw->l_rint)(*cp++, tp);
774 			mutex_spin_enter(&tty_lock);
775 			cnt++;
776 			cc--;
777 		}
778 	}
779 	error = 0;
780 	goto out;
781 
782 block:
783 	/*
784 	 * Come here to wait for slave to open, for space
785 	 * in outq, or space in rawq.
786 	 */
787 	if (!ISSET(tp->t_state, TS_CARR_ON)) {
788 		/* adjust for data copied in but not written */
789 		uio->uio_resid += cc;
790 		error = EIO;
791 		goto out;
792 	}
793 	if (flag & IO_NDELAY) {
794 		/* adjust for data copied in but not written */
795 		uio->uio_resid += cc;
796 		error = cnt == 0 ? EWOULDBLOCK : 0;
797 		goto out;
798 	}
799 	error = cv_wait_sig(&tp->t_rawcvf, &tty_lock);
800 	mutex_spin_exit(&tty_lock);
801 	if (error != 0) {
802 		/* adjust for data copied in but not written */
803 		uio->uio_resid += cc;
804 		return error;
805 	}
806 	goto again;
807 
808 out:
809 	mutex_spin_exit(&tty_lock);
810 	return error;
811 }
812 
813 int
814 ptcpoll(dev_t dev, int events, struct lwp *l)
815 {
816 	struct pt_softc *pti = pt_softc[minor(dev)];
817 	struct tty *tp = pti->pt_tty;
818 	int revents = 0;
819 
820 	mutex_spin_enter(&tty_lock);
821 
822 	if (events & (POLLIN | POLLRDNORM))
823 		if (ISSET(tp->t_state, TS_ISOPEN) &&
824 		    ((tp->t_outq.c_cc > 0 && !ISSET(tp->t_state, TS_TTSTOP)) ||
825 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
826 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)))
827 			revents |= events & (POLLIN | POLLRDNORM);
828 
829 	if (events & (POLLOUT | POLLWRNORM))
830 		if (ISSET(tp->t_state, TS_ISOPEN) &&
831 		    ((pti->pt_flags & PF_REMOTE) ?
832 		     (tp->t_canq.c_cc == 0) :
833 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG-2) ||
834 		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON)))))
835 			revents |= events & (POLLOUT | POLLWRNORM);
836 
837 	if (events & POLLHUP)
838 		if (!ISSET(tp->t_state, TS_CARR_ON))
839 			revents |= POLLHUP;
840 
841 	if (revents == 0) {
842 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
843 			selrecord(l, &pti->pt_selr);
844 
845 		if (events & (POLLOUT | POLLWRNORM))
846 			selrecord(l, &pti->pt_selw);
847 	}
848 
849 	mutex_spin_exit(&tty_lock);
850 
851 	return revents;
852 }
853 
854 static void
855 filt_ptcrdetach(struct knote *kn)
856 {
857 	struct pt_softc *pti;
858 
859 	pti = kn->kn_hook;
860 
861 	mutex_spin_enter(&tty_lock);
862 	SLIST_REMOVE(&pti->pt_selr.sel_klist, kn, knote, kn_selnext);
863 	mutex_spin_exit(&tty_lock);
864 }
865 
866 static int
867 filt_ptcread(struct knote *kn, long hint)
868 {
869 	struct pt_softc *pti;
870 	struct tty	*tp;
871 	int canread;
872 
873 	pti = kn->kn_hook;
874 	tp = pti->pt_tty;
875 
876 	if ((hint & NOTE_SUBMIT) == 0) {
877 		mutex_spin_enter(&tty_lock);
878 	}
879 
880 	canread = (ISSET(tp->t_state, TS_ISOPEN) &&
881 		    ((tp->t_outq.c_cc > 0 && !ISSET(tp->t_state, TS_TTSTOP)) ||
882 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
883 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)));
884 
885 	if (canread) {
886 		/*
887 		 * c_cc is number of characters after output post-processing;
888 		 * the amount of data actually read(2) depends on
889 		 * setting of input flags for the terminal.
890 		 */
891 		kn->kn_data = tp->t_outq.c_cc;
892 		if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
893 		    ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))
894 			kn->kn_data++;
895 	}
896 
897 	if ((hint & NOTE_SUBMIT) == 0) {
898 		mutex_spin_exit(&tty_lock);
899 	}
900 
901 	return canread;
902 }
903 
904 static void
905 filt_ptcwdetach(struct knote *kn)
906 {
907 	struct pt_softc *pti;
908 
909 	pti = kn->kn_hook;
910 
911 	mutex_spin_enter(&tty_lock);
912 	SLIST_REMOVE(&pti->pt_selw.sel_klist, kn, knote, kn_selnext);
913 	mutex_spin_exit(&tty_lock);
914 }
915 
916 static int
917 filt_ptcwrite(struct knote *kn, long hint)
918 {
919 	struct pt_softc *pti;
920 	struct tty	*tp;
921 	int canwrite;
922 	int nwrite;
923 
924 	pti = kn->kn_hook;
925 	tp = pti->pt_tty;
926 
927 	if ((hint & NOTE_SUBMIT) == 0) {
928 		mutex_spin_enter(&tty_lock);
929 	}
930 
931 	canwrite = (ISSET(tp->t_state, TS_ISOPEN) &&
932 		    ((pti->pt_flags & PF_REMOTE) ?
933 		     (tp->t_canq.c_cc == 0) :
934 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG-2) ||
935 		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON)))));
936 
937 	if (canwrite) {
938 		if (pti->pt_flags & PF_REMOTE)
939 			nwrite = tp->t_canq.c_cn;
940 		else {
941 			/* this is guaranteed to be > 0 due to above check */
942 			nwrite = tp->t_canq.c_cn
943 				- (tp->t_rawq.c_cc + tp->t_canq.c_cc);
944 		}
945 		kn->kn_data = nwrite;
946 	}
947 
948 	if ((hint & NOTE_SUBMIT) == 0) {
949 		mutex_spin_exit(&tty_lock);
950 	}
951 
952 	return canwrite;
953 }
954 
955 static const struct filterops ptcread_filtops =
956 	{ 1, NULL, filt_ptcrdetach, filt_ptcread };
957 static const struct filterops ptcwrite_filtops =
958 	{ 1, NULL, filt_ptcwdetach, filt_ptcwrite };
959 
960 int
961 ptckqfilter(dev_t dev, struct knote *kn)
962 {
963 	struct pt_softc *pti = pt_softc[minor(dev)];
964 	struct klist	*klist;
965 
966 	switch (kn->kn_filter) {
967 	case EVFILT_READ:
968 		klist = &pti->pt_selr.sel_klist;
969 		kn->kn_fop = &ptcread_filtops;
970 		break;
971 	case EVFILT_WRITE:
972 		klist = &pti->pt_selw.sel_klist;
973 		kn->kn_fop = &ptcwrite_filtops;
974 		break;
975 	default:
976 		return EINVAL;
977 	}
978 
979 	kn->kn_hook = pti;
980 
981 	mutex_spin_enter(&tty_lock);
982 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
983 	mutex_spin_exit(&tty_lock);
984 
985 	return 0;
986 }
987 
988 struct tty *
989 ptytty(dev_t dev)
990 {
991 	struct pt_softc *pti = pt_softc[minor(dev)];
992 	struct tty *tp = pti->pt_tty;
993 
994 	return tp;
995 }
996 
997 /*ARGSUSED*/
998 int
999 ptyioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
1000 {
1001 	struct pt_softc *pti = pt_softc[minor(dev)];
1002 	struct tty *tp = pti->pt_tty;
1003 	const struct cdevsw *cdev;
1004 	u_char *cc = tp->t_cc;
1005 	int stop, error, sig;
1006 
1007 	/*
1008 	 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1009 	 * ttywflush(tp) will hang if there are characters in the outq.
1010 	 */
1011 	if (cmd == TIOCEXT) {
1012 		/*
1013 		 * When the EXTPROC bit is being toggled, we need
1014 		 * to send an TIOCPKT_IOCTL if the packet driver
1015 		 * is turned on.
1016 		 */
1017 		if (*(int *)data) {
1018 			if (pti->pt_flags & PF_PKT) {
1019 				pti->pt_send |= TIOCPKT_IOCTL;
1020 				ptcwakeup(tp, FREAD);
1021 			}
1022 			SET(tp->t_lflag, EXTPROC);
1023 		} else {
1024 			if (ISSET(tp->t_lflag, EXTPROC) &&
1025 			    (pti->pt_flags & PF_PKT)) {
1026 				pti->pt_send |= TIOCPKT_IOCTL;
1027 				ptcwakeup(tp, FREAD);
1028 			}
1029 			CLR(tp->t_lflag, EXTPROC);
1030 		}
1031 		return(0);
1032 	}
1033 
1034 #ifndef NO_DEV_PTM
1035 	/* Allow getting the name from either the master or the slave */
1036 	if (cmd == TIOCPTSNAME)
1037 		return pty_fill_ptmget(l, dev, -1, -1, data);
1038 #endif
1039 
1040 	cdev = cdevsw_lookup(dev);
1041 	if (cdev != NULL && cdev->d_open == ptcopen)
1042 		switch (cmd) {
1043 #ifndef NO_DEV_PTM
1044 		case TIOCGRANTPT:
1045 			return pty_grant_slave(l, dev);
1046 #endif
1047 
1048 		case TIOCGPGRP:
1049 			/*
1050 			 * We avoid calling ttioctl on the controller since,
1051 			 * in that case, tp must be the controlling terminal.
1052 			 */
1053 			*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1054 			return 0;
1055 
1056 		case TIOCPKT:
1057 			if (*(int *)data) {
1058 				if (pti->pt_flags & PF_UCNTL)
1059 					return EINVAL;
1060 				pti->pt_flags |= PF_PKT;
1061 			} else
1062 				pti->pt_flags &= ~PF_PKT;
1063 			return 0;
1064 
1065 		case TIOCUCNTL:
1066 			if (*(int *)data) {
1067 				if (pti->pt_flags & PF_PKT)
1068 					return EINVAL;
1069 				pti->pt_flags |= PF_UCNTL;
1070 			} else
1071 				pti->pt_flags &= ~PF_UCNTL;
1072 			return 0;
1073 
1074 		case TIOCREMOTE:
1075 			if (*(int *)data)
1076 				pti->pt_flags |= PF_REMOTE;
1077 			else
1078 				pti->pt_flags &= ~PF_REMOTE;
1079 			mutex_spin_enter(&tty_lock);
1080 			ttyflush(tp, FREAD|FWRITE);
1081 			mutex_spin_exit(&tty_lock);
1082 			return 0;
1083 
1084 		case TIOCSETP:
1085 		case TIOCSETN:
1086 		case TIOCSETD:
1087 		case TIOCSETA:
1088 		case TIOCSETAW:
1089 		case TIOCSETAF:
1090 			mutex_spin_enter(&tty_lock);
1091 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
1092 			mutex_spin_exit(&tty_lock);
1093 			break;
1094 
1095 		case TIOCSIG:
1096 			sig = (int)(long)*(void **)data;
1097 			if (sig <= 0 || sig >= NSIG)
1098 				return EINVAL;
1099 			mutex_spin_enter(&tty_lock);
1100 			if (!ISSET(tp->t_lflag, NOFLSH))
1101 				ttyflush(tp, FREAD|FWRITE);
1102 			tp->t_state |= TS_SIGINFO;
1103 			ttysig(tp, TTYSIG_PG1, sig);
1104 			mutex_spin_exit(&tty_lock);
1105 			return 0;
1106 
1107 		case FIONREAD:
1108 			mutex_spin_enter(&tty_lock);
1109 			*(int *)data = tp->t_outq.c_cc;
1110 			mutex_spin_exit(&tty_lock);
1111 			return 0;
1112 		}
1113 
1114 	error = (*tp->t_linesw->l_ioctl)(tp, cmd, data, flag, l);
1115 	if (error == EPASSTHROUGH)
1116 		 error = ttioctl(tp, cmd, data, flag, l);
1117 	if (error == EPASSTHROUGH) {
1118 		if (pti->pt_flags & PF_UCNTL &&
1119 		    (cmd & ~0xff) == UIOCCMD(0)) {
1120 			if (cmd & 0xff) {
1121 				pti->pt_ucntl = (u_char)cmd;
1122 				ptcwakeup(tp, FREAD);
1123 			}
1124 			return 0;
1125 		}
1126 	}
1127 	/*
1128 	 * If external processing and packet mode send ioctl packet.
1129 	 */
1130 	if (ISSET(tp->t_lflag, EXTPROC) && (pti->pt_flags & PF_PKT)) {
1131 		switch(cmd) {
1132 		case TIOCSETA:
1133 		case TIOCSETAW:
1134 		case TIOCSETAF:
1135 		case TIOCSETP:
1136 		case TIOCSETN:
1137 		case TIOCSETC:
1138 		case TIOCSLTC:
1139 		case TIOCLBIS:
1140 		case TIOCLBIC:
1141 		case TIOCLSET:
1142 			pti->pt_send |= TIOCPKT_IOCTL;
1143 			ptcwakeup(tp, FREAD);
1144 		default:
1145 			break;
1146 		}
1147 	}
1148 	stop = ISSET(tp->t_iflag, IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1149 		&& CCEQ(cc[VSTART], CTRL('q'));
1150 	if (pti->pt_flags & PF_NOSTOP) {
1151 		if (stop) {
1152 			pti->pt_send &= ~TIOCPKT_NOSTOP;
1153 			pti->pt_send |= TIOCPKT_DOSTOP;
1154 			pti->pt_flags &= ~PF_NOSTOP;
1155 			ptcwakeup(tp, FREAD);
1156 		}
1157 	} else {
1158 		if (!stop) {
1159 			pti->pt_send &= ~TIOCPKT_DOSTOP;
1160 			pti->pt_send |= TIOCPKT_NOSTOP;
1161 			pti->pt_flags |= PF_NOSTOP;
1162 			ptcwakeup(tp, FREAD);
1163 		}
1164 	}
1165 	return error;
1166 }
1167