bsd/kern/tty_ptmx.c

   1 /*
   2  * Copyright (c) 1997-2019 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1982, 1986, 1989, 1993
  30  *      The Regents of the University of California.  All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. All advertising materials mentioning features or use of this software
  41  *    must display the following acknowledgement:
  42  *      This product includes software developed by the University of
  43  *      California, Berkeley and its contributors.
  44  * 4. Neither the name of the University nor the names of its contributors
  45  *    may be used to endorse or promote products derived from this software
  46  *    without specific prior written permission.
  47  *
  48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  58  * SUCH DAMAGE.
  59  *
  60  *      @(#)tty_pty.c   8.4 (Berkeley) 2/20/95
  61  */
  62
  63 /*
  64  * Pseudo-teletype Driver
  65  * (Actually two drivers, requiring two entries in 'cdevsw')
  66  */
  67 #include "pty.h"                /* XXX */
  68
  69 #include <sys/param.h>
  70 #include <sys/systm.h>
  71 #include <sys/ioctl.h>
  72 #include <sys/proc_internal.h>
  73 #include <sys/kauth.h>
  74 #include <sys/tty.h>
  75 #include <sys/conf.h>
  76 #include <sys/file_internal.h>
  77 #include <sys/uio_internal.h>
  78 #include <sys/kernel.h>
  79 #include <sys/vnode.h>
  80 #include <sys/user.h>
  81 #include <sys/signalvar.h>
  82 #include <sys/sysctl.h>
  83 #include <miscfs/devfs/devfs.h>
  84 #include <miscfs/devfs/devfsdefs.h>     /* DEVFS_LOCK()/DEVFS_UNLOCK() */
  85 #include <libkern/section_keywords.h>
  86
  87 #if CONFIG_MACF
  88 #include <security/mac_framework.h>
  89 #endif
  90
  91 #include "tty_dev.h"
  92
  93 /*
  94  * Forward declarations
  95  */
  96 int ptmx_init(int n_ptys);
  97 static struct ptmx_ioctl *ptmx_get_ioctl(int minor, int open_flag);
  98 static int ptmx_free_ioctl(int minor, int open_flag);
  99 static int ptmx_get_name(int minor, char *buffer, size_t size);
 100 static void ptsd_revoke_knotes(int minor, struct tty *tp);
 101
 102 extern  d_open_t        ptsopen;
 103 extern  d_close_t       ptsclose;
 104 extern  d_read_t        ptsread;
 105 extern  d_write_t       ptswrite;
 106 extern  d_ioctl_t       ptyioctl;
 107 extern  d_stop_t        ptsstop;
 108 extern  d_reset_t       ptsreset;
 109 extern  d_select_t      ptsselect;
 110
 111 extern  d_open_t        ptcopen;
 112 extern  d_close_t       ptcclose;
 113 extern  d_read_t        ptcread;
 114 extern  d_write_t       ptcwrite;
 115 extern  d_stop_t        ptcstop;
 116 extern  d_reset_t       ptcreset;
 117 extern  d_select_t      ptcselect;
 118
 119 static int ptmx_major;          /* dynamically assigned major number */
 120 static const struct cdevsw ptmx_cdev = {
 121         .d_open       = ptcopen,
 122         .d_close      = ptcclose,
 123         .d_read       = ptcread,
 124         .d_write      = ptcwrite,
 125         .d_ioctl      = ptyioctl,
 126         .d_stop       = ptcstop,
 127         .d_reset      = ptcreset,
 128         .d_ttys       = NULL,
 129         .d_select     = ptcselect,
 130         .d_mmap       = eno_mmap,
 131         .d_strategy   = eno_strat,
 132         .d_reserved_1 = eno_getc,
 133         .d_reserved_2 = eno_putc,
 134         .d_type       = D_TTY
 135 };
 136
 137 static int ptsd_major;          /* dynamically assigned major number */
 138 static const struct cdevsw ptsd_cdev = {
 139         .d_open       = ptsopen,
 140         .d_close      = ptsclose,
 141         .d_read       = ptsread,
 142         .d_write      = ptswrite,
 143         .d_ioctl      = ptyioctl,
 144         .d_stop       = ptsstop,
 145         .d_reset      = ptsreset,
 146         .d_ttys       = NULL,
 147         .d_select     = ptsselect,
 148         .d_mmap       = eno_mmap,
 149         .d_strategy   = eno_strat,
 150         .d_reserved_1 = eno_getc,
 151         .d_reserved_2 = eno_putc,
 152         .d_type       = D_TTY
 153 };
 154
 155 /*
 156  * ptmx == /dev/ptmx
 157  * ptsd == /dev/pts[0123456789]{3}
 158  */
 159 #define PTMX_TEMPLATE   "ptmx"
 160 #define PTSD_TEMPLATE   "ttys%03d"
 161
 162 /*
 163  * System-wide limit on the max number of cloned ptys
 164  */
 165 #define PTMX_MAX_DEFAULT        511     /* 512 entries */
 166 #define PTMX_MAX_HARD           999     /* 1000 entries, due to PTSD_TEMPLATE */
 167
 168 static int ptmx_max = PTMX_MAX_DEFAULT; /* default # of clones we allow */
 169
 170 /* Range enforcement for the sysctl */
 171 static int
 172 sysctl_ptmx_max(__unused struct sysctl_oid *oidp, __unused void *arg1,
 173     __unused int arg2, struct sysctl_req *req)
 174 {
 175         int new_value, changed;
 176         int error = sysctl_io_number(req, ptmx_max, sizeof(int), &new_value, &changed);
 177         if (changed) {
 178                 if (new_value > 0 && new_value <= PTMX_MAX_HARD) {
 179                         ptmx_max = new_value;
 180                 } else {
 181                         error = EINVAL;
 182                 }
 183         }
 184         return error;
 185 }
 186
 187 SYSCTL_NODE(_kern, KERN_TTY, tty, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "TTY");
 188 SYSCTL_PROC(_kern_tty, OID_AUTO, ptmx_max,
 189     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
 190     &ptmx_max, 0, &sysctl_ptmx_max, "I", "ptmx_max");
 191
 192 static int      ptmx_clone(dev_t dev, int minor);
 193
 194 static struct tty_dev_t _ptmx_driver;
 195
 196 int
 197 ptmx_init( __unused int config_count)
 198 {
 199         /*
 200          * We start looking at slot 10, since there are inits that will
 201          * stomp explicit slots (e.g. vndevice stomps 1) below that.
 202          */
 203
 204         /* Get a major number for /dev/ptmx */
 205         if ((ptmx_major = cdevsw_add(-15, &ptmx_cdev)) == -1) {
 206                 printf("ptmx_init: failed to obtain /dev/ptmx major number\n");
 207                 return ENOENT;
 208         }
 209
 210         if (cdevsw_setkqueueok(ptmx_major, &ptmx_cdev, CDEVSW_IS_PTC) == -1) {
 211                 panic("Failed to set flags on ptmx cdevsw entry.");
 212         }
 213
 214         /* Get a major number for /dev/pts/nnn */
 215         if ((ptsd_major = cdevsw_add(-15, &ptsd_cdev)) == -1) {
 216                 (void)cdevsw_remove(ptmx_major, &ptmx_cdev);
 217                 printf("ptmx_init: failed to obtain /dev/ptmx major number\n");
 218                 return ENOENT;
 219         }
 220
 221         if (cdevsw_setkqueueok(ptsd_major, &ptsd_cdev, CDEVSW_IS_PTS) == -1) {
 222                 panic("Failed to set flags on ptmx cdevsw entry.");
 223         }
 224
 225         /* Create the /dev/ptmx device {<major>,0} */
 226         (void)devfs_make_node_clone(makedev(ptmx_major, 0),
 227             DEVFS_CHAR, UID_ROOT, GID_TTY, 0666,
 228             ptmx_clone, PTMX_TEMPLATE);
 229
 230         _ptmx_driver.master = ptmx_major;
 231         _ptmx_driver.slave = ptsd_major;
 232         _ptmx_driver.fix_7828447 = 1;
 233         _ptmx_driver.fix_7070978 = 1;
 234 #if CONFIG_MACF
 235         _ptmx_driver.mac_notify = 1;
 236 #endif
 237         _ptmx_driver.open = &ptmx_get_ioctl;
 238         _ptmx_driver.free = &ptmx_free_ioctl;
 239         _ptmx_driver.name = &ptmx_get_name;
 240         _ptmx_driver.revoke = &ptsd_revoke_knotes;
 241         tty_dev_register(&_ptmx_driver);
 242
 243         return 0;
 244 }
 245
 246
 247 static struct _ptmx_ioctl_state {
 248         struct ptmx_ioctl       **pis_ioctl_list;       /* pointer vector */
 249         int                     pis_total;              /* total slots */
 250         int                     pis_free;               /* free slots */
 251 } _state;
 252 #define PTMX_GROW_VECTOR        16      /* Grow by this many slots at a time */
 253
 254 /*
 255  * Given a minor number, return the corresponding structure for that minor
 256  * number.  If there isn't one, and the create flag is specified, we create
 257  * one if possible.
 258  *
 259  * Parameters:  minor                   Minor number of ptmx device
 260  *              open_flag               PF_OPEN_M       First open of master
 261  *                                      PF_OPEN_S       First open of slave
 262  *                                      0               Just want ioctl struct
 263  *
 264  * Returns:     NULL                    Did not exist/could not create
 265  *              !NULL                   structure corresponding minor number
 266  *
 267  * Locks:       tty_lock() on ptmx_ioctl->pt_tty NOT held on entry or exit.
 268  */
 269 static struct ptmx_ioctl *
 270 ptmx_get_ioctl(int minor, int open_flag)
 271 {
 272         struct ptmx_ioctl *ptmx_ioctl = NULL;
 273
 274         if (open_flag & PF_OPEN_M) {
 275                 struct ptmx_ioctl *new_ptmx_ioctl;
 276
 277                 DEVFS_LOCK();
 278                 /*
 279                  * If we are about to allocate more memory, but we have
 280                  * already hit the administrative limit, then fail the
 281                  * operation.
 282                  *
 283                  * Note:        Subtract free from total when making this
 284                  *              check to allow unit increments, rather than
 285                  *              snapping to the nearest PTMX_GROW_VECTOR...
 286                  */
 287                 if ((_state.pis_total - _state.pis_free) >= ptmx_max) {
 288                         DEVFS_UNLOCK();
 289                         return NULL;
 290                 }
 291                 DEVFS_UNLOCK();
 292
 293                 MALLOC(new_ptmx_ioctl, struct ptmx_ioctl *, sizeof(struct ptmx_ioctl), M_TTYS, M_WAITOK | M_ZERO);
 294                 if (new_ptmx_ioctl == NULL) {
 295                         return NULL;
 296                 }
 297
 298                 if ((new_ptmx_ioctl->pt_tty = ttymalloc()) == NULL) {
 299                         FREE(new_ptmx_ioctl, M_TTYS);
 300                         return NULL;
 301                 }
 302
 303                 /*
 304                  * Hold the DEVFS_LOCK() over this whole operation; devfs
 305                  * itself does this over malloc/free as well, so this should
 306                  * be safe to do.  We hold it longer than we want to, but
 307                  * doing so avoids a reallocation race on the minor number.
 308                  */
 309                 DEVFS_LOCK();
 310
 311                 /*
 312                  * Check again to ensure the limit is not reached after initial check
 313                  * when the lock was dropped momentarily for malloc.
 314                  */
 315                 if ((_state.pis_total - _state.pis_free) >= ptmx_max) {
 316                         ttyfree(new_ptmx_ioctl->pt_tty);
 317                         DEVFS_UNLOCK();
 318                         FREE(new_ptmx_ioctl, M_TTYS);
 319                         return NULL;
 320                 }
 321
 322                 /* Need to allocate a larger vector? */
 323                 if (_state.pis_free == 0) {
 324                         struct ptmx_ioctl **new_pis_ioctl_list;
 325                         struct ptmx_ioctl **old_pis_ioctl_list = NULL;
 326
 327                         /* Yes. */
 328                         MALLOC(new_pis_ioctl_list, struct ptmx_ioctl **, sizeof(struct ptmx_ioctl *) * (_state.pis_total + PTMX_GROW_VECTOR), M_TTYS, M_WAITOK | M_ZERO);
 329                         if (new_pis_ioctl_list == NULL) {
 330                                 ttyfree(new_ptmx_ioctl->pt_tty);
 331                                 DEVFS_UNLOCK();
 332                                 FREE(new_ptmx_ioctl, M_TTYS);
 333                                 return NULL;
 334                         }
 335
 336                         /* If this is not the first time, copy the old over */
 337                         bcopy(_state.pis_ioctl_list, new_pis_ioctl_list, sizeof(struct ptmx_ioctl *) * _state.pis_total);
 338                         old_pis_ioctl_list = _state.pis_ioctl_list;
 339                         _state.pis_ioctl_list = new_pis_ioctl_list;
 340                         _state.pis_free += PTMX_GROW_VECTOR;
 341                         _state.pis_total += PTMX_GROW_VECTOR;
 342                         if (old_pis_ioctl_list) {
 343                                 FREE(old_pis_ioctl_list, M_TTYS);
 344                         }
 345                 }
 346
 347                 /* is minor in range now? */
 348                 if (minor < 0 || minor >= _state.pis_total) {
 349                         ttyfree(new_ptmx_ioctl->pt_tty);
 350                         DEVFS_UNLOCK();
 351                         FREE(new_ptmx_ioctl, M_TTYS);
 352                         return NULL;
 353                 }
 354
 355                 if (_state.pis_ioctl_list[minor] != NULL) {
 356                         ttyfree(new_ptmx_ioctl->pt_tty);
 357                         DEVFS_UNLOCK();
 358                         FREE(new_ptmx_ioctl, M_TTYS);
 359
 360                         /* Special error value so we know to redrive the open, we've been raced */
 361                         return (struct ptmx_ioctl*)-1;
 362                 }
 363
 364                 /* Vector is large enough; grab a new ptmx_ioctl */
 365
 366                 /* Now grab a free slot... */
 367                 _state.pis_ioctl_list[minor] = new_ptmx_ioctl;
 368
 369                 /* reduce free count */
 370                 _state.pis_free--;
 371
 372                 _state.pis_ioctl_list[minor]->pt_flags |= PF_OPEN_M;
 373                 DEVFS_UNLOCK();
 374
 375                 /* Create the /dev/ttysXXX device {<major>,XXX} */
 376                 _state.pis_ioctl_list[minor]->pt_devhandle = devfs_make_node(
 377                         makedev(ptsd_major, minor),
 378                         DEVFS_CHAR, UID_ROOT, GID_TTY, 0620,
 379                         PTSD_TEMPLATE, minor);
 380                 if (_state.pis_ioctl_list[minor]->pt_devhandle == NULL) {
 381                         printf("devfs_make_node() call failed for ptmx_get_ioctl()!!!!\n");
 382                 }
 383         }
 384
 385         /*
 386          * Lock is held here to protect race when the 'pis_ioctl_list' array is
 387          * being reallocated to increase its slots.
 388          */
 389         DEVFS_LOCK();
 390         if (minor >= 0 && minor < _state.pis_total) {
 391                 ptmx_ioctl = _state.pis_ioctl_list[minor];
 392         }
 393         DEVFS_UNLOCK();
 394
 395         return ptmx_ioctl;
 396 }
 397
 398 /*
 399  * Locks:       tty_lock() of old_ptmx_ioctl->pt_tty NOT held for this call.
 400  */
 401 static int
 402 ptmx_free_ioctl(int minor, int open_flag)
 403 {
 404         struct ptmx_ioctl *old_ptmx_ioctl = NULL;
 405
 406         DEVFS_LOCK();
 407
 408         if (minor < 0 || minor >= _state.pis_total) {
 409                 DEVFS_UNLOCK();
 410                 return -1;
 411         }
 412
 413         _state.pis_ioctl_list[minor]->pt_flags &= ~(open_flag);
 414
 415         /*
 416          * Was this the last close?  We will recognize it because we only get
 417          * a notification on the last close of a device, and we will have
 418          * cleared both the master and the slave open bits in the flags.
 419          */
 420         if (!(_state.pis_ioctl_list[minor]->pt_flags & (PF_OPEN_M | PF_OPEN_S))) {
 421                 /* Mark as free so it can be reallocated later */
 422                 old_ptmx_ioctl = _state.pis_ioctl_list[minor];
 423                 _state.pis_ioctl_list[minor] = NULL;
 424                 _state.pis_free++;
 425         }
 426         DEVFS_UNLOCK();
 427
 428         /* Free old after dropping lock */
 429         if (old_ptmx_ioctl != NULL) {
 430                 /*
 431                  * XXX See <rdar://5348651> and <rdar://4854638>
 432                  *
 433                  * XXX Conditional to be removed when/if tty/pty reference
 434                  * XXX counting and mutex implemented.
 435                  */
 436                 if (old_ptmx_ioctl->pt_devhandle != NULL) {
 437                         devfs_remove(old_ptmx_ioctl->pt_devhandle);
 438                 }
 439                 ttyfree(old_ptmx_ioctl->pt_tty);
 440                 FREE(old_ptmx_ioctl, M_TTYS);
 441         }
 442
 443         return 0;     /* Success */
 444 }
 445
 446 static int
 447 ptmx_get_name(int minor, char *buffer, size_t size)
 448 {
 449         return snprintf(buffer, size, "/dev/" PTSD_TEMPLATE, minor);
 450 }
 451
 452
 453
 454 /*
 455  * Given the dev entry that's being opened, we clone the device.  This driver
 456  * doesn't actually use the dev entry, since we alreaqdy know who we are by
 457  * being called from this code.  This routine is a callback registered from
 458  * devfs_make_node_clone() in ptmx_init(); it's purpose is to provide a new
 459  * minor number, or to return -1, if one can't be provided.
 460  *
 461  * Parameters:  dev                     The device we are cloning from
 462  *
 463  * Returns:     >= 0                    A new minor device number
 464  *              -1                      Error: ENOMEM ("Can't alloc device")
 465  *
 466  * NOTE:        Called with DEVFS_LOCK() held
 467  */
 468 static int
 469 ptmx_clone(__unused dev_t dev, int action)
 470 {
 471         int i;
 472
 473         if (action == DEVFS_CLONE_ALLOC) {
 474                 /* First one */
 475                 if (_state.pis_total == 0) {
 476                         return 0;
 477                 }
 478
 479                 /*
 480                  * Note: We can add hinting on free slots, if this linear search
 481                  * ends up being a performance bottleneck...
 482                  */
 483                 for (i = 0; i < _state.pis_total; i++) {
 484                         if (_state.pis_ioctl_list[i] == NULL) {
 485                                 break;
 486                         }
 487                 }
 488
 489                 /*
 490                  * XXX We fall off the end here; if we did this twice at the
 491                  * XXX same time, we could return the same minor to two
 492                  * XXX callers; we should probably exand the pointer vector
 493                  * XXX here, but I need more information on the MALLOC/FREE
 494                  * XXX locking to ensure against a deadlock.  Maybe we can
 495                  * XXX just high watermark it at 1/2 of PTMX_GROW_VECTOR?
 496                  * XXX That would require returning &minor as implict return
 497                  * XXX and an error code ("EAGAIN/ERESTART") or 0 as our
 498                  * XXX explicit return.
 499                  */
 500
 501                 return i;     /* empty slot or next slot */
 502         }
 503         return -1;
 504 }
 505
 506
 507 /*
 508  * kqueue support.
 509  */
 510 int ptsd_kqfilter(dev_t dev, struct knote *kn);
 511 static void ptsd_kqops_detach(struct knote *);
 512 static int ptsd_kqops_event(struct knote *, long);
 513 static int ptsd_kqops_touch(struct knote *kn, struct kevent_qos_s *kev);
 514 static int ptsd_kqops_process(struct knote *kn, struct kevent_qos_s *kev);
 515
 516 SECURITY_READ_ONLY_EARLY(struct filterops) ptsd_kqops = {
 517         .f_isfd = 1,
 518         /* attach is handled by ptsd_kqfilter -- the dev node must be passed in */
 519         .f_detach = ptsd_kqops_detach,
 520         .f_event = ptsd_kqops_event,
 521         .f_touch = ptsd_kqops_touch,
 522         .f_process = ptsd_kqops_process,
 523 };
 524
 525 /*
 526  * In the normal case, by the time the driver_close() routine is called
 527  * on the slave, all knotes have been detached.  However in the revoke(2)
 528  * case, the driver's close routine is called while there are knotes active
 529  * that reference the handlers below.  And we have no obvious means to
 530  * reach from the driver out to the kqueue's that reference them to get
 531  * them to stop.
 532  */
 533
 534 static void
 535 ptsd_kqops_detach(struct knote *kn)
 536 {
 537         struct tty *tp = kn->kn_hook;
 538
 539         tty_lock(tp);
 540
 541         /*
 542          * Only detach knotes from open ttys -- ttyclose detaches all knotes
 543          * under the lock and unsets TS_ISOPEN.
 544          */
 545         if (tp->t_state & TS_ISOPEN) {
 546                 switch (kn->kn_filter) {
 547                 case EVFILT_READ:
 548                         KNOTE_DETACH(&tp->t_rsel.si_note, kn);
 549                         break;
 550                 case EVFILT_WRITE:
 551                         KNOTE_DETACH(&tp->t_wsel.si_note, kn);
 552                         break;
 553                 default:
 554                         panic("invalid knote %p detach, filter: %d", kn, kn->kn_filter);
 555                         break;
 556                 }
 557         }
 558
 559         tty_unlock(tp);
 560         ttyfree(tp);
 561 }
 562
 563 static int
 564 ptsd_kqops_common(struct knote *kn, struct kevent_qos_s *kev, struct tty *tp)
 565 {
 566         int retval = 0;
 567         int64_t data = 0;
 568
 569         TTY_LOCK_OWNED(tp);
 570
 571         switch (kn->kn_filter) {
 572         case EVFILT_READ:
 573                 /*
 574                  * ttnread can change the tty state,
 575                  * hence must be done upfront, before any other check.
 576                  */
 577                 data = ttnread(tp);
 578                 retval = (data > 0);
 579                 break;
 580
 581         case EVFILT_WRITE:
 582                 if ((tp->t_outq.c_cc <= tp->t_lowat) &&
 583                     (tp->t_state & TS_CONNECTED)) {
 584                         data = tp->t_outq.c_cn - tp->t_outq.c_cc;
 585                         retval = 1;
 586                 }
 587                 break;
 588
 589         default:
 590                 panic("ptsd kevent: unexpected filter: %d, kn = %p, tty = %p",
 591                     kn->kn_filter, kn, tp);
 592                 break;
 593         }
 594
 595         if (tp->t_state & TS_ZOMBIE) {
 596                 kn->kn_flags |= EV_EOF;
 597         }
 598         if (kn->kn_flags & EV_EOF) {
 599                 retval = 1;
 600         }
 601         if (retval && kev) {
 602                 knote_fill_kevent(kn, kev, data);
 603         }
 604         return retval;
 605 }
 606
 607 static int
 608 ptsd_kqops_event(struct knote *kn, long hint)
 609 {
 610         struct tty *tp = kn->kn_hook;
 611         int ret;
 612
 613         TTY_LOCK_OWNED(tp);
 614
 615         if (hint & NOTE_REVOKE) {
 616                 kn->kn_flags |= EV_EOF | EV_ONESHOT;
 617                 ret = 1;
 618         } else {
 619                 ret = ptsd_kqops_common(kn, NULL, tp);
 620         }
 621
 622         return ret;
 623 }
 624
 625 static int
 626 ptsd_kqops_touch(struct knote *kn, struct kevent_qos_s *kev)
 627 {
 628         struct tty *tp = kn->kn_hook;
 629         int ret;
 630
 631         tty_lock(tp);
 632
 633         /* accept new kevent state */
 634         kn->kn_sfflags = kev->fflags;
 635         kn->kn_sdata = kev->data;
 636
 637         /* recapture fired state of knote */
 638         ret = ptsd_kqops_common(kn, NULL, tp);
 639
 640         tty_unlock(tp);
 641
 642         return ret;
 643 }
 644
 645 static int
 646 ptsd_kqops_process(struct knote *kn, struct kevent_qos_s *kev)
 647 {
 648         struct tty *tp = kn->kn_hook;
 649         int ret;
 650
 651         tty_lock(tp);
 652         ret = ptsd_kqops_common(kn, kev, tp);
 653         tty_unlock(tp);
 654
 655         return ret;
 656 }
 657
 658 int
 659 ptsd_kqfilter(dev_t dev, struct knote *kn)
 660 {
 661         struct tty *tp = NULL;
 662         struct ptmx_ioctl *pti = NULL;
 663         int ret;
 664
 665         /* make sure we're talking about the right device type */
 666         if (cdevsw[major(dev)].d_open != ptsopen) {
 667                 knote_set_error(kn, ENODEV);
 668                 return 0;
 669         }
 670
 671         if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
 672                 knote_set_error(kn, ENXIO);
 673                 return 0;
 674         }
 675
 676         tp = pti->pt_tty;
 677         tty_lock(tp);
 678
 679         assert(tp->t_state & TS_ISOPEN);
 680
 681         kn->kn_filtid = EVFILTID_PTSD;
 682         /* the tty will be freed when detaching the knote */
 683         ttyhold(tp);
 684         kn->kn_hook = tp;
 685
 686         switch (kn->kn_filter) {
 687         case EVFILT_READ:
 688                 KNOTE_ATTACH(&tp->t_rsel.si_note, kn);
 689                 break;
 690         case EVFILT_WRITE:
 691                 KNOTE_ATTACH(&tp->t_wsel.si_note, kn);
 692                 break;
 693         default:
 694                 panic("ptsd kevent: unexpected filter: %d, kn = %p, tty = %p",
 695                     kn->kn_filter, kn, tp);
 696                 break;
 697         }
 698
 699         /* capture current event state */
 700         ret = ptsd_kqops_common(kn, NULL, tp);
 701
 702         tty_unlock(tp);
 703
 704         return ret;
 705 }
 706
 707 /*
 708  * Support for revoke(2).
 709  */
 710 static void
 711 ptsd_revoke_knotes(__unused int minor, struct tty *tp)
 712 {
 713         tty_lock(tp);
 714
 715         ttwakeup(tp);
 716         assert((tp->t_rsel.si_flags & SI_KNPOSTING) == 0);
 717         KNOTE(&tp->t_rsel.si_note, NOTE_REVOKE);
 718
 719         ttwwakeup(tp);
 720         assert((tp->t_wsel.si_flags & SI_KNPOSTING) == 0);
 721         KNOTE(&tp->t_wsel.si_note, NOTE_REVOKE);
 722
 723         tty_unlock(tp);
 724 }
 725
 726 /*
 727  * kevent filter routines for the master side of a pty, a ptmx.
 728  *
 729  * Stuff the ptmx_ioctl structure into the hook for ptmx knotes.  Use the
 730  * embedded tty's lock for synchronization.
 731  */
 732
 733 int ptmx_kqfilter(dev_t dev, struct knote *kn);
 734 static void ptmx_kqops_detach(struct knote *);
 735 static int ptmx_kqops_event(struct knote *, long);
 736 static int ptmx_kqops_touch(struct knote *kn, struct kevent_qos_s *kev);
 737 static int ptmx_kqops_process(struct knote *kn, struct kevent_qos_s *kev);
 738 static int ptmx_kqops_common(struct knote *kn, struct kevent_qos_s *kev,
 739     struct ptmx_ioctl *pti, struct tty *tp);
 740
 741 SECURITY_READ_ONLY_EARLY(struct filterops) ptmx_kqops = {
 742         .f_isfd = 1,
 743         /* attach is handled by ptmx_kqfilter -- the dev node must be passed in */
 744         .f_detach = ptmx_kqops_detach,
 745         .f_event = ptmx_kqops_event,
 746         .f_touch = ptmx_kqops_touch,
 747         .f_process = ptmx_kqops_process,
 748 };
 749
 750 static struct ptmx_ioctl *
 751 ptmx_knote_ioctl(struct knote *kn)
 752 {
 753         return (struct ptmx_ioctl *)kn->kn_hook;
 754 }
 755
 756 static struct tty *
 757 ptmx_knote_tty(struct knote *kn)
 758 {
 759         return ptmx_knote_ioctl(kn)->pt_tty;
 760 }
 761
 762 int
 763 ptmx_kqfilter(dev_t dev, struct knote *kn)
 764 {
 765         struct tty *tp = NULL;
 766         struct ptmx_ioctl *pti = NULL;
 767         int ret;
 768
 769         /* make sure we're talking about the right device type */
 770         if (cdevsw[major(dev)].d_open != ptcopen) {
 771                 knote_set_error(kn, ENODEV);
 772                 return 0;
 773         }
 774
 775         if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
 776                 knote_set_error(kn, ENXIO);
 777                 return 0;
 778         }
 779
 780         tp = pti->pt_tty;
 781         tty_lock(tp);
 782
 783         kn->kn_filtid = EVFILTID_PTMX;
 784         /* the tty will be freed when detaching the knote */
 785         ttyhold(tp);
 786         kn->kn_hook = pti;
 787
 788         /*
 789          * Attach to the ptmx's selinfo structures.  This is the major difference
 790          * to the ptsd filtops, which use the selinfo structures in the tty
 791          * structure.
 792          */
 793         switch (kn->kn_filter) {
 794         case EVFILT_READ:
 795                 KNOTE_ATTACH(&pti->pt_selr.si_note, kn);
 796                 break;
 797         case EVFILT_WRITE:
 798                 KNOTE_ATTACH(&pti->pt_selw.si_note, kn);
 799                 break;
 800         default:
 801                 panic("ptmx kevent: unexpected filter: %d, kn = %p, tty = %p",
 802                     kn->kn_filter, kn, tp);
 803                 break;
 804         }
 805
 806         /* capture current event state */
 807         ret = ptmx_kqops_common(kn, NULL, pti, tp);
 808
 809         tty_unlock(tp);
 810
 811         return ret;
 812 }
 813
 814 static void
 815 ptmx_kqops_detach(struct knote *kn)
 816 {
 817         struct ptmx_ioctl *pti = kn->kn_hook;
 818         struct tty *tp = pti->pt_tty;
 819
 820         tty_lock(tp);
 821
 822         switch (kn->kn_filter) {
 823         case EVFILT_READ:
 824                 KNOTE_DETACH(&pti->pt_selr.si_note, kn);
 825                 break;
 826         case EVFILT_WRITE:
 827                 KNOTE_DETACH(&pti->pt_selw.si_note, kn);
 828                 break;
 829         default:
 830                 panic("invalid knote %p detach, filter: %d", kn, kn->kn_filter);
 831                 break;
 832         }
 833
 834         tty_unlock(tp);
 835         ttyfree(tp);
 836 }
 837
 838 static int
 839 ptmx_kqops_common(struct knote *kn, struct kevent_qos_s *kev,
 840     struct ptmx_ioctl *pti, struct tty *tp)
 841 {
 842         int retval = 0;
 843         int64_t data = 0;
 844
 845         TTY_LOCK_OWNED(tp);
 846
 847         switch (kn->kn_filter) {
 848         case EVFILT_READ:
 849                 /* there's data on the TTY and it's not stopped */
 850                 if (tp->t_outq.c_cc && !(tp->t_state & TS_TTSTOP)) {
 851                         data = tp->t_outq.c_cc;
 852                         retval = data > 0;
 853                 } else if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
 854                     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)) {
 855                         retval = 1;
 856                 }
 857                 break;
 858
 859         case EVFILT_WRITE:
 860                 if (pti->pt_flags & PF_REMOTE) {
 861                         if (tp->t_canq.c_cc == 0) {
 862                                 retval = TTYHOG - 1;
 863                         }
 864                 } else {
 865                         retval = (TTYHOG - 2) - (tp->t_rawq.c_cc + tp->t_canq.c_cc);
 866                         if (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON)) {
 867                                 retval = 1;
 868                         }
 869                         if (retval < 0) {
 870                                 retval = 0;
 871                         }
 872                 }
 873                 break;
 874
 875         default:
 876                 panic("ptmx kevent: unexpected filter: %d, kn = %p, tty = %p",
 877                     kn->kn_filter, kn, tp);
 878                 break;
 879         }
 880
 881         /* disconnects should force a wakeup (EOF) */
 882         if (!(tp->t_state & TS_CONNECTED) || (tp->t_state & TS_ZOMBIE)) {
 883                 kn->kn_flags |= EV_EOF;
 884         }
 885         if (kn->kn_flags & EV_EOF) {
 886                 retval = 1;
 887         }
 888         if (retval && kev) {
 889                 knote_fill_kevent(kn, kev, data);
 890         }
 891         return retval;
 892 }
 893
 894 static int
 895 ptmx_kqops_event(struct knote *kn, long hint)
 896 {
 897         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 898         struct tty *tp = ptmx_knote_tty(kn);
 899         int ret;
 900
 901         TTY_LOCK_OWNED(tp);
 902
 903         if (hint & NOTE_REVOKE) {
 904                 kn->kn_flags |= EV_EOF | EV_ONESHOT;
 905                 ret = 1;
 906         } else {
 907                 ret = ptmx_kqops_common(kn, NULL, pti, tp);
 908         }
 909
 910         return ret;
 911 }
 912
 913 static int
 914 ptmx_kqops_touch(struct knote *kn, struct kevent_qos_s *kev)
 915 {
 916         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 917         struct tty *tp = ptmx_knote_tty(kn);
 918         int ret;
 919
 920         tty_lock(tp);
 921
 922         /* accept new kevent state */
 923         kn->kn_sfflags = kev->fflags;
 924         kn->kn_sdata = kev->data;
 925
 926         /* recapture fired state of knote */
 927         ret = ptmx_kqops_common(kn, NULL, pti, tp);
 928
 929         tty_unlock(tp);
 930
 931         return ret;
 932 }
 933
 934 static int
 935 ptmx_kqops_process(struct knote *kn, struct kevent_qos_s *kev)
 936 {
 937         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 938         struct tty *tp = ptmx_knote_tty(kn);
 939         int ret;
 940
 941         tty_lock(tp);
 942         ret = ptmx_kqops_common(kn, kev, pti, tp);
 943         tty_unlock(tp);
 944
 945         return ret;
 946 }