sys/kern/tty_pty.c

   1 /*
   2  * (MPSAFE)
   3  *
   4  * Copyright (c) 1982, 1986, 1989, 1993
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the University nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  *
  31  *      @(#)tty_pty.c   8.4 (Berkeley) 2/20/95
  32  * $FreeBSD: src/sys/kern/tty_pty.c,v 1.74.2.4 2002/02/20 19:58:13 dillon Exp $
  33  */
  34
  35 /*
  36  * Most functions here could use a separate lock to deal with concurrent
  37  * access to the 'pt's.
  38  */
  39
  40 /*
  41  * Pseudo-teletype Driver
  42  * (Actually two drivers, requiring two dev_ops structures)
  43  */
  44
  45 #include <sys/param.h>
  46 #include <sys/systm.h>
  47 #include <sys/proc.h>
  48 #include <sys/priv.h>
  49 #include <sys/tty.h>
  50 #include <sys/ttydefaults.h>    /* for TTYDEF_* */
  51 #include <sys/conf.h>
  52 #include <sys/fcntl.h>
  53 #include <sys/kernel.h>
  54 #include <sys/vnode.h>
  55 #include <sys/signalvar.h>
  56 #include <sys/malloc.h>
  57 #include <sys/device.h>
  58 #include <sys/thread2.h>
  59 #include <sys/devfs.h>
  60 #include <sys/stat.h>
  61 #include <sys/sysctl.h>
  62
  63 MALLOC_DEFINE(M_PTY, "ptys", "pty data structures");
  64
  65 static void ptsstart (struct tty *tp);
  66 static void ptsstop (struct tty *tp, int rw);
  67 static void ptsunhold (struct tty *tp);
  68 static void ptcwakeup (struct tty *tp, int flag);
  69 static void ptyinit (int n);
  70 static int  filt_ptcread (struct knote *kn, long hint);
  71 static void filt_ptcrdetach (struct knote *kn);
  72 static int  filt_ptcwrite (struct knote *kn, long hint);
  73 static void filt_ptcwdetach (struct knote *kn);
  74
  75 static  d_open_t        ptsopen;
  76 static  d_close_t       ptsclose;
  77 static  d_read_t        ptsread;
  78 static  d_write_t       ptswrite;
  79 static  d_ioctl_t       ptyioctl;
  80 static  d_open_t        ptcopen;
  81 static  d_close_t       ptcclose;
  82 static  d_read_t        ptcread;
  83 static  d_write_t       ptcwrite;
  84 static  d_kqfilter_t    ptckqfilter;
  85
  86 DEVFS_DEFINE_CLONE_BITMAP(pty);
  87 static struct pt_ioctl **ptis;          /* keep pti's intact */
  88
  89 static  d_clone_t       ptyclone;
  90
  91 static int      pty_debug_level = 0;
  92
  93 static struct dev_ops pts98_ops = {
  94         { "pts98", 0, D_TTY | D_MPSAFE },
  95         .d_open =       ptsopen,
  96         .d_close =      ptsclose,
  97         .d_read =       ptsread,
  98         .d_write =      ptswrite,
  99         .d_ioctl =      ptyioctl,
 100         .d_kqfilter =   ttykqfilter,
 101         .d_revoke =     ttyrevoke
 102 };
 103
 104 static struct dev_ops ptc98_ops = {
 105         { "ptc98", 0, D_TTY | D_MASTER | D_MPSAFE },
 106         .d_open =       ptcopen,
 107         .d_close =      ptcclose,
 108         .d_read =       ptcread,
 109         .d_write =      ptcwrite,
 110         .d_ioctl =      ptyioctl,
 111         .d_kqfilter =   ptckqfilter,
 112         .d_revoke =     ttyrevoke
 113 };
 114
 115 static struct dev_ops pts_ops = {
 116         { "pts", 0, D_TTY | D_MPSAFE },
 117         .d_open =       ptsopen,
 118         .d_close =      ptsclose,
 119         .d_read =       ptsread,
 120         .d_write =      ptswrite,
 121         .d_ioctl =      ptyioctl,
 122         .d_kqfilter =   ttykqfilter,
 123         .d_revoke =     ttyrevoke
 124 };
 125
 126 #define CDEV_MAJOR_C    6
 127 static struct dev_ops ptc_ops = {
 128         { "ptc", 0, D_TTY | D_MASTER | D_MPSAFE },
 129         .d_open =       ptcopen,
 130         .d_close =      ptcclose,
 131         .d_read =       ptcread,
 132         .d_write =      ptcwrite,
 133         .d_ioctl =      ptyioctl,
 134         .d_kqfilter =   ptckqfilter,
 135         .d_revoke =     ttyrevoke
 136 };
 137
 138 #define BUFSIZ  100             /* Chunk size iomoved to/from user */
 139
 140 #define MAXPTYS 1000            /* Maximum cloneable ptys */
 141
 142 struct  pt_ioctl {
 143         int     pt_flags;
 144         int     pt_refs;        /* Structural references interlock S/MOPEN */
 145         int     pt_uminor;
 146         struct  kqinfo pt_kqr, pt_kqw;
 147         u_char  pt_send;
 148         u_char  pt_ucntl;
 149         struct tty pt_tty;
 150         cdev_t  devs, devc;
 151         struct  prison *pt_prison;
 152 };
 153
 154 /*
 155  * pt_flags ptc state
 156  */
 157 #define PF_PKT          0x0008          /* packet mode */
 158 #define PF_STOPPED      0x0010          /* user told stopped */
 159 #define PF_REMOTE       0x0020          /* remote and flow controlled input */
 160 #define PF_NOSTOP       0x0040
 161 #define PF_UCNTL        0x0080          /* user control mode */
 162
 163 #define PF_PTCSTATEMASK 0x00FF
 164
 165 /*
 166  * pt_flags open state.  Note that PF_SCLOSED is used to activate
 167  * read EOF on the ptc so it is only set after the slave has been
 168  * opened and then closed, and cleared again if the slave is opened
 169  * again.
 170  */
 171 #define PF_UNIX98       0x0100
 172 #define PF_SOPEN        0x0200
 173 #define PF_MOPEN        0x0400
 174 #define PF_SCLOSED      0x0800
 175 #define PF_TERMINATED   0x8000
 176
 177 /*
 178  * This function creates and initializes a pts/ptc pair
 179  *
 180  * pts == /dev/tty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
 181  * ptc == /dev/pty[pqrsPQRS][0123456789abcdefghijklmnopqrstuv]
 182  *
 183  * XXX: define and add mapping of upper minor bits to allow more
 184  *      than 256 ptys.
 185  */
 186 static void
 187 ptyinit(int n)
 188 {
 189         cdev_t devs, devc;
 190         char *names = "pqrsPQRS";
 191         struct pt_ioctl *pti;
 192
 193         /* For now we only map the lower 8 bits of the minor */
 194         if (n & ~0xff)
 195                 return;
 196
 197         pti = kmalloc(sizeof(*pti), M_PTY, M_WAITOK | M_ZERO);
 198         pti->devs = devs = make_dev(&pts_ops, n, 0, 0, 0666,
 199                                     "tty%c%c",
 200                                     names[n / 32], hex2ascii(n % 32));
 201         pti->devc = devc = make_dev(&ptc_ops, n, 0, 0, 0666,
 202                                     "pty%c%c",
 203                                     names[n / 32], hex2ascii(n % 32));
 204
 205         pti->pt_tty.t_dev = devs;
 206         pti->pt_uminor = n;
 207         devs->si_drv1 = devc->si_drv1 = pti;
 208         devs->si_tty = devc->si_tty = &pti->pt_tty;
 209         devs->si_flags |= SI_OVERRIDE;  /* uid, gid, perms from dev */
 210         devc->si_flags |= SI_OVERRIDE;  /* uid, gid, perms from dev */
 211         ttyinit(&pti->pt_tty);
 212         ttyregister(&pti->pt_tty);
 213 }
 214
 215 static int
 216 ptyclone(struct dev_clone_args *ap)
 217 {
 218         int unit;
 219         struct pt_ioctl *pti;
 220
 221         /*
 222          * Limit the number of unix98 pty (slave) devices to 1000, as
 223          * the utmp(5) format only allows for 8 bytes for the tty,
 224          * "pts/XXX".
 225          *
 226          * If this limit is reached, we don't clone and return an error
 227          * to devfs.
 228          */
 229         unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), MAXPTYS);
 230
 231         if (unit < 0) {
 232                 ap->a_dev = NULL;
 233                 return 1;
 234         }
 235
 236         /*
 237          * pti structures must be persistent once allocated.
 238          */
 239         if ((pti = ptis[unit]) == NULL) {
 240                 lwkt_gettoken(&tty_token);
 241                 pti = kmalloc(sizeof(*pti), M_PTY, M_WAITOK | M_ZERO);
 242                 if (ptis[unit] == NULL) {
 243                         ptis[unit] = pti;
 244                         ttyinit(&pti->pt_tty);
 245                 } else {
 246                         kfree(pti, M_PTY);
 247                 }
 248                 lwkt_reltoken(&tty_token);
 249         }
 250
 251         /*
 252          * The cloning bitmap should guarantee isolation during
 253          * initialization.
 254          */
 255         pti->devc = make_only_dev(&ptc98_ops, unit,
 256                                   ap->a_cred->cr_ruid,
 257                                   0, 0600, "ptm/%d", unit);
 258         pti->devs = make_dev(&pts98_ops, unit,
 259                              ap->a_cred->cr_ruid,
 260                              GID_TTY, 0620, "pts/%d", unit);
 261         ap->a_dev = pti->devc;
 262
 263         pti->devs->si_flags |= SI_OVERRIDE;     /* uid, gid, perms from dev */
 264         pti->devc->si_flags |= SI_OVERRIDE;     /* uid, gid, perms from dev */
 265
 266         pti->pt_tty.t_dev = pti->devs;
 267         pti->pt_flags = PF_UNIX98;
 268         pti->pt_uminor = unit;
 269         pti->devs->si_drv1 = pti->devc->si_drv1 = pti;
 270         pti->devs->si_tty = pti->devc->si_tty = &pti->pt_tty;
 271         ttyregister(&pti->pt_tty);
 272
 273         return 0;
 274 }
 275
 276 /*
 277  * pti_hold() prevents the pti from being destroyed due to a termination
 278  * while a pt*open() is blocked.
 279  *
 280  * This function returns non-zero if we cannot hold due to a termination
 281  * interlock.
 282  */
 283 static int
 284 pti_hold(struct pt_ioctl *pti)
 285 {
 286         if (pti->pt_flags & PF_TERMINATED)
 287                 return(ENXIO);
 288         ++pti->pt_refs;
 289
 290         return(0);
 291 }
 292
 293 /*
 294  * pti_done() releases the reference and checks to see if both sides have
 295  * been closed on a unix98 pty, allowing us to destroy the device and
 296  * release resources.
 297  *
 298  * We do not release resources on non-unix98 ptys.  Those are left
 299  * statically allocated.
 300  */
 301 static void
 302 pti_done(struct pt_ioctl *pti)
 303 {
 304         lwkt_gettoken(&pti->pt_tty.t_token);
 305         if (--pti->pt_refs == 0) {
 306                 cdev_t dev;
 307                 int uminor_no;
 308
 309                 /*
 310                  * Only unix09 ptys are freed up (the pti structure itself
 311                  * is never freed, regardless).
 312                  */
 313                 if ((pti->pt_flags & PF_UNIX98) == 0) {
 314                         lwkt_reltoken(&pti->pt_tty.t_token);
 315                         return;
 316                 }
 317
 318                 /*
 319                  * Interlock open attempts against termination by setting
 320                  * PF_TERMINATED.  This allows us to block while cleaning
 321                  * out the device infrastructure.
 322                  *
 323                  * Do not terminate the tty if it still has a session
 324                  * association (t_refs).
 325                  */
 326                 if ((pti->pt_flags & (PF_SOPEN|PF_MOPEN)) == 0 &&
 327                     pti->pt_tty.t_refs == 0) {
 328                         pti->pt_flags |= PF_TERMINATED;
 329                         uminor_no = pti->pt_uminor;
 330
 331                         if ((dev = pti->devs) != NULL) {
 332                                 dev->si_drv1 = NULL;
 333                                 pti->devs = NULL;
 334                                 destroy_dev(dev);
 335                         }
 336                         if ((dev = pti->devc) != NULL) {
 337                                 dev->si_drv1 = NULL;
 338                                 pti->devc = NULL;
 339                                 destroy_dev(dev);
 340                         }
 341                         ttyunregister(&pti->pt_tty);
 342                         pti->pt_tty.t_dev = NULL;
 343
 344                         devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(pty),
 345                                                uminor_no);
 346                         /* pti structure remains intact */
 347                 }
 348         }
 349         lwkt_reltoken(&pti->pt_tty.t_token);
 350 }
 351
 352 /*ARGSUSED*/
 353 static  int
 354 ptsopen(struct dev_open_args *ap)
 355 {
 356         cdev_t dev = ap->a_head.a_dev;
 357         struct tty *tp;
 358         int error;
 359         struct pt_ioctl *pti;
 360
 361         /*
 362          * The pti will already be assigned by the clone code or
 363          * pre-created if a non-unix 98 pty.  If si_drv1 is NULL
 364          * we are somehow racing a unix98 termination.
 365          */
 366         if (dev->si_drv1 == NULL)
 367                 return(ENXIO);
 368         pti = dev->si_drv1;
 369
 370         lwkt_gettoken(&pti->pt_tty.t_token);
 371         if (pti_hold(pti)) {
 372                 lwkt_reltoken(&pti->pt_tty.t_token);
 373                 return(ENXIO);
 374         }
 375
 376         tp = dev->si_tty;
 377
 378         /*
 379          * Reinit most of the tty state if it isn't open.  Handle
 380          * exclusive access.
 381          */
 382         if ((tp->t_state & TS_ISOPEN) == 0) {
 383                 ttychars(tp);           /* Set up default chars */
 384                 tp->t_iflag = TTYDEF_IFLAG;
 385                 tp->t_oflag = TTYDEF_OFLAG;
 386                 tp->t_lflag = TTYDEF_LFLAG;
 387                 tp->t_cflag = TTYDEF_CFLAG;
 388                 tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
 389         } else if ((tp->t_state & TS_XCLUDE) &&
 390                    priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) {
 391                 pti_done(pti);
 392                 lwkt_reltoken(&pti->pt_tty.t_token);
 393                 return (EBUSY);
 394         } else if (pti->pt_prison != ap->a_cred->cr_prison) {
 395                 pti_done(pti);
 396                 lwkt_reltoken(&pti->pt_tty.t_token);
 397                 return (EBUSY);
 398         }
 399
 400         /*
 401          * If the ptc is already present this will connect us up.  It
 402          * is unclear if this is actually needed.
 403          *
 404          * If neither side is open be sure to clear any left over
 405          * ZOMBIE state before continuing.
 406          */
 407         if (tp->t_oproc)
 408                 (void)(*linesw[tp->t_line].l_modem)(tp, 1);
 409         else if ((pti->pt_flags & PF_SOPEN) == 0)
 410                 tp->t_state &= ~TS_ZOMBIE;
 411
 412         /*
 413          * Wait for the carrier (ptc side)
 414          */
 415         while ((tp->t_state & TS_CARR_ON) == 0) {
 416                 if (ap->a_oflags & FNONBLOCK)
 417                         break;
 418                 error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ptsopn", 0);
 419                 if (error) {
 420                         pti_done(pti);
 421                         lwkt_reltoken(&pti->pt_tty.t_token);
 422                         return (error);
 423                 }
 424         }
 425
 426         /*
 427          * Mark the tty open and mark the slave side as being open.
 428          */
 429         error = (*linesw[tp->t_line].l_open)(dev, tp);
 430
 431         if (error == 0) {
 432                 pti->pt_flags |= PF_SOPEN;
 433                 pti->pt_flags &= ~PF_SCLOSED;
 434                 ptcwakeup(tp, FREAD|FWRITE);
 435         }
 436         pti_done(pti);
 437         lwkt_reltoken(&pti->pt_tty.t_token);
 438
 439         return (error);
 440 }
 441
 442 static  int
 443 ptsclose(struct dev_close_args *ap)
 444 {
 445         cdev_t dev = ap->a_head.a_dev;
 446         struct tty *tp;
 447         struct pt_ioctl *pti = dev->si_drv1;
 448         int err;
 449
 450         lwkt_gettoken(&pti->pt_tty.t_token);
 451         if (pti_hold(pti))
 452                 panic("ptsclose on terminated pti");
 453
 454         /*
 455          * Disconnect the slave side
 456          */
 457         tp = dev->si_tty;
 458         err = (*linesw[tp->t_line].l_close)(tp, ap->a_fflag);
 459         ptsstop(tp, FREAD|FWRITE);
 460         ttyclose(tp);                   /* clears t_state */
 461
 462         /*
 463          * Mark the pts side closed and signal the ptc.  Do not mark the
 464          * tty a zombie... that is, allow the tty to be re-opened as long
 465          * as the ptc is still open.  The ptc will read() EOFs until the
 466          * pts side is reopened or the ptc is closed.
 467          *
 468          * xterm() depends on this behavior as it will revoke() the pts
 469          * and then reopen it after the (unnecessary old code) chmod.
 470          */
 471         pti->pt_flags &= ~PF_SOPEN;
 472         pti->pt_flags |= PF_SCLOSED;
 473         if (tp->t_oproc)
 474                 ptcwakeup(tp, FREAD);
 475         pti_done(pti);
 476         lwkt_reltoken(&pti->pt_tty.t_token);
 477         return (err);
 478 }
 479
 480 static  int
 481 ptsread(struct dev_read_args *ap)
 482 {
 483         cdev_t dev = ap->a_head.a_dev;
 484         struct proc *p = curproc;
 485         struct tty *tp = dev->si_tty;
 486         struct pt_ioctl *pti = dev->si_drv1;
 487         struct lwp *lp;
 488
 489         int error = 0;
 490
 491         lp = curthread->td_lwp;
 492
 493         lwkt_gettoken(&pti->pt_tty.t_token);
 494 again:
 495         if (pti->pt_flags & PF_REMOTE) {
 496                 while (isbackground(p, tp)) {
 497                         if (SIGISMEMBER(p->p_sigignore, SIGTTIN) ||
 498                             SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
 499                             p->p_pgrp->pg_jobc == 0 ||
 500                             (p->p_flags & P_PPWAIT)) {
 501                                 lwkt_reltoken(&pti->pt_tty.t_token);
 502                                 return (EIO);
 503                         }
 504                         pgsignal(p->p_pgrp, SIGTTIN, 1);
 505                         error = ttysleep(tp, &lbolt, PCATCH, "ptsbg", 0);
 506                         if (error) {
 507                                 lwkt_reltoken(&pti->pt_tty.t_token);
 508                                 return (error);
 509                         }
 510                 }
 511                 if (tp->t_canq.c_cc == 0) {
 512                         if (ap->a_ioflag & IO_NDELAY) {
 513                                 lwkt_reltoken(&pti->pt_tty.t_token);
 514                                 return (EWOULDBLOCK);
 515                         }
 516                         error = ttysleep(tp, TSA_PTS_READ(tp), PCATCH,
 517                                          "ptsin", 0);
 518                         if (error) {
 519                                 lwkt_reltoken(&pti->pt_tty.t_token);
 520                                 return (error);
 521                         }
 522                         goto again;
 523                 }
 524                 while (tp->t_canq.c_cc > 1 && ap->a_uio->uio_resid > 0)
 525                         if (ureadc(clist_getc(&tp->t_canq), ap->a_uio) < 0) {
 526                                 error = EFAULT;
 527                                 break;
 528                         }
 529                 if (tp->t_canq.c_cc == 1)
 530                         clist_getc(&tp->t_canq);
 531                 if (tp->t_canq.c_cc) {
 532                         lwkt_reltoken(&pti->pt_tty.t_token);
 533                         return (error);
 534                 }
 535         } else
 536                 if (tp->t_oproc)
 537                         error = (*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag);
 538         ptcwakeup(tp, FWRITE);
 539         lwkt_reltoken(&pti->pt_tty.t_token);
 540
 541         return (error);
 542 }
 543
 544 /*
 545  * Write to pseudo-tty.
 546  * Wakeups of controlling tty will happen
 547  * indirectly, when tty driver calls ptsstart.
 548  */
 549 static  int
 550 ptswrite(struct dev_write_args *ap)
 551 {
 552         cdev_t dev = ap->a_head.a_dev;
 553         struct tty *tp;
 554         int ret;
 555
 556         tp = dev->si_tty;
 557         lwkt_gettoken(&tp->t_token);
 558         if (tp->t_oproc == NULL) {
 559                 lwkt_reltoken(&tp->t_token);
 560                 return (EIO);
 561         }
 562         ret = ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
 563         lwkt_reltoken(&tp->t_token);
 564
 565         return ret;
 566 }
 567
 568 /*
 569  * Start output on pseudo-tty.
 570  * Wake up process selecting or sleeping for input from controlling tty.
 571  */
 572 static void
 573 ptsstart(struct tty *tp)
 574 {
 575         struct pt_ioctl *pti = tp->t_dev->si_drv1;
 576
 577         lwkt_gettoken(&pti->pt_tty.t_token);
 578         lwkt_gettoken(&tp->t_token);
 579         if (tp->t_state & TS_TTSTOP) {
 580                 lwkt_reltoken(&tp->t_token);
 581                 lwkt_reltoken(&pti->pt_tty.t_token);
 582                 return;
 583         }
 584         if (pti) {
 585                 if (pti->pt_flags & PF_STOPPED) {
 586                         pti->pt_flags &= ~PF_STOPPED;
 587                         pti->pt_send = TIOCPKT_START;
 588                 }
 589         }
 590         ptcwakeup(tp, FREAD);
 591         lwkt_reltoken(&tp->t_token);
 592         lwkt_reltoken(&pti->pt_tty.t_token);
 593 }
 594
 595 /*
 596  * NOTE: Must be called with tp->t_token held
 597  */
 598 static void
 599 ptcwakeup(struct tty *tp, int flag)
 600 {
 601         if (flag & FREAD) {
 602                 wakeup(TSA_PTC_READ(tp));
 603                 KNOTE(&tp->t_rkq.ki_note, 0);
 604         }
 605         if (flag & FWRITE) {
 606                 wakeup(TSA_PTC_WRITE(tp));
 607                 KNOTE(&tp->t_wkq.ki_note, 0);
 608         }
 609 }
 610
 611 static  int
 612 ptcopen(struct dev_open_args *ap)
 613 {
 614         cdev_t dev = ap->a_head.a_dev;
 615         struct tty *tp;
 616         struct pt_ioctl *pti;
 617
 618         /*
 619          * The pti will already be assigned by the clone code or
 620          * pre-created if a non-unix 98 pty.  If si_drv1 is NULL
 621          * we are somehow racing a unix98 termination.
 622          */
 623         pti = dev->si_drv1;
 624         if (pti == NULL)
 625                 return(ENXIO);
 626
 627         lwkt_gettoken(&pti->pt_tty.t_token);
 628         if (pti_hold(pti)) {
 629                 lwkt_reltoken(&pti->pt_tty.t_token);
 630                 return(ENXIO);
 631         }
 632         if (pti->pt_prison && pti->pt_prison != ap->a_cred->cr_prison) {
 633                 pti_done(pti);
 634                 lwkt_reltoken(&pti->pt_tty.t_token);
 635                 return(EBUSY);
 636         }
 637         tp = dev->si_tty;
 638         lwkt_gettoken(&tp->t_token);
 639         if (tp->t_oproc) {
 640                 pti_done(pti);
 641                 lwkt_reltoken(&tp->t_token);
 642                 lwkt_reltoken(&pti->pt_tty.t_token);
 643                 return (EIO);
 644         }
 645
 646         /*
 647          * If the slave side is not yet open clear any left over zombie
 648          * state before doing our modem control.
 649          */
 650         if ((pti->pt_flags & PF_SOPEN) == 0)
 651                 tp->t_state &= ~TS_ZOMBIE;
 652
 653         tp->t_oproc = ptsstart;
 654         tp->t_stop = ptsstop;
 655         tp->t_unhold = ptsunhold;
 656
 657         /*
 658          * Carrier on!
 659          */
 660         (void)(*linesw[tp->t_line].l_modem)(tp, 1);
 661
 662         tp->t_lflag &= ~EXTPROC;
 663         pti->pt_prison = ap->a_cred->cr_prison;
 664         pti->pt_flags &= ~PF_PTCSTATEMASK;
 665         pti->pt_send = 0;
 666         pti->pt_ucntl = 0;
 667
 668         pti->devs->si_uid = ap->a_cred->cr_uid;
 669         pti->devs->si_gid = 0;
 670         pti->devs->si_perms = 0600;
 671         pti->devc->si_uid = ap->a_cred->cr_uid;
 672         pti->devc->si_gid = 0;
 673         pti->devc->si_perms = 0600;
 674
 675         /*
 676          * Mark master side open.  This does not cause any events
 677          * on the slave side.
 678          */
 679         pti->pt_flags |= PF_MOPEN;
 680         pti_done(pti);
 681
 682         lwkt_reltoken(&tp->t_token);
 683         lwkt_reltoken(&pti->pt_tty.t_token);
 684
 685         return (0);
 686 }
 687
 688 static  int
 689 ptcclose(struct dev_close_args *ap)
 690 {
 691         cdev_t dev = ap->a_head.a_dev;
 692         struct tty *tp;
 693         struct pt_ioctl *pti = dev->si_drv1;
 694
 695         lwkt_gettoken(&pti->pt_tty.t_token);
 696         if (pti_hold(pti)) {
 697                 lwkt_reltoken(&pti->pt_tty.t_token);
 698                 panic("ptcclose on terminated pti");
 699         }
 700         tp = dev->si_tty;
 701         lwkt_gettoken(&tp->t_token);
 702
 703         (void)(*linesw[tp->t_line].l_modem)(tp, 0);
 704
 705         /*
 706          * Mark the master side closed.  If the slave is still open
 707          * mark the tty ZOMBIE, preventing any new action until both
 708          * sides have closed.
 709          *
 710          * NOTE: The ttyflush() will wake up the slave once we've
 711          *       set appropriate flags.  The ZOMBIE flag will be
 712          *       cleared when the slave side is closed.
 713          */
 714         pti->pt_flags &= ~PF_MOPEN;
 715         if (pti->pt_flags & PF_SOPEN)
 716                 tp->t_state |= TS_ZOMBIE;
 717
 718         /*
 719          * Turn off the carrier and disconnect.  This will notify the slave
 720          * side.
 721          */
 722         if (tp->t_state & TS_ISOPEN) {
 723                 tp->t_state &= ~(TS_CARR_ON | TS_CONNECTED);
 724                 ttyflush(tp, FREAD | FWRITE);
 725         }
 726         tp->t_oproc = NULL;             /* mark closed */
 727
 728         pti->pt_prison = NULL;
 729         pti->devs->si_uid = 0;
 730         pti->devs->si_gid = 0;
 731         pti->devs->si_perms = 0666;
 732         pti->devc->si_uid = 0;
 733         pti->devc->si_gid = 0;
 734         pti->devc->si_perms = 0666;
 735
 736         pti_done(pti);
 737         lwkt_reltoken(&tp->t_token);
 738         lwkt_reltoken(&pti->pt_tty.t_token);
 739
 740         return (0);
 741 }
 742
 743 static  int
 744 ptcread(struct dev_read_args *ap)
 745 {
 746         cdev_t dev = ap->a_head.a_dev;
 747         struct tty *tp = dev->si_tty;
 748         struct pt_ioctl *pti = dev->si_drv1;
 749         char buf[BUFSIZ];
 750         int error = 0, cc;
 751
 752         lwkt_gettoken(&pti->pt_tty.t_token);
 753         lwkt_gettoken(&tp->t_token);
 754
 755         /*
 756          * We want to block until the slave
 757          * is open, and there's something to read;
 758          * but if we lost the slave or we're NBIO,
 759          * then return the appropriate error instead.
 760          */
 761         for (;;) {
 762                 if (tp->t_state&TS_ISOPEN) {
 763                         if ((pti->pt_flags & PF_PKT) && pti->pt_send) {
 764                                 error = ureadc((int)pti->pt_send, ap->a_uio);
 765                                 if (error) {
 766                                         lwkt_reltoken(&tp->t_token);
 767                                         lwkt_reltoken(&pti->pt_tty.t_token);
 768                                         return (error);
 769                                 }
 770                                 if (pti->pt_send & TIOCPKT_IOCTL) {
 771                                         cc = (int)szmin(ap->a_uio->uio_resid,
 772                                                         sizeof(tp->t_termios));
 773                                         uiomove((caddr_t)&tp->t_termios, cc,
 774                                                 ap->a_uio);
 775                                 }
 776                                 pti->pt_send = 0;
 777                                 lwkt_reltoken(&tp->t_token);
 778                                 lwkt_reltoken(&pti->pt_tty.t_token);
 779
 780                                 return (0);
 781                         }
 782                         if ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl) {
 783                                 error = ureadc((int)pti->pt_ucntl, ap->a_uio);
 784                                 if (error) {
 785                                         lwkt_reltoken(&tp->t_token);
 786                                         lwkt_reltoken(&pti->pt_tty.t_token);
 787                                         return (error);
 788                                 }
 789                                 pti->pt_ucntl = 0;
 790                                 lwkt_reltoken(&tp->t_token);
 791                                 lwkt_reltoken(&pti->pt_tty.t_token);
 792
 793                                 return (0);
 794                         }
 795                         if (tp->t_outq.c_cc && (tp->t_state&TS_TTSTOP) == 0)
 796                                 break;
 797                 }
 798                 if ((tp->t_state & TS_CONNECTED) == 0) {
 799                         lwkt_reltoken(&tp->t_token);
 800                         lwkt_reltoken(&pti->pt_tty.t_token);
 801                         return (0);     /* EOF */
 802                 }
 803                 if (ap->a_ioflag & IO_NDELAY) {
 804                         lwkt_reltoken(&tp->t_token);
 805                         lwkt_reltoken(&pti->pt_tty.t_token);
 806                         return (EWOULDBLOCK);
 807                 }
 808                 error = tsleep(TSA_PTC_READ(tp), PCATCH, "ptcin", 0);
 809                 if (error) {
 810                         lwkt_reltoken(&tp->t_token);
 811                         lwkt_reltoken(&pti->pt_tty.t_token);
 812                         return (error);
 813                 }
 814         }
 815         if (pti->pt_flags & (PF_PKT|PF_UCNTL))
 816                 error = ureadc(0, ap->a_uio);
 817         while (ap->a_uio->uio_resid > 0 && error == 0) {
 818                 cc = clist_qtob(&tp->t_outq, buf,
 819                                 (int)szmin(ap->a_uio->uio_resid, BUFSIZ));
 820                 if (cc <= 0)
 821                         break;
 822                 error = uiomove(buf, (size_t)cc, ap->a_uio);
 823         }
 824         ttwwakeup(tp);
 825         lwkt_reltoken(&tp->t_token);
 826         lwkt_reltoken(&pti->pt_tty.t_token);
 827
 828         return (error);
 829 }
 830
 831 static  void
 832 ptsstop(struct tty *tp, int flush)
 833 {
 834         struct pt_ioctl *pti = tp->t_dev->si_drv1;
 835         int flag;
 836
 837         lwkt_gettoken(&pti->pt_tty.t_token);
 838         /* note: FLUSHREAD and FLUSHWRITE already ok */
 839         if (pti) {
 840                 if (flush == 0) {
 841                         flush = TIOCPKT_STOP;
 842                         pti->pt_flags |= PF_STOPPED;
 843                 } else {
 844                         pti->pt_flags &= ~PF_STOPPED;
 845                 }
 846                 pti->pt_send |= flush;
 847                 /* change of perspective */
 848         }
 849         flag = 0;
 850         if (flush & FREAD)
 851                 flag |= FWRITE;
 852         if (flush & FWRITE)
 853                 flag |= FREAD;
 854         ptcwakeup(tp, flag);
 855
 856         lwkt_reltoken(&pti->pt_tty.t_token);
 857 }
 858
 859 /*
 860  * ttyunhold() calls us instead of just decrementing tp->t_refs.  This
 861  * is needed because a session can hold onto a pts (half closed state)
 862  * even if there are no live file descriptors.  Without the callback
 863  * we can't clean up.
 864  */
 865 static  void
 866 ptsunhold(struct tty *tp)
 867 {
 868         struct pt_ioctl *pti = tp->t_dev->si_drv1;
 869
 870         lwkt_gettoken(&pti->pt_tty.t_token);
 871         lwkt_gettoken(&tp->t_token);
 872         pti_hold(pti);
 873         --tp->t_refs;
 874         pti_done(pti);
 875         lwkt_reltoken(&tp->t_token);
 876         lwkt_reltoken(&pti->pt_tty.t_token);
 877 }
 878
 879 /*
 880  * kqueue ops for pseudo-terminals.
 881  */
 882 static struct filterops ptcread_filtops =
 883         { FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ptcrdetach, filt_ptcread };
 884 static struct filterops ptcwrite_filtops =
 885         { FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ptcwdetach, filt_ptcwrite };
 886
 887 static  int
 888 ptckqfilter(struct dev_kqfilter_args *ap)
 889 {
 890         cdev_t dev = ap->a_head.a_dev;
 891         struct knote *kn = ap->a_kn;
 892         struct tty *tp = dev->si_tty;
 893         struct klist *klist;
 894
 895         ap->a_result = 0;
 896         switch (kn->kn_filter) {
 897         case EVFILT_READ:
 898                 klist = &tp->t_rkq.ki_note;
 899                 kn->kn_fop = &ptcread_filtops;
 900                 break;
 901         case EVFILT_WRITE:
 902                 klist = &tp->t_wkq.ki_note;
 903                 kn->kn_fop = &ptcwrite_filtops;
 904                 break;
 905         default:
 906                 ap->a_result = EOPNOTSUPP;
 907                 return (0);
 908         }
 909
 910         kn->kn_hook = (caddr_t)dev;
 911         knote_insert(klist, kn);
 912         return (0);
 913 }
 914
 915 static int
 916 filt_ptcread (struct knote *kn, long hint)
 917 {
 918         struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
 919         struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
 920
 921         lwkt_gettoken(&pti->pt_tty.t_token);
 922         lwkt_gettoken(&tp->t_token);
 923
 924         if ((tp->t_state & TS_ZOMBIE) || (pti->pt_flags & PF_SCLOSED)) {
 925                 kn->kn_flags |= (EV_EOF | EV_NODATA);
 926                 lwkt_reltoken(&tp->t_token);
 927                 lwkt_reltoken(&pti->pt_tty.t_token);
 928                 return (1);
 929         }
 930
 931         if ((tp->t_state & TS_ISOPEN) &&
 932             ((tp->t_outq.c_cc && (tp->t_state & TS_TTSTOP) == 0) ||
 933              ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
 934              ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))) {
 935                 kn->kn_data = tp->t_outq.c_cc;
 936                 lwkt_reltoken(&tp->t_token);
 937                 lwkt_reltoken(&pti->pt_tty.t_token);
 938                 return(1);
 939         } else {
 940                 lwkt_reltoken(&tp->t_token);
 941                 lwkt_reltoken(&pti->pt_tty.t_token);
 942                 return(0);
 943         }
 944 }
 945
 946 static int
 947 filt_ptcwrite (struct knote *kn, long hint)
 948 {
 949         struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
 950         struct pt_ioctl *pti = ((cdev_t)kn->kn_hook)->si_drv1;
 951
 952         lwkt_gettoken(&pti->pt_tty.t_token);
 953         lwkt_gettoken(&tp->t_token);
 954         if (tp->t_state & TS_ZOMBIE) {
 955                 lwkt_reltoken(&tp->t_token);
 956                 lwkt_reltoken(&pti->pt_tty.t_token);
 957                 kn->kn_flags |= (EV_EOF | EV_NODATA);
 958                 return (1);
 959         }
 960
 961         if (tp->t_state & TS_ISOPEN &&
 962             ((pti->pt_flags & PF_REMOTE) ?
 963              (tp->t_canq.c_cc == 0) :
 964              ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
 965               (tp->t_canq.c_cc == 0 && (tp->t_lflag & ICANON))))) {
 966                 kn->kn_data = tp->t_canq.c_cc + tp->t_rawq.c_cc;
 967                 lwkt_reltoken(&tp->t_token);
 968                 lwkt_reltoken(&pti->pt_tty.t_token);
 969                 return(1);
 970         } else {
 971                 lwkt_reltoken(&tp->t_token);
 972                 lwkt_reltoken(&pti->pt_tty.t_token);
 973                 return(0);
 974         }
 975         /* NOTREACHED */
 976 }
 977
 978 static void
 979 filt_ptcrdetach (struct knote *kn)
 980 {
 981         struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
 982
 983         knote_remove(&tp->t_rkq.ki_note, kn);
 984 }
 985
 986 static void
 987 filt_ptcwdetach (struct knote *kn)
 988 {
 989         struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
 990
 991         knote_remove(&tp->t_wkq.ki_note, kn);
 992 }
 993
 994 /*
 995  * I/O ops
 996  */
 997 static  int
 998 ptcwrite(struct dev_write_args *ap)
 999 {
1000         cdev_t dev = ap->a_head.a_dev;
1001         struct tty *tp = dev->si_tty;
1002         u_char *cp = NULL;
1003         int cc = 0;
1004         u_char locbuf[BUFSIZ];
1005         int cnt = 0;
1006         struct pt_ioctl *pti = dev->si_drv1;
1007         int error = 0;
1008
1009         lwkt_gettoken(&pti->pt_tty.t_token);
1010         lwkt_gettoken(&tp->t_token);
1011 again:
1012         if ((tp->t_state&TS_ISOPEN) == 0)
1013                 goto block;
1014         if (pti->pt_flags & PF_REMOTE) {
1015                 if (tp->t_canq.c_cc)
1016                         goto block;
1017                 while ((ap->a_uio->uio_resid > 0 || cc > 0) &&
1018                        tp->t_canq.c_cc < TTYHOG - 1) {
1019                         if (cc == 0) {
1020                                 cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
1021                                 cc = imin(cc, TTYHOG - 1 - tp->t_canq.c_cc);
1022                                 cp = locbuf;
1023                                 error = uiomove(cp, (size_t)cc, ap->a_uio);
1024                                 if (error) {
1025                                         lwkt_reltoken(&tp->t_token);
1026                                         lwkt_reltoken(&pti->pt_tty.t_token);
1027                                         return (error);
1028                                 }
1029                                 /* check again for safety */
1030                                 if ((tp->t_state & TS_ISOPEN) == 0) {
1031                                         /* adjust as usual */
1032                                         ap->a_uio->uio_resid += cc;
1033                                         lwkt_reltoken(&tp->t_token);
1034                                         lwkt_reltoken(&pti->pt_tty.t_token);
1035                                         return (EIO);
1036                                 }
1037                         }
1038                         if (cc > 0) {
1039                                 cc = clist_btoq((char *)cp, cc, &tp->t_canq);
1040                                 /*
1041                                  * XXX we don't guarantee that the canq size
1042                                  * is >= TTYHOG, so the above btoq() may
1043                                  * leave some bytes uncopied.  However, space
1044                                  * is guaranteed for the null terminator if
1045                                  * we don't fail here since (TTYHOG - 1) is
1046                                  * not a multiple of CBSIZE.
1047                                  */
1048                                 if (cc > 0)
1049                                         break;
1050                         }
1051                 }
1052                 /* adjust for data copied in but not written */
1053                 ap->a_uio->uio_resid += cc;
1054                 clist_putc(0, &tp->t_canq);
1055                 ttwakeup(tp);
1056                 wakeup(TSA_PTS_READ(tp));
1057                 lwkt_reltoken(&tp->t_token);
1058                 lwkt_reltoken(&pti->pt_tty.t_token);
1059
1060                 return (0);
1061         }
1062         while (ap->a_uio->uio_resid > 0 || cc > 0) {
1063                 if (cc == 0) {
1064                         cc = (int)szmin(ap->a_uio->uio_resid, BUFSIZ);
1065                         cp = locbuf;
1066                         error = uiomove(cp, (size_t)cc, ap->a_uio);
1067                         if (error) {
1068                                 lwkt_reltoken(&tp->t_token);
1069                                 lwkt_reltoken(&pti->pt_tty.t_token);
1070                                 return (error);
1071                         }
1072                         /* check again for safety */
1073                         if ((tp->t_state & TS_ISOPEN) == 0) {
1074                                 /* adjust for data copied in but not written */
1075                                 ap->a_uio->uio_resid += cc;
1076                                 lwkt_reltoken(&tp->t_token);
1077                                 lwkt_reltoken(&pti->pt_tty.t_token);
1078                                 return (EIO);
1079                         }
1080                 }
1081                 while (cc > 0) {
1082                         if ((tp->t_rawq.c_cc + tp->t_canq.c_cc) >= TTYHOG - 2 &&
1083                            (tp->t_canq.c_cc > 0 || !(tp->t_lflag&ICANON))) {
1084                                 wakeup(TSA_HUP_OR_INPUT(tp));
1085                                 goto block;
1086                         }
1087                         (*linesw[tp->t_line].l_rint)(*cp++, tp);
1088                         cnt++;
1089                         cc--;
1090                 }
1091                 cc = 0;
1092         }
1093         lwkt_reltoken(&tp->t_token);
1094         lwkt_reltoken(&pti->pt_tty.t_token);
1095         return (0);
1096 block:
1097         /*
1098          * Come here to wait for slave to open, for space
1099          * in outq, or space in rawq, or an empty canq.
1100          */
1101         if ((tp->t_state & TS_CONNECTED) == 0) {
1102                 /* adjust for data copied in but not written */
1103                 ap->a_uio->uio_resid += cc;
1104                 lwkt_reltoken(&tp->t_token);
1105                 lwkt_reltoken(&pti->pt_tty.t_token);
1106                 return (EIO);
1107         }
1108         if (ap->a_ioflag & IO_NDELAY) {
1109                 /* adjust for data copied in but not written */
1110                 ap->a_uio->uio_resid += cc;
1111                 if (cnt == 0) {
1112                         lwkt_reltoken(&tp->t_token);
1113                         lwkt_reltoken(&pti->pt_tty.t_token);
1114                         return (EWOULDBLOCK);
1115                 }
1116                 lwkt_reltoken(&tp->t_token);
1117                 lwkt_reltoken(&pti->pt_tty.t_token);
1118                 return (0);
1119         }
1120         error = tsleep(TSA_PTC_WRITE(tp), PCATCH, "ptcout", 0);
1121         if (error) {
1122                 /* adjust for data copied in but not written */
1123                 ap->a_uio->uio_resid += cc;
1124                 lwkt_reltoken(&tp->t_token);
1125                 lwkt_reltoken(&pti->pt_tty.t_token);
1126                 return (error);
1127         }
1128         goto again;
1129 }
1130
1131 /*ARGSUSED*/
1132 static  int
1133 ptyioctl(struct dev_ioctl_args *ap)
1134 {
1135         cdev_t dev = ap->a_head.a_dev;
1136         struct tty *tp = dev->si_tty;
1137         struct pt_ioctl *pti = dev->si_drv1;
1138         u_char *cc = tp->t_cc;
1139         int stop, error;
1140
1141         lwkt_gettoken(&pti->pt_tty.t_token);
1142         lwkt_gettoken(&tp->t_token);
1143
1144         if (dev_dflags(dev) & D_MASTER) {
1145                 switch (ap->a_cmd) {
1146
1147                 case TIOCGPGRP:
1148                         /*
1149                          * We avoid calling ttioctl on the controller since,
1150                          * in that case, tp must be the controlling terminal.
1151                          */
1152                         *(int *)ap->a_data = tp->t_pgrp ? tp->t_pgrp->pg_id : 0;
1153                         lwkt_reltoken(&tp->t_token);
1154                         lwkt_reltoken(&pti->pt_tty.t_token);
1155                         return (0);
1156
1157                 case TIOCPKT:
1158                         if (*(int *)ap->a_data) {
1159                                 if (pti->pt_flags & PF_UCNTL) {
1160                                         lwkt_reltoken(&tp->t_token);
1161                                         lwkt_reltoken(&pti->pt_tty.t_token);
1162                                         return (EINVAL);
1163                                 }
1164                                 pti->pt_flags |= PF_PKT;
1165                         } else {
1166                                 pti->pt_flags &= ~PF_PKT;
1167                         }
1168                         lwkt_reltoken(&tp->t_token);
1169                         lwkt_reltoken(&pti->pt_tty.t_token);
1170                         return (0);
1171
1172                 case TIOCUCNTL:
1173                         if (*(int *)ap->a_data) {
1174                                 if (pti->pt_flags & PF_PKT) {
1175                                         lwkt_reltoken(&tp->t_token);
1176                                         lwkt_reltoken(&pti->pt_tty.t_token);
1177                                         return (EINVAL);
1178                                 }
1179                                 pti->pt_flags |= PF_UCNTL;
1180                         } else {
1181                                 pti->pt_flags &= ~PF_UCNTL;
1182                         }
1183                         lwkt_reltoken(&tp->t_token);
1184                         lwkt_reltoken(&pti->pt_tty.t_token);
1185                         return (0);
1186
1187                 case TIOCREMOTE:
1188                         if (*(int *)ap->a_data)
1189                                 pti->pt_flags |= PF_REMOTE;
1190                         else
1191                                 pti->pt_flags &= ~PF_REMOTE;
1192                         ttyflush(tp, FREAD|FWRITE);
1193                         lwkt_reltoken(&tp->t_token);
1194                         lwkt_reltoken(&pti->pt_tty.t_token);
1195                         return (0);
1196
1197                 case TIOCISPTMASTER:
1198                         if ((pti->pt_flags & PF_UNIX98) &&
1199                             (pti->devc == dev)) {
1200                                 lwkt_reltoken(&tp->t_token);
1201                                 lwkt_reltoken(&pti->pt_tty.t_token);
1202                                 return (0);
1203                         } else {
1204                                 lwkt_reltoken(&tp->t_token);
1205                                 lwkt_reltoken(&pti->pt_tty.t_token);
1206                                 return (EINVAL);
1207                         }
1208                 }
1209
1210                 /*
1211                  * The rest of the ioctls shouldn't be called until
1212                  * the slave is open.
1213                  */
1214                 if ((tp->t_state & TS_ISOPEN) == 0) {
1215                         lwkt_reltoken(&tp->t_token);
1216                         lwkt_reltoken(&pti->pt_tty.t_token);
1217                         return (EAGAIN);
1218                 }
1219
1220                 switch (ap->a_cmd) {
1221                 case TIOCSETD:
1222                 case TIOCSETA:
1223                 case TIOCSETAW:
1224                 case TIOCSETAF:
1225                         /*
1226                          * IF CONTROLLER STTY THEN MUST FLUSH TO PREVENT A HANG.
1227                          * ttywflush(tp) will hang if there are characters in
1228                          * the outq.
1229                          */
1230                         ndflush(&tp->t_outq, tp->t_outq.c_cc);
1231                         break;
1232
1233                 case TIOCSIG:
1234                         if (*(unsigned int *)ap->a_data >= NSIG ||
1235                             *(unsigned int *)ap->a_data == 0) {
1236                                 lwkt_reltoken(&tp->t_token);
1237                                 lwkt_reltoken(&pti->pt_tty.t_token);
1238                                 return(EINVAL);
1239                         }
1240                         if ((tp->t_lflag&NOFLSH) == 0)
1241                                 ttyflush(tp, FREAD|FWRITE);
1242                         pgsignal(tp->t_pgrp, *(unsigned int *)ap->a_data, 1);
1243                         if ((*(unsigned int *)ap->a_data == SIGINFO) &&
1244                             ((tp->t_lflag&NOKERNINFO) == 0))
1245                                 ttyinfo(tp);
1246                         lwkt_reltoken(&tp->t_token);
1247                         lwkt_reltoken(&pti->pt_tty.t_token);
1248                         return(0);
1249                 }
1250         }
1251         if (ap->a_cmd == TIOCEXT) {
1252                 /*
1253                  * When the EXTPROC bit is being toggled, we need
1254                  * to send an TIOCPKT_IOCTL if the packet driver
1255                  * is turned on.
1256                  */
1257                 if (*(int *)ap->a_data) {
1258                         if (pti->pt_flags & PF_PKT) {
1259                                 pti->pt_send |= TIOCPKT_IOCTL;
1260                                 ptcwakeup(tp, FREAD);
1261                         }
1262                         tp->t_lflag |= EXTPROC;
1263                 } else {
1264                         if ((tp->t_lflag & EXTPROC) &&
1265                             (pti->pt_flags & PF_PKT)) {
1266                                 pti->pt_send |= TIOCPKT_IOCTL;
1267                                 ptcwakeup(tp, FREAD);
1268                         }
1269                         tp->t_lflag &= ~EXTPROC;
1270                 }
1271                 lwkt_reltoken(&tp->t_token);
1272                 lwkt_reltoken(&pti->pt_tty.t_token);
1273                 return(0);
1274         }
1275         error = (*linesw[tp->t_line].l_ioctl)(tp, ap->a_cmd, ap->a_data,
1276                                               ap->a_fflag, ap->a_cred);
1277         if (error == ENOIOCTL)
1278                  error = ttioctl(tp, ap->a_cmd, ap->a_data, ap->a_fflag);
1279         if (error == ENOIOCTL) {
1280                 if (pti->pt_flags & PF_UCNTL &&
1281                     (ap->a_cmd & ~0xff) == UIOCCMD(0)) {
1282                         if (ap->a_cmd & 0xff) {
1283                                 pti->pt_ucntl = (u_char)ap->a_cmd;
1284                                 ptcwakeup(tp, FREAD);
1285                         }
1286                         lwkt_reltoken(&tp->t_token);
1287                         lwkt_reltoken(&pti->pt_tty.t_token);
1288                         return (0);
1289                 }
1290                 error = ENOTTY;
1291         }
1292         /*
1293          * If external processing and packet mode send ioctl packet.
1294          */
1295         if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
1296                 switch(ap->a_cmd) {
1297                 case TIOCSETA:
1298                 case TIOCSETAW:
1299                 case TIOCSETAF:
1300                         pti->pt_send |= TIOCPKT_IOCTL;
1301                         ptcwakeup(tp, FREAD);
1302                 default:
1303                         break;
1304                 }
1305         }
1306         stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s'))
1307                 && CCEQ(cc[VSTART], CTRL('q'));
1308         if (pti->pt_flags & PF_NOSTOP) {
1309                 if (stop) {
1310                         pti->pt_send &= ~TIOCPKT_NOSTOP;
1311                         pti->pt_send |= TIOCPKT_DOSTOP;
1312                         pti->pt_flags &= ~PF_NOSTOP;
1313                         ptcwakeup(tp, FREAD);
1314                 }
1315         } else {
1316                 if (!stop) {
1317                         pti->pt_send &= ~TIOCPKT_DOSTOP;
1318                         pti->pt_send |= TIOCPKT_NOSTOP;
1319                         pti->pt_flags |= PF_NOSTOP;
1320                         ptcwakeup(tp, FREAD);
1321                 }
1322         }
1323         lwkt_reltoken(&tp->t_token);
1324         lwkt_reltoken(&pti->pt_tty.t_token);
1325
1326         return (error);
1327 }
1328
1329
1330 static void ptc_drvinit (void *unused);
1331
1332 SYSCTL_INT(_kern, OID_AUTO, pty_debug, CTLFLAG_RW, &pty_debug_level,
1333                 0, "Change pty debug level");
1334
1335 static void
1336 ptc_drvinit(void *unused)
1337 {
1338         int i;
1339
1340         /*
1341          * Unix98 pty stuff.
1342          * Create the clonable base device.
1343          */
1344         make_autoclone_dev(&ptc_ops, &DEVFS_CLONE_BITMAP(pty), ptyclone,
1345                            0, 0, 0666, "ptmx");
1346         ptis = kmalloc(sizeof(struct pt_ioctl *) * MAXPTYS, M_PTY,
1347                        M_WAITOK | M_ZERO);
1348
1349         for (i = 0; i < 256; i++) {
1350                 ptyinit(i);
1351         }
1352 }
1353
1354 SYSINIT(ptcdev, SI_SUB_DRIVERS, SI_ORDER_MIDDLE + CDEV_MAJOR_C,
1355         ptc_drvinit, NULL);