bsd/kern/tty_ptmx.c

   1 /*
   2  * Copyright (c) 1997-2013 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1982, 1986, 1989, 1993
  30  *      The Regents of the University of California.  All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. All advertising materials mentioning features or use of this software
  41  *    must display the following acknowledgement:
  42  *      This product includes software developed by the University of
  43  *      California, Berkeley and its contributors.
  44  * 4. Neither the name of the University nor the names of its contributors
  45  *    may be used to endorse or promote products derived from this software
  46  *    without specific prior written permission.
  47  *
  48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  58  * SUCH DAMAGE.
  59  *
  60  *      @(#)tty_pty.c   8.4 (Berkeley) 2/20/95
  61  */
  62
  63 /*
  64  * Pseudo-teletype Driver
  65  * (Actually two drivers, requiring two entries in 'cdevsw')
  66  */
  67 #include "pty.h"                /* XXX */
  68
  69 #include <sys/param.h>
  70 #include <sys/systm.h>
  71 #include <sys/ioctl.h>
  72 #include <sys/proc_internal.h>
  73 #include <sys/kauth.h>
  74 #include <sys/tty.h>
  75 #include <sys/conf.h>
  76 #include <sys/file_internal.h>
  77 #include <sys/uio_internal.h>
  78 #include <sys/kernel.h>
  79 #include <sys/vnode.h>
  80 #include <sys/user.h>
  81 #include <sys/signalvar.h>
  82 #include <sys/sysctl.h>
  83 #include <miscfs/devfs/devfs.h>
  84 #include <miscfs/devfs/devfsdefs.h>     /* DEVFS_LOCK()/DEVFS_UNLOCK() */
  85 #include <libkern/section_keywords.h>
  86
  87 #if CONFIG_MACF
  88 #include <security/mac_framework.h>
  89 #endif
  90
  91 #include "tty_dev.h"
  92
  93 /*
  94  * Forward declarations
  95  */
  96 int ptmx_init(int n_ptys);
  97 static struct ptmx_ioctl *ptmx_get_ioctl(int minor, int open_flag);
  98 static int ptmx_free_ioctl(int minor, int open_flag);
  99 static int ptmx_get_name(int minor, char *buffer, size_t size);
 100 static void ptsd_revoke_knotes(int minor, struct tty *tp);
 101
 102 extern  d_open_t        ptsopen;
 103 extern  d_close_t       ptsclose;
 104 extern  d_read_t        ptsread;
 105 extern  d_write_t       ptswrite;
 106 extern  d_ioctl_t       ptyioctl;
 107 extern  d_stop_t        ptsstop;
 108 extern  d_reset_t       ptsreset;
 109 extern  d_select_t      ptsselect;
 110
 111 extern  d_open_t        ptcopen;
 112 extern  d_close_t       ptcclose;
 113 extern  d_read_t        ptcread;
 114 extern  d_write_t       ptcwrite;
 115 extern  d_stop_t        ptcstop;
 116 extern  d_reset_t       ptcreset;
 117 extern  d_select_t      ptcselect;
 118
 119 static int ptmx_major;          /* dynamically assigned major number */
 120 static struct cdevsw ptmx_cdev = {
 121         ptcopen, ptcclose, ptcread, ptcwrite,
 122         ptyioctl, ptcstop, ptcreset, 0,
 123         ptcselect, eno_mmap, eno_strat, eno_getc,
 124         eno_putc, D_TTY
 125 };
 126
 127 static int ptsd_major;          /* dynamically assigned major number */
 128 static struct cdevsw ptsd_cdev = {
 129         ptsopen, ptsclose, ptsread, ptswrite,
 130         ptyioctl, ptsstop, ptsreset, 0,
 131         ptsselect, eno_mmap, eno_strat, eno_getc,
 132         eno_putc, D_TTY
 133 };
 134
 135 /*
 136  * ptmx == /dev/ptmx
 137  * ptsd == /dev/pts[0123456789]{3}
 138  */
 139 #define PTMX_TEMPLATE   "ptmx"
 140 #define PTSD_TEMPLATE   "ttys%03d"
 141
 142 /*
 143  * System-wide limit on the max number of cloned ptys
 144  */
 145 #define PTMX_MAX_DEFAULT        511     /* 512 entries */
 146 #define PTMX_MAX_HARD           999     /* 1000 entries, due to PTSD_TEMPLATE */
 147
 148 static int ptmx_max = PTMX_MAX_DEFAULT; /* default # of clones we allow */
 149
 150 /* Range enforcement for the sysctl */
 151 static int
 152 sysctl_ptmx_max(__unused struct sysctl_oid *oidp, __unused void *arg1,
 153     __unused int arg2, struct sysctl_req *req)
 154 {
 155         int new_value, changed;
 156         int error = sysctl_io_number(req, ptmx_max, sizeof(int), &new_value, &changed);
 157         if (changed) {
 158                 if (new_value > 0 && new_value <= PTMX_MAX_HARD) {
 159                         ptmx_max = new_value;
 160                 } else {
 161                         error = EINVAL;
 162                 }
 163         }
 164         return error;
 165 }
 166
 167 SYSCTL_NODE(_kern, KERN_TTY, tty, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "TTY");
 168 SYSCTL_PROC(_kern_tty, OID_AUTO, ptmx_max,
 169     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
 170     &ptmx_max, 0, &sysctl_ptmx_max, "I", "ptmx_max");
 171
 172 static int      ptmx_clone(dev_t dev, int minor);
 173
 174 static struct tty_dev_t _ptmx_driver;
 175
 176 int
 177 ptmx_init( __unused int config_count)
 178 {
 179         /*
 180          * We start looking at slot 10, since there are inits that will
 181          * stomp explicit slots (e.g. vndevice stomps 1) below that.
 182          */
 183
 184         /* Get a major number for /dev/ptmx */
 185         if ((ptmx_major = cdevsw_add(-15, &ptmx_cdev)) == -1) {
 186                 printf("ptmx_init: failed to obtain /dev/ptmx major number\n");
 187                 return ENOENT;
 188         }
 189
 190         if (cdevsw_setkqueueok(ptmx_major, &ptmx_cdev, CDEVSW_IS_PTC) == -1) {
 191                 panic("Failed to set flags on ptmx cdevsw entry.");
 192         }
 193
 194         /* Get a major number for /dev/pts/nnn */
 195         if ((ptsd_major = cdevsw_add(-15, &ptsd_cdev)) == -1) {
 196                 (void)cdevsw_remove(ptmx_major, &ptmx_cdev);
 197                 printf("ptmx_init: failed to obtain /dev/ptmx major number\n");
 198                 return ENOENT;
 199         }
 200
 201         if (cdevsw_setkqueueok(ptsd_major, &ptsd_cdev, CDEVSW_IS_PTS) == -1) {
 202                 panic("Failed to set flags on ptmx cdevsw entry.");
 203         }
 204
 205         /* Create the /dev/ptmx device {<major>,0} */
 206         (void)devfs_make_node_clone(makedev(ptmx_major, 0),
 207             DEVFS_CHAR, UID_ROOT, GID_TTY, 0666,
 208             ptmx_clone, PTMX_TEMPLATE);
 209
 210         _ptmx_driver.master = ptmx_major;
 211         _ptmx_driver.slave = ptsd_major;
 212         _ptmx_driver.fix_7828447 = 1;
 213         _ptmx_driver.fix_7070978 = 1;
 214 #if CONFIG_MACF
 215         _ptmx_driver.mac_notify = 1;
 216 #endif
 217         _ptmx_driver.open = &ptmx_get_ioctl;
 218         _ptmx_driver.free = &ptmx_free_ioctl;
 219         _ptmx_driver.name = &ptmx_get_name;
 220         _ptmx_driver.revoke = &ptsd_revoke_knotes;
 221         tty_dev_register(&_ptmx_driver);
 222
 223         return 0;
 224 }
 225
 226
 227 static struct _ptmx_ioctl_state {
 228         struct ptmx_ioctl       **pis_ioctl_list;       /* pointer vector */
 229         int                     pis_total;              /* total slots */
 230         int                     pis_free;               /* free slots */
 231 } _state;
 232 #define PTMX_GROW_VECTOR        16      /* Grow by this many slots at a time */
 233
 234 /*
 235  * Given a minor number, return the corresponding structure for that minor
 236  * number.  If there isn't one, and the create flag is specified, we create
 237  * one if possible.
 238  *
 239  * Parameters:  minor                   Minor number of ptmx device
 240  *              open_flag               PF_OPEN_M       First open of master
 241  *                                      PF_OPEN_S       First open of slave
 242  *                                      0               Just want ioctl struct
 243  *
 244  * Returns:     NULL                    Did not exist/could not create
 245  *              !NULL                   structure corresponding minor number
 246  *
 247  * Locks:       tty_lock() on ptmx_ioctl->pt_tty NOT held on entry or exit.
 248  */
 249 static struct ptmx_ioctl *
 250 ptmx_get_ioctl(int minor, int open_flag)
 251 {
 252         struct ptmx_ioctl *new_ptmx_ioctl;
 253
 254         if (open_flag & PF_OPEN_M) {
 255                 /*
 256                  * If we are about to allocate more memory, but we have
 257                  * already hit the administrative limit, then fail the
 258                  * operation.
 259                  *
 260                  * Note:        Subtract free from total when making this
 261                  *              check to allow unit increments, rather than
 262                  *              snapping to the nearest PTMX_GROW_VECTOR...
 263                  */
 264                 if ((_state.pis_total - _state.pis_free) >= ptmx_max) {
 265                         return NULL;
 266                 }
 267
 268                 MALLOC(new_ptmx_ioctl, struct ptmx_ioctl *, sizeof(struct ptmx_ioctl), M_TTYS, M_WAITOK | M_ZERO);
 269                 if (new_ptmx_ioctl == NULL) {
 270                         return NULL;
 271                 }
 272
 273                 if ((new_ptmx_ioctl->pt_tty = ttymalloc()) == NULL) {
 274                         FREE(new_ptmx_ioctl, M_TTYS);
 275                         return NULL;
 276                 }
 277
 278                 /*
 279                  * Hold the DEVFS_LOCK() over this whole operation; devfs
 280                  * itself does this over malloc/free as well, so this should
 281                  * be safe to do.  We hold it longer than we want to, but
 282                  * doing so avoids a reallocation race on the minor number.
 283                  */
 284                 DEVFS_LOCK();
 285                 /* Need to allocate a larger vector? */
 286                 if (_state.pis_free == 0) {
 287                         struct ptmx_ioctl **new_pis_ioctl_list;
 288                         struct ptmx_ioctl **old_pis_ioctl_list = NULL;
 289
 290                         /* Yes. */
 291                         MALLOC(new_pis_ioctl_list, struct ptmx_ioctl **, sizeof(struct ptmx_ioctl *) * (_state.pis_total + PTMX_GROW_VECTOR), M_TTYS, M_WAITOK | M_ZERO);
 292                         if (new_pis_ioctl_list == NULL) {
 293                                 ttyfree(new_ptmx_ioctl->pt_tty);
 294                                 DEVFS_UNLOCK();
 295                                 FREE(new_ptmx_ioctl, M_TTYS);
 296                                 return NULL;
 297                         }
 298
 299                         /* If this is not the first time, copy the old over */
 300                         bcopy(_state.pis_ioctl_list, new_pis_ioctl_list, sizeof(struct ptmx_ioctl *) * _state.pis_total);
 301                         old_pis_ioctl_list = _state.pis_ioctl_list;
 302                         _state.pis_ioctl_list = new_pis_ioctl_list;
 303                         _state.pis_free += PTMX_GROW_VECTOR;
 304                         _state.pis_total += PTMX_GROW_VECTOR;
 305                         if (old_pis_ioctl_list) {
 306                                 FREE(old_pis_ioctl_list, M_TTYS);
 307                         }
 308                 }
 309
 310                 /* is minor in range now? */
 311                 if (minor < 0 || minor >= _state.pis_total) {
 312                         ttyfree(new_ptmx_ioctl->pt_tty);
 313                         DEVFS_UNLOCK();
 314                         FREE(new_ptmx_ioctl, M_TTYS);
 315                         return NULL;
 316                 }
 317
 318                 if (_state.pis_ioctl_list[minor] != NULL) {
 319                         ttyfree(new_ptmx_ioctl->pt_tty);
 320                         DEVFS_UNLOCK();
 321                         FREE(new_ptmx_ioctl, M_TTYS);
 322
 323                         /* Special error value so we know to redrive the open, we've been raced */
 324                         return (struct ptmx_ioctl*)-1;
 325                 }
 326
 327                 /* Vector is large enough; grab a new ptmx_ioctl */
 328
 329                 /* Now grab a free slot... */
 330                 _state.pis_ioctl_list[minor] = new_ptmx_ioctl;
 331
 332                 /* reduce free count */
 333                 _state.pis_free--;
 334
 335                 _state.pis_ioctl_list[minor]->pt_flags |= PF_OPEN_M;
 336                 DEVFS_UNLOCK();
 337
 338                 /* Create the /dev/ttysXXX device {<major>,XXX} */
 339                 _state.pis_ioctl_list[minor]->pt_devhandle = devfs_make_node(
 340                         makedev(ptsd_major, minor),
 341                         DEVFS_CHAR, UID_ROOT, GID_TTY, 0620,
 342                         PTSD_TEMPLATE, minor);
 343                 if (_state.pis_ioctl_list[minor]->pt_devhandle == NULL) {
 344                         printf("devfs_make_node() call failed for ptmx_get_ioctl()!!!!\n");
 345                 }
 346         }
 347
 348         if (minor < 0 || minor >= _state.pis_total) {
 349                 return NULL;
 350         }
 351
 352         return _state.pis_ioctl_list[minor];
 353 }
 354
 355 /*
 356  * Locks:       tty_lock() of old_ptmx_ioctl->pt_tty NOT held for this call.
 357  */
 358 static int
 359 ptmx_free_ioctl(int minor, int open_flag)
 360 {
 361         struct ptmx_ioctl *old_ptmx_ioctl = NULL;
 362
 363         DEVFS_LOCK();
 364
 365         if (minor < 0 || minor >= _state.pis_total) {
 366                 DEVFS_UNLOCK();
 367                 return -1;
 368         }
 369
 370         _state.pis_ioctl_list[minor]->pt_flags &= ~(open_flag);
 371
 372         /*
 373          * Was this the last close?  We will recognize it because we only get
 374          * a notification on the last close of a device, and we will have
 375          * cleared both the master and the slave open bits in the flags.
 376          */
 377         if (!(_state.pis_ioctl_list[minor]->pt_flags & (PF_OPEN_M | PF_OPEN_S))) {
 378                 /* Mark as free so it can be reallocated later */
 379                 old_ptmx_ioctl = _state.pis_ioctl_list[minor];
 380                 _state.pis_ioctl_list[minor] = NULL;
 381                 _state.pis_free++;
 382         }
 383         DEVFS_UNLOCK();
 384
 385         /* Free old after dropping lock */
 386         if (old_ptmx_ioctl != NULL) {
 387                 /*
 388                  * XXX See <rdar://5348651> and <rdar://4854638>
 389                  *
 390                  * XXX Conditional to be removed when/if tty/pty reference
 391                  * XXX counting and mutex implemented.
 392                  */
 393                 if (old_ptmx_ioctl->pt_devhandle != NULL) {
 394                         devfs_remove(old_ptmx_ioctl->pt_devhandle);
 395                 }
 396                 ttyfree(old_ptmx_ioctl->pt_tty);
 397                 FREE(old_ptmx_ioctl, M_TTYS);
 398         }
 399
 400         return 0;     /* Success */
 401 }
 402
 403 static int
 404 ptmx_get_name(int minor, char *buffer, size_t size)
 405 {
 406         return snprintf(buffer, size, "/dev/" PTSD_TEMPLATE, minor);
 407 }
 408
 409
 410
 411 /*
 412  * Given the dev entry that's being opened, we clone the device.  This driver
 413  * doesn't actually use the dev entry, since we alreaqdy know who we are by
 414  * being called from this code.  This routine is a callback registered from
 415  * devfs_make_node_clone() in ptmx_init(); it's purpose is to provide a new
 416  * minor number, or to return -1, if one can't be provided.
 417  *
 418  * Parameters:  dev                     The device we are cloning from
 419  *
 420  * Returns:     >= 0                    A new minor device number
 421  *              -1                      Error: ENOMEM ("Can't alloc device")
 422  *
 423  * NOTE:        Called with DEVFS_LOCK() held
 424  */
 425 static int
 426 ptmx_clone(__unused dev_t dev, int action)
 427 {
 428         int i;
 429
 430         if (action == DEVFS_CLONE_ALLOC) {
 431                 /* First one */
 432                 if (_state.pis_total == 0) {
 433                         return 0;
 434                 }
 435
 436                 /*
 437                  * Note: We can add hinting on free slots, if this linear search
 438                  * ends up being a performance bottleneck...
 439                  */
 440                 for (i = 0; i < _state.pis_total; i++) {
 441                         if (_state.pis_ioctl_list[i] == NULL) {
 442                                 break;
 443                         }
 444                 }
 445
 446                 /*
 447                  * XXX We fall off the end here; if we did this twice at the
 448                  * XXX same time, we could return the same minor to two
 449                  * XXX callers; we should probably exand the pointer vector
 450                  * XXX here, but I need more information on the MALLOC/FREE
 451                  * XXX locking to ensure against a deadlock.  Maybe we can
 452                  * XXX just high watermark it at 1/2 of PTMX_GROW_VECTOR?
 453                  * XXX That would require returning &minor as implict return
 454                  * XXX and an error code ("EAGAIN/ERESTART") or 0 as our
 455                  * XXX explicit return.
 456                  */
 457
 458                 return i;     /* empty slot or next slot */
 459         }
 460         return -1;
 461 }
 462
 463
 464 /*
 465  * kqueue support.
 466  */
 467 int ptsd_kqfilter(dev_t dev, struct knote *kn);
 468 static void ptsd_kqops_detach(struct knote *);
 469 static int ptsd_kqops_event(struct knote *, long);
 470 static int ptsd_kqops_touch(struct knote *kn, struct kevent_internal_s *kev);
 471 static int ptsd_kqops_process(struct knote *kn, struct filt_process_s *data, struct kevent_internal_s *kev);
 472
 473 SECURITY_READ_ONLY_EARLY(struct filterops) ptsd_kqops = {
 474         .f_isfd = 1,
 475         /* attach is handled by ptsd_kqfilter -- the dev node must be passed in */
 476         .f_detach = ptsd_kqops_detach,
 477         .f_event = ptsd_kqops_event,
 478         .f_touch = ptsd_kqops_touch,
 479         .f_process = ptsd_kqops_process,
 480 };
 481
 482 /*
 483  * In the normal case, by the time the driver_close() routine is called
 484  * on the slave, all knotes have been detached.  However in the revoke(2)
 485  * case, the driver's close routine is called while there are knotes active
 486  * that reference the handlers below.  And we have no obvious means to
 487  * reach from the driver out to the kqueue's that reference them to get
 488  * them to stop.
 489  */
 490
 491 static void
 492 ptsd_kqops_detach(struct knote *kn)
 493 {
 494         struct tty *tp;
 495
 496         tp = kn->kn_hook;
 497         assert(tp != NULL);
 498
 499         tty_lock(tp);
 500
 501         /*
 502          * Only detach knotes from open ttys -- ttyclose detaches all knotes
 503          * under the lock and unsets TS_ISOPEN.
 504          */
 505         if (tp->t_state & TS_ISOPEN) {
 506                 switch (kn->kn_filter) {
 507                 case EVFILT_READ:
 508                         KNOTE_DETACH(&tp->t_rsel.si_note, kn);
 509                         break;
 510
 511                 case EVFILT_WRITE:
 512                         KNOTE_DETACH(&tp->t_wsel.si_note, kn);
 513                         break;
 514
 515                 default:
 516                         panic("invalid knote %p detach, filter: %d", kn, kn->kn_filter);
 517                         break;
 518                 }
 519         }
 520
 521         kn->kn_hook = NULL;
 522         tty_unlock(tp);
 523
 524         ttyfree(tp);
 525 }
 526
 527 static int
 528 ptsd_kqops_common(struct knote *kn, struct tty *tp)
 529 {
 530         int retval = 0;
 531
 532         TTY_LOCK_OWNED(tp);
 533
 534         switch (kn->kn_filter) {
 535         case EVFILT_READ:
 536                 kn->kn_data = ttnread(tp);
 537                 if (kn->kn_data > 0) {
 538                         retval = 1;
 539                 }
 540                 break;
 541
 542         case EVFILT_WRITE:
 543                 if ((tp->t_outq.c_cc <= tp->t_lowat) &&
 544                     (tp->t_state & TS_CONNECTED)) {
 545                         kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
 546                         retval = 1;
 547                 }
 548                 break;
 549
 550         default:
 551                 panic("ptsd kevent: unexpected filter: %d, kn = %p, tty = %p",
 552                     kn->kn_filter, kn, tp);
 553                 break;
 554         }
 555
 556         if (tp->t_state & TS_ZOMBIE) {
 557                 kn->kn_flags |= EV_EOF;
 558                 retval = 1;
 559         }
 560
 561         return retval;
 562 }
 563
 564 static int
 565 ptsd_kqops_event(struct knote *kn, long hint)
 566 {
 567         struct tty *tp = kn->kn_hook;
 568         int ret;
 569         bool revoked = hint & NOTE_REVOKE;
 570         hint &= ~NOTE_REVOKE;
 571
 572         if (!hint) {
 573                 tty_lock(tp);
 574         }
 575
 576         if (revoked) {
 577                 kn->kn_flags |= EV_EOF | EV_ONESHOT;
 578                 ret = 1;
 579         } else {
 580                 ret = ptsd_kqops_common(kn, tp);
 581         }
 582
 583         if (!hint) {
 584                 tty_unlock(tp);
 585         }
 586
 587         return ret;
 588 }
 589
 590 static int
 591 ptsd_kqops_touch(struct knote *kn, struct kevent_internal_s *kev)
 592 {
 593         struct tty *tp;
 594         int ret;
 595
 596         tp = kn->kn_hook;
 597
 598         tty_lock(tp);
 599
 600         /* accept new kevent state */
 601         kn->kn_sfflags = kev->fflags;
 602         kn->kn_sdata = kev->data;
 603
 604         /* recapture fired state of knote */
 605         ret = ptsd_kqops_common(kn, tp);
 606
 607         tty_unlock(tp);
 608
 609         return ret;
 610 }
 611
 612 static int
 613 ptsd_kqops_process(struct knote *kn, __unused struct filt_process_s *data,
 614     struct kevent_internal_s *kev)
 615 {
 616         struct tty *tp = kn->kn_hook;
 617         int ret;
 618
 619         tty_lock(tp);
 620         ret = ptsd_kqops_common(kn, tp);
 621         if (ret) {
 622                 *kev = kn->kn_kevent;
 623                 if (kn->kn_flags & EV_CLEAR) {
 624                         kn->kn_fflags = 0;
 625                         kn->kn_data = 0;
 626                 }
 627         }
 628         tty_unlock(tp);
 629
 630         return ret;
 631 }
 632
 633 int
 634 ptsd_kqfilter(dev_t dev, struct knote *kn)
 635 {
 636         struct tty *tp = NULL;
 637         struct ptmx_ioctl *pti = NULL;
 638         int ret;
 639
 640         /* make sure we're talking about the right device type */
 641         if (cdevsw[major(dev)].d_open != ptsopen) {
 642                 knote_set_error(kn, ENODEV);
 643                 return 0;
 644         }
 645
 646         if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
 647                 knote_set_error(kn, ENXIO);
 648                 return 0;
 649         }
 650
 651         tp = pti->pt_tty;
 652         tty_lock(tp);
 653
 654         assert(tp->t_state & TS_ISOPEN);
 655
 656         kn->kn_filtid = EVFILTID_PTSD;
 657         /* the tty will be freed when detaching the knote */
 658         ttyhold(tp);
 659         kn->kn_hook = tp;
 660
 661         switch (kn->kn_filter) {
 662         case EVFILT_READ:
 663                 KNOTE_ATTACH(&tp->t_rsel.si_note, kn);
 664                 break;
 665         case EVFILT_WRITE:
 666                 KNOTE_ATTACH(&tp->t_wsel.si_note, kn);
 667                 break;
 668         default:
 669                 panic("ptsd kevent: unexpected filter: %d, kn = %p, tty = %p",
 670                     kn->kn_filter, kn, tp);
 671                 break;
 672         }
 673
 674         /* capture current event state */
 675         ret = ptsd_kqops_common(kn, tp);
 676
 677         tty_unlock(tp);
 678
 679         return ret;
 680 }
 681
 682 /*
 683  * Support for revoke(2).
 684  */
 685 static void
 686 ptsd_revoke_knotes(__unused int minor, struct tty *tp)
 687 {
 688         tty_lock(tp);
 689
 690         ttwakeup(tp);
 691         KNOTE(&tp->t_rsel.si_note, NOTE_REVOKE | 1 /* the lock is already held */);
 692
 693         ttwwakeup(tp);
 694         KNOTE(&tp->t_wsel.si_note, NOTE_REVOKE | 1);
 695
 696         tty_unlock(tp);
 697 }
 698
 699 /*
 700  * kevent filter routines for the master side of a pty, a ptmx.
 701  *
 702  * Stuff the ptmx_ioctl structure into the hook for ptmx knotes.  Use the
 703  * embedded tty's lock for synchronization.
 704  */
 705
 706 int ptmx_kqfilter(dev_t dev, struct knote *kn);
 707 static void ptmx_kqops_detach(struct knote *);
 708 static int ptmx_kqops_event(struct knote *, long);
 709 static int ptmx_kqops_touch(struct knote *kn, struct kevent_internal_s *kev);
 710 static int ptmx_kqops_process(struct knote *kn, struct filt_process_s *data, struct kevent_internal_s *kev);
 711 static int ptmx_kqops_common(struct knote *kn, struct ptmx_ioctl *pti, struct tty *tp);
 712
 713 SECURITY_READ_ONLY_EARLY(struct filterops) ptmx_kqops = {
 714         .f_isfd = 1,
 715         /* attach is handled by ptmx_kqfilter -- the dev node must be passed in */
 716         .f_detach = ptmx_kqops_detach,
 717         .f_event = ptmx_kqops_event,
 718         .f_touch = ptmx_kqops_touch,
 719         .f_process = ptmx_kqops_process,
 720 };
 721
 722 static struct ptmx_ioctl *
 723 ptmx_knote_ioctl(struct knote *kn)
 724 {
 725         return (struct ptmx_ioctl *)kn->kn_hook;
 726 }
 727
 728 static struct tty *
 729 ptmx_knote_tty(struct knote *kn)
 730 {
 731         struct ptmx_ioctl *pti = kn->kn_hook;
 732         return pti->pt_tty;
 733 }
 734
 735 int
 736 ptmx_kqfilter(dev_t dev, struct knote *kn)
 737 {
 738         struct tty *tp = NULL;
 739         struct ptmx_ioctl *pti = NULL;
 740         int ret;
 741
 742         /* make sure we're talking about the right device type */
 743         if (cdevsw[major(dev)].d_open != ptcopen) {
 744                 knote_set_error(kn, ENODEV);
 745                 return 0;
 746         }
 747
 748         if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
 749                 knote_set_error(kn, ENXIO);
 750                 return 0;
 751         }
 752
 753         tp = pti->pt_tty;
 754         tty_lock(tp);
 755
 756         kn->kn_filtid = EVFILTID_PTMX;
 757         kn->kn_hook = pti;
 758
 759         /*
 760          * Attach to the ptmx's selinfo structures.  This is the major difference
 761          * to the ptsd filtops, which use the selinfo structures in the tty
 762          * structure.
 763          */
 764         switch (kn->kn_filter) {
 765         case EVFILT_READ:
 766                 KNOTE_ATTACH(&pti->pt_selr.si_note, kn);
 767                 break;
 768         case EVFILT_WRITE:
 769                 KNOTE_ATTACH(&pti->pt_selw.si_note, kn);
 770                 break;
 771         default:
 772                 panic("ptmx kevent: unexpected filter: %d, kn = %p, tty = %p",
 773                     kn->kn_filter, kn, tp);
 774                 break;
 775         }
 776
 777         /* capture current event state */
 778         ret = ptmx_kqops_common(kn, pti, tp);
 779
 780         /* take a reference on the TTY */
 781         ttyhold(tp);
 782         tty_unlock(tp);
 783
 784         return ret;
 785 }
 786
 787 static void
 788 ptmx_kqops_detach(struct knote *kn)
 789 {
 790         struct ptmx_ioctl *pti = kn->kn_hook;
 791         struct tty *tp = pti->pt_tty;
 792
 793         assert(tp != NULL);
 794
 795         tty_lock(tp);
 796
 797         switch (kn->kn_filter) {
 798         case EVFILT_READ:
 799                 KNOTE_DETACH(&pti->pt_selr.si_note, kn);
 800                 break;
 801
 802         case EVFILT_WRITE:
 803                 KNOTE_DETACH(&pti->pt_selw.si_note, kn);
 804                 break;
 805
 806         default:
 807                 panic("invalid knote %p detach, filter: %d", kn, kn->kn_filter);
 808                 break;
 809         }
 810
 811         kn->kn_hook = NULL;
 812         tty_unlock(tp);
 813
 814         ttyfree(tp);
 815 }
 816
 817 static int
 818 ptmx_kqops_common(struct knote *kn, struct ptmx_ioctl *pti, struct tty *tp)
 819 {
 820         int retval = 0;
 821
 822         TTY_LOCK_OWNED(tp);
 823
 824         /* disconnects should force a wakeup (EOF) */
 825         if (!(tp->t_state & TS_CONNECTED)) {
 826                 kn->kn_flags |= EV_EOF;
 827                 return 1;
 828         }
 829
 830         switch (kn->kn_filter) {
 831         case EVFILT_READ:
 832                 /* there's data on the TTY and it's not stopped */
 833                 if (tp->t_outq.c_cc && !(tp->t_state & TS_TTSTOP)) {
 834                         retval = tp->t_outq.c_cc;
 835                         kn->kn_data = retval;
 836                 } else if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
 837                     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)) {
 838                         retval = 1;
 839                 }
 840                 break;
 841
 842         case EVFILT_WRITE:
 843                 if (pti->pt_flags & PF_REMOTE) {
 844                         if (tp->t_canq.c_cc == 0) {
 845                                 retval = TTYHOG - 1;
 846                         }
 847                 } else {
 848                         retval = (TTYHOG - 2) - (tp->t_rawq.c_cc + tp->t_canq.c_cc);
 849                         if (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON)) {
 850                                 retval = 1;
 851                         }
 852                         if (retval < 0) {
 853                                 retval = 0;
 854                         }
 855                 }
 856                 break;
 857
 858         default:
 859                 panic("ptmx kevent: unexpected filter: %d, kn = %p, tty = %p",
 860                     kn->kn_filter, kn, tp);
 861                 break;
 862         }
 863
 864         if (tp->t_state & TS_ZOMBIE) {
 865                 kn->kn_flags |= EV_EOF;
 866                 retval = 1;
 867         }
 868
 869         return retval;
 870 }
 871
 872 static int
 873 ptmx_kqops_event(struct knote *kn, long hint)
 874 {
 875         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 876         struct tty *tp = ptmx_knote_tty(kn);
 877         int ret;
 878         bool revoked = hint & NOTE_REVOKE;
 879         hint &= ~NOTE_REVOKE;
 880
 881         if (!hint) {
 882                 tty_lock(tp);
 883         }
 884
 885         if (revoked) {
 886                 kn->kn_flags |= EV_EOF | EV_ONESHOT;
 887                 ret = 1;
 888         } else {
 889                 ret = ptmx_kqops_common(kn, pti, tp);
 890         }
 891
 892         if (!hint) {
 893                 tty_unlock(tp);
 894         }
 895
 896         return ret;
 897 }
 898
 899 static int
 900 ptmx_kqops_touch(struct knote *kn, struct kevent_internal_s *kev)
 901 {
 902         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 903         struct tty *tp = ptmx_knote_tty(kn);
 904         int ret;
 905
 906         tty_lock(tp);
 907
 908         /* accept new kevent state */
 909         kn->kn_sfflags = kev->fflags;
 910         kn->kn_sdata = kev->data;
 911
 912         /* recapture fired state of knote */
 913         ret = ptmx_kqops_common(kn, pti, tp);
 914
 915         tty_unlock(tp);
 916
 917         return ret;
 918 }
 919
 920 static int
 921 ptmx_kqops_process(struct knote *kn, __unused struct filt_process_s *data,
 922     struct kevent_internal_s *kev)
 923 {
 924         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 925         struct tty *tp = ptmx_knote_tty(kn);
 926         int ret;
 927
 928         tty_lock(tp);
 929         ret = ptmx_kqops_common(kn, pti, tp);
 930         if (ret) {
 931                 *kev = kn->kn_kevent;
 932                 if (kn->kn_flags & EV_CLEAR) {
 933                         kn->kn_fflags = 0;
 934                         kn->kn_data = 0;
 935                 }
 936         }
 937         tty_unlock(tp);
 938
 939         return ret;
 940 }