xref: /dragonfly/sys/kern/tty_pty.c (revision 50b09fda)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
32  * $FreeBSD: src/sys/kern/tty_pty.c,v 1.74.2.4 2002/02/20 19:58:13 dillon Exp $
33  */
34 
35 /*
36  * Most functions here could use a separate lock to deal with concurrent
37  * access to the 'pt's.
38  */
39 
40 /*
41  * Pseudo-teletype Driver
42  * (Actually two drivers, requiring two dev_ops structures)
43  */
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/proc.h>
48 #include <sys/priv.h>
49 #include <sys/tty.h>
50 #include <sys/ttydefaults.h>	/* for TTYDEF_* */
51 #include <sys/conf.h>
52 #include <sys/fcntl.h>
53 #include <sys/kernel.h>
54 #include <sys/vnode.h>
55 #include <sys/signalvar.h>
56 #include <sys/malloc.h>
57 #include <sys/device.h>
58 #include <sys/thread2.h>
59 #include <sys/devfs.h>
60 #include <sys/stat.h>
61 #include <sys/sysctl.h>
62 
63 MALLOC_DEFINE(M_PTY, "ptys", "pty data structures");
64 
65 static void ptsstart (struct tty *tp);
66 static void ptsstop (struct tty *tp, int rw);
67 static void ptsunhold (struct tty *tp);
68 static void ptcwakeup (struct tty *tp, int flag);
69 static void ptyinit (int n);
70 static int  filt_ptcread (struct knote *kn, long hint);
71 static void filt_ptcrdetach (struct knote *kn);
72 static int  filt_ptcwrite (struct knote *kn, long hint);
73 static void filt_ptcwdetach (struct knote *kn);
74 
75 static	d_open_t	ptsopen;
76 static	d_close_t	ptsclose;
77 static	d_read_t	ptsread;
78 static	d_write_t	ptswrite;
79 static	d_ioctl_t	ptyioctl;
80 static	d_open_t	ptcopen;
81 static	d_close_t	ptcclose;
82 static	d_read_t	ptcread;
83 static	d_write_t	ptcwrite;
84 static	d_kqfilter_t	ptckqfilter;
85 
86 DEVFS_DEFINE_CLONE_BITMAP(pty);
87 static struct pt_ioctl **ptis;		/* keep pti's intact */
88 
89 static	d_clone_t 	ptyclone;
90 
91 static int	pty_debug_level = 0;
92 
93 static struct dev_ops pts98_ops = {
94 	{ "pts98", 0, D_TTY | D_MPSAFE },
95 	.d_open =	ptsopen,
96 	.d_close =	ptsclose,
97 	.d_read =	ptsread,
98 	.d_write =	ptswrite,
99 	.d_ioctl =	ptyioctl,
100 	.d_kqfilter =	ttykqfilter,
101 	.d_revoke =	ttyrevoke
102 };
103 
104 static struct dev_ops ptc98_ops = {
105 	{ "ptc98", 0, D_TTY | D_MASTER | D_MPSAFE },
106 	.d_open =	ptcopen,
107 	.d_close =	ptcclose,
108 	.d_read =	ptcread,
109 	.d_write =	ptcwrite,
110 	.d_ioctl =	ptyioctl,
111 	.d_kqfilter =	ptckqfilter,
112 	.d_revoke =	ttyrevoke
113 };
114 
115 static struct dev_ops pts_ops = {
116 	{ "pts", 0, D_TTY | D_MPSAFE },
117 	.d_open =	ptsopen,
118 	.d_close =	ptsclose,
119 	.d_read =	ptsread,
120 	.d_write =	ptswrite,
121 	.d_ioctl =	ptyioctl,
122 	.d_kqfilter =	ttykqfilter,
123 	.d_revoke =	ttyrevoke
124 };
125 
126 #define	CDEV_MAJOR_C	6
127 static struct dev_ops ptc_ops = {
128 	{ "ptc", 0, D_TTY | D_MASTER | D_MPSAFE },
129 	.d_open =	ptcopen,
130 	.d_close =	ptcclose,
131 	.d_read =	ptcread,
132 	.d_write =	ptcwrite,
133 	.d_ioctl =	ptyioctl,
134 	.d_kqfilter =	ptckqfilter,
135 	.d_revoke =	ttyrevoke
136 };
137 
138 #define BUFSIZ	100		/* Chunk size iomoved to/from user */
139 
140 #define MAXPTYS	1000		/* Maximum cloneable ptys */
141 
142 struct	pt_ioctl {
143 	int	pt_flags;
144 	int	pt_refs;	/* Structural references interlock S/MOPEN */
145 	int	pt_uminor;
146 	struct	kqinfo pt_kqr, pt_kqw;
147 	u_char	pt_send;
148 	u_char	pt_ucntl;
149 	struct tty pt_tty;
150 	cdev_t	devs, devc;
151 	struct	prison *pt_prison;
152 };
153 
154 /*
155  * pt_flags ptc state
156  */
157 #define	PF_PKT		0x0008		/* packet mode */
158 #define	PF_STOPPED	0x0010		/* user told stopped */
159 #define	PF_REMOTE	0x0020		/* remote and flow controlled input */
160 #define	PF_NOSTOP	0x0040
161 #define PF_UCNTL	0x0080		/* user control mode */
162 
163 #define PF_PTCSTATEMASK	0x00FF
164 
165 /*
166  * pt_flags open state.  Note that PF_SCLOSED is used to activate
167  * read EOF on the ptc so it is only set after the slave has been
168  * opened and then closed, and cleared again if the slave is opened
169  * again.
170  */
171 #define	PF_UNIX98	0x0100
172 #define	PF_SOPEN	0x0200
173 #define	PF_MOPEN	0x0400
174 #define PF_SCLOSED	0x0800
175 #define PF_TERMINATED	0x8000
176 
177 /*
178  * This function creates and initializes a pts/ptc pair
179  *
180  * pts == /dev/tty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
181  * ptc == /dev/pty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
182  *
183  * XXX: define and add mapping of upper minor bits to allow more
184  *      than 256 ptys.
185  */
186 static void
187 ptyinit(int n)
188 {
189 	cdev_t devs, devc;
190 	char *names = "pqrsPQRS";
191 	struct pt_ioctl *pti;
192 
193 	/* For now we only map the lower 8 bits of the minor */
194 	if (n & ~0xff)
195 		return;
196 
197 	pti = kmalloc(sizeof(*pti), M_PTY, M_WAITOK | M_ZERO);
198 	pti->devs = devs = make_dev(&pts_ops, n, 0, 0, 0666,
199 				    "tty%c%c",
200 				    names[n / 32], hex2ascii(n % 32));
201 	pti->devc = devc = make_dev(&ptc_ops, n, 0, 0, 0666,
202 				    "pty%c%c",
203 				    names[n / 32], hex2ascii(n % 32));
204 
205 	pti->pt_tty.t_dev = devs;
206 	pti->pt_uminor = n;
207 	devs->si_drv1 = devc->si_drv1 = pti;
208 	devs->si_tty = devc->si_tty = &pti->pt_tty;
209 	devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
210 	devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
211 	ttyinit(&pti->pt_tty);
212 	ttyregister(&pti->pt_tty);
213 }
214 
215 static int
216 ptyclone(struct dev_clone_args *ap)
217 {
218 	int unit;
219 	struct pt_ioctl *pti;
220 
221 	/*
222 	 * Limit the number of unix98 pty (slave) devices to 1000, as
223 	 * the utmp(5) format only allows for 8 bytes for the tty,
224 	 * "pts/XXX".
225 	 *
226 	 * If this limit is reached, we don't clone and return an error
227 	 * to devfs.
228 	 */
229 	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), MAXPTYS);
230 
231 	if (unit < 0) {
232 		ap->a_dev = NULL;
233 		return 1;
234 	}
235 
236 	/*
237 	 * pti structures must be persistent once allocated.
238 	 */
239 	if ((pti = ptis[unit]) == NULL) {
240 		lwkt_gettoken(&tty_token);
241 		pti = kmalloc(sizeof(*pti), M_PTY, M_WAITOK | M_ZERO);
242 		if (ptis[unit] == NULL) {
243 			ptis[unit] = pti;
244 			ttyinit(&pti->pt_tty);
245 		} else {
246 			kfree(pti, M_PTY);
247 		}
248 		lwkt_reltoken(&tty_token);
249 	}
250 
251 	/*
252 	 * The cloning bitmap should guarantee isolation during
253 	 * initialization.
254 	 */
255 	pti->devc = make_only_dev(&ptc98_ops, unit,
256 				  ap->a_cred->cr_ruid,
257 				  0, 0600, "ptm/%d", unit);
258 	pti->devs = make_dev(&pts98_ops, unit,
259 			     ap->a_cred->cr_ruid,
260 			     GID_TTY, 0620, "pts/%d", unit);
261 	ap->a_dev = pti->devc;
262 
263 	pti->devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
264 	pti->devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
265 
266 	pti->pt_tty.t_dev = pti->devs;
267 	pti->pt_flags = PF_UNIX98;
268 	pti->pt_uminor = unit;
269 	pti->devs->si_drv1 = pti->devc->si_drv1 = pti;
270 	pti->devs->si_tty = pti->devc->si_tty = &pti->pt_tty;
271 	ttyregister(&pti->pt_tty);
272 
273 	return 0;
274 }
275 
276 /*
277  * pti_hold() prevents the pti from being destroyed due to a termination
278  * while a pt*open() is blocked.
279  *
280  * This function returns non-zero if we cannot hold due to a termination
281  * interlock.
282  */
283 static int
284 pti_hold(struct pt_ioctl *pti)
285 {
286 	if (pti->pt_flags & PF_TERMINATED)
287 		return(ENXIO);
288 	++pti->pt_refs;
289 
290 	return(0);
291 }
292 
293 /*
294  * pti_done() releases the reference and checks to see if both sides have
295  * been closed on a unix98 pty, allowing us to destroy the device and
296  * release resources.
297  *
298  * We do not release resources on non-unix98 ptys.  Those are left
299  * statically allocated.
300  */
301 static void
302 pti_done(struct pt_ioctl *pti)
303 {
304 	lwkt_gettoken(&pti->pt_tty.t_token);
305 	if (--pti->pt_refs == 0) {
306 		cdev_t dev;
307 		int uminor_no;
308 
309 		/*
310 		 * Only unix09 ptys are freed up (the pti structure itself
311 		 * is never freed, regardless).
312 		 */
313 		if ((pti->pt_flags & PF_UNIX98) == 0) {
314 			lwkt_reltoken(&pti->pt_tty.t_token);
315 			return;
316 		}
317 
318 		/*
319 		 * Interlock open attempts against termination by setting
320 		 * PF_TERMINATED.  This allows us to block while cleaning
321 		 * out the device infrastructure.
322 		 *
323 		 * Do not terminate the tty if it still has a session
324 		 * association (t_refs).
325 		 */
326 		if ((pti->pt_flags & (PF_SOPEN|PF_MOPEN)) == 0 &&
327 		    pti->pt_tty.t_refs == 0) {
328 			pti->pt_flags |= PF_TERMINATED;
329 			uminor_no = pti->pt_uminor;
330 
331 			if ((dev = pti->devs) != NULL) {
332 				dev->si_drv1 = NULL;
333 				pti->devs = NULL;
334 				destroy_dev(dev);
335 			}
336 			if ((dev = pti->devc) != NULL) {
337 				dev->si_drv1 = NULL;
338 				pti->devc = NULL;
339 				destroy_dev(dev);
340 			}
341 			ttyunregister(&pti->pt_tty);
342 			pti->pt_tty.t_dev = NULL;
343 
344 			devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty),
345 					       uminor_no);
346 			/* pti structure remains intact */
347 		}
348 	}
349 	lwkt_reltoken(&pti->pt_tty.t_token);
350 }
351 
352 /*ARGSUSED*/
353 static	int
354 ptsopen(struct dev_open_args *ap)
355 {
356 	cdev_t dev = ap->a_head.a_dev;
357 	struct tty *tp;
358 	int error;
359 	struct pt_ioctl *pti;
360 
361 	/*
362 	 * The pti will already be assigned by the clone code or
363 	 * pre-created if a non-unix 98 pty.  If si_drv1 is NULL
364 	 * we are somehow racing a unix98 termination.
365 	 */
366 	if (dev->si_drv1 == NULL)
367 		return(ENXIO);
368 	pti = dev->si_drv1;
369 
370 	lwkt_gettoken(&pti->pt_tty.t_token);
371 	if (pti_hold(pti)) {
372 		lwkt_reltoken(&pti->pt_tty.t_token);
373 		return(ENXIO);
374 	}
375 
376 	tp = dev->si_tty;
377 
378 	/*
379 	 * Reinit most of the tty state if it isn't open.  Handle
380 	 * exclusive access.
381 	 */
382 	if ((tp->t_state & TS_ISOPEN) == 0) {
383 		ttychars(tp);		/* Set up default chars */
384 		tp->t_iflag = TTYDEF_IFLAG;
385 		tp->t_oflag = TTYDEF_OFLAG;
386 		tp->t_lflag = TTYDEF_LFLAG;
387 		tp->t_cflag = TTYDEF_CFLAG;
388 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
389 	} else if ((tp->t_state & TS_XCLUDE) &&
390 		   priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) {
391 		pti_done(pti);
392 		lwkt_reltoken(&pti->pt_tty.t_token);
393 		return (EBUSY);
394 	} else if (pti->pt_prison != ap->a_cred->cr_prison) {
395 		pti_done(pti);
396 		lwkt_reltoken(&pti->pt_tty.t_token);
397 		return (EBUSY);
398 	}
399 
400 	/*
401 	 * If the ptc is already present this will connect us up.  It
402 	 * is unclear if this is actually needed.
403 	 *
404 	 * If neither side is open be sure to clear any left over
405 	 * ZOMBIE state before continuing.
406 	 */
407 	if (tp->t_oproc)
408 		(void)(*linesw[tp->t_line].l_modem)(tp, 1);
409 	else if ((pti->pt_flags & PF_SOPEN) == 0)
410 		tp->t_state &= ~TS_ZOMBIE;
411 
412 	/*
413 	 * Wait for the carrier (ptc side)
414 	 */
415 	while ((tp->t_state & TS_CARR_ON) == 0) {
416 		if (ap->a_oflags & FNONBLOCK)
417 			break;
418 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ptsopn", 0);
419 		if (error) {
420 			pti_done(pti);
421 			lwkt_reltoken(&pti->pt_tty.t_token);
422 			return (error);
423 		}
424 	}
425 
426 	/*
427 	 * Mark the tty open and mark the slave side as being open.
428 	 */
429 	error = (*linesw[tp->t_line].l_open)(dev, tp);
430 
431 	if (error == 0) {
432 		pti->pt_flags |= PF_SOPEN;
433 		pti->pt_flags &= ~PF_SCLOSED;
434 		ptcwakeup(tp, FREAD|FWRITE);
435 	}
436 	pti_done(pti);
437 	lwkt_reltoken(&pti->pt_tty.t_token);
438 
439 	return (error);
440 }
441 
442 static	int
443 ptsclose(struct dev_close_args *ap)
444 {
445 	cdev_t dev = ap->a_head.a_dev;
446 	struct tty *tp;
447 	struct pt_ioctl *pti = dev->si_drv1;
448 	int err;
449 
450 	lwkt_gettoken(&pti->pt_tty.t_token);
451 	if (pti_hold(pti))
452 		panic("ptsclose on terminated pti");
453 
454 	/*
455 	 * Disconnect the slave side
456 	 */
457 	tp = dev->si_tty;
458 	err = (*linesw[tp->t_line].l_close)(tp, ap->a_fflag);
459 	ptsstop(tp, FREAD|FWRITE);
460 	ttyclose(tp);			/* clears t_state */
461 
462 	/*
463 	 * Mark the pts side closed and signal the ptc.  Do not mark the
464 	 * tty a zombie... that is, allow the tty to be re-opened as long
465 	 * as the ptc is still open.  The ptc will read() EOFs until the
466 	 * pts side is reopened or the ptc is closed.
467 	 *
468 	 * xterm() depends on this behavior as it will revoke() the pts
469 	 * and then reopen it after the (unnecessary old code) chmod.
470 	 */
471 	pti->pt_flags &= ~PF_SOPEN;
472 	pti->pt_flags |= PF_SCLOSED;
473 	if (tp->t_oproc)
474 		ptcwakeup(tp, FREAD);
475 	pti_done(pti);
476 	lwkt_reltoken(&pti->pt_tty.t_token);
477 	return (err);
478 }
479 
480 static	int
481 ptsread(struct dev_read_args *ap)
482 {
483 	cdev_t dev = ap->a_head.a_dev;
484 	struct proc *p = curproc;
485 	struct tty *tp = dev->si_tty;
486 	struct pt_ioctl *pti = dev->si_drv1;
487 	struct lwp *lp;
488 
489 	int error = 0;
490 
491 	lp = curthread->td_lwp;
492 
493 	lwkt_gettoken(&pti->pt_tty.t_token);
494 again:
495 	if (pti->pt_flags & PF_REMOTE) {
496 		while (isbackground(p, tp)) {
497 			if (SIGISMEMBER(p->p_sigignore, SIGTTIN) ||
498 			    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
499 			    p->p_pgrp->pg_jobc == 0 ||
500 			    (p->p_flags & P_PPWAIT)) {
501 				lwkt_reltoken(&pti->pt_tty.t_token);
502 				return (EIO);
503 			}
504 			pgsignal(p->p_pgrp, SIGTTIN, 1);
505 			error = ttysleep(tp, &lbolt, PCATCH, "ptsbg", 0);
506 			if (error) {
507 				lwkt_reltoken(&pti->pt_tty.t_token);
508 				return (error);
509 			}
510 		}
511 		if (tp->t_canq.c_cc == 0) {
512 			if (ap->a_ioflag & IO_NDELAY) {
513 				lwkt_reltoken(&pti->pt_tty.t_token);
514 				return (EWOULDBLOCK);
515 			}
516 			error = ttysleep(tp, TSA_PTS_READ(tp), PCATCH,
517 					 "ptsin", 0);
518 			if (error) {
519 				lwkt_reltoken(&pti->pt_tty.t_token);
520 				return (error);
521 			}
522 			goto again;
523 		}
524 		while (tp->t_canq.c_cc > 1 && ap->a_uio->uio_resid > 0)
525 			if (ureadc(clist_getc(&tp->t_canq), ap->a_uio) < 0) {
526 				error = EFAULT;
527 				break;
528 			}
529 		if (tp->t_canq.c_cc == 1)
530 			clist_getc(&tp->t_canq);
531 		if (tp->t_canq.c_cc) {
532 			lwkt_reltoken(&pti->pt_tty.t_token);
533 			return (error);
534 		}
535 	} else
536 		if (tp->t_oproc)
537 			error = (*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag);
538 	ptcwakeup(tp, FWRITE);
539 	lwkt_reltoken(&pti->pt_tty.t_token);
540 
541 	return (error);
542 }
543 
544 /*
545  * Write to pseudo-tty.
546  * Wakeups of controlling tty will happen
547  * indirectly, when tty driver calls ptsstart.
548  */
549 static	int
550 ptswrite(struct dev_write_args *ap)
551 {
552 	cdev_t dev = ap->a_head.a_dev;
553 	struct tty *tp;
554 	int ret;
555 
556 	tp = dev->si_tty;
557 	lwkt_gettoken(&tp->t_token);
558 	if (tp->t_oproc == NULL) {
559 		lwkt_reltoken(&tp->t_token);
560 		return (EIO);
561 	}
562 	ret = ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
563 	lwkt_reltoken(&tp->t_token);
564 
565 	return ret;
566 }
567 
568 /*
569  * Start output on pseudo-tty.
570  * Wake up process selecting or sleeping for input from controlling tty.
571  */
572 static void
573 ptsstart(struct tty *tp)
574 {
575 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
576 
577 	lwkt_gettoken(&pti->pt_tty.t_token);
578 	lwkt_gettoken(&tp->t_token);
579 	if (tp->t_state & TS_TTSTOP) {
580 		lwkt_reltoken(&tp->t_token);
581 		lwkt_reltoken(&pti->pt_tty.t_token);
582 		return;
583 	}
584 	if (pti) {
585 		if (pti->pt_flags & PF_STOPPED) {
586 			pti->pt_flags &= ~PF_STOPPED;
587 			pti->pt_send = TIOCPKT_START;
588 		}
589 	}
590 	ptcwakeup(tp, FREAD);
591 	lwkt_reltoken(&tp->t_token);
592 	lwkt_reltoken(&pti->pt_tty.t_token);
593 }
594 
595 /*
596  * NOTE: Must be called with tp->t_token held
597  */
598 static void
599 ptcwakeup(struct tty *tp, int flag)
600 {
601 	if (flag & FREAD) {
602 		wakeup(TSA_PTC_READ(tp));
603 		KNOTE(&tp->t_rkq.ki_note, 0);
604 	}
605 	if (flag & FWRITE) {
606 		wakeup(TSA_PTC_WRITE(tp));
607 		KNOTE(&tp->t_wkq.ki_note, 0);
608 	}
609 }
610 
611 static	int
612 ptcopen(struct dev_open_args *ap)
613 {
614 	cdev_t dev = ap->a_head.a_dev;
615 	struct tty *tp;
616 	struct pt_ioctl *pti;
617 
618 	/*
619 	 * The pti will already be assigned by the clone code or
620 	 * pre-created if a non-unix 98 pty.  If si_drv1 is NULL
621 	 * we are somehow racing a unix98 termination.
622 	 */
623 	pti = dev->si_drv1;
624 	if (pti == NULL)
625 		return(ENXIO);
626 
627 	lwkt_gettoken(&pti->pt_tty.t_token);
628 	if (pti_hold(pti)) {
629 		lwkt_reltoken(&pti->pt_tty.t_token);
630 		return(ENXIO);
631 	}
632 	if (pti->pt_prison && pti->pt_prison != ap->a_cred->cr_prison) {
633 		pti_done(pti);
634 		lwkt_reltoken(&pti->pt_tty.t_token);
635 		return(EBUSY);
636 	}
637 	tp = dev->si_tty;
638 	lwkt_gettoken(&tp->t_token);
639 	if (tp->t_oproc) {
640 		pti_done(pti);
641 		lwkt_reltoken(&tp->t_token);
642 		lwkt_reltoken(&pti->pt_tty.t_token);
643 		return (EIO);
644 	}
645 
646 	/*
647 	 * If the slave side is not yet open clear any left over zombie
648 	 * state before doing our modem control.
649 	 */
650 	if ((pti->pt_flags & PF_SOPEN) == 0)
651 		tp->t_state &= ~TS_ZOMBIE;
652 
653 	tp->t_oproc = ptsstart;
654 	tp->t_stop = ptsstop;
655 	tp->t_unhold = ptsunhold;
656 
657 	/*
658 	 * Carrier on!
659 	 */
660 	(void)(*linesw[tp->t_line].l_modem)(tp, 1);
661 
662 	tp->t_lflag &= ~EXTPROC;
663 	pti->pt_prison = ap->a_cred->cr_prison;
664 	pti->pt_flags &= ~PF_PTCSTATEMASK;
665 	pti->pt_send = 0;
666 	pti->pt_ucntl = 0;
667 
668 	pti->devs->si_uid = ap->a_cred->cr_uid;
669 	pti->devs->si_gid = 0;
670 	pti->devs->si_perms = 0600;
671 	pti->devc->si_uid = ap->a_cred->cr_uid;
672 	pti->devc->si_gid = 0;
673 	pti->devc->si_perms = 0600;
674 
675 	/*
676 	 * Mark master side open.  This does not cause any events
677 	 * on the slave side.
678 	 */
679 	pti->pt_flags |= PF_MOPEN;
680 	pti_done(pti);
681 
682 	lwkt_reltoken(&tp->t_token);
683 	lwkt_reltoken(&pti->pt_tty.t_token);
684 
685 	return (0);
686 }
687 
688 static	int
689 ptcclose(struct dev_close_args *ap)
690 {
691 	cdev_t dev = ap->a_head.a_dev;
692 	struct tty *tp;
693 	struct pt_ioctl *pti = dev->si_drv1;
694 
695 	lwkt_gettoken(&pti->pt_tty.t_token);
696 	if (pti_hold(pti)) {
697 		lwkt_reltoken(&pti->pt_tty.t_token);
698 		panic("ptcclose on terminated pti");
699 	}
700 	tp = dev->si_tty;
701 	lwkt_gettoken(&tp->t_token);
702 
703 	(void)(*linesw[tp->t_line].l_modem)(tp, 0);
704 
705 	/*
706 	 * Mark the master side closed.  If the slave is still open
707 	 * mark the tty ZOMBIE, preventing any new action until both
708 	 * sides have closed.
709 	 *
710 	 * NOTE: The ttyflush() will wake up the slave once we've
711 	 *	 set appropriate flags.  The ZOMBIE flag will be
712 	 *	 cleared when the slave side is closed.
713 	 */
714 	pti->pt_flags &= ~PF_MOPEN;
715 	if (pti->pt_flags & PF_SOPEN)
716 		tp->t_state |= TS_ZOMBIE;
717 
718 	/*
719 	 * Turn off the carrier and disconnect.  This will notify the slave
720 	 * side.
721 	 */
722 	if (tp->t_state & TS_ISOPEN) {
723 		tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
724 		ttyflush(tp, FREAD | FWRITE);
725 	}
726 	tp->t_oproc = NULL;		/* mark closed */
727 
728 	pti->pt_prison = NULL;
729 	pti->devs->si_uid = 0;
730 	pti->devs->si_gid = 0;
731 	pti->devs->si_perms = 0666;
732 	pti->devc->si_uid = 0;
733 	pti->devc->si_gid = 0;
734 	pti->devc->si_perms = 0666;
735 
736 	pti_done(pti);
737 	lwkt_reltoken(&tp->t_token);
738 	lwkt_reltoken(&pti->pt_tty.t_token);
739 
740 	return (0);
741 }
742 
743 static	int
744 ptcread(struct dev_read_args *ap)
745 {
746 	cdev_t dev = ap->a_head.a_dev;
747 	struct tty *tp = dev->si_tty;
748 	struct pt_ioctl *pti = dev->si_drv1;
749 	char buf[BUFSIZ];
750 	int error = 0, cc;
751 
752 	lwkt_gettoken(&pti->pt_tty.t_token);
753 	lwkt_gettoken(&tp->t_token);
754 
755 	/*
756 	 * We want to block until the slave
757 	 * is open, and there's something to read;
758 	 * but if we lost the slave or we're NBIO,
759 	 * then return the appropriate error instead.
760 	 */
761 	for (;;) {
762 		if (tp->t_state&TS_ISOPEN) {
763 			if ((pti->pt_flags & PF_PKT) && pti->pt_send) {
764 				error = ureadc((int)pti->pt_send, ap->a_uio);
765 				if (error) {
766 					lwkt_reltoken(&tp->t_token);
767 					lwkt_reltoken(&pti->pt_tty.t_token);
768 					return (error);
769 				}
770 				if (pti->pt_send & TIOCPKT_IOCTL) {
771 					cc = (int)szmin(ap->a_uio->uio_resid,
772 							sizeof(tp->t_termios));
773 					uiomove((caddr_t)&tp->t_termios, cc,
774 						ap->a_uio);
775 				}
776 				pti->pt_send = 0;
777 				lwkt_reltoken(&tp->t_token);
778 				lwkt_reltoken(&pti->pt_tty.t_token);
779 
780 				return (0);
781 			}
782 			if ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl) {
783 				error = ureadc((int)pti->pt_ucntl, ap->a_uio);
784 				if (error) {
785 					lwkt_reltoken(&tp->t_token);
786 					lwkt_reltoken(&pti->pt_tty.t_token);
787 					return (error);
788 				}
789 				pti->pt_ucntl = 0;
790 				lwkt_reltoken(&tp->t_token);
791 				lwkt_reltoken(&pti->pt_tty.t_token);
792 
793 				return (0);
794 			}
795 			if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
796 				break;
797 		}
798 		if ((tp->t_state & TS_CONNECTED) == 0) {
799 			lwkt_reltoken(&tp->t_token);
800 			lwkt_reltoken(&pti->pt_tty.t_token);
801 			return (0);	/* EOF */
802 		}
803 		if (ap->a_ioflag & IO_NDELAY) {
804 			lwkt_reltoken(&tp->t_token);
805 			lwkt_reltoken(&pti->pt_tty.t_token);
806 			return (EWOULDBLOCK);
807 		}
808 		error = tsleep(TSA_PTC_READ(tp), PCATCH, "ptcin", 0);
809 		if (error) {
810 			lwkt_reltoken(&tp->t_token);
811 			lwkt_reltoken(&pti->pt_tty.t_token);
812 			return (error);
813 		}
814 	}
815 	if (pti->pt_flags & (PF_PKT|PF_UCNTL))
816 		error = ureadc(0, ap->a_uio);
817 	while (ap->a_uio->uio_resid > 0 && error == 0) {
818 		cc = clist_qtob(&tp->t_outq, buf,
819 				(int)szmin(ap->a_uio->uio_resid, BUFSIZ));
820 		if (cc <= 0)
821 			break;
822 		error = uiomove(buf, (size_t)cc, ap->a_uio);
823 	}
824 	ttwwakeup(tp);
825 	lwkt_reltoken(&tp->t_token);
826 	lwkt_reltoken(&pti->pt_tty.t_token);
827 
828 	return (error);
829 }
830 
831 static	void
832 ptsstop(struct tty *tp, int flush)
833 {
834 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
835 	int flag;
836 
837 	lwkt_gettoken(&pti->pt_tty.t_token);
838 	/* note: FLUSHREAD and FLUSHWRITE already ok */
839 	if (pti) {
840 		if (flush == 0) {
841 			flush = TIOCPKT_STOP;
842 			pti->pt_flags |= PF_STOPPED;
843 		} else {
844 			pti->pt_flags &= ~PF_STOPPED;
845 		}
846 		pti->pt_send |= flush;
847 		/* change of perspective */
848 	}
849 	flag = 0;
850 	if (flush & FREAD)
851 		flag |= FWRITE;
852 	if (flush & FWRITE)
853 		flag |= FREAD;
854 	ptcwakeup(tp, flag);
855 
856 	lwkt_reltoken(&pti->pt_tty.t_token);
857 }
858 
859 /*
860  * ttyunhold() calls us instead of just decrementing tp->t_refs.  This
861  * is needed because a session can hold onto a pts (half closed state)
862  * even if there are no live file descriptors.  Without the callback
863  * we can't clean up.
864  */
865 static	void
866 ptsunhold(struct tty *tp)
867 {
868 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
869 
870 	lwkt_gettoken(&pti->pt_tty.t_token);
871 	lwkt_gettoken(&tp->t_token);
872 	pti_hold(pti);
873 	--tp->t_refs;
874 	pti_done(pti);
875 	lwkt_reltoken(&tp->t_token);
876 	lwkt_reltoken(&pti->pt_tty.t_token);
877 }
878 
879 /*
880  * kqueue ops for pseudo-terminals.
881  */
882 static struct filterops ptcread_filtops =
883 	{ FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ptcrdetach, filt_ptcread };
884 static struct filterops ptcwrite_filtops =
885 	{ FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ptcwdetach, filt_ptcwrite };
886 
887 static	int
888 ptckqfilter(struct dev_kqfilter_args *ap)
889 {
890 	cdev_t dev = ap->a_head.a_dev;
891 	struct knote *kn = ap->a_kn;
892 	struct tty *tp = dev->si_tty;
893 	struct klist *klist;
894 
895 	ap->a_result = 0;
896 	switch (kn->kn_filter) {
897 	case EVFILT_READ:
898 		klist = &tp->t_rkq.ki_note;
899 		kn->kn_fop = &ptcread_filtops;
900 		break;
901 	case EVFILT_WRITE:
902 		klist = &tp->t_wkq.ki_note;
903 		kn->kn_fop = &ptcwrite_filtops;
904 		break;
905 	default:
906 		ap->a_result = EOPNOTSUPP;
907 		return (0);
908 	}
909 
910 	kn->kn_hook = (caddr_t)dev;
911 	knote_insert(klist, kn);
912 	return (0);
913 }
914 
915 static int
916 filt_ptcread (struct knote *kn, long hint)
917 {
918 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
919 	struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
920 
921 	lwkt_gettoken(&pti->pt_tty.t_token);
922 	lwkt_gettoken(&tp->t_token);
923 
924 	if ((tp->t_state & TS_ZOMBIE) || (pti->pt_flags & PF_SCLOSED)) {
925 		kn->kn_flags |= (EV_EOF | EV_NODATA);
926 		lwkt_reltoken(&tp->t_token);
927 		lwkt_reltoken(&pti->pt_tty.t_token);
928 		return (1);
929 	}
930 
931 	if ((tp->t_state & TS_ISOPEN) &&
932 	    ((tp->t_outq.c_cc && (tp->t_state & TS_TTSTOP) == 0) ||
933 	     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
934 	     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))) {
935 		kn->kn_data = tp->t_outq.c_cc;
936 		lwkt_reltoken(&tp->t_token);
937 		lwkt_reltoken(&pti->pt_tty.t_token);
938 		return(1);
939 	} else {
940 		lwkt_reltoken(&tp->t_token);
941 		lwkt_reltoken(&pti->pt_tty.t_token);
942 		return(0);
943 	}
944 }
945 
946 static int
947 filt_ptcwrite (struct knote *kn, long hint)
948 {
949 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
950 	struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
951 
952 	lwkt_gettoken(&pti->pt_tty.t_token);
953 	lwkt_gettoken(&tp->t_token);
954 	if (tp->t_state & TS_ZOMBIE) {
955 		lwkt_reltoken(&tp->t_token);
956 		lwkt_reltoken(&pti->pt_tty.t_token);
957 		kn->kn_flags |= (EV_EOF | EV_NODATA);
958 		return (1);
959 	}
960 
961 	if (tp->t_state & TS_ISOPEN &&
962 	    ((pti->pt_flags & PF_REMOTE) ?
963 	     (tp->t_canq.c_cc == 0) :
964 	     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
965 	      (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON))))) {
966 		kn->kn_data = tp->t_canq.c_cc + tp->t_rawq.c_cc;
967 		lwkt_reltoken(&tp->t_token);
968 		lwkt_reltoken(&pti->pt_tty.t_token);
969 		return(1);
970 	} else {
971 		lwkt_reltoken(&tp->t_token);
972 		lwkt_reltoken(&pti->pt_tty.t_token);
973 		return(0);
974 	}
975 	/* NOTREACHED */
976 }
977 
978 static void
979 filt_ptcrdetach (struct knote *kn)
980 {
981 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
982 
983 	knote_remove(&tp->t_rkq.ki_note, kn);
984 }
985 
986 static void
987 filt_ptcwdetach (struct knote *kn)
988 {
989 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
990 
991 	knote_remove(&tp->t_wkq.ki_note, kn);
992 }
993 
994 /*
995  * I/O ops
996  */
997 static	int
998 ptcwrite(struct dev_write_args *ap)
999 {
1000 	cdev_t dev = ap->a_head.a_dev;
1001 	struct tty *tp = dev->si_tty;
1002 	u_char *cp = NULL;
1003 	int cc = 0;
1004 	u_char locbuf[BUFSIZ];
1005 	int cnt = 0;
1006 	struct pt_ioctl *pti = dev->si_drv1;
1007 	int error = 0;
1008 
1009 	lwkt_gettoken(&pti->pt_tty.t_token);
1010 	lwkt_gettoken(&tp->t_token);
1011 again:
1012 	if ((tp->t_state&TS_ISOPEN) == 0)
1013 		goto block;
1014 	if (pti->pt_flags & PF_REMOTE) {
1015 		if (tp->t_canq.c_cc)
1016 			goto block;
1017 		while ((ap->a_uio->uio_resid > 0 || cc > 0) &&
1018 		       tp->t_canq.c_cc < TTYHOG - 1) {
1019 			if (cc == 0) {
1020 				cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
1021 				cc = imin(cc, TTYHOG - 1 - tp->t_canq.c_cc);
1022 				cp = locbuf;
1023 				error = uiomove(cp, (size_t)cc, ap->a_uio);
1024 				if (error) {
1025 					lwkt_reltoken(&tp->t_token);
1026 					lwkt_reltoken(&pti->pt_tty.t_token);
1027 					return (error);
1028 				}
1029 				/* check again for safety */
1030 				if ((tp->t_state & TS_ISOPEN) == 0) {
1031 					/* adjust as usual */
1032 					ap->a_uio->uio_resid += cc;
1033 					lwkt_reltoken(&tp->t_token);
1034 					lwkt_reltoken(&pti->pt_tty.t_token);
1035 					return (EIO);
1036 				}
1037 			}
1038 			if (cc > 0) {
1039 				cc = clist_btoq((char *)cp, cc, &tp->t_canq);
1040 				/*
1041 				 * XXX we don't guarantee that the canq size
1042 				 * is >= TTYHOG, so the above btoq() may
1043 				 * leave some bytes uncopied.  However, space
1044 				 * is guaranteed for the null terminator if
1045 				 * we don't fail here since (TTYHOG - 1) is
1046 				 * not a multiple of CBSIZE.
1047 				 */
1048 				if (cc > 0)
1049 					break;
1050 			}
1051 		}
1052 		/* adjust for data copied in but not written */
1053 		ap->a_uio->uio_resid += cc;
1054 		clist_putc(0, &tp->t_canq);
1055 		ttwakeup(tp);
1056 		wakeup(TSA_PTS_READ(tp));
1057 		lwkt_reltoken(&tp->t_token);
1058 		lwkt_reltoken(&pti->pt_tty.t_token);
1059 
1060 		return (0);
1061 	}
1062 	while (ap->a_uio->uio_resid > 0 || cc > 0) {
1063 		if (cc == 0) {
1064 			cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
1065 			cp = locbuf;
1066 			error = uiomove(cp, (size_t)cc, ap->a_uio);
1067 			if (error) {
1068 				lwkt_reltoken(&tp->t_token);
1069 				lwkt_reltoken(&pti->pt_tty.t_token);
1070 				return (error);
1071 			}
1072 			/* check again for safety */
1073 			if ((tp->t_state & TS_ISOPEN) == 0) {
1074 				/* adjust for data copied in but not written */
1075 				ap->a_uio->uio_resid += cc;
1076 				lwkt_reltoken(&tp->t_token);
1077 				lwkt_reltoken(&pti->pt_tty.t_token);
1078 				return (EIO);
1079 			}
1080 		}
1081 		while (cc > 0) {
1082 			if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
1083 			   (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
1084 				wakeup(TSA_HUP_OR_INPUT(tp));
1085 				goto block;
1086 			}
1087 			(*linesw[tp->t_line].l_rint)(*cp++, tp);
1088 			cnt++;
1089 			cc--;
1090 		}
1091 		cc = 0;
1092 	}
1093 	lwkt_reltoken(&tp->t_token);
1094 	lwkt_reltoken(&pti->pt_tty.t_token);
1095 	return (0);
1096 block:
1097 	/*
1098 	 * Come here to wait for slave to open, for space
1099 	 * in outq, or space in rawq, or an empty canq.
1100 	 */
1101 	if ((tp->t_state & TS_CONNECTED) == 0) {
1102 		/* adjust for data copied in but not written */
1103 		ap->a_uio->uio_resid += cc;
1104 		lwkt_reltoken(&tp->t_token);
1105 		lwkt_reltoken(&pti->pt_tty.t_token);
1106 		return (EIO);
1107 	}
1108 	if (ap->a_ioflag & IO_NDELAY) {
1109 		/* adjust for data copied in but not written */
1110 		ap->a_uio->uio_resid += cc;
1111 		if (cnt == 0) {
1112 			lwkt_reltoken(&tp->t_token);
1113 			lwkt_reltoken(&pti->pt_tty.t_token);
1114 			return (EWOULDBLOCK);
1115 		}
1116 		lwkt_reltoken(&tp->t_token);
1117 		lwkt_reltoken(&pti->pt_tty.t_token);
1118 		return (0);
1119 	}
1120 	error = tsleep(TSA_PTC_WRITE(tp), PCATCH, "ptcout", 0);
1121 	if (error) {
1122 		/* adjust for data copied in but not written */
1123 		ap->a_uio->uio_resid += cc;
1124 		lwkt_reltoken(&tp->t_token);
1125 		lwkt_reltoken(&pti->pt_tty.t_token);
1126 		return (error);
1127 	}
1128 	goto again;
1129 }
1130 
1131 /*ARGSUSED*/
1132 static	int
1133 ptyioctl(struct dev_ioctl_args *ap)
1134 {
1135 	cdev_t dev = ap->a_head.a_dev;
1136 	struct tty *tp = dev->si_tty;
1137 	struct pt_ioctl *pti = dev->si_drv1;
1138 	u_char *cc = tp->t_cc;
1139 	int stop, error;
1140 
1141 	lwkt_gettoken(&pti->pt_tty.t_token);
1142 	lwkt_gettoken(&tp->t_token);
1143 
1144 	if (dev_dflags(dev) & D_MASTER) {
1145 		switch (ap->a_cmd) {
1146 
1147 		case TIOCGPGRP:
1148 			/*
1149 			 * We avoid calling ttioctl on the controller since,
1150 			 * in that case, tp must be the controlling terminal.
1151 			 */
1152 			*(int *)ap->a_data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1153 			lwkt_reltoken(&tp->t_token);
1154 			lwkt_reltoken(&pti->pt_tty.t_token);
1155 			return (0);
1156 
1157 		case TIOCPKT:
1158 			if (*(int *)ap->a_data) {
1159 				if (pti->pt_flags & PF_UCNTL) {
1160 					lwkt_reltoken(&tp->t_token);
1161 					lwkt_reltoken(&pti->pt_tty.t_token);
1162 					return (EINVAL);
1163 				}
1164 				pti->pt_flags |= PF_PKT;
1165 			} else {
1166 				pti->pt_flags &= ~PF_PKT;
1167 			}
1168 			lwkt_reltoken(&tp->t_token);
1169 			lwkt_reltoken(&pti->pt_tty.t_token);
1170 			return (0);
1171 
1172 		case TIOCUCNTL:
1173 			if (*(int *)ap->a_data) {
1174 				if (pti->pt_flags & PF_PKT) {
1175 					lwkt_reltoken(&tp->t_token);
1176 					lwkt_reltoken(&pti->pt_tty.t_token);
1177 					return (EINVAL);
1178 				}
1179 				pti->pt_flags |= PF_UCNTL;
1180 			} else {
1181 				pti->pt_flags &= ~PF_UCNTL;
1182 			}
1183 			lwkt_reltoken(&tp->t_token);
1184 			lwkt_reltoken(&pti->pt_tty.t_token);
1185 			return (0);
1186 
1187 		case TIOCREMOTE:
1188 			if (*(int *)ap->a_data)
1189 				pti->pt_flags |= PF_REMOTE;
1190 			else
1191 				pti->pt_flags &= ~PF_REMOTE;
1192 			ttyflush(tp, FREAD|FWRITE);
1193 			lwkt_reltoken(&tp->t_token);
1194 			lwkt_reltoken(&pti->pt_tty.t_token);
1195 			return (0);
1196 
1197 		case TIOCISPTMASTER:
1198 			if ((pti->pt_flags & PF_UNIX98) &&
1199 			    (pti->devc == dev)) {
1200 				lwkt_reltoken(&tp->t_token);
1201 				lwkt_reltoken(&pti->pt_tty.t_token);
1202 				return (0);
1203 			} else {
1204 				lwkt_reltoken(&tp->t_token);
1205 				lwkt_reltoken(&pti->pt_tty.t_token);
1206 				return (EINVAL);
1207 			}
1208 		}
1209 
1210 		/*
1211 		 * The rest of the ioctls shouldn't be called until
1212 		 * the slave is open.
1213 		 */
1214 		if ((tp->t_state & TS_ISOPEN) == 0) {
1215 			lwkt_reltoken(&tp->t_token);
1216 			lwkt_reltoken(&pti->pt_tty.t_token);
1217 			return (EAGAIN);
1218 		}
1219 
1220 		switch (ap->a_cmd) {
1221 		case TIOCSETD:
1222 		case TIOCSETA:
1223 		case TIOCSETAW:
1224 		case TIOCSETAF:
1225 			/*
1226 			 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1227 			 * ttywflush(tp) will hang if there are characters in
1228 			 * the outq.
1229 			 */
1230 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
1231 			break;
1232 
1233 		case TIOCSIG:
1234 			if (*(unsigned int *)ap->a_data >= NSIG ||
1235 			    *(unsigned int *)ap->a_data == 0) {
1236 				lwkt_reltoken(&tp->t_token);
1237 				lwkt_reltoken(&pti->pt_tty.t_token);
1238 				return(EINVAL);
1239 			}
1240 			if ((tp->t_lflag&NOFLSH) == 0)
1241 				ttyflush(tp, FREAD|FWRITE);
1242 			pgsignal(tp->t_pgrp, *(unsigned int *)ap->a_data, 1);
1243 			if ((*(unsigned int *)ap->a_data == SIGINFO) &&
1244 			    ((tp->t_lflag&NOKERNINFO) == 0))
1245 				ttyinfo(tp);
1246 			lwkt_reltoken(&tp->t_token);
1247 			lwkt_reltoken(&pti->pt_tty.t_token);
1248 			return(0);
1249 		}
1250 	}
1251 	if (ap->a_cmd == TIOCEXT) {
1252 		/*
1253 		 * When the EXTPROC bit is being toggled, we need
1254 		 * to send an TIOCPKT_IOCTL if the packet driver
1255 		 * is turned on.
1256 		 */
1257 		if (*(int *)ap->a_data) {
1258 			if (pti->pt_flags & PF_PKT) {
1259 				pti->pt_send |= TIOCPKT_IOCTL;
1260 				ptcwakeup(tp, FREAD);
1261 			}
1262 			tp->t_lflag |= EXTPROC;
1263 		} else {
1264 			if ((tp->t_lflag & EXTPROC) &&
1265 			    (pti->pt_flags & PF_PKT)) {
1266 				pti->pt_send |= TIOCPKT_IOCTL;
1267 				ptcwakeup(tp, FREAD);
1268 			}
1269 			tp->t_lflag &= ~EXTPROC;
1270 		}
1271 		lwkt_reltoken(&tp->t_token);
1272 		lwkt_reltoken(&pti->pt_tty.t_token);
1273 		return(0);
1274 	}
1275 	error = (*linesw[tp->t_line].l_ioctl)(tp, ap->a_cmd, ap->a_data,
1276 					      ap->a_fflag, ap->a_cred);
1277 	if (error == ENOIOCTL)
1278 		 error = ttioctl(tp, ap->a_cmd, ap->a_data, ap->a_fflag);
1279 	if (error == ENOIOCTL) {
1280 		if (pti->pt_flags & PF_UCNTL &&
1281 		    (ap->a_cmd & ~0xff) == UIOCCMD(0)) {
1282 			if (ap->a_cmd & 0xff) {
1283 				pti->pt_ucntl = (u_char)ap->a_cmd;
1284 				ptcwakeup(tp, FREAD);
1285 			}
1286 			lwkt_reltoken(&tp->t_token);
1287 			lwkt_reltoken(&pti->pt_tty.t_token);
1288 			return (0);
1289 		}
1290 		error = ENOTTY;
1291 	}
1292 	/*
1293 	 * If external processing and packet mode send ioctl packet.
1294 	 */
1295 	if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
1296 		switch(ap->a_cmd) {
1297 		case TIOCSETA:
1298 		case TIOCSETAW:
1299 		case TIOCSETAF:
1300 			pti->pt_send |= TIOCPKT_IOCTL;
1301 			ptcwakeup(tp, FREAD);
1302 		default:
1303 			break;
1304 		}
1305 	}
1306 	stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1307 		&& CCEQ(cc[VSTART], CTRL('q'));
1308 	if (pti->pt_flags & PF_NOSTOP) {
1309 		if (stop) {
1310 			pti->pt_send &= ~TIOCPKT_NOSTOP;
1311 			pti->pt_send |= TIOCPKT_DOSTOP;
1312 			pti->pt_flags &= ~PF_NOSTOP;
1313 			ptcwakeup(tp, FREAD);
1314 		}
1315 	} else {
1316 		if (!stop) {
1317 			pti->pt_send &= ~TIOCPKT_DOSTOP;
1318 			pti->pt_send |= TIOCPKT_NOSTOP;
1319 			pti->pt_flags |= PF_NOSTOP;
1320 			ptcwakeup(tp, FREAD);
1321 		}
1322 	}
1323 	lwkt_reltoken(&tp->t_token);
1324 	lwkt_reltoken(&pti->pt_tty.t_token);
1325 
1326 	return (error);
1327 }
1328 
1329 
1330 static void ptc_drvinit (void *unused);
1331 
1332 SYSCTL_INT(_kern, OID_AUTO, pty_debug, CTLFLAG_RW, &pty_debug_level,
1333 		0, "Change pty debug level");
1334 
1335 static void
1336 ptc_drvinit(void *unused)
1337 {
1338 	int i;
1339 
1340 	/*
1341 	 * Unix98 pty stuff.
1342 	 * Create the clonable base device.
1343 	 */
1344 	make_autoclone_dev(&ptc_ops, &DEVFS_CLONE_BITMAP(pty), ptyclone,
1345 			   0, 0, 0666, "ptmx");
1346 	ptis = kmalloc(sizeof(struct pt_ioctl *) * MAXPTYS, M_PTY,
1347 		       M_WAITOK | M_ZERO);
1348 
1349 	for (i = 0; i < 256; i++) {
1350 		ptyinit(i);
1351 	}
1352 }
1353 
1354 SYSINIT(ptcdev, SI_SUB_DRIVERS, SI_ORDER_MIDDLE + CDEV_MAJOR_C,
1355 	ptc_drvinit, NULL);
1356