sys/kern/tty_pty.c

   1 /*
   2  * (MPSAFE)
   3  *
   4  * Copyright (c) 1982, 1986, 1989, 1993
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the University nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  *
  31  *      @(#)tty_pty.c   8.4 (Berkeley) 2/20/95
  32  * $FreeBSD: src/sys/kern/tty_pty.c,v 1.74.2.4 2002/02/20 19:58:13 dillon Exp $
  33  */
  34
  35 /*
  36  * Most functions here could use a separate lock to deal with concurrent
  37  * access to the 'pt's.
  38  */
  39
  40 /*
  41  * Pseudo-teletype Driver
  42  * (Actually two drivers, requiring two dev_ops structures)
  43  */
  44
  45 #include <sys/param.h>
  46 #include <sys/systm.h>
  47 #include <sys/uio.h>
  48 #include <sys/proc.h>
  49 #include <sys/priv.h>
  50 #include <sys/tty.h>
  51 #include <sys/ttydefaults.h>    /* for TTYDEF_* */
  52 #include <sys/conf.h>
  53 #include <sys/fcntl.h>
  54 #include <sys/kernel.h>
  55 #include <sys/vnode.h>
  56 #include <sys/signalvar.h>
  57 #include <sys/malloc.h>
  58 #include <sys/device.h>
  59 #include <sys/devfs.h>
  60 #include <sys/stat.h>
  61 #include <sys/sysctl.h>
  62
  63 MALLOC_DEFINE(M_PTY, "ptys", "pty data structures");
  64
  65 static void ptsstart (struct tty *tp);
  66 static void ptsstop (struct tty *tp, int rw);
  67 static void ptsunhold (struct tty *tp);
  68 static void ptcwakeup (struct tty *tp, int flag);
  69 static void ptyinit (int n);
  70 static int  filt_ptcread (struct knote *kn, long hint);
  71 static void filt_ptcrdetach (struct knote *kn);
  72 static int  filt_ptcwrite (struct knote *kn, long hint);
  73 static void filt_ptcwdetach (struct knote *kn);
  74
  75 static  d_open_t        ptsopen;
  76 static  d_close_t       ptsclose;
  77 static  d_read_t        ptsread;
  78 static  d_write_t       ptswrite;
  79 static  d_ioctl_t       ptyioctl;
  80 static  d_open_t        ptcopen;
  81 static  d_close_t       ptcclose;
  82 static  d_read_t        ptcread;
  83 static  d_write_t       ptcwrite;
  84 static  d_kqfilter_t    ptckqfilter;
  85
  86 DEVFS_DEFINE_CLONE_BITMAP(pty);
  87 static struct pt_ioctl **ptis;          /* keep pti's intact */
  88
  89 static  d_clone_t       ptyclone;
  90
  91 static int      pty_debug_level = 0;
  92
  93 static struct dev_ops pts98_ops = {
  94         { "pts98", 0, D_TTY | D_MPSAFE },
  95         .d_open =       ptsopen,
  96         .d_close =      ptsclose,
  97         .d_read =       ptsread,
  98         .d_write =      ptswrite,
  99         .d_ioctl =      ptyioctl,
 100         .d_kqfilter =   ttykqfilter,
 101         .d_revoke =     ttyrevoke
 102 };
 103
 104 static struct dev_ops ptc98_ops = {
 105         { "ptc98", 0, D_TTY | D_MASTER | D_MPSAFE },
 106         .d_open =       ptcopen,
 107         .d_close =      ptcclose,
 108         .d_read =       ptcread,
 109         .d_write =      ptcwrite,
 110         .d_ioctl =      ptyioctl,
 111         .d_kqfilter =   ptckqfilter,
 112         .d_revoke =     ttyrevoke
 113 };
 114
 115 static struct dev_ops pts_ops = {
 116         { "pts", 0, D_TTY | D_MPSAFE },
 117         .d_open =       ptsopen,
 118         .d_close =      ptsclose,
 119         .d_read =       ptsread,
 120         .d_write =      ptswrite,
 121         .d_ioctl =      ptyioctl,
 122         .d_kqfilter =   ttykqfilter,
 123         .d_revoke =     ttyrevoke
 124 };
 125
 126 #define CDEV_MAJOR_C    6
 127 static struct dev_ops ptc_ops = {
 128         { "ptc", 0, D_TTY | D_MASTER | D_MPSAFE },
 129         .d_open =       ptcopen,
 130         .d_close =      ptcclose,
 131         .d_read =       ptcread,
 132         .d_write =      ptcwrite,
 133         .d_ioctl =      ptyioctl,
 134         .d_kqfilter =   ptckqfilter,
 135         .d_revoke =     ttyrevoke
 136 };
 137
 138 #define BUFSIZ  100             /* Chunk size iomoved to/from user */
 139
 140 #define MAXPTYS 1000            /* Maximum cloneable ptys */
 141
 142 struct  pt_ioctl {
 143         int     pt_flags;
 144         int     pt_refs;        /* Structural references interlock S/MOPEN */
 145         int     pt_uminor;
 146         struct  kqinfo pt_kqr, pt_kqw;
 147         u_char  pt_send;
 148         u_char  pt_ucntl;
 149         struct tty pt_tty;
 150         cdev_t  devs, devc;
 151         struct  prison *pt_prison;
 152 };
 153
 154 /*
 155  * pt_flags ptc state
 156  */
 157 #define PF_PKT          0x0008          /* packet mode */
 158 #define PF_STOPPED      0x0010          /* user told stopped */
 159 #define PF_REMOTE       0x0020          /* remote and flow controlled input */
 160 #define PF_NOSTOP       0x0040
 161 #define PF_UCNTL        0x0080          /* user control mode */
 162
 163 #define PF_PTCSTATEMASK 0x00FF
 164
 165 /*
 166  * pt_flags open state.  Note that PF_SCLOSED is used to activate
 167  * read EOF on the ptc so it is only set after the slave has been
 168  * opened and then closed, and cleared again if the slave is opened
 169  * again.
 170  */
 171 #define PF_UNIX98       0x0100
 172 #define PF_SOPEN        0x0200
 173 #define PF_MOPEN        0x0400
 174 #define PF_SCLOSED      0x0800
 175 #define PF_TERMINATED   0x8000
 176
 177 /*
 178  * This function creates and initializes a pts/ptc pair
 179  *
 180  * pts == /dev/tty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
 181  * ptc == /dev/pty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
 182  *
 183  * XXX: define and add mapping of upper minor bits to allow more
 184  *      than 256 ptys.
 185  */
 186 static void
 187 ptyinit(int n)
 188 {
 189         cdev_t devs, devc;
 190         char *names = "pqrsPQRS";
 191         struct pt_ioctl *pti;
 192
 193         /* For now we only map the lower 8 bits of the minor */
 194         if (n & ~0xff)
 195                 return;
 196
 197         pti = kmalloc(sizeof(*pti), M_PTY, M_WAITOK | M_ZERO);
 198         pti->devs = devs = make_dev(&pts_ops, n, 0, 0, 0666,
 199                                     "tty%c%c",
 200                                     names[n / 32], hex2ascii(n % 32));
 201         pti->devc = devc = make_dev(&ptc_ops, n, 0, 0, 0666,
 202                                     "pty%c%c",
 203                                     names[n / 32], hex2ascii(n % 32));
 204
 205         pti->pt_tty.t_dev = devs;
 206         pti->pt_uminor = n;
 207         devs->si_drv1 = devc->si_drv1 = pti;
 208         devs->si_tty = devc->si_tty = &pti->pt_tty;
 209         devs->si_flags |= SI_OVERRIDE;  /* uid, gid, perms from dev */
 210         devc->si_flags |= SI_OVERRIDE;  /* uid, gid, perms from dev */
 211         ttyinit(&pti->pt_tty);
 212         ttyregister(&pti->pt_tty);
 213 }
 214
 215 static int
 216 ptyclone(struct dev_clone_args *ap)
 217 {
 218         int unit;
 219         struct pt_ioctl *pti;
 220
 221         /*
 222          * Limit the number of unix98 pty (slave) devices to 1000 for now.
 223          *
 224          * If this limit is reached, we don't clone and return an error
 225          * to devfs.
 226          */
 227         unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), MAXPTYS);
 228
 229         if (unit < 0) {
 230                 ap->a_dev = NULL;
 231                 return 1;
 232         }
 233
 234         /*
 235          * pti structures must be persistent once allocated.
 236          */
 237         if ((pti = ptis[unit]) == NULL) {
 238                 lwkt_gettoken(&tty_token);
 239                 pti = kmalloc(sizeof(*pti), M_PTY, M_WAITOK | M_ZERO);
 240                 if (ptis[unit] == NULL) {
 241                         ptis[unit] = pti;
 242                         ttyinit(&pti->pt_tty);
 243                 } else {
 244                         kfree(pti, M_PTY);
 245                 }
 246                 lwkt_reltoken(&tty_token);
 247         }
 248
 249         /*
 250          * The cloning bitmap should guarantee isolation during
 251          * initialization.
 252          */
 253         pti->devc = make_only_dev(&ptc98_ops, unit,
 254                                   ap->a_cred->cr_ruid,
 255                                   0, 0600, "ptm/%d", unit);
 256         pti->devs = make_dev(&pts98_ops, unit,
 257                              ap->a_cred->cr_ruid,
 258                              GID_TTY, 0620, "pts/%d", unit);
 259         ap->a_dev = pti->devc;
 260
 261         pti->devs->si_flags |= SI_OVERRIDE;     /* uid, gid, perms from dev */
 262         pti->devc->si_flags |= SI_OVERRIDE;     /* uid, gid, perms from dev */
 263
 264         pti->pt_tty.t_dev = pti->devs;
 265         pti->pt_flags = PF_UNIX98;
 266         pti->pt_uminor = unit;
 267         pti->devs->si_drv1 = pti->devc->si_drv1 = pti;
 268         pti->devs->si_tty = pti->devc->si_tty = &pti->pt_tty;
 269         ttyregister(&pti->pt_tty);
 270
 271         return 0;
 272 }
 273
 274 /*
 275  * pti_hold() prevents the pti from being destroyed due to a termination
 276  * while a pt*open() is blocked.
 277  *
 278  * This function returns non-zero if we cannot hold due to a termination
 279  * interlock.
 280  */
 281 static int
 282 pti_hold(struct pt_ioctl *pti)
 283 {
 284         if (pti->pt_flags & PF_TERMINATED)
 285                 return(ENXIO);
 286         ++pti->pt_refs;
 287
 288         return(0);
 289 }
 290
 291 /*
 292  * pti_done() releases the reference and checks to see if both sides have
 293  * been closed on a unix98 pty, allowing us to destroy the device and
 294  * release resources.
 295  *
 296  * We do not release resources on non-unix98 ptys.  Those are left
 297  * statically allocated.
 298  */
 299 static void
 300 pti_done(struct pt_ioctl *pti)
 301 {
 302         lwkt_gettoken(&pti->pt_tty.t_token);
 303         if (--pti->pt_refs == 0) {
 304                 cdev_t dev;
 305                 int uminor_no;
 306
 307                 /*
 308                  * Only unix09 ptys are freed up (the pti structure itself
 309                  * is never freed, regardless).
 310                  */
 311                 if ((pti->pt_flags & PF_UNIX98) == 0) {
 312                         lwkt_reltoken(&pti->pt_tty.t_token);
 313                         return;
 314                 }
 315
 316                 /*
 317                  * Interlock open attempts against termination by setting
 318                  * PF_TERMINATED.  This allows us to block while cleaning
 319                  * out the device infrastructure.
 320                  *
 321                  * Do not terminate the tty if it still has a session
 322                  * association (t_refs).
 323                  */
 324                 if ((pti->pt_flags & (PF_SOPEN|PF_MOPEN)) == 0 &&
 325                     pti->pt_tty.t_refs == 0) {
 326                         pti->pt_flags |= PF_TERMINATED;
 327                         uminor_no = pti->pt_uminor;
 328
 329                         if ((dev = pti->devs) != NULL) {
 330                                 dev->si_drv1 = NULL;
 331                                 pti->devs = NULL;
 332                                 destroy_dev(dev);
 333                         }
 334                         if ((dev = pti->devc) != NULL) {
 335                                 dev->si_drv1 = NULL;
 336                                 pti->devc = NULL;
 337                                 destroy_dev(dev);
 338                         }
 339                         ttyunregister(&pti->pt_tty);
 340                         pti->pt_tty.t_dev = NULL;
 341
 342                         devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty),
 343                                                uminor_no);
 344                         /* pti structure remains intact */
 345                 }
 346         }
 347         lwkt_reltoken(&pti->pt_tty.t_token);
 348 }
 349
 350 /*ARGSUSED*/
 351 static  int
 352 ptsopen(struct dev_open_args *ap)
 353 {
 354         cdev_t dev = ap->a_head.a_dev;
 355         struct tty *tp;
 356         int error;
 357         struct pt_ioctl *pti;
 358
 359         /*
 360          * The pti will already be assigned by the clone code or
 361          * pre-created if a non-unix 98 pty.  If si_drv1 is NULL
 362          * we are somehow racing a unix98 termination.
 363          */
 364         if (dev->si_drv1 == NULL)
 365                 return(ENXIO);
 366         pti = dev->si_drv1;
 367
 368         lwkt_gettoken(&pti->pt_tty.t_token);
 369         if (pti_hold(pti)) {
 370                 lwkt_reltoken(&pti->pt_tty.t_token);
 371                 return(ENXIO);
 372         }
 373
 374         tp = dev->si_tty;
 375
 376         /*
 377          * Reinit most of the tty state if it isn't open.  Handle
 378          * exclusive access.
 379          */
 380         if ((tp->t_state & TS_ISOPEN) == 0) {
 381                 ttychars(tp);           /* Set up default chars */
 382                 tp->t_iflag = TTYDEF_IFLAG;
 383                 tp->t_oflag = TTYDEF_OFLAG;
 384                 tp->t_lflag = TTYDEF_LFLAG;
 385                 tp->t_cflag = TTYDEF_CFLAG;
 386                 tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
 387         } else if ((tp->t_state & TS_XCLUDE) &&
 388                    priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) {
 389                 pti_done(pti);
 390                 lwkt_reltoken(&pti->pt_tty.t_token);
 391                 return (EBUSY);
 392         } else if (pti->pt_prison != ap->a_cred->cr_prison) {
 393                 pti_done(pti);
 394                 lwkt_reltoken(&pti->pt_tty.t_token);
 395                 return (EBUSY);
 396         }
 397
 398         /*
 399          * If the ptc is already present this will connect us up.  It
 400          * is unclear if this is actually needed.
 401          *
 402          * If neither side is open be sure to clear any left over
 403          * ZOMBIE state before continuing.
 404          */
 405         if (tp->t_oproc)
 406                 (void)(*linesw[tp->t_line].l_modem)(tp, 1);
 407         else if ((pti->pt_flags & PF_SOPEN) == 0)
 408                 tp->t_state &= ~TS_ZOMBIE;
 409
 410         /*
 411          * Wait for the carrier (ptc side)
 412          */
 413         while ((tp->t_state & TS_CARR_ON) == 0) {
 414                 if (ap->a_oflags & FNONBLOCK)
 415                         break;
 416                 error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ptsopn", 0);
 417                 if (error) {
 418                         pti_done(pti);
 419                         lwkt_reltoken(&pti->pt_tty.t_token);
 420                         return (error);
 421                 }
 422         }
 423
 424         /*
 425          * Mark the tty open and mark the slave side as being open.
 426          */
 427         error = (*linesw[tp->t_line].l_open)(dev, tp);
 428
 429         if (error == 0) {
 430                 pti->pt_flags |= PF_SOPEN;
 431                 pti->pt_flags &= ~PF_SCLOSED;
 432                 ptcwakeup(tp, FREAD|FWRITE);
 433         }
 434         pti_done(pti);
 435         lwkt_reltoken(&pti->pt_tty.t_token);
 436
 437         return (error);
 438 }
 439
 440 static  int
 441 ptsclose(struct dev_close_args *ap)
 442 {
 443         cdev_t dev = ap->a_head.a_dev;
 444         struct tty *tp;
 445         struct pt_ioctl *pti = dev->si_drv1;
 446         int err;
 447
 448         lwkt_gettoken(&pti->pt_tty.t_token);
 449         if (pti_hold(pti))
 450                 panic("ptsclose on terminated pti");
 451
 452         /*
 453          * Disconnect the slave side
 454          */
 455         tp = dev->si_tty;
 456         err = (*linesw[tp->t_line].l_close)(tp, ap->a_fflag);
 457         ptsstop(tp, FREAD|FWRITE);
 458         ttyclose(tp);                   /* clears t_state */
 459
 460         /*
 461          * Mark the pts side closed and signal the ptc.  Do not mark the
 462          * tty a zombie... that is, allow the tty to be re-opened as long
 463          * as the ptc is still open.  The ptc will read() EOFs until the
 464          * pts side is reopened or the ptc is closed.
 465          *
 466          * xterm() depends on this behavior as it will revoke() the pts
 467          * and then reopen it after the (unnecessary old code) chmod.
 468          */
 469         pti->pt_flags &= ~PF_SOPEN;
 470         pti->pt_flags |= PF_SCLOSED;
 471         if (tp->t_oproc)
 472                 ptcwakeup(tp, FREAD);
 473         pti_done(pti);
 474         lwkt_reltoken(&pti->pt_tty.t_token);
 475         return (err);
 476 }
 477
 478 static  int
 479 ptsread(struct dev_read_args *ap)
 480 {
 481         cdev_t dev = ap->a_head.a_dev;
 482         struct proc *p = curproc;
 483         struct tty *tp = dev->si_tty;
 484         struct pt_ioctl *pti = dev->si_drv1;
 485         struct lwp *lp;
 486
 487         int error = 0;
 488
 489         lp = curthread->td_lwp;
 490
 491         lwkt_gettoken(&pti->pt_tty.t_token);
 492 again:
 493         if (pti->pt_flags & PF_REMOTE) {
 494                 while (isbackground(p, tp)) {
 495                         if (SIGISMEMBER(p->p_sigignore, SIGTTIN) ||
 496                             SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
 497                             p->p_pgrp->pg_jobc == 0 ||
 498                             (p->p_flags & P_PPWAIT)) {
 499                                 lwkt_reltoken(&pti->pt_tty.t_token);
 500                                 return (EIO);
 501                         }
 502                         pgsignal(p->p_pgrp, SIGTTIN, 1);
 503                         error = ttysleep(tp, &lbolt, PCATCH, "ptsbg", 0);
 504                         if (error) {
 505                                 lwkt_reltoken(&pti->pt_tty.t_token);
 506                                 return (error);
 507                         }
 508                 }
 509                 if (tp->t_canq.c_cc == 0) {
 510                         if (ap->a_ioflag & IO_NDELAY) {
 511                                 lwkt_reltoken(&pti->pt_tty.t_token);
 512                                 return (EWOULDBLOCK);
 513                         }
 514                         error = ttysleep(tp, TSA_PTS_READ(tp), PCATCH,
 515                                          "ptsin", 0);
 516                         if (error) {
 517                                 lwkt_reltoken(&pti->pt_tty.t_token);
 518                                 return (error);
 519                         }
 520                         goto again;
 521                 }
 522                 while (tp->t_canq.c_cc > 1 && ap->a_uio->uio_resid > 0)
 523                         if (ureadc(clist_getc(&tp->t_canq), ap->a_uio) < 0) {
 524                                 error = EFAULT;
 525                                 break;
 526                         }
 527                 if (tp->t_canq.c_cc == 1)
 528                         clist_getc(&tp->t_canq);
 529                 if (tp->t_canq.c_cc) {
 530                         lwkt_reltoken(&pti->pt_tty.t_token);
 531                         return (error);
 532                 }
 533         } else
 534                 if (tp->t_oproc)
 535                         error = (*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag);
 536         ptcwakeup(tp, FWRITE);
 537         lwkt_reltoken(&pti->pt_tty.t_token);
 538
 539         return (error);
 540 }
 541
 542 /*
 543  * Write to pseudo-tty.
 544  * Wakeups of controlling tty will happen
 545  * indirectly, when tty driver calls ptsstart.
 546  */
 547 static  int
 548 ptswrite(struct dev_write_args *ap)
 549 {
 550         cdev_t dev = ap->a_head.a_dev;
 551         struct tty *tp;
 552         int ret;
 553
 554         tp = dev->si_tty;
 555         lwkt_gettoken(&tp->t_token);
 556         if (tp->t_oproc == NULL) {
 557                 lwkt_reltoken(&tp->t_token);
 558                 return (EIO);
 559         }
 560         ret = ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
 561         lwkt_reltoken(&tp->t_token);
 562
 563         return ret;
 564 }
 565
 566 /*
 567  * Start output on pseudo-tty.
 568  * Wake up process selecting or sleeping for input from controlling tty.
 569  */
 570 static void
 571 ptsstart(struct tty *tp)
 572 {
 573         struct pt_ioctl *pti = tp->t_dev->si_drv1;
 574
 575         lwkt_gettoken(&pti->pt_tty.t_token);
 576         lwkt_gettoken(&tp->t_token);
 577         if (tp->t_state & TS_TTSTOP) {
 578                 lwkt_reltoken(&tp->t_token);
 579                 lwkt_reltoken(&pti->pt_tty.t_token);
 580                 return;
 581         }
 582         if (pti) {
 583                 if (pti->pt_flags & PF_STOPPED) {
 584                         pti->pt_flags &= ~PF_STOPPED;
 585                         pti->pt_send = TIOCPKT_START;
 586                 }
 587         }
 588         ptcwakeup(tp, FREAD);
 589         lwkt_reltoken(&tp->t_token);
 590         lwkt_reltoken(&pti->pt_tty.t_token);
 591 }
 592
 593 /*
 594  * NOTE: Must be called with tp->t_token held
 595  */
 596 static void
 597 ptcwakeup(struct tty *tp, int flag)
 598 {
 599         if (flag & FREAD) {
 600                 wakeup(TSA_PTC_READ(tp));
 601                 KNOTE(&tp->t_rkq.ki_note, 0);
 602         }
 603         if (flag & FWRITE) {
 604                 wakeup(TSA_PTC_WRITE(tp));
 605                 KNOTE(&tp->t_wkq.ki_note, 0);
 606         }
 607 }
 608
 609 static  int
 610 ptcopen(struct dev_open_args *ap)
 611 {
 612         cdev_t dev = ap->a_head.a_dev;
 613         struct tty *tp;
 614         struct pt_ioctl *pti;
 615
 616         /*
 617          * The pti will already be assigned by the clone code or
 618          * pre-created if a non-unix 98 pty.  If si_drv1 is NULL
 619          * we are somehow racing a unix98 termination.
 620          */
 621         pti = dev->si_drv1;
 622         if (pti == NULL)
 623                 return(ENXIO);
 624
 625         lwkt_gettoken(&pti->pt_tty.t_token);
 626         if (pti_hold(pti)) {
 627                 lwkt_reltoken(&pti->pt_tty.t_token);
 628                 return(ENXIO);
 629         }
 630         if (pti->pt_prison && pti->pt_prison != ap->a_cred->cr_prison) {
 631                 pti_done(pti);
 632                 lwkt_reltoken(&pti->pt_tty.t_token);
 633                 return(EBUSY);
 634         }
 635         tp = dev->si_tty;
 636         lwkt_gettoken(&tp->t_token);
 637         if (tp->t_oproc) {
 638                 pti_done(pti);
 639                 lwkt_reltoken(&tp->t_token);
 640                 lwkt_reltoken(&pti->pt_tty.t_token);
 641                 return (EIO);
 642         }
 643
 644         /*
 645          * If the slave side is not yet open clear any left over zombie
 646          * state before doing our modem control.
 647          */
 648         if ((pti->pt_flags & PF_SOPEN) == 0)
 649                 tp->t_state &= ~TS_ZOMBIE;
 650
 651         tp->t_oproc = ptsstart;
 652         tp->t_stop = ptsstop;
 653         tp->t_unhold = ptsunhold;
 654
 655         /*
 656          * Carrier on!
 657          */
 658         (void)(*linesw[tp->t_line].l_modem)(tp, 1);
 659
 660         tp->t_lflag &= ~EXTPROC;
 661         pti->pt_prison = ap->a_cred->cr_prison;
 662         pti->pt_flags &= ~PF_PTCSTATEMASK;
 663         pti->pt_send = 0;
 664         pti->pt_ucntl = 0;
 665
 666         pti->devs->si_uid = ap->a_cred->cr_uid;
 667         pti->devs->si_gid = ap->a_cred->cr_uid ? GID_TTY : 0;
 668         pti->devs->si_perms = 0600;
 669         pti->devc->si_uid = ap->a_cred->cr_uid;
 670         pti->devc->si_gid = 0;
 671         pti->devc->si_perms = 0600;
 672
 673         /*
 674          * Mark master side open.  This does not cause any events
 675          * on the slave side.
 676          */
 677         pti->pt_flags |= PF_MOPEN;
 678         pti_done(pti);
 679
 680         lwkt_reltoken(&tp->t_token);
 681         lwkt_reltoken(&pti->pt_tty.t_token);
 682
 683         return (0);
 684 }
 685
 686 static  int
 687 ptcclose(struct dev_close_args *ap)
 688 {
 689         cdev_t dev = ap->a_head.a_dev;
 690         struct tty *tp;
 691         struct pt_ioctl *pti = dev->si_drv1;
 692
 693         lwkt_gettoken(&pti->pt_tty.t_token);
 694         if (pti_hold(pti)) {
 695                 lwkt_reltoken(&pti->pt_tty.t_token);
 696                 panic("ptcclose on terminated pti");
 697         }
 698         tp = dev->si_tty;
 699         lwkt_gettoken(&tp->t_token);
 700
 701         (void)(*linesw[tp->t_line].l_modem)(tp, 0);
 702
 703         /*
 704          * Mark the master side closed.  If the slave is still open
 705          * mark the tty ZOMBIE, preventing any new action until both
 706          * sides have closed.
 707          *
 708          * NOTE: The ttyflush() will wake up the slave once we've
 709          *       set appropriate flags.  The ZOMBIE flag will be
 710          *       cleared when the slave side is closed.
 711          */
 712         pti->pt_flags &= ~PF_MOPEN;
 713         if (pti->pt_flags & PF_SOPEN)
 714                 tp->t_state |= TS_ZOMBIE;
 715
 716         /*
 717          * Turn off the carrier and disconnect.  This will notify the slave
 718          * side.
 719          */
 720         if (tp->t_state & TS_ISOPEN) {
 721                 tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
 722                 ttyflush(tp, FREAD | FWRITE);
 723         }
 724         tp->t_oproc = NULL;             /* mark closed */
 725
 726         pti->pt_prison = NULL;
 727         pti->devs->si_uid = 0;
 728         pti->devs->si_gid = 0;
 729         pti->devs->si_perms = 0666;
 730         pti->devc->si_uid = 0;
 731         pti->devc->si_gid = 0;
 732         pti->devc->si_perms = 0666;
 733
 734         pti_done(pti);
 735         lwkt_reltoken(&tp->t_token);
 736         lwkt_reltoken(&pti->pt_tty.t_token);
 737
 738         return (0);
 739 }
 740
 741 static  int
 742 ptcread(struct dev_read_args *ap)
 743 {
 744         cdev_t dev = ap->a_head.a_dev;
 745         struct tty *tp = dev->si_tty;
 746         struct pt_ioctl *pti = dev->si_drv1;
 747         char buf[BUFSIZ];
 748         int error = 0, cc;
 749
 750         lwkt_gettoken(&pti->pt_tty.t_token);
 751         lwkt_gettoken(&tp->t_token);
 752
 753         /*
 754          * We want to block until the slave
 755          * is open, and there's something to read;
 756          * but if we lost the slave or we're NBIO,
 757          * then return the appropriate error instead.
 758          */
 759         for (;;) {
 760                 if (tp->t_state&TS_ISOPEN) {
 761                         if ((pti->pt_flags & PF_PKT) && pti->pt_send) {
 762                                 error = ureadc((int)pti->pt_send, ap->a_uio);
 763                                 if (error) {
 764                                         lwkt_reltoken(&tp->t_token);
 765                                         lwkt_reltoken(&pti->pt_tty.t_token);
 766                                         return (error);
 767                                 }
 768                                 if (pti->pt_send & TIOCPKT_IOCTL) {
 769                                         cc = (int)szmin(ap->a_uio->uio_resid,
 770                                                         sizeof(tp->t_termios));
 771                                         uiomove((caddr_t)&tp->t_termios, cc,
 772                                                 ap->a_uio);
 773                                 }
 774                                 pti->pt_send = 0;
 775                                 lwkt_reltoken(&tp->t_token);
 776                                 lwkt_reltoken(&pti->pt_tty.t_token);
 777
 778                                 return (0);
 779                         }
 780                         if ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl) {
 781                                 error = ureadc((int)pti->pt_ucntl, ap->a_uio);
 782                                 if (error) {
 783                                         lwkt_reltoken(&tp->t_token);
 784                                         lwkt_reltoken(&pti->pt_tty.t_token);
 785                                         return (error);
 786                                 }
 787                                 pti->pt_ucntl = 0;
 788                                 lwkt_reltoken(&tp->t_token);
 789                                 lwkt_reltoken(&pti->pt_tty.t_token);
 790
 791                                 return (0);
 792                         }
 793                         if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
 794                                 break;
 795                 }
 796                 if ((tp->t_state & TS_CONNECTED) == 0) {
 797                         lwkt_reltoken(&tp->t_token);
 798                         lwkt_reltoken(&pti->pt_tty.t_token);
 799                         return (0);     /* EOF */
 800                 }
 801                 if (ap->a_ioflag & IO_NDELAY) {
 802                         lwkt_reltoken(&tp->t_token);
 803                         lwkt_reltoken(&pti->pt_tty.t_token);
 804                         return (EWOULDBLOCK);
 805                 }
 806                 error = tsleep(TSA_PTC_READ(tp), PCATCH, "ptcin", 0);
 807                 if (error) {
 808                         lwkt_reltoken(&tp->t_token);
 809                         lwkt_reltoken(&pti->pt_tty.t_token);
 810                         return (error);
 811                 }
 812         }
 813         if (pti->pt_flags & (PF_PKT|PF_UCNTL))
 814                 error = ureadc(0, ap->a_uio);
 815         while (ap->a_uio->uio_resid > 0 && error == 0) {
 816                 cc = clist_qtob(&tp->t_outq, buf,
 817                                 (int)szmin(ap->a_uio->uio_resid, BUFSIZ));
 818                 if (cc <= 0)
 819                         break;
 820                 error = uiomove(buf, (size_t)cc, ap->a_uio);
 821         }
 822         ttwwakeup(tp);
 823         lwkt_reltoken(&tp->t_token);
 824         lwkt_reltoken(&pti->pt_tty.t_token);
 825
 826         return (error);
 827 }
 828
 829 static  void
 830 ptsstop(struct tty *tp, int flush)
 831 {
 832         struct pt_ioctl *pti = tp->t_dev->si_drv1;
 833         int flag;
 834
 835         lwkt_gettoken(&pti->pt_tty.t_token);
 836         /* note: FLUSHREAD and FLUSHWRITE already ok */
 837         if (pti) {
 838                 if (flush == 0) {
 839                         flush = TIOCPKT_STOP;
 840                         pti->pt_flags |= PF_STOPPED;
 841                 } else {
 842                         pti->pt_flags &= ~PF_STOPPED;
 843                 }
 844                 pti->pt_send |= flush;
 845                 /* change of perspective */
 846         }
 847         flag = 0;
 848         if (flush & FREAD)
 849                 flag |= FWRITE;
 850         if (flush & FWRITE)
 851                 flag |= FREAD;
 852         ptcwakeup(tp, flag);
 853
 854         lwkt_reltoken(&pti->pt_tty.t_token);
 855 }
 856
 857 /*
 858  * ttyunhold() calls us instead of just decrementing tp->t_refs.  This
 859  * is needed because a session can hold onto a pts (half closed state)
 860  * even if there are no live file descriptors.  Without the callback
 861  * we can't clean up.
 862  */
 863 static  void
 864 ptsunhold(struct tty *tp)
 865 {
 866         struct pt_ioctl *pti = tp->t_dev->si_drv1;
 867
 868         lwkt_gettoken(&pti->pt_tty.t_token);
 869         lwkt_gettoken(&tp->t_token);
 870         pti_hold(pti);
 871         --tp->t_refs;
 872         pti_done(pti);
 873         lwkt_reltoken(&tp->t_token);
 874         lwkt_reltoken(&pti->pt_tty.t_token);
 875 }
 876
 877 /*
 878  * kqueue ops for pseudo-terminals.
 879  */
 880 static struct filterops ptcread_filtops =
 881         { FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ptcrdetach, filt_ptcread };
 882 static struct filterops ptcwrite_filtops =
 883         { FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ptcwdetach, filt_ptcwrite };
 884
 885 static  int
 886 ptckqfilter(struct dev_kqfilter_args *ap)
 887 {
 888         cdev_t dev = ap->a_head.a_dev;
 889         struct knote *kn = ap->a_kn;
 890         struct tty *tp = dev->si_tty;
 891         struct klist *klist;
 892
 893         ap->a_result = 0;
 894         switch (kn->kn_filter) {
 895         case EVFILT_READ:
 896                 klist = &tp->t_rkq.ki_note;
 897                 kn->kn_fop = &ptcread_filtops;
 898                 break;
 899         case EVFILT_WRITE:
 900                 klist = &tp->t_wkq.ki_note;
 901                 kn->kn_fop = &ptcwrite_filtops;
 902                 break;
 903         default:
 904                 ap->a_result = EOPNOTSUPP;
 905                 return (0);
 906         }
 907
 908         kn->kn_hook = (caddr_t)dev;
 909         knote_insert(klist, kn);
 910         return (0);
 911 }
 912
 913 static int
 914 filt_ptcread (struct knote *kn, long hint)
 915 {
 916         struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
 917         struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
 918
 919         lwkt_gettoken(&pti->pt_tty.t_token);
 920         lwkt_gettoken(&tp->t_token);
 921
 922         if ((tp->t_state & TS_ZOMBIE) || (pti->pt_flags & PF_SCLOSED)) {
 923                 kn->kn_flags |= (EV_EOF | EV_NODATA);
 924                 lwkt_reltoken(&tp->t_token);
 925                 lwkt_reltoken(&pti->pt_tty.t_token);
 926                 return (1);
 927         }
 928
 929         if ((tp->t_state & TS_ISOPEN) &&
 930             ((tp->t_outq.c_cc && (tp->t_state & TS_TTSTOP) == 0) ||
 931              ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
 932              ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))) {
 933                 kn->kn_data = tp->t_outq.c_cc;
 934                 lwkt_reltoken(&tp->t_token);
 935                 lwkt_reltoken(&pti->pt_tty.t_token);
 936                 return(1);
 937         } else {
 938                 lwkt_reltoken(&tp->t_token);
 939                 lwkt_reltoken(&pti->pt_tty.t_token);
 940                 return(0);
 941         }
 942 }
 943
 944 static int
 945 filt_ptcwrite (struct knote *kn, long hint)
 946 {
 947         struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
 948         struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
 949
 950         lwkt_gettoken(&pti->pt_tty.t_token);
 951         lwkt_gettoken(&tp->t_token);
 952         if (tp->t_state & TS_ZOMBIE) {
 953                 lwkt_reltoken(&tp->t_token);
 954                 lwkt_reltoken(&pti->pt_tty.t_token);
 955                 kn->kn_flags |= (EV_EOF | EV_NODATA);
 956                 return (1);
 957         }
 958
 959         if (tp->t_state & TS_ISOPEN &&
 960             ((pti->pt_flags & PF_REMOTE) ?
 961              (tp->t_canq.c_cc == 0) :
 962              ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
 963               (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON))))) {
 964                 kn->kn_data = tp->t_canq.c_cc + tp->t_rawq.c_cc;
 965                 lwkt_reltoken(&tp->t_token);
 966                 lwkt_reltoken(&pti->pt_tty.t_token);
 967                 return(1);
 968         } else {
 969                 lwkt_reltoken(&tp->t_token);
 970                 lwkt_reltoken(&pti->pt_tty.t_token);
 971                 return(0);
 972         }
 973         /* NOTREACHED */
 974 }
 975
 976 static void
 977 filt_ptcrdetach (struct knote *kn)
 978 {
 979         struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
 980
 981         knote_remove(&tp->t_rkq.ki_note, kn);
 982 }
 983
 984 static void
 985 filt_ptcwdetach (struct knote *kn)
 986 {
 987         struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
 988
 989         knote_remove(&tp->t_wkq.ki_note, kn);
 990 }
 991
 992 /*
 993  * I/O ops
 994  */
 995 static  int
 996 ptcwrite(struct dev_write_args *ap)
 997 {
 998         cdev_t dev = ap->a_head.a_dev;
 999         struct tty *tp = dev->si_tty;
1000         u_char *cp = NULL;
1001         int cc = 0;
1002         u_char locbuf[BUFSIZ];
1003         int cnt = 0;
1004         struct pt_ioctl *pti = dev->si_drv1;
1005         int error = 0;
1006
1007         lwkt_gettoken(&pti->pt_tty.t_token);
1008         lwkt_gettoken(&tp->t_token);
1009 again:
1010         if ((tp->t_state&TS_ISOPEN) == 0)
1011                 goto block;
1012         if (pti->pt_flags & PF_REMOTE) {
1013                 if (tp->t_canq.c_cc)
1014                         goto block;
1015                 while ((ap->a_uio->uio_resid > 0 || cc > 0) &&
1016                        tp->t_canq.c_cc < TTYHOG - 1) {
1017                         if (cc == 0) {
1018                                 cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
1019                                 cc = imin(cc, TTYHOG - 1 - tp->t_canq.c_cc);
1020                                 cp = locbuf;
1021                                 error = uiomove(cp, (size_t)cc, ap->a_uio);
1022                                 if (error) {
1023                                         lwkt_reltoken(&tp->t_token);
1024                                         lwkt_reltoken(&pti->pt_tty.t_token);
1025                                         return (error);
1026                                 }
1027                                 /* check again for safety */
1028                                 if ((tp->t_state & TS_ISOPEN) == 0) {
1029                                         /* adjust as usual */
1030                                         ap->a_uio->uio_resid += cc;
1031                                         lwkt_reltoken(&tp->t_token);
1032                                         lwkt_reltoken(&pti->pt_tty.t_token);
1033                                         return (EIO);
1034                                 }
1035                         }
1036                         if (cc > 0) {
1037                                 cc = clist_btoq((char *)cp, cc, &tp->t_canq);
1038                                 /*
1039                                  * XXX we don't guarantee that the canq size
1040                                  * is >= TTYHOG, so the above btoq() may
1041                                  * leave some bytes uncopied.  However, space
1042                                  * is guaranteed for the null terminator if
1043                                  * we don't fail here since (TTYHOG - 1) is
1044                                  * not a multiple of CBSIZE.
1045                                  */
1046                                 if (cc > 0)
1047                                         break;
1048                         }
1049                 }
1050                 /* adjust for data copied in but not written */
1051                 ap->a_uio->uio_resid += cc;
1052                 clist_putc(0, &tp->t_canq);
1053                 ttwakeup(tp);
1054                 wakeup(TSA_PTS_READ(tp));
1055                 lwkt_reltoken(&tp->t_token);
1056                 lwkt_reltoken(&pti->pt_tty.t_token);
1057
1058                 return (0);
1059         }
1060         while (ap->a_uio->uio_resid > 0 || cc > 0) {
1061                 if (cc == 0) {
1062                         cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
1063                         cp = locbuf;
1064                         error = uiomove(cp, (size_t)cc, ap->a_uio);
1065                         if (error) {
1066                                 lwkt_reltoken(&tp->t_token);
1067                                 lwkt_reltoken(&pti->pt_tty.t_token);
1068                                 return (error);
1069                         }
1070                         /* check again for safety */
1071                         if ((tp->t_state & TS_ISOPEN) == 0) {
1072                                 /* adjust for data copied in but not written */
1073                                 ap->a_uio->uio_resid += cc;
1074                                 lwkt_reltoken(&tp->t_token);
1075                                 lwkt_reltoken(&pti->pt_tty.t_token);
1076                                 return (EIO);
1077                         }
1078                 }
1079                 while (cc > 0) {
1080                         if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
1081                            (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
1082                                 wakeup(TSA_HUP_OR_INPUT(tp));
1083                                 goto block;
1084                         }
1085                         (*linesw[tp->t_line].l_rint)(*cp++, tp);
1086                         cnt++;
1087                         cc--;
1088                 }
1089                 cc = 0;
1090         }
1091         lwkt_reltoken(&tp->t_token);
1092         lwkt_reltoken(&pti->pt_tty.t_token);
1093         return (0);
1094 block:
1095         /*
1096          * Come here to wait for slave to open, for space
1097          * in outq, or space in rawq, or an empty canq.
1098          */
1099         if ((tp->t_state & TS_CONNECTED) == 0) {
1100                 /* adjust for data copied in but not written */
1101                 ap->a_uio->uio_resid += cc;
1102                 lwkt_reltoken(&tp->t_token);
1103                 lwkt_reltoken(&pti->pt_tty.t_token);
1104                 return (EIO);
1105         }
1106         if (ap->a_ioflag & IO_NDELAY) {
1107                 /* adjust for data copied in but not written */
1108                 ap->a_uio->uio_resid += cc;
1109                 if (cnt == 0) {
1110                         lwkt_reltoken(&tp->t_token);
1111                         lwkt_reltoken(&pti->pt_tty.t_token);
1112                         return (EWOULDBLOCK);
1113                 }
1114                 lwkt_reltoken(&tp->t_token);
1115                 lwkt_reltoken(&pti->pt_tty.t_token);
1116                 return (0);
1117         }
1118         error = tsleep(TSA_PTC_WRITE(tp), PCATCH, "ptcout", 0);
1119         if (error) {
1120                 /* adjust for data copied in but not written */
1121                 ap->a_uio->uio_resid += cc;
1122                 lwkt_reltoken(&tp->t_token);
1123                 lwkt_reltoken(&pti->pt_tty.t_token);
1124                 return (error);
1125         }
1126         goto again;
1127 }
1128
1129 /*ARGSUSED*/
1130 static  int
1131 ptyioctl(struct dev_ioctl_args *ap)
1132 {
1133         cdev_t dev = ap->a_head.a_dev;
1134         struct tty *tp = dev->si_tty;
1135         struct pt_ioctl *pti = dev->si_drv1;
1136         u_char *cc = tp->t_cc;
1137         int stop, error;
1138
1139         lwkt_gettoken(&pti->pt_tty.t_token);
1140         lwkt_gettoken(&tp->t_token);
1141
1142         if (dev_dflags(dev) & D_MASTER) {
1143                 switch (ap->a_cmd) {
1144
1145                 case TIOCGPGRP:
1146                         /*
1147                          * We avoid calling ttioctl on the controller since,
1148                          * in that case, tp must be the controlling terminal.
1149                          */
1150                         *(int *)ap->a_data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1151                         lwkt_reltoken(&tp->t_token);
1152                         lwkt_reltoken(&pti->pt_tty.t_token);
1153                         return (0);
1154
1155                 case TIOCPKT:
1156                         if (*(int *)ap->a_data) {
1157                                 if (pti->pt_flags & PF_UCNTL) {
1158                                         lwkt_reltoken(&tp->t_token);
1159                                         lwkt_reltoken(&pti->pt_tty.t_token);
1160                                         return (EINVAL);
1161                                 }
1162                                 pti->pt_flags |= PF_PKT;
1163                         } else {
1164                                 pti->pt_flags &= ~PF_PKT;
1165                         }
1166                         lwkt_reltoken(&tp->t_token);
1167                         lwkt_reltoken(&pti->pt_tty.t_token);
1168                         return (0);
1169
1170                 case TIOCUCNTL:
1171                         if (*(int *)ap->a_data) {
1172                                 if (pti->pt_flags & PF_PKT) {
1173                                         lwkt_reltoken(&tp->t_token);
1174                                         lwkt_reltoken(&pti->pt_tty.t_token);
1175                                         return (EINVAL);
1176                                 }
1177                                 pti->pt_flags |= PF_UCNTL;
1178                         } else {
1179                                 pti->pt_flags &= ~PF_UCNTL;
1180                         }
1181                         lwkt_reltoken(&tp->t_token);
1182                         lwkt_reltoken(&pti->pt_tty.t_token);
1183                         return (0);
1184
1185                 case TIOCREMOTE:
1186                         if (*(int *)ap->a_data)
1187                                 pti->pt_flags |= PF_REMOTE;
1188                         else
1189                                 pti->pt_flags &= ~PF_REMOTE;
1190                         ttyflush(tp, FREAD|FWRITE);
1191                         lwkt_reltoken(&tp->t_token);
1192                         lwkt_reltoken(&pti->pt_tty.t_token);
1193                         return (0);
1194
1195                 case TIOCISPTMASTER:
1196                         if ((pti->pt_flags & PF_UNIX98) &&
1197                             (pti->devc == dev)) {
1198                                 lwkt_reltoken(&tp->t_token);
1199                                 lwkt_reltoken(&pti->pt_tty.t_token);
1200                                 return (0);
1201                         } else {
1202                                 lwkt_reltoken(&tp->t_token);
1203                                 lwkt_reltoken(&pti->pt_tty.t_token);
1204                                 return (EINVAL);
1205                         }
1206                 }
1207
1208                 /*
1209                  * The rest of the ioctls shouldn't be called until
1210                  * the slave is open.
1211                  */
1212                 if ((tp->t_state & TS_ISOPEN) == 0) {
1213                         lwkt_reltoken(&tp->t_token);
1214                         lwkt_reltoken(&pti->pt_tty.t_token);
1215                         return (EAGAIN);
1216                 }
1217
1218                 switch (ap->a_cmd) {
1219                 case TIOCSETD:
1220                 case TIOCSETA:
1221                 case TIOCSETAW:
1222                 case TIOCSETAF:
1223                         /*
1224                          * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1225                          * ttywflush(tp) will hang if there are characters in
1226                          * the outq.
1227                          */
1228                         ndflush(&tp->t_outq, tp->t_outq.c_cc);
1229                         break;
1230
1231                 case TIOCSIG:
1232                         if (*(unsigned int *)ap->a_data >= NSIG ||
1233                             *(unsigned int *)ap->a_data == 0) {
1234                                 lwkt_reltoken(&tp->t_token);
1235                                 lwkt_reltoken(&pti->pt_tty.t_token);
1236                                 return(EINVAL);
1237                         }
1238                         if ((tp->t_lflag&NOFLSH) == 0)
1239                                 ttyflush(tp, FREAD|FWRITE);
1240                         pgsignal(tp->t_pgrp, *(unsigned int *)ap->a_data, 1);
1241                         if ((*(unsigned int *)ap->a_data == SIGINFO) &&
1242                             ((tp->t_lflag&NOKERNINFO) == 0))
1243                                 ttyinfo(tp);
1244                         lwkt_reltoken(&tp->t_token);
1245                         lwkt_reltoken(&pti->pt_tty.t_token);
1246                         return(0);
1247                 }
1248         }
1249         if (ap->a_cmd == TIOCEXT) {
1250                 /*
1251                  * When the EXTPROC bit is being toggled, we need
1252                  * to send an TIOCPKT_IOCTL if the packet driver
1253                  * is turned on.
1254                  */
1255                 if (*(int *)ap->a_data) {
1256                         if (pti->pt_flags & PF_PKT) {
1257                                 pti->pt_send |= TIOCPKT_IOCTL;
1258                                 ptcwakeup(tp, FREAD);
1259                         }
1260                         tp->t_lflag |= EXTPROC;
1261                 } else {
1262                         if ((tp->t_lflag & EXTPROC) &&
1263                             (pti->pt_flags & PF_PKT)) {
1264                                 pti->pt_send |= TIOCPKT_IOCTL;
1265                                 ptcwakeup(tp, FREAD);
1266                         }
1267                         tp->t_lflag &= ~EXTPROC;
1268                 }
1269                 lwkt_reltoken(&tp->t_token);
1270                 lwkt_reltoken(&pti->pt_tty.t_token);
1271                 return(0);
1272         }
1273         error = (*linesw[tp->t_line].l_ioctl)(tp, ap->a_cmd, ap->a_data,
1274                                               ap->a_fflag, ap->a_cred);
1275         if (error == ENOIOCTL)
1276                  error = ttioctl(tp, ap->a_cmd, ap->a_data, ap->a_fflag);
1277         if (error == ENOIOCTL) {
1278                 if (pti->pt_flags & PF_UCNTL &&
1279                     (ap->a_cmd & ~0xff) == UIOCCMD(0)) {
1280                         if (ap->a_cmd & 0xff) {
1281                                 pti->pt_ucntl = (u_char)ap->a_cmd;
1282                                 ptcwakeup(tp, FREAD);
1283                         }
1284                         lwkt_reltoken(&tp->t_token);
1285                         lwkt_reltoken(&pti->pt_tty.t_token);
1286                         return (0);
1287                 }
1288                 error = ENOTTY;
1289         }
1290         /*
1291          * If external processing and packet mode send ioctl packet.
1292          */
1293         if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
1294                 switch(ap->a_cmd) {
1295                 case TIOCSETA:
1296                 case TIOCSETAW:
1297                 case TIOCSETAF:
1298                         pti->pt_send |= TIOCPKT_IOCTL;
1299                         ptcwakeup(tp, FREAD);
1300                 default:
1301                         break;
1302                 }
1303         }
1304         stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1305                 && CCEQ(cc[VSTART], CTRL('q'));
1306         if (pti->pt_flags & PF_NOSTOP) {
1307                 if (stop) {
1308                         pti->pt_send &= ~TIOCPKT_NOSTOP;
1309                         pti->pt_send |= TIOCPKT_DOSTOP;
1310                         pti->pt_flags &= ~PF_NOSTOP;
1311                         ptcwakeup(tp, FREAD);
1312                 }
1313         } else {
1314                 if (!stop) {
1315                         pti->pt_send &= ~TIOCPKT_DOSTOP;
1316                         pti->pt_send |= TIOCPKT_NOSTOP;
1317                         pti->pt_flags |= PF_NOSTOP;
1318                         ptcwakeup(tp, FREAD);
1319                 }
1320         }
1321         lwkt_reltoken(&tp->t_token);
1322         lwkt_reltoken(&pti->pt_tty.t_token);
1323
1324         return (error);
1325 }
1326
1327
1328 static void ptc_drvinit (void *unused);
1329
1330 SYSCTL_INT(_kern, OID_AUTO, pty_debug, CTLFLAG_RW, &pty_debug_level,
1331                 0, "Change pty debug level");
1332
1333 static void
1334 ptc_drvinit(void *unused)
1335 {
1336         int i;
1337
1338         /*
1339          * Unix98 pty stuff.
1340          * Create the clonable base device.
1341          */
1342         make_autoclone_dev(&ptc_ops, &DEVFS_CLONE_BITMAP(pty), ptyclone,
1343                            0, 0, 0666, "ptmx");
1344         ptis = kmalloc(sizeof(struct pt_ioctl *) * MAXPTYS, M_PTY,
1345                        M_WAITOK | M_ZERO);
1346
1347         for (i = 0; i < 256; i++) {
1348                 ptyinit(i);
1349         }
1350 }
1351
1352 SYSINIT(ptcdev, SI_SUB_DRIVERS, SI_ORDER_MIDDLE + CDEV_MAJOR_C,
1353         ptc_drvinit, NULL);