xref: /netbsd-src/sys/kern/tty_pty.c (revision b7b7574d3bf8eeb51a1fa3977b59142ec6434a55)
1 /*	$NetBSD: tty_pty.c,v 1.139 2014/05/22 16:28:06 dholland Exp $	*/
2 
3 /*
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
32  */
33 
34 /*
35  * Pseudo-teletype Driver
36  * (Actually two drivers, requiring two entries in 'cdevsw')
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: tty_pty.c,v 1.139 2014/05/22 16:28:06 dholland Exp $");
41 
42 #include "opt_ptm.h"
43 
44 #define TTY_ALLOW_PRIVATE
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/ioctl.h>
49 #include <sys/ioctl_compat.h>
50 #include <sys/proc.h>
51 #include <sys/tty.h>
52 #include <sys/stat.h>
53 #include <sys/file.h>
54 #include <sys/kernel.h>
55 #include <sys/vnode.h>
56 #include <sys/namei.h>
57 #include <sys/signalvar.h>
58 #include <sys/uio.h>
59 #include <sys/filedesc.h>
60 #include <sys/conf.h>
61 #include <sys/poll.h>
62 #include <sys/pty.h>
63 #include <sys/kauth.h>
64 
65 #define	DEFAULT_NPTYS		16	/* default number of initial ptys */
66 #define DEFAULT_MAXPTYS		992	/* default maximum number of ptys */
67 
68 #define BUFSIZ 100		/* Chunk size iomoved to/from user */
69 
70 struct	pt_softc {
71 	struct	tty *pt_tty;
72 	int	pt_flags;
73 	struct	selinfo pt_selr, pt_selw;
74 	u_char	pt_send;
75 	u_char	pt_ucntl;
76 };
77 
78 static struct pt_softc **pt_softc = NULL;	/* pty array */
79 static int maxptys = DEFAULT_MAXPTYS;	/* maximum number of ptys (sysctable) */
80 kmutex_t pt_softc_mutex;
81 int npty = 0;			/* for pstat -t */
82 
83 #define	PF_PKT		0x08		/* packet mode */
84 #define	PF_STOPPED	0x10		/* user told stopped */
85 #define	PF_REMOTE	0x20		/* remote and flow controlled input */
86 #define	PF_NOSTOP	0x40
87 #define PF_UCNTL	0x80		/* user control mode */
88 
89 void	ptyattach(int);
90 void	ptcwakeup(struct tty *, int);
91 void	ptsstart(struct tty *);
92 int	pty_maxptys(int, int);
93 
94 static struct pt_softc **ptyarralloc(int);
95 
96 dev_type_open(ptcopen);
97 dev_type_close(ptcclose);
98 dev_type_read(ptcread);
99 dev_type_write(ptcwrite);
100 dev_type_poll(ptcpoll);
101 dev_type_kqfilter(ptckqfilter);
102 
103 dev_type_open(ptsopen);
104 dev_type_close(ptsclose);
105 dev_type_read(ptsread);
106 dev_type_write(ptswrite);
107 dev_type_stop(ptsstop);
108 dev_type_poll(ptspoll);
109 
110 dev_type_ioctl(ptyioctl);
111 dev_type_tty(ptytty);
112 
113 const struct cdevsw ptc_cdevsw = {
114 	.d_open = ptcopen,
115 	.d_close = ptcclose,
116 	.d_read = ptcread,
117 	.d_write = ptcwrite,
118 	.d_ioctl = ptyioctl,
119 	.d_stop = nullstop,
120 	.d_tty = ptytty,
121 	.d_poll = ptcpoll,
122 	.d_mmap = nommap,
123 	.d_kqfilter = ptckqfilter,
124 	.d_flag = D_TTY
125 };
126 
127 const struct cdevsw pts_cdevsw = {
128 	.d_open = ptsopen,
129 	.d_close = ptsclose,
130 	.d_read = ptsread,
131 	.d_write = ptswrite,
132 	.d_ioctl = ptyioctl,
133 	.d_stop = ptsstop,
134 	.d_tty = ptytty,
135 	.d_poll = ptspoll,
136 	.d_mmap = nommap,
137 	.d_kqfilter = ttykqfilter,
138 	.d_flag = D_TTY
139 };
140 
141 #if defined(pmax)
142 /*
143  * Used by arch/pmax/conf/majors.pmax, which needs a second copy as it
144  * needs to map this stuff to two pairs of majors.
145  */
146 
147 const struct cdevsw ptc_ultrix_cdevsw = {
148 	.d_open = ptcopen,
149 	.d_close = ptcclose,
150 	.d_read = ptcread,
151 	.d_write = ptcwrite,
152 	.d_ioctl = ptyioctl,
153 	.d_stop = nullstop,
154 	.d_tty = ptytty,
155 	.d_poll = ptcpoll,
156 	.d_mmap = nommap,
157 	.d_kqfilter = ptckqfilter,
158 	.d_flag = D_TTY
159 };
160 
161 const struct cdevsw pts_ultrix_cdevsw = {
162 	.d_open = ptsopen,
163 	.d_close = ptsclose,
164 	.d_read = ptsread,
165 	.d_write = ptswrite,
166 	.d_ioctl = ptyioctl,
167 	.d_stop = ptsstop,
168 	.d_tty = ptytty,
169 	.d_poll = ptspoll,
170 	.d_mmap = nommap,
171 	.d_kqfilter = ttykqfilter,
172 	.d_flag = D_TTY
173 };
174 #endif /* defined(pmax) */
175 
176 /*
177  * Check if a pty is free to use.
178  */
179 int
180 pty_isfree(int minor, int lock)
181 {
182 	struct pt_softc *pt = pt_softc[minor];
183 	if (lock)
184 		mutex_enter(&pt_softc_mutex);
185 	minor = pt == NULL || pt->pt_tty == NULL ||
186 	    pt->pt_tty->t_oproc == NULL;
187 	if (lock)
188 		mutex_exit(&pt_softc_mutex);
189 	return minor;
190 }
191 
192 /*
193  * Allocate and zero array of nelem elements.
194  */
195 static struct pt_softc **
196 ptyarralloc(int nelem)
197 {
198 	struct pt_softc **pt;
199 	nelem += 10;
200 	pt = kmem_zalloc(nelem * sizeof(*pt), KM_SLEEP);
201 	return pt;
202 }
203 
204 static void
205 ptyarrfree(struct pt_softc **pt, int nelem)
206 {
207 
208 	nelem += 10;
209 	kmem_free(pt, nelem * sizeof(*pt));
210 }
211 
212 /*
213  * Check if the minor is correct and ensure necessary structures
214  * are properly allocated.
215  */
216 int
217 pty_check(int ptn)
218 {
219 	struct pt_softc *pti;
220 
221 	if (ptn >= npty) {
222 		struct pt_softc **newpt, **oldpt;
223 		int newnpty;
224 		int oldnpty;
225 
226 		/* check if the requested pty can be granted */
227 		if (ptn >= maxptys) {
228 	    limit_reached:
229 			tablefull("pty", "increase kern.maxptys");
230 			return ENXIO;
231 		}
232 
233 		/* Allocate a larger pty array */
234 		for (newnpty = npty; newnpty <= ptn;)
235 			newnpty *= 2;
236 		if (newnpty > maxptys)
237 			newnpty = maxptys;
238 		newpt = ptyarralloc(newnpty);
239 
240 		/*
241 		 * Now grab the pty array mutex - we need to ensure
242 		 * that the pty array is consistent while copying it's
243 		 * content to newly allocated, larger space; we also
244 		 * need to be safe against pty_maxptys().
245 		 */
246 		mutex_enter(&pt_softc_mutex);
247 
248 		if (newnpty >= maxptys) {
249 			/* limit cut away beneath us... */
250 			if (ptn >= maxptys) {
251 				mutex_exit(&pt_softc_mutex);
252 				ptyarrfree(newpt, newnpty);
253 				goto limit_reached;
254 			}
255 			newnpty = maxptys;
256 		}
257 
258 		/*
259 		 * If the pty array was not enlarged while we were waiting
260 		 * for mutex, copy current contents of pt_softc[] to newly
261 		 * allocated array and start using the new bigger array.
262 		 */
263 		if (newnpty > npty) {
264 			memcpy(newpt, pt_softc, npty*sizeof(struct pt_softc *));
265 			oldpt = pt_softc;
266 			oldnpty = npty;
267 			pt_softc = newpt;
268 			npty = newnpty;
269 		} else {
270 			/* was enlarged when waited for lock, free new space */
271 			oldpt = newpt;
272 			oldnpty = newnpty;
273 		}
274 
275 		mutex_exit(&pt_softc_mutex);
276 		ptyarrfree(oldpt, oldnpty);
277 	}
278 
279 	/*
280 	 * If the entry is not yet allocated, allocate one. The mutex is
281 	 * needed so that the state of pt_softc[] array is consistant
282 	 * in case it has been lengthened above.
283 	 */
284 	if (!pt_softc[ptn]) {
285 		pti = kmem_zalloc(sizeof(*pti), KM_SLEEP);
286 
287 		selinit(&pti->pt_selr);
288 		selinit(&pti->pt_selw);
289 		pti->pt_tty = tty_alloc();
290 
291 		mutex_enter(&pt_softc_mutex);
292 
293 		/*
294 		 * Check the entry again - it might have been
295 		 * added while we were waiting for mutex.
296 		 */
297 		if (pt_softc[ptn]) {
298 			mutex_exit(&pt_softc_mutex);
299 			tty_free(pti->pt_tty);
300 			seldestroy(&pti->pt_selr);
301 			seldestroy(&pti->pt_selw);
302 			kmem_free(pti, sizeof(*pti));
303 			return 0;
304 		}
305 		tty_attach(pti->pt_tty);
306 		pt_softc[ptn] = pti;
307 
308 		mutex_exit(&pt_softc_mutex);
309 	}
310 
311 	return 0;
312 }
313 
314 /*
315  * Set maxpty in thread-safe way. Returns 0 in case of error, otherwise
316  * new value of maxptys.
317  */
318 int
319 pty_maxptys(int newmax, int set)
320 {
321 	if (!set)
322 		return maxptys;
323 
324 	/*
325 	 * We have to grab the pt_softc lock, so that we would pick correct
326 	 * value of npty (might be modified in pty_check()).
327 	 */
328 	mutex_enter(&pt_softc_mutex);
329 
330 	/*
331 	 * The value cannot be set to value lower than the highest pty
332 	 * number ever allocated.
333 	 */
334 	if (newmax >= npty)
335 		maxptys = newmax;
336 	else
337 		newmax = 0;
338 
339 	mutex_exit(&pt_softc_mutex);
340 
341 	return newmax;
342 }
343 
344 /*
345  * Establish n (or default if n is 1) ptys in the system.
346  */
347 void
348 ptyattach(int n)
349 {
350 
351 	mutex_init(&pt_softc_mutex, MUTEX_DEFAULT, IPL_NONE);
352 
353 	/* maybe should allow 0 => none? */
354 	if (n <= 1)
355 		n = DEFAULT_NPTYS;
356 	pt_softc = ptyarralloc(n);
357 	npty = n;
358 #ifndef NO_DEV_PTM
359 	ptmattach(1);
360 #endif
361 }
362 
363 /*ARGSUSED*/
364 int
365 ptsopen(dev_t dev, int flag, int devtype, struct lwp *l)
366 {
367 	struct pt_softc *pti;
368 	struct tty *tp;
369 	int error;
370 	int ptn = minor(dev);
371 
372 	if ((error = pty_check(ptn)) != 0)
373 		return error;
374 
375 	mutex_spin_enter(&tty_lock);
376 	pti = pt_softc[ptn];
377 	tp = pti->pt_tty;
378 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
379 		tp->t_dev = dev;
380 		ttychars(tp);		/* Set up default chars */
381 		tp->t_iflag = TTYDEF_IFLAG;
382 		tp->t_oflag = TTYDEF_OFLAG;
383 		tp->t_lflag = TTYDEF_LFLAG;
384 		tp->t_cflag = TTYDEF_CFLAG;
385 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
386 		ttsetwater(tp);		/* would be done in xxparam() */
387 	} else if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_OPEN,
388 	    tp) != 0) {
389 		mutex_spin_exit(&tty_lock);
390 		return EBUSY;
391 	}
392 	if (tp->t_oproc)			/* Ctrlr still around. */
393 		SET(tp->t_state, TS_CARR_ON);
394 	if (!ISSET(flag, O_NONBLOCK)) {
395 		while (!ISSET(tp->t_state, TS_CARR_ON)) {
396 			tp->t_wopen++;
397 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
398 			tp->t_wopen--;
399 			if (error != 0) {
400 				mutex_spin_exit(&tty_lock);
401 				return error;
402 			}
403 		}
404 	}
405 	mutex_spin_exit(&tty_lock);
406 	error = (*tp->t_linesw->l_open)(dev, tp);
407 	ptcwakeup(tp, FREAD|FWRITE);
408 	return error;
409 }
410 
411 int
412 ptsclose(dev_t dev, int flag, int mode, struct lwp *l)
413 {
414 	struct pt_softc *pti = pt_softc[minor(dev)];
415 	struct tty *tp = pti->pt_tty;
416 	int error;
417 
418 	error = (*tp->t_linesw->l_close)(tp, flag);
419 	error |= ttyclose(tp);
420 	ptcwakeup(tp, FREAD|FWRITE);
421 	return error;
422 }
423 
424 int
425 ptsread(dev_t dev, struct uio *uio, int flag)
426 {
427 	struct proc *p = curproc;
428 	struct pt_softc *pti = pt_softc[minor(dev)];
429 	struct tty *tp = pti->pt_tty;
430 	int error = 0;
431 	int cc, c;
432 
433 again:
434 	if (pti->pt_flags & PF_REMOTE) {
435 		mutex_spin_enter(&tty_lock);
436 		while (isbackground(p, tp)) {	/* XXXSMP */
437 			if (sigismasked(curlwp, SIGTTIN) ||
438 			    p->p_pgrp->pg_jobc == 0 ||
439 			    p->p_lflag & PL_PPWAIT) {
440 				mutex_spin_exit(&tty_lock);
441 				return EIO;
442 			}
443 			ttysig(tp, TTYSIG_PG1, SIGTTIN);
444 			error = ttypause(tp, hz);
445 			if (error != 0) {
446 				mutex_spin_exit(&tty_lock);
447 				return error;
448 			}
449 		}
450 		if (tp->t_canq.c_cc == 0) {
451 			if (flag & IO_NDELAY) {
452 				mutex_spin_exit(&tty_lock);
453 				return EWOULDBLOCK;
454 			}
455 			error = ttysleep(tp, &tp->t_cancv, true, 0);
456 			mutex_spin_exit(&tty_lock);
457 			if (error != 0)
458 				return error;
459 			goto again;
460 		}
461 		while(error == 0 && tp->t_canq.c_cc > 1 && uio->uio_resid > 0) {
462 			c = getc(&tp->t_canq);
463 			mutex_spin_exit(&tty_lock);
464 			error = ureadc(c, uio);
465 			mutex_spin_enter(&tty_lock);
466 			/* Re-check terminal state here? */
467 		}
468 		if (tp->t_canq.c_cc == 1)
469 			(void) getc(&tp->t_canq);
470 		cc = tp->t_canq.c_cc;
471 		mutex_spin_exit(&tty_lock);
472 		if (cc)
473 			return error;
474 	} else if (tp->t_oproc)
475 		error = (*tp->t_linesw->l_read)(tp, uio, flag);
476 	ptcwakeup(tp, FWRITE);
477 	return error;
478 }
479 
480 /*
481  * Write to pseudo-tty.
482  * Wakeups of controlling tty will happen
483  * indirectly, when tty driver calls ptsstart.
484  */
485 int
486 ptswrite(dev_t dev, struct uio *uio, int flag)
487 {
488 	struct pt_softc *pti = pt_softc[minor(dev)];
489 	struct tty *tp = pti->pt_tty;
490 
491 	if (tp->t_oproc == NULL)
492 		return EIO;
493 	return (*tp->t_linesw->l_write)(tp, uio, flag);
494 }
495 
496 /*
497  * Poll pseudo-tty.
498  */
499 int
500 ptspoll(dev_t dev, int events, struct lwp *l)
501 {
502 	struct pt_softc *pti = pt_softc[minor(dev)];
503 	struct tty *tp = pti->pt_tty;
504 
505 	if (tp->t_oproc == NULL)
506 		return POLLHUP;
507 
508 	return (*tp->t_linesw->l_poll)(tp, events, l);
509 }
510 
511 /*
512  * Start output on pseudo-tty.
513  * Wake up process polling or sleeping for input from controlling tty.
514  */
515 void
516 ptsstart(struct tty *tp)
517 {
518 	struct pt_softc *pti;
519 
520 	KASSERT(tp->t_dev != NODEV);
521 	pti = pt_softc[minor(tp->t_dev)];
522 
523 	KASSERT(mutex_owned(&tty_lock));
524 
525 	if (ISSET(tp->t_state, TS_TTSTOP))
526 		return;
527 	if (pti->pt_flags & PF_STOPPED) {
528 		pti->pt_flags &= ~PF_STOPPED;
529 		pti->pt_send = TIOCPKT_START;
530 	}
531 
532 	selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
533 	cv_broadcast(&tp->t_outcvf);
534 }
535 
536 /*
537  * Stop output.
538  */
539 void
540 ptsstop(struct tty *tp, int flush)
541 {
542 	struct pt_softc *pti;
543 
544 	KASSERT(tp->t_dev != NODEV);
545 	pti = pt_softc[minor(tp->t_dev)];
546 
547 	KASSERT(mutex_owned(&tty_lock));
548 
549 	/* note: FLUSHREAD and FLUSHWRITE already ok */
550 	CTASSERT(TIOCPKT_FLUSHREAD == FREAD);
551 	CTASSERT(TIOCPKT_FLUSHWRITE == FWRITE);
552 	if (flush == 0) {
553 		flush = TIOCPKT_STOP;
554 		pti->pt_flags |= PF_STOPPED;
555 	} else
556 		pti->pt_flags &= ~PF_STOPPED;
557 	pti->pt_send |= flush;
558 
559 	/* change of perspective */
560 	if (flush & FREAD) {
561 		selnotify(&pti->pt_selw, 0, NOTE_SUBMIT);
562 		cv_broadcast(&tp->t_rawcvf);
563 	}
564 	if (flush & FWRITE) {
565 		selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
566 		cv_broadcast(&tp->t_outcvf);
567 	}
568 }
569 
570 void
571 ptcwakeup(struct tty *tp, int flag)
572 {
573 	struct pt_softc *pti;
574 
575 	if (tp->t_dev == NODEV)
576 		return;	/* client side not open yet */
577 
578 	pti = pt_softc[minor(tp->t_dev)];
579 	KASSERT(pti != NULL);
580 
581 	mutex_spin_enter(&tty_lock);
582 	if (flag & FREAD) {
583 		selnotify(&pti->pt_selr, 0, NOTE_SUBMIT);
584 		cv_broadcast(&tp->t_outcvf);
585 	}
586 	if (flag & FWRITE) {
587 		selnotify(&pti->pt_selw, 0, NOTE_SUBMIT);
588 		cv_broadcast(&tp->t_rawcvf);
589 	}
590 	mutex_spin_exit(&tty_lock);
591 }
592 
593 /*ARGSUSED*/
594 int
595 ptcopen(dev_t dev, int flag, int devtype, struct lwp *l)
596 {
597 	struct pt_softc *pti;
598 	struct tty *tp;
599 	int error;
600 	int ptn = minor(dev);
601 
602 	if ((error = pty_check(ptn)) != 0)
603 		return error;
604 
605 	pti = pt_softc[ptn];
606 	tp = pti->pt_tty;
607 
608 	mutex_spin_enter(&tty_lock);
609 	if (tp->t_oproc) {
610 		mutex_spin_exit(&tty_lock);
611 		return EIO;
612 	}
613 	tp->t_dev = dev;
614 	tp->t_oproc = ptsstart;
615 	mutex_spin_exit(&tty_lock);
616 	(void)(*tp->t_linesw->l_modem)(tp, 1);
617 	CLR(tp->t_lflag, EXTPROC);
618 	pti->pt_flags = 0;
619 	pti->pt_send = 0;
620 	pti->pt_ucntl = 0;
621 	return 0;
622 }
623 
624 /*ARGSUSED*/
625 int
626 ptcclose(dev_t dev, int flag, int devtype, struct lwp *l)
627 {
628 	struct pt_softc *pti = pt_softc[minor(dev)];
629 	struct tty *tp = pti->pt_tty;
630 
631 	(void)(*tp->t_linesw->l_modem)(tp, 0);
632 	mutex_spin_enter(&tty_lock);
633 	CLR(tp->t_state, TS_CARR_ON);
634 	tp->t_oproc = NULL;		/* mark closed */
635 	mutex_spin_exit(&tty_lock);
636 	return 0;
637 }
638 
639 int
640 ptcread(dev_t dev, struct uio *uio, int flag)
641 {
642 	struct pt_softc *pti = pt_softc[minor(dev)];
643 	struct tty *tp = pti->pt_tty;
644 	u_char bf[BUFSIZ];
645 	int error = 0, cc;
646 	int c;
647 
648 	if (uio->uio_resid <= 0)
649 		return EINVAL;
650 
651 	/*
652 	 * We want to block until the slave
653 	 * is open, and there's something to read;
654 	 * but if we lost the slave or we're NBIO,
655 	 * then return the appropriate error instead.
656 	 */
657 	mutex_spin_enter(&tty_lock);
658 	for (;;) {
659 		if (ISSET(tp->t_state, TS_ISOPEN)) {
660 			if (pti->pt_flags & PF_PKT && (c = pti->pt_send)) {
661 				pti->pt_send = 0;
662 				mutex_spin_exit(&tty_lock);
663 				error = ureadc(c, uio);
664 				if (error != 0)
665 					return error;
666 				/*
667 				 * Since we don't have the tty locked, there's
668 				 * a risk of messing up `t_termios'. This is
669 				 * relevant only if the tty got closed and then
670 				 * opened again while we were out uiomoving.
671 				 */
672 				if (c & TIOCPKT_IOCTL) {
673 					cc = min(uio->uio_resid,
674 						sizeof(tp->t_termios));
675 					uiomove((void *) &tp->t_termios,
676 						cc, uio);
677 				}
678 				return 0;
679 			}
680 			if (pti->pt_flags & PF_UCNTL && (c = pti->pt_ucntl)) {
681 				pti->pt_ucntl = 0;
682 				mutex_spin_exit(&tty_lock);
683 				error = ureadc(c, uio);
684 				if (error != 0)
685 					return error;
686 				return 0;
687 			}
688 			if (tp->t_outq.c_cc && !ISSET(tp->t_state, TS_TTSTOP))
689 				break;
690 		}
691 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
692 			error = 0;	/* EOF */
693 			goto out;
694 		}
695 		if (flag & IO_NDELAY) {
696 			error = EWOULDBLOCK;
697 			goto out;
698 		}
699 		error = cv_wait_sig(&tp->t_outcvf, &tty_lock);
700 		if (error != 0)
701 			goto out;
702 	}
703 
704 	if (pti->pt_flags & (PF_PKT|PF_UCNTL)) {
705 		mutex_spin_exit(&tty_lock);
706 		error = ureadc(0, uio);
707 		mutex_spin_enter(&tty_lock);
708 		if (error == 0 && !ISSET(tp->t_state, TS_ISOPEN))
709 			error = EIO;
710 	}
711 	while (uio->uio_resid > 0 && error == 0) {
712 		cc = q_to_b(&tp->t_outq, bf, min(uio->uio_resid, BUFSIZ));
713 		if (cc <= 0)
714 			break;
715 		mutex_spin_exit(&tty_lock);
716 		error = uiomove(bf, cc, uio);
717 		mutex_spin_enter(&tty_lock);
718 		if (error == 0 && !ISSET(tp->t_state, TS_ISOPEN))
719 			error = EIO;
720 	}
721 	ttypull(tp);
722 out:
723 	mutex_spin_exit(&tty_lock);
724 	return error;
725 }
726 
727 
728 int
729 ptcwrite(dev_t dev, struct uio *uio, int flag)
730 {
731 	struct pt_softc *pti = pt_softc[minor(dev)];
732 	struct tty *tp = pti->pt_tty;
733 	u_char *cp = NULL;
734 	int cc = 0;
735 	u_char locbuf[BUFSIZ];
736 	int cnt = 0;
737 	int error = 0;
738 
739 again:
740 	mutex_spin_enter(&tty_lock);
741 	if (!ISSET(tp->t_state, TS_ISOPEN))
742 		goto block;
743 	if (pti->pt_flags & PF_REMOTE) {
744 		if (tp->t_canq.c_cc)
745 			goto block;
746 		while (uio->uio_resid > 0 && tp->t_canq.c_cc < TTYHOG) {
747 			if (cc == 0) {
748 				cc = min(uio->uio_resid, BUFSIZ);
749 				cc = min(cc, TTYHOG - tp->t_canq.c_cc);
750 				cp = locbuf;
751 				mutex_spin_exit(&tty_lock);
752 				error = uiomove(cp, cc, uio);
753 				if (error != 0)
754 					return error;
755 				mutex_spin_enter(&tty_lock);
756 				/* check again for safety */
757 				if (!ISSET(tp->t_state, TS_ISOPEN)) {
758 					/*
759 					 * adjust for data copied in but not
760 					 * written
761 					 */
762 					uio->uio_resid += cc;
763 					error = EIO;
764 					goto out;
765 				}
766 			}
767 			if (cc) {
768 				cc = b_to_q(cp, cc, &tp->t_outq);
769 				if (cc > 0)
770 					goto block;
771 			}
772 		}
773 		(void) putc(0, &tp->t_canq);
774 		ttwakeup(tp);
775 		cv_broadcast(&tp->t_cancv);
776 		error = 0;
777 		goto out;
778 	}
779 	while (uio->uio_resid > 0) {
780 		if (cc == 0) {
781 			cc = min(uio->uio_resid, BUFSIZ);
782 			cp = locbuf;
783 			mutex_spin_exit(&tty_lock);
784 			error = uiomove(cp, cc, uio);
785 			if (error != 0)
786 				return error;
787 			mutex_spin_enter(&tty_lock);
788 			/* check again for safety */
789 			if (!ISSET(tp->t_state, TS_ISOPEN)) {
790 				/* adjust for data copied in but not written */
791 				uio->uio_resid += cc;
792 				error = EIO;
793 				goto out;
794 			}
795 		}
796 		while (cc > 0) {
797 			int used = tp->t_rawq.c_cc + tp->t_canq.c_cc;
798 			int canon = ISSET(tp->t_lflag, ICANON) ? 1 : 0;
799 			/*
800 			 * We need space for 2 characters if canonical
801 			 * because we might need to print ^C
802 			 */
803 			if (used >= (TTYHOG - canon) &&
804 			   (tp->t_canq.c_cc > 0 || !canon)) {
805 				cv_broadcast(&tp->t_rawcv);
806 				goto block;
807 			}
808 			/*
809 			 * XXX - should change l_rint to be called with lock
810 			 *	 see also tty.c:ttyinput_wlock()
811 			 */
812 			mutex_spin_exit(&tty_lock);
813 			(*tp->t_linesw->l_rint)(*cp++, tp);
814 			mutex_spin_enter(&tty_lock);
815 			cnt++;
816 			cc--;
817 		}
818 	}
819 	error = 0;
820 	goto out;
821 
822 block:
823 	/*
824 	 * Come here to wait for slave to open, for space
825 	 * in outq, or space in rawq.
826 	 */
827 	if (!ISSET(tp->t_state, TS_CARR_ON)) {
828 		/* adjust for data copied in but not written */
829 		uio->uio_resid += cc;
830 		error = EIO;
831 		goto out;
832 	}
833 	if (flag & IO_NDELAY) {
834 		/* adjust for data copied in but not written */
835 		uio->uio_resid += cc;
836 		error = cnt == 0 ? EWOULDBLOCK : 0;
837 		goto out;
838 	}
839 	error = cv_wait_sig(&tp->t_rawcvf, &tty_lock);
840 	mutex_spin_exit(&tty_lock);
841 	if (error != 0) {
842 		/* adjust for data copied in but not written */
843 		uio->uio_resid += cc;
844 		return error;
845 	}
846 	goto again;
847 
848 out:
849 	mutex_spin_exit(&tty_lock);
850 	return error;
851 }
852 
853 int
854 ptcpoll(dev_t dev, int events, struct lwp *l)
855 {
856 	struct pt_softc *pti = pt_softc[minor(dev)];
857 	struct tty *tp = pti->pt_tty;
858 	int revents = 0;
859 
860 	mutex_spin_enter(&tty_lock);
861 
862 	if (events & (POLLIN | POLLRDNORM))
863 		if (ISSET(tp->t_state, TS_ISOPEN) &&
864 		    ((tp->t_outq.c_cc > 0 && !ISSET(tp->t_state, TS_TTSTOP)) ||
865 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
866 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)))
867 			revents |= events & (POLLIN | POLLRDNORM);
868 
869 	if (events & (POLLOUT | POLLWRNORM))
870 		if (ISSET(tp->t_state, TS_ISOPEN) &&
871 		    ((pti->pt_flags & PF_REMOTE) ?
872 		     (tp->t_canq.c_cc == 0) :
873 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG-2) ||
874 		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON)))))
875 			revents |= events & (POLLOUT | POLLWRNORM);
876 
877 	if (events & POLLHUP)
878 		if (!ISSET(tp->t_state, TS_CARR_ON))
879 			revents |= POLLHUP;
880 
881 	if (revents == 0) {
882 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
883 			selrecord(l, &pti->pt_selr);
884 
885 		if (events & (POLLOUT | POLLWRNORM))
886 			selrecord(l, &pti->pt_selw);
887 	}
888 
889 	mutex_spin_exit(&tty_lock);
890 
891 	return revents;
892 }
893 
894 static void
895 filt_ptcrdetach(struct knote *kn)
896 {
897 	struct pt_softc *pti;
898 
899 	pti = kn->kn_hook;
900 
901 	mutex_spin_enter(&tty_lock);
902 	SLIST_REMOVE(&pti->pt_selr.sel_klist, kn, knote, kn_selnext);
903 	mutex_spin_exit(&tty_lock);
904 }
905 
906 static int
907 filt_ptcread(struct knote *kn, long hint)
908 {
909 	struct pt_softc *pti;
910 	struct tty	*tp;
911 	int canread;
912 
913 	pti = kn->kn_hook;
914 	tp = pti->pt_tty;
915 
916 	if ((hint & NOTE_SUBMIT) == 0) {
917 		mutex_spin_enter(&tty_lock);
918 	}
919 
920 	canread = (ISSET(tp->t_state, TS_ISOPEN) &&
921 		    ((tp->t_outq.c_cc > 0 && !ISSET(tp->t_state, TS_TTSTOP)) ||
922 		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
923 		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)));
924 
925 	if (canread) {
926 		/*
927 		 * c_cc is number of characters after output post-processing;
928 		 * the amount of data actually read(2) depends on
929 		 * setting of input flags for the terminal.
930 		 */
931 		kn->kn_data = tp->t_outq.c_cc;
932 		if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
933 		    ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))
934 			kn->kn_data++;
935 	}
936 
937 	if ((hint & NOTE_SUBMIT) == 0) {
938 		mutex_spin_exit(&tty_lock);
939 	}
940 
941 	return canread;
942 }
943 
944 static void
945 filt_ptcwdetach(struct knote *kn)
946 {
947 	struct pt_softc *pti;
948 
949 	pti = kn->kn_hook;
950 
951 	mutex_spin_enter(&tty_lock);
952 	SLIST_REMOVE(&pti->pt_selw.sel_klist, kn, knote, kn_selnext);
953 	mutex_spin_exit(&tty_lock);
954 }
955 
956 static int
957 filt_ptcwrite(struct knote *kn, long hint)
958 {
959 	struct pt_softc *pti;
960 	struct tty	*tp;
961 	int canwrite;
962 	int nwrite;
963 
964 	pti = kn->kn_hook;
965 	tp = pti->pt_tty;
966 
967 	if ((hint & NOTE_SUBMIT) == 0) {
968 		mutex_spin_enter(&tty_lock);
969 	}
970 
971 	canwrite = (ISSET(tp->t_state, TS_ISOPEN) &&
972 		    ((pti->pt_flags & PF_REMOTE) ?
973 		     (tp->t_canq.c_cc == 0) :
974 		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG-2) ||
975 		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON)))));
976 
977 	if (canwrite) {
978 		if (pti->pt_flags & PF_REMOTE)
979 			nwrite = tp->t_canq.c_cn;
980 		else {
981 			/* this is guaranteed to be > 0 due to above check */
982 			nwrite = tp->t_canq.c_cn
983 				- (tp->t_rawq.c_cc + tp->t_canq.c_cc);
984 		}
985 		kn->kn_data = nwrite;
986 	}
987 
988 	if ((hint & NOTE_SUBMIT) == 0) {
989 		mutex_spin_exit(&tty_lock);
990 	}
991 
992 	return canwrite;
993 }
994 
995 static const struct filterops ptcread_filtops =
996 	{ 1, NULL, filt_ptcrdetach, filt_ptcread };
997 static const struct filterops ptcwrite_filtops =
998 	{ 1, NULL, filt_ptcwdetach, filt_ptcwrite };
999 
1000 int
1001 ptckqfilter(dev_t dev, struct knote *kn)
1002 {
1003 	struct pt_softc *pti = pt_softc[minor(dev)];
1004 	struct klist	*klist;
1005 
1006 	switch (kn->kn_filter) {
1007 	case EVFILT_READ:
1008 		klist = &pti->pt_selr.sel_klist;
1009 		kn->kn_fop = &ptcread_filtops;
1010 		break;
1011 	case EVFILT_WRITE:
1012 		klist = &pti->pt_selw.sel_klist;
1013 		kn->kn_fop = &ptcwrite_filtops;
1014 		break;
1015 	default:
1016 		return EINVAL;
1017 	}
1018 
1019 	kn->kn_hook = pti;
1020 
1021 	mutex_spin_enter(&tty_lock);
1022 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1023 	mutex_spin_exit(&tty_lock);
1024 
1025 	return 0;
1026 }
1027 
1028 struct tty *
1029 ptytty(dev_t dev)
1030 {
1031 	struct pt_softc *pti = pt_softc[minor(dev)];
1032 	struct tty *tp = pti->pt_tty;
1033 
1034 	return tp;
1035 }
1036 
1037 /*ARGSUSED*/
1038 int
1039 ptyioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
1040 {
1041 	struct pt_softc *pti = pt_softc[minor(dev)];
1042 	struct tty *tp = pti->pt_tty;
1043 	const struct cdevsw *cdev;
1044 	u_char *cc = tp->t_cc;
1045 	int stop, error, sig;
1046 #ifndef NO_DEV_PTM
1047 	struct mount *mp;
1048 #endif
1049 
1050 	/*
1051 	 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1052 	 * ttywflush(tp) will hang if there are characters in the outq.
1053 	 */
1054 	if (cmd == TIOCEXT) {
1055 		/*
1056 		 * When the EXTPROC bit is being toggled, we need
1057 		 * to send an TIOCPKT_IOCTL if the packet driver
1058 		 * is turned on.
1059 		 */
1060 		if (*(int *)data) {
1061 			if (pti->pt_flags & PF_PKT) {
1062 				pti->pt_send |= TIOCPKT_IOCTL;
1063 				ptcwakeup(tp, FREAD);
1064 			}
1065 			SET(tp->t_lflag, EXTPROC);
1066 		} else {
1067 			if (ISSET(tp->t_lflag, EXTPROC) &&
1068 			    (pti->pt_flags & PF_PKT)) {
1069 				pti->pt_send |= TIOCPKT_IOCTL;
1070 				ptcwakeup(tp, FREAD);
1071 			}
1072 			CLR(tp->t_lflag, EXTPROC);
1073 		}
1074 		return(0);
1075 	}
1076 
1077 #ifndef NO_DEV_PTM
1078 	/* Allow getting the name from either the master or the slave */
1079 	if (cmd == TIOCPTSNAME) {
1080 		if ((error = pty_getmp(l, &mp)) != 0)
1081 			return error;
1082 		return pty_fill_ptmget(l, dev, -1, -1, data, mp);
1083 	}
1084 #endif
1085 
1086 	cdev = cdevsw_lookup(dev);
1087 	if (cdev != NULL && cdev->d_open == ptcopen)
1088 		switch (cmd) {
1089 #ifndef NO_DEV_PTM
1090 		case TIOCGRANTPT:
1091 			if ((error = pty_getmp(l, &mp)) != 0)
1092 				return error;
1093 			return pty_grant_slave(l, dev, mp);
1094 #endif
1095 
1096 		case TIOCGPGRP:
1097 			/*
1098 			 * We avoid calling ttioctl on the controller since,
1099 			 * in that case, tp must be the controlling terminal.
1100 			 */
1101 			*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1102 			return 0;
1103 
1104 		case TIOCPKT:
1105 			if (*(int *)data) {
1106 				if (pti->pt_flags & PF_UCNTL)
1107 					return EINVAL;
1108 				pti->pt_flags |= PF_PKT;
1109 			} else
1110 				pti->pt_flags &= ~PF_PKT;
1111 			return 0;
1112 
1113 		case TIOCUCNTL:
1114 			if (*(int *)data) {
1115 				if (pti->pt_flags & PF_PKT)
1116 					return EINVAL;
1117 				pti->pt_flags |= PF_UCNTL;
1118 			} else
1119 				pti->pt_flags &= ~PF_UCNTL;
1120 			return 0;
1121 
1122 		case TIOCREMOTE:
1123 			if (*(int *)data)
1124 				pti->pt_flags |= PF_REMOTE;
1125 			else
1126 				pti->pt_flags &= ~PF_REMOTE;
1127 			mutex_spin_enter(&tty_lock);
1128 			ttyflush(tp, FREAD|FWRITE);
1129 			mutex_spin_exit(&tty_lock);
1130 			return 0;
1131 
1132 		case TIOCSETP:
1133 		case TIOCSETN:
1134 		case TIOCSETD:
1135 		case TIOCSETA:
1136 		case TIOCSETAW:
1137 		case TIOCSETAF:
1138 			mutex_spin_enter(&tty_lock);
1139 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
1140 			mutex_spin_exit(&tty_lock);
1141 			break;
1142 
1143 		case TIOCSIG:
1144 			sig = (int)(long)*(void **)data;
1145 			if (sig <= 0 || sig >= NSIG)
1146 				return EINVAL;
1147 			mutex_spin_enter(&tty_lock);
1148 			if (!ISSET(tp->t_lflag, NOFLSH))
1149 				ttyflush(tp, FREAD|FWRITE);
1150 			tp->t_state |= TS_SIGINFO;
1151 			ttysig(tp, TTYSIG_PG1, sig);
1152 			mutex_spin_exit(&tty_lock);
1153 			return 0;
1154 
1155 		case FIONREAD:
1156 			mutex_spin_enter(&tty_lock);
1157 			*(int *)data = tp->t_outq.c_cc;
1158 			mutex_spin_exit(&tty_lock);
1159 			return 0;
1160 		}
1161 
1162 	error = (*tp->t_linesw->l_ioctl)(tp, cmd, data, flag, l);
1163 	if (error == EPASSTHROUGH)
1164 		 error = ttioctl(tp, cmd, data, flag, l);
1165 	if (error == EPASSTHROUGH) {
1166 		if (pti->pt_flags & PF_UCNTL &&
1167 		    (cmd & ~0xff) == UIOCCMD(0)) {
1168 			if (cmd & 0xff) {
1169 				pti->pt_ucntl = (u_char)cmd;
1170 				ptcwakeup(tp, FREAD);
1171 			}
1172 			return 0;
1173 		}
1174 	}
1175 	/*
1176 	 * If external processing and packet mode send ioctl packet.
1177 	 */
1178 	if (ISSET(tp->t_lflag, EXTPROC) && (pti->pt_flags & PF_PKT)) {
1179 		switch(cmd) {
1180 		case TIOCSETA:
1181 		case TIOCSETAW:
1182 		case TIOCSETAF:
1183 		case TIOCSETP:
1184 		case TIOCSETN:
1185 		case TIOCSETC:
1186 		case TIOCSLTC:
1187 		case TIOCLBIS:
1188 		case TIOCLBIC:
1189 		case TIOCLSET:
1190 			pti->pt_send |= TIOCPKT_IOCTL;
1191 			ptcwakeup(tp, FREAD);
1192 		default:
1193 			break;
1194 		}
1195 	}
1196 	stop = ISSET(tp->t_iflag, IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1197 		&& CCEQ(cc[VSTART], CTRL('q'));
1198 	if (pti->pt_flags & PF_NOSTOP) {
1199 		if (stop) {
1200 			pti->pt_send &= ~TIOCPKT_NOSTOP;
1201 			pti->pt_send |= TIOCPKT_DOSTOP;
1202 			pti->pt_flags &= ~PF_NOSTOP;
1203 			ptcwakeup(tp, FREAD);
1204 		}
1205 	} else {
1206 		if (!stop) {
1207 			pti->pt_send &= ~TIOCPKT_DOSTOP;
1208 			pti->pt_send |= TIOCPKT_NOSTOP;
1209 			pti->pt_flags |= PF_NOSTOP;
1210 			ptcwakeup(tp, FREAD);
1211 		}
1212 	}
1213 	return error;
1214 }
1215