1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2008 Ed Schouten <ed@FreeBSD.org> 5 * All rights reserved. 6 * 7 * Portions of this software were developed under sponsorship from Snow 8 * B.V., the Netherlands. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #include "opt_capsicum.h" 34 #include "opt_printf.h" 35 36 #include <sys/param.h> 37 #include <sys/capsicum.h> 38 #include <sys/conf.h> 39 #include <sys/cons.h> 40 #include <sys/fcntl.h> 41 #include <sys/file.h> 42 #include <sys/filedesc.h> 43 #include <sys/filio.h> 44 #ifdef COMPAT_43TTY 45 #include <sys/ioctl_compat.h> 46 #endif /* COMPAT_43TTY */ 47 #include <sys/jail.h> 48 #include <sys/kernel.h> 49 #include <sys/limits.h> 50 #include <sys/malloc.h> 51 #include <sys/mount.h> 52 #include <sys/poll.h> 53 #include <sys/priv.h> 54 #include <sys/proc.h> 55 #include <sys/serial.h> 56 #include <sys/signal.h> 57 #include <sys/stat.h> 58 #include <sys/stdarg.h> 59 #include <sys/sx.h> 60 #include <sys/sysctl.h> 61 #include <sys/systm.h> 62 #include <sys/tty.h> 63 #include <sys/ttycom.h> 64 #define TTYDEFCHARS 65 #include <sys/ttydefaults.h> 66 #undef TTYDEFCHARS 67 #include <sys/ucred.h> 68 #include <sys/vnode.h> 69 #define EXTERR_CATEGORY EXTERR_CAT_TTY 70 #include <sys/exterrvar.h> 71 72 #include <fs/devfs/devfs.h> 73 74 static MALLOC_DEFINE(M_TTY, "tty", "tty device"); 75 76 static void tty_rel_free(struct tty *tp, bool inttydevclose); 77 static int tty_wait_proctree(struct tty *tp, struct cv *cv, 78 int proctree_lock_mode); 79 80 static TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list); 81 static struct sx tty_list_sx; 82 SX_SYSINIT(tty_list, &tty_list_sx, "tty list"); 83 static unsigned int tty_list_count = 0; 84 85 /* Character device of /dev/console. */ 86 static struct cdev *dev_console; 87 static const char *dev_console_filename; 88 89 /* 90 * Flags that are supported and stored by this implementation. 91 */ 92 #define TTYSUP_IFLAG (IGNBRK|BRKINT|IGNPAR|PARMRK|INPCK|ISTRIP|INLCR|\ 93 IGNCR|ICRNL|IXON|IXOFF|IXANY|IMAXBEL|IUTF8) 94 #define TTYSUP_OFLAG (OPOST|ONLCR|TAB3|ONOEOT|OCRNL|ONOCR|ONLRET) 95 #define TTYSUP_LFLAG (ECHOKE|ECHOE|ECHOK|ECHO|ECHONL|ECHOPRT|\ 96 ECHOCTL|ISIG|ICANON|ALTWERASE|IEXTEN|TOSTOP|\ 97 FLUSHO|NOKERNINFO|NOFLSH) 98 #define TTYSUP_CFLAG (CIGNORE|CSIZE|CSTOPB|CREAD|PARENB|PARODD|\ 99 HUPCL|CLOCAL|CCTS_OFLOW|CRTS_IFLOW|CDTR_IFLOW|\ 100 CDSR_OFLOW|CCAR_OFLOW|CNO_RTSDTR) 101 102 #define TTY_CALLOUT(tp,d) (dev2unit(d) & TTYUNIT_CALLOUT) 103 104 static int tty_drainwait = 5 * 60; 105 SYSCTL_INT(_kern, OID_AUTO, tty_drainwait, CTLFLAG_RWTUN, 106 &tty_drainwait, 0, "Default output drain timeout in seconds"); 107 108 static bool tty_tiocsti = true; 109 SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_tiocsti, CTLFLAG_RWTUN, 110 &tty_tiocsti, 0, "Allow TIOCSTI ioctl"); 111 112 /* 113 * Set TTY buffer sizes. 114 */ 115 116 #define TTYBUF_MAX 65536 117 118 #ifdef PRINTF_BUFR_SIZE 119 #define TTY_PRBUF_SIZE PRINTF_BUFR_SIZE 120 #else 121 #define TTY_PRBUF_SIZE 256 122 #endif 123 124 /* 125 * Allocate buffer space if necessary, and set low watermarks, based on speed. 126 * Note that the ttyxxxq_setsize() functions may drop and then reacquire the tty 127 * lock during memory allocation. They will return ENXIO if the tty disappears 128 * while unlocked. 129 */ 130 static int 131 tty_watermarks(struct tty *tp) 132 { 133 size_t bs = 0; 134 int error; 135 136 /* Provide an input buffer for 2 seconds of data. */ 137 if (tp->t_termios.c_cflag & CREAD) 138 bs = MIN(tp->t_termios.c_ispeed / 5, TTYBUF_MAX); 139 error = ttyinq_setsize(&tp->t_inq, tp, bs); 140 if (error != 0) 141 return (error); 142 143 /* Set low watermark at 10% (when 90% is available). */ 144 tp->t_inlow = (ttyinq_getallocatedsize(&tp->t_inq) * 9) / 10; 145 146 /* Provide an output buffer for 2 seconds of data. */ 147 bs = MIN(tp->t_termios.c_ospeed / 5, TTYBUF_MAX); 148 error = ttyoutq_setsize(&tp->t_outq, tp, bs); 149 if (error != 0) 150 return (error); 151 152 /* Set low watermark at 10% (when 90% is available). */ 153 tp->t_outlow = (ttyoutq_getallocatedsize(&tp->t_outq) * 9) / 10; 154 155 return (0); 156 } 157 158 static int 159 tty_drain(struct tty *tp, int leaving) 160 { 161 sbintime_t timeout_at; 162 size_t bytes; 163 int error; 164 165 if (ttyhook_hashook(tp, getc_inject)) 166 /* buffer is inaccessible */ 167 return (0); 168 169 /* 170 * For close(), use the recent historic timeout of "1 second without 171 * making progress". For tcdrain(), use t_drainwait as the timeout, 172 * with zero meaning "no timeout" which gives POSIX behavior. 173 */ 174 if (leaving) 175 timeout_at = getsbinuptime() + SBT_1S; 176 else if (tp->t_drainwait != 0) 177 timeout_at = getsbinuptime() + SBT_1S * tp->t_drainwait; 178 else 179 timeout_at = 0; 180 181 /* 182 * Poll the output buffer and the hardware for completion, at 10 Hz. 183 * Polling is required for devices which are not able to signal an 184 * interrupt when the transmitter becomes idle (most USB serial devs). 185 * The unusual structure of this loop ensures we check for busy one more 186 * time after tty_timedwait() returns EWOULDBLOCK, so that success has 187 * higher priority than timeout if the IO completed in the last 100mS. 188 */ 189 error = 0; 190 bytes = ttyoutq_bytesused(&tp->t_outq); 191 for (;;) { 192 if (ttyoutq_bytesused(&tp->t_outq) == 0 && !ttydevsw_busy(tp)) 193 return (0); 194 if (error != 0) 195 return (error); 196 ttydevsw_outwakeup(tp); 197 error = tty_timedwait(tp, &tp->t_outwait, hz / 10); 198 if (error != 0 && error != EWOULDBLOCK) 199 return (error); 200 else if (timeout_at == 0 || getsbinuptime() < timeout_at) 201 error = 0; 202 else if (leaving && ttyoutq_bytesused(&tp->t_outq) < bytes) { 203 /* In close, making progress, grant an extra second. */ 204 error = 0; 205 timeout_at += SBT_1S; 206 bytes = ttyoutq_bytesused(&tp->t_outq); 207 } 208 } 209 } 210 211 /* 212 * Though ttydev_enter() and ttydev_leave() seem to be related, they 213 * don't have to be used together. ttydev_enter() is used by the cdev 214 * operations to prevent an actual operation from being processed when 215 * the TTY has been abandoned. ttydev_leave() is used by ttydev_open() 216 * and ttydev_close() to determine whether per-TTY data should be 217 * deallocated. 218 */ 219 220 static __inline int 221 ttydev_enter(struct tty *tp) 222 { 223 224 tty_lock(tp); 225 226 if (tty_gone(tp) || !tty_opened(tp)) { 227 /* Device is already gone. */ 228 tty_unlock(tp); 229 return (EXTERROR(ENXIO, "ttydev_enter: device is gone")); 230 } 231 232 return (0); 233 } 234 235 static void 236 ttydev_leave(struct tty *tp, bool inttydevclose) 237 { 238 239 tty_assert_locked(tp); 240 241 if (tty_opened(tp) || tp->t_flags & TF_OPENCLOSE) { 242 /* Device is still opened somewhere. */ 243 if (inttydevclose) 244 tp->t_flags &= ~TF_INDEVCLOSE; 245 tty_unlock(tp); 246 return; 247 } 248 249 tp->t_flags |= TF_OPENCLOSE; 250 251 /* Remove console TTY. */ 252 constty_clear(tp); 253 254 /* Drain any output. */ 255 if (!tty_gone(tp)) 256 tty_drain(tp, 1); 257 258 ttydisc_close(tp); 259 260 /* Free i/o queues now since they might be large. */ 261 ttyinq_free(&tp->t_inq); 262 tp->t_inlow = 0; 263 ttyoutq_free(&tp->t_outq); 264 tp->t_outlow = 0; 265 266 if (!tty_gone(tp)) 267 ttydevsw_close(tp); 268 269 tp->t_flags &= ~TF_OPENCLOSE; 270 cv_broadcast(&tp->t_dcdwait); 271 tty_rel_free(tp, inttydevclose); 272 } 273 274 /* 275 * Operations that are exposed through the character device in /dev. 276 */ 277 static int 278 ttydev_open(struct cdev *dev, int oflags, int devtype __unused, 279 struct thread *td) 280 { 281 struct tty *tp; 282 int error; 283 284 tp = dev->si_drv1; 285 error = 0; 286 tty_lock(tp); 287 if (tty_gone(tp)) { 288 /* Device is already gone. */ 289 tty_unlock(tp); 290 return (EXTERROR(ENXIO, "ttydev_open: device is gone")); 291 } 292 293 /* 294 * Block when other processes are currently opening or closing 295 * the TTY. 296 */ 297 while (tp->t_flags & TF_OPENCLOSE) { 298 error = tty_wait(tp, &tp->t_dcdwait); 299 if (error != 0) { 300 tty_unlock(tp); 301 return (error); 302 } 303 } 304 tp->t_flags |= TF_OPENCLOSE; 305 306 /* 307 * Make sure the "tty" and "cua" device cannot be opened at the 308 * same time. The console is a "tty" device. 309 */ 310 if (TTY_CALLOUT(tp, dev)) { 311 if (tp->t_flags & (TF_OPENED_CONS | TF_OPENED_IN)) { 312 error = EBUSY; 313 goto done; 314 } 315 } else { 316 if (tp->t_flags & TF_OPENED_OUT) { 317 error = EBUSY; 318 goto done; 319 } 320 } 321 322 if (tp->t_flags & TF_EXCLUDE && priv_check(td, PRIV_TTY_EXCLUSIVE)) { 323 error = EBUSY; 324 goto done; 325 } 326 327 if (!tty_opened(tp)) { 328 /* Set proper termios flags. */ 329 if (TTY_CALLOUT(tp, dev)) 330 tp->t_termios = tp->t_termios_init_out; 331 else 332 tp->t_termios = tp->t_termios_init_in; 333 ttydevsw_param(tp, &tp->t_termios); 334 /* Prevent modem control on callout devices and /dev/console. */ 335 if (TTY_CALLOUT(tp, dev) || dev == dev_console) 336 tp->t_termios.c_cflag |= CLOCAL; 337 338 if ((tp->t_termios.c_cflag & CNO_RTSDTR) == 0) 339 ttydevsw_modem(tp, SER_DTR|SER_RTS, 0); 340 341 error = ttydevsw_open(tp); 342 if (error != 0) 343 goto done; 344 345 ttydisc_open(tp); 346 error = tty_watermarks(tp); 347 if (error != 0) 348 goto done; 349 } 350 351 /* Wait for Carrier Detect. */ 352 if ((oflags & O_NONBLOCK) == 0 && 353 (tp->t_termios.c_cflag & CLOCAL) == 0) { 354 while ((ttydevsw_modem(tp, 0, 0) & SER_DCD) == 0) { 355 error = tty_wait(tp, &tp->t_dcdwait); 356 if (error != 0) 357 goto done; 358 } 359 } 360 361 if (dev == dev_console) 362 tp->t_flags |= TF_OPENED_CONS; 363 else if (TTY_CALLOUT(tp, dev)) 364 tp->t_flags |= TF_OPENED_OUT; 365 else 366 tp->t_flags |= TF_OPENED_IN; 367 MPASS((tp->t_flags & (TF_OPENED_CONS | TF_OPENED_IN)) == 0 || 368 (tp->t_flags & TF_OPENED_OUT) == 0); 369 370 done: tp->t_flags &= ~TF_OPENCLOSE; 371 cv_broadcast(&tp->t_dcdwait); 372 ttydev_leave(tp, false); 373 374 return (error); 375 } 376 377 static int 378 ttydev_close(struct cdev *dev, int fflag, int devtype __unused, 379 struct thread *td) 380 { 381 struct tty *tp = dev->si_drv1; 382 383 tty_lock(tp); 384 if ((tp->t_flags & TF_INDEVCLOSE) != 0) { 385 tty_unlock(tp); 386 return (0); 387 } 388 tp->t_flags |= TF_INDEVCLOSE; 389 390 /* 391 * Don't actually close the device if it is being used as the 392 * console. 393 */ 394 MPASS((tp->t_flags & (TF_OPENED_CONS | TF_OPENED_IN)) == 0 || 395 (tp->t_flags & TF_OPENED_OUT) == 0); 396 if (dev == dev_console) 397 tp->t_flags &= ~TF_OPENED_CONS; 398 else 399 tp->t_flags &= ~(TF_OPENED_IN|TF_OPENED_OUT); 400 401 if (tp->t_flags & TF_OPENED) { 402 tp->t_flags &= ~TF_INDEVCLOSE; 403 tty_unlock(tp); 404 return (0); 405 } 406 407 /* If revoking, flush output now to avoid draining it later. */ 408 if ((fflag & FREVOKE) != 0) { 409 tty_flush(tp, FWRITE); 410 knlist_delete(&tp->t_inpoll.si_note, td, 1); 411 knlist_delete(&tp->t_outpoll.si_note, td, 1); 412 } 413 414 tp->t_flags &= ~TF_EXCLUDE; 415 416 /* Properly wake up threads that are stuck - revoke(). */ 417 tp->t_revokecnt++; 418 tty_wakeup(tp, FREAD|FWRITE); 419 cv_broadcast(&tp->t_bgwait); 420 cv_broadcast(&tp->t_dcdwait); 421 422 ttydev_leave(tp, true); 423 424 return (0); 425 } 426 427 static __inline int 428 tty_is_ctty(struct tty *tp, struct proc *p) 429 { 430 431 tty_assert_locked(tp); 432 433 return (p->p_session == tp->t_session && p->p_flag & P_CONTROLT); 434 } 435 436 int 437 tty_wait_background(struct tty *tp, struct thread *td, int sig, 438 int proctree_lock_mode) 439 { 440 struct proc *p; 441 struct pgrp *pg; 442 ksiginfo_t ksi; 443 int error; 444 445 MPASS(sig == SIGTTIN || sig == SIGTTOU); 446 tty_assert_locked(tp); 447 MPASS(proctree_lock_mode == LA_UNLOCKED || 448 proctree_lock_mode == LA_SLOCKED || 449 proctree_lock_mode == LA_XLOCKED); 450 451 p = td->td_proc; 452 for (;;) { 453 pg = p->p_pgrp; 454 PGRP_LOCK(pg); 455 PROC_LOCK(p); 456 457 /* 458 * pg may no longer be our process group. 459 * Re-check after locking. 460 */ 461 if (p->p_pgrp != pg) { 462 PROC_UNLOCK(p); 463 PGRP_UNLOCK(pg); 464 continue; 465 } 466 467 /* 468 * The process should only sleep, when: 469 * - This terminal is the controlling terminal 470 * - Its process group is not the foreground process 471 * group 472 * - The parent process isn't waiting for the child to 473 * exit 474 * - the signal to send to the process isn't masked 475 */ 476 if (!tty_is_ctty(tp, p) || p->p_pgrp == tp->t_pgrp) { 477 /* Allow the action to happen. */ 478 PROC_UNLOCK(p); 479 PGRP_UNLOCK(pg); 480 return (0); 481 } 482 483 if (SIGISMEMBER(p->p_sigacts->ps_sigignore, sig) || 484 SIGISMEMBER(td->td_sigmask, sig)) { 485 /* Only allow them in write()/ioctl(). */ 486 PROC_UNLOCK(p); 487 PGRP_UNLOCK(pg); 488 return (sig == SIGTTOU ? 0 : EIO); 489 } 490 491 if ((p->p_flag & P_PPWAIT) != 0 || 492 (pg->pg_flags & PGRP_ORPHANED) != 0) { 493 /* Don't allow the action to happen. */ 494 PROC_UNLOCK(p); 495 PGRP_UNLOCK(pg); 496 return (EXTERROR(EIO, "cannot wait in background")); 497 } 498 PROC_UNLOCK(p); 499 500 /* 501 * Send the signal and sleep until we're the new 502 * foreground process group. 503 */ 504 if (sig != 0) { 505 ksiginfo_init(&ksi); 506 ksi.ksi_code = SI_KERNEL; 507 ksi.ksi_signo = sig; 508 sig = 0; 509 } 510 511 pgsignal(pg, ksi.ksi_signo, 1, &ksi); 512 PGRP_UNLOCK(pg); 513 514 error = tty_wait_proctree(tp, &tp->t_bgwait, proctree_lock_mode); 515 if (error != 0) 516 return (error); 517 } 518 } 519 520 static int 521 ttydev_read(struct cdev *dev, struct uio *uio, int ioflag) 522 { 523 struct tty *tp = dev->si_drv1; 524 int error; 525 526 error = ttydev_enter(tp); 527 if (error) 528 goto done; 529 error = ttydisc_read(tp, uio, ioflag); 530 tty_unlock(tp); 531 532 /* 533 * The read() call should not throw an error when the device is 534 * being destroyed. Silently convert it to an EOF. 535 */ 536 done: if (error == ENXIO) 537 error = 0; 538 return (error); 539 } 540 541 static int 542 ttydev_write(struct cdev *dev, struct uio *uio, int ioflag) 543 { 544 struct tty *tp = dev->si_drv1; 545 int defer, error; 546 547 error = ttydev_enter(tp); 548 if (error) 549 return (error); 550 551 if (tp->t_termios.c_lflag & TOSTOP) { 552 error = tty_wait_background(tp, curthread, SIGTTOU, 553 LA_UNLOCKED); 554 if (error) 555 goto done; 556 } 557 558 if (ioflag & IO_NDELAY && tp->t_flags & TF_BUSY_OUT) { 559 /* Allow non-blocking writes to bypass serialization. */ 560 error = ttydisc_write(tp, uio, ioflag); 561 } else { 562 /* Serialize write() calls. */ 563 while (tp->t_flags & TF_BUSY_OUT) { 564 error = tty_wait(tp, &tp->t_outserwait); 565 if (error) 566 goto done; 567 } 568 569 tp->t_flags |= TF_BUSY_OUT; 570 defer = sigdeferstop(SIGDEFERSTOP_ERESTART); 571 error = ttydisc_write(tp, uio, ioflag); 572 sigallowstop(defer); 573 tp->t_flags &= ~TF_BUSY_OUT; 574 cv_signal(&tp->t_outserwait); 575 } 576 577 done: tty_unlock(tp); 578 return (error); 579 } 580 581 static int 582 tty_ioctl_cnotty(struct tty *tp, struct thread *td) 583 { 584 struct session *session; 585 struct vnode *vp; 586 struct proc *p; 587 int error; 588 589 p = td->td_proc; 590 error = 0; 591 592 sx_xlock(&proctree_lock); 593 error = ttydev_enter(tp); 594 if (error != 0) 595 goto out_unlock2; 596 597 /* 598 * If the session doesn't have a controlling TTY, or if we weren't 599 * invoked on the controlling TTY, we'll return ENOTTY as we've 600 * historically done. 601 */ 602 session = p->p_session; 603 if (session->s_ttyp == NULL || session->s_ttyp != tp) { 604 error = EXTERROR(ENOTTY, "no controlling tty"); 605 goto out_unlock1; 606 } 607 608 if (!SESS_LEADER(p)) { 609 error = EXTERROR(EPERM, "not a session leader"); 610 goto out_unlock1; 611 } 612 613 PROC_LOCK(p); 614 SESS_LOCK(session); 615 vp = session->s_ttyvp; 616 session->s_ttyp = NULL; 617 session->s_ttyvp = NULL; 618 session->s_ttydp = NULL; 619 SESS_UNLOCK(session); 620 621 if (tp->t_session == session) { 622 tp->t_session = NULL; 623 tp->t_pgrp = NULL; 624 } 625 tp->t_sessioncnt--; 626 p->p_flag &= ~P_CONTROLT; 627 PROC_UNLOCK(p); 628 sx_xunlock(&proctree_lock); 629 630 /* 631 * If we did have a vnode, release our reference. Ordinarily 632 * we manage these at the devfs layer, but we can't 633 * necessarily know that we were invoked on the vnode 634 * referenced in the session (i.e. the vnode we hold a 635 * reference to). We explicitly don't check VBAD/VIRF_DOOMED 636 * here to avoid a vnode leak -- in circumstances elsewhere 637 * where we'd hit a VIRF_DOOMED vnode, release has been 638 * deferred until the controlling TTY is either changed or 639 * released. 640 */ 641 if (vp != NULL) 642 devfs_ctty_unref(vp); 643 644 tty_unlock(tp); 645 return (error); 646 647 out_unlock1: 648 tty_unlock(tp); 649 out_unlock2: 650 sx_xunlock(&proctree_lock); 651 return (error); 652 } 653 654 static int 655 ttydev_ioctl_sctty(struct tty *tp, caddr_t data, struct thread *td) 656 { 657 struct proc *p; 658 int error; 659 660 p = td->td_proc; 661 error = 0; 662 663 error = ttydev_enter(tp); 664 if (error != 0) 665 return (error); 666 667 error = tty_wait_background(tp, td, SIGTTOU, LA_XLOCKED); 668 if (error != 0) 669 goto out; 670 671 if (!SESS_LEADER(p)) { 672 /* Only the session leader may do this. */ 673 error = EXTERROR(EPERM, "not a session leader"); 674 goto out; 675 } 676 677 if (tp->t_session != NULL && tp->t_session == p->p_session) { 678 /* This is already our controlling TTY. */ 679 goto out; 680 } 681 682 if (p->p_session->s_ttyp != NULL || 683 (tp->t_session != NULL && tp->t_session->s_ttyvp != NULL && 684 tp->t_session->s_ttyvp->v_type != VBAD)) { 685 /* 686 * There is already a relation between a TTY and 687 * a session, or the caller is not the session 688 * leader. 689 * 690 * Allow the TTY to be stolen when the vnode is 691 * invalid, but the reference to the TTY is 692 * still active. This allows immediate reuse of 693 * TTYs of which the session leader has been 694 * killed or the TTY revoked. 695 */ 696 error = EXTERROR(EPERM, "session already has CTTY"); 697 goto out; 698 } 699 700 /* Connect the session to the TTY. */ 701 tp->t_session = p->p_session; 702 tp->t_session->s_ttyp = tp; 703 tp->t_sessioncnt++; 704 705 /* Assign foreground process group. */ 706 tp->t_pgrp = p->p_pgrp; 707 PROC_LOCK(p); 708 p->p_flag |= P_CONTROLT; 709 PROC_UNLOCK(p); 710 out: 711 tty_unlock(tp); 712 return (error); 713 } 714 715 static int 716 ttydev_ioctl_spgrp(struct tty *tp, caddr_t data, struct thread *td) 717 { 718 struct pgrp *pg; 719 int error; 720 721 error = ttydev_enter(tp); 722 if (error != 0) 723 return (error); 724 725 error = tty_wait_background(tp, td, SIGTTOU, LA_SLOCKED); 726 if (error != 0) 727 goto out; 728 729 pg = pgfind(*(int *)data); 730 if (pg != NULL) 731 PGRP_UNLOCK(pg); 732 if (pg == NULL || pg->pg_session != td->td_proc->p_session) { 733 error = EXTERROR(EPERM, 734 "pgrp %jd belongs to other session %jd", 735 pg != NULL ? pg->pg_id : -1, 736 td->td_proc->p_session->s_sid); 737 goto out; 738 } 739 740 /* 741 * Determine if this TTY is the controlling TTY. 742 */ 743 if (!tty_is_ctty(tp, td->td_proc)) { 744 error = EXTERROR(ENOTTY, "not a controlling tty"); 745 goto out; 746 } 747 tp->t_pgrp = pg; 748 749 /* Wake up the background process groups. */ 750 cv_broadcast(&tp->t_bgwait); 751 out: 752 tty_unlock(tp); 753 return (error); 754 } 755 756 int 757 ttydev_ioctl_proctree(struct tty *tp, u_long cmd, caddr_t data, 758 struct thread *td) 759 { 760 int error; 761 762 switch (cmd) { 763 case TIOCNOTTY: 764 error = tty_ioctl_cnotty(tp, td); 765 break; 766 case TIOCSCTTY: 767 sx_xlock(&proctree_lock); 768 error = ttydev_ioctl_sctty(tp, data, td); 769 sx_xunlock(&proctree_lock); 770 break; 771 case TIOCSPGRP: 772 sx_slock(&proctree_lock); 773 error = ttydev_ioctl_spgrp(tp, data, td); 774 sx_sunlock(&proctree_lock); 775 break; 776 default: 777 __unreachable(); 778 } 779 return (error); 780 } 781 782 static int 783 ttydev_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag, 784 struct thread *td) 785 { 786 struct tty *tp = dev->si_drv1; 787 int error; 788 789 if (cmd == TIOCNOTTY || cmd == TIOCSCTTY || cmd == TIOCSPGRP) 790 return (ttydev_ioctl_proctree(tp, cmd, data, td)); 791 792 error = ttydev_enter(tp); 793 if (error) 794 return (error); 795 796 switch (cmd) { 797 case TIOCCBRK: 798 case TIOCCONS: 799 case TIOCDRAIN: 800 case TIOCEXCL: 801 case TIOCFLUSH: 802 case TIOCNXCL: 803 case TIOCSBRK: 804 case TIOCSETA: 805 case TIOCSETAF: 806 case TIOCSETAW: 807 case TIOCSTART: 808 case TIOCSTAT: 809 case TIOCSTI: 810 case TIOCSTOP: 811 case TIOCSWINSZ: 812 #if 0 813 case TIOCSDRAINWAIT: 814 case TIOCSETD: 815 #endif 816 #ifdef COMPAT_43TTY 817 case TIOCLBIC: 818 case TIOCLBIS: 819 case TIOCLSET: 820 case TIOCSETC: 821 case OTIOCSETD: 822 case TIOCSETN: 823 case TIOCSETP: 824 case TIOCSLTC: 825 #endif /* COMPAT_43TTY */ 826 /* 827 * If the ioctl() causes the TTY to be modified, let it 828 * wait in the background. 829 */ 830 error = tty_wait_background(tp, curthread, SIGTTOU, 831 LA_UNLOCKED); 832 if (error) 833 goto done; 834 } 835 836 if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) { 837 struct termios *old = &tp->t_termios; 838 struct termios *new = (struct termios *)data; 839 struct termios *lock = TTY_CALLOUT(tp, dev) ? 840 &tp->t_termios_lock_out : &tp->t_termios_lock_in; 841 int cc; 842 843 /* 844 * Lock state devices. Just overwrite the values of the 845 * commands that are currently in use. 846 */ 847 new->c_iflag = (old->c_iflag & lock->c_iflag) | 848 (new->c_iflag & ~lock->c_iflag); 849 new->c_oflag = (old->c_oflag & lock->c_oflag) | 850 (new->c_oflag & ~lock->c_oflag); 851 new->c_cflag = (old->c_cflag & lock->c_cflag) | 852 (new->c_cflag & ~lock->c_cflag); 853 new->c_lflag = (old->c_lflag & lock->c_lflag) | 854 (new->c_lflag & ~lock->c_lflag); 855 for (cc = 0; cc < NCCS; ++cc) 856 if (lock->c_cc[cc]) 857 new->c_cc[cc] = old->c_cc[cc]; 858 if (lock->c_ispeed) 859 new->c_ispeed = old->c_ispeed; 860 if (lock->c_ospeed) 861 new->c_ospeed = old->c_ospeed; 862 } 863 864 error = tty_ioctl(tp, cmd, data, fflag, td); 865 done: tty_unlock(tp); 866 867 return (error); 868 } 869 870 static int 871 ttydev_poll(struct cdev *dev, int events, struct thread *td) 872 { 873 struct tty *tp = dev->si_drv1; 874 int error, revents = 0; 875 876 error = ttydev_enter(tp); 877 if (error) 878 return ((events & (POLLIN|POLLRDNORM)) | POLLHUP); 879 880 if (events & (POLLIN|POLLRDNORM)) { 881 /* See if we can read something. */ 882 if (ttydisc_read_poll(tp) > 0) 883 revents |= events & (POLLIN|POLLRDNORM); 884 } 885 886 if (tp->t_flags & TF_ZOMBIE) { 887 /* Hangup flag on zombie state. */ 888 revents |= POLLHUP; 889 } else if (events & (POLLOUT|POLLWRNORM)) { 890 /* See if we can write something. */ 891 if (ttydisc_write_poll(tp) > 0) 892 revents |= events & (POLLOUT|POLLWRNORM); 893 } 894 895 if (revents == 0) { 896 if (events & (POLLIN|POLLRDNORM)) 897 selrecord(td, &tp->t_inpoll); 898 if (events & (POLLOUT|POLLWRNORM)) 899 selrecord(td, &tp->t_outpoll); 900 } 901 902 tty_unlock(tp); 903 904 return (revents); 905 } 906 907 static int 908 ttydev_mmap(struct cdev *dev, vm_ooffset_t offset, vm_paddr_t *paddr, 909 int nprot, vm_memattr_t *memattr) 910 { 911 struct tty *tp = dev->si_drv1; 912 int error; 913 914 /* Handle mmap() through the driver. */ 915 916 error = ttydev_enter(tp); 917 if (error) 918 return (-1); 919 error = ttydevsw_mmap(tp, offset, paddr, nprot, memattr); 920 tty_unlock(tp); 921 922 return (error); 923 } 924 925 /* 926 * kqueue support. 927 */ 928 929 static void 930 tty_kqops_read_detach(struct knote *kn) 931 { 932 struct tty *tp = kn->kn_hook; 933 934 knlist_remove(&tp->t_inpoll.si_note, kn, 0); 935 } 936 937 static int 938 tty_kqops_read_event(struct knote *kn, long hint __unused) 939 { 940 struct tty *tp = kn->kn_hook; 941 942 tty_assert_locked(tp); 943 944 if (tty_gone(tp) || tp->t_flags & TF_ZOMBIE) { 945 kn->kn_flags |= EV_EOF; 946 return (1); 947 } else { 948 kn->kn_data = ttydisc_read_poll(tp); 949 return (kn->kn_data > 0); 950 } 951 } 952 953 static void 954 tty_kqops_write_detach(struct knote *kn) 955 { 956 struct tty *tp = kn->kn_hook; 957 958 knlist_remove(&tp->t_outpoll.si_note, kn, 0); 959 } 960 961 static int 962 tty_kqops_write_event(struct knote *kn, long hint __unused) 963 { 964 struct tty *tp = kn->kn_hook; 965 966 tty_assert_locked(tp); 967 968 if (tty_gone(tp)) { 969 kn->kn_flags |= EV_EOF; 970 return (1); 971 } else { 972 kn->kn_data = ttydisc_write_poll(tp); 973 return (kn->kn_data > 0); 974 } 975 } 976 977 static const struct filterops tty_kqops_read = { 978 .f_isfd = 1, 979 .f_detach = tty_kqops_read_detach, 980 .f_event = tty_kqops_read_event, 981 .f_copy = knote_triv_copy, 982 }; 983 984 static const struct filterops tty_kqops_write = { 985 .f_isfd = 1, 986 .f_detach = tty_kqops_write_detach, 987 .f_event = tty_kqops_write_event, 988 .f_copy = knote_triv_copy, 989 }; 990 991 static int 992 ttydev_kqfilter(struct cdev *dev, struct knote *kn) 993 { 994 struct tty *tp = dev->si_drv1; 995 int error; 996 997 error = ttydev_enter(tp); 998 if (error) 999 return (error); 1000 1001 switch (kn->kn_filter) { 1002 case EVFILT_READ: 1003 kn->kn_hook = tp; 1004 kn->kn_fop = &tty_kqops_read; 1005 knlist_add(&tp->t_inpoll.si_note, kn, 1); 1006 break; 1007 case EVFILT_WRITE: 1008 kn->kn_hook = tp; 1009 kn->kn_fop = &tty_kqops_write; 1010 knlist_add(&tp->t_outpoll.si_note, kn, 1); 1011 break; 1012 default: 1013 error = EINVAL; 1014 break; 1015 } 1016 1017 tty_unlock(tp); 1018 return (error); 1019 } 1020 1021 static struct cdevsw ttydev_cdevsw = { 1022 .d_version = D_VERSION, 1023 .d_open = ttydev_open, 1024 .d_close = ttydev_close, 1025 .d_read = ttydev_read, 1026 .d_write = ttydev_write, 1027 .d_ioctl = ttydev_ioctl, 1028 .d_kqfilter = ttydev_kqfilter, 1029 .d_poll = ttydev_poll, 1030 .d_mmap = ttydev_mmap, 1031 .d_name = "ttydev", 1032 .d_flags = D_TTY, 1033 }; 1034 1035 /* 1036 * Init/lock-state devices 1037 */ 1038 1039 static int 1040 ttyil_open(struct cdev *dev, int oflags __unused, int devtype __unused, 1041 struct thread *td) 1042 { 1043 struct tty *tp; 1044 int error; 1045 1046 tp = dev->si_drv1; 1047 error = 0; 1048 tty_lock(tp); 1049 if (tty_gone(tp)) 1050 error = ENODEV; 1051 tty_unlock(tp); 1052 1053 return (error); 1054 } 1055 1056 static int 1057 ttyil_close(struct cdev *dev __unused, int flag __unused, int mode __unused, 1058 struct thread *td __unused) 1059 { 1060 1061 return (0); 1062 } 1063 1064 static int 1065 ttyil_rdwr(struct cdev *dev __unused, struct uio *uio __unused, 1066 int ioflag __unused) 1067 { 1068 1069 return (ENODEV); 1070 } 1071 1072 static int 1073 ttyil_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag, 1074 struct thread *td) 1075 { 1076 struct tty *tp = dev->si_drv1; 1077 int error; 1078 1079 tty_lock(tp); 1080 if (tty_gone(tp)) { 1081 error = (EXTERROR(ENODEV, "ttyil_ioctl: device is gone")); 1082 goto done; 1083 } 1084 1085 error = ttydevsw_cioctl(tp, dev2unit(dev), cmd, data, td); 1086 if (error != ENOIOCTL) 1087 goto done; 1088 error = 0; 1089 1090 switch (cmd) { 1091 case TIOCGETA: 1092 /* Obtain terminal flags through tcgetattr(). */ 1093 *(struct termios*)data = *(struct termios*)dev->si_drv2; 1094 break; 1095 case TIOCSETA: 1096 /* Set terminal flags through tcsetattr(). */ 1097 error = priv_check(td, PRIV_TTY_SETA); 1098 if (error) 1099 break; 1100 *(struct termios*)dev->si_drv2 = *(struct termios*)data; 1101 break; 1102 case TIOCGETD: 1103 *(int *)data = TTYDISC; 1104 break; 1105 case TIOCGWINSZ: 1106 bzero(data, sizeof(struct winsize)); 1107 break; 1108 default: 1109 error = ENOTTY; 1110 } 1111 1112 done: tty_unlock(tp); 1113 return (error); 1114 } 1115 1116 static struct cdevsw ttyil_cdevsw = { 1117 .d_version = D_VERSION, 1118 .d_open = ttyil_open, 1119 .d_close = ttyil_close, 1120 .d_read = ttyil_rdwr, 1121 .d_write = ttyil_rdwr, 1122 .d_ioctl = ttyil_ioctl, 1123 .d_name = "ttyil", 1124 .d_flags = D_TTY, 1125 }; 1126 1127 static void 1128 tty_init_termios(struct tty *tp) 1129 { 1130 struct termios *t = &tp->t_termios_init_in; 1131 1132 t->c_cflag = TTYDEF_CFLAG; 1133 t->c_iflag = TTYDEF_IFLAG; 1134 t->c_lflag = TTYDEF_LFLAG; 1135 t->c_oflag = TTYDEF_OFLAG; 1136 t->c_ispeed = TTYDEF_SPEED; 1137 t->c_ospeed = TTYDEF_SPEED; 1138 memcpy(&t->c_cc, ttydefchars, sizeof ttydefchars); 1139 1140 tp->t_termios_init_out = *t; 1141 } 1142 1143 void 1144 tty_init_console(struct tty *tp, speed_t s) 1145 { 1146 struct termios *ti = &tp->t_termios_init_in; 1147 struct termios *to = &tp->t_termios_init_out; 1148 1149 if (s != 0) { 1150 ti->c_ispeed = ti->c_ospeed = s; 1151 to->c_ispeed = to->c_ospeed = s; 1152 } 1153 1154 ti->c_cflag |= CLOCAL; 1155 to->c_cflag |= CLOCAL; 1156 } 1157 1158 /* 1159 * Standard device routine implementations, mostly meant for 1160 * pseudo-terminal device drivers. When a driver creates a new terminal 1161 * device class, missing routines are patched. 1162 */ 1163 1164 static int 1165 ttydevsw_defopen(struct tty *tp __unused) 1166 { 1167 1168 return (0); 1169 } 1170 1171 static void 1172 ttydevsw_defclose(struct tty *tp __unused) 1173 { 1174 1175 } 1176 1177 static void 1178 ttydevsw_defoutwakeup(struct tty *tp __unused) 1179 { 1180 1181 panic("Terminal device has output, while not implemented"); 1182 } 1183 1184 static void 1185 ttydevsw_definwakeup(struct tty *tp __unused) 1186 { 1187 1188 } 1189 1190 static int 1191 ttydevsw_defioctl(struct tty *tp __unused, u_long cmd __unused, 1192 caddr_t data __unused, struct thread *td __unused) 1193 { 1194 1195 return (ENOIOCTL); 1196 } 1197 1198 static int 1199 ttydevsw_defcioctl(struct tty *tp __unused, int unit __unused, 1200 u_long cmd __unused, caddr_t data __unused, struct thread *td __unused) 1201 { 1202 1203 return (ENOIOCTL); 1204 } 1205 1206 static int 1207 ttydevsw_defparam(struct tty *tp __unused, struct termios *t) 1208 { 1209 1210 /* 1211 * Allow the baud rate to be adjusted for pseudo-devices, but at 1212 * least restrict it to 115200 to prevent excessive buffer 1213 * usage. Also disallow 0, to prevent foot shooting. 1214 */ 1215 if (t->c_ispeed < B50) 1216 t->c_ispeed = B50; 1217 else if (t->c_ispeed > B115200) 1218 t->c_ispeed = B115200; 1219 if (t->c_ospeed < B50) 1220 t->c_ospeed = B50; 1221 else if (t->c_ospeed > B115200) 1222 t->c_ospeed = B115200; 1223 t->c_cflag |= CREAD; 1224 1225 return (0); 1226 } 1227 1228 static int 1229 ttydevsw_defmodem(struct tty *tp __unused, int sigon __unused, 1230 int sigoff __unused) 1231 { 1232 1233 /* Simulate a carrier to make the TTY layer happy. */ 1234 return (SER_DCD); 1235 } 1236 1237 static int 1238 ttydevsw_defmmap(struct tty *tp __unused, vm_ooffset_t offset __unused, 1239 vm_paddr_t *paddr __unused, int nprot __unused, 1240 vm_memattr_t *memattr __unused) 1241 { 1242 1243 return (-1); 1244 } 1245 1246 static void 1247 ttydevsw_defpktnotify(struct tty *tp __unused, char event __unused) 1248 { 1249 1250 } 1251 1252 static void 1253 ttydevsw_deffree(void *softc __unused) 1254 { 1255 1256 panic("Terminal device freed without a free-handler"); 1257 } 1258 1259 static bool 1260 ttydevsw_defbusy(struct tty *tp __unused) 1261 { 1262 1263 return (false); 1264 } 1265 1266 /* 1267 * TTY allocation and deallocation. TTY devices can be deallocated when 1268 * the driver doesn't use it anymore, when the TTY isn't a session's 1269 * controlling TTY and when the device node isn't opened through devfs. 1270 */ 1271 1272 struct tty * 1273 tty_alloc(struct ttydevsw *tsw, void *sc) 1274 { 1275 1276 return (tty_alloc_mutex(tsw, sc, NULL)); 1277 } 1278 1279 struct tty * 1280 tty_alloc_mutex(struct ttydevsw *tsw, void *sc, struct mtx *mutex) 1281 { 1282 struct tty *tp; 1283 1284 /* Make sure the driver defines all routines. */ 1285 #define PATCH_FUNC(x) do { \ 1286 if (tsw->tsw_ ## x == NULL) \ 1287 tsw->tsw_ ## x = ttydevsw_def ## x; \ 1288 } while (0) 1289 PATCH_FUNC(open); 1290 PATCH_FUNC(close); 1291 PATCH_FUNC(outwakeup); 1292 PATCH_FUNC(inwakeup); 1293 PATCH_FUNC(ioctl); 1294 PATCH_FUNC(cioctl); 1295 PATCH_FUNC(param); 1296 PATCH_FUNC(modem); 1297 PATCH_FUNC(mmap); 1298 PATCH_FUNC(pktnotify); 1299 PATCH_FUNC(free); 1300 PATCH_FUNC(busy); 1301 #undef PATCH_FUNC 1302 1303 tp = malloc(sizeof(struct tty) + TTY_PRBUF_SIZE, M_TTY, 1304 M_WAITOK | M_ZERO); 1305 tp->t_prbufsz = TTY_PRBUF_SIZE; 1306 tp->t_devsw = tsw; 1307 tp->t_devswsoftc = sc; 1308 tp->t_flags = tsw->tsw_flags; 1309 tp->t_drainwait = tty_drainwait; 1310 1311 tty_init_termios(tp); 1312 1313 cv_init(&tp->t_inwait, "ttyin"); 1314 cv_init(&tp->t_outwait, "ttyout"); 1315 cv_init(&tp->t_outserwait, "ttyosr"); 1316 cv_init(&tp->t_bgwait, "ttybg"); 1317 cv_init(&tp->t_dcdwait, "ttydcd"); 1318 1319 /* Allow drivers to use a custom mutex to lock the TTY. */ 1320 if (mutex != NULL) { 1321 tp->t_mtx = mutex; 1322 } else { 1323 tp->t_mtx = &tp->t_mtxobj; 1324 mtx_init(&tp->t_mtxobj, "ttymtx", NULL, MTX_DEF); 1325 } 1326 1327 knlist_init_mtx(&tp->t_inpoll.si_note, tp->t_mtx); 1328 knlist_init_mtx(&tp->t_outpoll.si_note, tp->t_mtx); 1329 1330 return (tp); 1331 } 1332 1333 static void 1334 tty_dealloc(void *arg) 1335 { 1336 struct tty *tp = arg; 1337 1338 /* 1339 * ttyydev_leave() usually frees the i/o queues earlier, but it is 1340 * not always called between queue allocation and here. The queues 1341 * may be allocated by ioctls on a pty control device without the 1342 * corresponding pty slave device ever being open, or after it is 1343 * closed. 1344 */ 1345 ttyinq_free(&tp->t_inq); 1346 ttyoutq_free(&tp->t_outq); 1347 seldrain(&tp->t_inpoll); 1348 seldrain(&tp->t_outpoll); 1349 knlist_clear(&tp->t_inpoll.si_note, 0); 1350 knlist_clear(&tp->t_outpoll.si_note, 0); 1351 knlist_destroy(&tp->t_inpoll.si_note); 1352 knlist_destroy(&tp->t_outpoll.si_note); 1353 1354 cv_destroy(&tp->t_inwait); 1355 cv_destroy(&tp->t_outwait); 1356 cv_destroy(&tp->t_bgwait); 1357 cv_destroy(&tp->t_dcdwait); 1358 cv_destroy(&tp->t_outserwait); 1359 1360 if (tp->t_mtx == &tp->t_mtxobj) 1361 mtx_destroy(&tp->t_mtxobj); 1362 ttydevsw_free(tp); 1363 free(tp, M_TTY); 1364 } 1365 1366 static void 1367 tty_rel_free(struct tty *tp, bool inttydevclose) 1368 { 1369 struct cdev *dev; 1370 1371 tty_assert_locked(tp); 1372 1373 #define TF_ACTIVITY (TF_GONE|TF_OPENED|TF_HOOK|TF_OPENCLOSE) 1374 if (tp->t_sessioncnt != 0 || (tp->t_flags & TF_ACTIVITY) != TF_GONE) { 1375 /* TTY is still in use. */ 1376 if (inttydevclose) 1377 tp->t_flags &= ~TF_INDEVCLOSE; 1378 tty_unlock(tp); 1379 return; 1380 } 1381 1382 /* Stop asynchronous I/O. */ 1383 funsetown(&tp->t_sigio); 1384 1385 /* TTY can be deallocated. */ 1386 dev = tp->t_dev; 1387 tp->t_dev = NULL; 1388 if (inttydevclose) 1389 tp->t_flags &= ~TF_INDEVCLOSE; 1390 tty_unlock(tp); 1391 1392 if (dev != NULL) { 1393 sx_xlock(&tty_list_sx); 1394 TAILQ_REMOVE(&tty_list, tp, t_list); 1395 tty_list_count--; 1396 sx_xunlock(&tty_list_sx); 1397 destroy_dev_sched_cb(dev, tty_dealloc, tp); 1398 } 1399 } 1400 1401 void 1402 tty_rel_pgrp(struct tty *tp, struct pgrp *pg) 1403 { 1404 1405 MPASS(tp->t_sessioncnt > 0); 1406 tty_assert_locked(tp); 1407 1408 if (tp->t_pgrp == pg) 1409 tp->t_pgrp = NULL; 1410 1411 tty_unlock(tp); 1412 } 1413 1414 void 1415 tty_rel_sess(struct tty *tp, struct session *sess) 1416 { 1417 1418 MPASS(tp->t_sessioncnt > 0); 1419 1420 /* Current session has left. */ 1421 if (tp->t_session == sess) { 1422 tp->t_session = NULL; 1423 MPASS(tp->t_pgrp == NULL); 1424 } 1425 tp->t_sessioncnt--; 1426 tty_rel_free(tp, false); 1427 } 1428 1429 void 1430 tty_rel_gone(struct tty *tp) 1431 { 1432 1433 tty_assert_locked(tp); 1434 MPASS(!tty_gone(tp)); 1435 1436 /* Simulate carrier removal. */ 1437 ttydisc_modem(tp, 0); 1438 1439 /* Wake up all blocked threads. */ 1440 tty_wakeup(tp, FREAD|FWRITE); 1441 cv_broadcast(&tp->t_bgwait); 1442 cv_broadcast(&tp->t_dcdwait); 1443 1444 tp->t_flags |= TF_GONE; 1445 tty_rel_free(tp, false); 1446 } 1447 1448 /* 1449 * Exposing information about current TTY's through sysctl 1450 */ 1451 1452 static void 1453 tty_to_xtty(struct tty *tp, struct xtty *xt) 1454 { 1455 1456 tty_assert_locked(tp); 1457 1458 memset(xt, 0, sizeof(*xt)); 1459 xt->xt_size = sizeof(struct xtty); 1460 xt->xt_insize = ttyinq_getsize(&tp->t_inq); 1461 xt->xt_incc = ttyinq_bytescanonicalized(&tp->t_inq); 1462 xt->xt_inlc = ttyinq_bytesline(&tp->t_inq); 1463 xt->xt_inlow = tp->t_inlow; 1464 xt->xt_outsize = ttyoutq_getsize(&tp->t_outq); 1465 xt->xt_outcc = ttyoutq_bytesused(&tp->t_outq); 1466 xt->xt_outlow = tp->t_outlow; 1467 xt->xt_column = tp->t_column; 1468 xt->xt_pgid = tp->t_pgrp ? tp->t_pgrp->pg_id : 0; 1469 xt->xt_sid = tp->t_session ? tp->t_session->s_sid : 0; 1470 xt->xt_flags = tp->t_flags; 1471 xt->xt_dev = tp->t_dev ? dev2udev(tp->t_dev) : (uint32_t)NODEV; 1472 } 1473 1474 static int 1475 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS) 1476 { 1477 unsigned long lsize; 1478 struct thread *td = curthread; 1479 struct xtty *xtlist, *xt; 1480 struct tty *tp; 1481 struct proc *p; 1482 int error; 1483 bool cansee; 1484 1485 sx_slock(&tty_list_sx); 1486 lsize = tty_list_count * sizeof(struct xtty); 1487 if (lsize == 0) { 1488 sx_sunlock(&tty_list_sx); 1489 return (0); 1490 } 1491 1492 xtlist = xt = malloc(lsize, M_TTY, M_WAITOK); 1493 1494 TAILQ_FOREACH(tp, &tty_list, t_list) { 1495 tty_lock(tp); 1496 if (tp->t_session != NULL && 1497 (p = atomic_load_ptr(&tp->t_session->s_leader)) != NULL) { 1498 PROC_LOCK(p); 1499 cansee = (p_cansee(td, p) == 0); 1500 PROC_UNLOCK(p); 1501 } else { 1502 cansee = !jailed(td->td_ucred); 1503 } 1504 if (cansee) { 1505 tty_to_xtty(tp, xt); 1506 xt++; 1507 } 1508 tty_unlock(tp); 1509 } 1510 sx_sunlock(&tty_list_sx); 1511 1512 lsize = (xt - xtlist) * sizeof(struct xtty); 1513 if (lsize > 0) { 1514 error = SYSCTL_OUT(req, xtlist, lsize); 1515 } else { 1516 error = 0; 1517 } 1518 free(xtlist, M_TTY); 1519 return (error); 1520 } 1521 1522 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD|CTLFLAG_MPSAFE, 1523 0, 0, sysctl_kern_ttys, "S,xtty", "List of TTYs"); 1524 1525 /* 1526 * Device node creation. Device has been set up, now we can expose it to 1527 * the user. 1528 */ 1529 1530 int 1531 tty_makedevf(struct tty *tp, struct ucred *cred, int flags, 1532 const char *fmt, ...) 1533 { 1534 va_list ap; 1535 struct make_dev_args args; 1536 struct cdev *dev, *init, *lock, *cua, *cinit, *clock; 1537 const char *prefix = "tty"; 1538 char name[SPECNAMELEN - 3]; /* for "tty" and "cua". */ 1539 uid_t uid; 1540 gid_t gid; 1541 mode_t mode; 1542 int error; 1543 1544 /* Remove "tty" prefix from devices like PTY's. */ 1545 if (tp->t_flags & TF_NOPREFIX) 1546 prefix = ""; 1547 1548 va_start(ap, fmt); 1549 vsnrprintf(name, sizeof name, 32, fmt, ap); 1550 va_end(ap); 1551 1552 if (cred == NULL) { 1553 /* System device. */ 1554 uid = UID_ROOT; 1555 gid = GID_WHEEL; 1556 mode = S_IRUSR|S_IWUSR; 1557 } else { 1558 /* User device. */ 1559 uid = cred->cr_ruid; 1560 gid = GID_TTY; 1561 mode = S_IRUSR|S_IWUSR|S_IWGRP; 1562 } 1563 1564 flags = flags & TTYMK_CLONING ? MAKEDEV_REF : 0; 1565 flags |= MAKEDEV_CHECKNAME; 1566 1567 /* Master call-in device. */ 1568 make_dev_args_init(&args); 1569 args.mda_flags = flags; 1570 args.mda_devsw = &ttydev_cdevsw; 1571 args.mda_cr = cred; 1572 args.mda_uid = uid; 1573 args.mda_gid = gid; 1574 args.mda_mode = mode; 1575 args.mda_si_drv1 = tp; 1576 error = make_dev_s(&args, &dev, "%s%s", prefix, name); 1577 if (error != 0) 1578 return (error); 1579 tp->t_dev = dev; 1580 1581 init = lock = cua = cinit = clock = NULL; 1582 1583 /* Slave call-in devices. */ 1584 if (tp->t_flags & TF_INITLOCK) { 1585 args.mda_devsw = &ttyil_cdevsw; 1586 args.mda_unit = TTYUNIT_INIT; 1587 args.mda_si_drv1 = tp; 1588 args.mda_si_drv2 = &tp->t_termios_init_in; 1589 error = make_dev_s(&args, &init, "%s%s.init", prefix, name); 1590 if (error != 0) 1591 goto fail; 1592 dev_depends(dev, init); 1593 1594 args.mda_unit = TTYUNIT_LOCK; 1595 args.mda_si_drv2 = &tp->t_termios_lock_in; 1596 error = make_dev_s(&args, &lock, "%s%s.lock", prefix, name); 1597 if (error != 0) 1598 goto fail; 1599 dev_depends(dev, lock); 1600 } 1601 1602 /* Call-out devices. */ 1603 if (tp->t_flags & TF_CALLOUT) { 1604 make_dev_args_init(&args); 1605 args.mda_flags = flags; 1606 args.mda_devsw = &ttydev_cdevsw; 1607 args.mda_cr = cred; 1608 args.mda_uid = UID_UUCP; 1609 args.mda_gid = GID_DIALER; 1610 args.mda_mode = 0660; 1611 args.mda_unit = TTYUNIT_CALLOUT; 1612 args.mda_si_drv1 = tp; 1613 error = make_dev_s(&args, &cua, "cua%s", name); 1614 if (error != 0) 1615 goto fail; 1616 dev_depends(dev, cua); 1617 1618 /* Slave call-out devices. */ 1619 if (tp->t_flags & TF_INITLOCK) { 1620 args.mda_devsw = &ttyil_cdevsw; 1621 args.mda_unit = TTYUNIT_CALLOUT | TTYUNIT_INIT; 1622 args.mda_si_drv2 = &tp->t_termios_init_out; 1623 error = make_dev_s(&args, &cinit, "cua%s.init", name); 1624 if (error != 0) 1625 goto fail; 1626 dev_depends(dev, cinit); 1627 1628 args.mda_unit = TTYUNIT_CALLOUT | TTYUNIT_LOCK; 1629 args.mda_si_drv2 = &tp->t_termios_lock_out; 1630 error = make_dev_s(&args, &clock, "cua%s.lock", name); 1631 if (error != 0) 1632 goto fail; 1633 dev_depends(dev, clock); 1634 } 1635 } 1636 1637 sx_xlock(&tty_list_sx); 1638 TAILQ_INSERT_TAIL(&tty_list, tp, t_list); 1639 tty_list_count++; 1640 sx_xunlock(&tty_list_sx); 1641 1642 return (0); 1643 1644 fail: 1645 destroy_dev(dev); 1646 if (init) 1647 destroy_dev(init); 1648 if (lock) 1649 destroy_dev(lock); 1650 if (cinit) 1651 destroy_dev(cinit); 1652 if (clock) 1653 destroy_dev(clock); 1654 1655 return (error); 1656 } 1657 1658 /* 1659 * Signalling processes. 1660 */ 1661 1662 void 1663 tty_signal_sessleader(struct tty *tp, int sig) 1664 { 1665 struct proc *p; 1666 struct session *s; 1667 1668 tty_assert_locked(tp); 1669 MPASS(sig >= 1 && sig < NSIG); 1670 1671 /* Make signals start output again. */ 1672 tp->t_flags &= ~TF_STOPPED; 1673 tp->t_termios.c_lflag &= ~FLUSHO; 1674 1675 /* 1676 * Load s_leader exactly once to avoid race where s_leader is 1677 * set to NULL by a concurrent invocation of killjobc() by the 1678 * session leader. Note that we are not holding t_session's 1679 * lock for the read. 1680 */ 1681 if ((s = tp->t_session) != NULL && 1682 (p = atomic_load_ptr(&s->s_leader)) != NULL) { 1683 PROC_LOCK(p); 1684 kern_psignal(p, sig); 1685 PROC_UNLOCK(p); 1686 } 1687 } 1688 1689 void 1690 tty_signal_pgrp(struct tty *tp, int sig) 1691 { 1692 ksiginfo_t ksi; 1693 1694 tty_assert_locked(tp); 1695 MPASS(sig >= 1 && sig < NSIG); 1696 1697 /* Make signals start output again. */ 1698 tp->t_flags &= ~TF_STOPPED; 1699 tp->t_termios.c_lflag &= ~FLUSHO; 1700 1701 if (sig == SIGINFO && !(tp->t_termios.c_lflag & NOKERNINFO)) 1702 tty_info(tp); 1703 if (tp->t_pgrp != NULL) { 1704 ksiginfo_init(&ksi); 1705 ksi.ksi_signo = sig; 1706 ksi.ksi_code = SI_KERNEL; 1707 PGRP_LOCK(tp->t_pgrp); 1708 pgsignal(tp->t_pgrp, sig, 1, &ksi); 1709 PGRP_UNLOCK(tp->t_pgrp); 1710 } 1711 } 1712 1713 void 1714 tty_wakeup(struct tty *tp, int flags) 1715 { 1716 1717 if (tp->t_flags & TF_ASYNC && tp->t_sigio != NULL) 1718 pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL)); 1719 1720 if (flags & FWRITE) { 1721 cv_broadcast(&tp->t_outwait); 1722 selwakeup(&tp->t_outpoll); 1723 KNOTE_LOCKED(&tp->t_outpoll.si_note, 0); 1724 } 1725 if (flags & FREAD) { 1726 cv_broadcast(&tp->t_inwait); 1727 selwakeup(&tp->t_inpoll); 1728 KNOTE_LOCKED(&tp->t_inpoll.si_note, 0); 1729 } 1730 } 1731 1732 int 1733 tty_wait(struct tty *tp, struct cv *cv) 1734 { 1735 int error; 1736 int revokecnt = tp->t_revokecnt; 1737 1738 tty_lock_assert(tp, MA_OWNED|MA_NOTRECURSED); 1739 MPASS(!tty_gone(tp)); 1740 1741 error = cv_wait_sig(cv, tp->t_mtx); 1742 1743 /* Bail out when the device slipped away. */ 1744 if (tty_gone(tp)) 1745 return (EXTERROR(ENXIO, "tty_wait: device is gone")); 1746 1747 /* Restart the system call when we may have been revoked. */ 1748 if (tp->t_revokecnt != revokecnt) 1749 return (ERESTART); 1750 1751 return (error); 1752 } 1753 1754 static int 1755 tty_wait_proctree(struct tty *tp, struct cv *cv, int proctree_lock_mode) 1756 { 1757 int error; 1758 int revokecnt = tp->t_revokecnt; 1759 1760 tty_lock_assert(tp, MA_OWNED | MA_NOTRECURSED); 1761 MPASS(!tty_gone(tp)); 1762 MPASS(proctree_lock_mode == LA_UNLOCKED || 1763 proctree_lock_mode == LA_SLOCKED || 1764 proctree_lock_mode == LA_XLOCKED); 1765 1766 if (proctree_lock_mode != LA_UNLOCKED) 1767 sx_unlock(&proctree_lock); 1768 1769 error = cv_wait_sig_unlock(cv, tp->t_mtx); 1770 switch (proctree_lock_mode) { 1771 case LA_SLOCKED: 1772 sx_slock(&proctree_lock); 1773 break; 1774 case LA_XLOCKED: 1775 sx_xlock(&proctree_lock); 1776 break; 1777 } 1778 tty_lock(tp); 1779 1780 /* Bail out when the device slipped away. */ 1781 if (tty_gone(tp)) 1782 return (EXTERROR(ENXIO, "tty_wait_proctree: device is gone")); 1783 1784 /* Restart the system call when we may have been revoked. */ 1785 if (tp->t_revokecnt != revokecnt) 1786 return (ERESTART); 1787 1788 return (error); 1789 } 1790 1791 int 1792 tty_timedwait(struct tty *tp, struct cv *cv, int hz) 1793 { 1794 int error; 1795 int revokecnt = tp->t_revokecnt; 1796 1797 tty_lock_assert(tp, MA_OWNED|MA_NOTRECURSED); 1798 MPASS(!tty_gone(tp)); 1799 1800 error = cv_timedwait_sig(cv, tp->t_mtx, hz); 1801 1802 /* Bail out when the device slipped away. */ 1803 if (tty_gone(tp)) 1804 return (EXTERROR(ENXIO, "tty_timedwait: device is gone")); 1805 1806 /* Restart the system call when we may have been revoked. */ 1807 if (tp->t_revokecnt != revokecnt) 1808 return (ERESTART); 1809 1810 return (error); 1811 } 1812 1813 void 1814 tty_flush(struct tty *tp, int flags) 1815 { 1816 1817 if (flags & FWRITE) { 1818 tp->t_flags &= ~TF_HIWAT_OUT; 1819 ttyoutq_flush(&tp->t_outq); 1820 tty_wakeup(tp, FWRITE); 1821 if (!tty_gone(tp)) { 1822 ttydevsw_outwakeup(tp); 1823 ttydevsw_pktnotify(tp, TIOCPKT_FLUSHWRITE); 1824 } 1825 } 1826 if (flags & FREAD) { 1827 tty_hiwat_in_unblock(tp); 1828 ttyinq_flush(&tp->t_inq); 1829 tty_wakeup(tp, FREAD); 1830 if (!tty_gone(tp)) { 1831 ttydevsw_inwakeup(tp); 1832 ttydevsw_pktnotify(tp, TIOCPKT_FLUSHREAD); 1833 } 1834 } 1835 } 1836 1837 void 1838 tty_set_winsize(struct tty *tp, const struct winsize *wsz) 1839 { 1840 1841 if (memcmp(&tp->t_winsize, wsz, sizeof(*wsz)) == 0) 1842 return; 1843 tp->t_winsize = *wsz; 1844 tty_signal_pgrp(tp, SIGWINCH); 1845 } 1846 1847 static int 1848 tty_sti_check(struct tty *tp, int fflag, struct thread *td) 1849 { 1850 /* Check for global disable. */ 1851 if (!tty_tiocsti) 1852 return (EXTERROR(EPERM, "security.bsd.allow_tiocsti")); 1853 1854 /* Root can bypass all of our constraints. */ 1855 if (priv_check(td, PRIV_TTY_STI) == 0) 1856 return (0); 1857 1858 /* Unprivileged users must have it opened for read. */ 1859 if ((fflag & FREAD) == 0) 1860 return (EXTERROR(EPERM, "opened read-only")); 1861 1862 /* It must also be their controlling tty. */ 1863 if (!tty_is_ctty(tp, td->td_proc)) 1864 return (EXTERROR(EACCES, "not a controlling tty")); 1865 1866 return (0); 1867 } 1868 1869 static int 1870 tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, 1871 struct thread *td) 1872 { 1873 int error; 1874 1875 switch (cmd) { 1876 /* 1877 * Modem commands. 1878 * The SER_* and TIOCM_* flags are the same, but one bit 1879 * shifted. I don't know why. 1880 */ 1881 case TIOCSDTR: 1882 ttydevsw_modem(tp, SER_DTR, 0); 1883 return (0); 1884 case TIOCCDTR: 1885 ttydevsw_modem(tp, 0, SER_DTR); 1886 return (0); 1887 case TIOCMSET: { 1888 int bits = *(int *)data; 1889 ttydevsw_modem(tp, 1890 (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1, 1891 ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1); 1892 return (0); 1893 } 1894 case TIOCMBIS: { 1895 int bits = *(int *)data; 1896 ttydevsw_modem(tp, (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1, 0); 1897 return (0); 1898 } 1899 case TIOCMBIC: { 1900 int bits = *(int *)data; 1901 ttydevsw_modem(tp, 0, (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1); 1902 return (0); 1903 } 1904 case TIOCMGET: 1905 *(int *)data = TIOCM_LE + (ttydevsw_modem(tp, 0, 0) << 1); 1906 return (0); 1907 1908 case FIOASYNC: 1909 if (*(int *)data) 1910 tp->t_flags |= TF_ASYNC; 1911 else 1912 tp->t_flags &= ~TF_ASYNC; 1913 return (0); 1914 case FIONBIO: 1915 /* This device supports non-blocking operation. */ 1916 return (0); 1917 case FIONREAD: 1918 *(int *)data = ttydisc_bytesavail(tp); 1919 return (0); 1920 case FIONWRITE: 1921 case TIOCOUTQ: 1922 *(int *)data = ttyoutq_bytesused(&tp->t_outq); 1923 return (0); 1924 case FIOSETOWN: 1925 if (tp->t_session != NULL && !tty_is_ctty(tp, td->td_proc)) 1926 /* Not allowed to set ownership. */ 1927 return (ENOTTY); 1928 1929 /* Temporarily unlock the TTY to set ownership. */ 1930 tty_unlock(tp); 1931 error = fsetown(*(int *)data, &tp->t_sigio); 1932 tty_lock(tp); 1933 return (error); 1934 case FIOGETOWN: 1935 if (tp->t_session != NULL && !tty_is_ctty(tp, td->td_proc)) 1936 /* Not allowed to set ownership. */ 1937 return (ENOTTY); 1938 1939 /* Get ownership. */ 1940 *(int *)data = fgetown(&tp->t_sigio); 1941 return (0); 1942 case TIOCGETA: 1943 /* Obtain terminal flags through tcgetattr(). */ 1944 *(struct termios*)data = tp->t_termios; 1945 return (0); 1946 case TIOCSETA: 1947 case TIOCSETAW: 1948 case TIOCSETAF: { 1949 struct termios *t = data; 1950 bool canonicalize = false; 1951 1952 /* 1953 * Who makes up these funny rules? According to POSIX, 1954 * input baud rate is set equal to the output baud rate 1955 * when zero. 1956 */ 1957 if (t->c_ispeed == 0) 1958 t->c_ispeed = t->c_ospeed; 1959 1960 /* Discard any unsupported bits. */ 1961 t->c_iflag &= TTYSUP_IFLAG; 1962 t->c_oflag &= TTYSUP_OFLAG; 1963 t->c_lflag &= TTYSUP_LFLAG; 1964 t->c_cflag &= TTYSUP_CFLAG; 1965 1966 /* Set terminal flags through tcsetattr(). */ 1967 if (cmd == TIOCSETAW || cmd == TIOCSETAF) { 1968 error = tty_drain(tp, 0); 1969 if (error) 1970 return (error); 1971 if (cmd == TIOCSETAF) 1972 tty_flush(tp, FREAD); 1973 } 1974 1975 /* 1976 * Only call param() when the flags really change. 1977 */ 1978 if ((t->c_cflag & CIGNORE) == 0 && 1979 (tp->t_termios.c_cflag != t->c_cflag || 1980 ((tp->t_termios.c_iflag ^ t->c_iflag) & 1981 (IXON|IXOFF|IXANY)) || 1982 tp->t_termios.c_ispeed != t->c_ispeed || 1983 tp->t_termios.c_ospeed != t->c_ospeed)) { 1984 error = ttydevsw_param(tp, t); 1985 if (error) 1986 return (error); 1987 1988 /* XXX: CLOCAL? */ 1989 1990 tp->t_termios.c_cflag = t->c_cflag & ~CIGNORE; 1991 tp->t_termios.c_ispeed = t->c_ispeed; 1992 tp->t_termios.c_ospeed = t->c_ospeed; 1993 1994 /* Baud rate has changed - update watermarks. */ 1995 error = tty_watermarks(tp); 1996 if (error) 1997 return (error); 1998 } 1999 2000 /* 2001 * We'll canonicalize any partial input if we're transitioning 2002 * ICANON one way or the other. If we're going from -ICANON -> 2003 * ICANON, then in the worst case scenario we're in the middle 2004 * of a line but both ttydisc_read() and FIONREAD will search 2005 * for one of our line terminals. 2006 */ 2007 if ((t->c_lflag & ICANON) != (tp->t_termios.c_lflag & ICANON)) 2008 canonicalize = true; 2009 else if (tp->t_termios.c_cc[VEOF] != t->c_cc[VEOF] || 2010 tp->t_termios.c_cc[VEOL] != t->c_cc[VEOL]) 2011 canonicalize = true; 2012 2013 /* Copy new non-device driver parameters. */ 2014 tp->t_termios.c_iflag = t->c_iflag; 2015 tp->t_termios.c_oflag = t->c_oflag; 2016 tp->t_termios.c_lflag = t->c_lflag; 2017 memcpy(&tp->t_termios.c_cc, t->c_cc, sizeof t->c_cc); 2018 2019 ttydisc_optimize(tp); 2020 2021 if (canonicalize) 2022 ttydisc_canonicalize(tp); 2023 if ((t->c_lflag & ICANON) == 0) { 2024 /* 2025 * When in non-canonical mode, wake up all 2026 * readers. Any partial input has already been 2027 * canonicalized above if we were in canonical mode. 2028 * VMIN and VTIME could also be adjusted. 2029 */ 2030 tty_wakeup(tp, FREAD); 2031 } 2032 2033 /* 2034 * For packet mode: notify the PTY consumer that VSTOP 2035 * and VSTART may have been changed. 2036 */ 2037 if (tp->t_termios.c_iflag & IXON && 2038 tp->t_termios.c_cc[VSTOP] == CTRL('S') && 2039 tp->t_termios.c_cc[VSTART] == CTRL('Q')) 2040 ttydevsw_pktnotify(tp, TIOCPKT_DOSTOP); 2041 else 2042 ttydevsw_pktnotify(tp, TIOCPKT_NOSTOP); 2043 return (0); 2044 } 2045 case TIOCGETD: 2046 /* For compatibility - we only support TTYDISC. */ 2047 *(int *)data = TTYDISC; 2048 return (0); 2049 case TIOCGPGRP: 2050 if (!tty_is_ctty(tp, td->td_proc)) 2051 return (EXTERROR(ENOTTY, "not a controlling tty")); 2052 2053 if (tp->t_pgrp != NULL) 2054 *(int *)data = tp->t_pgrp->pg_id; 2055 else 2056 *(int *)data = NO_PID; 2057 return (0); 2058 case TIOCGSID: 2059 if (!tty_is_ctty(tp, td->td_proc)) 2060 return (EXTERROR(ENOTTY, "not a controlling tty")); 2061 2062 MPASS(tp->t_session); 2063 *(int *)data = tp->t_session->s_sid; 2064 return (0); 2065 case TIOCNOTTY: 2066 panic("TIOCNOTTY"); 2067 case TIOCSCTTY: 2068 panic("TIOCSCTTY"); 2069 case TIOCSPGRP: 2070 panic("TIOCSPGRP"); 2071 case TIOCFLUSH: { 2072 int flags = *(int *)data; 2073 2074 if (flags == 0) 2075 flags = (FREAD|FWRITE); 2076 else 2077 flags &= (FREAD|FWRITE); 2078 tty_flush(tp, flags); 2079 return (0); 2080 } 2081 case TIOCDRAIN: 2082 /* Drain TTY output. */ 2083 return tty_drain(tp, 0); 2084 case TIOCGDRAINWAIT: 2085 *(int *)data = tp->t_drainwait; 2086 return (0); 2087 case TIOCSDRAINWAIT: 2088 error = priv_check(td, PRIV_TTY_DRAINWAIT); 2089 if (error == 0) 2090 tp->t_drainwait = *(int *)data; 2091 return (error); 2092 case TIOCCONS: 2093 /* Set terminal as console TTY. */ 2094 if (*(int *)data) { 2095 error = priv_check(td, PRIV_TTY_CONSOLE); 2096 if (error) 2097 return (error); 2098 error = constty_set(tp); 2099 } else { 2100 error = constty_clear(tp); 2101 } 2102 return (error); 2103 case TIOCGWINSZ: 2104 /* Obtain window size. */ 2105 *(struct winsize*)data = tp->t_winsize; 2106 return (0); 2107 case TIOCSWINSZ: 2108 /* Set window size. */ 2109 tty_set_winsize(tp, data); 2110 return (0); 2111 case TIOCEXCL: 2112 tp->t_flags |= TF_EXCLUDE; 2113 return (0); 2114 case TIOCNXCL: 2115 tp->t_flags &= ~TF_EXCLUDE; 2116 return (0); 2117 case TIOCSTOP: 2118 tp->t_flags |= TF_STOPPED; 2119 ttydevsw_pktnotify(tp, TIOCPKT_STOP); 2120 return (0); 2121 case TIOCSTART: 2122 tp->t_flags &= ~TF_STOPPED; 2123 tp->t_termios.c_lflag &= ~FLUSHO; 2124 ttydevsw_outwakeup(tp); 2125 ttydevsw_pktnotify(tp, TIOCPKT_START); 2126 return (0); 2127 case TIOCSTAT: 2128 tty_info(tp); 2129 return (0); 2130 case TIOCSTI: 2131 error = tty_sti_check(tp, fflag, td); 2132 if (error != 0) 2133 return (error); 2134 ttydisc_rint(tp, *(char *)data, 0); 2135 ttydisc_rint_done(tp); 2136 return (0); 2137 } 2138 2139 #ifdef COMPAT_43TTY 2140 return tty_ioctl_compat(tp, cmd, data, fflag, td); 2141 #else /* !COMPAT_43TTY */ 2142 return (ENOIOCTL); 2143 #endif /* COMPAT_43TTY */ 2144 } 2145 2146 int 2147 tty_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, struct thread *td) 2148 { 2149 int error; 2150 2151 tty_assert_locked(tp); 2152 2153 if (tty_gone(tp)) 2154 return (EXTERROR(ENXIO, "tty_ioctl: device is gone")); 2155 2156 error = ttydevsw_ioctl(tp, cmd, data, td); 2157 if (error == ENOIOCTL) 2158 error = tty_generic_ioctl(tp, cmd, data, fflag, td); 2159 2160 return (error); 2161 } 2162 2163 dev_t 2164 tty_udev(struct tty *tp) 2165 { 2166 2167 if (tp->t_dev) 2168 return (dev2udev(tp->t_dev)); 2169 else 2170 return (NODEV); 2171 } 2172 2173 int 2174 tty_checkoutq(struct tty *tp) 2175 { 2176 2177 /* 256 bytes should be enough to print a log message. */ 2178 return (ttyoutq_bytesleft(&tp->t_outq) >= 256); 2179 } 2180 2181 void 2182 tty_hiwat_in_block(struct tty *tp) 2183 { 2184 2185 if ((tp->t_flags & TF_HIWAT_IN) == 0 && 2186 tp->t_termios.c_iflag & IXOFF && 2187 tp->t_termios.c_cc[VSTOP] != _POSIX_VDISABLE) { 2188 /* 2189 * Input flow control. Only enter the high watermark when we 2190 * can successfully store the VSTOP character. 2191 */ 2192 if (ttyoutq_write_nofrag(&tp->t_outq, 2193 &tp->t_termios.c_cc[VSTOP], 1) == 0) 2194 tp->t_flags |= TF_HIWAT_IN; 2195 } else { 2196 /* No input flow control. */ 2197 tp->t_flags |= TF_HIWAT_IN; 2198 } 2199 } 2200 2201 void 2202 tty_hiwat_in_unblock(struct tty *tp) 2203 { 2204 2205 if (tp->t_flags & TF_HIWAT_IN && 2206 tp->t_termios.c_iflag & IXOFF && 2207 tp->t_termios.c_cc[VSTART] != _POSIX_VDISABLE) { 2208 /* 2209 * Input flow control. Only leave the high watermark when we 2210 * can successfully store the VSTART character. 2211 */ 2212 if (ttyoutq_write_nofrag(&tp->t_outq, 2213 &tp->t_termios.c_cc[VSTART], 1) == 0) 2214 tp->t_flags &= ~TF_HIWAT_IN; 2215 } else { 2216 /* No input flow control. */ 2217 tp->t_flags &= ~TF_HIWAT_IN; 2218 } 2219 2220 if (!tty_gone(tp)) 2221 ttydevsw_inwakeup(tp); 2222 } 2223 2224 /* 2225 * TTY hooks interface. 2226 */ 2227 2228 static int 2229 ttyhook_defrint(struct tty *tp, char c, int flags) 2230 { 2231 2232 if (ttyhook_rint_bypass(tp, &c, 1) != 1) 2233 return (-1); 2234 2235 return (0); 2236 } 2237 2238 int 2239 ttyhook_register(struct tty **rtp, struct proc *p, int fd, struct ttyhook *th, 2240 void *softc) 2241 { 2242 struct tty *tp; 2243 struct file *fp; 2244 struct cdev *dev; 2245 struct cdevsw *cdp; 2246 struct filedesc *fdp; 2247 cap_rights_t rights; 2248 int error, ref; 2249 2250 /* Validate the file descriptor. */ 2251 /* 2252 * XXX this code inspects a file descriptor from a different process, 2253 * but there is no dedicated routine to do it in fd code, making the 2254 * ordeal highly questionable. 2255 */ 2256 fdp = p->p_fd; 2257 FILEDESC_SLOCK(fdp); 2258 error = fget_cap_noref(fdp, fd, cap_rights_init_one(&rights, CAP_TTYHOOK), 2259 &fp, NULL); 2260 if (error == 0 && !fhold(fp)) 2261 error = EBADF; 2262 FILEDESC_SUNLOCK(fdp); 2263 if (error != 0) 2264 return (error); 2265 if (fp->f_ops == &badfileops) { 2266 error = EBADF; 2267 goto done1; 2268 } 2269 2270 /* 2271 * Make sure the vnode is bound to a character device. 2272 * Unlocked check for the vnode type is ok there, because we 2273 * only shall prevent calling devvn_refthread on the file that 2274 * never has been opened over a character device. 2275 */ 2276 if (fp->f_type != DTYPE_VNODE || fp->f_vnode->v_type != VCHR) { 2277 error = EINVAL; 2278 goto done1; 2279 } 2280 2281 /* Make sure it is a TTY. */ 2282 cdp = devvn_refthread(fp->f_vnode, &dev, &ref); 2283 if (cdp == NULL) { 2284 error = ENXIO; 2285 goto done1; 2286 } 2287 if (dev != fp->f_data) { 2288 error = ENXIO; 2289 goto done2; 2290 } 2291 if (cdp != &ttydev_cdevsw) { 2292 error = ENOTTY; 2293 goto done2; 2294 } 2295 tp = dev->si_drv1; 2296 2297 /* Try to attach the hook to the TTY. */ 2298 error = EBUSY; 2299 tty_lock(tp); 2300 MPASS((tp->t_hook == NULL) == ((tp->t_flags & TF_HOOK) == 0)); 2301 if (tp->t_flags & TF_HOOK) 2302 goto done3; 2303 2304 tp->t_flags |= TF_HOOK; 2305 tp->t_hook = th; 2306 tp->t_hooksoftc = softc; 2307 *rtp = tp; 2308 error = 0; 2309 2310 /* Maybe we can switch into bypass mode now. */ 2311 ttydisc_optimize(tp); 2312 2313 /* Silently convert rint() calls to rint_bypass() when possible. */ 2314 if (!ttyhook_hashook(tp, rint) && ttyhook_hashook(tp, rint_bypass)) 2315 th->th_rint = ttyhook_defrint; 2316 2317 done3: tty_unlock(tp); 2318 done2: dev_relthread(dev, ref); 2319 done1: fdrop(fp, curthread); 2320 return (error); 2321 } 2322 2323 void 2324 ttyhook_unregister(struct tty *tp) 2325 { 2326 2327 tty_assert_locked(tp); 2328 MPASS(tp->t_flags & TF_HOOK); 2329 2330 /* Disconnect the hook. */ 2331 tp->t_flags &= ~TF_HOOK; 2332 tp->t_hook = NULL; 2333 2334 /* Maybe we need to leave bypass mode. */ 2335 ttydisc_optimize(tp); 2336 2337 /* Maybe deallocate the TTY as well. */ 2338 tty_rel_free(tp, false); 2339 } 2340 2341 /* 2342 * /dev/console handling. 2343 */ 2344 2345 static int 2346 ttyconsdev_open(struct cdev *dev, int oflags, int devtype, struct thread *td) 2347 { 2348 struct tty *tp; 2349 2350 /* System has no console device. */ 2351 if (dev_console_filename == NULL) 2352 return (EXTERROR(ENXIO, "system has no console device")); 2353 2354 /* Look up corresponding TTY by device name. */ 2355 sx_slock(&tty_list_sx); 2356 TAILQ_FOREACH(tp, &tty_list, t_list) { 2357 if (strcmp(dev_console_filename, tty_devname(tp)) == 0) { 2358 dev_console->si_drv1 = tp; 2359 break; 2360 } 2361 } 2362 sx_sunlock(&tty_list_sx); 2363 2364 /* System console has no TTY associated. */ 2365 if (dev_console->si_drv1 == NULL) 2366 return (EXTERROR(ENXIO, "system console has no TTY attached")); 2367 2368 return (ttydev_open(dev, oflags, devtype, td)); 2369 } 2370 2371 static int 2372 ttyconsdev_write(struct cdev *dev, struct uio *uio, int ioflag) 2373 { 2374 2375 log_console(uio); 2376 2377 return (ttydev_write(dev, uio, ioflag)); 2378 } 2379 2380 /* 2381 * /dev/console is a little different than normal TTY's. When opened, 2382 * it determines which TTY to use. When data gets written to it, it 2383 * will be logged in the kernel message buffer. 2384 */ 2385 static struct cdevsw ttyconsdev_cdevsw = { 2386 .d_version = D_VERSION, 2387 .d_open = ttyconsdev_open, 2388 .d_close = ttydev_close, 2389 .d_read = ttydev_read, 2390 .d_write = ttyconsdev_write, 2391 .d_ioctl = ttydev_ioctl, 2392 .d_kqfilter = ttydev_kqfilter, 2393 .d_poll = ttydev_poll, 2394 .d_mmap = ttydev_mmap, 2395 .d_name = "ttyconsdev", 2396 .d_flags = D_TTY, 2397 }; 2398 2399 static void 2400 ttyconsdev_init(void *unused __unused) 2401 { 2402 2403 dev_console = make_dev_credf(MAKEDEV_ETERNAL, &ttyconsdev_cdevsw, 0, 2404 NULL, UID_ROOT, GID_WHEEL, 0600, "console"); 2405 } 2406 2407 SYSINIT(tty, SI_SUB_DRIVERS, SI_ORDER_FIRST, ttyconsdev_init, NULL); 2408 2409 void 2410 ttyconsdev_select(const char *name) 2411 { 2412 2413 dev_console_filename = name; 2414 } 2415 2416 /* 2417 * Debugging routines. 2418 */ 2419 2420 #include "opt_ddb.h" 2421 #ifdef DDB 2422 #include <ddb/ddb.h> 2423 #include <ddb/db_sym.h> 2424 2425 static const struct { 2426 int flag; 2427 char val; 2428 } ttystates[] = { 2429 #if 0 2430 { TF_NOPREFIX, 'N' }, 2431 #endif 2432 { TF_INITLOCK, 'I' }, 2433 { TF_CALLOUT, 'C' }, 2434 2435 /* Keep these together -> 'Oi' and 'Oo'. */ 2436 { TF_OPENED, 'O' }, 2437 { TF_OPENED_IN, 'i' }, 2438 { TF_OPENED_OUT, 'o' }, 2439 { TF_OPENED_CONS, 'c' }, 2440 2441 { TF_GONE, 'G' }, 2442 { TF_OPENCLOSE, 'B' }, 2443 { TF_ASYNC, 'Y' }, 2444 { TF_LITERAL, 'L' }, 2445 2446 /* Keep these together -> 'Hi' and 'Ho'. */ 2447 { TF_HIWAT, 'H' }, 2448 { TF_HIWAT_IN, 'i' }, 2449 { TF_HIWAT_OUT, 'o' }, 2450 2451 { TF_STOPPED, 'S' }, 2452 { TF_EXCLUDE, 'X' }, 2453 { TF_BYPASS, 'l' }, 2454 { TF_ZOMBIE, 'Z' }, 2455 { TF_HOOK, 's' }, 2456 2457 /* Keep these together -> 'bi' and 'bo'. */ 2458 { TF_BUSY, 'b' }, 2459 { TF_BUSY_IN, 'i' }, 2460 { TF_BUSY_OUT, 'o' }, 2461 2462 { 0, '\0'}, 2463 }; 2464 2465 #define TTY_FLAG_BITS \ 2466 "\20\1NOPREFIX\2INITLOCK\3CALLOUT\4OPENED_IN" \ 2467 "\5OPENED_OUT\6OPENED_CONS\7GONE\10OPENCLOSE" \ 2468 "\11ASYNC\12LITERAL\13HIWAT_IN\14HIWAT_OUT" \ 2469 "\15STOPPED\16EXCLUDE\17BYPASS\20ZOMBIE" \ 2470 "\21HOOK\22BUSY_IN\23BUSY_OUT" 2471 2472 #define DB_PRINTSYM(name, addr) \ 2473 db_printf("%s " #name ": ", sep); \ 2474 db_printsym((db_addr_t) addr, DB_STGY_ANY); \ 2475 db_printf("\n"); 2476 2477 static void 2478 _db_show_devsw(const char *sep, const struct ttydevsw *tsw) 2479 { 2480 2481 db_printf("%sdevsw: ", sep); 2482 db_printsym((db_addr_t)tsw, DB_STGY_ANY); 2483 db_printf(" (%p)\n", tsw); 2484 DB_PRINTSYM(open, tsw->tsw_open); 2485 DB_PRINTSYM(close, tsw->tsw_close); 2486 DB_PRINTSYM(outwakeup, tsw->tsw_outwakeup); 2487 DB_PRINTSYM(inwakeup, tsw->tsw_inwakeup); 2488 DB_PRINTSYM(ioctl, tsw->tsw_ioctl); 2489 DB_PRINTSYM(param, tsw->tsw_param); 2490 DB_PRINTSYM(modem, tsw->tsw_modem); 2491 DB_PRINTSYM(mmap, tsw->tsw_mmap); 2492 DB_PRINTSYM(pktnotify, tsw->tsw_pktnotify); 2493 DB_PRINTSYM(free, tsw->tsw_free); 2494 } 2495 2496 static void 2497 _db_show_hooks(const char *sep, const struct ttyhook *th) 2498 { 2499 2500 db_printf("%shook: ", sep); 2501 db_printsym((db_addr_t)th, DB_STGY_ANY); 2502 db_printf(" (%p)\n", th); 2503 if (th == NULL) 2504 return; 2505 DB_PRINTSYM(rint, th->th_rint); 2506 DB_PRINTSYM(rint_bypass, th->th_rint_bypass); 2507 DB_PRINTSYM(rint_done, th->th_rint_done); 2508 DB_PRINTSYM(rint_poll, th->th_rint_poll); 2509 DB_PRINTSYM(getc_inject, th->th_getc_inject); 2510 DB_PRINTSYM(getc_capture, th->th_getc_capture); 2511 DB_PRINTSYM(getc_poll, th->th_getc_poll); 2512 DB_PRINTSYM(close, th->th_close); 2513 } 2514 2515 static void 2516 _db_show_termios(const char *name, const struct termios *t) 2517 { 2518 2519 db_printf("%s: iflag 0x%x oflag 0x%x cflag 0x%x " 2520 "lflag 0x%x ispeed %u ospeed %u\n", name, 2521 t->c_iflag, t->c_oflag, t->c_cflag, t->c_lflag, 2522 t->c_ispeed, t->c_ospeed); 2523 } 2524 2525 /* DDB command to show TTY statistics. */ 2526 DB_SHOW_COMMAND(tty, db_show_tty) 2527 { 2528 struct tty *tp; 2529 2530 if (!have_addr) { 2531 db_printf("usage: show tty <addr>\n"); 2532 return; 2533 } 2534 tp = (struct tty *)addr; 2535 2536 db_printf("%p: %s\n", tp, tty_devname(tp)); 2537 db_printf("\tmtx: %p\n", tp->t_mtx); 2538 db_printf("\tflags: 0x%b\n", tp->t_flags, TTY_FLAG_BITS); 2539 db_printf("\trevokecnt: %u\n", tp->t_revokecnt); 2540 2541 /* Buffering mechanisms. */ 2542 db_printf("\tinq: %p begin %u linestart %u reprint %u end %u " 2543 "nblocks %u quota %u\n", &tp->t_inq, tp->t_inq.ti_begin, 2544 tp->t_inq.ti_linestart, tp->t_inq.ti_reprint, tp->t_inq.ti_end, 2545 tp->t_inq.ti_nblocks, tp->t_inq.ti_quota); 2546 db_printf("\toutq: %p begin %u end %u nblocks %u quota %u\n", 2547 &tp->t_outq, tp->t_outq.to_begin, tp->t_outq.to_end, 2548 tp->t_outq.to_nblocks, tp->t_outq.to_quota); 2549 db_printf("\tinlow: %zu\n", tp->t_inlow); 2550 db_printf("\toutlow: %zu\n", tp->t_outlow); 2551 _db_show_termios("\ttermios", &tp->t_termios); 2552 db_printf("\twinsize: row %u col %u xpixel %u ypixel %u\n", 2553 tp->t_winsize.ws_row, tp->t_winsize.ws_col, 2554 tp->t_winsize.ws_xpixel, tp->t_winsize.ws_ypixel); 2555 db_printf("\tcolumn: %u\n", tp->t_column); 2556 db_printf("\twritepos: %u\n", tp->t_writepos); 2557 db_printf("\tcompatflags: 0x%x\n", tp->t_compatflags); 2558 2559 /* Init/lock-state devices. */ 2560 _db_show_termios("\ttermios_init_in", &tp->t_termios_init_in); 2561 _db_show_termios("\ttermios_init_out", &tp->t_termios_init_out); 2562 _db_show_termios("\ttermios_lock_in", &tp->t_termios_lock_in); 2563 _db_show_termios("\ttermios_lock_out", &tp->t_termios_lock_out); 2564 2565 /* Hooks */ 2566 _db_show_devsw("\t", tp->t_devsw); 2567 _db_show_hooks("\t", tp->t_hook); 2568 2569 /* Process info. */ 2570 db_printf("\tpgrp: %p gid %d\n", tp->t_pgrp, 2571 tp->t_pgrp ? tp->t_pgrp->pg_id : 0); 2572 db_printf("\tsession: %p", tp->t_session); 2573 if (tp->t_session != NULL) 2574 db_printf(" count %u leader %p tty %p sid %d login %s", 2575 tp->t_session->s_count, tp->t_session->s_leader, 2576 tp->t_session->s_ttyp, tp->t_session->s_sid, 2577 tp->t_session->s_login); 2578 db_printf("\n"); 2579 db_printf("\tsessioncnt: %u\n", tp->t_sessioncnt); 2580 db_printf("\tdevswsoftc: %p\n", tp->t_devswsoftc); 2581 db_printf("\thooksoftc: %p\n", tp->t_hooksoftc); 2582 db_printf("\tdev: %p\n", tp->t_dev); 2583 } 2584 2585 /* DDB command to list TTYs. */ 2586 DB_SHOW_ALL_COMMAND(ttys, db_show_all_ttys) 2587 { 2588 struct tty *tp; 2589 size_t isiz, osiz; 2590 int i, j; 2591 2592 /* Make the output look like `pstat -t'. */ 2593 db_printf("PTR "); 2594 #if defined(__LP64__) 2595 db_printf(" "); 2596 #endif 2597 db_printf(" LINE INQ CAN LIN LOW OUTQ USE LOW " 2598 "COL SESS PGID STATE\n"); 2599 2600 TAILQ_FOREACH(tp, &tty_list, t_list) { 2601 isiz = tp->t_inq.ti_nblocks * TTYINQ_DATASIZE; 2602 osiz = tp->t_outq.to_nblocks * TTYOUTQ_DATASIZE; 2603 2604 db_printf("%p %10s %5zu %4u %4u %4zu %5zu %4u %4zu %5u %5d " 2605 "%5d ", tp, tty_devname(tp), isiz, 2606 tp->t_inq.ti_linestart - tp->t_inq.ti_begin, 2607 tp->t_inq.ti_end - tp->t_inq.ti_linestart, 2608 isiz - tp->t_inlow, osiz, 2609 tp->t_outq.to_end - tp->t_outq.to_begin, 2610 osiz - tp->t_outlow, MIN(tp->t_column, 99999), 2611 tp->t_session ? tp->t_session->s_sid : 0, 2612 tp->t_pgrp ? tp->t_pgrp->pg_id : 0); 2613 2614 /* Flag bits. */ 2615 for (i = j = 0; ttystates[i].flag; i++) 2616 if (tp->t_flags & ttystates[i].flag) { 2617 db_printf("%c", ttystates[i].val); 2618 j++; 2619 } 2620 if (j == 0) 2621 db_printf("-"); 2622 db_printf("\n"); 2623 } 2624 } 2625 #endif /* DDB */ 2626