bsd/kern/tty_ptmx.c

   1 /*
   2  * Copyright (c) 1997-2019 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1982, 1986, 1989, 1993
  30  *      The Regents of the University of California.  All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. All advertising materials mentioning features or use of this software
  41  *    must display the following acknowledgement:
  42  *      This product includes software developed by the University of
  43  *      California, Berkeley and its contributors.
  44  * 4. Neither the name of the University nor the names of its contributors
  45  *    may be used to endorse or promote products derived from this software
  46  *    without specific prior written permission.
  47  *
  48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  58  * SUCH DAMAGE.
  59  *
  60  *      @(#)tty_pty.c   8.4 (Berkeley) 2/20/95
  61  */
  62
  63 /*
  64  * Pseudo-teletype Driver
  65  * (Actually two drivers, requiring two entries in 'cdevsw')
  66  */
  67 #include "pty.h"                /* XXX */
  68
  69 #include <sys/param.h>
  70 #include <sys/systm.h>
  71 #include <sys/ioctl.h>
  72 #include <sys/proc_internal.h>
  73 #include <sys/kauth.h>
  74 #include <sys/tty.h>
  75 #include <sys/conf.h>
  76 #include <sys/file_internal.h>
  77 #include <sys/uio_internal.h>
  78 #include <sys/kernel.h>
  79 #include <sys/vnode.h>
  80 #include <sys/user.h>
  81 #include <sys/signalvar.h>
  82 #include <sys/sysctl.h>
  83 #include <miscfs/devfs/devfs.h>
  84 #include <miscfs/devfs/devfsdefs.h>     /* DEVFS_LOCK()/DEVFS_UNLOCK() */
  85 #include <libkern/section_keywords.h>
  86
  87 #if CONFIG_MACF
  88 #include <security/mac_framework.h>
  89 #endif
  90
  91 #include "tty_dev.h"
  92
  93 /*
  94  * Forward declarations
  95  */
  96 int ptmx_init(int n_ptys);
  97 static struct ptmx_ioctl *ptmx_get_ioctl(int minor, int open_flag);
  98 static int ptmx_free_ioctl(int minor, int open_flag);
  99 static int ptmx_get_name(int minor, char *buffer, size_t size);
 100 static void ptsd_revoke_knotes(int minor, struct tty *tp);
 101
 102 extern  d_open_t        ptsopen;
 103 extern  d_close_t       ptsclose;
 104 extern  d_read_t        ptsread;
 105 extern  d_write_t       ptswrite;
 106 extern  d_ioctl_t       ptyioctl;
 107 extern  d_stop_t        ptsstop;
 108 extern  d_reset_t       ptsreset;
 109 extern  d_select_t      ptsselect;
 110
 111 extern  d_open_t        ptcopen;
 112 extern  d_close_t       ptcclose;
 113 extern  d_read_t        ptcread;
 114 extern  d_write_t       ptcwrite;
 115 extern  d_stop_t        ptcstop;
 116 extern  d_reset_t       ptcreset;
 117 extern  d_select_t      ptcselect;
 118
 119 static int ptmx_major;          /* dynamically assigned major number */
 120 static const struct cdevsw ptmx_cdev = {
 121         .d_open       = ptcopen,
 122         .d_close      = ptcclose,
 123         .d_read       = ptcread,
 124         .d_write      = ptcwrite,
 125         .d_ioctl      = ptyioctl,
 126         .d_stop       = ptcstop,
 127         .d_reset      = ptcreset,
 128         .d_ttys       = NULL,
 129         .d_select     = ptcselect,
 130         .d_mmap       = eno_mmap,
 131         .d_strategy   = eno_strat,
 132         .d_reserved_1 = eno_getc,
 133         .d_reserved_2 = eno_putc,
 134         .d_type       = D_TTY
 135 };
 136
 137 static int ptsd_major;          /* dynamically assigned major number */
 138 static const struct cdevsw ptsd_cdev = {
 139         .d_open       = ptsopen,
 140         .d_close      = ptsclose,
 141         .d_read       = ptsread,
 142         .d_write      = ptswrite,
 143         .d_ioctl      = ptyioctl,
 144         .d_stop       = ptsstop,
 145         .d_reset      = ptsreset,
 146         .d_ttys       = NULL,
 147         .d_select     = ptsselect,
 148         .d_mmap       = eno_mmap,
 149         .d_strategy   = eno_strat,
 150         .d_reserved_1 = eno_getc,
 151         .d_reserved_2 = eno_putc,
 152         .d_type       = D_TTY
 153 };
 154
 155 /*
 156  * ptmx == /dev/ptmx
 157  * ptsd == /dev/pts[0123456789]{3}
 158  */
 159 #define PTMX_TEMPLATE   "ptmx"
 160 #define PTSD_TEMPLATE   "ttys%03d"
 161
 162 /*
 163  * System-wide limit on the max number of cloned ptys
 164  */
 165 #define PTMX_MAX_DEFAULT        511     /* 512 entries */
 166 #define PTMX_MAX_HARD           999     /* 1000 entries, due to PTSD_TEMPLATE */
 167
 168 static int ptmx_max = PTMX_MAX_DEFAULT; /* default # of clones we allow */
 169
 170 /* Range enforcement for the sysctl */
 171 static int
 172 sysctl_ptmx_max(__unused struct sysctl_oid *oidp, __unused void *arg1,
 173     __unused int arg2, struct sysctl_req *req)
 174 {
 175         int new_value, changed;
 176         int error = sysctl_io_number(req, ptmx_max, sizeof(int), &new_value, &changed);
 177         if (changed) {
 178                 if (new_value > 0 && new_value <= PTMX_MAX_HARD) {
 179                         ptmx_max = new_value;
 180                 } else {
 181                         error = EINVAL;
 182                 }
 183         }
 184         return error;
 185 }
 186
 187 SYSCTL_NODE(_kern, KERN_TTY, tty, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "TTY");
 188 SYSCTL_PROC(_kern_tty, OID_AUTO, ptmx_max,
 189     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
 190     &ptmx_max, 0, &sysctl_ptmx_max, "I", "ptmx_max");
 191
 192 static int      ptmx_clone(dev_t dev, int minor);
 193
 194 static struct tty_dev_t _ptmx_driver;
 195
 196 int
 197 ptmx_init( __unused int config_count)
 198 {
 199         /*
 200          * We start looking at slot 10, since there are inits that will
 201          * stomp explicit slots (e.g. vndevice stomps 1) below that.
 202          */
 203
 204         /* Get a major number for /dev/ptmx */
 205         if ((ptmx_major = cdevsw_add(-15, &ptmx_cdev)) == -1) {
 206                 printf("ptmx_init: failed to obtain /dev/ptmx major number\n");
 207                 return ENOENT;
 208         }
 209
 210         if (cdevsw_setkqueueok(ptmx_major, &ptmx_cdev, CDEVSW_IS_PTC) == -1) {
 211                 panic("Failed to set flags on ptmx cdevsw entry.");
 212         }
 213
 214         /* Get a major number for /dev/pts/nnn */
 215         if ((ptsd_major = cdevsw_add(-15, &ptsd_cdev)) == -1) {
 216                 (void)cdevsw_remove(ptmx_major, &ptmx_cdev);
 217                 printf("ptmx_init: failed to obtain /dev/ptmx major number\n");
 218                 return ENOENT;
 219         }
 220
 221         if (cdevsw_setkqueueok(ptsd_major, &ptsd_cdev, CDEVSW_IS_PTS) == -1) {
 222                 panic("Failed to set flags on ptmx cdevsw entry.");
 223         }
 224
 225         /* Create the /dev/ptmx device {<major>,0} */
 226         (void)devfs_make_node_clone(makedev(ptmx_major, 0),
 227             DEVFS_CHAR, UID_ROOT, GID_TTY, 0666,
 228             ptmx_clone, PTMX_TEMPLATE);
 229
 230         _ptmx_driver.master = ptmx_major;
 231         _ptmx_driver.slave = ptsd_major;
 232         _ptmx_driver.fix_7828447 = 1;
 233         _ptmx_driver.fix_7070978 = 1;
 234 #if CONFIG_MACF
 235         _ptmx_driver.mac_notify = 1;
 236 #endif
 237         _ptmx_driver.open = &ptmx_get_ioctl;
 238         _ptmx_driver.free = &ptmx_free_ioctl;
 239         _ptmx_driver.name = &ptmx_get_name;
 240         _ptmx_driver.revoke = &ptsd_revoke_knotes;
 241         tty_dev_register(&_ptmx_driver);
 242
 243         return 0;
 244 }
 245
 246
 247 static struct _ptmx_ioctl_state {
 248         struct ptmx_ioctl       **pis_ioctl_list;       /* pointer vector */
 249         int                     pis_total;              /* total slots */
 250         int                     pis_free;               /* free slots */
 251 } _state;
 252 #define PTMX_GROW_VECTOR        16      /* Grow by this many slots at a time */
 253
 254 /*
 255  * Given a minor number, return the corresponding structure for that minor
 256  * number.  If there isn't one, and the create flag is specified, we create
 257  * one if possible.
 258  *
 259  * Parameters:  minor                   Minor number of ptmx device
 260  *              open_flag               PF_OPEN_M       First open of master
 261  *                                      PF_OPEN_S       First open of slave
 262  *                                      0               Just want ioctl struct
 263  *
 264  * Returns:     NULL                    Did not exist/could not create
 265  *              !NULL                   structure corresponding minor number
 266  *
 267  * Locks:       tty_lock() on ptmx_ioctl->pt_tty NOT held on entry or exit.
 268  */
 269 static struct ptmx_ioctl *
 270 ptmx_get_ioctl(int minor, int open_flag)
 271 {
 272         struct ptmx_ioctl *ptmx_ioctl = NULL;
 273
 274         if (open_flag & PF_OPEN_M) {
 275                 struct ptmx_ioctl *new_ptmx_ioctl;
 276
 277                 DEVFS_LOCK();
 278                 /*
 279                  * If we are about to allocate more memory, but we have
 280                  * already hit the administrative limit, then fail the
 281                  * operation.
 282                  *
 283                  * Note:        Subtract free from total when making this
 284                  *              check to allow unit increments, rather than
 285                  *              snapping to the nearest PTMX_GROW_VECTOR...
 286                  */
 287                 if ((_state.pis_total - _state.pis_free) >= ptmx_max) {
 288                         DEVFS_UNLOCK();
 289                         return NULL;
 290                 }
 291                 DEVFS_UNLOCK();
 292
 293                 new_ptmx_ioctl = kheap_alloc(KM_TTYS, sizeof(struct ptmx_ioctl),
 294                     Z_WAITOK | Z_ZERO);
 295                 if (new_ptmx_ioctl == NULL) {
 296                         return NULL;
 297                 }
 298
 299                 if ((new_ptmx_ioctl->pt_tty = ttymalloc()) == NULL) {
 300                         kheap_free(KM_TTYS, new_ptmx_ioctl, sizeof(struct ptmx_ioctl));
 301                         return NULL;
 302                 }
 303
 304                 /*
 305                  * Hold the DEVFS_LOCK() over this whole operation; devfs
 306                  * itself does this over malloc/free as well, so this should
 307                  * be safe to do.  We hold it longer than we want to, but
 308                  * doing so avoids a reallocation race on the minor number.
 309                  */
 310                 DEVFS_LOCK();
 311
 312                 /*
 313                  * Check again to ensure the limit is not reached after initial check
 314                  * when the lock was dropped momentarily for malloc.
 315                  */
 316                 if ((_state.pis_total - _state.pis_free) >= ptmx_max) {
 317                         ttyfree(new_ptmx_ioctl->pt_tty);
 318                         DEVFS_UNLOCK();
 319                         kheap_free(KM_TTYS, new_ptmx_ioctl, sizeof(struct ptmx_ioctl));
 320                         return NULL;
 321                 }
 322
 323                 /* Need to allocate a larger vector? */
 324                 if (_state.pis_free == 0) {
 325                         struct ptmx_ioctl **new_pis_ioctl_list;
 326                         struct ptmx_ioctl **old_pis_ioctl_list = NULL;
 327                         size_t old_pis_total = 0;
 328
 329                         /* Yes. */
 330                         new_pis_ioctl_list = kheap_alloc(KM_TTYS,
 331                             sizeof(struct ptmx_ioctl *) * (_state.pis_total + PTMX_GROW_VECTOR),
 332                             Z_WAITOK | Z_ZERO);
 333                         if (new_pis_ioctl_list == NULL) {
 334                                 ttyfree(new_ptmx_ioctl->pt_tty);
 335                                 DEVFS_UNLOCK();
 336                                 kheap_free(KM_TTYS, new_ptmx_ioctl, sizeof(struct ptmx_ioctl));
 337                                 return NULL;
 338                         }
 339
 340                         /* If this is not the first time, copy the old over */
 341                         bcopy(_state.pis_ioctl_list, new_pis_ioctl_list, sizeof(struct ptmx_ioctl *) * _state.pis_total);
 342                         old_pis_ioctl_list = _state.pis_ioctl_list;
 343                         old_pis_total = _state.pis_total;
 344                         _state.pis_ioctl_list = new_pis_ioctl_list;
 345                         _state.pis_free += PTMX_GROW_VECTOR;
 346                         _state.pis_total += PTMX_GROW_VECTOR;
 347                         kheap_free(KM_TTYS, old_pis_ioctl_list,
 348                             sizeof(struct ptmx_ioctl *) * old_pis_total);
 349                 }
 350
 351                 /* is minor in range now? */
 352                 if (minor < 0 || minor >= _state.pis_total) {
 353                         ttyfree(new_ptmx_ioctl->pt_tty);
 354                         DEVFS_UNLOCK();
 355                         kheap_free(KM_TTYS, new_ptmx_ioctl, sizeof(struct ptmx_ioctl));
 356                         return NULL;
 357                 }
 358
 359                 if (_state.pis_ioctl_list[minor] != NULL) {
 360                         ttyfree(new_ptmx_ioctl->pt_tty);
 361                         DEVFS_UNLOCK();
 362                         kheap_free(KM_TTYS, new_ptmx_ioctl, sizeof(struct ptmx_ioctl));
 363
 364                         /* Special error value so we know to redrive the open, we've been raced */
 365                         return (struct ptmx_ioctl*)-1;
 366                 }
 367
 368                 /* Vector is large enough; grab a new ptmx_ioctl */
 369
 370                 /* Now grab a free slot... */
 371                 _state.pis_ioctl_list[minor] = new_ptmx_ioctl;
 372
 373                 /* reduce free count */
 374                 _state.pis_free--;
 375
 376                 _state.pis_ioctl_list[minor]->pt_flags |= PF_OPEN_M;
 377                 DEVFS_UNLOCK();
 378
 379                 /* Create the /dev/ttysXXX device {<major>,XXX} */
 380                 _state.pis_ioctl_list[minor]->pt_devhandle = devfs_make_node(
 381                         makedev(ptsd_major, minor),
 382                         DEVFS_CHAR, UID_ROOT, GID_TTY, 0620,
 383                         PTSD_TEMPLATE, minor);
 384                 if (_state.pis_ioctl_list[minor]->pt_devhandle == NULL) {
 385                         printf("devfs_make_node() call failed for ptmx_get_ioctl()!!!!\n");
 386                 }
 387         }
 388
 389         /*
 390          * Lock is held here to protect race when the 'pis_ioctl_list' array is
 391          * being reallocated to increase its slots.
 392          */
 393         DEVFS_LOCK();
 394         if (minor >= 0 && minor < _state.pis_total) {
 395                 ptmx_ioctl = _state.pis_ioctl_list[minor];
 396         }
 397         DEVFS_UNLOCK();
 398
 399         return ptmx_ioctl;
 400 }
 401
 402 /*
 403  * Locks:       tty_lock() of old_ptmx_ioctl->pt_tty NOT held for this call.
 404  */
 405 static int
 406 ptmx_free_ioctl(int minor, int open_flag)
 407 {
 408         struct ptmx_ioctl *old_ptmx_ioctl = NULL;
 409
 410         DEVFS_LOCK();
 411
 412         if (minor < 0 || minor >= _state.pis_total) {
 413                 DEVFS_UNLOCK();
 414                 return -1;
 415         }
 416
 417         _state.pis_ioctl_list[minor]->pt_flags &= ~(open_flag);
 418
 419         /*
 420          * Was this the last close?  We will recognize it because we only get
 421          * a notification on the last close of a device, and we will have
 422          * cleared both the master and the slave open bits in the flags.
 423          */
 424         if (!(_state.pis_ioctl_list[minor]->pt_flags & (PF_OPEN_M | PF_OPEN_S))) {
 425                 /* Mark as free so it can be reallocated later */
 426                 old_ptmx_ioctl = _state.pis_ioctl_list[minor];
 427                 _state.pis_ioctl_list[minor] = NULL;
 428                 _state.pis_free++;
 429         }
 430         DEVFS_UNLOCK();
 431
 432         /* Free old after dropping lock */
 433         if (old_ptmx_ioctl != NULL) {
 434                 /*
 435                  * XXX See <rdar://5348651> and <rdar://4854638>
 436                  *
 437                  * XXX Conditional to be removed when/if tty/pty reference
 438                  * XXX counting and mutex implemented.
 439                  */
 440                 if (old_ptmx_ioctl->pt_devhandle != NULL) {
 441                         devfs_remove(old_ptmx_ioctl->pt_devhandle);
 442                 }
 443                 ttyfree(old_ptmx_ioctl->pt_tty);
 444                 kheap_free(KM_TTYS, old_ptmx_ioctl, sizeof(struct ptmx_ioctl));
 445         }
 446
 447         return 0;     /* Success */
 448 }
 449
 450 static int
 451 ptmx_get_name(int minor, char *buffer, size_t size)
 452 {
 453         return snprintf(buffer, size, "/dev/" PTSD_TEMPLATE, minor);
 454 }
 455
 456
 457
 458 /*
 459  * Given the dev entry that's being opened, we clone the device.  This driver
 460  * doesn't actually use the dev entry, since we alreaqdy know who we are by
 461  * being called from this code.  This routine is a callback registered from
 462  * devfs_make_node_clone() in ptmx_init(); it's purpose is to provide a new
 463  * minor number, or to return -1, if one can't be provided.
 464  *
 465  * Parameters:  dev                     The device we are cloning from
 466  *
 467  * Returns:     >= 0                    A new minor device number
 468  *              -1                      Error: ENOMEM ("Can't alloc device")
 469  *
 470  * NOTE:        Called with DEVFS_LOCK() held
 471  */
 472 static int
 473 ptmx_clone(__unused dev_t dev, int action)
 474 {
 475         int i;
 476
 477         if (action == DEVFS_CLONE_ALLOC) {
 478                 /* First one */
 479                 if (_state.pis_total == 0) {
 480                         return 0;
 481                 }
 482
 483                 /*
 484                  * Note: We can add hinting on free slots, if this linear search
 485                  * ends up being a performance bottleneck...
 486                  */
 487                 for (i = 0; i < _state.pis_total; i++) {
 488                         if (_state.pis_ioctl_list[i] == NULL) {
 489                                 break;
 490                         }
 491                 }
 492
 493                 /*
 494                  * XXX We fall off the end here; if we did this twice at the
 495                  * XXX same time, we could return the same minor to two
 496                  * XXX callers; we should probably exand the pointer vector
 497                  * XXX here, but I need more information on the MALLOC/FREE
 498                  * XXX locking to ensure against a deadlock.  Maybe we can
 499                  * XXX just high watermark it at 1/2 of PTMX_GROW_VECTOR?
 500                  * XXX That would require returning &minor as implict return
 501                  * XXX and an error code ("EAGAIN/ERESTART") or 0 as our
 502                  * XXX explicit return.
 503                  */
 504
 505                 return i;     /* empty slot or next slot */
 506         }
 507         return -1;
 508 }
 509
 510
 511 /*
 512  * kqueue support.
 513  */
 514 int ptsd_kqfilter(dev_t dev, struct knote *kn);
 515 static void ptsd_kqops_detach(struct knote *);
 516 static int ptsd_kqops_event(struct knote *, long);
 517 static int ptsd_kqops_touch(struct knote *kn, struct kevent_qos_s *kev);
 518 static int ptsd_kqops_process(struct knote *kn, struct kevent_qos_s *kev);
 519
 520 SECURITY_READ_ONLY_EARLY(struct filterops) ptsd_kqops = {
 521         .f_isfd = 1,
 522         /* attach is handled by ptsd_kqfilter -- the dev node must be passed in */
 523         .f_detach = ptsd_kqops_detach,
 524         .f_event = ptsd_kqops_event,
 525         .f_touch = ptsd_kqops_touch,
 526         .f_process = ptsd_kqops_process,
 527 };
 528
 529 /*
 530  * In the normal case, by the time the driver_close() routine is called
 531  * on the slave, all knotes have been detached.  However in the revoke(2)
 532  * case, the driver's close routine is called while there are knotes active
 533  * that reference the handlers below.  And we have no obvious means to
 534  * reach from the driver out to the kqueue's that reference them to get
 535  * them to stop.
 536  */
 537
 538 static void
 539 ptsd_kqops_detach(struct knote *kn)
 540 {
 541         struct tty *tp = kn->kn_hook;
 542
 543         tty_lock(tp);
 544
 545         /*
 546          * Only detach knotes from open ttys -- ttyclose detaches all knotes
 547          * under the lock and unsets TS_ISOPEN.
 548          */
 549         if (tp->t_state & TS_ISOPEN) {
 550                 switch (kn->kn_filter) {
 551                 case EVFILT_READ:
 552                         KNOTE_DETACH(&tp->t_rsel.si_note, kn);
 553                         break;
 554                 case EVFILT_WRITE:
 555                         KNOTE_DETACH(&tp->t_wsel.si_note, kn);
 556                         break;
 557                 default:
 558                         panic("invalid knote %p detach, filter: %d", kn, kn->kn_filter);
 559                         break;
 560                 }
 561         }
 562
 563         tty_unlock(tp);
 564         ttyfree(tp);
 565 }
 566
 567 static int
 568 ptsd_kqops_common(struct knote *kn, struct kevent_qos_s *kev, struct tty *tp)
 569 {
 570         int retval = 0;
 571         int64_t data = 0;
 572
 573         TTY_LOCK_OWNED(tp);
 574
 575         switch (kn->kn_filter) {
 576         case EVFILT_READ:
 577                 /*
 578                  * ttnread can change the tty state,
 579                  * hence must be done upfront, before any other check.
 580                  */
 581                 data = ttnread(tp);
 582                 retval = (data > 0);
 583                 break;
 584
 585         case EVFILT_WRITE:
 586                 if ((tp->t_outq.c_cc <= tp->t_lowat) &&
 587                     (tp->t_state & TS_CONNECTED)) {
 588                         data = tp->t_outq.c_cn - tp->t_outq.c_cc;
 589                         retval = 1;
 590                 }
 591                 break;
 592
 593         default:
 594                 panic("ptsd kevent: unexpected filter: %d, kn = %p, tty = %p",
 595                     kn->kn_filter, kn, tp);
 596                 break;
 597         }
 598
 599         if (tp->t_state & TS_ZOMBIE) {
 600                 kn->kn_flags |= EV_EOF;
 601         }
 602         if (kn->kn_flags & EV_EOF) {
 603                 retval = 1;
 604         }
 605         if (retval && kev) {
 606                 knote_fill_kevent(kn, kev, data);
 607         }
 608         return retval;
 609 }
 610
 611 static int
 612 ptsd_kqops_event(struct knote *kn, long hint)
 613 {
 614         struct tty *tp = kn->kn_hook;
 615         int ret;
 616
 617         TTY_LOCK_OWNED(tp);
 618
 619         if (hint & NOTE_REVOKE) {
 620                 kn->kn_flags |= EV_EOF | EV_ONESHOT;
 621                 ret = 1;
 622         } else {
 623                 ret = ptsd_kqops_common(kn, NULL, tp);
 624         }
 625
 626         return ret;
 627 }
 628
 629 static int
 630 ptsd_kqops_touch(struct knote *kn, struct kevent_qos_s *kev)
 631 {
 632         struct tty *tp = kn->kn_hook;
 633         int ret;
 634
 635         tty_lock(tp);
 636
 637         /* accept new kevent state */
 638         kn->kn_sfflags = kev->fflags;
 639         kn->kn_sdata = kev->data;
 640
 641         /* recapture fired state of knote */
 642         ret = ptsd_kqops_common(kn, NULL, tp);
 643
 644         tty_unlock(tp);
 645
 646         return ret;
 647 }
 648
 649 static int
 650 ptsd_kqops_process(struct knote *kn, struct kevent_qos_s *kev)
 651 {
 652         struct tty *tp = kn->kn_hook;
 653         int ret;
 654
 655         tty_lock(tp);
 656         ret = ptsd_kqops_common(kn, kev, tp);
 657         tty_unlock(tp);
 658
 659         return ret;
 660 }
 661
 662 int
 663 ptsd_kqfilter(dev_t dev, struct knote *kn)
 664 {
 665         struct tty *tp = NULL;
 666         struct ptmx_ioctl *pti = NULL;
 667         int ret;
 668
 669         /* make sure we're talking about the right device type */
 670         if (cdevsw[major(dev)].d_open != ptsopen) {
 671                 knote_set_error(kn, ENODEV);
 672                 return 0;
 673         }
 674
 675         if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
 676                 knote_set_error(kn, ENXIO);
 677                 return 0;
 678         }
 679
 680         tp = pti->pt_tty;
 681         tty_lock(tp);
 682
 683         assert(tp->t_state & TS_ISOPEN);
 684
 685         kn->kn_filtid = EVFILTID_PTSD;
 686         /* the tty will be freed when detaching the knote */
 687         ttyhold(tp);
 688         kn->kn_hook = tp;
 689
 690         switch (kn->kn_filter) {
 691         case EVFILT_READ:
 692                 KNOTE_ATTACH(&tp->t_rsel.si_note, kn);
 693                 break;
 694         case EVFILT_WRITE:
 695                 KNOTE_ATTACH(&tp->t_wsel.si_note, kn);
 696                 break;
 697         default:
 698                 panic("ptsd kevent: unexpected filter: %d, kn = %p, tty = %p",
 699                     kn->kn_filter, kn, tp);
 700                 break;
 701         }
 702
 703         /* capture current event state */
 704         ret = ptsd_kqops_common(kn, NULL, tp);
 705
 706         tty_unlock(tp);
 707
 708         return ret;
 709 }
 710
 711 /*
 712  * Support for revoke(2).
 713  */
 714 static void
 715 ptsd_revoke_knotes(__unused int minor, struct tty *tp)
 716 {
 717         tty_lock(tp);
 718
 719         ttwakeup(tp);
 720         assert((tp->t_rsel.si_flags & SI_KNPOSTING) == 0);
 721         KNOTE(&tp->t_rsel.si_note, NOTE_REVOKE);
 722
 723         ttwwakeup(tp);
 724         assert((tp->t_wsel.si_flags & SI_KNPOSTING) == 0);
 725         KNOTE(&tp->t_wsel.si_note, NOTE_REVOKE);
 726
 727         tty_unlock(tp);
 728 }
 729
 730 /*
 731  * kevent filter routines for the master side of a pty, a ptmx.
 732  *
 733  * Stuff the ptmx_ioctl structure into the hook for ptmx knotes.  Use the
 734  * embedded tty's lock for synchronization.
 735  */
 736
 737 int ptmx_kqfilter(dev_t dev, struct knote *kn);
 738 static void ptmx_kqops_detach(struct knote *);
 739 static int ptmx_kqops_event(struct knote *, long);
 740 static int ptmx_kqops_touch(struct knote *kn, struct kevent_qos_s *kev);
 741 static int ptmx_kqops_process(struct knote *kn, struct kevent_qos_s *kev);
 742 static int ptmx_kqops_common(struct knote *kn, struct kevent_qos_s *kev,
 743     struct ptmx_ioctl *pti, struct tty *tp);
 744
 745 SECURITY_READ_ONLY_EARLY(struct filterops) ptmx_kqops = {
 746         .f_isfd = 1,
 747         /* attach is handled by ptmx_kqfilter -- the dev node must be passed in */
 748         .f_detach = ptmx_kqops_detach,
 749         .f_event = ptmx_kqops_event,
 750         .f_touch = ptmx_kqops_touch,
 751         .f_process = ptmx_kqops_process,
 752 };
 753
 754 static struct ptmx_ioctl *
 755 ptmx_knote_ioctl(struct knote *kn)
 756 {
 757         return (struct ptmx_ioctl *)kn->kn_hook;
 758 }
 759
 760 static struct tty *
 761 ptmx_knote_tty(struct knote *kn)
 762 {
 763         return ptmx_knote_ioctl(kn)->pt_tty;
 764 }
 765
 766 int
 767 ptmx_kqfilter(dev_t dev, struct knote *kn)
 768 {
 769         struct tty *tp = NULL;
 770         struct ptmx_ioctl *pti = NULL;
 771         int ret;
 772
 773         /* make sure we're talking about the right device type */
 774         if (cdevsw[major(dev)].d_open != ptcopen) {
 775                 knote_set_error(kn, ENODEV);
 776                 return 0;
 777         }
 778
 779         if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
 780                 knote_set_error(kn, ENXIO);
 781                 return 0;
 782         }
 783
 784         tp = pti->pt_tty;
 785         tty_lock(tp);
 786
 787         kn->kn_filtid = EVFILTID_PTMX;
 788         /* the tty will be freed when detaching the knote */
 789         ttyhold(tp);
 790         kn->kn_hook = pti;
 791
 792         /*
 793          * Attach to the ptmx's selinfo structures.  This is the major difference
 794          * to the ptsd filtops, which use the selinfo structures in the tty
 795          * structure.
 796          */
 797         switch (kn->kn_filter) {
 798         case EVFILT_READ:
 799                 KNOTE_ATTACH(&pti->pt_selr.si_note, kn);
 800                 break;
 801         case EVFILT_WRITE:
 802                 KNOTE_ATTACH(&pti->pt_selw.si_note, kn);
 803                 break;
 804         default:
 805                 panic("ptmx kevent: unexpected filter: %d, kn = %p, tty = %p",
 806                     kn->kn_filter, kn, tp);
 807                 break;
 808         }
 809
 810         /* capture current event state */
 811         ret = ptmx_kqops_common(kn, NULL, pti, tp);
 812
 813         tty_unlock(tp);
 814
 815         return ret;
 816 }
 817
 818 static void
 819 ptmx_kqops_detach(struct knote *kn)
 820 {
 821         struct ptmx_ioctl *pti = kn->kn_hook;
 822         struct tty *tp = pti->pt_tty;
 823
 824         tty_lock(tp);
 825
 826         switch (kn->kn_filter) {
 827         case EVFILT_READ:
 828                 KNOTE_DETACH(&pti->pt_selr.si_note, kn);
 829                 break;
 830         case EVFILT_WRITE:
 831                 KNOTE_DETACH(&pti->pt_selw.si_note, kn);
 832                 break;
 833         default:
 834                 panic("invalid knote %p detach, filter: %d", kn, kn->kn_filter);
 835                 break;
 836         }
 837
 838         tty_unlock(tp);
 839         ttyfree(tp);
 840 }
 841
 842 static int
 843 ptmx_kqops_common(struct knote *kn, struct kevent_qos_s *kev,
 844     struct ptmx_ioctl *pti, struct tty *tp)
 845 {
 846         int retval = 0;
 847         int64_t data = 0;
 848
 849         TTY_LOCK_OWNED(tp);
 850
 851         switch (kn->kn_filter) {
 852         case EVFILT_READ:
 853                 /* there's data on the TTY and it's not stopped */
 854                 if (tp->t_outq.c_cc && !(tp->t_state & TS_TTSTOP)) {
 855                         data = tp->t_outq.c_cc;
 856                         retval = data > 0;
 857                 } else if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
 858                     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)) {
 859                         retval = 1;
 860                 }
 861                 break;
 862
 863         case EVFILT_WRITE:
 864                 if (pti->pt_flags & PF_REMOTE) {
 865                         if (tp->t_canq.c_cc == 0) {
 866                                 retval = TTYHOG - 1;
 867                         }
 868                 } else {
 869                         retval = (TTYHOG - 2) - (tp->t_rawq.c_cc + tp->t_canq.c_cc);
 870                         if (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON)) {
 871                                 retval = 1;
 872                         }
 873                         if (retval < 0) {
 874                                 retval = 0;
 875                         }
 876                 }
 877                 break;
 878
 879         default:
 880                 panic("ptmx kevent: unexpected filter: %d, kn = %p, tty = %p",
 881                     kn->kn_filter, kn, tp);
 882                 break;
 883         }
 884
 885         /* disconnects should force a wakeup (EOF) */
 886         if (!(tp->t_state & TS_CONNECTED) || (tp->t_state & TS_ZOMBIE)) {
 887                 kn->kn_flags |= EV_EOF;
 888         }
 889         if (kn->kn_flags & EV_EOF) {
 890                 retval = 1;
 891         }
 892         if (retval && kev) {
 893                 knote_fill_kevent(kn, kev, data);
 894         }
 895         return retval;
 896 }
 897
 898 static int
 899 ptmx_kqops_event(struct knote *kn, long hint)
 900 {
 901         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 902         struct tty *tp = ptmx_knote_tty(kn);
 903         int ret;
 904
 905         TTY_LOCK_OWNED(tp);
 906
 907         if (hint & NOTE_REVOKE) {
 908                 kn->kn_flags |= EV_EOF | EV_ONESHOT;
 909                 ret = 1;
 910         } else {
 911                 ret = ptmx_kqops_common(kn, NULL, pti, tp);
 912         }
 913
 914         return ret;
 915 }
 916
 917 static int
 918 ptmx_kqops_touch(struct knote *kn, struct kevent_qos_s *kev)
 919 {
 920         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 921         struct tty *tp = ptmx_knote_tty(kn);
 922         int ret;
 923
 924         tty_lock(tp);
 925
 926         /* accept new kevent state */
 927         kn->kn_sfflags = kev->fflags;
 928         kn->kn_sdata = kev->data;
 929
 930         /* recapture fired state of knote */
 931         ret = ptmx_kqops_common(kn, NULL, pti, tp);
 932
 933         tty_unlock(tp);
 934
 935         return ret;
 936 }
 937
 938 static int
 939 ptmx_kqops_process(struct knote *kn, struct kevent_qos_s *kev)
 940 {
 941         struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
 942         struct tty *tp = ptmx_knote_tty(kn);
 943         int ret;
 944
 945         tty_lock(tp);
 946         ret = ptmx_kqops_common(kn, kev, pti, tp);
 947         tty_unlock(tp);
 948
 949         return ret;
 950 }