xref: /dragonfly/sys/kern/tty_pty.c (revision 6e5c5008)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)tty_pty.c	8.4 (Berkeley) 2/20/95
32  * $FreeBSD: src/sys/kern/tty_pty.c,v 1.74.2.4 2002/02/20 19:58:13 dillon Exp $
33  */
34 
35 /*
36  * Most functions here could use a separate lock to deal with concurrent
37  * access to the 'pt's.
38  */
39 
40 /*
41  * Pseudo-teletype Driver
42  * (Actually two drivers, requiring two dev_ops structures)
43  */
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/uio.h>
48 #include <sys/proc.h>
49 #include <sys/priv.h>
50 #include <sys/tty.h>
51 #include <sys/ttydefaults.h>	/* for TTYDEF_* */
52 #include <sys/conf.h>
53 #include <sys/fcntl.h>
54 #include <sys/kernel.h>
55 #include <sys/vnode.h>
56 #include <sys/signalvar.h>
57 #include <sys/malloc.h>
58 #include <sys/device.h>
59 #include <sys/devfs.h>
60 #include <sys/stat.h>
61 #include <sys/sysctl.h>
62 
63 MALLOC_DEFINE(M_PTY, "ptys", "pty data structures");
64 
65 static void ptsstart (struct tty *tp);
66 static void ptsstop (struct tty *tp, int rw);
67 static void ptsunhold (struct tty *tp);
68 static void ptcwakeup (struct tty *tp, int flag);
69 static void ptyinit (int n);
70 static int  filt_ptcread (struct knote *kn, long hint);
71 static void filt_ptcrdetach (struct knote *kn);
72 static int  filt_ptcwrite (struct knote *kn, long hint);
73 static void filt_ptcwdetach (struct knote *kn);
74 
75 static	d_open_t	ptsopen;
76 static	d_close_t	ptsclose;
77 static	d_read_t	ptsread;
78 static	d_write_t	ptswrite;
79 static	d_ioctl_t	ptyioctl;
80 static	d_open_t	ptcopen;
81 static	d_close_t	ptcclose;
82 static	d_read_t	ptcread;
83 static	d_write_t	ptcwrite;
84 static	d_kqfilter_t	ptckqfilter;
85 
86 DEVFS_DEFINE_CLONE_BITMAP(pty);
87 static struct pt_ioctl **ptis;		/* keep pti's intact */
88 
89 static	d_clone_t 	ptyclone;
90 
91 static int	pty_debug_level = 0;
92 
93 static struct dev_ops pts98_ops = {
94 	{ "pts98", 0, D_TTY | D_MPSAFE },
95 	.d_open =	ptsopen,
96 	.d_close =	ptsclose,
97 	.d_read =	ptsread,
98 	.d_write =	ptswrite,
99 	.d_ioctl =	ptyioctl,
100 	.d_kqfilter =	ttykqfilter,
101 	.d_revoke =	ttyrevoke
102 };
103 
104 static struct dev_ops ptc98_ops = {
105 	{ "ptc98", 0, D_TTY | D_MASTER | D_MPSAFE },
106 	.d_open =	ptcopen,
107 	.d_close =	ptcclose,
108 	.d_read =	ptcread,
109 	.d_write =	ptcwrite,
110 	.d_ioctl =	ptyioctl,
111 	.d_kqfilter =	ptckqfilter,
112 	.d_revoke =	ttyrevoke
113 };
114 
115 static struct dev_ops pts_ops = {
116 	{ "pts", 0, D_TTY | D_MPSAFE },
117 	.d_open =	ptsopen,
118 	.d_close =	ptsclose,
119 	.d_read =	ptsread,
120 	.d_write =	ptswrite,
121 	.d_ioctl =	ptyioctl,
122 	.d_kqfilter =	ttykqfilter,
123 	.d_revoke =	ttyrevoke
124 };
125 
126 #define	CDEV_MAJOR_C	6
127 static struct dev_ops ptc_ops = {
128 	{ "ptc", 0, D_TTY | D_MASTER | D_MPSAFE },
129 	.d_open =	ptcopen,
130 	.d_close =	ptcclose,
131 	.d_read =	ptcread,
132 	.d_write =	ptcwrite,
133 	.d_ioctl =	ptyioctl,
134 	.d_kqfilter =	ptckqfilter,
135 	.d_revoke =	ttyrevoke
136 };
137 
138 #define BUFSIZ	100		/* Chunk size iomoved to/from user */
139 
140 #define MAXPTYS	1000		/* Maximum cloneable ptys */
141 
142 struct	pt_ioctl {
143 	int	pt_flags;
144 	int	pt_refs;	/* Structural references interlock S/MOPEN */
145 	int	pt_uminor;
146 	struct	kqinfo pt_kqr, pt_kqw;
147 	u_char	pt_send;
148 	u_char	pt_ucntl;
149 	struct tty pt_tty;
150 	cdev_t	devs, devc;
151 	struct	prison *pt_prison;
152 };
153 
154 /*
155  * pt_flags ptc state
156  */
157 #define	PF_PKT		0x0008		/* packet mode */
158 #define	PF_STOPPED	0x0010		/* user told stopped */
159 #define	PF_REMOTE	0x0020		/* remote and flow controlled input */
160 #define	PF_NOSTOP	0x0040
161 #define PF_UCNTL	0x0080		/* user control mode */
162 
163 #define PF_PTCSTATEMASK	0x00FF
164 
165 /*
166  * pt_flags open state.  Note that PF_SCLOSED is used to activate
167  * read EOF on the ptc so it is only set after the slave has been
168  * opened and then closed, and cleared again if the slave is opened
169  * again.
170  */
171 #define	PF_UNIX98	0x0100
172 #define	PF_SOPEN	0x0200
173 #define	PF_MOPEN	0x0400
174 #define PF_SCLOSED	0x0800
175 #define PF_TERMINATED	0x8000
176 
177 /*
178  * This function creates and initializes a pts/ptc pair
179  *
180  * pts == /dev/tty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
181  * ptc == /dev/pty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
182  *
183  * XXX: define and add mapping of upper minor bits to allow more
184  *      than 256 ptys.
185  */
186 static void
187 ptyinit(int n)
188 {
189 	cdev_t devs, devc;
190 	char *names = "pqrsPQRS";
191 	struct pt_ioctl *pti;
192 
193 	/* For now we only map the lower 8 bits of the minor */
194 	if (n & ~0xff)
195 		return;
196 
197 	pti = kmalloc(sizeof(*pti), M_PTY, M_WAITOK | M_ZERO);
198 	pti->devs = devs = make_dev(&pts_ops, n, 0, 0, 0666,
199 				    "tty%c%c",
200 				    names[n / 32], hex2ascii(n % 32));
201 	pti->devc = devc = make_dev(&ptc_ops, n, 0, 0, 0666,
202 				    "pty%c%c",
203 				    names[n / 32], hex2ascii(n % 32));
204 
205 	pti->pt_tty.t_dev = devs;
206 	pti->pt_uminor = n;
207 	devs->si_drv1 = devc->si_drv1 = pti;
208 	devs->si_tty = devc->si_tty = &pti->pt_tty;
209 	devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
210 	devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
211 	ttyinit(&pti->pt_tty);
212 	ttyregister(&pti->pt_tty);
213 }
214 
215 static int
216 ptyclone(struct dev_clone_args *ap)
217 {
218 	int unit;
219 	struct pt_ioctl *pti;
220 
221 	/*
222 	 * Limit the number of unix98 pty (slave) devices to 1000 for now.
223 	 *
224 	 * If this limit is reached, we don't clone and return an error
225 	 * to devfs.
226 	 */
227 	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), MAXPTYS);
228 
229 	if (unit < 0) {
230 		ap->a_dev = NULL;
231 		return 1;
232 	}
233 
234 	/*
235 	 * pti structures must be persistent once allocated.
236 	 */
237 	if ((pti = ptis[unit]) == NULL) {
238 		lwkt_gettoken(&tty_token);
239 		pti = kmalloc(sizeof(*pti), M_PTY, M_WAITOK | M_ZERO);
240 		if (ptis[unit] == NULL) {
241 			ptis[unit] = pti;
242 			ttyinit(&pti->pt_tty);
243 		} else {
244 			kfree(pti, M_PTY);
245 		}
246 		lwkt_reltoken(&tty_token);
247 	}
248 
249 	/*
250 	 * The cloning bitmap should guarantee isolation during
251 	 * initialization.
252 	 */
253 	pti->devc = make_only_dev(&ptc98_ops, unit,
254 				  ap->a_cred->cr_ruid,
255 				  0, 0600, "ptm/%d", unit);
256 	pti->devs = make_dev(&pts98_ops, unit,
257 			     ap->a_cred->cr_ruid,
258 			     GID_TTY, 0620, "pts/%d", unit);
259 	ap->a_dev = pti->devc;
260 
261 	pti->devs->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
262 	pti->devc->si_flags |= SI_OVERRIDE;	/* uid, gid, perms from dev */
263 
264 	pti->pt_tty.t_dev = pti->devs;
265 	pti->pt_flags = PF_UNIX98;
266 	pti->pt_uminor = unit;
267 	pti->devs->si_drv1 = pti->devc->si_drv1 = pti;
268 	pti->devs->si_tty = pti->devc->si_tty = &pti->pt_tty;
269 	ttyregister(&pti->pt_tty);
270 
271 	return 0;
272 }
273 
274 /*
275  * pti_hold() prevents the pti from being destroyed due to a termination
276  * while a pt*open() is blocked.
277  *
278  * This function returns non-zero if we cannot hold due to a termination
279  * interlock.
280  */
281 static int
282 pti_hold(struct pt_ioctl *pti)
283 {
284 	if (pti->pt_flags & PF_TERMINATED)
285 		return(ENXIO);
286 	++pti->pt_refs;
287 
288 	return(0);
289 }
290 
291 /*
292  * pti_done() releases the reference and checks to see if both sides have
293  * been closed on a unix98 pty, allowing us to destroy the device and
294  * release resources.
295  *
296  * We do not release resources on non-unix98 ptys.  Those are left
297  * statically allocated.
298  */
299 static void
300 pti_done(struct pt_ioctl *pti)
301 {
302 	lwkt_gettoken(&pti->pt_tty.t_token);
303 	if (--pti->pt_refs == 0) {
304 		cdev_t dev;
305 		int uminor_no;
306 
307 		/*
308 		 * Only unix09 ptys are freed up (the pti structure itself
309 		 * is never freed, regardless).
310 		 */
311 		if ((pti->pt_flags & PF_UNIX98) == 0) {
312 			lwkt_reltoken(&pti->pt_tty.t_token);
313 			return;
314 		}
315 
316 		/*
317 		 * Interlock open attempts against termination by setting
318 		 * PF_TERMINATED.  This allows us to block while cleaning
319 		 * out the device infrastructure.
320 		 *
321 		 * Do not terminate the tty if it still has a session
322 		 * association (t_refs).
323 		 */
324 		if ((pti->pt_flags & (PF_SOPEN|PF_MOPEN)) == 0 &&
325 		    pti->pt_tty.t_refs == 0) {
326 			pti->pt_flags |= PF_TERMINATED;
327 			uminor_no = pti->pt_uminor;
328 
329 			if ((dev = pti->devs) != NULL) {
330 				dev->si_drv1 = NULL;
331 				pti->devs = NULL;
332 				destroy_dev(dev);
333 			}
334 			if ((dev = pti->devc) != NULL) {
335 				dev->si_drv1 = NULL;
336 				pti->devc = NULL;
337 				destroy_dev(dev);
338 			}
339 			ttyunregister(&pti->pt_tty);
340 			pti->pt_tty.t_dev = NULL;
341 
342 			devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty),
343 					       uminor_no);
344 			/* pti structure remains intact */
345 		}
346 	}
347 	lwkt_reltoken(&pti->pt_tty.t_token);
348 }
349 
350 /*ARGSUSED*/
351 static	int
352 ptsopen(struct dev_open_args *ap)
353 {
354 	cdev_t dev = ap->a_head.a_dev;
355 	struct tty *tp;
356 	int error;
357 	struct pt_ioctl *pti;
358 
359 	/*
360 	 * The pti will already be assigned by the clone code or
361 	 * pre-created if a non-unix 98 pty.  If si_drv1 is NULL
362 	 * we are somehow racing a unix98 termination.
363 	 */
364 	if (dev->si_drv1 == NULL)
365 		return(ENXIO);
366 	pti = dev->si_drv1;
367 
368 	lwkt_gettoken(&pti->pt_tty.t_token);
369 	if (pti_hold(pti)) {
370 		lwkt_reltoken(&pti->pt_tty.t_token);
371 		return(ENXIO);
372 	}
373 
374 	tp = dev->si_tty;
375 
376 	/*
377 	 * Reinit most of the tty state if it isn't open.  Handle
378 	 * exclusive access.
379 	 */
380 	if ((tp->t_state & TS_ISOPEN) == 0) {
381 		ttychars(tp);		/* Set up default chars */
382 		tp->t_iflag = TTYDEF_IFLAG;
383 		tp->t_oflag = TTYDEF_OFLAG;
384 		tp->t_lflag = TTYDEF_LFLAG;
385 		tp->t_cflag = TTYDEF_CFLAG;
386 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
387 	} else if ((tp->t_state & TS_XCLUDE) &&
388 		   priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) {
389 		pti_done(pti);
390 		lwkt_reltoken(&pti->pt_tty.t_token);
391 		return (EBUSY);
392 	} else if (pti->pt_prison != ap->a_cred->cr_prison) {
393 		pti_done(pti);
394 		lwkt_reltoken(&pti->pt_tty.t_token);
395 		return (EBUSY);
396 	}
397 
398 	/*
399 	 * If the ptc is already present this will connect us up.  It
400 	 * is unclear if this is actually needed.
401 	 *
402 	 * If neither side is open be sure to clear any left over
403 	 * ZOMBIE state before continuing.
404 	 */
405 	if (tp->t_oproc)
406 		(void)(*linesw[tp->t_line].l_modem)(tp, 1);
407 	else if ((pti->pt_flags & PF_SOPEN) == 0)
408 		tp->t_state &= ~TS_ZOMBIE;
409 
410 	/*
411 	 * Wait for the carrier (ptc side)
412 	 */
413 	while ((tp->t_state & TS_CARR_ON) == 0) {
414 		if (ap->a_oflags & FNONBLOCK)
415 			break;
416 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ptsopn", 0);
417 		if (error) {
418 			pti_done(pti);
419 			lwkt_reltoken(&pti->pt_tty.t_token);
420 			return (error);
421 		}
422 	}
423 
424 	/*
425 	 * Mark the tty open and mark the slave side as being open.
426 	 */
427 	error = (*linesw[tp->t_line].l_open)(dev, tp);
428 
429 	if (error == 0) {
430 		pti->pt_flags |= PF_SOPEN;
431 		pti->pt_flags &= ~PF_SCLOSED;
432 		ptcwakeup(tp, FREAD|FWRITE);
433 	}
434 	pti_done(pti);
435 	lwkt_reltoken(&pti->pt_tty.t_token);
436 
437 	return (error);
438 }
439 
440 static	int
441 ptsclose(struct dev_close_args *ap)
442 {
443 	cdev_t dev = ap->a_head.a_dev;
444 	struct tty *tp;
445 	struct pt_ioctl *pti = dev->si_drv1;
446 	int err;
447 
448 	lwkt_gettoken(&pti->pt_tty.t_token);
449 	if (pti_hold(pti))
450 		panic("ptsclose on terminated pti");
451 
452 	/*
453 	 * Disconnect the slave side
454 	 */
455 	tp = dev->si_tty;
456 	err = (*linesw[tp->t_line].l_close)(tp, ap->a_fflag);
457 	ptsstop(tp, FREAD|FWRITE);
458 	ttyclose(tp);			/* clears t_state */
459 
460 	/*
461 	 * Mark the pts side closed and signal the ptc.  Do not mark the
462 	 * tty a zombie... that is, allow the tty to be re-opened as long
463 	 * as the ptc is still open.  The ptc will read() EOFs until the
464 	 * pts side is reopened or the ptc is closed.
465 	 *
466 	 * xterm() depends on this behavior as it will revoke() the pts
467 	 * and then reopen it after the (unnecessary old code) chmod.
468 	 */
469 	pti->pt_flags &= ~PF_SOPEN;
470 	pti->pt_flags |= PF_SCLOSED;
471 	if (tp->t_oproc)
472 		ptcwakeup(tp, FREAD);
473 	pti_done(pti);
474 	lwkt_reltoken(&pti->pt_tty.t_token);
475 	return (err);
476 }
477 
478 static	int
479 ptsread(struct dev_read_args *ap)
480 {
481 	cdev_t dev = ap->a_head.a_dev;
482 	struct proc *p = curproc;
483 	struct tty *tp = dev->si_tty;
484 	struct pt_ioctl *pti = dev->si_drv1;
485 	struct lwp *lp;
486 
487 	int error = 0;
488 
489 	lp = curthread->td_lwp;
490 
491 	lwkt_gettoken(&pti->pt_tty.t_token);
492 again:
493 	if (pti->pt_flags & PF_REMOTE) {
494 		while (isbackground(p, tp)) {
495 			if (SIGISMEMBER(p->p_sigignore, SIGTTIN) ||
496 			    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
497 			    p->p_pgrp->pg_jobc == 0 ||
498 			    (p->p_flags & P_PPWAIT)) {
499 				lwkt_reltoken(&pti->pt_tty.t_token);
500 				return (EIO);
501 			}
502 			pgsignal(p->p_pgrp, SIGTTIN, 1);
503 			error = ttysleep(tp, &lbolt, PCATCH, "ptsbg", 0);
504 			if (error) {
505 				lwkt_reltoken(&pti->pt_tty.t_token);
506 				return (error);
507 			}
508 		}
509 		if (tp->t_canq.c_cc == 0) {
510 			if (ap->a_ioflag & IO_NDELAY) {
511 				lwkt_reltoken(&pti->pt_tty.t_token);
512 				return (EWOULDBLOCK);
513 			}
514 			error = ttysleep(tp, TSA_PTS_READ(tp), PCATCH,
515 					 "ptsin", 0);
516 			if (error) {
517 				lwkt_reltoken(&pti->pt_tty.t_token);
518 				return (error);
519 			}
520 			goto again;
521 		}
522 		while (tp->t_canq.c_cc > 1 && ap->a_uio->uio_resid > 0)
523 			if (ureadc(clist_getc(&tp->t_canq), ap->a_uio) < 0) {
524 				error = EFAULT;
525 				break;
526 			}
527 		if (tp->t_canq.c_cc == 1)
528 			clist_getc(&tp->t_canq);
529 		if (tp->t_canq.c_cc) {
530 			lwkt_reltoken(&pti->pt_tty.t_token);
531 			return (error);
532 		}
533 	} else
534 		if (tp->t_oproc)
535 			error = (*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag);
536 	ptcwakeup(tp, FWRITE);
537 	lwkt_reltoken(&pti->pt_tty.t_token);
538 
539 	return (error);
540 }
541 
542 /*
543  * Write to pseudo-tty.
544  * Wakeups of controlling tty will happen
545  * indirectly, when tty driver calls ptsstart.
546  */
547 static	int
548 ptswrite(struct dev_write_args *ap)
549 {
550 	cdev_t dev = ap->a_head.a_dev;
551 	struct tty *tp;
552 	int ret;
553 
554 	tp = dev->si_tty;
555 	lwkt_gettoken(&tp->t_token);
556 	if (tp->t_oproc == NULL) {
557 		lwkt_reltoken(&tp->t_token);
558 		return (EIO);
559 	}
560 	ret = ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
561 	lwkt_reltoken(&tp->t_token);
562 
563 	return ret;
564 }
565 
566 /*
567  * Start output on pseudo-tty.
568  * Wake up process selecting or sleeping for input from controlling tty.
569  */
570 static void
571 ptsstart(struct tty *tp)
572 {
573 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
574 
575 	lwkt_gettoken(&pti->pt_tty.t_token);
576 	lwkt_gettoken(&tp->t_token);
577 	if (tp->t_state & TS_TTSTOP) {
578 		lwkt_reltoken(&tp->t_token);
579 		lwkt_reltoken(&pti->pt_tty.t_token);
580 		return;
581 	}
582 	if (pti) {
583 		if (pti->pt_flags & PF_STOPPED) {
584 			pti->pt_flags &= ~PF_STOPPED;
585 			pti->pt_send = TIOCPKT_START;
586 		}
587 	}
588 	ptcwakeup(tp, FREAD);
589 	lwkt_reltoken(&tp->t_token);
590 	lwkt_reltoken(&pti->pt_tty.t_token);
591 }
592 
593 /*
594  * NOTE: Must be called with tp->t_token held
595  */
596 static void
597 ptcwakeup(struct tty *tp, int flag)
598 {
599 	if (flag & FREAD) {
600 		wakeup(TSA_PTC_READ(tp));
601 		KNOTE(&tp->t_rkq.ki_note, 0);
602 	}
603 	if (flag & FWRITE) {
604 		wakeup(TSA_PTC_WRITE(tp));
605 		KNOTE(&tp->t_wkq.ki_note, 0);
606 	}
607 }
608 
609 static	int
610 ptcopen(struct dev_open_args *ap)
611 {
612 	cdev_t dev = ap->a_head.a_dev;
613 	struct tty *tp;
614 	struct pt_ioctl *pti;
615 
616 	/*
617 	 * The pti will already be assigned by the clone code or
618 	 * pre-created if a non-unix 98 pty.  If si_drv1 is NULL
619 	 * we are somehow racing a unix98 termination.
620 	 */
621 	pti = dev->si_drv1;
622 	if (pti == NULL)
623 		return(ENXIO);
624 
625 	lwkt_gettoken(&pti->pt_tty.t_token);
626 	if (pti_hold(pti)) {
627 		lwkt_reltoken(&pti->pt_tty.t_token);
628 		return(ENXIO);
629 	}
630 	if (pti->pt_prison && pti->pt_prison != ap->a_cred->cr_prison) {
631 		pti_done(pti);
632 		lwkt_reltoken(&pti->pt_tty.t_token);
633 		return(EBUSY);
634 	}
635 	tp = dev->si_tty;
636 	lwkt_gettoken(&tp->t_token);
637 	if (tp->t_oproc) {
638 		pti_done(pti);
639 		lwkt_reltoken(&tp->t_token);
640 		lwkt_reltoken(&pti->pt_tty.t_token);
641 		return (EIO);
642 	}
643 
644 	/*
645 	 * If the slave side is not yet open clear any left over zombie
646 	 * state before doing our modem control.
647 	 */
648 	if ((pti->pt_flags & PF_SOPEN) == 0)
649 		tp->t_state &= ~TS_ZOMBIE;
650 
651 	tp->t_oproc = ptsstart;
652 	tp->t_stop = ptsstop;
653 	tp->t_unhold = ptsunhold;
654 
655 	/*
656 	 * Carrier on!
657 	 */
658 	(void)(*linesw[tp->t_line].l_modem)(tp, 1);
659 
660 	tp->t_lflag &= ~EXTPROC;
661 	pti->pt_prison = ap->a_cred->cr_prison;
662 	pti->pt_flags &= ~PF_PTCSTATEMASK;
663 	pti->pt_send = 0;
664 	pti->pt_ucntl = 0;
665 
666 	pti->devs->si_uid = ap->a_cred->cr_uid;
667 	pti->devs->si_gid = ap->a_cred->cr_uid ? GID_TTY : 0;
668 	pti->devs->si_perms = 0600;
669 	pti->devc->si_uid = ap->a_cred->cr_uid;
670 	pti->devc->si_gid = 0;
671 	pti->devc->si_perms = 0600;
672 
673 	/*
674 	 * Mark master side open.  This does not cause any events
675 	 * on the slave side.
676 	 */
677 	pti->pt_flags |= PF_MOPEN;
678 	pti_done(pti);
679 
680 	lwkt_reltoken(&tp->t_token);
681 	lwkt_reltoken(&pti->pt_tty.t_token);
682 
683 	return (0);
684 }
685 
686 static	int
687 ptcclose(struct dev_close_args *ap)
688 {
689 	cdev_t dev = ap->a_head.a_dev;
690 	struct tty *tp;
691 	struct pt_ioctl *pti = dev->si_drv1;
692 
693 	lwkt_gettoken(&pti->pt_tty.t_token);
694 	if (pti_hold(pti)) {
695 		lwkt_reltoken(&pti->pt_tty.t_token);
696 		panic("ptcclose on terminated pti");
697 	}
698 	tp = dev->si_tty;
699 	lwkt_gettoken(&tp->t_token);
700 
701 	(void)(*linesw[tp->t_line].l_modem)(tp, 0);
702 
703 	/*
704 	 * Mark the master side closed.  If the slave is still open
705 	 * mark the tty ZOMBIE, preventing any new action until both
706 	 * sides have closed.
707 	 *
708 	 * NOTE: The ttyflush() will wake up the slave once we've
709 	 *	 set appropriate flags.  The ZOMBIE flag will be
710 	 *	 cleared when the slave side is closed.
711 	 */
712 	pti->pt_flags &= ~PF_MOPEN;
713 	if (pti->pt_flags & PF_SOPEN)
714 		tp->t_state |= TS_ZOMBIE;
715 
716 	/*
717 	 * Turn off the carrier and disconnect.  This will notify the slave
718 	 * side.
719 	 */
720 	if (tp->t_state & TS_ISOPEN) {
721 		tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
722 		ttyflush(tp, FREAD | FWRITE);
723 	}
724 	tp->t_oproc = NULL;		/* mark closed */
725 
726 	pti->pt_prison = NULL;
727 	pti->devs->si_uid = 0;
728 	pti->devs->si_gid = 0;
729 	pti->devs->si_perms = 0666;
730 	pti->devc->si_uid = 0;
731 	pti->devc->si_gid = 0;
732 	pti->devc->si_perms = 0666;
733 
734 	pti_done(pti);
735 	lwkt_reltoken(&tp->t_token);
736 	lwkt_reltoken(&pti->pt_tty.t_token);
737 
738 	return (0);
739 }
740 
741 static	int
742 ptcread(struct dev_read_args *ap)
743 {
744 	cdev_t dev = ap->a_head.a_dev;
745 	struct tty *tp = dev->si_tty;
746 	struct pt_ioctl *pti = dev->si_drv1;
747 	char buf[BUFSIZ];
748 	int error = 0, cc;
749 
750 	lwkt_gettoken(&pti->pt_tty.t_token);
751 	lwkt_gettoken(&tp->t_token);
752 
753 	/*
754 	 * We want to block until the slave
755 	 * is open, and there's something to read;
756 	 * but if we lost the slave or we're NBIO,
757 	 * then return the appropriate error instead.
758 	 */
759 	for (;;) {
760 		if (tp->t_state&TS_ISOPEN) {
761 			if ((pti->pt_flags & PF_PKT) && pti->pt_send) {
762 				error = ureadc((int)pti->pt_send, ap->a_uio);
763 				if (error) {
764 					lwkt_reltoken(&tp->t_token);
765 					lwkt_reltoken(&pti->pt_tty.t_token);
766 					return (error);
767 				}
768 				if (pti->pt_send & TIOCPKT_IOCTL) {
769 					cc = (int)szmin(ap->a_uio->uio_resid,
770 							sizeof(tp->t_termios));
771 					uiomove((caddr_t)&tp->t_termios, cc,
772 						ap->a_uio);
773 				}
774 				pti->pt_send = 0;
775 				lwkt_reltoken(&tp->t_token);
776 				lwkt_reltoken(&pti->pt_tty.t_token);
777 
778 				return (0);
779 			}
780 			if ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl) {
781 				error = ureadc((int)pti->pt_ucntl, ap->a_uio);
782 				if (error) {
783 					lwkt_reltoken(&tp->t_token);
784 					lwkt_reltoken(&pti->pt_tty.t_token);
785 					return (error);
786 				}
787 				pti->pt_ucntl = 0;
788 				lwkt_reltoken(&tp->t_token);
789 				lwkt_reltoken(&pti->pt_tty.t_token);
790 
791 				return (0);
792 			}
793 			if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
794 				break;
795 		}
796 		if ((tp->t_state & TS_CONNECTED) == 0) {
797 			lwkt_reltoken(&tp->t_token);
798 			lwkt_reltoken(&pti->pt_tty.t_token);
799 			return (0);	/* EOF */
800 		}
801 		if (ap->a_ioflag & IO_NDELAY) {
802 			lwkt_reltoken(&tp->t_token);
803 			lwkt_reltoken(&pti->pt_tty.t_token);
804 			return (EWOULDBLOCK);
805 		}
806 		error = tsleep(TSA_PTC_READ(tp), PCATCH, "ptcin", 0);
807 		if (error) {
808 			lwkt_reltoken(&tp->t_token);
809 			lwkt_reltoken(&pti->pt_tty.t_token);
810 			return (error);
811 		}
812 	}
813 	if (pti->pt_flags & (PF_PKT|PF_UCNTL))
814 		error = ureadc(0, ap->a_uio);
815 	while (ap->a_uio->uio_resid > 0 && error == 0) {
816 		cc = clist_qtob(&tp->t_outq, buf,
817 				(int)szmin(ap->a_uio->uio_resid, BUFSIZ));
818 		if (cc <= 0)
819 			break;
820 		error = uiomove(buf, (size_t)cc, ap->a_uio);
821 	}
822 	ttwwakeup(tp);
823 	lwkt_reltoken(&tp->t_token);
824 	lwkt_reltoken(&pti->pt_tty.t_token);
825 
826 	return (error);
827 }
828 
829 static	void
830 ptsstop(struct tty *tp, int flush)
831 {
832 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
833 	int flag;
834 
835 	lwkt_gettoken(&pti->pt_tty.t_token);
836 	/* note: FLUSHREAD and FLUSHWRITE already ok */
837 	if (pti) {
838 		if (flush == 0) {
839 			flush = TIOCPKT_STOP;
840 			pti->pt_flags |= PF_STOPPED;
841 		} else {
842 			pti->pt_flags &= ~PF_STOPPED;
843 		}
844 		pti->pt_send |= flush;
845 		/* change of perspective */
846 	}
847 	flag = 0;
848 	if (flush & FREAD)
849 		flag |= FWRITE;
850 	if (flush & FWRITE)
851 		flag |= FREAD;
852 	ptcwakeup(tp, flag);
853 
854 	lwkt_reltoken(&pti->pt_tty.t_token);
855 }
856 
857 /*
858  * ttyunhold() calls us instead of just decrementing tp->t_refs.  This
859  * is needed because a session can hold onto a pts (half closed state)
860  * even if there are no live file descriptors.  Without the callback
861  * we can't clean up.
862  */
863 static	void
864 ptsunhold(struct tty *tp)
865 {
866 	struct pt_ioctl *pti = tp->t_dev->si_drv1;
867 
868 	lwkt_gettoken(&pti->pt_tty.t_token);
869 	lwkt_gettoken(&tp->t_token);
870 	pti_hold(pti);
871 	--tp->t_refs;
872 	pti_done(pti);
873 	lwkt_reltoken(&tp->t_token);
874 	lwkt_reltoken(&pti->pt_tty.t_token);
875 }
876 
877 /*
878  * kqueue ops for pseudo-terminals.
879  */
880 static struct filterops ptcread_filtops =
881 	{ FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ptcrdetach, filt_ptcread };
882 static struct filterops ptcwrite_filtops =
883 	{ FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ptcwdetach, filt_ptcwrite };
884 
885 static	int
886 ptckqfilter(struct dev_kqfilter_args *ap)
887 {
888 	cdev_t dev = ap->a_head.a_dev;
889 	struct knote *kn = ap->a_kn;
890 	struct tty *tp = dev->si_tty;
891 	struct klist *klist;
892 
893 	ap->a_result = 0;
894 	switch (kn->kn_filter) {
895 	case EVFILT_READ:
896 		klist = &tp->t_rkq.ki_note;
897 		kn->kn_fop = &ptcread_filtops;
898 		break;
899 	case EVFILT_WRITE:
900 		klist = &tp->t_wkq.ki_note;
901 		kn->kn_fop = &ptcwrite_filtops;
902 		break;
903 	default:
904 		ap->a_result = EOPNOTSUPP;
905 		return (0);
906 	}
907 
908 	kn->kn_hook = (caddr_t)dev;
909 	knote_insert(klist, kn);
910 	return (0);
911 }
912 
913 static int
914 filt_ptcread (struct knote *kn, long hint)
915 {
916 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
917 	struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
918 
919 	lwkt_gettoken(&pti->pt_tty.t_token);
920 	lwkt_gettoken(&tp->t_token);
921 
922 	if ((tp->t_state & TS_ZOMBIE) || (pti->pt_flags & PF_SCLOSED)) {
923 		kn->kn_flags |= (EV_EOF | EV_NODATA);
924 		lwkt_reltoken(&tp->t_token);
925 		lwkt_reltoken(&pti->pt_tty.t_token);
926 		return (1);
927 	}
928 
929 	if ((tp->t_state & TS_ISOPEN) &&
930 	    ((tp->t_outq.c_cc && (tp->t_state & TS_TTSTOP) == 0) ||
931 	     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
932 	     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))) {
933 		kn->kn_data = tp->t_outq.c_cc;
934 		lwkt_reltoken(&tp->t_token);
935 		lwkt_reltoken(&pti->pt_tty.t_token);
936 		return(1);
937 	} else {
938 		lwkt_reltoken(&tp->t_token);
939 		lwkt_reltoken(&pti->pt_tty.t_token);
940 		return(0);
941 	}
942 }
943 
944 static int
945 filt_ptcwrite (struct knote *kn, long hint)
946 {
947 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
948 	struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
949 
950 	lwkt_gettoken(&pti->pt_tty.t_token);
951 	lwkt_gettoken(&tp->t_token);
952 	if (tp->t_state & TS_ZOMBIE) {
953 		lwkt_reltoken(&tp->t_token);
954 		lwkt_reltoken(&pti->pt_tty.t_token);
955 		kn->kn_flags |= (EV_EOF | EV_NODATA);
956 		return (1);
957 	}
958 
959 	if (tp->t_state & TS_ISOPEN &&
960 	    ((pti->pt_flags & PF_REMOTE) ?
961 	     (tp->t_canq.c_cc == 0) :
962 	     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
963 	      (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON))))) {
964 		kn->kn_data = tp->t_canq.c_cc + tp->t_rawq.c_cc;
965 		lwkt_reltoken(&tp->t_token);
966 		lwkt_reltoken(&pti->pt_tty.t_token);
967 		return(1);
968 	} else {
969 		lwkt_reltoken(&tp->t_token);
970 		lwkt_reltoken(&pti->pt_tty.t_token);
971 		return(0);
972 	}
973 	/* NOTREACHED */
974 }
975 
976 static void
977 filt_ptcrdetach (struct knote *kn)
978 {
979 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
980 
981 	knote_remove(&tp->t_rkq.ki_note, kn);
982 }
983 
984 static void
985 filt_ptcwdetach (struct knote *kn)
986 {
987 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
988 
989 	knote_remove(&tp->t_wkq.ki_note, kn);
990 }
991 
992 /*
993  * I/O ops
994  */
995 static	int
996 ptcwrite(struct dev_write_args *ap)
997 {
998 	cdev_t dev = ap->a_head.a_dev;
999 	struct tty *tp = dev->si_tty;
1000 	u_char *cp = NULL;
1001 	int cc = 0;
1002 	u_char locbuf[BUFSIZ];
1003 	int cnt = 0;
1004 	struct pt_ioctl *pti = dev->si_drv1;
1005 	int error = 0;
1006 
1007 	lwkt_gettoken(&pti->pt_tty.t_token);
1008 	lwkt_gettoken(&tp->t_token);
1009 again:
1010 	if ((tp->t_state&TS_ISOPEN) == 0)
1011 		goto block;
1012 	if (pti->pt_flags & PF_REMOTE) {
1013 		if (tp->t_canq.c_cc)
1014 			goto block;
1015 		while ((ap->a_uio->uio_resid > 0 || cc > 0) &&
1016 		       tp->t_canq.c_cc < TTYHOG - 1) {
1017 			if (cc == 0) {
1018 				cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
1019 				cc = imin(cc, TTYHOG - 1 - tp->t_canq.c_cc);
1020 				cp = locbuf;
1021 				error = uiomove(cp, (size_t)cc, ap->a_uio);
1022 				if (error) {
1023 					lwkt_reltoken(&tp->t_token);
1024 					lwkt_reltoken(&pti->pt_tty.t_token);
1025 					return (error);
1026 				}
1027 				/* check again for safety */
1028 				if ((tp->t_state & TS_ISOPEN) == 0) {
1029 					/* adjust as usual */
1030 					ap->a_uio->uio_resid += cc;
1031 					lwkt_reltoken(&tp->t_token);
1032 					lwkt_reltoken(&pti->pt_tty.t_token);
1033 					return (EIO);
1034 				}
1035 			}
1036 			if (cc > 0) {
1037 				cc = clist_btoq((char *)cp, cc, &tp->t_canq);
1038 				/*
1039 				 * XXX we don't guarantee that the canq size
1040 				 * is >= TTYHOG, so the above btoq() may
1041 				 * leave some bytes uncopied.  However, space
1042 				 * is guaranteed for the null terminator if
1043 				 * we don't fail here since (TTYHOG - 1) is
1044 				 * not a multiple of CBSIZE.
1045 				 */
1046 				if (cc > 0)
1047 					break;
1048 			}
1049 		}
1050 		/* adjust for data copied in but not written */
1051 		ap->a_uio->uio_resid += cc;
1052 		clist_putc(0, &tp->t_canq);
1053 		ttwakeup(tp);
1054 		wakeup(TSA_PTS_READ(tp));
1055 		lwkt_reltoken(&tp->t_token);
1056 		lwkt_reltoken(&pti->pt_tty.t_token);
1057 
1058 		return (0);
1059 	}
1060 	while (ap->a_uio->uio_resid > 0 || cc > 0) {
1061 		if (cc == 0) {
1062 			cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
1063 			cp = locbuf;
1064 			error = uiomove(cp, (size_t)cc, ap->a_uio);
1065 			if (error) {
1066 				lwkt_reltoken(&tp->t_token);
1067 				lwkt_reltoken(&pti->pt_tty.t_token);
1068 				return (error);
1069 			}
1070 			/* check again for safety */
1071 			if ((tp->t_state & TS_ISOPEN) == 0) {
1072 				/* adjust for data copied in but not written */
1073 				ap->a_uio->uio_resid += cc;
1074 				lwkt_reltoken(&tp->t_token);
1075 				lwkt_reltoken(&pti->pt_tty.t_token);
1076 				return (EIO);
1077 			}
1078 		}
1079 		while (cc > 0) {
1080 			if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
1081 			   (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
1082 				wakeup(TSA_HUP_OR_INPUT(tp));
1083 				goto block;
1084 			}
1085 			(*linesw[tp->t_line].l_rint)(*cp++, tp);
1086 			cnt++;
1087 			cc--;
1088 		}
1089 		cc = 0;
1090 	}
1091 	lwkt_reltoken(&tp->t_token);
1092 	lwkt_reltoken(&pti->pt_tty.t_token);
1093 	return (0);
1094 block:
1095 	/*
1096 	 * Come here to wait for slave to open, for space
1097 	 * in outq, or space in rawq, or an empty canq.
1098 	 */
1099 	if ((tp->t_state & TS_CONNECTED) == 0) {
1100 		/* adjust for data copied in but not written */
1101 		ap->a_uio->uio_resid += cc;
1102 		lwkt_reltoken(&tp->t_token);
1103 		lwkt_reltoken(&pti->pt_tty.t_token);
1104 		return (EIO);
1105 	}
1106 	if (ap->a_ioflag & IO_NDELAY) {
1107 		/* adjust for data copied in but not written */
1108 		ap->a_uio->uio_resid += cc;
1109 		if (cnt == 0) {
1110 			lwkt_reltoken(&tp->t_token);
1111 			lwkt_reltoken(&pti->pt_tty.t_token);
1112 			return (EWOULDBLOCK);
1113 		}
1114 		lwkt_reltoken(&tp->t_token);
1115 		lwkt_reltoken(&pti->pt_tty.t_token);
1116 		return (0);
1117 	}
1118 	error = tsleep(TSA_PTC_WRITE(tp), PCATCH, "ptcout", 0);
1119 	if (error) {
1120 		/* adjust for data copied in but not written */
1121 		ap->a_uio->uio_resid += cc;
1122 		lwkt_reltoken(&tp->t_token);
1123 		lwkt_reltoken(&pti->pt_tty.t_token);
1124 		return (error);
1125 	}
1126 	goto again;
1127 }
1128 
1129 /*ARGSUSED*/
1130 static	int
1131 ptyioctl(struct dev_ioctl_args *ap)
1132 {
1133 	cdev_t dev = ap->a_head.a_dev;
1134 	struct tty *tp = dev->si_tty;
1135 	struct pt_ioctl *pti = dev->si_drv1;
1136 	u_char *cc = tp->t_cc;
1137 	int stop, error;
1138 
1139 	lwkt_gettoken(&pti->pt_tty.t_token);
1140 	lwkt_gettoken(&tp->t_token);
1141 
1142 	if (dev_dflags(dev) & D_MASTER) {
1143 		switch (ap->a_cmd) {
1144 
1145 		case TIOCGPGRP:
1146 			/*
1147 			 * We avoid calling ttioctl on the controller since,
1148 			 * in that case, tp must be the controlling terminal.
1149 			 */
1150 			*(int *)ap->a_data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1151 			lwkt_reltoken(&tp->t_token);
1152 			lwkt_reltoken(&pti->pt_tty.t_token);
1153 			return (0);
1154 
1155 		case TIOCPKT:
1156 			if (*(int *)ap->a_data) {
1157 				if (pti->pt_flags & PF_UCNTL) {
1158 					lwkt_reltoken(&tp->t_token);
1159 					lwkt_reltoken(&pti->pt_tty.t_token);
1160 					return (EINVAL);
1161 				}
1162 				pti->pt_flags |= PF_PKT;
1163 			} else {
1164 				pti->pt_flags &= ~PF_PKT;
1165 			}
1166 			lwkt_reltoken(&tp->t_token);
1167 			lwkt_reltoken(&pti->pt_tty.t_token);
1168 			return (0);
1169 
1170 		case TIOCUCNTL:
1171 			if (*(int *)ap->a_data) {
1172 				if (pti->pt_flags & PF_PKT) {
1173 					lwkt_reltoken(&tp->t_token);
1174 					lwkt_reltoken(&pti->pt_tty.t_token);
1175 					return (EINVAL);
1176 				}
1177 				pti->pt_flags |= PF_UCNTL;
1178 			} else {
1179 				pti->pt_flags &= ~PF_UCNTL;
1180 			}
1181 			lwkt_reltoken(&tp->t_token);
1182 			lwkt_reltoken(&pti->pt_tty.t_token);
1183 			return (0);
1184 
1185 		case TIOCREMOTE:
1186 			if (*(int *)ap->a_data)
1187 				pti->pt_flags |= PF_REMOTE;
1188 			else
1189 				pti->pt_flags &= ~PF_REMOTE;
1190 			ttyflush(tp, FREAD|FWRITE);
1191 			lwkt_reltoken(&tp->t_token);
1192 			lwkt_reltoken(&pti->pt_tty.t_token);
1193 			return (0);
1194 
1195 		case TIOCISPTMASTER:
1196 			if ((pti->pt_flags & PF_UNIX98) &&
1197 			    (pti->devc == dev)) {
1198 				lwkt_reltoken(&tp->t_token);
1199 				lwkt_reltoken(&pti->pt_tty.t_token);
1200 				return (0);
1201 			} else {
1202 				lwkt_reltoken(&tp->t_token);
1203 				lwkt_reltoken(&pti->pt_tty.t_token);
1204 				return (EINVAL);
1205 			}
1206 		}
1207 
1208 		/*
1209 		 * The rest of the ioctls shouldn't be called until
1210 		 * the slave is open.
1211 		 */
1212 		if ((tp->t_state & TS_ISOPEN) == 0) {
1213 			lwkt_reltoken(&tp->t_token);
1214 			lwkt_reltoken(&pti->pt_tty.t_token);
1215 			return (EAGAIN);
1216 		}
1217 
1218 		switch (ap->a_cmd) {
1219 		case TIOCSETD:
1220 		case TIOCSETA:
1221 		case TIOCSETAW:
1222 		case TIOCSETAF:
1223 			/*
1224 			 * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1225 			 * ttywflush(tp) will hang if there are characters in
1226 			 * the outq.
1227 			 */
1228 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
1229 			break;
1230 
1231 		case TIOCSIG:
1232 			if (*(unsigned int *)ap->a_data >= NSIG ||
1233 			    *(unsigned int *)ap->a_data == 0) {
1234 				lwkt_reltoken(&tp->t_token);
1235 				lwkt_reltoken(&pti->pt_tty.t_token);
1236 				return(EINVAL);
1237 			}
1238 			if ((tp->t_lflag&NOFLSH) == 0)
1239 				ttyflush(tp, FREAD|FWRITE);
1240 			pgsignal(tp->t_pgrp, *(unsigned int *)ap->a_data, 1);
1241 			if ((*(unsigned int *)ap->a_data == SIGINFO) &&
1242 			    ((tp->t_lflag&NOKERNINFO) == 0))
1243 				ttyinfo(tp);
1244 			lwkt_reltoken(&tp->t_token);
1245 			lwkt_reltoken(&pti->pt_tty.t_token);
1246 			return(0);
1247 		}
1248 	}
1249 	if (ap->a_cmd == TIOCEXT) {
1250 		/*
1251 		 * When the EXTPROC bit is being toggled, we need
1252 		 * to send an TIOCPKT_IOCTL if the packet driver
1253 		 * is turned on.
1254 		 */
1255 		if (*(int *)ap->a_data) {
1256 			if (pti->pt_flags & PF_PKT) {
1257 				pti->pt_send |= TIOCPKT_IOCTL;
1258 				ptcwakeup(tp, FREAD);
1259 			}
1260 			tp->t_lflag |= EXTPROC;
1261 		} else {
1262 			if ((tp->t_lflag & EXTPROC) &&
1263 			    (pti->pt_flags & PF_PKT)) {
1264 				pti->pt_send |= TIOCPKT_IOCTL;
1265 				ptcwakeup(tp, FREAD);
1266 			}
1267 			tp->t_lflag &= ~EXTPROC;
1268 		}
1269 		lwkt_reltoken(&tp->t_token);
1270 		lwkt_reltoken(&pti->pt_tty.t_token);
1271 		return(0);
1272 	}
1273 	error = (*linesw[tp->t_line].l_ioctl)(tp, ap->a_cmd, ap->a_data,
1274 					      ap->a_fflag, ap->a_cred);
1275 	if (error == ENOIOCTL)
1276 		 error = ttioctl(tp, ap->a_cmd, ap->a_data, ap->a_fflag);
1277 	if (error == ENOIOCTL) {
1278 		if (pti->pt_flags & PF_UCNTL &&
1279 		    (ap->a_cmd & ~0xff) == UIOCCMD(0)) {
1280 			if (ap->a_cmd & 0xff) {
1281 				pti->pt_ucntl = (u_char)ap->a_cmd;
1282 				ptcwakeup(tp, FREAD);
1283 			}
1284 			lwkt_reltoken(&tp->t_token);
1285 			lwkt_reltoken(&pti->pt_tty.t_token);
1286 			return (0);
1287 		}
1288 		error = ENOTTY;
1289 	}
1290 	/*
1291 	 * If external processing and packet mode send ioctl packet.
1292 	 */
1293 	if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
1294 		switch(ap->a_cmd) {
1295 		case TIOCSETA:
1296 		case TIOCSETAW:
1297 		case TIOCSETAF:
1298 			pti->pt_send |= TIOCPKT_IOCTL;
1299 			ptcwakeup(tp, FREAD);
1300 		default:
1301 			break;
1302 		}
1303 	}
1304 	stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1305 		&& CCEQ(cc[VSTART], CTRL('q'));
1306 	if (pti->pt_flags & PF_NOSTOP) {
1307 		if (stop) {
1308 			pti->pt_send &= ~TIOCPKT_NOSTOP;
1309 			pti->pt_send |= TIOCPKT_DOSTOP;
1310 			pti->pt_flags &= ~PF_NOSTOP;
1311 			ptcwakeup(tp, FREAD);
1312 		}
1313 	} else {
1314 		if (!stop) {
1315 			pti->pt_send &= ~TIOCPKT_DOSTOP;
1316 			pti->pt_send |= TIOCPKT_NOSTOP;
1317 			pti->pt_flags |= PF_NOSTOP;
1318 			ptcwakeup(tp, FREAD);
1319 		}
1320 	}
1321 	lwkt_reltoken(&tp->t_token);
1322 	lwkt_reltoken(&pti->pt_tty.t_token);
1323 
1324 	return (error);
1325 }
1326 
1327 
1328 static void ptc_drvinit (void *unused);
1329 
1330 SYSCTL_INT(_kern, OID_AUTO, pty_debug, CTLFLAG_RW, &pty_debug_level,
1331 		0, "Change pty debug level");
1332 
1333 static void
1334 ptc_drvinit(void *unused)
1335 {
1336 	int i;
1337 
1338 	/*
1339 	 * Unix98 pty stuff.
1340 	 * Create the clonable base device.
1341 	 */
1342 	make_autoclone_dev(&ptc_ops, &DEVFS_CLONE_BITMAP(pty), ptyclone,
1343 			   0, 0, 0666, "ptmx");
1344 	ptis = kmalloc(sizeof(struct pt_ioctl *) * MAXPTYS, M_PTY,
1345 		       M_WAITOK | M_ZERO);
1346 
1347 	for (i = 0; i < 256; i++) {
1348 		ptyinit(i);
1349 	}
1350 }
1351 
1352 SYSINIT(ptcdev, SI_SUB_DRIVERS, SI_ORDER_MIDDLE + CDEV_MAJOR_C,
1353 	ptc_drvinit, NULL);
1354