bsd/kern/tty_dev.c

   1 /*
   2  * Copyright (c) 1997-2013 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1982, 1986, 1989, 1993
  30  *      The Regents of the University of California.  All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. All advertising materials mentioning features or use of this software
  41  *    must display the following acknowledgement:
  42  *      This product includes software developed by the University of
  43  *      California, Berkeley and its contributors.
  44  * 4. Neither the name of the University nor the names of its contributors
  45  *    may be used to endorse or promote products derived from this software
  46  *    without specific prior written permission.
  47  *
  48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  58  * SUCH DAMAGE.
  59  *
  60  *      @(#)tty_pty.c   8.4 (Berkeley) 2/20/95
  61  */
  62
  63 /* Common callbacks for the pseudo-teletype driver (pty/tty)
  64  * and cloning pseudo-teletype driver (ptmx/pts).
  65  */
  66
  67 #include <sys/param.h>
  68 #include <sys/systm.h>
  69 #include <sys/ioctl.h>
  70 #include <sys/proc_internal.h>
  71 #include <sys/kauth.h>
  72 #include <sys/tty.h>
  73 #include <sys/conf.h>
  74 #include <sys/file_internal.h>
  75 #include <sys/uio_internal.h>
  76 #include <sys/kernel.h>
  77 #include <sys/vnode.h>
  78 #include <sys/vnode_internal.h>         /* _devfs_setattr() */
  79 #include <sys/stat.h>                   /* _devfs_setattr() */
  80 #include <sys/user.h>
  81 #include <sys/signalvar.h>
  82 #include <sys/sysctl.h>
  83 #include <miscfs/devfs/devfs.h>
  84 #include <miscfs/devfs/devfsdefs.h>     /* DEVFS_LOCK()/DEVFS_UNLOCK() */
  85
  86 #if CONFIG_MACF
  87 #include <security/mac_framework.h>
  88 #endif
  89
  90 #include "tty_dev.h"
  91
  92 /* XXX belongs in devfs somewhere - LATER */
  93 static int _devfs_setattr(void *, unsigned short, uid_t, gid_t);
  94
  95 /*
  96  * Forward declarations
  97  */
  98 static void ptcwakeup(struct tty *tp, int flag);
  99 __XNU_PRIVATE_EXTERN    d_open_t        ptsopen;
 100 __XNU_PRIVATE_EXTERN    d_close_t       ptsclose;
 101 __XNU_PRIVATE_EXTERN    d_read_t        ptsread;
 102 __XNU_PRIVATE_EXTERN    d_write_t       ptswrite;
 103 __XNU_PRIVATE_EXTERN    d_ioctl_t       ptyioctl;       /* common ioctl */
 104 __XNU_PRIVATE_EXTERN    d_stop_t        ptsstop;
 105 __XNU_PRIVATE_EXTERN    d_reset_t       ptsreset;
 106 __XNU_PRIVATE_EXTERN    d_select_t      ptsselect;
 107 __XNU_PRIVATE_EXTERN    d_open_t        ptcopen;
 108 __XNU_PRIVATE_EXTERN    d_close_t       ptcclose;
 109 __XNU_PRIVATE_EXTERN    d_read_t        ptcread;
 110 __XNU_PRIVATE_EXTERN    d_write_t       ptcwrite;
 111 __XNU_PRIVATE_EXTERN    d_stop_t        ptcstop;        /* NO-OP */
 112 __XNU_PRIVATE_EXTERN    d_reset_t       ptcreset;
 113 __XNU_PRIVATE_EXTERN    d_select_t      ptcselect;
 114
 115 /*
 116  * XXX Should be devfs function... and use VATTR mechanisms, per
 117  * XXX vnode_setattr2(); only we maybe can't really get back to the
 118  * XXX vnode here for cloning devices (but it works for *cloned* devices
 119  * XXX that are not themselves cloning).
 120  *
 121  * Returns:     0                       Success
 122  *      namei:???
 123  *      vnode_setattr:???
 124  */
 125 static int
 126 _devfs_setattr(void * handle, unsigned short mode, uid_t uid, gid_t gid)
 127 {
 128         devdirent_t             *direntp = (devdirent_t *)handle;
 129         devnode_t               *devnodep;
 130         int                     error = EACCES;
 131         vfs_context_t           ctx = vfs_context_current();;
 132         struct vnode_attr       va;
 133
 134         VATTR_INIT(&va);
 135         VATTR_SET(&va, va_uid, uid);
 136         VATTR_SET(&va, va_gid, gid);
 137         VATTR_SET(&va, va_mode, mode & ALLPERMS);
 138
 139         /*
 140          * If the TIOCPTYGRANT loses the race with the clone operation because
 141          * this function is not part of devfs, and therefore can't take the
 142          * devfs lock to protect the direntp update, then force user space to
 143          * redrive the grant request.
 144          */
 145         if (direntp == NULL || (devnodep = direntp->de_dnp) == NULL) {
 146                 error = ERESTART;
 147                 goto out;
 148         }
 149
 150         /*
 151          * Only do this if we are operating on device that doesn't clone
 152          * each time it's referenced.  We perform a lookup on the device
 153          * to insure we get the right instance.  We can't just use the call
 154          * to devfs_dntovn() to get the vp for the operation, because
 155          * dn_dvm may not have been initialized.
 156          */
 157         if (devnodep->dn_clone == NULL) {
 158                 struct nameidata nd;
 159                 char name[128];
 160
 161                 snprintf(name, sizeof(name), "/dev/%s", direntp->de_name);
 162                 NDINIT(&nd, LOOKUP, OP_SETATTR, FOLLOW, UIO_SYSSPACE, CAST_USER_ADDR_T(name), ctx);
 163                 error = namei(&nd);
 164                 if (error)
 165                         goto out;
 166                 error = vnode_setattr(nd.ni_vp, &va, ctx);
 167                 vnode_put(nd.ni_vp);
 168                 nameidone(&nd);
 169                 goto out;
 170         }
 171
 172 out:
 173         return(error);
 174 }
 175
 176 #define BUFSIZ 100              /* Chunk size iomoved to/from user */
 177
 178 static struct tty_dev_t *tty_dev_head;
 179
 180 __private_extern__ void
 181 tty_dev_register(struct tty_dev_t *driver)
 182 {
 183         if (driver) {
 184                 driver->next = tty_dev_head;
 185                 tty_dev_head = driver;
 186         }
 187 }
 188
 189 /*
 190  * Given a minor number, return the corresponding structure for that minor
 191  * number.  If there isn't one, and the create flag is specified, we create
 192  * one if possible.
 193  *
 194  * Parameters:  minor                   Minor number of ptmx device
 195  *              open_flag               PF_OPEN_M       First open of master
 196  *                                      PF_OPEN_S       First open of slave
 197  *                                      0               Just want ioctl struct
 198  *
 199  * Returns:     NULL                    Did not exist/could not create
 200  *              !NULL                   structure corresponding minor number
 201  *
 202  * Locks:       tty_lock() on ptmx_ioctl->pt_tty NOT held on entry or exit.
 203  */
 204
 205 static struct tty_dev_t *
 206 pty_get_driver(dev_t dev)
 207 {
 208         int major = major(dev);
 209         struct tty_dev_t *driver;
 210         for (driver = tty_dev_head; driver != NULL; driver = driver->next) {
 211                 if ((driver->master == major || driver->slave == major)) {
 212                         break;
 213                 }
 214         }
 215         return driver;
 216 }
 217
 218 static struct ptmx_ioctl *
 219 pty_get_ioctl(dev_t dev, int open_flag, struct tty_dev_t **out_driver)
 220 {
 221         struct tty_dev_t *driver = pty_get_driver(dev);
 222         if (out_driver) {
 223                 *out_driver = driver;
 224         }
 225         if (driver && driver->open) {
 226                 return driver->open(minor(dev), open_flag);
 227         }
 228         return NULL;
 229 }
 230
 231 /*
 232  * Locks:       tty_lock() of old_ptmx_ioctl->pt_tty NOT held for this call.
 233  */
 234 static int
 235 pty_free_ioctl(dev_t dev, int open_flag)
 236 {
 237         struct tty_dev_t *driver = pty_get_driver(dev);
 238         if (driver && driver->free) {
 239                 return driver->free(minor(dev), open_flag);
 240         }
 241         return 0;
 242 }
 243
 244 static int
 245 pty_get_name(dev_t dev, char *buffer, size_t size)
 246 {
 247         struct tty_dev_t *driver = pty_get_driver(dev);
 248         if (driver && driver->name) {
 249                 return driver->name(minor(dev), buffer, size);
 250         }
 251         return 0;
 252 }
 253
 254 __private_extern__ int
 255 ptsopen(dev_t dev, int flag, __unused int devtype, __unused struct proc *p)
 256 {
 257         int error;
 258         struct tty_dev_t *driver;
 259         struct ptmx_ioctl *pti = pty_get_ioctl(dev, PF_OPEN_S, &driver);
 260         if (pti == NULL) {
 261                 return ENXIO;
 262         }
 263         if (!(pti->pt_flags & PF_UNLOCKED)) {
 264                 return EAGAIN;
 265         }
 266
 267         struct tty *tp = pti->pt_tty;
 268         tty_lock(tp);
 269
 270         if ((tp->t_state & TS_ISOPEN) == 0) {
 271                 termioschars(&tp->t_termios);   /* Set up default chars */
 272                 tp->t_iflag = TTYDEF_IFLAG;
 273                 tp->t_oflag = TTYDEF_OFLAG;
 274                 tp->t_lflag = TTYDEF_LFLAG;
 275                 tp->t_cflag = TTYDEF_CFLAG;
 276                 tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
 277                 ttsetwater(tp);         /* would be done in xxparam() */
 278         } else if ((tp->t_state & TS_XCLUDE) && kauth_cred_issuser(kauth_cred_get())) {
 279                 error = EBUSY;
 280                 goto out;
 281         }
 282         if (tp->t_oproc)                        /* Ctrlr still around. */
 283                 (void)(*linesw[tp->t_line].l_modem)(tp, 1);
 284         while ((tp->t_state & TS_CARR_ON) == 0) {
 285                 if (flag&FNONBLOCK)
 286                         break;
 287                 error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH, __FUNCTION__, 0);
 288                 if (error)
 289                         goto out;
 290         }
 291         error = (*linesw[tp->t_line].l_open)(dev, tp);
 292         /* Successful open; mark as open by the slave */
 293
 294         pti->pt_flags |= PF_OPEN_S;
 295         CLR(tp->t_state, TS_IOCTL_NOT_OK);
 296         if (error == 0)
 297                 ptcwakeup(tp, FREAD|FWRITE);
 298
 299 out:
 300         tty_unlock(tp);
 301         return (error);
 302 }
 303
 304 __private_extern__ int
 305 ptsclose(dev_t dev, int flag, __unused int mode, __unused proc_t p)
 306 {
 307         int err;
 308
 309         /*
 310          * This is temporary until the VSX conformance tests
 311          * are fixed.  They are hanging with a deadlock
 312          * where close() will not complete without t_timeout set
 313          */
 314 #define FIX_VSX_HANG    1
 315 #ifdef  FIX_VSX_HANG
 316         int save_timeout;
 317 #endif
 318         struct tty_dev_t *driver;
 319         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, &driver);
 320         struct tty *tp;
 321
 322         if (pti == NULL)
 323                 return (ENXIO);
 324
 325         tp = pti->pt_tty;
 326         tty_lock(tp);
 327 #ifdef  FIX_VSX_HANG
 328         save_timeout = tp->t_timeout;
 329         tp->t_timeout = 60;
 330 #endif
 331         err = (*linesw[tp->t_line].l_close)(tp, flag);
 332         ptsstop(tp, FREAD|FWRITE);
 333         (void) ttyclose(tp);
 334 #ifdef  FIX_VSX_HANG
 335         tp->t_timeout = save_timeout;
 336 #endif
 337         tty_unlock(tp);
 338
 339         if ((flag & IO_REVOKE) == IO_REVOKE && driver->revoke) {
 340                 driver->revoke(minor(dev), tp);
 341         }
 342         /* unconditional, just like ttyclose() */
 343         pty_free_ioctl(dev, PF_OPEN_S);
 344
 345         return (err);
 346 }
 347
 348 __private_extern__ int
 349 ptsread(dev_t dev, struct uio *uio, int flag)
 350 {
 351         proc_t p = current_proc();
 352         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 353         struct tty *tp;
 354         int error = 0;
 355         struct uthread *ut;
 356         struct pgrp *pg;
 357
 358         if (pti == NULL)
 359                 return (ENXIO);
 360         tp = pti->pt_tty;
 361         tty_lock(tp);
 362
 363         ut = (struct uthread *)get_bsdthread_info(current_thread());
 364 again:
 365         if (pti->pt_flags & PF_REMOTE) {
 366                 while (isbackground(p, tp)) {
 367                         if ((p->p_sigignore & sigmask(SIGTTIN)) ||
 368                             (ut->uu_sigmask & sigmask(SIGTTIN)) ||
 369                             p->p_lflag & P_LPPWAIT) {
 370                                 error = EIO;
 371                                 goto out;
 372                         }
 373
 374
 375                         pg = proc_pgrp(p);
 376                         if (pg == PGRP_NULL) {
 377                                 error = EIO;
 378                                 goto out;
 379                         }
 380                         /*
 381                          * SAFE: We about to drop the lock ourselves by
 382                          * SAFE: erroring out or sleeping anyway.
 383                          */
 384                         tty_unlock(tp);
 385                         if (pg->pg_jobc == 0) {
 386                                 pg_rele(pg);
 387                                 tty_lock(tp);
 388                                 error = EIO;
 389                                 goto out;
 390                         }
 391                         pgsignal(pg, SIGTTIN, 1);
 392                         pg_rele(pg);
 393                         tty_lock(tp);
 394
 395                         error = ttysleep(tp, &ptsread, TTIPRI | PCATCH | PTTYBLOCK, __FUNCTION__, hz);
 396                         if (error)
 397                                 goto out;
 398                 }
 399                 if (tp->t_canq.c_cc == 0) {
 400                         if (flag & IO_NDELAY) {
 401                                 error = EWOULDBLOCK;
 402                                 goto out;
 403                         }
 404                         error = ttysleep(tp, TSA_PTS_READ(tp), TTIPRI | PCATCH, __FUNCTION__, 0);
 405                         if (error)
 406                                 goto out;
 407                         goto again;
 408                 }
 409                 while (tp->t_canq.c_cc > 1 && uio_resid(uio) > 0) {
 410                         int cc;
 411                         char buf[BUFSIZ];
 412
 413                         cc = MIN((int)uio_resid(uio), BUFSIZ);
 414                         // Don't copy the very last byte
 415                         cc = MIN(cc, tp->t_canq.c_cc - 1);
 416                         cc = q_to_b(&tp->t_canq, (u_char *)buf, cc);
 417                         error = uiomove(buf, cc, uio);
 418                         if (error)
 419                                 break;
 420                 }
 421                 if (tp->t_canq.c_cc == 1)
 422                         (void) getc(&tp->t_canq);
 423                 if (tp->t_canq.c_cc)
 424                         goto out;
 425         } else
 426                 if (tp->t_oproc)
 427                         error = (*linesw[tp->t_line].l_read)(tp, uio, flag);
 428         ptcwakeup(tp, FWRITE);
 429 out:
 430         tty_unlock(tp);
 431         return (error);
 432 }
 433
 434 /*
 435  * Write to pseudo-tty.
 436  * Wakeups of controlling tty will happen
 437  * indirectly, when tty driver calls ptsstart.
 438  */
 439 __private_extern__ int
 440 ptswrite(dev_t dev, struct uio *uio, int flag)
 441 {
 442         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 443         struct tty *tp;
 444         int error;
 445
 446         if (pti == NULL)
 447                 return (ENXIO);
 448         tp = pti->pt_tty;
 449         tty_lock(tp);
 450
 451         if (tp->t_oproc == 0)
 452                 error = EIO;
 453         else
 454                 error = (*linesw[tp->t_line].l_write)(tp, uio, flag);
 455
 456         tty_unlock(tp);
 457
 458         return (error);
 459 }
 460
 461 /*
 462  * Start output on pseudo-tty.
 463  * Wake up process selecting or sleeping for input from controlling tty.
 464  *
 465  * t_oproc for this driver; called from within the line discipline
 466  *
 467  * Locks:       Assumes tp is locked on entry, remains locked on exit
 468  */
 469 static void
 470 ptsstart(struct tty *tp)
 471 {
 472         struct ptmx_ioctl *pti = pty_get_ioctl(tp->t_dev, 0, NULL);
 473         if (pti == NULL)
 474                 goto out;
 475         if (tp->t_state & TS_TTSTOP)
 476                 goto out;
 477         if (pti->pt_flags & PF_STOPPED) {
 478                 pti->pt_flags &= ~PF_STOPPED;
 479                 pti->pt_send = TIOCPKT_START;
 480         }
 481         ptcwakeup(tp, FREAD);
 482 out:
 483         return;
 484 }
 485
 486 /*
 487  * Locks:       Assumes tty_lock() is held over this call.
 488  */
 489 static void
 490 ptcwakeup(struct tty *tp, int flag)
 491 {
 492         struct ptmx_ioctl *pti = pty_get_ioctl(tp->t_dev, 0, NULL);
 493         if (pti == NULL)
 494                 return;
 495
 496         if (flag & FREAD) {
 497                 selwakeup(&pti->pt_selr);
 498                 wakeup(TSA_PTC_READ(tp));
 499                 KNOTE(&pti->pt_selr.si_note, 1);
 500         }
 501         if (flag & FWRITE) {
 502                 selwakeup(&pti->pt_selw);
 503                 wakeup(TSA_PTC_WRITE(tp));
 504                 KNOTE(&pti->pt_selw.si_note, 1);
 505         }
 506 }
 507
 508 __private_extern__ int
 509 ptcopen(dev_t dev, __unused int flag, __unused int devtype, __unused proc_t p)
 510 {
 511         struct tty_dev_t *driver;
 512         struct ptmx_ioctl *pti = pty_get_ioctl(dev, PF_OPEN_M, &driver);
 513         if (pti == NULL) {
 514                 return (ENXIO);
 515         } else if (pti == (struct ptmx_ioctl*)-1) {
 516                 return (EREDRIVEOPEN);
 517         }
 518
 519         struct tty *tp = pti->pt_tty;
 520         tty_lock(tp);
 521
 522         /* If master is open OR slave is still draining, pty is still busy */
 523         if (tp->t_oproc || (tp->t_state & TS_ISOPEN)) {
 524                 tty_unlock(tp);
 525                 /*
 526                  * If master is closed, we are the only reference, so we
 527                  * need to clear the master open bit
 528                  */
 529                 if (!tp->t_oproc) {
 530                         pty_free_ioctl(dev, PF_OPEN_M);
 531                 }
 532                 return EBUSY;
 533         }
 534         tp->t_oproc = ptsstart;
 535         CLR(tp->t_state, TS_ZOMBIE);
 536         SET(tp->t_state, TS_IOCTL_NOT_OK);
 537 #ifdef sun4c
 538         tp->t_stop = ptsstop;
 539 #endif
 540         (void)(*linesw[tp->t_line].l_modem)(tp, 1);
 541         tp->t_lflag &= ~EXTPROC;
 542
 543         if (driver->open_reset) {
 544                 pti->pt_flags = PF_UNLOCKED;
 545                 pti->pt_send = 0;
 546                 pti->pt_ucntl = 0;
 547         }
 548
 549         tty_unlock(tp);
 550         return 0;
 551 }
 552
 553 __private_extern__ int
 554 ptcclose(dev_t dev, __unused int flags, __unused int fmt, __unused proc_t p)
 555 {
 556         struct tty_dev_t *driver;
 557         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, &driver);
 558         struct tty *tp;
 559
 560         if (pti == NULL)
 561                 return (ENXIO);
 562         tp = pti->pt_tty;
 563         tty_lock(tp);
 564
 565         (void)(*linesw[tp->t_line].l_modem)(tp, 0);
 566
 567         /*
 568          * XXX MDMBUF makes no sense for ptys but would inhibit the above
 569          * l_modem().  CLOCAL makes sense but isn't supported.   Special
 570          * l_modem()s that ignore carrier drop make no sense for ptys but
 571          * may be in use because other parts of the line discipline make
 572          * sense for ptys.  Recover by doing everything that a normal
 573          * ttymodem() would have done except for sending a SIGHUP.
 574          */
 575         if (tp->t_state & TS_ISOPEN) {
 576                 tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
 577                 tp->t_state |= TS_ZOMBIE;
 578                 ttyflush(tp, FREAD | FWRITE);
 579         }
 580
 581         tp->t_oproc = 0;                /* mark closed */
 582
 583         tty_unlock(tp);
 584
 585         pty_free_ioctl(dev, PF_OPEN_M);
 586 #if CONFIG_MACF
 587         if (driver->mac_notify) {
 588                 mac_pty_notify_close(p, tp, dev, NULL);
 589         }
 590 #endif
 591
 592         return (0);
 593 }
 594
 595 __private_extern__ int
 596 ptcread(dev_t dev, struct uio *uio, int flag)
 597 {
 598         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 599         struct tty *tp;
 600         char buf[BUFSIZ];
 601         int error = 0, cc;
 602
 603         if (pti == NULL)
 604                 return (ENXIO);
 605         tp = pti->pt_tty;
 606         tty_lock(tp);
 607
 608         /*
 609          * We want to block until the slave
 610          * is open, and there's something to read;
 611          * but if we lost the slave or we're NBIO,
 612          * then return the appropriate error instead.
 613          */
 614         for (;;) {
 615                 if (tp->t_state & TS_ISOPEN) {
 616                         if (pti->pt_flags & PF_PKT && pti->pt_send) {
 617                                 error = ureadc((int)pti->pt_send, uio);
 618                                 if (error)
 619                                         goto out;
 620                                 if (pti->pt_send & TIOCPKT_IOCTL) {
 621                                         cc = MIN((int)uio_resid(uio),
 622                                                 (int)sizeof(tp->t_termios));
 623                                         uiomove((caddr_t)&tp->t_termios, cc,
 624                                                 uio);
 625                                 }
 626                                 pti->pt_send = 0;
 627                                 goto out;
 628                         }
 629                         if (pti->pt_flags & PF_UCNTL && pti->pt_ucntl) {
 630                                 error = ureadc((int)pti->pt_ucntl, uio);
 631                                 if (error)
 632                                         goto out;
 633                                 pti->pt_ucntl = 0;
 634                                 goto out;
 635                         }
 636                         if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
 637                                 break;
 638                 }
 639                 if ((tp->t_state & TS_CONNECTED) == 0)
 640                         goto out;       /* EOF */
 641                 if (flag & IO_NDELAY) {
 642                         error = EWOULDBLOCK;
 643                         goto out;
 644                 }
 645                 error = ttysleep(tp, TSA_PTC_READ(tp), TTIPRI | PCATCH, __FUNCTION__, 0);
 646                 if (error)
 647                         goto out;
 648         }
 649         if (pti->pt_flags & (PF_PKT|PF_UCNTL))
 650                 error = ureadc(0, uio);
 651         while (uio_resid(uio) > 0 && error == 0) {
 652                 cc = q_to_b(&tp->t_outq, (u_char *)buf, MIN((int)uio_resid(uio), BUFSIZ));
 653                 if (cc <= 0)
 654                         break;
 655                 error = uiomove(buf, cc, uio);
 656         }
 657         (*linesw[tp->t_line].l_start)(tp);
 658
 659 out:
 660         tty_unlock(tp);
 661
 662         return (error);
 663 }
 664
 665 /*
 666  * Line discipline callback
 667  *
 668  * Locks:       tty_lock() is assumed held on entry and exit.
 669  */
 670 __private_extern__ int
 671 ptsstop(struct tty* tp, int flush)
 672 {
 673         struct ptmx_ioctl *pti = pty_get_ioctl(tp->t_dev, 0, NULL);
 674         int flag;
 675
 676         if (pti == NULL)
 677                 return (ENXIO);
 678
 679         /* note: FLUSHREAD and FLUSHWRITE already ok */
 680         if (flush == 0) {
 681                 flush = TIOCPKT_STOP;
 682                 pti->pt_flags |= PF_STOPPED;
 683         } else
 684                 pti->pt_flags &= ~PF_STOPPED;
 685         pti->pt_send |= flush;
 686         /* change of perspective */
 687         flag = 0;
 688         if (flush & FREAD)
 689                 flag |= FWRITE;
 690         if (flush & FWRITE)
 691                 flag |= FREAD;
 692         ptcwakeup(tp, flag);
 693         return 0;
 694 }
 695
 696 __private_extern__ int
 697 ptsreset(__unused int uban)
 698 {
 699         return (0);
 700 }
 701
 702 int
 703 ptsselect(dev_t dev, int rw, void *wql, proc_t p)
 704 {
 705         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 706         struct tty *tp;
 707         int retval = 0;
 708
 709         if (pti == NULL)
 710                 return (ENXIO);
 711         tp = pti->pt_tty;
 712         if (tp == NULL)
 713                 return (ENXIO);
 714
 715         tty_lock(tp);
 716
 717         switch (rw) {
 718         case FREAD:
 719                 if (ISSET(tp->t_state, TS_ZOMBIE)) {
 720                         retval = 1;
 721                         break;
 722                 }
 723
 724                 retval = ttnread(tp);
 725                 if (retval > 0) {
 726                         break;
 727                 }
 728
 729                 selrecord(p, &tp->t_rsel, wql);
 730                 break;
 731         case FWRITE:
 732                 if (ISSET(tp->t_state, TS_ZOMBIE)) {
 733                         retval = 1;
 734                         break;
 735                 }
 736
 737                 if ((tp->t_outq.c_cc <= tp->t_lowat) &&
 738                                 ISSET(tp->t_state, TS_CONNECTED)) {
 739                         retval = tp->t_hiwat - tp->t_outq.c_cc;
 740                         break;
 741                 }
 742
 743                 selrecord(p, &tp->t_wsel, wql);
 744                 break;
 745         }
 746
 747         tty_unlock(tp);
 748         return (retval);
 749 }
 750
 751 __private_extern__ int
 752 ptcselect(dev_t dev, int rw, void *wql, proc_t p)
 753 {
 754         struct tty_dev_t *driver;
 755         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, &driver);
 756         struct tty *tp;
 757         int retval = 0;
 758
 759         if (pti == NULL)
 760                 return (ENXIO);
 761         tp = pti->pt_tty;
 762         tty_lock(tp);
 763
 764         if ((tp->t_state & TS_CONNECTED) == 0) {
 765                 retval = 1;
 766                 goto out;
 767         }
 768         switch (rw) {
 769
 770         case FREAD:
 771                 /*
 772                  * Need to block timeouts (ttrstart).
 773                  */
 774                 if ((tp->t_state&TS_ISOPEN) &&
 775                      tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0) {
 776                         retval = (driver->fix_7828447) ? tp->t_outq.c_cc : 1;
 777                         break;
 778                 }
 779                 /* FALLTHROUGH */
 780
 781         case 0: /* exceptional */
 782                 if ((tp->t_state&TS_ISOPEN) &&
 783                                 (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
 784                                  ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))) {
 785                         retval = 1;
 786                         break;
 787                 }
 788                 selrecord(p, &pti->pt_selr, wql);
 789                 break;
 790
 791
 792         case FWRITE:
 793                 if (tp->t_state&TS_ISOPEN) {
 794                         if (pti->pt_flags & PF_REMOTE) {
 795                                 if (tp->t_canq.c_cc == 0) {
 796                                         retval = (driver->fix_7828447) ? (TTYHOG - 1) : 1;
 797                                         break;
 798                             }
 799                         } else {
 800                                 retval = (TTYHOG - 2) - (tp->t_rawq.c_cc + tp->t_canq.c_cc);
 801                                 if (retval > 0) {
 802                                         retval = (driver->fix_7828447) ? retval : 1;
 803                                         break;
 804                                 }
 805                                 if (tp->t_canq.c_cc == 0 && (tp->t_lflag&ICANON)) {
 806                                         retval = 1;
 807                                         break;
 808                                 }
 809                                 retval = 0;
 810                         }
 811                 }
 812                 selrecord(p, &pti->pt_selw, wql);
 813                 break;
 814
 815         }
 816 out:
 817         tty_unlock(tp);
 818
 819         return (retval);
 820 }
 821
 822 __private_extern__ int
 823 ptcstop(__unused struct tty *tp, __unused int flush)
 824 {
 825         return (0);
 826 }
 827
 828 __private_extern__ int
 829 ptcreset(__unused int uban)
 830 {
 831         return (0);
 832 }
 833
 834 __private_extern__ int
 835 ptcwrite(dev_t dev, struct uio *uio, int flag)
 836 {
 837         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 838         struct tty *tp;
 839         u_char *cp = NULL;
 840         int cc = 0;
 841         u_char locbuf[BUFSIZ];
 842         int wcnt = 0;
 843         int error = 0;
 844
 845         if (pti == NULL)
 846                 return (ENXIO);
 847         tp = pti->pt_tty;
 848         tty_lock(tp);
 849
 850 again:
 851         if ((tp->t_state & TS_ISOPEN) == 0)
 852                 goto block;
 853         if (pti->pt_flags & PF_REMOTE) {
 854                 if (tp->t_canq.c_cc)
 855                         goto block;
 856                 while ((uio_resid(uio) > 0 || cc > 0) &&
 857                        tp->t_canq.c_cc < TTYHOG - 1) {
 858                         if (cc == 0) {
 859                                 cc = MIN((int)uio_resid(uio), BUFSIZ);
 860                                 cc = MIN(cc, TTYHOG - 1 - tp->t_canq.c_cc);
 861                                 cp = locbuf;
 862                                 error = uiomove((caddr_t)cp, cc, uio);
 863                                 if (error)
 864                                         goto out;
 865                                 /* check again for safety */
 866                                 if ((tp->t_state & TS_ISOPEN) == 0) {
 867                                         /* adjust as usual */
 868                                         uio_setresid(uio, (uio_resid(uio) + cc));
 869                                         error = EIO;
 870                                         goto out;
 871                                 }
 872                         }
 873                         if (cc > 0) {
 874                                 cc = b_to_q((u_char *)cp, cc, &tp->t_canq);
 875                                 /*
 876                                  * XXX we don't guarantee that the canq size
 877                                  * is >= TTYHOG, so the above b_to_q() may
 878                                  * leave some bytes uncopied.  However, space
 879                                  * is guaranteed for the null terminator if
 880                                  * we don't fail here since (TTYHOG - 1) is
 881                                  * not a multiple of CBSIZE.
 882                                  */
 883                                 if (cc > 0)
 884                                         break;
 885                         }
 886                 }
 887                 /* adjust for data copied in but not written */
 888                 uio_setresid(uio, (uio_resid(uio) + cc));
 889                 (void) putc(0, &tp->t_canq);
 890                 ttwakeup(tp);
 891                 wakeup(TSA_PTS_READ(tp));
 892                 goto out;
 893         }
 894         while (uio_resid(uio) > 0 || cc > 0) {
 895                 if (cc == 0) {
 896                         cc = MIN((int)uio_resid(uio), BUFSIZ);
 897                         cp = locbuf;
 898                         error = uiomove((caddr_t)cp, cc, uio);
 899                         if (error)
 900                                 goto out;
 901                         /* check again for safety */
 902                         if ((tp->t_state & TS_ISOPEN) == 0) {
 903                                 /* adjust for data copied in but not written */
 904                                 uio_setresid(uio, (uio_resid(uio) + cc));
 905                                 error = EIO;
 906                                 goto out;
 907                         }
 908                 }
 909                 while (cc > 0) {
 910                         if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
 911                            (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
 912                                 wakeup(TSA_HUP_OR_INPUT(tp));
 913                                 goto block;
 914                         }
 915                         (*linesw[tp->t_line].l_rint)(*cp++, tp);
 916                         wcnt++;
 917                         cc--;
 918                 }
 919                 cc = 0;
 920         }
 921 out:
 922         tty_unlock(tp);
 923
 924         return (error);
 925
 926 block:
 927         /*
 928          * Come here to wait for slave to open, for space
 929          * in outq, or space in rawq, or an empty canq.
 930          */
 931         if ((tp->t_state & TS_CONNECTED) == 0) {
 932                 /* adjust for data copied in but not written */
 933                 uio_setresid(uio, (uio_resid(uio) + cc));
 934                 error = EIO;
 935                 goto out;
 936         }
 937         if (flag & IO_NDELAY) {
 938                 /* adjust for data copied in but not written */
 939                 uio_setresid(uio, (uio_resid(uio) + cc));
 940                 if (wcnt == 0)
 941                         error = EWOULDBLOCK;
 942                 goto out;
 943         }
 944         error = ttysleep(tp, TSA_PTC_WRITE(tp), TTOPRI | PCATCH, __FUNCTION__, 0);
 945         if (error) {
 946                 /* adjust for data copied in but not written */
 947                 uio_setresid(uio, (uio_resid(uio) + cc));
 948                 goto out;
 949         }
 950         goto again;
 951 }
 952
 953 __private_extern__ int
 954 ptyioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 955 {
 956         struct tty_dev_t *driver;
 957         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, &driver);
 958         struct tty *tp;
 959         int stop, error = 0;
 960         int allow_ext_ioctl = 1;
 961
 962         if (pti == NULL)
 963                 return (ENXIO);
 964         tp = pti->pt_tty;
 965         tty_lock(tp);
 966
 967         u_char *cc = tp->t_cc;
 968
 969         /*
 970          * Do not permit extended ioctls on the master side of the pty unless
 971          * the slave side has been successfully opened and initialized.
 972          */
 973         if (major(dev) == driver->master &&
 974             driver->fix_7070978 &&
 975             ISSET(tp->t_state, TS_IOCTL_NOT_OK)) {
 976                 allow_ext_ioctl = 0;
 977         }
 978
 979         /*
 980          * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
 981          * ttywflush(tp) will hang if there are characters in the outq.
 982          */
 983         if (cmd == TIOCEXT && allow_ext_ioctl) {
 984                 /*
 985                  * When the EXTPROC bit is being toggled, we need
 986                  * to send an TIOCPKT_IOCTL if the packet driver
 987                  * is turned on.
 988                  */
 989                 if (*(int *)data) {
 990                         if (pti->pt_flags & PF_PKT) {
 991                                 pti->pt_send |= TIOCPKT_IOCTL;
 992                                 ptcwakeup(tp, FREAD);
 993                         }
 994                         tp->t_lflag |= EXTPROC;
 995                 } else {
 996                         if ((tp->t_lflag & EXTPROC) &&
 997                             (pti->pt_flags & PF_PKT)) {
 998                                 pti->pt_send |= TIOCPKT_IOCTL;
 999                                 ptcwakeup(tp, FREAD);
1000                         }
1001                         tp->t_lflag &= ~EXTPROC;
1002                 }
1003                 goto out;
1004         } else
1005         if (cdevsw[major(dev)].d_open == ptcopen) {
1006                 switch (cmd) {
1007
1008                 case TIOCGPGRP:
1009                         /*
1010                          * We aviod calling ttioctl on the controller since,
1011                          * in that case, tp must be the controlling terminal.
1012                          */
1013                         *(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1014                         goto out;
1015
1016                 case TIOCPKT:
1017                         if (*(int *)data) {
1018                                 if (pti->pt_flags & PF_UCNTL) {
1019                                         error = EINVAL;
1020                                         goto out;
1021                                 }
1022                                 pti->pt_flags |= PF_PKT;
1023                         } else
1024                                 pti->pt_flags &= ~PF_PKT;
1025                         goto out;
1026
1027                 case TIOCUCNTL:
1028                         if (*(int *)data) {
1029                                 if (pti->pt_flags & PF_PKT) {
1030                                         error = EINVAL;
1031                                         goto out;
1032                                 }
1033                                 pti->pt_flags |= PF_UCNTL;
1034                         } else
1035                                 pti->pt_flags &= ~PF_UCNTL;
1036                         goto out;
1037
1038                 case TIOCREMOTE:
1039                         if (*(int *)data)
1040                                 pti->pt_flags |= PF_REMOTE;
1041                         else
1042                                 pti->pt_flags &= ~PF_REMOTE;
1043                         ttyflush(tp, FREAD|FWRITE);
1044                         goto out;
1045
1046                 case TIOCSETP:
1047                 case TIOCSETN:
1048                 case TIOCSETD:
1049                 case TIOCSETA_32:
1050                 case TIOCSETAW_32:
1051                 case TIOCSETAF_32:
1052                 case TIOCSETA_64:
1053                 case TIOCSETAW_64:
1054                 case TIOCSETAF_64:
1055                         ndflush(&tp->t_outq, tp->t_outq.c_cc);
1056                         break;
1057
1058                 case TIOCSIG:
1059                         if (*(unsigned int *)data >= NSIG ||
1060                             *(unsigned int *)data == 0) {
1061                                 error = EINVAL;
1062                                 goto out;
1063                         }
1064                         if ((tp->t_lflag&NOFLSH) == 0)
1065                                 ttyflush(tp, FREAD|FWRITE);
1066                         if ((*(unsigned int *)data == SIGINFO) &&
1067                             ((tp->t_lflag&NOKERNINFO) == 0))
1068                                 ttyinfo_locked(tp);
1069                         /*
1070                          * SAFE: All callers drop the lock on return and
1071                          * SAFE: the linesw[] will short circut this call
1072                          * SAFE: if the ioctl() is eaten before the lower
1073                          * SAFE: level code gets to see it.
1074                          */
1075                         tty_unlock(tp);
1076                         tty_pgsignal(tp, *(unsigned int *)data, 1);
1077                         tty_lock(tp);
1078                         goto out;
1079
1080                 case TIOCPTYGRANT:      /* grantpt(3) */
1081                         /*
1082                          * Change the uid of the slave to that of the calling
1083                          * thread, change the gid of the slave to GID_TTY,
1084                          * change the mode to 0620 (rw--w----).
1085                          */
1086                         {
1087                                 error = _devfs_setattr(pti->pt_devhandle, 0620, kauth_getuid(), GID_TTY);
1088                                 if (major(dev) == driver->master) {
1089                                         if (driver->mac_notify) {
1090 #if CONFIG_MACF
1091                                                 if (!error) {
1092                                                         tty_unlock(tp);
1093                                                         mac_pty_notify_grant(p, tp, dev, NULL);
1094                                                         tty_lock(tp);
1095                                                 }
1096 #endif
1097                                         } else {
1098                                                 error = 0;
1099                                         }
1100                                 }
1101                                 goto out;
1102                         }
1103
1104                 case TIOCPTYGNAME:      /* ptsname(3) */
1105                         /*
1106                          * Report the name of the slave device in *data
1107                          * (128 bytes max.).  Use the same template string
1108                          * used for calling devfs_make_node() to create it.
1109                          */
1110                         pty_get_name(dev, data, 128);
1111                         error = 0;
1112                         goto out;
1113
1114                 case TIOCPTYUNLK:       /* unlockpt(3) */
1115                         /*
1116                          * Unlock the slave device so that it can be opened.
1117                          */
1118                         if (major(dev) == driver->master) {
1119                                 pti->pt_flags |= PF_UNLOCKED;
1120                         }
1121                         error = 0;
1122                         goto out;
1123                 }
1124
1125                 /*
1126                  * Fail all other calls; pty masters are not serial devices;
1127                  * we only pretend they are when the slave side of the pty is
1128                  * already open.
1129                  */
1130                 if (!allow_ext_ioctl) {
1131                         error = ENOTTY;
1132                         goto out;
1133                 }
1134         }
1135         error = (*linesw[tp->t_line].l_ioctl)(tp, cmd, data, flag, p);
1136         if (error == ENOTTY) {
1137                 error = ttioctl_locked(tp, cmd, data, flag, p);
1138                 if (error == ENOTTY) {
1139                         if (pti->pt_flags & PF_UCNTL && (cmd & ~0xff) == UIOCCMD(0)) {
1140                                 /* Process the UIOCMD ioctl group */
1141                                 if (cmd & 0xff) {
1142                                         pti->pt_ucntl = (u_char)cmd;
1143                                         ptcwakeup(tp, FREAD);
1144                                 }
1145                                 error = 0;
1146                                 goto out;
1147                         } else if (cmd == TIOCSBRK || cmd == TIOCCBRK) {
1148                                 /*
1149                                  * POSIX conformance; rdar://3936338
1150                                  *
1151                                  * Clear ENOTTY in the case of setting or
1152                                  * clearing a break failing because pty's
1153                                  * don't support break like real serial
1154                                  * ports.
1155                                  */
1156                                 error = 0;
1157                                 goto out;
1158                         }
1159                 }
1160         }
1161
1162         /*
1163          * If external processing and packet mode send ioctl packet.
1164          */
1165         if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
1166                 switch(cmd) {
1167                 case TIOCSETA_32:
1168                 case TIOCSETAW_32:
1169                 case TIOCSETAF_32:
1170                 case TIOCSETA_64:
1171                 case TIOCSETAW_64:
1172                 case TIOCSETAF_64:
1173                 case TIOCSETP:
1174                 case TIOCSETN:
1175                 case TIOCSETC:
1176                 case TIOCSLTC:
1177                 case TIOCLBIS:
1178                 case TIOCLBIC:
1179                 case TIOCLSET:
1180                         pti->pt_send |= TIOCPKT_IOCTL;
1181                         ptcwakeup(tp, FREAD);
1182                 default:
1183                         break;
1184                 }
1185         }
1186         stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1187                 && CCEQ(cc[VSTART], CTRL('q'));
1188         if (pti->pt_flags & PF_NOSTOP) {
1189                 if (stop) {
1190                         pti->pt_send &= ~TIOCPKT_NOSTOP;
1191                         pti->pt_send |= TIOCPKT_DOSTOP;
1192                         pti->pt_flags &= ~PF_NOSTOP;
1193                         ptcwakeup(tp, FREAD);
1194                 }
1195         } else {
1196                 if (!stop) {
1197                         pti->pt_send &= ~TIOCPKT_DOSTOP;
1198                         pti->pt_send |= TIOCPKT_NOSTOP;
1199                         pti->pt_flags |= PF_NOSTOP;
1200                         ptcwakeup(tp, FREAD);
1201                 }
1202         }
1203 out:
1204         tty_unlock(tp);
1205
1206         return (error);
1207 }