bsd/kern/tty_dev.c

   1 /*
   2  * Copyright (c) 1997-2013 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1982, 1986, 1989, 1993
  30  *      The Regents of the University of California.  All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. All advertising materials mentioning features or use of this software
  41  *    must display the following acknowledgement:
  42  *      This product includes software developed by the University of
  43  *      California, Berkeley and its contributors.
  44  * 4. Neither the name of the University nor the names of its contributors
  45  *    may be used to endorse or promote products derived from this software
  46  *    without specific prior written permission.
  47  *
  48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  58  * SUCH DAMAGE.
  59  *
  60  *      @(#)tty_pty.c   8.4 (Berkeley) 2/20/95
  61  */
  62
  63 /* Common callbacks for the pseudo-teletype driver (pty/tty)
  64  * and cloning pseudo-teletype driver (ptmx/pts).
  65  */
  66
  67 #include <sys/param.h>
  68 #include <sys/systm.h>
  69 #include <sys/ioctl.h>
  70 #include <sys/proc_internal.h>
  71 #include <sys/kauth.h>
  72 #include <sys/tty.h>
  73 #include <sys/conf.h>
  74 #include <sys/file_internal.h>
  75 #include <sys/uio_internal.h>
  76 #include <sys/kernel.h>
  77 #include <sys/vnode.h>
  78 #include <sys/vnode_internal.h>         /* _devfs_setattr() */
  79 #include <sys/stat.h>                   /* _devfs_setattr() */
  80 #include <sys/user.h>
  81 #include <sys/signalvar.h>
  82 #include <sys/sysctl.h>
  83 #include <miscfs/devfs/devfs.h>
  84 #include <miscfs/devfs/devfsdefs.h>     /* DEVFS_LOCK()/DEVFS_UNLOCK() */
  85
  86 #if CONFIG_MACF
  87 #include <security/mac_framework.h>
  88 #endif
  89
  90 #include "tty_dev.h"
  91
  92 /* XXX belongs in devfs somewhere - LATER */
  93 static int _devfs_setattr(void *, unsigned short, uid_t, gid_t);
  94
  95 /*
  96  * Forward declarations
  97  */
  98 static void ptcwakeup(struct tty *tp, int flag);
  99 __XNU_PRIVATE_EXTERN    d_open_t        ptsopen;
 100 __XNU_PRIVATE_EXTERN    d_close_t       ptsclose;
 101 __XNU_PRIVATE_EXTERN    d_read_t        ptsread;
 102 __XNU_PRIVATE_EXTERN    d_write_t       ptswrite;
 103 __XNU_PRIVATE_EXTERN    d_ioctl_t       ptyioctl;       /* common ioctl */
 104 __XNU_PRIVATE_EXTERN    d_stop_t        ptsstop;
 105 __XNU_PRIVATE_EXTERN    d_reset_t       ptsreset;
 106 __XNU_PRIVATE_EXTERN    d_select_t      ptsselect;
 107 __XNU_PRIVATE_EXTERN    d_open_t        ptcopen;
 108 __XNU_PRIVATE_EXTERN    d_close_t       ptcclose;
 109 __XNU_PRIVATE_EXTERN    d_read_t        ptcread;
 110 __XNU_PRIVATE_EXTERN    d_write_t       ptcwrite;
 111 __XNU_PRIVATE_EXTERN    d_stop_t        ptcstop;        /* NO-OP */
 112 __XNU_PRIVATE_EXTERN    d_reset_t       ptcreset;
 113 __XNU_PRIVATE_EXTERN    d_select_t      ptcselect;
 114
 115 /*
 116  * XXX Should be devfs function... and use VATTR mechanisms, per
 117  * XXX vnode_setattr2(); only we maybe can't really get back to the
 118  * XXX vnode here for cloning devices (but it works for *cloned* devices
 119  * XXX that are not themselves cloning).
 120  *
 121  * Returns:     0                       Success
 122  *      namei:???
 123  *      vnode_setattr:???
 124  */
 125 static int
 126 _devfs_setattr(void * handle, unsigned short mode, uid_t uid, gid_t gid)
 127 {
 128         devdirent_t             *direntp = (devdirent_t *)handle;
 129         devnode_t               *devnodep;
 130         int                     error = EACCES;
 131         vfs_context_t           ctx = vfs_context_current();;
 132         struct vnode_attr       va;
 133
 134         VATTR_INIT(&va);
 135         VATTR_SET(&va, va_uid, uid);
 136         VATTR_SET(&va, va_gid, gid);
 137         VATTR_SET(&va, va_mode, mode & ALLPERMS);
 138
 139         /*
 140          * If the TIOCPTYGRANT loses the race with the clone operation because
 141          * this function is not part of devfs, and therefore can't take the
 142          * devfs lock to protect the direntp update, then force user space to
 143          * redrive the grant request.
 144          */
 145         if (direntp == NULL || (devnodep = direntp->de_dnp) == NULL) {
 146                 error = ERESTART;
 147                 goto out;
 148         }
 149
 150         /*
 151          * Only do this if we are operating on device that doesn't clone
 152          * each time it's referenced.  We perform a lookup on the device
 153          * to insure we get the right instance.  We can't just use the call
 154          * to devfs_dntovn() to get the vp for the operation, because
 155          * dn_dvm may not have been initialized.
 156          */
 157         if (devnodep->dn_clone == NULL) {
 158                 struct nameidata nd;
 159                 char name[128];
 160
 161                 snprintf(name, sizeof(name), "/dev/%s", direntp->de_name);
 162                 NDINIT(&nd, LOOKUP, OP_SETATTR, FOLLOW, UIO_SYSSPACE, CAST_USER_ADDR_T(name), ctx);
 163                 error = namei(&nd);
 164                 if (error)
 165                         goto out;
 166                 error = vnode_setattr(nd.ni_vp, &va, ctx);
 167                 vnode_put(nd.ni_vp);
 168                 nameidone(&nd);
 169                 goto out;
 170         }
 171
 172 out:
 173         return(error);
 174 }
 175
 176 #define BUFSIZ 100              /* Chunk size iomoved to/from user */
 177
 178 static struct tty_dev_t *tty_dev_head;
 179
 180 __private_extern__ void
 181 tty_dev_register(struct tty_dev_t *driver)
 182 {
 183         if (driver) {
 184                 driver->next = tty_dev_head;
 185                 tty_dev_head = driver;
 186         }
 187 }
 188
 189 /*
 190  * Given a minor number, return the corresponding structure for that minor
 191  * number.  If there isn't one, and the create flag is specified, we create
 192  * one if possible.
 193  *
 194  * Parameters:  minor                   Minor number of ptmx device
 195  *              open_flag               PF_OPEN_M       First open of master
 196  *                                      PF_OPEN_S       First open of slave
 197  *                                      0               Just want ioctl struct
 198  *
 199  * Returns:     NULL                    Did not exist/could not create
 200  *              !NULL                   structure corresponding minor number
 201  *
 202  * Locks:       tty_lock() on ptmx_ioctl->pt_tty NOT held on entry or exit.
 203  */
 204
 205 static struct tty_dev_t *
 206 pty_get_driver(dev_t dev)
 207 {
 208         int major = major(dev);
 209         struct tty_dev_t *driver;
 210         for (driver = tty_dev_head; driver != NULL; driver = driver->next) {
 211                 if ((driver->master == major || driver->slave == major)) {
 212                         break;
 213                 }
 214         }
 215         return driver;
 216 }
 217
 218 static struct ptmx_ioctl *
 219 pty_get_ioctl(dev_t dev, int open_flag, struct tty_dev_t **out_driver)
 220 {
 221         struct tty_dev_t *driver = pty_get_driver(dev);
 222         if (out_driver) {
 223                 *out_driver = driver;
 224         }
 225         if (driver && driver->open) {
 226                 return driver->open(minor(dev), open_flag);
 227         }
 228         return NULL;
 229 }
 230
 231 /*
 232  * Locks:       tty_lock() of old_ptmx_ioctl->pt_tty NOT held for this call.
 233  */
 234 static int
 235 pty_free_ioctl(dev_t dev, int open_flag)
 236 {
 237         struct tty_dev_t *driver = pty_get_driver(dev);
 238         if (driver && driver->free) {
 239                 return driver->free(minor(dev), open_flag);
 240         }
 241         return 0;
 242 }
 243
 244 static int
 245 pty_get_name(dev_t dev, char *buffer, size_t size)
 246 {
 247         struct tty_dev_t *driver = pty_get_driver(dev);
 248         if (driver && driver->name) {
 249                 return driver->name(minor(dev), buffer, size);
 250         }
 251         return 0;
 252 }
 253
 254 __private_extern__ int
 255 ptsopen(dev_t dev, int flag, __unused int devtype, __unused struct proc *p)
 256 {
 257         int error;
 258         struct tty_dev_t *driver;
 259         struct ptmx_ioctl *pti = pty_get_ioctl(dev, PF_OPEN_S, &driver);
 260         if (pti == NULL) {
 261                 return ENXIO;
 262         }
 263         if (!(pti->pt_flags & PF_UNLOCKED)) {
 264                 return EAGAIN;
 265         }
 266
 267         struct tty *tp = pti->pt_tty;
 268         tty_lock(tp);
 269
 270         if ((tp->t_state & TS_ISOPEN) == 0) {
 271                 termioschars(&tp->t_termios);   /* Set up default chars */
 272                 tp->t_iflag = TTYDEF_IFLAG;
 273                 tp->t_oflag = TTYDEF_OFLAG;
 274                 tp->t_lflag = TTYDEF_LFLAG;
 275                 tp->t_cflag = TTYDEF_CFLAG;
 276                 tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
 277                 ttsetwater(tp);         /* would be done in xxparam() */
 278         } else if ((tp->t_state & TS_XCLUDE) && kauth_cred_issuser(kauth_cred_get())) {
 279                 error = EBUSY;
 280                 goto out;
 281         }
 282         if (tp->t_oproc)                        /* Ctrlr still around. */
 283                 (void)(*linesw[tp->t_line].l_modem)(tp, 1);
 284         while ((tp->t_state & TS_CARR_ON) == 0) {
 285                 if (flag&FNONBLOCK)
 286                         break;
 287                 error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH, __FUNCTION__, 0);
 288                 if (error)
 289                         goto out;
 290         }
 291         error = (*linesw[tp->t_line].l_open)(dev, tp);
 292         /* Successful open; mark as open by the slave */
 293
 294         pti->pt_flags |= PF_OPEN_S;
 295         CLR(tp->t_state, TS_IOCTL_NOT_OK);
 296         if (error == 0)
 297                 ptcwakeup(tp, FREAD|FWRITE);
 298
 299 out:
 300         tty_unlock(tp);
 301         return (error);
 302 }
 303
 304 __private_extern__ int
 305 ptsclose(dev_t dev, int flag, __unused int mode, __unused proc_t p)
 306 {
 307         int err;
 308
 309         /*
 310          * This is temporary until the VSX conformance tests
 311          * are fixed.  They are hanging with a deadlock
 312          * where close() will not complete without t_timeout set
 313          */
 314 #define FIX_VSX_HANG    1
 315 #ifdef  FIX_VSX_HANG
 316         int save_timeout;
 317 #endif
 318         struct tty_dev_t *driver;
 319         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, &driver);
 320         struct tty *tp;
 321
 322         if (pti == NULL)
 323                 return (ENXIO);
 324
 325         tp = pti->pt_tty;
 326         tty_lock(tp);
 327 #ifdef  FIX_VSX_HANG
 328         save_timeout = tp->t_timeout;
 329         tp->t_timeout = 60;
 330 #endif
 331         /*
 332          * Close the line discipline and backing TTY structures.
 333          */
 334         err = (*linesw[tp->t_line].l_close)(tp, flag);
 335         (void)ttyclose(tp);
 336
 337         /*
 338          * Flush data and notify any waiters on the master side of this PTY.
 339          */
 340         ptsstop(tp, FREAD | FWRITE);
 341 #ifdef  FIX_VSX_HANG
 342         tp->t_timeout = save_timeout;
 343 #endif
 344         tty_unlock(tp);
 345
 346         if ((flag & IO_REVOKE) == IO_REVOKE && driver->revoke) {
 347                 driver->revoke(minor(dev), tp);
 348         }
 349         /* unconditional, just like ttyclose() */
 350         pty_free_ioctl(dev, PF_OPEN_S);
 351
 352         return (err);
 353 }
 354
 355 __private_extern__ int
 356 ptsread(dev_t dev, struct uio *uio, int flag)
 357 {
 358         proc_t p = current_proc();
 359         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 360         struct tty *tp;
 361         int error = 0;
 362         struct uthread *ut;
 363         struct pgrp *pg;
 364
 365         if (pti == NULL)
 366                 return (ENXIO);
 367         tp = pti->pt_tty;
 368         tty_lock(tp);
 369
 370         ut = (struct uthread *)get_bsdthread_info(current_thread());
 371 again:
 372         if (pti->pt_flags & PF_REMOTE) {
 373                 while (isbackground(p, tp)) {
 374                         if ((p->p_sigignore & sigmask(SIGTTIN)) ||
 375                             (ut->uu_sigmask & sigmask(SIGTTIN)) ||
 376                             p->p_lflag & P_LPPWAIT) {
 377                                 error = EIO;
 378                                 goto out;
 379                         }
 380
 381
 382                         pg = proc_pgrp(p);
 383                         if (pg == PGRP_NULL) {
 384                                 error = EIO;
 385                                 goto out;
 386                         }
 387                         /*
 388                          * SAFE: We about to drop the lock ourselves by
 389                          * SAFE: erroring out or sleeping anyway.
 390                          */
 391                         tty_unlock(tp);
 392                         if (pg->pg_jobc == 0) {
 393                                 pg_rele(pg);
 394                                 tty_lock(tp);
 395                                 error = EIO;
 396                                 goto out;
 397                         }
 398                         pgsignal(pg, SIGTTIN, 1);
 399                         pg_rele(pg);
 400                         tty_lock(tp);
 401
 402                         error = ttysleep(tp, &ptsread, TTIPRI | PCATCH | PTTYBLOCK, __FUNCTION__, hz);
 403                         if (error)
 404                                 goto out;
 405                 }
 406                 if (tp->t_canq.c_cc == 0) {
 407                         if (flag & IO_NDELAY) {
 408                                 error = EWOULDBLOCK;
 409                                 goto out;
 410                         }
 411                         error = ttysleep(tp, TSA_PTS_READ(tp), TTIPRI | PCATCH, __FUNCTION__, 0);
 412                         if (error)
 413                                 goto out;
 414                         goto again;
 415                 }
 416                 while (tp->t_canq.c_cc > 1 && uio_resid(uio) > 0) {
 417                         int cc;
 418                         char buf[BUFSIZ];
 419
 420                         cc = MIN((int)uio_resid(uio), BUFSIZ);
 421                         // Don't copy the very last byte
 422                         cc = MIN(cc, tp->t_canq.c_cc - 1);
 423                         cc = q_to_b(&tp->t_canq, (u_char *)buf, cc);
 424                         error = uiomove(buf, cc, uio);
 425                         if (error)
 426                                 break;
 427                 }
 428                 if (tp->t_canq.c_cc == 1)
 429                         (void) getc(&tp->t_canq);
 430                 if (tp->t_canq.c_cc)
 431                         goto out;
 432         } else
 433                 if (tp->t_oproc)
 434                         error = (*linesw[tp->t_line].l_read)(tp, uio, flag);
 435         ptcwakeup(tp, FWRITE);
 436 out:
 437         tty_unlock(tp);
 438         return (error);
 439 }
 440
 441 /*
 442  * Write to pseudo-tty.
 443  * Wakeups of controlling tty will happen
 444  * indirectly, when tty driver calls ptsstart.
 445  */
 446 __private_extern__ int
 447 ptswrite(dev_t dev, struct uio *uio, int flag)
 448 {
 449         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 450         struct tty *tp;
 451         int error;
 452
 453         if (pti == NULL)
 454                 return (ENXIO);
 455         tp = pti->pt_tty;
 456         tty_lock(tp);
 457
 458         if (tp->t_oproc == 0)
 459                 error = EIO;
 460         else
 461                 error = (*linesw[tp->t_line].l_write)(tp, uio, flag);
 462
 463         tty_unlock(tp);
 464
 465         return (error);
 466 }
 467
 468 /*
 469  * Start output on pseudo-tty.
 470  * Wake up process selecting or sleeping for input from controlling tty.
 471  *
 472  * t_oproc for this driver; called from within the line discipline
 473  *
 474  * Locks:       Assumes tp is locked on entry, remains locked on exit
 475  */
 476 static void
 477 ptsstart(struct tty *tp)
 478 {
 479         struct ptmx_ioctl *pti = pty_get_ioctl(tp->t_dev, 0, NULL);
 480         if (pti == NULL)
 481                 goto out;
 482         if (tp->t_state & TS_TTSTOP)
 483                 goto out;
 484         if (pti->pt_flags & PF_STOPPED) {
 485                 pti->pt_flags &= ~PF_STOPPED;
 486                 pti->pt_send = TIOCPKT_START;
 487         }
 488         ptcwakeup(tp, FREAD);
 489 out:
 490         return;
 491 }
 492
 493 /*
 494  * Locks:       Assumes tty_lock() is held over this call.
 495  */
 496 static void
 497 ptcwakeup(struct tty *tp, int flag)
 498 {
 499         struct ptmx_ioctl *pti = pty_get_ioctl(tp->t_dev, 0, NULL);
 500         if (pti == NULL)
 501                 return;
 502
 503         if (flag & FREAD) {
 504                 selwakeup(&pti->pt_selr);
 505                 wakeup(TSA_PTC_READ(tp));
 506                 KNOTE(&pti->pt_selr.si_note, 1);
 507         }
 508         if (flag & FWRITE) {
 509                 selwakeup(&pti->pt_selw);
 510                 wakeup(TSA_PTC_WRITE(tp));
 511                 KNOTE(&pti->pt_selw.si_note, 1);
 512         }
 513 }
 514
 515 __private_extern__ int
 516 ptcopen(dev_t dev, __unused int flag, __unused int devtype, __unused proc_t p)
 517 {
 518         struct tty_dev_t *driver;
 519         struct ptmx_ioctl *pti = pty_get_ioctl(dev, PF_OPEN_M, &driver);
 520         if (pti == NULL) {
 521                 return (ENXIO);
 522         } else if (pti == (struct ptmx_ioctl*)-1) {
 523                 return (EREDRIVEOPEN);
 524         }
 525
 526         struct tty *tp = pti->pt_tty;
 527         tty_lock(tp);
 528
 529         /* If master is open OR slave is still draining, pty is still busy */
 530         if (tp->t_oproc || (tp->t_state & TS_ISOPEN)) {
 531                 tty_unlock(tp);
 532                 /*
 533                  * If master is closed, we are the only reference, so we
 534                  * need to clear the master open bit
 535                  */
 536                 if (!tp->t_oproc) {
 537                         pty_free_ioctl(dev, PF_OPEN_M);
 538                 }
 539                 return EBUSY;
 540         }
 541         tp->t_oproc = ptsstart;
 542         CLR(tp->t_state, TS_ZOMBIE);
 543         SET(tp->t_state, TS_IOCTL_NOT_OK);
 544 #ifdef sun4c
 545         tp->t_stop = ptsstop;
 546 #endif
 547         (void)(*linesw[tp->t_line].l_modem)(tp, 1);
 548         tp->t_lflag &= ~EXTPROC;
 549
 550         if (driver->open_reset) {
 551                 pti->pt_flags = PF_UNLOCKED;
 552                 pti->pt_send = 0;
 553                 pti->pt_ucntl = 0;
 554         }
 555
 556         tty_unlock(tp);
 557         return 0;
 558 }
 559
 560 __private_extern__ int
 561 ptcclose(dev_t dev, __unused int flags, __unused int fmt, __unused proc_t p)
 562 {
 563         struct tty_dev_t *driver;
 564         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, &driver);
 565         struct tty *tp;
 566         struct knote *kn;
 567
 568         if (!pti) {
 569                 return ENXIO;
 570         }
 571
 572         tp = pti->pt_tty;
 573         tty_lock(tp);
 574
 575         /*
 576          * XXX MDMBUF makes no sense for PTYs, but would inhibit an `l_modem`.
 577          * CLOCAL makes sense but isn't supported.  Special `l_modem`s that ignore
 578          * carrier drop make no sense for PTYs but may be in use because other parts
 579          * of the line discipline make sense for PTYs.  Recover by doing everything
 580          * that a normal `ttymodem` would have done except for sending SIGHUP.
 581          */
 582         (void)(*linesw[tp->t_line].l_modem)(tp, 0);
 583         if (tp->t_state & TS_ISOPEN) {
 584                 tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
 585                 tp->t_state |= TS_ZOMBIE;
 586                 ttyflush(tp, FREAD | FWRITE);
 587         }
 588
 589         /*
 590          * Null out the backing TTY struct's open procedure to prevent starting
 591          * slaves through `ptsstart`.
 592          */
 593         tp->t_oproc = NULL;
 594
 595         /*
 596          * Clear any select or kevent waiters under the lock.
 597          */
 598         SLIST_FOREACH(kn, &pti->pt_selr.si_note, kn_selnext) {
 599                 KNOTE_DETACH(&pti->pt_selr.si_note, kn);
 600         }
 601         selthreadclear(&pti->pt_selr);
 602         SLIST_FOREACH(kn, &pti->pt_selw.si_note, kn_selnext) {
 603                 KNOTE_DETACH(&pti->pt_selw.si_note, kn);
 604         }
 605         selthreadclear(&pti->pt_selw);
 606
 607         tty_unlock(tp);
 608
 609         pty_free_ioctl(dev, PF_OPEN_M);
 610 #if CONFIG_MACF
 611         if (driver->mac_notify) {
 612                 mac_pty_notify_close(p, tp, dev, NULL);
 613         }
 614 #endif
 615
 616         return (0);
 617 }
 618
 619 __private_extern__ int
 620 ptcread(dev_t dev, struct uio *uio, int flag)
 621 {
 622         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 623         struct tty *tp;
 624         char buf[BUFSIZ];
 625         int error = 0, cc;
 626
 627         if (pti == NULL)
 628                 return (ENXIO);
 629         tp = pti->pt_tty;
 630         tty_lock(tp);
 631
 632         /*
 633          * We want to block until the slave
 634          * is open, and there's something to read;
 635          * but if we lost the slave or we're NBIO,
 636          * then return the appropriate error instead.
 637          */
 638         for (;;) {
 639                 if (tp->t_state & TS_ISOPEN) {
 640                         if (pti->pt_flags & PF_PKT && pti->pt_send) {
 641                                 error = ureadc((int)pti->pt_send, uio);
 642                                 if (error)
 643                                         goto out;
 644                                 if (pti->pt_send & TIOCPKT_IOCTL) {
 645                                         cc = MIN((int)uio_resid(uio),
 646                                                 (int)sizeof(tp->t_termios));
 647                                         uiomove((caddr_t)&tp->t_termios, cc,
 648                                                 uio);
 649                                 }
 650                                 pti->pt_send = 0;
 651                                 goto out;
 652                         }
 653                         if (pti->pt_flags & PF_UCNTL && pti->pt_ucntl) {
 654                                 error = ureadc((int)pti->pt_ucntl, uio);
 655                                 if (error)
 656                                         goto out;
 657                                 pti->pt_ucntl = 0;
 658                                 goto out;
 659                         }
 660                         if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
 661                                 break;
 662                 }
 663                 if ((tp->t_state & TS_CONNECTED) == 0)
 664                         goto out;       /* EOF */
 665                 if (flag & IO_NDELAY) {
 666                         error = EWOULDBLOCK;
 667                         goto out;
 668                 }
 669                 error = ttysleep(tp, TSA_PTC_READ(tp), TTIPRI | PCATCH, __FUNCTION__, 0);
 670                 if (error)
 671                         goto out;
 672         }
 673         if (pti->pt_flags & (PF_PKT|PF_UCNTL))
 674                 error = ureadc(0, uio);
 675         while (uio_resid(uio) > 0 && error == 0) {
 676                 cc = q_to_b(&tp->t_outq, (u_char *)buf, MIN((int)uio_resid(uio), BUFSIZ));
 677                 if (cc <= 0)
 678                         break;
 679                 error = uiomove(buf, cc, uio);
 680         }
 681         (*linesw[tp->t_line].l_start)(tp);
 682
 683 out:
 684         tty_unlock(tp);
 685
 686         return (error);
 687 }
 688
 689 /*
 690  * Line discipline callback
 691  *
 692  * Locks:       tty_lock() is assumed held on entry and exit.
 693  */
 694 __private_extern__ int
 695 ptsstop(struct tty* tp, int flush)
 696 {
 697         struct ptmx_ioctl *pti = pty_get_ioctl(tp->t_dev, 0, NULL);
 698         int flag;
 699
 700         if (pti == NULL)
 701                 return (ENXIO);
 702
 703         /* note: FLUSHREAD and FLUSHWRITE already ok */
 704         if (flush == 0) {
 705                 flush = TIOCPKT_STOP;
 706                 pti->pt_flags |= PF_STOPPED;
 707         } else
 708                 pti->pt_flags &= ~PF_STOPPED;
 709         pti->pt_send |= flush;
 710         /* change of perspective */
 711         flag = 0;
 712         if (flush & FREAD)
 713                 flag |= FWRITE;
 714         if (flush & FWRITE)
 715                 flag |= FREAD;
 716         ptcwakeup(tp, flag);
 717         return 0;
 718 }
 719
 720 __private_extern__ int
 721 ptsreset(__unused int uban)
 722 {
 723         return (0);
 724 }
 725
 726 int
 727 ptsselect(dev_t dev, int rw, void *wql, proc_t p)
 728 {
 729         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 730         struct tty *tp;
 731         int retval = 0;
 732
 733         if (pti == NULL)
 734                 return (ENXIO);
 735         tp = pti->pt_tty;
 736         if (tp == NULL)
 737                 return (ENXIO);
 738
 739         tty_lock(tp);
 740
 741         switch (rw) {
 742         case FREAD:
 743                 if (ISSET(tp->t_state, TS_ZOMBIE)) {
 744                         retval = 1;
 745                         break;
 746                 }
 747
 748                 retval = ttnread(tp);
 749                 if (retval > 0) {
 750                         break;
 751                 }
 752
 753                 selrecord(p, &tp->t_rsel, wql);
 754                 break;
 755         case FWRITE:
 756                 if (ISSET(tp->t_state, TS_ZOMBIE)) {
 757                         retval = 1;
 758                         break;
 759                 }
 760
 761                 if ((tp->t_outq.c_cc <= tp->t_lowat) &&
 762                                 ISSET(tp->t_state, TS_CONNECTED)) {
 763                         retval = tp->t_hiwat - tp->t_outq.c_cc;
 764                         break;
 765                 }
 766
 767                 selrecord(p, &tp->t_wsel, wql);
 768                 break;
 769         }
 770
 771         tty_unlock(tp);
 772         return (retval);
 773 }
 774
 775 __private_extern__ int
 776 ptcselect(dev_t dev, int rw, void *wql, proc_t p)
 777 {
 778         struct tty_dev_t *driver;
 779         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, &driver);
 780         struct tty *tp;
 781         int retval = 0;
 782
 783         if (pti == NULL)
 784                 return (ENXIO);
 785         tp = pti->pt_tty;
 786         tty_lock(tp);
 787
 788         if ((tp->t_state & TS_CONNECTED) == 0) {
 789                 retval = 1;
 790                 goto out;
 791         }
 792         switch (rw) {
 793
 794         case FREAD:
 795                 /*
 796                  * Need to block timeouts (ttrstart).
 797                  */
 798                 if ((tp->t_state&TS_ISOPEN) &&
 799                      tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0) {
 800                         retval = (driver->fix_7828447) ? tp->t_outq.c_cc : 1;
 801                         break;
 802                 }
 803                 /* FALLTHROUGH */
 804
 805         case 0: /* exceptional */
 806                 if ((tp->t_state&TS_ISOPEN) &&
 807                                 (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
 808                                  ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))) {
 809                         retval = 1;
 810                         break;
 811                 }
 812                 selrecord(p, &pti->pt_selr, wql);
 813                 break;
 814
 815
 816         case FWRITE:
 817                 if (tp->t_state&TS_ISOPEN) {
 818                         if (pti->pt_flags & PF_REMOTE) {
 819                                 if (tp->t_canq.c_cc == 0) {
 820                                         retval = (driver->fix_7828447) ? (TTYHOG - 1) : 1;
 821                                         break;
 822                             }
 823                         } else {
 824                                 retval = (TTYHOG - 2) - (tp->t_rawq.c_cc + tp->t_canq.c_cc);
 825                                 if (retval > 0) {
 826                                         retval = (driver->fix_7828447) ? retval : 1;
 827                                         break;
 828                                 }
 829                                 if (tp->t_canq.c_cc == 0 && (tp->t_lflag&ICANON)) {
 830                                         retval = 1;
 831                                         break;
 832                                 }
 833                                 retval = 0;
 834                         }
 835                 }
 836                 selrecord(p, &pti->pt_selw, wql);
 837                 break;
 838
 839         }
 840 out:
 841         tty_unlock(tp);
 842
 843         return (retval);
 844 }
 845
 846 __private_extern__ int
 847 ptcstop(__unused struct tty *tp, __unused int flush)
 848 {
 849         return (0);
 850 }
 851
 852 __private_extern__ int
 853 ptcreset(__unused int uban)
 854 {
 855         return (0);
 856 }
 857
 858 __private_extern__ int
 859 ptcwrite(dev_t dev, struct uio *uio, int flag)
 860 {
 861         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, NULL);
 862         struct tty *tp;
 863         u_char *cp = NULL;
 864         int cc = 0;
 865         u_char locbuf[BUFSIZ];
 866         int wcnt = 0;
 867         int error = 0;
 868
 869         if (pti == NULL)
 870                 return (ENXIO);
 871         tp = pti->pt_tty;
 872         tty_lock(tp);
 873
 874 again:
 875         if ((tp->t_state & TS_ISOPEN) == 0)
 876                 goto block;
 877         if (pti->pt_flags & PF_REMOTE) {
 878                 if (tp->t_canq.c_cc)
 879                         goto block;
 880                 while ((uio_resid(uio) > 0 || cc > 0) &&
 881                        tp->t_canq.c_cc < TTYHOG - 1) {
 882                         if (cc == 0) {
 883                                 cc = MIN((int)uio_resid(uio), BUFSIZ);
 884                                 cc = MIN(cc, TTYHOG - 1 - tp->t_canq.c_cc);
 885                                 cp = locbuf;
 886                                 error = uiomove((caddr_t)cp, cc, uio);
 887                                 if (error)
 888                                         goto out;
 889                                 /* check again for safety */
 890                                 if ((tp->t_state & TS_ISOPEN) == 0) {
 891                                         /* adjust as usual */
 892                                         uio_setresid(uio, (uio_resid(uio) + cc));
 893                                         error = EIO;
 894                                         goto out;
 895                                 }
 896                         }
 897                         if (cc > 0) {
 898                                 cc = b_to_q((u_char *)cp, cc, &tp->t_canq);
 899                                 /*
 900                                  * XXX we don't guarantee that the canq size
 901                                  * is >= TTYHOG, so the above b_to_q() may
 902                                  * leave some bytes uncopied.  However, space
 903                                  * is guaranteed for the null terminator if
 904                                  * we don't fail here since (TTYHOG - 1) is
 905                                  * not a multiple of CBSIZE.
 906                                  */
 907                                 if (cc > 0)
 908                                         break;
 909                         }
 910                 }
 911                 /* adjust for data copied in but not written */
 912                 uio_setresid(uio, (uio_resid(uio) + cc));
 913                 (void) putc(0, &tp->t_canq);
 914                 ttwakeup(tp);
 915                 wakeup(TSA_PTS_READ(tp));
 916                 goto out;
 917         }
 918         while (uio_resid(uio) > 0 || cc > 0) {
 919                 if (cc == 0) {
 920                         cc = MIN((int)uio_resid(uio), BUFSIZ);
 921                         cp = locbuf;
 922                         error = uiomove((caddr_t)cp, cc, uio);
 923                         if (error)
 924                                 goto out;
 925                         /* check again for safety */
 926                         if ((tp->t_state & TS_ISOPEN) == 0) {
 927                                 /* adjust for data copied in but not written */
 928                                 uio_setresid(uio, (uio_resid(uio) + cc));
 929                                 error = EIO;
 930                                 goto out;
 931                         }
 932                 }
 933                 while (cc > 0) {
 934                         if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
 935                            (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
 936                                 wakeup(TSA_HUP_OR_INPUT(tp));
 937                                 goto block;
 938                         }
 939                         (*linesw[tp->t_line].l_rint)(*cp++, tp);
 940                         wcnt++;
 941                         cc--;
 942                 }
 943                 cc = 0;
 944         }
 945 out:
 946         tty_unlock(tp);
 947
 948         return (error);
 949
 950 block:
 951         /*
 952          * Come here to wait for slave to open, for space
 953          * in outq, or space in rawq, or an empty canq.
 954          */
 955         if ((tp->t_state & TS_CONNECTED) == 0) {
 956                 /* adjust for data copied in but not written */
 957                 uio_setresid(uio, (uio_resid(uio) + cc));
 958                 error = EIO;
 959                 goto out;
 960         }
 961         if (flag & IO_NDELAY) {
 962                 /* adjust for data copied in but not written */
 963                 uio_setresid(uio, (uio_resid(uio) + cc));
 964                 if (wcnt == 0)
 965                         error = EWOULDBLOCK;
 966                 goto out;
 967         }
 968         error = ttysleep(tp, TSA_PTC_WRITE(tp), TTOPRI | PCATCH, __FUNCTION__, 0);
 969         if (error) {
 970                 /* adjust for data copied in but not written */
 971                 uio_setresid(uio, (uio_resid(uio) + cc));
 972                 goto out;
 973         }
 974         goto again;
 975 }
 976
 977 __private_extern__ int
 978 ptyioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 979 {
 980         struct tty_dev_t *driver;
 981         struct ptmx_ioctl *pti = pty_get_ioctl(dev, 0, &driver);
 982         struct tty *tp;
 983         int stop, error = 0;
 984         int allow_ext_ioctl = 1;
 985
 986         if (pti == NULL)
 987                 return (ENXIO);
 988         tp = pti->pt_tty;
 989         tty_lock(tp);
 990
 991         u_char *cc = tp->t_cc;
 992
 993         /*
 994          * Do not permit extended ioctls on the master side of the pty unless
 995          * the slave side has been successfully opened and initialized.
 996          */
 997         if (major(dev) == driver->master &&
 998             driver->fix_7070978 &&
 999             ISSET(tp->t_state, TS_IOCTL_NOT_OK)) {
1000                 allow_ext_ioctl = 0;
1001         }
1002
1003         /*
1004          * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1005          * ttywflush(tp) will hang if there are characters in the outq.
1006          */
1007         if (cmd == TIOCEXT && allow_ext_ioctl) {
1008                 /*
1009                  * When the EXTPROC bit is being toggled, we need
1010                  * to send an TIOCPKT_IOCTL if the packet driver
1011                  * is turned on.
1012                  */
1013                 if (*(int *)data) {
1014                         if (pti->pt_flags & PF_PKT) {
1015                                 pti->pt_send |= TIOCPKT_IOCTL;
1016                                 ptcwakeup(tp, FREAD);
1017                         }
1018                         tp->t_lflag |= EXTPROC;
1019                 } else {
1020                         if ((tp->t_lflag & EXTPROC) &&
1021                             (pti->pt_flags & PF_PKT)) {
1022                                 pti->pt_send |= TIOCPKT_IOCTL;
1023                                 ptcwakeup(tp, FREAD);
1024                         }
1025                         tp->t_lflag &= ~EXTPROC;
1026                 }
1027                 goto out;
1028         } else
1029         if (cdevsw[major(dev)].d_open == ptcopen) {
1030                 switch (cmd) {
1031
1032                 case TIOCGPGRP:
1033                         /*
1034                          * We aviod calling ttioctl on the controller since,
1035                          * in that case, tp must be the controlling terminal.
1036                          */
1037                         *(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1038                         goto out;
1039
1040                 case TIOCPKT:
1041                         if (*(int *)data) {
1042                                 if (pti->pt_flags & PF_UCNTL) {
1043                                         error = EINVAL;
1044                                         goto out;
1045                                 }
1046                                 pti->pt_flags |= PF_PKT;
1047                         } else
1048                                 pti->pt_flags &= ~PF_PKT;
1049                         goto out;
1050
1051                 case TIOCUCNTL:
1052                         if (*(int *)data) {
1053                                 if (pti->pt_flags & PF_PKT) {
1054                                         error = EINVAL;
1055                                         goto out;
1056                                 }
1057                                 pti->pt_flags |= PF_UCNTL;
1058                         } else
1059                                 pti->pt_flags &= ~PF_UCNTL;
1060                         goto out;
1061
1062                 case TIOCREMOTE:
1063                         if (*(int *)data)
1064                                 pti->pt_flags |= PF_REMOTE;
1065                         else
1066                                 pti->pt_flags &= ~PF_REMOTE;
1067                         ttyflush(tp, FREAD|FWRITE);
1068                         goto out;
1069
1070                 case TIOCSETP:
1071                 case TIOCSETN:
1072                 case TIOCSETD:
1073                 case TIOCSETA_32:
1074                 case TIOCSETAW_32:
1075                 case TIOCSETAF_32:
1076                 case TIOCSETA_64:
1077                 case TIOCSETAW_64:
1078                 case TIOCSETAF_64:
1079                         ndflush(&tp->t_outq, tp->t_outq.c_cc);
1080                         break;
1081
1082                 case TIOCSIG:
1083                         if (*(unsigned int *)data >= NSIG ||
1084                             *(unsigned int *)data == 0) {
1085                                 error = EINVAL;
1086                                 goto out;
1087                         }
1088                         if ((tp->t_lflag&NOFLSH) == 0)
1089                                 ttyflush(tp, FREAD|FWRITE);
1090                         if ((*(unsigned int *)data == SIGINFO) &&
1091                             ((tp->t_lflag&NOKERNINFO) == 0))
1092                                 ttyinfo_locked(tp);
1093                         /*
1094                          * SAFE: All callers drop the lock on return and
1095                          * SAFE: the linesw[] will short circut this call
1096                          * SAFE: if the ioctl() is eaten before the lower
1097                          * SAFE: level code gets to see it.
1098                          */
1099                         tty_unlock(tp);
1100                         tty_pgsignal(tp, *(unsigned int *)data, 1);
1101                         tty_lock(tp);
1102                         goto out;
1103
1104                 case TIOCPTYGRANT:      /* grantpt(3) */
1105                         /*
1106                          * Change the uid of the slave to that of the calling
1107                          * thread, change the gid of the slave to GID_TTY,
1108                          * change the mode to 0620 (rw--w----).
1109                          */
1110                         {
1111                                 error = _devfs_setattr(pti->pt_devhandle, 0620, kauth_getuid(), GID_TTY);
1112                                 if (major(dev) == driver->master) {
1113                                         if (driver->mac_notify) {
1114 #if CONFIG_MACF
1115                                                 if (!error) {
1116                                                         tty_unlock(tp);
1117                                                         mac_pty_notify_grant(p, tp, dev, NULL);
1118                                                         tty_lock(tp);
1119                                                 }
1120 #endif
1121                                         } else {
1122                                                 error = 0;
1123                                         }
1124                                 }
1125                                 goto out;
1126                         }
1127
1128                 case TIOCPTYGNAME:      /* ptsname(3) */
1129                         /*
1130                          * Report the name of the slave device in *data
1131                          * (128 bytes max.).  Use the same template string
1132                          * used for calling devfs_make_node() to create it.
1133                          */
1134                         pty_get_name(dev, data, 128);
1135                         error = 0;
1136                         goto out;
1137
1138                 case TIOCPTYUNLK:       /* unlockpt(3) */
1139                         /*
1140                          * Unlock the slave device so that it can be opened.
1141                          */
1142                         if (major(dev) == driver->master) {
1143                                 pti->pt_flags |= PF_UNLOCKED;
1144                         }
1145                         error = 0;
1146                         goto out;
1147                 }
1148
1149                 /*
1150                  * Fail all other calls; pty masters are not serial devices;
1151                  * we only pretend they are when the slave side of the pty is
1152                  * already open.
1153                  */
1154                 if (!allow_ext_ioctl) {
1155                         error = ENOTTY;
1156                         goto out;
1157                 }
1158         }
1159         error = (*linesw[tp->t_line].l_ioctl)(tp, cmd, data, flag, p);
1160         if (error == ENOTTY) {
1161                 error = ttioctl_locked(tp, cmd, data, flag, p);
1162                 if (error == ENOTTY) {
1163                         if (pti->pt_flags & PF_UCNTL && (cmd & ~0xff) == UIOCCMD(0)) {
1164                                 /* Process the UIOCMD ioctl group */
1165                                 if (cmd & 0xff) {
1166                                         pti->pt_ucntl = (u_char)cmd;
1167                                         ptcwakeup(tp, FREAD);
1168                                 }
1169                                 error = 0;
1170                                 goto out;
1171                         } else if (cmd == TIOCSBRK || cmd == TIOCCBRK) {
1172                                 /*
1173                                  * POSIX conformance; rdar://3936338
1174                                  *
1175                                  * Clear ENOTTY in the case of setting or
1176                                  * clearing a break failing because pty's
1177                                  * don't support break like real serial
1178                                  * ports.
1179                                  */
1180                                 error = 0;
1181                                 goto out;
1182                         }
1183                 }
1184         }
1185
1186         /*
1187          * If external processing and packet mode send ioctl packet.
1188          */
1189         if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
1190                 switch(cmd) {
1191                 case TIOCSETA_32:
1192                 case TIOCSETAW_32:
1193                 case TIOCSETAF_32:
1194                 case TIOCSETA_64:
1195                 case TIOCSETAW_64:
1196                 case TIOCSETAF_64:
1197                 case TIOCSETP:
1198                 case TIOCSETN:
1199                 case TIOCSETC:
1200                 case TIOCSLTC:
1201                 case TIOCLBIS:
1202                 case TIOCLBIC:
1203                 case TIOCLSET:
1204                         pti->pt_send |= TIOCPKT_IOCTL;
1205                         ptcwakeup(tp, FREAD);
1206                 default:
1207                         break;
1208                 }
1209         }
1210         stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1211                 && CCEQ(cc[VSTART], CTRL('q'));
1212         if (pti->pt_flags & PF_NOSTOP) {
1213                 if (stop) {
1214                         pti->pt_send &= ~TIOCPKT_NOSTOP;
1215                         pti->pt_send |= TIOCPKT_DOSTOP;
1216                         pti->pt_flags &= ~PF_NOSTOP;
1217                         ptcwakeup(tp, FREAD);
1218                 }
1219         } else {
1220                 if (!stop) {
1221                         pti->pt_send &= ~TIOCPKT_DOSTOP;
1222                         pti->pt_send |= TIOCPKT_NOSTOP;
1223                         pti->pt_flags |= PF_NOSTOP;
1224                         ptcwakeup(tp, FREAD);
1225                 }
1226         }
1227 out:
1228         tty_unlock(tp);
1229
1230         return (error);
1231 }