1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2008 Ed Schouten <ed@FreeBSD.org>
5 * All rights reserved.
6 *
7 * Portions of this software were developed under sponsorship from Snow
8 * B.V., the Netherlands.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33/* Add compatibility bits for FreeBSD. */
34#define PTS_COMPAT
35/* Add pty(4) compat bits. */
36#define PTS_EXTERNAL
37/* Add bits to make Linux binaries work. */
38#define PTS_LINUX
39
40#include <sys/param.h>
41#include <sys/lock.h>
42#include <sys/condvar.h>
43#include <sys/conf.h>
44#include <sys/fcntl.h>
45#include <sys/file.h>
46#include <sys/filedesc.h>
47#include <sys/filio.h>
48#include <sys/kernel.h>
49#include <sys/limits.h>
50#include <sys/malloc.h>
51#include <sys/mutex.h>
52#include <sys/poll.h>
53#include <sys/proc.h>
54#include <sys/racct.h>
55#include <sys/resourcevar.h>
56#include <sys/serial.h>
57#include <sys/stat.h>
58#include <sys/syscall.h>
59#include <sys/syscallsubr.h>
60#include <sys/sysctl.h>
61#include <sys/sysproto.h>
62#include <sys/systm.h>
63#include <sys/tty.h>
64#include <sys/ttycom.h>
65#include <sys/uio.h>
66#include <sys/user.h>
67
68#include <machine/stdarg.h>
69
70/*
71 * Our utmp(5) format is limited to 8-byte TTY line names.  This means
72 * we can at most allocate 1000 pseudo-terminals ("pts/999").  Allow
73 * users to increase this number, assuming they have manually increased
74 * UT_LINESIZE.
75 */
76static struct unrhdr *pts_pool;
77
78static MALLOC_DEFINE(M_PTS, "pts", "pseudo tty device");
79
80/*
81 * Per-PTS structure.
82 *
83 * List of locks
84 * (t)	locked by tty_lock()
85 * (c)	const until freeing
86 */
87struct pts_softc {
88	int		pts_unit;	/* (c) Device unit number. */
89	unsigned int	pts_flags;	/* (t) Device flags. */
90#define	PTS_PKT		0x1	/* Packet mode. */
91#define	PTS_FINISHED	0x2	/* Return errors on read()/write(). */
92	char		pts_pkt;	/* (t) Unread packet mode data. */
93
94	struct cv	pts_inwait;	/* (t) Blocking write() on master. */
95	struct selinfo	pts_inpoll;	/* (t) Select queue for write(). */
96	struct cv	pts_outwait;	/* (t) Blocking read() on master. */
97	struct selinfo	pts_outpoll;	/* (t) Select queue for read(). */
98
99#ifdef PTS_EXTERNAL
100	struct cdev	*pts_cdev;	/* (c) Master device node. */
101#endif /* PTS_EXTERNAL */
102
103	struct ucred	*pts_cred;	/* (c) Resource limit. */
104};
105
106/*
107 * Controller-side file operations.
108 */
109
110static int
111ptsdev_read(struct file *fp, struct uio *uio, struct ucred *active_cred,
112    int flags, struct thread *td)
113{
114	struct tty *tp = fp->f_data;
115	struct pts_softc *psc = tty_softc(tp);
116	int error = 0;
117	char pkt;
118
119	if (uio->uio_resid == 0)
120		return (0);
121
122	tty_lock(tp);
123
124	for (;;) {
125		/*
126		 * Implement packet mode. When packet mode is turned on,
127		 * the first byte contains a bitmask of events that
128		 * occurred (start, stop, flush, window size, etc).
129		 */
130		if (psc->pts_flags & PTS_PKT && psc->pts_pkt) {
131			pkt = psc->pts_pkt;
132			psc->pts_pkt = 0;
133			tty_unlock(tp);
134
135			error = ureadc(pkt, uio);
136			return (error);
137		}
138
139		/*
140		 * Transmit regular data.
141		 *
142		 * XXX: We shouldn't use ttydisc_getc_poll()! Even
143		 * though in this implementation, there is likely going
144		 * to be data, we should just call ttydisc_getc_uio()
145		 * and use its return value to sleep.
146		 */
147		if (ttydisc_getc_poll(tp)) {
148			if (psc->pts_flags & PTS_PKT) {
149				/*
150				 * XXX: Small race. Fortunately PTY
151				 * consumers aren't multithreaded.
152				 */
153
154				tty_unlock(tp);
155				error = ureadc(TIOCPKT_DATA, uio);
156				if (error)
157					return (error);
158				tty_lock(tp);
159			}
160
161			error = ttydisc_getc_uio(tp, uio);
162			break;
163		}
164
165		/* Maybe the device isn't used anyway. */
166		if (psc->pts_flags & PTS_FINISHED)
167			break;
168
169		/* Wait for more data. */
170		if (fp->f_flag & O_NONBLOCK) {
171			error = EWOULDBLOCK;
172			break;
173		}
174		error = cv_wait_sig(&psc->pts_outwait, tp->t_mtx);
175		if (error != 0)
176			break;
177	}
178
179	tty_unlock(tp);
180
181	return (error);
182}
183
184static int
185ptsdev_write(struct file *fp, struct uio *uio, struct ucred *active_cred,
186    int flags, struct thread *td)
187{
188	struct tty *tp = fp->f_data;
189	struct pts_softc *psc = tty_softc(tp);
190	char ib[256], *ibstart;
191	size_t iblen, rintlen;
192	int error = 0;
193
194	if (uio->uio_resid == 0)
195		return (0);
196
197	for (;;) {
198		ibstart = ib;
199		iblen = MIN(uio->uio_resid, sizeof ib);
200		error = uiomove(ib, iblen, uio);
201
202		tty_lock(tp);
203		if (error != 0) {
204			iblen = 0;
205			goto done;
206		}
207
208		/*
209		 * When possible, avoid the slow path. rint_bypass()
210		 * copies all input to the input queue at once.
211		 */
212		MPASS(iblen > 0);
213		do {
214			rintlen = ttydisc_rint_simple(tp, ibstart, iblen);
215			ibstart += rintlen;
216			iblen -= rintlen;
217			if (iblen == 0) {
218				/* All data written. */
219				break;
220			}
221
222			/* Maybe the device isn't used anyway. */
223			if (psc->pts_flags & PTS_FINISHED) {
224				error = EIO;
225				goto done;
226			}
227
228			/* Wait for more data. */
229			if (fp->f_flag & O_NONBLOCK) {
230				error = EWOULDBLOCK;
231				goto done;
232			}
233
234			/* Wake up users on the slave side. */
235			ttydisc_rint_done(tp);
236			error = cv_wait_sig(&psc->pts_inwait, tp->t_mtx);
237			if (error != 0)
238				goto done;
239		} while (iblen > 0);
240
241		if (uio->uio_resid == 0)
242			break;
243		tty_unlock(tp);
244	}
245
246done:	ttydisc_rint_done(tp);
247	tty_unlock(tp);
248
249	/*
250	 * Don't account for the part of the buffer that we couldn't
251	 * pass to the TTY.
252	 */
253	uio->uio_resid += iblen;
254	return (error);
255}
256
257static int
258ptsdev_ioctl(struct file *fp, u_long cmd, void *data,
259    struct ucred *active_cred, struct thread *td)
260{
261	struct tty *tp = fp->f_data;
262	struct pts_softc *psc = tty_softc(tp);
263	int error = 0, sig;
264
265	switch (cmd) {
266	case FIODTYPE:
267		*(int *)data = D_TTY;
268		return (0);
269	case FIONBIO:
270		/* This device supports non-blocking operation. */
271		return (0);
272	case FIONREAD:
273		tty_lock(tp);
274		*(int *)data = ttydisc_getc_poll(tp);
275		tty_unlock(tp);
276		return (0);
277	case FIODGNAME:
278#ifdef COMPAT_FREEBSD32
279	case FIODGNAME_32:
280#endif
281	{
282		struct fiodgname_arg *fgn;
283		const char *p;
284		int i;
285
286		/* Reverse device name lookups, for ptsname() and ttyname(). */
287		fgn = data;
288		p = tty_devname(tp);
289		i = strlen(p) + 1;
290		if (i > fgn->len)
291			return (EINVAL);
292		return (copyout(p, fiodgname_buf_get_ptr(fgn, cmd), i));
293	}
294
295	/*
296	 * We need to implement TIOCGPGRP and TIOCGSID here again. When
297	 * called on the pseudo-terminal master, it should not check if
298	 * the terminal is the foreground terminal of the calling
299	 * process.
300	 *
301	 * TIOCGETA is also implemented here. Various Linux PTY routines
302	 * often call isatty(), which is implemented by tcgetattr().
303	 */
304#ifdef PTS_LINUX
305	case TIOCGETA:
306		/* Obtain terminal flags through tcgetattr(). */
307		tty_lock(tp);
308		*(struct termios*)data = tp->t_termios;
309		tty_unlock(tp);
310		return (0);
311#endif /* PTS_LINUX */
312	case TIOCSETAF:
313	case TIOCSETAW:
314		/*
315		 * We must make sure we turn tcsetattr() calls of TCSAFLUSH and
316		 * TCSADRAIN into something different. If an application would
317		 * call TCSAFLUSH or TCSADRAIN on the master descriptor, it may
318		 * deadlock waiting for all data to be read.
319		 */
320		cmd = TIOCSETA;
321		break;
322#if defined(PTS_COMPAT) || defined(PTS_LINUX)
323	case TIOCGPTN:
324		/*
325		 * Get the device unit number.
326		 */
327		if (psc->pts_unit < 0)
328			return (ENOTTY);
329		*(unsigned int *)data = psc->pts_unit;
330		return (0);
331#endif /* PTS_COMPAT || PTS_LINUX */
332	case TIOCGPGRP:
333		/* Get the foreground process group ID. */
334		tty_lock(tp);
335		if (tp->t_pgrp != NULL)
336			*(int *)data = tp->t_pgrp->pg_id;
337		else
338			*(int *)data = NO_PID;
339		tty_unlock(tp);
340		return (0);
341	case TIOCGSID:
342		/* Get the session leader process ID. */
343		tty_lock(tp);
344		if (tp->t_session == NULL)
345			error = ENOTTY;
346		else
347			*(int *)data = tp->t_session->s_sid;
348		tty_unlock(tp);
349		return (error);
350	case TIOCPTMASTER:
351		/* Yes, we are a pseudo-terminal master. */
352		return (0);
353	case TIOCSIG:
354		/* Signal the foreground process group. */
355		sig = *(int *)data;
356		if (sig < 1 || sig >= NSIG)
357			return (EINVAL);
358
359		tty_lock(tp);
360		tty_signal_pgrp(tp, sig);
361		tty_unlock(tp);
362		return (0);
363	case TIOCPKT:
364		/* Enable/disable packet mode. */
365		tty_lock(tp);
366		if (*(int *)data)
367			psc->pts_flags |= PTS_PKT;
368		else
369			psc->pts_flags &= ~PTS_PKT;
370		tty_unlock(tp);
371		return (0);
372	}
373
374	/* Just redirect this ioctl to the slave device. */
375	tty_lock(tp);
376	error = tty_ioctl(tp, cmd, data, fp->f_flag, td);
377	tty_unlock(tp);
378	if (error == ENOIOCTL)
379		error = ENOTTY;
380
381	return (error);
382}
383
384static int
385ptsdev_poll(struct file *fp, int events, struct ucred *active_cred,
386    struct thread *td)
387{
388	struct tty *tp = fp->f_data;
389	struct pts_softc *psc = tty_softc(tp);
390	int revents = 0;
391
392	tty_lock(tp);
393
394	if (psc->pts_flags & PTS_FINISHED) {
395		/* Slave device is not opened. */
396		tty_unlock(tp);
397		return ((events & (POLLIN|POLLRDNORM)) | POLLHUP);
398	}
399
400	if (events & (POLLIN|POLLRDNORM)) {
401		/* See if we can getc something. */
402		if (ttydisc_getc_poll(tp) ||
403		    (psc->pts_flags & PTS_PKT && psc->pts_pkt))
404			revents |= events & (POLLIN|POLLRDNORM);
405	}
406	if (events & (POLLOUT|POLLWRNORM)) {
407		/* See if we can rint something. */
408		if (ttydisc_rint_poll(tp))
409			revents |= events & (POLLOUT|POLLWRNORM);
410	}
411
412	/*
413	 * No need to check for POLLHUP here. This device cannot be used
414	 * as a callout device, which means we always have a carrier,
415	 * because the master is.
416	 */
417
418	if (revents == 0) {
419		/*
420		 * This code might look misleading, but the naming of
421		 * poll events on this side is the opposite of the slave
422		 * device.
423		 */
424		if (events & (POLLIN|POLLRDNORM))
425			selrecord(td, &psc->pts_outpoll);
426		if (events & (POLLOUT|POLLWRNORM))
427			selrecord(td, &psc->pts_inpoll);
428	}
429
430	tty_unlock(tp);
431
432	return (revents);
433}
434
435/*
436 * kqueue support.
437 */
438
439static void
440pts_kqops_read_detach(struct knote *kn)
441{
442	struct file *fp = kn->kn_fp;
443	struct tty *tp = fp->f_data;
444	struct pts_softc *psc = tty_softc(tp);
445
446	knlist_remove(&psc->pts_outpoll.si_note, kn, 0);
447}
448
449static int
450pts_kqops_read_event(struct knote *kn, long hint)
451{
452	struct file *fp = kn->kn_fp;
453	struct tty *tp = fp->f_data;
454	struct pts_softc *psc = tty_softc(tp);
455
456	if (psc->pts_flags & PTS_FINISHED) {
457		kn->kn_flags |= EV_EOF;
458		return (1);
459	} else {
460		kn->kn_data = ttydisc_getc_poll(tp);
461		return (kn->kn_data > 0);
462	}
463}
464
465static void
466pts_kqops_write_detach(struct knote *kn)
467{
468	struct file *fp = kn->kn_fp;
469	struct tty *tp = fp->f_data;
470	struct pts_softc *psc = tty_softc(tp);
471
472	knlist_remove(&psc->pts_inpoll.si_note, kn, 0);
473}
474
475static int
476pts_kqops_write_event(struct knote *kn, long hint)
477{
478	struct file *fp = kn->kn_fp;
479	struct tty *tp = fp->f_data;
480	struct pts_softc *psc = tty_softc(tp);
481
482	if (psc->pts_flags & PTS_FINISHED) {
483		kn->kn_flags |= EV_EOF;
484		return (1);
485	} else {
486		kn->kn_data = ttydisc_rint_poll(tp);
487		return (kn->kn_data > 0);
488	}
489}
490
491static struct filterops pts_kqops_read = {
492	.f_isfd = 1,
493	.f_detach = pts_kqops_read_detach,
494	.f_event = pts_kqops_read_event,
495};
496static struct filterops pts_kqops_write = {
497	.f_isfd = 1,
498	.f_detach = pts_kqops_write_detach,
499	.f_event = pts_kqops_write_event,
500};
501
502static int
503ptsdev_kqfilter(struct file *fp, struct knote *kn)
504{
505	struct tty *tp = fp->f_data;
506	struct pts_softc *psc = tty_softc(tp);
507	int error = 0;
508
509	tty_lock(tp);
510
511	switch (kn->kn_filter) {
512	case EVFILT_READ:
513		kn->kn_fop = &pts_kqops_read;
514		knlist_add(&psc->pts_outpoll.si_note, kn, 1);
515		break;
516	case EVFILT_WRITE:
517		kn->kn_fop = &pts_kqops_write;
518		knlist_add(&psc->pts_inpoll.si_note, kn, 1);
519		break;
520	default:
521		error = EINVAL;
522		break;
523	}
524
525	tty_unlock(tp);
526	return (error);
527}
528
529static int
530ptsdev_stat(struct file *fp, struct stat *sb, struct ucred *active_cred)
531{
532	struct tty *tp = fp->f_data;
533#ifdef PTS_EXTERNAL
534	struct pts_softc *psc = tty_softc(tp);
535#endif /* PTS_EXTERNAL */
536	struct cdev *dev = tp->t_dev;
537
538	/*
539	 * According to POSIX, we must implement an fstat(). This also
540	 * makes this implementation compatible with Linux binaries,
541	 * because Linux calls fstat() on the pseudo-terminal master to
542	 * obtain st_rdev.
543	 *
544	 * XXX: POSIX also mentions we must fill in st_dev, but how?
545	 */
546
547	bzero(sb, sizeof *sb);
548#ifdef PTS_EXTERNAL
549	if (psc->pts_cdev != NULL)
550		sb->st_ino = sb->st_rdev = dev2udev(psc->pts_cdev);
551	else
552#endif /* PTS_EXTERNAL */
553		sb->st_ino = sb->st_rdev = tty_udev(tp);
554
555	sb->st_atim = dev->si_atime;
556	sb->st_ctim = dev->si_ctime;
557	sb->st_mtim = dev->si_mtime;
558	sb->st_uid = dev->si_uid;
559	sb->st_gid = dev->si_gid;
560	sb->st_mode = dev->si_mode | S_IFCHR;
561
562	return (0);
563}
564
565static int
566ptsdev_close(struct file *fp, struct thread *td)
567{
568	struct tty *tp = fp->f_data;
569
570	/* Deallocate TTY device. */
571	tty_lock(tp);
572	tty_rel_gone(tp);
573
574	/*
575	 * Open of /dev/ptmx or /dev/ptyXX changes the type of file
576	 * from DTYPE_VNODE to DTYPE_PTS. vn_open() increases vnode
577	 * use count, we need to decrement it, and possibly do other
578	 * required cleanup.
579	 */
580	if (fp->f_vnode != NULL)
581		return (vnops.fo_close(fp, td));
582
583	return (0);
584}
585
586static int
587ptsdev_fill_kinfo(struct file *fp, struct kinfo_file *kif, struct filedesc *fdp)
588{
589	struct tty *tp;
590
591	kif->kf_type = KF_TYPE_PTS;
592	tp = fp->f_data;
593	kif->kf_un.kf_pts.kf_pts_dev = tty_udev(tp);
594	kif->kf_un.kf_pts.kf_pts_dev_freebsd11 =
595	    kif->kf_un.kf_pts.kf_pts_dev; /* truncate */
596	strlcpy(kif->kf_path, tty_devname(tp), sizeof(kif->kf_path));
597	return (0);
598}
599
600static struct fileops ptsdev_ops = {
601	.fo_read	= ptsdev_read,
602	.fo_write	= ptsdev_write,
603	.fo_truncate	= invfo_truncate,
604	.fo_ioctl	= ptsdev_ioctl,
605	.fo_poll	= ptsdev_poll,
606	.fo_kqfilter	= ptsdev_kqfilter,
607	.fo_stat	= ptsdev_stat,
608	.fo_close	= ptsdev_close,
609	.fo_chmod	= invfo_chmod,
610	.fo_chown	= invfo_chown,
611	.fo_sendfile	= invfo_sendfile,
612	.fo_fill_kinfo	= ptsdev_fill_kinfo,
613	.fo_cmp		= file_kcmp_generic,
614	.fo_flags	= DFLAG_PASSABLE,
615};
616
617/*
618 * Driver-side hooks.
619 */
620
621static void
622ptsdrv_outwakeup(struct tty *tp)
623{
624	struct pts_softc *psc = tty_softc(tp);
625
626	cv_broadcast(&psc->pts_outwait);
627	selwakeup(&psc->pts_outpoll);
628	KNOTE_LOCKED(&psc->pts_outpoll.si_note, 0);
629}
630
631static void
632ptsdrv_inwakeup(struct tty *tp)
633{
634	struct pts_softc *psc = tty_softc(tp);
635
636	cv_broadcast(&psc->pts_inwait);
637	selwakeup(&psc->pts_inpoll);
638	KNOTE_LOCKED(&psc->pts_inpoll.si_note, 0);
639}
640
641static int
642ptsdrv_open(struct tty *tp)
643{
644	struct pts_softc *psc = tty_softc(tp);
645
646	psc->pts_flags &= ~PTS_FINISHED;
647
648	return (0);
649}
650
651static void
652ptsdrv_close(struct tty *tp)
653{
654	struct pts_softc *psc = tty_softc(tp);
655
656	/* Wake up any blocked readers/writers. */
657	psc->pts_flags |= PTS_FINISHED;
658	ptsdrv_outwakeup(tp);
659	ptsdrv_inwakeup(tp);
660}
661
662static void
663ptsdrv_pktnotify(struct tty *tp, char event)
664{
665	struct pts_softc *psc = tty_softc(tp);
666
667	/*
668	 * Clear conflicting flags.
669	 */
670
671	switch (event) {
672	case TIOCPKT_STOP:
673		psc->pts_pkt &= ~TIOCPKT_START;
674		break;
675	case TIOCPKT_START:
676		psc->pts_pkt &= ~TIOCPKT_STOP;
677		break;
678	case TIOCPKT_NOSTOP:
679		psc->pts_pkt &= ~TIOCPKT_DOSTOP;
680		break;
681	case TIOCPKT_DOSTOP:
682		psc->pts_pkt &= ~TIOCPKT_NOSTOP;
683		break;
684	}
685
686	psc->pts_pkt |= event;
687	ptsdrv_outwakeup(tp);
688}
689
690static void
691ptsdrv_free(void *softc)
692{
693	struct pts_softc *psc = softc;
694
695	/* Make device number available again. */
696	if (psc->pts_unit >= 0)
697		free_unr(pts_pool, psc->pts_unit);
698
699	chgptscnt(psc->pts_cred->cr_ruidinfo, -1, 0);
700	racct_sub_cred(psc->pts_cred, RACCT_NPTS, 1);
701	crfree(psc->pts_cred);
702
703	seldrain(&psc->pts_inpoll);
704	seldrain(&psc->pts_outpoll);
705	knlist_destroy(&psc->pts_inpoll.si_note);
706	knlist_destroy(&psc->pts_outpoll.si_note);
707
708#ifdef PTS_EXTERNAL
709	/* Destroy master device as well. */
710	if (psc->pts_cdev != NULL)
711		destroy_dev_sched(psc->pts_cdev);
712#endif /* PTS_EXTERNAL */
713
714	free(psc, M_PTS);
715}
716
717static struct ttydevsw pts_class = {
718	.tsw_flags	= TF_NOPREFIX,
719	.tsw_outwakeup	= ptsdrv_outwakeup,
720	.tsw_inwakeup	= ptsdrv_inwakeup,
721	.tsw_open	= ptsdrv_open,
722	.tsw_close	= ptsdrv_close,
723	.tsw_pktnotify	= ptsdrv_pktnotify,
724	.tsw_free	= ptsdrv_free,
725};
726
727#ifndef PTS_EXTERNAL
728static
729#endif /* !PTS_EXTERNAL */
730int
731pts_alloc(int fflags, struct thread *td, struct file *fp)
732{
733	int unit, ok, error;
734	struct tty *tp;
735	struct pts_softc *psc;
736	struct proc *p = td->td_proc;
737	struct ucred *cred = td->td_ucred;
738
739	/* Resource limiting. */
740	PROC_LOCK(p);
741	error = racct_add(p, RACCT_NPTS, 1);
742	if (error != 0) {
743		PROC_UNLOCK(p);
744		return (EAGAIN);
745	}
746	ok = chgptscnt(cred->cr_ruidinfo, 1, lim_cur(td, RLIMIT_NPTS));
747	if (!ok) {
748		racct_sub(p, RACCT_NPTS, 1);
749		PROC_UNLOCK(p);
750		return (EAGAIN);
751	}
752	PROC_UNLOCK(p);
753
754	/* Try to allocate a new pts unit number. */
755	unit = alloc_unr(pts_pool);
756	if (unit < 0) {
757		racct_sub(p, RACCT_NPTS, 1);
758		chgptscnt(cred->cr_ruidinfo, -1, 0);
759		return (EAGAIN);
760	}
761
762	/* Allocate TTY and softc. */
763	psc = malloc(sizeof(struct pts_softc), M_PTS, M_WAITOK|M_ZERO);
764	cv_init(&psc->pts_inwait, "ptsin");
765	cv_init(&psc->pts_outwait, "ptsout");
766
767	psc->pts_unit = unit;
768	psc->pts_cred = crhold(cred);
769
770	tp = tty_alloc(&pts_class, psc);
771	knlist_init_mtx(&psc->pts_inpoll.si_note, tp->t_mtx);
772	knlist_init_mtx(&psc->pts_outpoll.si_note, tp->t_mtx);
773
774	/* Expose the slave device as well. */
775	tty_makedev(tp, td->td_ucred, "pts/%u", psc->pts_unit);
776
777	finit(fp, fflags, DTYPE_PTS, tp, &ptsdev_ops);
778
779	return (0);
780}
781
782#ifdef PTS_EXTERNAL
783int
784pts_alloc_external(int fflags, struct thread *td, struct file *fp,
785    struct cdev *dev, const char *name)
786{
787	int ok, error;
788	struct tty *tp;
789	struct pts_softc *psc;
790	struct proc *p = td->td_proc;
791	struct ucred *cred = td->td_ucred;
792
793	/* Resource limiting. */
794	PROC_LOCK(p);
795	error = racct_add(p, RACCT_NPTS, 1);
796	if (error != 0) {
797		PROC_UNLOCK(p);
798		return (EAGAIN);
799	}
800	ok = chgptscnt(cred->cr_ruidinfo, 1, lim_cur(td, RLIMIT_NPTS));
801	if (!ok) {
802		racct_sub(p, RACCT_NPTS, 1);
803		PROC_UNLOCK(p);
804		return (EAGAIN);
805	}
806	PROC_UNLOCK(p);
807
808	/* Allocate TTY and softc. */
809	psc = malloc(sizeof(struct pts_softc), M_PTS, M_WAITOK|M_ZERO);
810	cv_init(&psc->pts_inwait, "ptsin");
811	cv_init(&psc->pts_outwait, "ptsout");
812
813	psc->pts_unit = -1;
814	psc->pts_cdev = dev;
815	psc->pts_cred = crhold(cred);
816
817	tp = tty_alloc(&pts_class, psc);
818	knlist_init_mtx(&psc->pts_inpoll.si_note, tp->t_mtx);
819	knlist_init_mtx(&psc->pts_outpoll.si_note, tp->t_mtx);
820
821	/* Expose the slave device as well. */
822	tty_makedev(tp, td->td_ucred, "%s", name);
823
824	finit(fp, fflags, DTYPE_PTS, tp, &ptsdev_ops);
825
826	return (0);
827}
828#endif /* PTS_EXTERNAL */
829
830int
831sys_posix_openpt(struct thread *td, struct posix_openpt_args *uap)
832{
833	int error, fd;
834	struct file *fp;
835
836	/*
837	 * POSIX states it's unspecified when other flags are passed. We
838	 * don't allow this.
839	 */
840	if (uap->flags & ~(O_RDWR|O_NOCTTY|O_CLOEXEC))
841		return (EINVAL);
842
843	error = falloc(td, &fp, &fd, uap->flags);
844	if (error)
845		return (error);
846
847	/* Allocate the actual pseudo-TTY. */
848	error = pts_alloc(FFLAGS(uap->flags & O_ACCMODE), td, fp);
849	if (error != 0) {
850		fdclose(td, fp, fd);
851		fdrop(fp, td);
852		return (error);
853	}
854
855	/* Pass it back to userspace. */
856	td->td_retval[0] = fd;
857	fdrop(fp, td);
858
859	return (0);
860}
861
862static void
863pts_init(void *unused)
864{
865
866	pts_pool = new_unrhdr(0, INT_MAX, NULL);
867}
868
869SYSINIT(pts, SI_SUB_DRIVERS, SI_ORDER_MIDDLE, pts_init, NULL);
870