xref: /netbsd-src/sys/kern/tty_pty.c (revision 80d9064ac03cbb6a4174695f0d5b237c8766d3d0)
1 /*	$NetBSD: tty_pty.c,v 1.140 2014/07/25 08:10:40 dholland Exp $	*/
2 
3 /*
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
32  */
33 
34 /*
35  * Pseudo-teletype Driver
36  * (Actually two drivers, requiring two entries in 'cdevsw')
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: tty_pty.c,v 1.140 2014/07/25 08:10:40 dholland Exp $");
41 
42 #include "opt_ptm.h"
43 
44 #define TTY_ALLOW_PRIVATE
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/ioctl.h>
49 #include <sys/ioctl_compat.h>
50 #include <sys/proc.h>
51 #include <sys/tty.h>
52 #include <sys/stat.h>
53 #include <sys/file.h>
54 #include <sys/kernel.h>
55 #include <sys/vnode.h>
56 #include <sys/namei.h>
57 #include <sys/signalvar.h>
58 #include <sys/uio.h>
59 #include <sys/filedesc.h>
60 #include <sys/conf.h>
61 #include <sys/poll.h>
62 #include <sys/pty.h>
63 #include <sys/kauth.h>
64 
65 #define	DEFAULT_NPTYS		16	/* default number of initial ptys */
66 #define DEFAULT_MAXPTYS		992	/* default maximum number of ptys */
67 
68 #define BUFSIZ 100		/* Chunk size iomoved to/from user */
69 
70 struct	pt_softc {
71 	struct	tty *pt_tty;
72 	int	pt_flags;
73 	struct	selinfo pt_selr, pt_selw;
74 	u_char	pt_send;
75 	u_char	pt_ucntl;
76 };
77 
78 static struct pt_softc **pt_softc = NULL;	/* pty array */
79 static int maxptys = DEFAULT_MAXPTYS;	/* maximum number of ptys (sysctable) */
80 kmutex_t pt_softc_mutex;
81 int npty = 0;			/* for pstat -t */
82 
83 #define	PF_PKT		0x08		/* packet mode */
84 #define	PF_STOPPED	0x10		/* user told stopped */
85 #define	PF_REMOTE	0x20		/* remote and flow controlled input */
86 #define	PF_NOSTOP	0x40
87 #define PF_UCNTL	0x80		/* user control mode */
88 
89 void	ptyattach(int);
90 void	ptcwakeup(struct tty *, int);
91 void	ptsstart(struct tty *);
92 int	pty_maxptys(int, int);
93 
94 static struct pt_softc **ptyarralloc(int);
95 
96 dev_type_open(ptcopen);
97 dev_type_close(ptcclose);
98 dev_type_read(ptcread);
99 dev_type_write(ptcwrite);
100 dev_type_poll(ptcpoll);
101 dev_type_kqfilter(ptckqfilter);
102 
103 dev_type_open(ptsopen);
104 dev_type_close(ptsclose);
105 dev_type_read(ptsread);
106 dev_type_write(ptswrite);
107 dev_type_stop(ptsstop);
108 dev_type_poll(ptspoll);
109 
110 dev_type_ioctl(ptyioctl);
111 dev_type_tty(ptytty);
112 
113 const struct cdevsw ptc_cdevsw = {
114 	.d_open = ptcopen,
115 	.d_close = ptcclose,
116 	.d_read = ptcread,
117 	.d_write = ptcwrite,
118 	.d_ioctl = ptyioctl,
119 	.d_stop = nullstop,
120 	.d_tty = ptytty,
121 	.d_poll = ptcpoll,
122 	.d_mmap = nommap,
123 	.d_kqfilter = ptckqfilter,
124 	.d_discard = nodiscard,
125 	.d_flag = D_TTY
126 };
127 
128 const struct cdevsw pts_cdevsw = {
129 	.d_open = ptsopen,
130 	.d_close = ptsclose,
131 	.d_read = ptsread,
132 	.d_write = ptswrite,
133 	.d_ioctl = ptyioctl,
134 	.d_stop = ptsstop,
135 	.d_tty = ptytty,
136 	.d_poll = ptspoll,
137 	.d_mmap = nommap,
138 	.d_kqfilter = ttykqfilter,
139 	.d_discard = nodiscard,
140 	.d_flag = D_TTY
141 };
142 
143 #if defined(pmax)
144 /*
145  * Used by arch/pmax/conf/majors.pmax, which needs a second copy as it
146  * needs to map this stuff to two pairs of majors.
147  */
148 
149 const struct cdevsw ptc_ultrix_cdevsw = {
150 	.d_open = ptcopen,
151 	.d_close = ptcclose,
152 	.d_read = ptcread,
153 	.d_write = ptcwrite,
154 	.d_ioctl = ptyioctl,
155 	.d_stop = nullstop,
156 	.d_tty = ptytty,
157 	.d_poll = ptcpoll,
158 	.d_mmap = nommap,
159 	.d_kqfilter = ptckqfilter,
160 	.d_discard = nodiscard,
161 	.d_flag = D_TTY
162 };
163 
164 const struct cdevsw pts_ultrix_cdevsw = {
165 	.d_open = ptsopen,
166 	.d_close = ptsclose,
167 	.d_read = ptsread,
168 	.d_write = ptswrite,
169 	.d_ioctl = ptyioctl,
170 	.d_stop = ptsstop,
171 	.d_tty = ptytty,
172 	.d_poll = ptspoll,
173 	.d_mmap = nommap,
174 	.d_kqfilter = ttykqfilter,
175 	.d_discard = nodiscard,
176 	.d_flag = D_TTY
177 };
178 #endif /* defined(pmax) */
179 
180 /*
181  * Check if a pty is free to use.
182  */
183 int
184 pty_isfree(int minor, int lock)
185 {
186 	struct pt_softc *pt = pt_softc[minor];
187 	if (lock)
188 		mutex_enter(&pt_softc_mutex);
189 	minor = pt == NULL || pt->pt_tty == NULL ||
190 	    pt->pt_tty->t_oproc == NULL;
191 	if (lock)
192 		mutex_exit(&pt_softc_mutex);
193 	return minor;
194 }
195 
196 /*
197  * Allocate and zero array of nelem elements.
198  */
199 static struct pt_softc **
200 ptyarralloc(int nelem)
201 {
202 	struct pt_softc **pt;
203 	nelem += 10;
204 	pt = kmem_zalloc(nelem * sizeof(*pt), KM_SLEEP);
205 	return pt;
206 }
207 
208 static void
209 ptyarrfree(struct pt_softc **pt, int nelem)
210 {
211 
212 	nelem += 10;
213 	kmem_free(pt, nelem * sizeof(*pt));
214 }
215 
216 /*
217  * Check if the minor is correct and ensure necessary structures
218  * are properly allocated.
219  */
220 int
221 pty_check(int ptn)
222 {
223 	struct pt_softc *pti;
224 
225 	if (ptn >= npty) {
226 		struct pt_softc **newpt, **oldpt;
227 		int newnpty;
228 		int oldnpty;
229 
230 		/* check if the requested pty can be granted */
231 		if (ptn >= maxptys) {
232 	    limit_reached:
233 			tablefull("pty", "increase kern.maxptys");
234 			return ENXIO;
235 		}
236 
237 		/* Allocate a larger pty array */
238 		for (newnpty = npty; newnpty <= ptn;)
239 			newnpty *= 2;
240 		if (newnpty > maxptys)
241 			newnpty = maxptys;
242 		newpt = ptyarralloc(newnpty);
243 
244 		/*
245 		 * Now grab the pty array mutex - we need to ensure
246 		 * that the pty array is consistent while copying it's
247 		 * content to newly allocated, larger space; we also
248 		 * need to be safe against pty_maxptys().
249 		 */
250 		mutex_enter(&pt_softc_mutex);
251 
252 		if (newnpty >= maxptys) {
253 			/* limit cut away beneath us... */
254 			if (ptn >= maxptys) {
255 				mutex_exit(&pt_softc_mutex);
256 				ptyarrfree(newpt, newnpty);
257 				goto limit_reached;
258 			}
259 			newnpty = maxptys;
260 		}
261 
262 		/*
263 		 * If the pty array was not enlarged while we were waiting
264 		 * for mutex, copy current contents of pt_softc[] to newly
265 		 * allocated array and start using the new bigger array.
266 		 */
267 		if (newnpty > npty) {
268 			memcpy(newpt, pt_softc, npty*sizeof(struct pt_softc *));
269 			oldpt = pt_softc;
270 			oldnpty = npty;
271 			pt_softc = newpt;
272 			npty = newnpty;
273 		} else {
274 			/* was enlarged when waited for lock, free new space */
275 			oldpt = newpt;
276 			oldnpty = newnpty;
277 		}
278 
279 		mutex_exit(&pt_softc_mutex);
280 		ptyarrfree(oldpt, oldnpty);
281 	}
282 
283 	/*
284 	 * If the entry is not yet allocated, allocate one. The mutex is
285 	 * needed so that the state of pt_softc[] array is consistant
286 	 * in case it has been lengthened above.
287 	 */
288 	if (!pt_softc[ptn]) {
289 		pti = kmem_zalloc(sizeof(*pti), KM_SLEEP);
290 
291 		selinit(&pti->pt_selr);
292 		selinit(&pti->pt_selw);
293 		pti->pt_tty = tty_alloc();
294 
295 		mutex_enter(&pt_softc_mutex);
296 
297 		/*
298 		 * Check the entry again - it might have been
299 		 * added while we were waiting for mutex.
300 		 */
301 		if (pt_softc[ptn]) {
302 			mutex_exit(&pt_softc_mutex);
303 			tty_free(pti->pt_tty);
304 			seldestroy(&pti->pt_selr);
305 			seldestroy(&pti->pt_selw);
306 			kmem_free(pti, sizeof(*pti));
307 			return 0;
308 		}
309 		tty_attach(pti->pt_tty);
310 		pt_softc[ptn] = pti;
311 
312 		mutex_exit(&pt_softc_mutex);
313 	}
314 
315 	return 0;
316 }
317 
318 /*
319  * Set maxpty in thread-safe way. Returns 0 in case of error, otherwise
320  * new value of maxptys.
321  */
322 int
323 pty_maxptys(int newmax, int set)
324 {
325 	if (!set)
326 		return maxptys;
327 
328 	/*
329 	 * We have to grab the pt_softc lock, so that we would pick correct
330 	 * value of npty (might be modified in pty_check()).
331 	 */
332 	mutex_enter(&pt_softc_mutex);
333 
334 	/*
335 	 * The value cannot be set to value lower than the highest pty
336 	 * number ever allocated.
337 	 */
338 	if (newmax >= npty)
339 		maxptys = newmax;
340 	else
341 		newmax = 0;
342 
343 	mutex_exit(&pt_softc_mutex);
344 
345 	return newmax;
346 }
347 
348 /*
349  * Establish n (or default if n is 1) ptys in the system.
350  */
351 void
352 ptyattach(int n)
353 {
354 
355 	mutex_init(&pt_softc_mutex, MUTEX_DEFAULT, IPL_NONE);
356 
357 	/* maybe should allow 0 => none? */
358 	if (n <= 1)
359 		n = DEFAULT_NPTYS;
360 	pt_softc = ptyarralloc(n);
361 	npty = n;
362 #ifndef NO_DEV_PTM
363 	ptmattach(1);
364 #endif
365 }
366 
367 /*ARGSUSED*/
368 int
369 ptsopen(dev_t dev, int flag, int devtype, struct lwp *l)
370 {
371 	struct pt_softc *pti;
372 	struct tty *tp;
373 	int error;
374 	int ptn = minor(dev);
375 
376 	if ((error = pty_check(ptn)) != 0)
377 		return error;
378 
379 	mutex_spin_enter(&tty_lock);
380 	pti = pt_softc[ptn];
381 	tp = pti->pt_tty;
382 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
383 		tp->t_dev = dev;
384 		ttychars(tp);		/* Set up default chars */
385 		tp->t_iflag = TTYDEF_IFLAG;
386 		tp->t_oflag = TTYDEF_OFLAG;
387 		tp->t_lflag = TTYDEF_LFLAG;
388 		tp->t_cflag = TTYDEF_CFLAG;
389 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
390 		ttsetwater(tp);		/* would be done in xxparam() */
391 	} else if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_OPEN,
392 	    tp) != 0) {
393 		mutex_spin_exit(&tty_lock);
394 		return EBUSY;
395 	}
396 	if (tp->t_oproc)			/* Ctrlr still around. */
397 		SET(tp->t_state, TS_CARR_ON);
398 	if (!ISSET(flag, O_NONBLOCK)) {
399 		while (!ISSET(tp->t_state, TS_CARR_ON)) {
400 			tp->t_wopen++;
401 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
402 			tp->t_wopen--;
403 			if (error != 0) {
404 				mutex_spin_exit(&tty_lock);
405 				return error;
406 			}
407 		}
408 	}
409 	mutex_spin_exit(&tty_lock);
410 	error = (*tp->t_linesw->l_open)(dev, tp);
411 	ptcwakeup(tp, FREAD|FWRITE);
412 	return error;
413 }
414 
415 int
416 ptsclose(dev_t dev, int flag, int mode, struct lwp *l)
417 {
418 	struct pt_softc *pti = pt_softc[minor(dev)];
419 	struct tty *tp = pti->pt_tty;
420 	int error;
421 
422 	error = (*tp->t_linesw->l_close)(tp, flag);
423 	error |= ttyclose(tp);
424 	ptcwakeup(tp, FREAD|FWRITE);
425 	return error;
426 }
427 
428 int
429 ptsread(dev_t dev, struct uio *uio, int flag)
430 {
431 	struct proc *p = curproc;
432 	struct pt_softc *pti = pt_softc[minor(dev)];
433 	struct tty *tp = pti->pt_tty;
434 	int error = 0;
435 	int cc, c;
436 
437 again:
438 	if (pti->pt_flags & PF_REMOTE) {
439 		mutex_spin_enter(&tty_lock);
440 		while (isbackground(p, tp)) {	/* XXXSMP */
441 			if (sigismasked(curlwp, SIGTTIN) ||
442 			    p->p_pgrp->pg_jobc == 0 ||
443 			    p->p_lflag & PL_PPWAIT) {
444 				mutex_spin_exit(&tty_lock);
445 				return EIO;
446 			}
447 			ttysig(tp, TTYSIG_PG1, SIGTTIN);
448 			error = ttypause(tp, hz);
449 			if (error != 0) {
450 				mutex_spin_exit(&tty_lock);
451 				return error;
452 			}
453 		}
454 		if (tp->t_canq.c_cc == 0) {
455 			if (flag & IO_NDELAY) {
456 				mutex_spin_exit(&tty_lock);
457 				return EWOULDBLOCK;
458 			}
459 			error = ttysleep(tp, &tp->t_cancv, true, 0);
460 			mutex_spin_exit(&tty_lock);
461 			if (error != 0)
462 				return error;
463 			goto again;
464 		}
465 		while(error == 0 && tp->t_canq.c_cc > 1 && uio->uio_resid > 0) {
466 			c = getc(&tp->t_canq);
467 			mutex_spin_exit(&tty_lock);
468 			error = ureadc(c, uio);
469 			mutex_spin_enter(&tty_lock);
470 			/* Re-check terminal state here? */
471 		}
472 		if (tp->t_canq.c_cc == 1)
473 			(void) getc(&tp->t_canq);
474 		cc = tp->t_canq.c_cc;
475 		mutex_spin_exit(&tty_lock);
476 		if (cc)
477 			return error;
478 	} else if (tp->t_oproc)
479 		error = (*tp->t_linesw->l_read)(tp, uio, flag);
480 	ptcwakeup(tp, FWRITE);
481 	return error;
482 }
483 
484 /*
485  * Write to pseudo-tty.
486  * Wakeups of controlling tty will happen
487  * indirectly, when tty driver calls ptsstart.
488  */
489 int
490 ptswrite(dev_t dev, struct uio *uio, int flag)
491 {
492 	struct pt_softc *pti = pt_softc[minor(dev)];
493 	struct tty *tp = pti->pt_tty;
494 
495 	if (tp->t_oproc == NULL)
496 		return EIO;
497 	return (*tp->t_linesw->l_write)(tp, uio, flag);
498 }
499 
500 /*
501  * Poll pseudo-tty.
502  */
503 int
504 ptspoll(dev_t dev, int events, struct lwp *l)
505 {
506 	struct pt_softc *pti = pt_softc[minor(dev)];
507 	struct tty *tp = pti->pt_tty;
508 
509 	if (tp->t_oproc == NULL)
510 		return POLLHUP;
511 
512 	return (*tp->t_linesw->l_poll)(tp, events, l);
513 }
514 
515 /*
516  * Start output on pseudo-tty.
517  * Wake up process polling or sleeping for input from controlling tty.
518  */
519 void
520 ptsstart(struct tty *tp)
521 {
522 	struct pt_softc *pti;
523 
524 	KASSERT(tp->t_dev != NODEV);
525 	pti = pt_softc[minor(tp->t_dev)];
526 
527 	KASSERT(mutex_owned(&tty_lock));
528 
529 	if (ISSET(tp->t_state, TS_TTSTOP))
530 		return;
531 	if (pti->pt_flags & PF_STOPPED) {
532 		pti->pt_flags &= ~PF_STOPPED;
533 		pti->pt_send = TIOCPKT_START;
534 	}
535 
536 	selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
537 	cv_broadcast(&tp->t_outcvf);
538 }
539 
540 /*
541  * Stop output.
542  */
543 void
544 ptsstop(struct tty *tp, int flush)
545 {
546 	struct pt_softc *pti;
547 
548 	KASSERT(tp->t_dev != NODEV);
549 	pti = pt_softc[minor(tp->t_dev)];
550 
551 	KASSERT(mutex_owned(&tty_lock));
552 
553 	/* note: FLUSHREAD and FLUSHWRITE already ok */
554 	CTASSERT(TIOCPKT_FLUSHREAD == FREAD);
555 	CTASSERT(TIOCPKT_FLUSHWRITE == FWRITE);
556 	if (flush == 0) {
557 		flush = TIOCPKT_STOP;
558 		pti->pt_flags |= PF_STOPPED;
559 	} else
560 		pti->pt_flags &= ~PF_STOPPED;
561 	pti->pt_send |= flush;
562 
563 	/* change of perspective */
564 	if (flush & FREAD) {
565 		selnotify(&pti->pt_selw, 0, NOTE_SUBMIT);
566 		cv_broadcast(&tp->t_rawcvf);
567 	}
568 	if (flush & FWRITE) {
569 		selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
570 		cv_broadcast(&tp->t_outcvf);
571 	}
572 }
573 
574 void
575 ptcwakeup(struct tty *tp, int flag)
576 {
577 	struct pt_softc *pti;
578 
579 	if (tp->t_dev == NODEV)
580 		return;	/* client side not open yet */
581 
582 	pti = pt_softc[minor(tp->t_dev)];
583 	KASSERT(pti != NULL);
584 
585 	mutex_spin_enter(&tty_lock);
586 	if (flag & FREAD) {
587 		selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
588 		cv_broadcast(&tp->t_outcvf);
589 	}
590 	if (flag & FWRITE) {
591 		selnotify(&pti->pt_selw, 0, NOTE_SUBMIT);
592 		cv_broadcast(&tp->t_rawcvf);
593 	}
594 	mutex_spin_exit(&tty_lock);
595 }
596 
597 /*ARGSUSED*/
598 int
599 ptcopen(dev_t dev, int flag, int devtype, struct lwp *l)
600 {
601 	struct pt_softc *pti;
602 	struct tty *tp;
603 	int error;
604 	int ptn = minor(dev);
605 
606 	if ((error = pty_check(ptn)) != 0)
607 		return error;
608 
609 	pti = pt_softc[ptn];
610 	tp = pti->pt_tty;
611 
612 	mutex_spin_enter(&tty_lock);
613 	if (tp->t_oproc) {
614 		mutex_spin_exit(&tty_lock);
615 		return EIO;
616 	}
617 	tp->t_dev = dev;
618 	tp->t_oproc = ptsstart;
619 	mutex_spin_exit(&tty_lock);
620 	(void)(*tp->t_linesw->l_modem)(tp, 1);
621 	CLR(tp->t_lflag, EXTPROC);
622 	pti->pt_flags = 0;
623 	pti->pt_send = 0;
624 	pti->pt_ucntl = 0;
625 	return 0;
626 }
627 
628 /*ARGSUSED*/
629 int
630 ptcclose(dev_t dev, int flag, int devtype, struct lwp *l)
631 {
632 	struct pt_softc *pti = pt_softc[minor(dev)];
633 	struct tty *tp = pti->pt_tty;
634 
635 	(void)(*tp->t_linesw->l_modem)(tp, 0);
636 	mutex_spin_enter(&tty_lock);
637 	CLR(tp->t_state, TS_CARR_ON);
638 	tp->t_oproc = NULL;		/* mark closed */
639 	mutex_spin_exit(&tty_lock);
640 	return 0;
641 }
642 
643 int
644 ptcread(dev_t dev, struct uio *uio, int flag)
645 {
646 	struct pt_softc *pti = pt_softc[minor(dev)];
647 	struct tty *tp = pti->pt_tty;
648 	u_char bf[BUFSIZ];
649 	int error = 0, cc;
650 	int c;
651 
652 	if (uio->uio_resid <= 0)
653 		return EINVAL;
654 
655 	/*
656 	 * We want to block until the slave
657 	 * is open, and there's something to read;
658 	 * but if we lost the slave or we're NBIO,
659 	 * then return the appropriate error instead.
660 	 */
661 	mutex_spin_enter(&tty_lock);
662 	for (;;) {
663 		if (ISSET(tp->t_state, TS_ISOPEN)) {
664 			if (pti->pt_flags & PF_PKT && (c = pti->pt_send)) {
665 				pti->pt_send = 0;
666 				mutex_spin_exit(&tty_lock);
667 				error = ureadc(c, uio);
668 				if (error != 0)
669 					return error;
670 				/*
671 				 * Since we don't have the tty locked, there's
672 				 * a risk of messing up `t_termios'. This is
673 				 * relevant only if the tty got closed and then
674 				 * opened again while we were out uiomoving.
675 				 */
676 				if (c & TIOCPKT_IOCTL) {
677 					cc = min(uio->uio_resid,
678 						sizeof(tp->t_termios));
679 					uiomove((void *) &tp->t_termios,
680 						cc, uio);
681 				}
682 				return 0;
683 			}
684 			if (pti->pt_flags & PF_UCNTL && (c = pti->pt_ucntl)) {
685 				pti->pt_ucntl = 0;
686 				mutex_spin_exit(&tty_lock);
687 				error = ureadc(c, uio);
688 				if (error != 0)
689 					return error;
690 				return 0;
691 			}
692 			if (tp->t_outq.c_cc && !ISSET(tp->t_state, TS_TTSTOP))
693 				break;
694 		}
695 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
696 			error = 0;	/* EOF */
697 			goto out;
698 		}
699 		if (flag & IO_NDELAY) {
700 			error = EWOULDBLOCK;
701 			goto out;
702 		}
703 		error = cv_wait_sig(&tp->t_outcvf, &tty_lock);
704 		if (error != 0)
705 			goto out;
706 	}
707 
708 	if (pti->pt_flags & (PF_PKT|PF_UCNTL)) {
709 		mutex_spin_exit(&tty_lock);
710 		error = ureadc(0, uio);
711 		mutex_spin_enter(&tty_lock);
712 		if (error == 0 && !ISSET(tp->t_state, TS_ISOPEN))
713 			error = EIO;
714 	}
715 	while (uio->uio_resid > 0 && error == 0) {
716 		cc = q_to_b(&tp->t_outq, bf, min(uio->uio_resid, BUFSIZ));
717 		if (cc <= 0)
718 			break;
719 		mutex_spin_exit(&tty_lock);
720 		error = uiomove(bf, cc, uio);
721 		mutex_spin_enter(&tty_lock);
722 		if (error == 0 && !ISSET(tp->t_state, TS_ISOPEN))
723 			error = EIO;
724 	}
725 	ttypull(tp);
726 out:
727 	mutex_spin_exit(&tty_lock);
728 	return error;
729 }
730 
731 
732 int
733 ptcwrite(dev_t dev, struct uio *uio, int flag)
734 {
735 	struct pt_softc *pti = pt_softc[minor(dev)];
736 	struct tty *tp = pti->pt_tty;
737 	u_char *cp = NULL;
738 	int cc = 0;
739 	u_char locbuf[BUFSIZ];
740 	int cnt = 0;
741 	int error = 0;
742 
743 again:
744 	mutex_spin_enter(&tty_lock);
745 	if (!ISSET(tp->t_state, TS_ISOPEN))
746 		goto block;
747 	if (pti->pt_flags & PF_REMOTE) {
748 		if (tp->t_canq.c_cc)
749 			goto block;
750 		while (uio->uio_resid > 0 && tp->t_canq.c_cc < TTYHOG) {
751 			if (cc == 0) {
752 				cc = min(uio->uio_resid, BUFSIZ);
753 				cc = min(cc, TTYHOG - tp->t_canq.c_cc);
754 				cp = locbuf;
755 				mutex_spin_exit(&tty_lock);
756 				error = uiomove(cp, cc, uio);
757 				if (error != 0)
758 					return error;
759 				mutex_spin_enter(&tty_lock);
760 				/* check again for safety */
761 				if (!ISSET(tp->t_state, TS_ISOPEN)) {
762 					/*
763 					 * adjust for data copied in but not
764 					 * written
765 					 */
766 					uio->uio_resid += cc;
767 					error = EIO;
768 					goto out;
769 				}
770 			}
771 			if (cc) {
772 				cc = b_to_q(cp, cc, &tp->t_outq);
773 				if (cc > 0)
774 					goto block;
775 			}
776 		}
777 		(void) putc(0, &tp->t_canq);
778 		ttwakeup(tp);
779 		cv_broadcast(&tp->t_cancv);
780 		error = 0;
781 		goto out;
782 	}
783 	while (uio->uio_resid > 0) {
784 		if (cc == 0) {
785 			cc = min(uio->uio_resid, BUFSIZ);
786 			cp = locbuf;
787 			mutex_spin_exit(&tty_lock);
788 			error = uiomove(cp, cc, uio);
789 			if (error != 0)
790 				return error;
791 			mutex_spin_enter(&tty_lock);
792 			/* check again for safety */
793 			if (!ISSET(tp->t_state, TS_ISOPEN)) {
794 				/* adjust for data copied in but not written */
795 				uio->uio_resid += cc;
796 				error = EIO;
797 				goto out;
798 			}
799 		}
800 		while (cc > 0) {
801 			int used = tp->t_rawq.c_cc + tp->t_canq.c_cc;
802 			int canon = ISSET(tp->t_lflag, ICANON) ? 1 : 0;
803 			/*
804 			 * We need space for 2 characters if canonical
805 			 * because we might need to print ^C
806 			 */
807 			if (used >= (TTYHOG - canon) &&
808 			   (tp->t_canq.c_cc > 0 || !canon)) {
809 				cv_broadcast(&tp->t_rawcv);
810 				goto block;
811 			}
812 			/*
813 			 * XXX - should change l_rint to be called with lock
814 			 *	 see also tty.c:ttyinput_wlock()
815 			 */
816 			mutex_spin_exit(&tty_lock);
817 			(*tp->t_linesw->l_rint)(*cp++, tp);
818 			mutex_spin_enter(&tty_lock);
819 			cnt++;
820 			cc--;
821 		}
822 	}
823 	error = 0;
824 	goto out;
825 
826 block:
827 	/*
828 	 * Come here to wait for slave to open, for space
829 	 * in outq, or space in rawq.
830 	 */
831 	if (!ISSET(tp->t_state, TS_CARR_ON)) {
832 		/* adjust for data copied in but not written */
833 		uio->uio_resid += cc;
834 		error = EIO;
835 		goto out;
836 	}
837 	if (flag & IO_NDELAY) {
838 		/* adjust for data copied in but not written */
839 		uio->uio_resid += cc;
840 		error = cnt == 0 ? EWOULDBLOCK : 0;
841 		goto out;
842 	}
843 	error = cv_wait_sig(&tp->t_rawcvf, &tty_lock);
844 	mutex_spin_exit(&tty_lock);
845 	if (error != 0) {
846 		/* adjust for data copied in but not written */
847 		uio->uio_resid += cc;
848 		return error;
849 	}
850 	goto again;
851 
852 out:
853 	mutex_spin_exit(&tty_lock);
854 	return error;
855 }
856 
857 int
858 ptcpoll(dev_t dev, int events, struct lwp *l)
859 {
860 	struct pt_softc *pti = pt_softc[minor(dev)];
861 	struct tty *tp = pti->pt_tty;
862 	int revents = 0;
863 
864 	mutex_spin_enter(&tty_lock);
865 
866 	if (events & (POLLIN | POLLRDNORM))
867 		if (ISSET(tp->t_state, TS_ISOPEN) &&
868 		    ((tp->t_outq.c_cc > 0 && !ISSET(tp->t_state, TS_TTSTOP)) ||
869 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
870 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)))
871 			revents |= events & (POLLIN | POLLRDNORM);
872 
873 	if (events & (POLLOUT | POLLWRNORM))
874 		if (ISSET(tp->t_state, TS_ISOPEN) &&
875 		    ((pti->pt_flags & PF_REMOTE) ?
876 		     (tp->t_canq.c_cc == 0) :
877 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG-2) ||
878 		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON)))))
879 			revents |= events & (POLLOUT | POLLWRNORM);
880 
881 	if (events & POLLHUP)
882 		if (!ISSET(tp->t_state, TS_CARR_ON))
883 			revents |= POLLHUP;
884 
885 	if (revents == 0) {
886 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
887 			selrecord(l, &pti->pt_selr);
888 
889 		if (events & (POLLOUT | POLLWRNORM))
890 			selrecord(l, &pti->pt_selw);
891 	}
892 
893 	mutex_spin_exit(&tty_lock);
894 
895 	return revents;
896 }
897 
898 static void
899 filt_ptcrdetach(struct knote *kn)
900 {
901 	struct pt_softc *pti;
902 
903 	pti = kn->kn_hook;
904 
905 	mutex_spin_enter(&tty_lock);
906 	SLIST_REMOVE(&pti->pt_selr.sel_klist, kn, knote, kn_selnext);
907 	mutex_spin_exit(&tty_lock);
908 }
909 
910 static int
911 filt_ptcread(struct knote *kn, long hint)
912 {
913 	struct pt_softc *pti;
914 	struct tty	*tp;
915 	int canread;
916 
917 	pti = kn->kn_hook;
918 	tp = pti->pt_tty;
919 
920 	if ((hint & NOTE_SUBMIT) == 0) {
921 		mutex_spin_enter(&tty_lock);
922 	}
923 
924 	canread = (ISSET(tp->t_state, TS_ISOPEN) &&
925 		    ((tp->t_outq.c_cc > 0 && !ISSET(tp->t_state, TS_TTSTOP)) ||
926 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
927 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)));
928 
929 	if (canread) {
930 		/*
931 		 * c_cc is number of characters after output post-processing;
932 		 * the amount of data actually read(2) depends on
933 		 * setting of input flags for the terminal.
934 		 */
935 		kn->kn_data = tp->t_outq.c_cc;
936 		if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
937 		    ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))
938 			kn->kn_data++;
939 	}
940 
941 	if ((hint & NOTE_SUBMIT) == 0) {
942 		mutex_spin_exit(&tty_lock);
943 	}
944 
945 	return canread;
946 }
947 
948 static void
949 filt_ptcwdetach(struct knote *kn)
950 {
951 	struct pt_softc *pti;
952 
953 	pti = kn->kn_hook;
954 
955 	mutex_spin_enter(&tty_lock);
956 	SLIST_REMOVE(&pti->pt_selw.sel_klist, kn, knote, kn_selnext);
957 	mutex_spin_exit(&tty_lock);
958 }
959 
960 static int
961 filt_ptcwrite(struct knote *kn, long hint)
962 {
963 	struct pt_softc *pti;
964 	struct tty	*tp;
965 	int canwrite;
966 	int nwrite;
967 
968 	pti = kn->kn_hook;
969 	tp = pti->pt_tty;
970 
971 	if ((hint & NOTE_SUBMIT) == 0) {
972 		mutex_spin_enter(&tty_lock);
973 	}
974 
975 	canwrite = (ISSET(tp->t_state, TS_ISOPEN) &&
976 		    ((pti->pt_flags & PF_REMOTE) ?
977 		     (tp->t_canq.c_cc == 0) :
978 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG-2) ||
979 		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON)))));
980 
981 	if (canwrite) {
982 		if (pti->pt_flags & PF_REMOTE)
983 			nwrite = tp->t_canq.c_cn;
984 		else {
985 			/* this is guaranteed to be > 0 due to above check */
986 			nwrite = tp->t_canq.c_cn
987 				- (tp->t_rawq.c_cc + tp->t_canq.c_cc);
988 		}
989 		kn->kn_data = nwrite;
990 	}
991 
992 	if ((hint & NOTE_SUBMIT) == 0) {
993 		mutex_spin_exit(&tty_lock);
994 	}
995 
996 	return canwrite;
997 }
998 
999 static const struct filterops ptcread_filtops =
1000 	{ 1, NULL, filt_ptcrdetach, filt_ptcread };
1001 static const struct filterops ptcwrite_filtops =
1002 	{ 1, NULL, filt_ptcwdetach, filt_ptcwrite };
1003 
1004 int
1005 ptckqfilter(dev_t dev, struct knote *kn)
1006 {
1007 	struct pt_softc *pti = pt_softc[minor(dev)];
1008 	struct klist	*klist;
1009 
1010 	switch (kn->kn_filter) {
1011 	case EVFILT_READ:
1012 		klist = &pti->pt_selr.sel_klist;
1013 		kn->kn_fop = &ptcread_filtops;
1014 		break;
1015 	case EVFILT_WRITE:
1016 		klist = &pti->pt_selw.sel_klist;
1017 		kn->kn_fop = &ptcwrite_filtops;
1018 		break;
1019 	default:
1020 		return EINVAL;
1021 	}
1022 
1023 	kn->kn_hook = pti;
1024 
1025 	mutex_spin_enter(&tty_lock);
1026 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1027 	mutex_spin_exit(&tty_lock);
1028 
1029 	return 0;
1030 }
1031 
1032 struct tty *
1033 ptytty(dev_t dev)
1034 {
1035 	struct pt_softc *pti = pt_softc[minor(dev)];
1036 	struct tty *tp = pti->pt_tty;
1037 
1038 	return tp;
1039 }
1040 
1041 /*ARGSUSED*/
1042 int
1043 ptyioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
1044 {
1045 	struct pt_softc *pti = pt_softc[minor(dev)];
1046 	struct tty *tp = pti->pt_tty;
1047 	const struct cdevsw *cdev;
1048 	u_char *cc = tp->t_cc;
1049 	int stop, error, sig;
1050 #ifndef NO_DEV_PTM
1051 	struct mount *mp;
1052 #endif
1053 
1054 	/*
1055 	 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1056 	 * ttywflush(tp) will hang if there are characters in the outq.
1057 	 */
1058 	if (cmd == TIOCEXT) {
1059 		/*
1060 		 * When the EXTPROC bit is being toggled, we need
1061 		 * to send an TIOCPKT_IOCTL if the packet driver
1062 		 * is turned on.
1063 		 */
1064 		if (*(int *)data) {
1065 			if (pti->pt_flags & PF_PKT) {
1066 				pti->pt_send |= TIOCPKT_IOCTL;
1067 				ptcwakeup(tp, FREAD);
1068 			}
1069 			SET(tp->t_lflag, EXTPROC);
1070 		} else {
1071 			if (ISSET(tp->t_lflag, EXTPROC) &&
1072 			    (pti->pt_flags & PF_PKT)) {
1073 				pti->pt_send |= TIOCPKT_IOCTL;
1074 				ptcwakeup(tp, FREAD);
1075 			}
1076 			CLR(tp->t_lflag, EXTPROC);
1077 		}
1078 		return(0);
1079 	}
1080 
1081 #ifndef NO_DEV_PTM
1082 	/* Allow getting the name from either the master or the slave */
1083 	if (cmd == TIOCPTSNAME) {
1084 		if ((error = pty_getmp(l, &mp)) != 0)
1085 			return error;
1086 		return pty_fill_ptmget(l, dev, -1, -1, data, mp);
1087 	}
1088 #endif
1089 
1090 	cdev = cdevsw_lookup(dev);
1091 	if (cdev != NULL && cdev->d_open == ptcopen)
1092 		switch (cmd) {
1093 #ifndef NO_DEV_PTM
1094 		case TIOCGRANTPT:
1095 			if ((error = pty_getmp(l, &mp)) != 0)
1096 				return error;
1097 			return pty_grant_slave(l, dev, mp);
1098 #endif
1099 
1100 		case TIOCGPGRP:
1101 			/*
1102 			 * We avoid calling ttioctl on the controller since,
1103 			 * in that case, tp must be the controlling terminal.
1104 			 */
1105 			*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1106 			return 0;
1107 
1108 		case TIOCPKT:
1109 			if (*(int *)data) {
1110 				if (pti->pt_flags & PF_UCNTL)
1111 					return EINVAL;
1112 				pti->pt_flags |= PF_PKT;
1113 			} else
1114 				pti->pt_flags &= ~PF_PKT;
1115 			return 0;
1116 
1117 		case TIOCUCNTL:
1118 			if (*(int *)data) {
1119 				if (pti->pt_flags & PF_PKT)
1120 					return EINVAL;
1121 				pti->pt_flags |= PF_UCNTL;
1122 			} else
1123 				pti->pt_flags &= ~PF_UCNTL;
1124 			return 0;
1125 
1126 		case TIOCREMOTE:
1127 			if (*(int *)data)
1128 				pti->pt_flags |= PF_REMOTE;
1129 			else
1130 				pti->pt_flags &= ~PF_REMOTE;
1131 			mutex_spin_enter(&tty_lock);
1132 			ttyflush(tp, FREAD|FWRITE);
1133 			mutex_spin_exit(&tty_lock);
1134 			return 0;
1135 
1136 		case TIOCSETP:
1137 		case TIOCSETN:
1138 		case TIOCSETD:
1139 		case TIOCSETA:
1140 		case TIOCSETAW:
1141 		case TIOCSETAF:
1142 			mutex_spin_enter(&tty_lock);
1143 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
1144 			mutex_spin_exit(&tty_lock);
1145 			break;
1146 
1147 		case TIOCSIG:
1148 			sig = (int)(long)*(void **)data;
1149 			if (sig <= 0 || sig >= NSIG)
1150 				return EINVAL;
1151 			mutex_spin_enter(&tty_lock);
1152 			if (!ISSET(tp->t_lflag, NOFLSH))
1153 				ttyflush(tp, FREAD|FWRITE);
1154 			tp->t_state |= TS_SIGINFO;
1155 			ttysig(tp, TTYSIG_PG1, sig);
1156 			mutex_spin_exit(&tty_lock);
1157 			return 0;
1158 
1159 		case FIONREAD:
1160 			mutex_spin_enter(&tty_lock);
1161 			*(int *)data = tp->t_outq.c_cc;
1162 			mutex_spin_exit(&tty_lock);
1163 			return 0;
1164 		}
1165 
1166 	error = (*tp->t_linesw->l_ioctl)(tp, cmd, data, flag, l);
1167 	if (error == EPASSTHROUGH)
1168 		 error = ttioctl(tp, cmd, data, flag, l);
1169 	if (error == EPASSTHROUGH) {
1170 		if (pti->pt_flags & PF_UCNTL &&
1171 		    (cmd & ~0xff) == UIOCCMD(0)) {
1172 			if (cmd & 0xff) {
1173 				pti->pt_ucntl = (u_char)cmd;
1174 				ptcwakeup(tp, FREAD);
1175 			}
1176 			return 0;
1177 		}
1178 	}
1179 	/*
1180 	 * If external processing and packet mode send ioctl packet.
1181 	 */
1182 	if (ISSET(tp->t_lflag, EXTPROC) && (pti->pt_flags & PF_PKT)) {
1183 		switch(cmd) {
1184 		case TIOCSETA:
1185 		case TIOCSETAW:
1186 		case TIOCSETAF:
1187 		case TIOCSETP:
1188 		case TIOCSETN:
1189 		case TIOCSETC:
1190 		case TIOCSLTC:
1191 		case TIOCLBIS:
1192 		case TIOCLBIC:
1193 		case TIOCLSET:
1194 			pti->pt_send |= TIOCPKT_IOCTL;
1195 			ptcwakeup(tp, FREAD);
1196 		default:
1197 			break;
1198 		}
1199 	}
1200 	stop = ISSET(tp->t_iflag, IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1201 		&& CCEQ(cc[VSTART], CTRL('q'));
1202 	if (pti->pt_flags & PF_NOSTOP) {
1203 		if (stop) {
1204 			pti->pt_send &= ~TIOCPKT_NOSTOP;
1205 			pti->pt_send |= TIOCPKT_DOSTOP;
1206 			pti->pt_flags &= ~PF_NOSTOP;
1207 			ptcwakeup(tp, FREAD);
1208 		}
1209 	} else {
1210 		if (!stop) {
1211 			pti->pt_send &= ~TIOCPKT_DOSTOP;
1212 			pti->pt_send |= TIOCPKT_NOSTOP;
1213 			pti->pt_flags |= PF_NOSTOP;
1214 			ptcwakeup(tp, FREAD);
1215 		}
1216 	}
1217 	return error;
1218 }
1219