Integrate the new MPSAFE TTY layer to the FreeBSD operating system.

The last half year I've been working on a replacement TTY layer for the
FreeBSD kernel. The new TTY layer was designed to improve the following:

- Improved driver model:

  The old TTY layer has a driver model that is not abstract enough to
  make it friendly to use. A good example is the output path, where the
  device drivers directly access the output buffers. This means that an
  in-kernel PPP implementation must always convert network buffers into
  TTY buffers.

  If a PPP implementation would be built on top of the new TTY layer
  (still needs a hooks layer, though), it would allow the PPP
  implementation to directly hand the data to the TTY driver.

- Improved hotplugging:

  With the old TTY layer, it isn't entirely safe to destroy TTY's from
  the system. This implementation has a two-step destructing design,
  where the driver first abandons the TTY. After all threads have left
  the TTY, the TTY layer calls a routine in the driver, which can be
  used to free resources (unit numbers, etc).

  The pts(4) driver also implements this feature, which means
  posix_openpt() will now return PTY's that are created on the fly.

- Improved performance:

  One of the major improvements is the per-TTY mutex, which is expected
  to improve scalability when compared to the old Giant locking.
  Another change is the unbuffered copying to userspace, which is both
  used on TTY device nodes and PTY masters.

Upgrading should be quite straightforward. Unlike previous versions,
existing kernel configuration files do not need to be changed, except
when they reference device drivers that are listed in UPDATING.

Obtained from:		//depot/projects/mpsafetty/...
Approved by:		philip (ex-mentor)
Discussed:		on the lists, at BSDCan, at the DevSummit
Sponsored by:		Snow B.V., the Netherlands
dcons(4) fixed by:	kan

4 files changed, 129 insertions, 100 deletions

diff --git a/lib/libc/stdlib/Makefile.inc b/lib/libc/stdlib/Makefile.inc
index f9b8fec..86b3c65 100644
--- a/lib/libc/stdlib/Makefile.inc
+++ b/lib/libc/stdlib/Makefile.inc
@@ -6,9 +6,9 @@
 
 MISRCS+=_Exit.c a64l.c abort.c abs.c atexit.c atof.c atoi.c atol.c atoll.c \
 	bsearch.c div.c exit.c getenv.c getopt.c getopt_long.c \
-	getsubopt.c grantpt.c hcreate.c heapsort.c imaxabs.c imaxdiv.c \
+	getsubopt.c hcreate.c heapsort.c imaxabs.c imaxdiv.c \
 	insque.c l64a.c labs.c ldiv.c llabs.c lldiv.c lsearch.c malloc.c \
-	merge.c qsort.c qsort_r.c radixsort.c rand.c random.c \
+	merge.c ptsname.c qsort.c qsort_r.c radixsort.c rand.c random.c \
 	reallocf.c realpath.c remque.c strfmon.c strtoimax.c \
 	strtol.c strtoll.c strtoq.c strtoul.c strtonum.c strtoull.c \
         strtoumax.c strtouq.c system.c tdelete.c tfind.c tsearch.c twalk.c
@@ -21,10 +21,10 @@ SYM_MAPS+= ${.CURDIR}/stdlib/Symbol.map
 .endif
 
 MAN+=	a64l.3 abort.3 abs.3 alloca.3 atexit.3 atof.3 atoi.3 atol.3 bsearch.3 \
-	div.3 exit.3 getenv.3 getopt.3 getopt_long.3 getsubopt.3 grantpt.3 \
+	div.3 exit.3 getenv.3 getopt.3 getopt_long.3 getsubopt.3 \
 	hcreate.3 imaxabs.3 imaxdiv.3 insque.3 labs.3 ldiv.3 llabs.3 lldiv.3 \
-	lsearch.3 malloc.3 memory.3 posix_memalign.3 qsort.3 radixsort.3 \
-	rand.3 random.3 \
+	lsearch.3 malloc.3 memory.3 posix_memalign.3 ptsname.3 qsort.3 \
+	radixsort.3 rand.3 random.3 \
 	realpath.3 strfmon.3 strtod.3 strtol.3 strtonum.3 strtoul.3 system.3 \
 	tsearch.3
 
@@ -33,10 +33,10 @@ MLINKS+=atol.3 atoll.3
 MLINKS+=exit.3 _Exit.3
 MLINKS+=getenv.3 putenv.3 getenv.3 setenv.3 getenv.3 unsetenv.3
 MLINKS+=getopt_long.3 getopt_long_only.3
-MLINKS+=grantpt.3 posix_openpt.3 grantpt.3 ptsname.3 grantpt.3 unlockpt.3
 MLINKS+=hcreate.3 hdestroy.3 hcreate.3 hsearch.3
 MLINKS+=insque.3 remque.3
 MLINKS+=lsearch.3 lfind.3
+MLINKS+=ptsname.3 grantpt.3 ptsname.3 unlockpt.3
 MLINKS+=qsort.3 heapsort.3 qsort.3 mergesort.3 qsort.3 qsort_r.3
 MLINKS+=rand.3 rand_r.3 rand.3 srand.3 rand.3 sranddev.3
 MLINKS+=random.3 initstate.3 random.3 setstate.3 random.3 srandom.3 \
diff --git a/lib/libc/stdlib/Symbol.map b/lib/libc/stdlib/Symbol.map
index 23cb391..10dff7e 100644
--- a/lib/libc/stdlib/Symbol.map
+++ b/lib/libc/stdlib/Symbol.map
@@ -30,7 +30,6 @@ FBSD_1.0 {
 	suboptarg;
 	getsubopt;
 	grantpt;
-	posix_openpt;
 	ptsname;
 	unlockpt;
 	hcreate;
diff --git a/lib/libc/stdlib/grantpt.3 b/lib/libc/stdlib/ptsname.3
index b4ad8c4..b9c7381 100644
--- a/lib/libc/stdlib/grantpt.3
+++ b/lib/libc/stdlib/ptsname.3
@@ -31,14 +31,13 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 23, 2002
+.Dd August 20, 2008
 .Os
-.Dt GRANTPT 3
+.Dt PTSNAME 3
 .Sh NAME
 .Nm grantpt ,
 .Nm ptsname ,
-.Nm unlockpt ,
-.Nm posix_openpt
+.Nm unlockpt
 .Nd pseudo-terminal access functions
 .Sh LIBRARY
 .Lb libc
@@ -50,21 +49,17 @@
 .Fn ptsname "int fildes"
 .Ft int
 .Fn unlockpt "int fildes"
-.In fcntl.h
-.Ft int
-.Fn posix_openpt "int mode"
 .Sh DESCRIPTION
 The
 .Fn grantpt ,
 .Fn ptsname ,
-.Fn unlockpt ,
 and
-.Fn posix_openpt
+.Fn unlockpt
 functions allow access to pseudo-terminal devices.
-The first three functions accept a file descriptor
-that references the master half of a pseudo-terminal pair.
+These three functions accept a file descriptor that references the
+master half of a pseudo-terminal pair.
 This file descriptor is created with
-.Fn posix_openpt .
+.Xr posix_openpt 2 .
 .Pp
 The
 .Fn grantpt
@@ -77,9 +72,7 @@ of the calling process, and the permissions are set to
 user readable-writable and group writable.
 The group owner of the slave device is also set to the
 group
-.Dq Li tty
-if it exists on the system; otherwise, it
-is left untouched.
+.Dq Li tty .
 .Pp
 The
 .Fn ptsname
@@ -88,7 +81,7 @@ counterpart to the master device specified with
 .Fa fildes .
 This value can be used
 to subsequently open the appropriate slave after
-.Fn posix_openpt
+.Xr posix_openpt 2
 and
 .Fn grantpt
 have been called.
@@ -98,22 +91,6 @@ The
 function clears the lock held on the pseudo-terminal pair
 for the master device specified with
 .Fa fildes .
-.Pp
-The
-.Fn posix_openpt
-function opens the first available master pseudo-terminal
-device and returns a descriptor to it.
-The
-.Fa mode
-argument
-specifies the flags used for opening the device:
-.Bl -tag -width ".Dv O_NOCTTY"
-.It Dv O_RDWR
-Open for reading and writing.
-.It Dv O_NOCTTY
-If set, do not allow the terminal to become
-the controlling terminal for the calling process.
-.El
 .Sh RETURN VALUES
 .Rv -std grantpt unlockpt
 .Pp
@@ -122,27 +99,19 @@ The
 function returns a pointer to the name
 of the slave device on success; otherwise a
 .Dv NULL
-pointer is returned and the global variable
-.Va errno
-is set to indicate the error.
-.Pp
-The
-.Fn posix_openpt
-function returns a file descriptor to the first
-available master pseudo-terminal device on success;
-otherwise \-1 is returned and the global variable
-.Va errno
-is set to indicate the error.
+pointer is returned.
 .Sh ERRORS
 The
-.Fn grantpt ,
-.Fn ptsname ,
+.Fn grantpt
 and
 .Fn unlockpt
 functions may fail and set
 .Va errno
 to:
 .Bl -tag -width Er
+.It Bq Er EBADF
+.Fa fildes
+is not a valid open file descriptor.
 .It Bq Er EINVAL
 .Fa fildes
 is not a master pseudo-terminal device.
@@ -157,69 +126,35 @@ to:
 .It Bq Er EACCES
 The slave pseudo-terminal device could not be accessed.
 .El
-.Pp
-The
-.Fn posix_openpt
-function may fail and set
-.Va errno
-to:
-.Bl -tag -width Er
-.It Bq Er EINVAL
-.Fa mode
-consists of an invalid mode bit.
-.It Bq Er EAGAIN
-The system has no available pseudo-terminal devices.
-.El
-.Pp
-The
-.Fn grantpt ,
-.Fn ptsname ,
-and
-.Fn unlockpt
-functions may also fail and set
-.Va errno
-for any of the errors specified for the
-.Xr fstat 2
-system call.
-.Pp
-The
-.Fn posix_openpt
-function may also fail and set
-.Va errno
-for any of the errors specified for the
-.Xr open 2
-system call.
 .Sh SEE ALSO
-.Xr open 2 ,
-.Xr pty 4 ,
+.Xr posix_openpt 2 ,
+.Xr pts 4 ,
 .Xr tty 4
 .Sh STANDARDS
 The
 .Fn grantpt ,
-.Fn ptsname ,
-.Fn unlockpt ,
+.Fn ptsname
 and
-.Fn posix_openpt
+.Fn unlockpt
 functions conform to
 .St -p1003.1-2001 .
 .Sh HISTORY
 The
 .Fn grantpt ,
-.Fn ptsname ,
-.Fn unlockpt ,
+.Fn ptsname
 and
-.Fn posix_openpt
+.Fn unlockpt
 functions appeared in
 .Fx 5.0 .
 .Sh NOTES
 The purpose of the
+.Fn grantpt
+and
 .Fn unlockpt
-function has no meaning in
-.Fx .
-.Pp
-The flag
-.Dv O_NOCTTY
-is included for compatibility; in
+functions has no meaning in
 .Fx ,
-opening a terminal does not cause it to become
-a process's controlling terminal.
+because pseudo-terminals obtained by
+.Xr posix_openpt 2
+are created on demand.
+Because these devices are created with proper permissions in place, they
+are guaranteed to be unused by unprivileged processes.
diff --git a/lib/libc/stdlib/ptsname.c b/lib/libc/stdlib/ptsname.c
new file mode 100644
index 0000000..fa606f6
--- /dev/null
+++ b/lib/libc/stdlib/ptsname.c
@@ -0,0 +1,95 @@
+/*-
+ * Copyright (c) 2008 Ed Schouten <ed@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Portions of this software were developed under sponsorship from Snow
+ * B.V., the Netherlands.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+#ifndef lint
+__FBSDID("$FreeBSD$");
+#endif /* not lint */
+
+#include "namespace.h"
+#include <sys/param.h>
+#include <sys/ioctl.h>
+
+#include <errno.h>
+#include <paths.h>
+#include "un-namespace.h"
+
+/*
+ * __isptmaster():  return whether the file descriptor refers to a
+ *                  pseudo-terminal master device.
+ */
+static int
+__isptmaster(int fildes)
+{
+
+	if (_ioctl(fildes, TIOCPTMASTER) == 0)
+		return (0);
+
+	if (errno != EBADF)
+		errno = EINVAL;
+
+	return (-1);
+}
+
+/*
+ * In our implementation, grantpt() and unlockpt() don't actually have
+ * any use, because PTY's are created on the fly and already have proper
+ * permissions upon creation.
+ *
+ * Just make sure `fildes' actually points to a real PTY master device.
+ */
+__strong_reference(__isptmaster, grantpt);
+__strong_reference(__isptmaster, unlockpt);
+
+/*
+ * ptsname():  return the pathname of the slave pseudo-terminal device
+ *             associated with the specified master.
+ */
+char *
+ptsname(int fildes)
+{
+	static char pt_slave[sizeof _PATH_DEV + SPECNAMELEN] = _PATH_DEV;
+	struct fiodgname_arg fgn;
+	char *ret = NULL;
+	int sverrno = errno;
+
+	/* Make sure fildes points to a master device. */
+	if (__isptmaster(fildes) != 0)
+		goto done;
+	
+	/* Obtain the device name through FIODGNAME. */
+	fgn.len = sizeof pt_slave - (sizeof _PATH_DEV - 1);
+	fgn.buf = pt_slave + (sizeof _PATH_DEV - 1);
+	if (_ioctl(fildes, FIODGNAME, &fgn) == 0)
+		ret = pt_slave;
+
+done:	/* Make sure ptsname() does not overwrite errno. */
+	errno = sverrno;
+	return (ret);
+}