1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 /*      Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T     */
  26 /*        All Rights Reserved   */
  27 
  28 
  29 
  30 /*
  31  * Pseudo Terminal Slave Driver.
  32  *
  33  * The pseudo-tty subsystem simulates a terminal connection, where the master
  34  * side represents the terminal and the slave represents the user process's
  35  * special device end point. The master device is set up as a cloned device
  36  * where its major device number is the major for the clone device and its minor
  37  * device number is the major for the ptm driver. There are no nodes in the file
  38  * system for master devices. The master pseudo driver is opened using the
  39  * open(2) system call with /dev/ptmx as the device parameter.  The clone open
  40  * finds the next available minor device for the ptm major device.
  41  *
  42  * A master device is available only if it and its corresponding slave device
  43  * are not already open. When the master device is opened, the corresponding
  44  * slave device is automatically locked out. Only one open is allowed on a
  45  * master device.  Multiple opens are allowed on the slave device.  After both
  46  * the master and slave have been opened, the user has two file descriptors
  47  * which are the end points of a full duplex connection composed of two streams
  48  * which are automatically connected at the master and slave drivers. The user
  49  * may then push modules onto either side of the stream pair.
  50  *
  51  * The master and slave drivers pass all messages to their adjacent queues.
  52  * Only the M_FLUSH needs some processing.  Because the read queue of one side
  53  * is connected to the write queue of the other, the FLUSHR flag is changed to
  54  * the FLUSHW flag and vice versa. When the master device is closed an M_HANGUP
  55  * message is sent to the slave device which will render the device
  56  * unusable. The process on the slave side gets the EIO when attempting to write
  57  * on that stream but it will be able to read any data remaining on the stream
  58  * head read queue.  When all the data has been read, read() returns 0
  59  * indicating that the stream can no longer be used.  On the last close of the
  60  * slave device, a 0-length message is sent to the master device. When the
  61  * application on the master side issues a read() or getmsg() and 0 is returned,
  62  * the user of the master device decides whether to issue a close() that
  63  * dismantles the pseudo-terminal subsystem. If the master device is not closed,
  64  * the pseudo-tty subsystem will be available to another user to open the slave
  65  * device.
  66  *
  67  * Synchronization:
  68  *
  69  *   All global data synchronization between ptm/pts is done via global
  70  *   ptms_lock mutex which is initialized at system boot time from
  71  *   ptms_initspace (called from space.c).
  72  *
  73  *   Individual fields of pt_ttys structure (except ptm_rdq, pts_rdq and
  74  *   pt_nullmsg) are protected by pt_ttys.pt_lock mutex.
  75  *
  76  *   PT_ENTER_READ/PT_ENTER_WRITE are reference counter based read-write locks
  77  *   which allow reader locks to be reacquired by the same thread (usual
  78  *   reader/writer locks can't be used for that purpose since it is illegal for
  79  *   a thread to acquire a lock it already holds, even as a reader). The sole
  80  *   purpose of these macros is to guarantee that the peer queue will not
  81  *   disappear (due to closing peer) while it is used. It is safe to use
  82  *   PT_ENTER_READ/PT_EXIT_READ brackets across calls like putq/putnext (since
  83  *   they are not real locks but reference counts).
  84  *
  85  *   PT_ENTER_WRITE/PT_EXIT_WRITE brackets are used ONLY in master/slave
  86  *   open/close paths to modify ptm_rdq and pts_rdq fields. These fields should
  87  *   be set to appropriate queues *after* qprocson() is called during open (to
  88  *   prevent peer from accessing the queue with incomplete plumbing) and set to
  89  *   NULL before qprocsoff() is called during close.
  90  *
  91  *   The pt_nullmsg field is only used in open/close routines and it is also
  92  *   protected by PT_ENTER_WRITE/PT_EXIT_WRITE brackets to avoid extra mutex
  93  *   holds.
  94  *
  95  * Lock Ordering:
  96  *
  97  *   If both ptms_lock and per-pty lock should be held, ptms_lock should always
  98  *   be entered first, followed by per-pty lock.
  99  *
 100  * See ptms.h, ptm.c and ptms_conf.c fore more information.
 101  *
 102  */
 103 
 104 #include <sys/types.h>
 105 #include <sys/param.h>
 106 #include <sys/sysmacros.h>
 107 #include <sys/stream.h>
 108 #include <sys/stropts.h>
 109 #include <sys/stat.h>
 110 #include <sys/errno.h>
 111 #include <sys/debug.h>
 112 #include <sys/cmn_err.h>
 113 #include <sys/ptms.h>
 114 #include <sys/systm.h>
 115 #include <sys/modctl.h>
 116 #include <sys/conf.h>
 117 #include <sys/ddi.h>
 118 #include <sys/sunddi.h>
 119 #include <sys/cred.h>
 120 #include <sys/zone.h>
 121 
 122 #ifdef DEBUG
 123 int pts_debug = 0;
 124 #define DBG(a)   if (pts_debug) cmn_err(CE_NOTE, a)
 125 #else
 126 #define DBG(a)
 127 #endif
 128 
 129 static int ptsopen(queue_t *, dev_t *, int, int, cred_t *);
 130 static int ptsclose(queue_t *, int, cred_t *);
 131 static void ptswput(queue_t *, mblk_t *);
 132 static void ptsrsrv(queue_t *);
 133 static void ptswsrv(queue_t *);
 134 
 135 /*
 136  * Slave Stream Pseudo Terminal Module: stream data structure definitions
 137  */
 138 static struct module_info pts_info = {
 139         0xface,
 140         "pts",
 141         0,
 142         512,
 143         512,
 144         128
 145 };
 146 
 147 static struct qinit ptsrint = {
 148         NULL,
 149         (int (*)()) ptsrsrv,
 150         ptsopen,
 151         ptsclose,
 152         NULL,
 153         &pts_info,
 154         NULL
 155 };
 156 
 157 static struct qinit ptswint = {
 158         (int (*)()) ptswput,
 159         (int (*)()) ptswsrv,
 160         NULL,
 161         NULL,
 162         NULL,
 163         &pts_info,
 164         NULL
 165 };
 166 
 167 static struct streamtab ptsinfo = {
 168         &ptsrint,
 169         &ptswint,
 170         NULL,
 171         NULL
 172 };
 173 
 174 static int pts_devinfo(dev_info_t *, ddi_info_cmd_t, void *, void **);
 175 static int pts_attach(dev_info_t *, ddi_attach_cmd_t);
 176 static int pts_detach(dev_info_t *, ddi_detach_cmd_t);
 177 
 178 #define PTS_CONF_FLAG   (D_NEW | D_MP)
 179 
 180 /*
 181  * this will define (struct cb_ops cb_pts_ops) and (struct dev_ops pts_ops)
 182  */
 183 DDI_DEFINE_STREAM_OPS(pts_ops, nulldev, nulldev,        \
 184         pts_attach, pts_detach, nodev,                  \
 185         pts_devinfo, PTS_CONF_FLAG, &ptsinfo, ddi_quiesce_not_supported);
 186 
 187 /*
 188  * Module linkage information for the kernel.
 189  */
 190 
 191 static struct modldrv modldrv = {
 192         &mod_driverops, /* Type of module.  This one is a pseudo driver */
 193         "Slave Stream Pseudo Terminal driver 'pts'",
 194         &pts_ops,   /* driver ops */
 195 };
 196 
 197 static struct modlinkage modlinkage = {
 198         MODREV_1,
 199         { &modldrv, NULL }
 200 };
 201 
 202 int
 203 _init(void)
 204 {
 205         int rc;
 206 
 207         if ((rc = mod_install(&modlinkage)) == 0)
 208                 ptms_init();
 209         return (rc);
 210 }
 211 
 212 
 213 int
 214 _fini(void)
 215 {
 216         return (mod_remove(&modlinkage));
 217 }
 218 
 219 int
 220 _info(struct modinfo *modinfop)
 221 {
 222         return (mod_info(&modlinkage, modinfop));
 223 }
 224 
 225 static int
 226 pts_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
 227 {
 228         if (cmd != DDI_ATTACH)
 229                 return (DDI_FAILURE);
 230 
 231         mutex_enter(&ptms_lock);
 232         pts_dip = devi;
 233         mutex_exit(&ptms_lock);
 234 
 235         return (DDI_SUCCESS);
 236 }
 237 
 238 /*ARGSUSED*/
 239 static int
 240 pts_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
 241 {
 242         if (cmd != DDI_DETACH)
 243                 return (DDI_FAILURE);
 244 
 245         /*
 246          * For now, pts cannot be detached.
 247          */
 248         return (DDI_FAILURE);
 249 }
 250 
 251 /*ARGSUSED*/
 252 static int
 253 pts_devinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg,
 254     void **result)
 255 {
 256         int error;
 257 
 258         switch (infocmd) {
 259         case DDI_INFO_DEVT2DEVINFO:
 260                 if (pts_dip == NULL) {
 261                         error = DDI_FAILURE;
 262                 } else {
 263                         *result = (void *)pts_dip;
 264                         error = DDI_SUCCESS;
 265                 }
 266                 break;
 267         case DDI_INFO_DEVT2INSTANCE:
 268                 *result = (void *)0;
 269                 error = DDI_SUCCESS;
 270                 break;
 271         default:
 272                 error = DDI_FAILURE;
 273         }
 274         return (error);
 275 }
 276 
 277 /* ARGSUSED */
 278 /*
 279  * Open the slave device. Reject a clone open and do not allow the
 280  * driver to be pushed. If the slave/master pair is locked or if
 281  * the master is not open, return EACCESS.
 282  * Upon success, store the write queue pointer in private data and
 283  * set the PTSOPEN bit in the pt_state field.
 284  */
 285 static int
 286 ptsopen(
 287         queue_t *rqp,           /* pointer to the read side queue */
 288         dev_t   *devp,          /* pointer to stream tail's dev */
 289         int     oflag,          /* the user open(2) supplied flags */
 290         int     sflag,          /* open state flag */
 291         cred_t  *credp)         /* credentials */
 292 {
 293         struct pt_ttys  *ptsp;
 294         mblk_t          *mp;
 295         mblk_t          *mop;   /* ptr to a setopts message block */
 296         minor_t         dminor = getminor(*devp);
 297         struct stroptions *sop;
 298 
 299         DDBG("entering ptsopen(%d)", dminor);
 300 
 301         if (sflag != 0) {
 302                 return (EINVAL);
 303         }
 304 
 305         mutex_enter(&ptms_lock);
 306         ptsp = ptms_minor2ptty(dminor);
 307 
 308         if (ptsp == NULL) {
 309                 mutex_exit(&ptms_lock);
 310                 return (ENXIO);
 311         }
 312         mutex_enter(&ptsp->pt_lock);
 313 
 314         /*
 315          * Prevent opens from zones other than the one blessed by ptm.  We
 316          * can't even allow the global zone to open all pts's, as it would
 317          * otherwise inproperly be able to claim pts's already opened by zones.
 318          */
 319         if (ptsp->pt_zoneid != getzoneid()) {
 320                 mutex_exit(&ptsp->pt_lock);
 321                 mutex_exit(&ptms_lock);
 322                 return (EPERM);
 323         }
 324 
 325         /*
 326          * Allow reopen of this device.
 327          */
 328         if (rqp->q_ptr != NULL) {
 329                 ASSERT(rqp->q_ptr == ptsp);
 330                 ASSERT(ptsp->pts_rdq == rqp);
 331                 mutex_exit(&ptsp->pt_lock);
 332                 mutex_exit(&ptms_lock);
 333                 return (0);
 334         }
 335 
 336         DDBGP("ptsopen: p = %p\n", (uintptr_t)ptsp);
 337         DDBG("ptsopen: state = %x\n", ptsp->pt_state);
 338 
 339 
 340         ASSERT(ptsp->pt_minor == dminor);
 341 
 342         if ((ptsp->pt_state & PTLOCK) || !(ptsp->pt_state & PTMOPEN)) {
 343                 mutex_exit(&ptsp->pt_lock);
 344                 mutex_exit(&ptms_lock);
 345                 return (EAGAIN);
 346         }
 347 
 348         /*
 349          * if already, open simply return...
 350          */
 351         if (ptsp->pt_state & PTSOPEN) {
 352                 ASSERT(rqp->q_ptr == ptsp);
 353                 ASSERT(ptsp->pts_rdq == rqp);
 354                 mutex_exit(&ptsp->pt_lock);
 355                 mutex_exit(&ptms_lock);
 356                 return (0);
 357         }
 358 
 359         /*
 360          * Allocate message block for setting stream head options.
 361          */
 362         if ((mop = allocb(sizeof (struct stroptions), BPRI_MED)) == NULL) {
 363                 mutex_exit(&ptsp->pt_lock);
 364                 mutex_exit(&ptms_lock);
 365                 return (ENOMEM);
 366         }
 367 
 368         /*
 369          * Slave should send zero-length message to a master when it is
 370          * closing. If memory is low at that time, master will not detect slave
 371          * closes, this pty will not be deallocated. So, preallocate this
 372          * zero-length message block early.
 373          */
 374         if ((mp = allocb(0, BPRI_MED)) == NULL) {
 375                 mutex_exit(&ptsp->pt_lock);
 376                 mutex_exit(&ptms_lock);
 377                 freemsg(mop);
 378                 return (ENOMEM);
 379         }
 380 
 381         ptsp->pt_state |= PTSOPEN;
 382 
 383         WR(rqp)->q_ptr = rqp->q_ptr = ptsp;
 384 
 385         mutex_exit(&ptsp->pt_lock);
 386         mutex_exit(&ptms_lock);
 387 
 388         qprocson(rqp);
 389 
 390         /*
 391          * After qprocson pts driver is fully plumbed into the stream and can
 392          * send/receive messages. Setting pts_rdq will allow master side to send
 393          * messages to the slave. This setting can't occur before qprocson() is
 394          * finished because slave is not ready to process them.
 395          */
 396         PT_ENTER_WRITE(ptsp);
 397         ptsp->pts_rdq = rqp;
 398         ASSERT(ptsp->pt_nullmsg == NULL);
 399         ptsp->pt_nullmsg = mp;
 400         PT_EXIT_WRITE(ptsp);
 401 
 402         /*
 403          * set up hi/lo water marks on stream head read queue
 404          * and add controlling tty if not set
 405          */
 406 
 407         mop->b_datap->db_type = M_SETOPTS;
 408         mop->b_wptr += sizeof (struct stroptions);
 409         sop = (struct stroptions *)mop->b_rptr;
 410         sop->so_flags = SO_HIWAT | SO_LOWAT | SO_ISTTY;
 411         sop->so_hiwat = 512;
 412         sop->so_lowat = 256;
 413         putnext(rqp, mop);
 414 
 415         return (0);
 416 }
 417 
 418 
 419 
 420 /*
 421  * Find the address to private data identifying the slave's write
 422  * queue. Send a 0-length msg up the slave's read queue to designate
 423  * the master is closing. Uattach the master from the slave by nulling
 424  * out master's write queue field in private data.
 425  */
 426 /*ARGSUSED1*/
 427 static int
 428 ptsclose(queue_t *rqp, int flag, cred_t *credp)
 429 {
 430         struct pt_ttys  *ptsp;
 431         queue_t *wqp;
 432         mblk_t  *mp;
 433         mblk_t  *bp;
 434 
 435         /*
 436          * q_ptr should never be NULL in the close routine and it is checked in
 437          * DEBUG kernel by ASSERT. For non-DEBUG kernel the attempt is made to
 438          * behave gracefully.
 439          */
 440         ASSERT(rqp->q_ptr != NULL);
 441         if (rqp->q_ptr == NULL) {
 442                 qprocsoff(rqp);
 443                 return (0);
 444         }
 445 
 446         ptsp = (struct pt_ttys *)rqp->q_ptr;
 447 
 448         /*
 449          * Slave is going to close and doesn't want any new  messages coming
 450          * from the master side, so set pts_rdq to NULL. This should be done
 451          * before call to qprocsoff() since slave can't process additional
 452          * messages from the master after qprocsoff is called.
 453          */
 454         PT_ENTER_WRITE(ptsp);
 455         mp = ptsp->pt_nullmsg;
 456         ptsp->pt_nullmsg = NULL;
 457         ptsp->pts_rdq = NULL;
 458         PT_EXIT_WRITE(ptsp);
 459 
 460         /*
 461          * Drain the ouput
 462          */
 463         wqp = WR(rqp);
 464         PT_ENTER_READ(ptsp);
 465         while ((bp = getq(wqp)) != NULL) {
 466                 if (ptsp->ptm_rdq) {
 467                         putnext(ptsp->ptm_rdq, bp);
 468                 } else if (bp->b_datap->db_type == M_IOCTL) {
 469                         bp->b_datap->db_type = M_IOCNAK;
 470                         freemsg(bp->b_cont);
 471                         bp->b_cont = NULL;
 472                         qreply(wqp, bp);
 473                 } else {
 474                         freemsg(bp);
 475                 }
 476         }
 477         /*
 478          * qenable master side write queue so that it can flush
 479          * its messages as slaves's read queue is going away
 480          */
 481         if (ptsp->ptm_rdq) {
 482                 if (mp)
 483                         putnext(ptsp->ptm_rdq, mp);
 484                 else
 485                         qenable(WR(ptsp->ptm_rdq));
 486         } else
 487                 freemsg(mp);
 488         PT_EXIT_READ(ptsp);
 489 
 490         qprocsoff(rqp);
 491 
 492         rqp->q_ptr = NULL;
 493         WR(rqp)->q_ptr = NULL;
 494 
 495         ptms_close(ptsp, PTSOPEN | PTSTTY);
 496 
 497         return (0);
 498 }
 499 
 500 
 501 /*
 502  * The wput procedure will only handle flush messages.
 503  * All other messages are queued and the write side
 504  * service procedure sends them off to the master side.
 505  */
 506 static void
 507 ptswput(queue_t *qp, mblk_t *mp)
 508 {
 509         struct pt_ttys *ptsp;
 510         struct iocblk  *iocp;
 511         unsigned char type = mp->b_datap->db_type;
 512 
 513         DBG(("entering ptswput\n"));
 514         ASSERT(qp->q_ptr);
 515 
 516         ptsp = (struct pt_ttys *)qp->q_ptr;
 517         PT_ENTER_READ(ptsp);
 518         if (ptsp->ptm_rdq == NULL) {
 519                 DBG(("in write put proc but no master\n"));
 520                 /*
 521                  * NAK ioctl as slave side read queue is gone.
 522                  * Or else free the message.
 523                  */
 524                 if (mp->b_datap->db_type == M_IOCTL) {
 525                         mp->b_datap->db_type = M_IOCNAK;
 526                         freemsg(mp->b_cont);
 527                         mp->b_cont = NULL;
 528                         qreply(qp, mp);
 529                 } else
 530                         freemsg(mp);
 531                 PT_EXIT_READ(ptsp);
 532                 return;
 533         }
 534 
 535         if (type >= QPCTL) {
 536                 switch (type) {
 537 
 538                 /*
 539                  * if write queue request, flush slave's write
 540                  * queue and send FLUSHR to ptm. If read queue
 541                  * request, send FLUSHR to ptm.
 542                  */
 543                 case M_FLUSH:
 544                 DBG(("pts got flush request\n"));
 545                 if (*mp->b_rptr & FLUSHW) {
 546 
 547                         DBG(("got FLUSHW, flush pts write Q\n"));
 548                         if (*mp->b_rptr & FLUSHBAND)
 549                                 /*
 550                                  * if it is a FLUSHBAND, do flushband.
 551                                  */
 552                                 flushband(qp, *(mp->b_rptr + 1), FLUSHDATA);
 553                         else
 554                                 flushq(qp, FLUSHDATA);
 555 
 556                         *mp->b_rptr &= ~FLUSHW;
 557                         if ((*mp->b_rptr & FLUSHR) == 0) {
 558                                 /*
 559                                  * FLUSHW only. Change to FLUSHR and putnext
 560                                  * to ptm, then we are done.
 561                                  */
 562                                 *mp->b_rptr |= FLUSHR;
 563                                 if (ptsp->ptm_rdq)
 564                                         putnext(ptsp->ptm_rdq, mp);
 565                                 break;
 566                         } else {
 567                                 mblk_t *nmp;
 568 
 569                                 /* It is a FLUSHRW. Duplicate the mblk */
 570                                 nmp = copyb(mp);
 571                                 if (nmp) {
 572                                         /*
 573                                          * Change FLUSHW to FLUSHR before
 574                                          * putnext to ptm.
 575                                          */
 576                                         DBG(("putnext nmp(FLUSHR) to ptm\n"));
 577                                         *nmp->b_rptr |= FLUSHR;
 578                                         if (ptsp->ptm_rdq)
 579                                                 putnext(ptsp->ptm_rdq, nmp);
 580                                 }
 581                         }
 582                 }
 583                 /*
 584                  * Since the packet module will toss any
 585                  * M_FLUSHES sent to the master's stream head
 586                  * read queue, we simply turn it around here.
 587                  */
 588                 if (*mp->b_rptr & FLUSHR) {
 589                         ASSERT(RD(qp)->q_first == NULL);
 590                         DBG(("qreply(qp) turning FLUSHR around\n"));
 591                         qreply(qp, mp);
 592                 } else {
 593                         freemsg(mp);
 594                 }
 595                 break;
 596 
 597                 case M_READ:
 598                 /* Caused by ldterm - can not pass to master */
 599                 freemsg(mp);
 600                 break;
 601 
 602                 default:
 603                 if (ptsp->ptm_rdq)
 604                         putnext(ptsp->ptm_rdq, mp);
 605                 break;
 606                 }
 607                 PT_EXIT_READ(ptsp);
 608                 return;
 609         }
 610 
 611         switch (type) {
 612 
 613         case M_IOCTL:
 614                 /*
 615                  * For case PTSSTTY set the flag PTSTTY and ACK
 616                  * the ioctl so that the user program can push
 617                  * the associated modules to get tty semantics.
 618                  * See bugid 4025044
 619                  */
 620                 iocp = (struct iocblk *)mp->b_rptr;
 621                 switch (iocp->ioc_cmd) {
 622                 default:
 623                         break;
 624 
 625                 case PTSSTTY:
 626                         if (ptsp->pt_state & PTSTTY) {
 627                                 mp->b_datap->db_type = M_IOCNAK;
 628                                 iocp->ioc_error = EEXIST;
 629                         } else {
 630                                 mp->b_datap->db_type = M_IOCACK;
 631                                 mutex_enter(&ptsp->pt_lock);
 632                                 ptsp->pt_state |= PTSTTY;
 633                                 mutex_exit(&ptsp->pt_lock);
 634                                 iocp->ioc_error = 0;
 635                         }
 636                         iocp->ioc_count = 0;
 637                         qreply(qp, mp);
 638                         PT_EXIT_READ(ptsp);
 639                         return;
 640                 }
 641 
 642         default:
 643                 /*
 644                  * send other messages to the master
 645                  */
 646                 DBG(("put msg on slave's write queue\n"));
 647                 (void) putq(qp, mp);
 648                 break;
 649         }
 650 
 651         PT_EXIT_READ(ptsp);
 652         DBG(("return from ptswput()\n"));
 653 }
 654 
 655 
 656 /*
 657  * enable the write side of the master. This triggers the
 658  * master to send any messages queued on its write side to
 659  * the read side of this slave.
 660  */
 661 static void
 662 ptsrsrv(queue_t *qp)
 663 {
 664         struct pt_ttys *ptsp;
 665 
 666         DBG(("entering ptsrsrv\n"));
 667         ASSERT(qp->q_ptr);
 668 
 669         ptsp = (struct pt_ttys *)qp->q_ptr;
 670         PT_ENTER_READ(ptsp);
 671         if (ptsp->ptm_rdq == NULL) {
 672                 DBG(("in read srv proc but no master\n"));
 673                 PT_EXIT_READ(ptsp);
 674                 return;
 675         }
 676         qenable(WR(ptsp->ptm_rdq));
 677         PT_EXIT_READ(ptsp);
 678         DBG(("leaving ptsrsrv\n"));
 679 }
 680 
 681 /*
 682  * If there are messages on this queue that can be sent to
 683  * master, send them via putnext(). Else, if queued messages
 684  * cannot be sent, leave them on this queue. If priority
 685  * messages on this queue, send them to master no matter what.
 686  */
 687 static void
 688 ptswsrv(queue_t *qp)
 689 {
 690         struct pt_ttys *ptsp;
 691         queue_t *ptm_rdq;
 692         mblk_t *mp;
 693 
 694         DBG(("entering ptswsrv\n"));
 695         ASSERT(qp->q_ptr);
 696 
 697         ptsp = (struct pt_ttys *)qp->q_ptr;
 698         PT_ENTER_READ(ptsp);
 699         if (ptsp->ptm_rdq == NULL) {
 700                 DBG(("in write srv proc but no master\n"));
 701                 /*
 702                  * Free messages on the write queue and send
 703                  * NAK for any M_IOCTL type messages to wakeup
 704                  * the user process waiting for ACK/NAK from
 705                  * the ioctl invocation
 706                  */
 707                 while ((mp = getq(qp)) != NULL) {
 708                         if (mp->b_datap->db_type == M_IOCTL) {
 709                                 mp->b_datap->db_type = M_IOCNAK;
 710                                 freemsg(mp->b_cont);
 711                                 mp->b_cont = NULL;
 712                                 qreply(qp, mp);
 713                         } else
 714                                 freemsg(mp);
 715                 }
 716                 PT_EXIT_READ(ptsp);
 717                 return;
 718         } else {
 719                 ptm_rdq = ptsp->ptm_rdq;
 720         }
 721 
 722         /*
 723          * while there are messages on this write queue...
 724          */
 725         while ((mp = getq(qp)) != NULL) {
 726                 /*
 727                  * if don't have control message and cannot put
 728                  * msg. on master's read queue, put it back on
 729                  * this queue.
 730                  */
 731                 if (mp->b_datap->db_type <= QPCTL &&
 732                     !bcanputnext(ptm_rdq, mp->b_band)) {
 733                         DBG(("put msg. back on Q\n"));
 734                         (void) putbq(qp, mp);
 735                         break;
 736                 }
 737                 /*
 738                  * else send the message up master's stream
 739                  */
 740                 DBG(("send message to master\n"));
 741                 putnext(ptm_rdq, mp);
 742         }
 743         DBG(("leaving ptswsrv\n"));
 744         PT_EXIT_READ(ptsp);
 745 }