1/*
2 * Copyright (c) 1997-2013 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1982, 1986, 1989, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)tty_pty.c 8.4 (Berkeley) 2/20/95
61 */
62
63/*
64 * Pseudo-teletype Driver
65 * (Actually two drivers, requiring two entries in 'cdevsw')
66 */
67#include "pty.h" /* XXX */
68
69#include <sys/param.h>
70#include <sys/systm.h>
71#include <sys/ioctl.h>
72#include <sys/proc_internal.h>
73#include <sys/kauth.h>
74#include <sys/tty.h>
75#include <sys/conf.h>
76#include <sys/file_internal.h>
77#include <sys/uio_internal.h>
78#include <sys/kernel.h>
79#include <sys/vnode.h>
80#include <sys/user.h>
81#include <sys/signalvar.h>
82#include <sys/sysctl.h>
83#include <miscfs/devfs/devfs.h>
84#include <miscfs/devfs/devfsdefs.h> /* DEVFS_LOCK()/DEVFS_UNLOCK() */
85#include <libkern/section_keywords.h>
86
87#if CONFIG_MACF
88#include <security/mac_framework.h>
89#endif
90
91#include "tty_dev.h"
92
93/*
94 * Forward declarations
95 */
96int ptmx_init(int n_ptys);
97static struct ptmx_ioctl *ptmx_get_ioctl(int minor, int open_flag);
98static int ptmx_free_ioctl(int minor, int open_flag);
99static int ptmx_get_name(int minor, char *buffer, size_t size);
100static void ptsd_revoke_knotes(int minor, struct tty *tp);
101
102extern d_open_t ptsopen;
103extern d_close_t ptsclose;
104extern d_read_t ptsread;
105extern d_write_t ptswrite;
106extern d_ioctl_t ptyioctl;
107extern d_stop_t ptsstop;
108extern d_reset_t ptsreset;
109extern d_select_t ptsselect;
110
111extern d_open_t ptcopen;
112extern d_close_t ptcclose;
113extern d_read_t ptcread;
114extern d_write_t ptcwrite;
115extern d_stop_t ptcstop;
116extern d_reset_t ptcreset;
117extern d_select_t ptcselect;
118
119static int ptmx_major; /* dynamically assigned major number */
120static struct cdevsw ptmx_cdev = {
121 ptcopen, ptcclose, ptcread, ptcwrite,
122 ptyioctl, ptcstop, ptcreset, 0,
123 ptcselect, eno_mmap, eno_strat, eno_getc,
124 eno_putc, D_TTY
125};
126
127static int ptsd_major; /* dynamically assigned major number */
128static struct cdevsw ptsd_cdev = {
129 ptsopen, ptsclose, ptsread, ptswrite,
130 ptyioctl, ptsstop, ptsreset, 0,
131 ptsselect, eno_mmap, eno_strat, eno_getc,
132 eno_putc, D_TTY
133};
134
135/*
136 * ptmx == /dev/ptmx
137 * ptsd == /dev/pts[0123456789]{3}
138 */
139#define PTMX_TEMPLATE "ptmx"
140#define PTSD_TEMPLATE "ttys%03d"
141
142/*
143 * System-wide limit on the max number of cloned ptys
144 */
145#define PTMX_MAX_DEFAULT 511 /* 512 entries */
146#define PTMX_MAX_HARD 999 /* 1000 entries, due to PTSD_TEMPLATE */
147
148static int ptmx_max = PTMX_MAX_DEFAULT; /* default # of clones we allow */
149
150/* Range enforcement for the sysctl */
151static int
152sysctl_ptmx_max(__unused struct sysctl_oid *oidp, __unused void *arg1,
153 __unused int arg2, struct sysctl_req *req)
154{
155 int new_value, changed;
156 int error = sysctl_io_number(req, ptmx_max, sizeof(int), &new_value, &changed);
157 if (changed) {
158 if (new_value > 0 && new_value <= PTMX_MAX_HARD)
159 ptmx_max = new_value;
160 else
161 error = EINVAL;
162 }
163 return(error);
164}
165
166SYSCTL_NODE(_kern, KERN_TTY, tty, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "TTY");
167SYSCTL_PROC(_kern_tty, OID_AUTO, ptmx_max,
168 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
169 &ptmx_max, 0, &sysctl_ptmx_max, "I", "ptmx_max");
170
171static int ptmx_clone(dev_t dev, int minor);
172
173static struct tty_dev_t _ptmx_driver;
174
175int
176ptmx_init( __unused int config_count)
177{
178 /*
179 * We start looking at slot 10, since there are inits that will
180 * stomp explicit slots (e.g. vndevice stomps 1) below that.
181 */
182
183 /* Get a major number for /dev/ptmx */
184 if ((ptmx_major = cdevsw_add(-15, &ptmx_cdev)) == -1) {
185 printf("ptmx_init: failed to obtain /dev/ptmx major number\n");
186 return (ENOENT);
187 }
188
189 if (cdevsw_setkqueueok(ptmx_major, &ptmx_cdev, CDEVSW_IS_PTC) == -1) {
190 panic("Failed to set flags on ptmx cdevsw entry.");
191 }
192
193 /* Get a major number for /dev/pts/nnn */
194 if ((ptsd_major = cdevsw_add(-15, &ptsd_cdev)) == -1) {
195 (void)cdevsw_remove(ptmx_major, &ptmx_cdev);
196 printf("ptmx_init: failed to obtain /dev/ptmx major number\n");
197 return (ENOENT);
198 }
199
200 if (cdevsw_setkqueueok(ptsd_major, &ptsd_cdev, CDEVSW_IS_PTS) == -1) {
201 panic("Failed to set flags on ptmx cdevsw entry.");
202 }
203
204 /* Create the /dev/ptmx device {<major>,0} */
205 (void)devfs_make_node_clone(makedev(ptmx_major, 0),
206 DEVFS_CHAR, UID_ROOT, GID_TTY, 0666,
207 ptmx_clone, PTMX_TEMPLATE);
208
209 _ptmx_driver.master = ptmx_major;
210 _ptmx_driver.slave = ptsd_major;
211 _ptmx_driver.fix_7828447 = 1;
212 _ptmx_driver.fix_7070978 = 1;
213#if CONFIG_MACF
214 _ptmx_driver.mac_notify = 1;
215#endif
216 _ptmx_driver.open = &ptmx_get_ioctl;
217 _ptmx_driver.free = &ptmx_free_ioctl;
218 _ptmx_driver.name = &ptmx_get_name;
219 _ptmx_driver.revoke = &ptsd_revoke_knotes;
220 tty_dev_register(&_ptmx_driver);
221
222 return (0);
223}
224
225
226static struct _ptmx_ioctl_state {
227 struct ptmx_ioctl **pis_ioctl_list; /* pointer vector */
228 int pis_total; /* total slots */
229 int pis_free; /* free slots */
230} _state;
231#define PTMX_GROW_VECTOR 16 /* Grow by this many slots at a time */
232
233/*
234 * Given a minor number, return the corresponding structure for that minor
235 * number. If there isn't one, and the create flag is specified, we create
236 * one if possible.
237 *
238 * Parameters: minor Minor number of ptmx device
239 * open_flag PF_OPEN_M First open of master
240 * PF_OPEN_S First open of slave
241 * 0 Just want ioctl struct
242 *
243 * Returns: NULL Did not exist/could not create
244 * !NULL structure corresponding minor number
245 *
246 * Locks: tty_lock() on ptmx_ioctl->pt_tty NOT held on entry or exit.
247 */
248static struct ptmx_ioctl *
249ptmx_get_ioctl(int minor, int open_flag)
250{
251 struct ptmx_ioctl *new_ptmx_ioctl;
252
253 if (open_flag & PF_OPEN_M) {
254
255 /*
256 * If we are about to allocate more memory, but we have
257 * already hit the administrative limit, then fail the
258 * operation.
259 *
260 * Note: Subtract free from total when making this
261 * check to allow unit increments, rather than
262 * snapping to the nearest PTMX_GROW_VECTOR...
263 */
264 if ((_state.pis_total - _state.pis_free) >= ptmx_max) {
265 return (NULL);
266 }
267
268 MALLOC(new_ptmx_ioctl, struct ptmx_ioctl *, sizeof(struct ptmx_ioctl), M_TTYS, M_WAITOK|M_ZERO);
269 if (new_ptmx_ioctl == NULL) {
270 return (NULL);
271 }
272
273 if ((new_ptmx_ioctl->pt_tty = ttymalloc()) == NULL) {
274 FREE(new_ptmx_ioctl, M_TTYS);
275 return (NULL);
276 }
277
278 /*
279 * Hold the DEVFS_LOCK() over this whole operation; devfs
280 * itself does this over malloc/free as well, so this should
281 * be safe to do. We hold it longer than we want to, but
282 * doing so avoids a reallocation race on the minor number.
283 */
284 DEVFS_LOCK();
285 /* Need to allocate a larger vector? */
286 if (_state.pis_free == 0) {
287 struct ptmx_ioctl **new_pis_ioctl_list;
288 struct ptmx_ioctl **old_pis_ioctl_list = NULL;
289
290 /* Yes. */
291 MALLOC(new_pis_ioctl_list, struct ptmx_ioctl **, sizeof(struct ptmx_ioctl *) * (_state.pis_total + PTMX_GROW_VECTOR), M_TTYS, M_WAITOK|M_ZERO);
292 if (new_pis_ioctl_list == NULL) {
293 ttyfree(new_ptmx_ioctl->pt_tty);
294 DEVFS_UNLOCK();
295 FREE(new_ptmx_ioctl, M_TTYS);
296 return (NULL);
297 }
298
299 /* If this is not the first time, copy the old over */
300 bcopy(_state.pis_ioctl_list, new_pis_ioctl_list, sizeof(struct ptmx_ioctl *) * _state.pis_total);
301 old_pis_ioctl_list = _state.pis_ioctl_list;
302 _state.pis_ioctl_list = new_pis_ioctl_list;
303 _state.pis_free += PTMX_GROW_VECTOR;
304 _state.pis_total += PTMX_GROW_VECTOR;
305 if (old_pis_ioctl_list)
306 FREE(old_pis_ioctl_list, M_TTYS);
307 }
308
309 /* is minor in range now? */
310 if (minor < 0 || minor >= _state.pis_total) {
311 ttyfree(new_ptmx_ioctl->pt_tty);
312 DEVFS_UNLOCK();
313 FREE(new_ptmx_ioctl, M_TTYS);
314 return (NULL);
315 }
316
317 if (_state.pis_ioctl_list[minor] != NULL) {
318 ttyfree(new_ptmx_ioctl->pt_tty);
319 DEVFS_UNLOCK();
320 FREE(new_ptmx_ioctl, M_TTYS);
321
322 /* Special error value so we know to redrive the open, we've been raced */
323 return (struct ptmx_ioctl*)-1;
324
325 }
326
327 /* Vector is large enough; grab a new ptmx_ioctl */
328
329 /* Now grab a free slot... */
330 _state.pis_ioctl_list[minor] = new_ptmx_ioctl;
331
332 /* reduce free count */
333 _state.pis_free--;
334
335 _state.pis_ioctl_list[minor]->pt_flags |= PF_OPEN_M;
336 DEVFS_UNLOCK();
337
338 /* Create the /dev/ttysXXX device {<major>,XXX} */
339 _state.pis_ioctl_list[minor]->pt_devhandle = devfs_make_node(
340 makedev(ptsd_major, minor),
341 DEVFS_CHAR, UID_ROOT, GID_TTY, 0620,
342 PTSD_TEMPLATE, minor);
343 if (_state.pis_ioctl_list[minor]->pt_devhandle == NULL) {
344 printf("devfs_make_node() call failed for ptmx_get_ioctl()!!!!\n");
345 }
346 }
347
348 if (minor < 0 || minor >= _state.pis_total) {
349 return (NULL);
350 }
351
352 return (_state.pis_ioctl_list[minor]);
353}
354
355/*
356 * Locks: tty_lock() of old_ptmx_ioctl->pt_tty NOT held for this call.
357 */
358static int
359ptmx_free_ioctl(int minor, int open_flag)
360{
361 struct ptmx_ioctl *old_ptmx_ioctl = NULL;
362
363 DEVFS_LOCK();
364
365 if (minor < 0 || minor >= _state.pis_total) {
366 DEVFS_UNLOCK();
367 return (-1);
368 }
369
370 _state.pis_ioctl_list[minor]->pt_flags &= ~(open_flag);
371
372 /*
373 * Was this the last close? We will recognize it because we only get
374 * a notification on the last close of a device, and we will have
375 * cleared both the master and the slave open bits in the flags.
376 */
377 if (!(_state.pis_ioctl_list[minor]->pt_flags & (PF_OPEN_M|PF_OPEN_S))) {
378 /* Mark as free so it can be reallocated later */
379 old_ptmx_ioctl = _state.pis_ioctl_list[ minor];
380 _state.pis_ioctl_list[minor] = NULL;
381 _state.pis_free++;
382 }
383 DEVFS_UNLOCK();
384
385 /* Free old after dropping lock */
386 if (old_ptmx_ioctl != NULL) {
387 /*
388 * XXX See <rdar://5348651> and <rdar://4854638>
389 *
390 * XXX Conditional to be removed when/if tty/pty reference
391 * XXX counting and mutex implemented.
392 */
393 if (old_ptmx_ioctl->pt_devhandle != NULL)
394 devfs_remove(old_ptmx_ioctl->pt_devhandle);
395 ttyfree(old_ptmx_ioctl->pt_tty);
396 FREE(old_ptmx_ioctl, M_TTYS);
397 }
398
399 return (0); /* Success */
400}
401
402static int
403ptmx_get_name(int minor, char *buffer, size_t size)
404{
405 return snprintf(buffer, size, "/dev/" PTSD_TEMPLATE, minor);
406}
407
408
409
410/*
411 * Given the dev entry that's being opened, we clone the device. This driver
412 * doesn't actually use the dev entry, since we alreaqdy know who we are by
413 * being called from this code. This routine is a callback registered from
414 * devfs_make_node_clone() in ptmx_init(); it's purpose is to provide a new
415 * minor number, or to return -1, if one can't be provided.
416 *
417 * Parameters: dev The device we are cloning from
418 *
419 * Returns: >= 0 A new minor device number
420 * -1 Error: ENOMEM ("Can't alloc device")
421 *
422 * NOTE: Called with DEVFS_LOCK() held
423 */
424static int
425ptmx_clone(__unused dev_t dev, int action)
426{
427 int i;
428
429 if (action == DEVFS_CLONE_ALLOC) {
430 /* First one */
431 if (_state.pis_total == 0)
432 return (0);
433
434 /*
435 * Note: We can add hinting on free slots, if this linear search
436 * ends up being a performance bottleneck...
437 */
438 for(i = 0; i < _state.pis_total; i++) {
439 if (_state.pis_ioctl_list[ i] == NULL)
440 break;
441 }
442
443 /*
444 * XXX We fall off the end here; if we did this twice at the
445 * XXX same time, we could return the same minor to two
446 * XXX callers; we should probably exand the pointer vector
447 * XXX here, but I need more information on the MALLOC/FREE
448 * XXX locking to ensure against a deadlock. Maybe we can
449 * XXX just high watermark it at 1/2 of PTMX_GROW_VECTOR?
450 * XXX That would require returning &minor as implict return
451 * XXX and an error code ("EAGAIN/ERESTART") or 0 as our
452 * XXX explicit return.
453 */
454
455 return (i); /* empty slot or next slot */
456 }
457 return(-1);
458}
459
460
461/*
462 * kqueue support.
463 */
464int ptsd_kqfilter(dev_t dev, struct knote *kn);
465static void ptsd_kqops_detach(struct knote *);
466static int ptsd_kqops_event(struct knote *, long);
467static int ptsd_kqops_touch(struct knote *kn, struct kevent_internal_s *kev);
468static int ptsd_kqops_process(struct knote *kn, struct filt_process_s *data, struct kevent_internal_s *kev);
469
470SECURITY_READ_ONLY_EARLY(struct filterops) ptsd_kqops = {
471 .f_isfd = 1,
472 /* attach is handled by ptsd_kqfilter -- the dev node must be passed in */
473 .f_detach = ptsd_kqops_detach,
474 .f_event = ptsd_kqops_event,
475 .f_touch = ptsd_kqops_touch,
476 .f_process = ptsd_kqops_process,
477};
478
479/*
480 * In the normal case, by the time the driver_close() routine is called
481 * on the slave, all knotes have been detached. However in the revoke(2)
482 * case, the driver's close routine is called while there are knotes active
483 * that reference the handlers below. And we have no obvious means to
484 * reach from the driver out to the kqueue's that reference them to get
485 * them to stop.
486 */
487
488static void
489ptsd_kqops_detach(struct knote *kn)
490{
491 struct tty *tp;
492
493 tp = kn->kn_hook;
494 assert(tp != NULL);
495
496 tty_lock(tp);
497
498 /*
499 * Only detach knotes from open ttys -- ttyclose detaches all knotes
500 * under the lock and unsets TS_ISOPEN.
501 */
502 if (tp->t_state & TS_ISOPEN) {
503 switch (kn->kn_filter) {
504 case EVFILT_READ:
505 KNOTE_DETACH(&tp->t_rsel.si_note, kn);
506 break;
507
508 case EVFILT_WRITE:
509 KNOTE_DETACH(&tp->t_wsel.si_note, kn);
510 break;
511
512 default:
513 panic("invalid knote %p detach, filter: %d", kn, kn->kn_filter);
514 break;
515 }
516 }
517
518 kn->kn_hook = NULL;
519 tty_unlock(tp);
520
521 ttyfree(tp);
522}
523
524static int
525ptsd_kqops_common(struct knote *kn, struct tty *tp)
526{
527 int retval = 0;
528
529 TTY_LOCK_OWNED(tp);
530
531 switch (kn->kn_filter) {
532 case EVFILT_READ:
533 kn->kn_data = ttnread(tp);
534 if (kn->kn_data > 0) {
535 retval = 1;
536 }
537 break;
538
539 case EVFILT_WRITE:
540 if ((tp->t_outq.c_cc <= tp->t_lowat) &&
541 (tp->t_state & TS_CONNECTED)) {
542 kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
543 retval = 1;
544 }
545 break;
546
547 default:
548 panic("ptsd kevent: unexpected filter: %d, kn = %p, tty = %p",
549 kn->kn_filter, kn, tp);
550 break;
551 }
552
553 if (tp->t_state & TS_ZOMBIE) {
554 kn->kn_flags |= EV_EOF;
555 retval = 1;
556 }
557
558 return retval;
559}
560
561static int
562ptsd_kqops_event(struct knote *kn, long hint)
563{
564 struct tty *tp = kn->kn_hook;
565 int ret;
566 bool revoked = hint & NOTE_REVOKE;
567 hint &= ~NOTE_REVOKE;
568
569 if (!hint) {
570 tty_lock(tp);
571 }
572
573 if (revoked) {
574 kn->kn_flags |= EV_EOF | EV_ONESHOT;
575 ret = 1;
576 } else {
577 ret = ptsd_kqops_common(kn, tp);
578 }
579
580 if (!hint) {
581 tty_unlock(tp);
582 }
583
584 return ret;
585}
586
587static int
588ptsd_kqops_touch(struct knote *kn, struct kevent_internal_s *kev)
589{
590 struct tty *tp;
591 int ret;
592
593 tp = kn->kn_hook;
594
595 tty_lock(tp);
596
597 /* accept new kevent state */
598 kn->kn_sfflags = kev->fflags;
599 kn->kn_sdata = kev->data;
600
601 /* recapture fired state of knote */
602 ret = ptsd_kqops_common(kn, tp);
603
604 tty_unlock(tp);
605
606 return ret;
607}
608
609static int
610ptsd_kqops_process(struct knote *kn, __unused struct filt_process_s *data,
611 struct kevent_internal_s *kev)
612{
613 struct tty *tp = kn->kn_hook;
614 int ret;
615
616 tty_lock(tp);
617 ret = ptsd_kqops_common(kn, tp);
618 if (ret) {
619 *kev = kn->kn_kevent;
620 if (kn->kn_flags & EV_CLEAR) {
621 kn->kn_fflags = 0;
622 kn->kn_data = 0;
623 }
624 }
625 tty_unlock(tp);
626
627 return ret;
628}
629
630int
631ptsd_kqfilter(dev_t dev, struct knote *kn)
632{
633 struct tty *tp = NULL;
634 struct ptmx_ioctl *pti = NULL;
635 int ret;
636
637 /* make sure we're talking about the right device type */
638 if (cdevsw[major(dev)].d_open != ptsopen) {
639 knote_set_error(kn, ENODEV);
640 return 0;
641 }
642
643 if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
644 knote_set_error(kn, ENXIO);
645 return 0;
646 }
647
648 tp = pti->pt_tty;
649 tty_lock(tp);
650
651 assert(tp->t_state & TS_ISOPEN);
652
653 kn->kn_filtid = EVFILTID_PTSD;
654 /* the tty will be freed when detaching the knote */
655 ttyhold(tp);
656 kn->kn_hook = tp;
657
658 switch (kn->kn_filter) {
659 case EVFILT_READ:
660 KNOTE_ATTACH(&tp->t_rsel.si_note, kn);
661 break;
662 case EVFILT_WRITE:
663 KNOTE_ATTACH(&tp->t_wsel.si_note, kn);
664 break;
665 default:
666 panic("ptsd kevent: unexpected filter: %d, kn = %p, tty = %p",
667 kn->kn_filter, kn, tp);
668 break;
669 }
670
671 /* capture current event state */
672 ret = ptsd_kqops_common(kn, tp);
673
674 tty_unlock(tp);
675
676 return ret;
677}
678
679/*
680 * Support for revoke(2).
681 */
682static void
683ptsd_revoke_knotes(__unused int minor, struct tty *tp)
684{
685 tty_lock(tp);
686
687 ttwakeup(tp);
688 KNOTE(&tp->t_rsel.si_note, NOTE_REVOKE | 1 /* the lock is already held */);
689
690 ttwwakeup(tp);
691 KNOTE(&tp->t_wsel.si_note, NOTE_REVOKE | 1);
692
693 tty_unlock(tp);
694}
695
696/*
697 * kevent filter routines for the master side of a pty, a ptmx.
698 *
699 * Stuff the ptmx_ioctl structure into the hook for ptmx knotes. Use the
700 * embedded tty's lock for synchronization.
701 */
702
703int ptmx_kqfilter(dev_t dev, struct knote *kn);
704static void ptmx_kqops_detach(struct knote *);
705static int ptmx_kqops_event(struct knote *, long);
706static int ptmx_kqops_touch(struct knote *kn, struct kevent_internal_s *kev);
707static int ptmx_kqops_process(struct knote *kn, struct filt_process_s *data, struct kevent_internal_s *kev);
708static int ptmx_kqops_common(struct knote *kn, struct ptmx_ioctl *pti, struct tty *tp);
709
710SECURITY_READ_ONLY_EARLY(struct filterops) ptmx_kqops = {
711 .f_isfd = 1,
712 /* attach is handled by ptmx_kqfilter -- the dev node must be passed in */
713 .f_detach = ptmx_kqops_detach,
714 .f_event = ptmx_kqops_event,
715 .f_touch = ptmx_kqops_touch,
716 .f_process = ptmx_kqops_process,
717};
718
719static struct ptmx_ioctl *
720ptmx_knote_ioctl(struct knote *kn)
721{
722 return (struct ptmx_ioctl *)kn->kn_hook;
723}
724
725static struct tty *
726ptmx_knote_tty(struct knote *kn)
727{
728 struct ptmx_ioctl *pti = kn->kn_hook;
729 return pti->pt_tty;
730}
731
732int
733ptmx_kqfilter(dev_t dev, struct knote *kn)
734{
735 struct tty *tp = NULL;
736 struct ptmx_ioctl *pti = NULL;
737 int ret;
738
739 /* make sure we're talking about the right device type */
740 if (cdevsw[major(dev)].d_open != ptcopen) {
741 knote_set_error(kn, ENODEV);
742 return 0;
743 }
744
745 if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
746 knote_set_error(kn, ENXIO);
747 return 0;
748 }
749
750 tp = pti->pt_tty;
751 tty_lock(tp);
752
753 kn->kn_filtid = EVFILTID_PTMX;
754 kn->kn_hook = pti;
755
756 /*
757 * Attach to the ptmx's selinfo structures. This is the major difference
758 * to the ptsd filtops, which use the selinfo structures in the tty
759 * structure.
760 */
761 switch (kn->kn_filter) {
762 case EVFILT_READ:
763 KNOTE_ATTACH(&pti->pt_selr.si_note, kn);
764 break;
765 case EVFILT_WRITE:
766 KNOTE_ATTACH(&pti->pt_selw.si_note, kn);
767 break;
768 default:
769 panic("ptmx kevent: unexpected filter: %d, kn = %p, tty = %p",
770 kn->kn_filter, kn, tp);
771 break;
772 }
773
774 /* capture current event state */
775 ret = ptmx_kqops_common(kn, pti, tp);
776
777 /* take a reference on the TTY */
778 ttyhold(tp);
779 tty_unlock(tp);
780
781 return ret;
782}
783
784static void
785ptmx_kqops_detach(struct knote *kn)
786{
787 struct ptmx_ioctl *pti = kn->kn_hook;
788 struct tty *tp = pti->pt_tty;
789
790 assert(tp != NULL);
791
792 tty_lock(tp);
793
794 switch (kn->kn_filter) {
795 case EVFILT_READ:
796 KNOTE_DETACH(&pti->pt_selr.si_note, kn);
797 break;
798
799 case EVFILT_WRITE:
800 KNOTE_DETACH(&pti->pt_selw.si_note, kn);
801 break;
802
803 default:
804 panic("invalid knote %p detach, filter: %d", kn, kn->kn_filter);
805 break;
806 }
807
808 kn->kn_hook = NULL;
809 tty_unlock(tp);
810
811 ttyfree(tp);
812}
813
814static int
815ptmx_kqops_common(struct knote *kn, struct ptmx_ioctl *pti, struct tty *tp)
816{
817 int retval = 0;
818
819 TTY_LOCK_OWNED(tp);
820
821 /* disconnects should force a wakeup (EOF) */
822 if (!(tp->t_state & TS_CONNECTED)) {
823 kn->kn_flags |= EV_EOF;
824 return 1;
825 }
826
827 switch (kn->kn_filter) {
828 case EVFILT_READ:
829 /* there's data on the TTY and it's not stopped */
830 if (tp->t_outq.c_cc && !(tp->t_state & TS_TTSTOP)) {
831 retval = tp->t_outq.c_cc;
832 kn->kn_data = retval;
833 } else if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
834 ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl)) {
835 retval = 1;
836 }
837 break;
838
839 case EVFILT_WRITE:
840 if (pti->pt_flags & PF_REMOTE) {
841 if (tp->t_canq.c_cc == 0) {
842 retval = TTYHOG - 1;
843 }
844 } else {
845 retval = (TTYHOG - 2) - (tp->t_rawq.c_cc + tp->t_canq.c_cc);
846 if (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON)) {
847 retval = 1;
848 }
849 if (retval < 0) {
850 retval = 0;
851 }
852 }
853 break;
854
855 default:
856 panic("ptmx kevent: unexpected filter: %d, kn = %p, tty = %p",
857 kn->kn_filter, kn, tp);
858 break;
859 }
860
861 if (tp->t_state & TS_ZOMBIE) {
862 kn->kn_flags |= EV_EOF;
863 retval = 1;
864 }
865
866 return retval;
867}
868
869static int
870ptmx_kqops_event(struct knote *kn, long hint)
871{
872 struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
873 struct tty *tp = ptmx_knote_tty(kn);
874 int ret;
875 bool revoked = hint & NOTE_REVOKE;
876 hint &= ~NOTE_REVOKE;
877
878 if (!hint) {
879 tty_lock(tp);
880 }
881
882 if (revoked) {
883 kn->kn_flags |= EV_EOF | EV_ONESHOT;
884 ret = 1;
885 } else {
886 ret = ptmx_kqops_common(kn, pti, tp);
887 }
888
889 if (!hint) {
890 tty_unlock(tp);
891 }
892
893 return ret;
894}
895
896static int
897ptmx_kqops_touch(struct knote *kn, struct kevent_internal_s *kev)
898{
899 struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
900 struct tty *tp = ptmx_knote_tty(kn);
901 int ret;
902
903 tty_lock(tp);
904
905 /* accept new kevent state */
906 kn->kn_sfflags = kev->fflags;
907 kn->kn_sdata = kev->data;
908
909 /* recapture fired state of knote */
910 ret = ptmx_kqops_common(kn, pti, tp);
911
912 tty_unlock(tp);
913
914 return ret;
915}
916
917static int
918ptmx_kqops_process(struct knote *kn, __unused struct filt_process_s *data,
919 struct kevent_internal_s *kev)
920{
921 struct ptmx_ioctl *pti = ptmx_knote_ioctl(kn);
922 struct tty *tp = ptmx_knote_tty(kn);
923 int ret;
924
925 tty_lock(tp);
926 ret = ptmx_kqops_common(kn, pti, tp);
927 if (ret) {
928 *kev = kn->kn_kevent;
929 if (kn->kn_flags & EV_CLEAR) {
930 kn->kn_fflags = 0;
931 kn->kn_data = 0;
932 }
933 }
934 tty_unlock(tp);
935
936 return ret;
937}
938