Add the ptm device to pty(4). By opening /dev/ptm and using the PTMGET

ioctl(2), an unprivileged process may allocate a pty and have its owner
and mode set appropriately.  This means that programs such as xterm and
screen no longer need to be setuid.  Programs using the openpty()
function require zero changes and will "just work".

Designed by beck@ and deraadt@; changes by beck@ with cleanup (and
a rewrite of the vnode bits) by art@ and tweaks/bugfixes by me.
Tested by many.

49 files changed, 632 insertions, 88 deletions

diff --git a/etc/MAKEDEV.mi b/etc/MAKEDEV.mi
index 50300c2c8ad..9e108a187be 100644
--- a/etc/MAKEDEV.mi
+++ b/etc/MAKEDEV.mi
@@ -1,6 +1,6 @@
 include(MAKEDEV.sub)dnl
 dnl
-vers(a, {-$OpenBSD: MAKEDEV.mi,v 1.67 2004/02/05 22:22:15 todd Exp $-})dnl
+vers(a, {-$OpenBSD: MAKEDEV.mi,v 1.68 2004/02/10 01:31:20 millert Exp $-})dnl
 dnl
 divert(1)dnl
 {-#-}
@@ -186,6 +186,7 @@ target(all, ppi, 0)dnl
 target(all, view0, 0, 1, 2, 3, 4, 5)dnl
 target(all, local)dnl
 target(all, gpr, 0)dnl
+target(all, ptm)dnl
 dnl
 _mkdev(all, {-all-}, {-dnl
 show_target(all)dnl
@@ -405,6 +406,8 @@ __devitem(wsmouse, wsmouse*, wscons mice)dnl
 _mkdev(wsmouse, wsmouse*, {-M wsmouse$U c major_wsmouse_c $U 600-})dnl
 __devitem(quad, quadmouse, "quadrature mouse")dnl
 __devtitle(pty, Pseudo terminals)dnl
+__devitem(ptm, ptm, pty master device)dnl
+_mkdev(ptm, ptm, {-M ptm c major_ptm_c 0 666-})dnl
 __devitem(tty, tty*, set of 16 slave psuedo terminals)dnl
 __devitem(pty, pty*, set of 16 master pseudo terminals)dnl
 _mkdev(pty, pty*, {-if [ $U -gt 15 ]; then
diff --git a/etc/etc.alpha/MAKEDEV b/etc/etc.alpha/MAKEDEV
index 4421db9ae88..42cac7fdd97 100644
--- a/etc/etc.alpha/MAKEDEV
+++ b/etc/etc.alpha/MAKEDEV
@@ -52,6 +52,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Printers:
 #	lpt*	IEEE 1284 centronics printer
 #	lpa*	interruptless lp
@@ -382,6 +383,10 @@ lpt*|lpa*)
 	M $n$U c 31 $(($U+$f)) 600
 	;;
 
+ptm)
+	M ptm c 55 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -501,7 +506,7 @@ all)
 	R cd0 cd1 rd0 tun0 tun1 tun2 tun3 bpf0 bpf1 bpf2 bpf3 bpf4
 	R bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 fd1 fd1B fd1C fd1D
 	R fd1E fd1F fd1G fd1H fd0 fd0B fd0C fd0D fd0E fd0F fd0G fd0H
-	R xfs0 ss0 ss1 ch0 wscons pci iop0 iop1 usbs rmidi0 rmidi1
+	R xfs0 ss0 ss1 ch0 ptm wscons pci iop0 iop1 usbs rmidi0 rmidi1
 	R rmidi2 rmidi3 rmidi4 rmidi5 rmidi6 rmidi7 music0 speaker
 	R audio0 uk0 random lpa0 lpa1 lpa2 lpt0 lpt1 lpt2 mmclock lkm
 	R tty00 tty01 tty02 tty03 ttyc0 ttyc1 ttyc2 ttyc3 ttyc4 ttyc5
diff --git a/etc/etc.alpha/MAKEDEV.md b/etc/etc.alpha/MAKEDEV.md
index 9a6adf92dd3..f8f7f4b0edd 100644
--- a/etc/etc.alpha/MAKEDEV.md
+++ b/etc/etc.alpha/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.17 2004/01/12 22:18:24 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.18 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -46,6 +46,7 @@ _DEV(wsmouse, 30)
 _TITLE(pty)
 _DEV(tty, 4)
 _DEV(pty, 5)
+_DEV(ptm, 55)
 _TITLE(prn)
 _DEV(lpt, 31)
 _DEV(lpa)
diff --git a/etc/etc.cats/MAKEDEV.md b/etc/etc.cats/MAKEDEV.md
index 9e0c454c724..5c41eeefb4b 100644
--- a/etc/etc.cats/MAKEDEV.md
+++ b/etc/etc.cats/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.1 2004/02/01 05:26:50 drahn Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.2 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001 Todd T. Fries <todd@OpenBSD.org>
@@ -83,6 +83,7 @@ _DEV(systrace, 50)
 _DEV(bktr, 75)
 _DEV(tuner, 75)
 _DEV(radio, 97)
+_DEV(ptm, 98)
 dnl
 divert(7)dnl
 dnl
diff --git a/etc/etc.hp300/MAKEDEV b/etc/etc.hp300/MAKEDEV
index 5709d84e427..683c782ae93 100644
--- a/etc/etc.hp300/MAKEDEV
+++ b/etc/etc.hp300/MAKEDEV
@@ -44,6 +44,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Printers:
 #	ppi*	HP-IB plotters
 # Call units:
@@ -343,6 +344,10 @@ fd)
 	MKlist="$MKlist;chmod 555 fd"
 	;;
 
+ptm)
+	M ptm c 52 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -402,7 +407,7 @@ all)
 	R ite0 ct0 ct1 hd0 hd1 hd2 dcm0 dcm1 dcm2 dcm3 dca0 dca1 st0
 	R st1 hil grf0 ccd0 ccd1 ccd2 ccd3 vnd0 vnd1 vnd2 vnd3 sd0 sd1
 	R sd2 sd3 sd4 rd0 tun0 tun1 tun2 tun3 bpf0 bpf1 bpf2 bpf3 bpf4
-	R bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 xfs0 local ppi0
+	R bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 xfs0 ptm local ppi0
 	R apci0 random lkm pf systrace std fd
 	;;
 
diff --git a/etc/etc.hp300/MAKEDEV.md b/etc/etc.hp300/MAKEDEV.md
index 85a90e3272a..78720866fc3 100644
--- a/etc/etc.hp300/MAKEDEV.md
+++ b/etc/etc.hp300/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.14 2004/01/13 15:13:14 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.15 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -66,6 +66,7 @@ _DEV(apci)
 _TITLE(pty)
 _DEV(tty, 4)
 _DEV(pty, 5)
+_DEV(ptm, 52)
 _TITLE(prn)
 _DEV(ppi, 11)
 _TITLE(call)
diff --git a/etc/etc.hppa/MAKEDEV b/etc/etc.hppa/MAKEDEV
index 0c939a5ae0f..2381cb1cea6 100644
--- a/etc/etc.hppa/MAKEDEV
+++ b/etc/etc.hppa/MAKEDEV
@@ -41,6 +41,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Printers:
 #	lpt*	IEEE 1284 centronics printer
 # Console ports:
@@ -340,6 +341,10 @@ lpt*|lpa*)
 	M $n$U c 30 $(($U+$f)) 600
 	;;
 
+ptm)
+	M ptm c 38 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -425,9 +430,9 @@ all)
 	R cd0 cd1 rd0 tun0 tun1 tun2 tun3 bpf0 bpf1 bpf2 bpf3 bpf4
 	R bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 fd1 fd1B fd1C fd1D
 	R fd1E fd1F fd1G fd1H fd0 fd0B fd0C fd0D fd0E fd0F fd0G fd0H
-	R xfs0 ss0 ss1 ch0 ses0 wscons pci audio0 uk0 random lpa0 lpa1
-	R lpa2 lpt0 lpt1 lpt2 lkm tty00 tty01 tty02 tty03 crypto pf
-	R systrace std st0 st1 fd
+	R xfs0 ss0 ss1 ch0 ses0 ptm wscons pci audio0 uk0 random lpa0
+	R lpa1 lpa2 lpt0 lpt1 lpt2 lkm tty00 tty01 tty02 tty03 crypto
+	R pf systrace std st0 st1 fd
 	;;
 
 sd*|ccd*)
diff --git a/etc/etc.hppa/MAKEDEV.md b/etc/etc.hppa/MAKEDEV.md
index 2bef1e12100..72498d0c244 100644
--- a/etc/etc.hppa/MAKEDEV.md
+++ b/etc/etc.hppa/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.16 2003/12/09 04:27:51 mickey Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.17 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -35,6 +35,7 @@ _DEV(com, 23)
 _TITLE(pty)
 _DEV(tty, 4)
 _DEV(pty, 5)
+_DEV(ptm, 38)
 _TITLE(prn)
 _DEV(lpt, 30)
 _TITLE(cons)
diff --git a/etc/etc.i386/MAKEDEV b/etc/etc.i386/MAKEDEV
index 5299a60ac19..82001ecf440 100644
--- a/etc/etc.i386/MAKEDEV
+++ b/etc/etc.i386/MAKEDEV
@@ -54,6 +54,7 @@
 #	tty[0-7][0-9a-f]	NS16x50 serial ports
 #	ttyc*	Cyclades serial ports
 # Pseudo terminals:
+#	ptm	pty master device
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
 # Printers:
@@ -457,6 +458,10 @@ pty*)
 	done
 	;;
 
+ptm)
+	M ptm c 81 0 666
+	;;
+
 tty[0-7][0-9a-f])
 	U=${i#tty*}
 	o=$(h2d $U)
@@ -575,8 +580,8 @@ all)
 	R sd3 sd4 cd0 cd1 rd0 tun0 tun1 tun2 tun3 bpf0 bpf1 bpf2 bpf3
 	R bpf4 bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 fd1 fd1B fd1C
 	R fd1D fd1E fd1F fd1G fd1H fd0 fd0B fd0C fd0D fd0E fd0F fd0G
-	R fd0H xfs0 ss0 ss1 ch0 ses0 gpr0 wscons pci iop0 iop1 usbs
-	R rmidi0 rmidi1 rmidi2 rmidi3 rmidi4 rmidi5 rmidi6 rmidi7
+	R fd0H xfs0 ss0 ss1 ch0 ses0 ptm gpr0 wscons pci iop0 iop1
+	R usbs rmidi0 rmidi1 rmidi2 rmidi3 rmidi4 rmidi5 rmidi6 rmidi7
 	R tuner0 radio0 music0 speaker audio0 wdt0 wt0 uk0 random joy0
 	R joy1 lpa0 lpa1 lpa2 lpt0 lpt1 lpt2 lkm tty00 tty01 tty02
 	R tty03 ttyc0 ttyc1 ttyc2 ttyc3 ttyc4 ttyc5 ttyc6 ttyc7 apm
diff --git a/etc/etc.i386/MAKEDEV.md b/etc/etc.i386/MAKEDEV.md
index dd0521c7def..4e7f82eb5a1 100644
--- a/etc/etc.i386/MAKEDEV.md
+++ b/etc/etc.i386/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.18 2004/01/12 22:18:24 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.19 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -48,6 +48,7 @@ _TITLE(term)
 _DEV(com, 8)
 _DEV(ttyc, 38)
 _TITLE(pty)
+_DEV(ptm, 81)
 _DEV(tty, 5)
 _DEV(pty, 6)
 _TITLE(prn)
diff --git a/etc/etc.mac68k/MAKEDEV b/etc/etc.mac68k/MAKEDEV
index 18768d39d5f..1466591dae0 100644
--- a/etc/etc.mac68k/MAKEDEV
+++ b/etc/etc.mac68k/MAKEDEV
@@ -42,6 +42,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Graphics devices:
 #	grf*	custom chip (grf0), Retina Z2/Z3 (grf1/grf2),
 #		Cirrus boards (grf3), A2410 (grf4) video or
@@ -298,6 +299,10 @@ bpf*)
 	M bpf$U c 22 $U 600
 	;;
 
+ptm)
+	M ptm c 52 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -362,8 +367,8 @@ all)
 	R ttye0 ccd0 ccd1 ccd2 ccd3 cd0 cd1 rd0 tun0 tun1 tun2 tun3
 	R bpf0 bpf1 bpf2 bpf3 bpf4 bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1
 	R pty2 xfs0 ss0 ss1 ch0 vnd0 vnd1 vnd2 vnd3 sd0 sd1 sd2 sd3
-	R sd4 local grf0 grf1 grf2 grf3 adb asc0 uk0 random lkm tty00
-	R tty01 pf systrace std st0 st1 fd
+	R sd4 ptm local grf0 grf1 grf2 grf3 adb asc0 uk0 random lkm
+	R tty00 tty01 pf systrace std st0 st1 fd
 	;;
 
 sd*|ccd*)
diff --git a/etc/etc.mac68k/MAKEDEV.md b/etc/etc.mac68k/MAKEDEV.md
index 734ad4874a5..fb018c07524 100644
--- a/etc/etc.mac68k/MAKEDEV.md
+++ b/etc/etc.mac68k/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.12 2004/01/13 15:13:14 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.13 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -40,6 +40,7 @@ _DEV(mac_tty0)
 _TITLE(pty)
 _DEV(tty, 4)
 _DEV(pty, 5)
+_DEV(ptm, 52)
 _TITLE(graph)
 _DEV(grf_mac, 10)
 _TITLE(spec)
diff --git a/etc/etc.macppc/MAKEDEV b/etc/etc.macppc/MAKEDEV
index 5fbd2824bf6..e07a8c0f7cd 100644
--- a/etc/etc.macppc/MAKEDEV
+++ b/etc/etc.macppc/MAKEDEV
@@ -51,6 +51,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # USB devices:
 #	usb*	Bus control devices used by usbd for attach/detach
 #	uhid*	Generic HID devices
@@ -353,6 +354,10 @@ usb*)
 	M usb$u c 61 $U 660
 	;;
 
+ptm)
+	M ptm c 77 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -457,7 +462,7 @@ fd)
 all)
 	R ccd0 ccd1 ccd2 ccd3 vnd0 vnd1 vnd2 vnd3 sd0 sd1 sd2 sd3 sd4
 	R cd0 cd1 rd0 tun0 tun1 tun2 tun3 bpf0 bpf1 bpf2 bpf3 bpf4
-	R bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 xfs0 ss0 ss1 ch0
+	R bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 xfs0 ss0 ss1 ch0 ptm
 	R local wscons pci iop0 iop1 usbs tuner0 radio0 audio0 uk0
 	R random lkm tty00 tty01 tty02 tty03 apm crypto pf systrace
 	R wd0 wd1 wd2 wd3 raid0 raid1 raid2 raid3 std st0 st1 fd
diff --git a/etc/etc.macppc/MAKEDEV.md b/etc/etc.macppc/MAKEDEV.md
index 987d2d3eab9..728e0953938 100644
--- a/etc/etc.macppc/MAKEDEV.md
+++ b/etc/etc.macppc/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.13 2004/01/13 13:38:21 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.14 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -45,6 +45,7 @@ _DEV(com, 7)
 _TITLE(pty)
 _DEV(tty, 4)
 _DEV(pty, 5)
+_DEV(ptm, 77)
 _TITLE(usb)
 _DEV(usb, 61)
 _DEV(uhid, 62)
diff --git a/etc/etc.mvme68k/MAKEDEV b/etc/etc.mvme68k/MAKEDEV
index 9e113223cc9..f7ec457a81c 100644
--- a/etc/etc.mvme68k/MAKEDEV
+++ b/etc/etc.mvme68k/MAKEDEV
@@ -44,6 +44,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Printers:
 #	par0	Printer port
 # Special purpose devices:
@@ -293,6 +294,10 @@ lp*)
 	esac
 	;;
 
+ptm)
+	M ptm c 52 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -402,7 +407,7 @@ all)
 	R vnd2 vnd3 sd0 sd1 sd2 sd3 sd4 cd0 cd1 rd0 tun0 tun1 tun2
 	R tun3 bpf0 bpf1 bpf2 bpf3 bpf4 bpf5 bpf6 bpf7 bpf8 bpf9 pty0
 	R pty1 pty2 xfs0 ss0 ss1 ch0 vmel0 vmes0 flash0 nvram0 sram0
-	R uk0 random lkm pf systrace std st0 st1 fd
+	R ptm uk0 random lkm pf systrace std st0 st1 fd
 	;;
 
 sd*|ccd*)
diff --git a/etc/etc.mvme68k/MAKEDEV.md b/etc/etc.mvme68k/MAKEDEV.md
index a12b1fec4ce..81cb07c9be3 100644
--- a/etc/etc.mvme68k/MAKEDEV.md
+++ b/etc/etc.mvme68k/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.9 2003/09/26 06:58:02 miod Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.10 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -143,6 +143,7 @@ _DEV(ttyw, 30)
 _TITLE(pty)
 _DEV(tty, 4)
 _DEV(pty, 5)
+_DEV(ptm, 52)
 _TITLE(prn)
 _DEV(lp, 28)
 _TITLE(spec)
diff --git a/etc/etc.mvme88k/MAKEDEV b/etc/etc.mvme88k/MAKEDEV
index aca2f9359e8..a5c2dd3ffe8 100644
--- a/etc/etc.mvme88k/MAKEDEV
+++ b/etc/etc.mvme88k/MAKEDEV
@@ -43,6 +43,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Special purpose devices:
 #	uk*	SCSI Unknown device
 #	ss*	SCSI scanners
@@ -277,6 +278,10 @@ uk*)
 	M uk$U c 41 $U 640 operator
 	;;
 
+ptm)
+	M ptm c 52 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -370,7 +375,7 @@ all)
 	R ccd3 vnd0 vnd1 vnd2 vnd3 sd0 sd1 sd2 sd3 sd4 cd0 cd1 rd0
 	R tun0 tun1 tun2 tun3 bpf0 bpf1 bpf2 bpf3 bpf4 bpf5 bpf6 bpf7
 	R bpf8 bpf9 pty0 pty1 pty2 xfs0 ss0 ch0 vmel0 vmes0 nvram0
-	R sram0 uk0 random lkm pf systrace std st0 st1 fd
+	R sram0 ptm uk0 random lkm pf systrace std st0 st1 fd
 	;;
 
 sd*|ccd*)
diff --git a/etc/etc.mvme88k/MAKEDEV.md b/etc/etc.mvme88k/MAKEDEV.md
index f492f5749e3..da150df801e 100644
--- a/etc/etc.mvme88k/MAKEDEV.md
+++ b/etc/etc.mvme88k/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.10 2004/01/05 20:11:56 miod Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.11 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -117,6 +117,7 @@ _DEV(vx, 15)
 _TITLE(pty)
 _DEV(tty, 4)
 _DEV(pty, 5)
+_DEV(ptm, 52)
 _TITLE(spec)
 _DEV(uk, 41)
 _DEV(ss, 42)
diff --git a/etc/etc.mvmeppc/MAKEDEV.md b/etc/etc.mvmeppc/MAKEDEV.md
index cd10ea084b2..d2905ba35bd 100644
--- a/etc/etc.mvmeppc/MAKEDEV.md
+++ b/etc/etc.mvmeppc/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-        {-$OpenBSD: MAKEDEV.md,v 1.12 2004/01/12 22:18:24 todd Exp $-},
+        {-$OpenBSD: MAKEDEV.md,v 1.13 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -42,6 +42,7 @@ _DEV(wsmouse, 69)
 _TITLE(pty)
 _DEV(tty)
 _DEV(pty)
+_DEV(ptm, 55)
 _TITLE(graphics)
 _DEV(mac_grf)
 _TTILE(usb)
diff --git a/etc/etc.pegasos/MAKEDEV b/etc/etc.pegasos/MAKEDEV
index 7f020902512..532e45460be 100644
--- a/etc/etc.pegasos/MAKEDEV
+++ b/etc/etc.pegasos/MAKEDEV
@@ -52,6 +52,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # USB devices:
 #	usb*	Bus control devices used by usbd for attach/detach
 #	uhid*	Generic HID devices
@@ -361,6 +362,10 @@ usb*)
 	M usb$u c 61 $U 660
 	;;
 
+ptm)
+	M ptm c 77 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -465,7 +470,7 @@ fd)
 all)
 	R ccd0 ccd1 ccd2 ccd3 vnd0 vnd1 vnd2 vnd3 sd0 sd1 sd2 sd3 sd4
 	R cd0 cd1 rd0 tun0 tun1 tun2 tun3 bpf0 bpf1 bpf2 bpf3 bpf4
-	R bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 xfs0 ss0 ss1 ch0
+	R bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1 pty2 xfs0 ss0 ss1 ch0 ptm
 	R local wscons pci iop0 iop1 usbs tuner0 radio0 audio0 uk0
 	R random lkm tty00 tty01 tty02 tty03 apm crypto pf systrace
 	R wd0 wd1 wd2 wd3 raid0 raid1 raid2 raid3 std st0 st1 fd
diff --git a/etc/etc.pegasos/MAKEDEV.md b/etc/etc.pegasos/MAKEDEV.md
index 4d6c942b734..68509d6bb75 100644
--- a/etc/etc.pegasos/MAKEDEV.md
+++ b/etc/etc.pegasos/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.2 2004/01/12 23:32:24 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.3 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001 Todd T. Fries <todd@OpenBSD.org>
@@ -54,6 +54,7 @@ _DEV(com, 7)
 _TITLE(pty)
 _DEV(tty, 4)
 _DEV(pty, 5)
+_DEV(ptm, 77)
 _TITLE(usb)
 _DEV(usb, 61)
 _DEV(uhid, 62)
diff --git a/etc/etc.sparc/MAKEDEV b/etc/etc.sparc/MAKEDEV
index adb33704dbf..b0d67136340 100644
--- a/etc/etc.sparc/MAKEDEV
+++ b/etc/etc.sparc/MAKEDEV
@@ -45,6 +45,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Printers:
 # Console ports:
 #	ttyC0	wscons screen 0
@@ -392,6 +393,10 @@ wscons)
 	R ttyC4 ttyC5 ttyC6 ttyC7 ttyC8 ttyC9 ttyCa ttyCb
 	;;
 
+ptm)
+	M ptm c 125 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -487,9 +492,9 @@ all)
 	R tun3 bpf0 bpf1 bpf2 bpf3 bpf4 bpf5 bpf6 bpf7 bpf8 bpf9 pty0
 	R pty1 pty2 fd1 fd1B fd1C fd1D fd1E fd1F fd1G fd1H fd0 fd0B
 	R fd0C fd0D fd0E fd0F fd0G fd0H xfs0 ss0 ss1 ch0 ses0 cuaa
-	R cuab cuac cuad ttya ttyb ttyc ttyd wscons audio0 uk0 random
-	R lkm pf systrace xd0 xd1 xd2 xd3 raid0 raid1 raid2 raid3 std
-	R st0 st1 fd
+	R cuab cuac cuad ttya ttyb ttyc ttyd ptm wscons audio0 uk0
+	R random lkm pf systrace xd0 xd1 xd2 xd3 raid0 raid1 raid2
+	R raid3 std st0 st1 fd
 	;;
 
 presto*|xd*|xy*|sd*|raid*|ccd*)
diff --git a/etc/etc.sparc/MAKEDEV.md b/etc/etc.sparc/MAKEDEV.md
index 43ee54373b3..25c8d743dfa 100644
--- a/etc/etc.sparc/MAKEDEV.md
+++ b/etc/etc.sparc/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.19 2003/06/18 18:08:59 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.20 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -71,6 +71,7 @@ _DEV(presto, 25, 26)
 _TITLE(pty)
 _DEV(tty, 20)
 _DEV(pty, 21)
+_DEV(ptm, 125)
 _TITLE(prn)
 _TITLE(cons)
 _DEV(wscons)
diff --git a/etc/etc.sparc64/MAKEDEV b/etc/etc.sparc64/MAKEDEV
index 6fd4562e738..753181191d2 100644
--- a/etc/etc.sparc64/MAKEDEV
+++ b/etc/etc.sparc64/MAKEDEV
@@ -57,6 +57,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Printers:
 #	lpt*	IEEE 1284 centronics printer
 #	lpa*	interruptless lp
@@ -420,6 +421,10 @@ lpt*|lpa*)
 	M $n$U c 37 $(($U+$f)) 600
 	;;
 
+ptm)
+	M ptm c 123 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -576,8 +581,8 @@ all)
 	R bpf0 bpf1 bpf2 bpf3 bpf4 bpf5 bpf6 bpf7 bpf8 bpf9 pty0 pty1
 	R pty2 fd1 fd1B fd1C fd1D fd1E fd1F fd1G fd1H fd0 fd0B fd0C
 	R fd0D fd0E fd0F fd0G fd0H xfs0 ss0 ss1 ch0 ses0 ccd0 ccd1
-	R ccd2 ccd3 wscons pci usbs audio0 uk0 random lpa0 lpa1 lpa2
-	R lpt0 lpt1 lpt2 lkm tty00 tty01 tty02 tty03 ttyh0 ttyh1
+	R ccd2 ccd3 ptm wscons pci usbs audio0 uk0 random lpa0 lpa1
+	R lpa2 lpt0 lpt1 lpt2 lkm tty00 tty01 tty02 tty03 ttyh0 ttyh1
 	R crypto pf systrace wd0 wd1 wd2 wd3 raid0 raid1 raid2 raid3
 	R std st0 st1 fd
 	;;
diff --git a/etc/etc.sparc64/MAKEDEV.md b/etc/etc.sparc64/MAKEDEV.md
index dd7a2b9ca63..821b3170fb6 100644
--- a/etc/etc.sparc64/MAKEDEV.md
+++ b/etc/etc.sparc64/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.28 2004/01/12 22:18:24 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.29 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -76,6 +76,7 @@ _DEV(tth, 77)
 _TITLE(pty)
 _DEV(tty, 20)
 _DEV(pty, 21)
+_DEV(ptm, 123)
 _TITLE(prn)
 _DEV(lpt, 37)
 _DEV(lpa)
diff --git a/etc/etc.vax/MAKEDEV b/etc/etc.vax/MAKEDEV
index 336848d9be6..a314a46f767 100644
--- a/etc/etc.vax/MAKEDEV
+++ b/etc/etc.vax/MAKEDEV
@@ -56,6 +56,7 @@
 # Pseudo terminals:
 #	tty*	set of 16 slave psuedo terminals
 #	pty*	set of 16 master pseudo terminals
+#	ptm	pty master device
 # Printers:
 # Terminal ports:
 #	dhu*	unibus dhu11
@@ -418,6 +419,10 @@ dl*)
 	fi
 	;;
 
+ptm)
+	M ptm c 75 0 666
+	;;
+
 pty*)
 	if [ $U -gt 15 ]; then
 		echo bad unit for pty in: $i
@@ -510,9 +515,9 @@ local)
 all)
 	R vt0 dl0 dz0 dhu0 ts0 ts1 mt0 mt1 hd0 hd1 hd2 ccd0 vnd0 sd0
 	R sd1 sd2 sd3 cd0 tun0 tun1 bpf0 bpf1 bpf2 bpf3 bpf4 bpf5 bpf6
-	R bpf7 pty0 pty1 ss0 uk0 random lkm pf systrace rx0 rx1 ra0
-	R ra1 ra2 ra3 hp0 hp1 hp2 hp3 raid0 raid1 raid2 raid3 std st0
-	R st1 fd
+	R bpf7 pty0 pty1 ss0 ptm uk0 random lkm pf systrace rx0 rx1
+	R ra0 ra1 ra2 ra3 hp0 hp1 hp2 hp3 raid0 raid1 raid2 raid3 std
+	R st0 st1 fd
 	;;
 
 up*|sd*|rx*|rl*|rb*|raid*|ra*|hp*|hk*|hd*|ccd*)
diff --git a/etc/etc.vax/MAKEDEV.md b/etc/etc.vax/MAKEDEV.md
index 0f9a0145de5..ef0c8f12da2 100644
--- a/etc/etc.vax/MAKEDEV.md
+++ b/etc/etc.vax/MAKEDEV.md
@@ -1,5 +1,5 @@
 vers(__file__,
-	{-$OpenBSD: MAKEDEV.md,v 1.13 2003/06/18 18:08:59 todd Exp $-},
+	{-$OpenBSD: MAKEDEV.md,v 1.14 2004/02/10 01:31:20 millert Exp $-},
 etc.MACHINE)dnl
 dnl
 dnl Copyright (c) 2001,2002,2003 Todd T. Fries <todd@OpenBSD.org>
@@ -130,6 +130,7 @@ _DEV(ccd, 54, 17)
 _TITLE(pty)
 _DEV(tty, 20)
 _DEV(pty, 21)
+_DEV(ptm, 75)
 _TITLE(prn)
 _TITLE(term)
 _DEV(dhu, 34)
diff --git a/lib/libutil/openpty.3 b/lib/libutil/openpty.3
index 4794f7846c0..986912b6e05 100644
--- a/lib/libutil/openpty.3
+++ b/lib/libutil/openpty.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: openpty.3,v 1.11 2003/06/02 20:18:42 millert Exp $
+.\"	$OpenBSD: openpty.3,v 1.12 2004/02/10 01:31:20 millert Exp $
 .\" Copyright (c) 1995
 .\"	The Regents of the University of California.  All rights reserved.
 .\"
@@ -78,6 +78,24 @@ is non-null, the window size of the slave will be set to the values in
 .Fa winp .
 .Pp
 The
+.Fn openpty
+function works in the following way:
+first it attempts to allocate the pseudo-tty through the
+.Pa /dev/ptm
+device (see
+.Xr pty 4
+for details) and if that fails it searches for a free psuedo-tty by iterating
+through all existing pseudo-tty devices in
+.Pa /dev .
+When a free pseudo-tty is found, its ownership is changed to
+the UID of the caller, permissions are set to correct values,
+and all earlier uses of that device are revoked (see
+.Xr revoke 2
+for details).
+The first method can work for any user, the second method requires
+super-user privileges in most cases.
+.Pp
+The
 .Fn login_tty
 function prepares for a login on the tty
 .Fa fd
@@ -132,6 +150,7 @@ returns the process ID of the child process.
 .Sh FILES
 .Bl -tag -width /dev/[pt]ty[pqrstuvwxyzPQRST][0123456789abcdef] -compact
 .It Pa /dev/[pt]ty[pqrstuvwxyzPQRST][0123456789abcdef]
+.It Pa /dev/ptm
 .El
 .Sh ERRORS
 .Fn openpty
@@ -154,4 +173,6 @@ or
 .Fn fork
 fails.
 .Sh SEE ALSO
-.Xr fork 2
+.Xr fork 2 ,
+.Xr revoke 2 ,
+.Xr pty 4
diff --git a/lib/libutil/pty.c b/lib/libutil/pty.c
index 743daf70491..a8fa7671537 100644
--- a/lib/libutil/pty.c
+++ b/lib/libutil/pty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pty.c,v 1.10 2003/06/02 20:18:42 millert Exp $	*/
+/*	$OpenBSD: pty.c,v 1.11 2004/02/10 01:31:20 millert Exp $	*/
 /*-
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -30,7 +30,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 /* from: static char sccsid[] = "@(#)pty.c	8.1 (Berkeley) 6/4/93"; */
-static const char rcsid[] = "$Id: pty.c,v 1.10 2003/06/02 20:18:42 millert Exp $";
+static const char rcsid[] = "$Id: pty.c,v 1.11 2004/02/10 01:31:20 millert Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/cdefs.h>
@@ -44,6 +44,7 @@ static const char rcsid[] = "$Id: pty.c,v 1.10 2003/06/02 20:18:42 millert Exp $
 #include <stdio.h>
 #include <string.h>
 #include <grp.h>
+#include <sys/tty.h>
 
 #include "util.h"
 
@@ -60,7 +61,41 @@ openpty(amaster, aslave, name, termp, winp)
 	register const char *cp1, *cp2;
 	register int master, slave, ttygid;
 	struct group *gr;
+	struct ptmget ptm;
+	int fd;
 
+	/* Try to use /dev/ptm and the PTMGET ioctl to get a properly set up
+	 * and owned pty/tty pair. If this fails, (because we might not have
+	 * the ptm device, etc.) fall back to using the traditional method
+	 * of walking through the pty entries in /dev for the moment, until
+	 * there is less chance of people being seriously boned by running
+	 * kernels without /dev/ptm in them.
+	 */
+
+	fd = open(PATH_PTMDEV, O_RDWR, 0);
+	if (fd == -1)
+		goto walkit;
+	if ((ioctl(fd, PTMGET, &ptm) == -1)) {
+		close(fd); 
+		goto walkit;
+	}
+	close(fd);
+	master = ptm.cfd;
+	slave = ptm.sfd;
+	if (name) {
+		/*
+		 * Manual page says "at least 16 characters".
+		 */
+		strlcpy(name, ptm.sn, 16);
+	}
+	*amaster = master;
+	*aslave = slave;
+	if (termp)
+		(void) tcsetattr(slave, TCSAFLUSH, termp);
+	if (winp)
+		(void) ioctl(slave, TIOCSWINSZ, (char *)winp);
+	return (0);
+ walkit:
 	if ((gr = getgrnam("tty")) != NULL)
 		ttygid = gr->gr_gid;
 	else
diff --git a/regress/sys/kern/Makefile b/regress/sys/kern/Makefile
index 65a8c692ad1..506b4520f66 100644
--- a/regress/sys/kern/Makefile
+++ b/regress/sys/kern/Makefile
@@ -1,7 +1,7 @@
-#	$OpenBSD: Makefile,v 1.42 2003/11/04 07:38:08 mickey Exp $
+#	$OpenBSD: Makefile,v 1.43 2004/02/10 01:31:20 millert Exp $
 
 SUBDIR+= execve getrusage kqueue mmap mmap2 mmap3 dup2 minherit rlimit-file
-SUBDIR+= fcntl_dup dup2_self pread preadv exit wait mbuf pwrite pwritev
+SUBDIR+= fcntl_dup dup2_self ptmget pread preadv exit wait mbuf pwrite pwritev
 SUBDIR+= syscall __syscall unfdpass accept nanosleep sysvmsg sysvsem
 SUBDIR+= sysvshm rfork gettimeofday signal exec_self noexec
 SUBDIR+= rcvtimeo
diff --git a/share/man/man4/pty.4 b/share/man/man4/pty.4
index 0f89f596654..77ed7cf85a5 100644
--- a/share/man/man4/pty.4
+++ b/share/man/man4/pty.4
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: pty.4,v 1.10 2003/06/02 23:30:12 millert Exp $
+.\"	$OpenBSD: pty.4,v 1.11 2004/02/10 01:31:20 millert Exp $
 .\"	$NetBSD: pty.4,v 1.4 1998/03/21 03:14:30 fair Exp $
 .\"
 .\" Copyright (c) 1983, 1991, 1993
@@ -66,8 +66,14 @@ device.
 In configuring, if an optional
 .Ar count
 is given in
-the specification, that number of pseudo terminal pairs are configured;
-the default count is 64.
+the specification, space for that number of pseudo terminal pairs is
+preallocated.
+If the count is missing or is less than 2, a default count of 8 is used.
+This is not a hard limit--space for additional pseudo terminal pairs
+is allocated on demand up to the limit imposed by the
+.Li kern.tty.maxptys
+.Xr sysctl 8
+(256 by default).
 .Pp
 The following
 .Xr ioctl 2
@@ -158,7 +164,7 @@ protocol equivalents with the remote peer.
 .It Dv TIOCUCNTL
 Enable/disable a mode that allows a small number of simple user
 .Xr ioctl 2
-commands to be passed through the pseudo-terminal,
+commands to be passed through the pseudo terminal,
 using a protocol similar to that of
 .Dv TIOCPKT .
 The
@@ -213,17 +219,75 @@ can be used when doing remote line
 editing in a window manager, or whenever flow controlled input
 is required.
 .El
+.Pp
+The standard way to allocate
+.Nm
+devices is through the
+.Dv PTMGET
+.Xr ioctl 2
+call on the
+.Pa /dev/ptm
+device.
+The
+.Dv PTMGET
+command allocates a free pseudo terminal, changes its ownership to
+the caller, revokes the access privileges for all previous users,
+opens the file descriptors for the master and slave devices and returns
+them to the caller in
+.Fa struct ptmget .
+.Bd -literal -offset indent
+struct ptmget {
+	int	cfd;
+	int	sfd;
+	char	cn[16];
+	char	sn[16];
+};
+.Ed
+.Pp
+The
+.Va cfd
+and
+.Va sfd
+fields are the file descriptors for the controlling and slave terminals.
+The
+.Va cn
+and
+.Va sn
+fields are the file names of the controlling and slave devices.
 .Sh FILES
-.Bl -tag -width /dev/tty[p-r][0-9a-f]x -compact
-.It Pa /dev/pty[p-r][0-9a-f]
+.Bl -tag -width /dev/tty[p-zP-T][0-9a-f]x -compact
+.It Pa /dev/pty[p-zP-T][0-9a-f]
 master pseudo terminals
-.It Pa /dev/tty[p-r][0-9a-f]
+.It Pa /dev/tty[p-zP-T][0-9a-f]
 slave pseudo terminals
+.It Pa /dev/ptm
+pseudo terminal management device
 .El
 .Sh SEE ALSO
-.Xr tty 4
+.Xr openpty 3 ,
+.Xr tty 4 ,
+.Xr sysctl 8
 .Sh HISTORY
 The
 .Nm
 driver appeared in
 .Bx 4.2 .
+The
+.Pa /dev/ptm
+device was added in
+.Ox 3.5 .
+.Sh CAVEATS
+The
+.Pa ptm
+device will only work on systems where the
+.Pa /dev
+directory has been properly populated with
+.Xr pty 4
+device nodes following the naming convention used in
+.Ox .
+Since
+.Pa ptm
+impersonates the super user for some operations it needs to perform
+to complete the allocation of a pseudo terminal, the
+.Pa /dev
+directory must also be writeable by the super user.
diff --git a/sys/arch/alpha/alpha/conf.c b/sys/arch/alpha/alpha/conf.c
index bb9404639f1..72b28e754a7 100644
--- a/sys/arch/alpha/alpha/conf.c
+++ b/sys/arch/alpha/alpha/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.47 2003/06/02 23:27:43 millert Exp $	*/
+/*	$OpenBSD: conf.c,v 1.48 2004/02/10 01:31:20 millert Exp $	*/
 /*	$NetBSD: conf.c,v 1.16 1996/10/18 21:26:57 cgd Exp $	*/
 
 /*-
@@ -192,6 +192,7 @@ struct cdevsw	cdevsw[] =
 #endif
 	cdev_notdef(),			/* 53: ALTQ (deprecated) */
 	cdev_iop_init(NIOP, iop),	/* 54: I2O IOP control interface */
+	cdev_ptm_init(NPTY,ptm),	/* 55: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof (cdevsw) / sizeof (cdevsw[0]);
 
diff --git a/sys/arch/amd64/amd64/conf.c b/sys/arch/amd64/amd64/conf.c
index ac1fb00010e..0723e17ad80 100644
--- a/sys/arch/amd64/amd64/conf.c
+++ b/sys/arch/amd64/amd64/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.2 2004/02/03 12:09:47 mickey Exp $	*/
+/*	$OpenBSD: conf.c,v 1.3 2004/02/10 01:31:21 millert Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995 Charles M. Hannum.  All rights reserved.
@@ -293,6 +293,8 @@ struct cdevsw	cdevsw[] =
 	cdev_usbdev_init(NUSCANNER,uscanner),	/* 77: USB scanners */
 	cdev_systrace_init(NSYSTRACE,systrace),	/* 78: system call tracing */
  	cdev_oci_init(NBIO,bio),	/* 79: ioctl tunnel */
+	cdev_notdef(),			/* 80: gpr? XXX */
+	cdev_ptm_init(NPTY,ptm),	/* 81: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/arch/arm/arm/conf.c b/sys/arch/arm/arm/conf.c
index dd8a21bcf46..f1518be6ae4 100644
--- a/sys/arch/arm/arm/conf.c
+++ b/sys/arch/arm/arm/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.1 2004/02/01 05:09:48 drahn Exp $	*/
+/*	$OpenBSD: conf.c,v 1.2 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: conf.c,v 1.10 2002/04/19 01:04:38 wiz Exp $	*/
 
 /*
@@ -374,6 +374,7 @@ struct cdevsw cdevsw[] = {
 	cdev_notdef(),                          /* 95: removed device */
 	cdev_notdef(),                          /* 96: removed device */
 	cdev_radio_init(NRADIO,radio),		/* 97: generic radio I/O */
+	cdev_ptm_init(NPTY,ptm),		/* 98: pseudo-tty ptm device */
 };
 
 int nblkdev = sizeof(bdevsw) / sizeof(bdevsw[0]);
diff --git a/sys/arch/hp300/hp300/conf.c b/sys/arch/hp300/hp300/conf.c
index 41b386845d1..46fb9b97a81 100644
--- a/sys/arch/hp300/hp300/conf.c
+++ b/sys/arch/hp300/hp300/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.34 2003/09/23 16:51:11 millert Exp $	*/
+/*	$OpenBSD: conf.c,v 1.35 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: conf.c,v 1.39 1997/05/12 08:17:53 thorpej Exp $	*/
 
 /*-
@@ -185,6 +185,8 @@ struct cdevsw	cdevsw[] =
 	
 	cdev_notdef(),			/* 51 */
 #endif
+	cdev_ptm_init(NPTY,ptm),	/* 52: pseudo-tty ptm device */
+
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/arch/hppa/hppa/conf.c b/sys/arch/hppa/hppa/conf.c
index 3a66e3b9daa..80bbfefa9ca 100644
--- a/sys/arch/hppa/hppa/conf.c
+++ b/sys/arch/hppa/hppa/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.29 2003/12/09 04:25:56 mickey Exp $	*/
+/*	$OpenBSD: conf.c,v 1.30 2004/02/10 01:31:21 millert Exp $	*/
 
 /*-
  * Copyright (c) 1991 The Regents of the University of California.
@@ -165,6 +165,7 @@ struct cdevsw   cdevsw[] =
 	cdev_audio_init(NAUDIO,audio),	/* 35: /dev/audio */
 	cdev_crypto_init(NCRYPTO,crypto), /* 36: /dev/crypto */
 	cdev_ses_init(NSES,ses),	/* 37: SCSI SES/SAF-TE */
+	cdev_ptm_init(NPTY,ptm),	/* 38: pseudo-tty ptm device */
 	cdev_lkm_dummy(),
 	cdev_lkm_dummy(),
 	cdev_lkm_dummy(),
diff --git a/sys/arch/i386/i386/conf.c b/sys/arch/i386/i386/conf.c
index 1f611b60029..25198bf2ebb 100644
--- a/sys/arch/i386/i386/conf.c
+++ b/sys/arch/i386/i386/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.105 2003/11/03 03:35:40 tedu Exp $	*/
+/*	$OpenBSD: conf.c,v 1.106 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: conf.c,v 1.75 1996/05/03 19:40:20 christos Exp $	*/
 
 /*
@@ -308,7 +308,8 @@ struct cdevsw	cdevsw[] =
 	cdev_usbdev_init(NUSCANNER,uscanner),	/* 77: USB scanners */
 	cdev_systrace_init(NSYSTRACE,systrace),	/* 78: system call tracing */
  	cdev_oci_init(NBIO,bio),	/* 79: ioctl tunnel */
-	cdev_ch_init(NGPR,gpr)		/* 80: GPR400 SmartCard reader */
+	cdev_ch_init(NGPR,gpr),		/* 80: GPR400 SmartCard reader */
+	cdev_ptm_init(NPTY,ptm),	/* 81: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/arch/mac68k/mac68k/conf.c b/sys/arch/mac68k/mac68k/conf.c
index aa6780c249d..620a07ae38e 100644
--- a/sys/arch/mac68k/mac68k/conf.c
+++ b/sys/arch/mac68k/mac68k/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.34 2003/06/02 23:27:49 millert Exp $	*/
+/*	$OpenBSD: conf.c,v 1.35 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: conf.c,v 1.41 1997/02/11 07:35:49 scottr Exp $	*/
 
 /*
@@ -166,6 +166,7 @@ struct cdevsw	cdevsw[] =
 #else
 	cdev_notdef(),			/* 51 */
 #endif
+	cdev_ptm_init(NPTY,ptm),	/* 52: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/arch/macppc/macppc/conf.c b/sys/arch/macppc/macppc/conf.c
index 43b0aaf72b6..a4d7efd644a 100644
--- a/sys/arch/macppc/macppc/conf.c
+++ b/sys/arch/macppc/macppc/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.24 2003/10/15 17:50:16 drahn Exp $ */
+/*	$OpenBSD: conf.c,v 1.25 2004/02/10 01:31:21 millert Exp $ */
 
 /*
  * Copyright (c) 1997 Per Fogelstrom
@@ -235,6 +235,7 @@ struct cdevsw cdevsw[] = {
 	cdev_usbdev_init(NUSCANNER,uscanner), /* 74: usb scanner */
 	cdev_bktr_init(NBKTR,bktr),	/* 75: Bt848 video capture device */
 	cdev_radio_init(NRADIO, radio),	/* 76: generic radio I/O */
+	cdev_ptm_init(NPTY,ptm),	/* 77: pseudo-tty ptm device */
 };
 int nchrdev = sizeof cdevsw / sizeof cdevsw[0];
 
diff --git a/sys/arch/mvme68k/mvme68k/conf.c b/sys/arch/mvme68k/mvme68k/conf.c
index 1abe10dd648..7df6bdfd3e2 100644
--- a/sys/arch/mvme68k/mvme68k/conf.c
+++ b/sys/arch/mvme68k/mvme68k/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.36 2003/09/26 06:58:04 miod Exp $ */
+/*	$OpenBSD: conf.c,v 1.37 2004/02/10 01:31:21 millert Exp $ */
 
 /*-
  * Copyright (c) 1995 Theo de Raadt
@@ -214,6 +214,7 @@ struct cdevsw	cdevsw[] =
 #else
 	cdev_lkm_dummy(),		/* 51 */
 #endif
+	cdev_ptm_init(NPTY,ptm),	/* 52: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/arch/mvme88k/mvme88k/conf.c b/sys/arch/mvme88k/mvme88k/conf.c
index cf24580187e..e48f7e2cabe 100644
--- a/sys/arch/mvme88k/mvme88k/conf.c
+++ b/sys/arch/mvme88k/mvme88k/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.29 2004/01/20 10:34:24 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.30 2004/02/10 01:31:21 millert Exp $	*/
 
 /*-
  * Copyright (c) 1991 The Regents of the University of California.
@@ -200,6 +200,7 @@ struct cdevsw	cdevsw[] =
 #else
 	cdev_notdef(),			/* 51 */
 #endif
+	cdev_ptm_init(NPTY,ptm),	/* 52: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/arch/mvmeppc/mvmeppc/conf.c b/sys/arch/mvmeppc/mvmeppc/conf.c
index d429d0bd6af..88a5064fc7d 100644
--- a/sys/arch/mvmeppc/mvmeppc/conf.c
+++ b/sys/arch/mvmeppc/mvmeppc/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.16 2004/01/23 10:41:07 miod Exp $ */
+/*	$OpenBSD: conf.c,v 1.17 2004/02/10 01:31:21 millert Exp $ */
 
 /*
  * Copyright (c) 1997 Per Fogelstrom
@@ -180,6 +180,7 @@ struct cdevsw cdevsw[] = {
         cdev_notdef(),                  /* 52 */ 
         cdev_notdef(),                  /* 53 */ 
 	cdev_disk_init(NRAID,raid),	/* 54: RAIDframe disk driver */
+	cdev_ptm_init(NPTY,ptm),	/* 55: pseudo-tty ptm device */
 };
 int nchrdev = sizeof cdevsw / sizeof cdevsw[0];
 
diff --git a/sys/arch/pegasos/pegasos/conf.c b/sys/arch/pegasos/pegasos/conf.c
index 44d14de8cb0..4ba95eb33f1 100644
--- a/sys/arch/pegasos/pegasos/conf.c
+++ b/sys/arch/pegasos/pegasos/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.1 2003/10/31 03:54:33 drahn Exp $ */
+/*	$OpenBSD: conf.c,v 1.2 2004/02/10 01:31:21 millert Exp $ */
 
 /*
  * Copyright (c) 1997 Per Fogelstrom
@@ -235,6 +235,7 @@ struct cdevsw cdevsw[] = {
 	cdev_usbdev_init(NUSCANNER,uscanner), /* 74: usb scanner */
 	cdev_bktr_init(NBKTR,bktr),	/* 75: Bt848 video capture device */
 	cdev_radio_init(NRADIO, radio),	/* 76: generic radio I/O */
+	cdev_ptm_init(NPTY,ptm),	/* 77: pseudo-tty ptm device */
 };
 int nchrdev = sizeof cdevsw / sizeof cdevsw[0];
 
diff --git a/sys/arch/sparc/sparc/conf.c b/sys/arch/sparc/sparc/conf.c
index 139c819477a..d31d1b9ef47 100644
--- a/sys/arch/sparc/sparc/conf.c
+++ b/sys/arch/sparc/sparc/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.38 2003/06/02 23:27:55 millert Exp $	*/
+/*	$OpenBSD: conf.c,v 1.39 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: conf.c,v 1.40 1996/04/11 19:20:03 thorpej Exp $ */
 
 /*
@@ -260,6 +260,7 @@ struct cdevsw	cdevsw[] =
 	cdev_ksyms_init(NKSYMS,ksyms),	/* 122: Kernel symbols device */
 	cdev_disk_init(NRAID,raid),     /* 123: RAIDframe disk driver */
 	cdev_ses_init(NSES,ses),	/* 124: SCSI SES or SAF-TE device */
+	cdev_ptm_init(NPTY,ptm),	/* 125: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/arch/sparc64/sparc64/conf.c b/sys/arch/sparc64/sparc64/conf.c
index ea5151d85d3..6a839aabadf 100644
--- a/sys/arch/sparc64/sparc64/conf.c
+++ b/sys/arch/sparc64/sparc64/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.36 2003/06/27 16:57:14 nate Exp $	*/
+/*	$OpenBSD: conf.c,v 1.37 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: conf.c,v 1.17 2001/03/26 12:33:26 lukem Exp $ */
 
 /*
@@ -291,6 +291,7 @@ struct cdevsw	cdevsw[] =
 	cdev_notdef(),			/* 120 */
 	cdev_disk_init(NRAID,raid),	/* 121: RAIDframe disk driver */
 	cdev_tty_init(NPCONS,pcons),	/* 122: PROM console */
+	cdev_ptm_init(NPTY,ptm),	/* 123: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/arch/vax/vax/conf.c b/sys/arch/vax/vax/conf.c
index b1fbebb1460..28b2e4ef747 100644
--- a/sys/arch/vax/vax/conf.c
+++ b/sys/arch/vax/vax/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.42 2003/09/23 16:51:12 millert Exp $ */
+/*	$OpenBSD: conf.c,v 1.43 2004/02/10 01:31:21 millert Exp $ */
 /*	$NetBSD: conf.c,v 1.44 1999/10/27 16:38:54 ragge Exp $	*/
 
 /*-
@@ -438,6 +438,7 @@ struct cdevsw	cdevsw[] =
 #else
 	cdev_notdef(),			/* 74 */
 #endif
+	cdev_ptm_init(NPTY,ptm),	/* 75: pseudo-tty ptm device */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
diff --git a/sys/kern/tty_pty.c b/sys/kern/tty_pty.c
index c3dd4252e77..72e9b198c9e 100644
--- a/sys/kern/tty_pty.c
+++ b/sys/kern/tty_pty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tty_pty.c,v 1.17 2004/02/10 01:19:47 millert Exp $	*/
+/*	$OpenBSD: tty_pty.c,v 1.18 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: tty_pty.c,v 1.33.4.1 1996/06/02 09:08:11 mrg Exp $	*/
 
 /*
@@ -39,10 +39,13 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
+#include <sys/namei.h>
+#include <sys/mount.h>
 #include <sys/ioctl.h>
 #include <sys/proc.h>
 #include <sys/tty.h>
 #include <sys/file.h>
+#include <sys/filedesc.h>
 #include <sys/uio.h>
 #include <sys/kernel.h>
 #include <sys/malloc.h>
@@ -50,6 +53,7 @@
 #include <sys/signalvar.h>
 #include <sys/uio.h>
 #include <sys/conf.h>
+#include <sys/stat.h>
 #include <sys/sysctl.h>
 #include <sys/poll.h>
 #include <sys/rwlock.h>
@@ -57,19 +61,28 @@
 #define BUFSIZ 100		/* Chunk size iomoved to/from user */
 
 /*
- * pts == /dev/tty[pqrs]?
- * ptc == /dev/pty[pqrs]?
+ * pts == /dev/tty[p-zP-T][0-9a-f]
+ * ptc == /dev/pty[p-zP-T][0-9a-f]
  */
+
+/* XXX this needs to come from somewhere sane, and work with MAKEDEV */
+#define TTY_LETTERS "pqrstuvwxyzPQRST"
+#define TTY_SUFFIX "0123456789abcdef"
+
+static int pts_major;
+
 struct	pt_softc {
 	struct	tty *pt_tty;
 	int	pt_flags;
 	struct	selinfo pt_selr, pt_selw;
 	u_char	pt_send;
 	u_char	pt_ucntl;
+	char	pty_pn[11];
+	char	pty_sn[11];
 };
 
 #define	DEFAULT_NPTYS		8	/* default number of initial ptys */
-#define	DEFAULT_MAXPTYS		256	/* default maximum number of ptys */
+#define DEFAULT_MAXPTYS		256	/* default maximum number of ptys */
 
 static struct pt_softc **pt_softc = NULL;	/* pty array */
 static int npty = 0;				/* size of pty array */
@@ -96,6 +109,42 @@ int	filt_ptcwrite(struct knote *, long);
 static struct pt_softc **ptyarralloc(int);
 static int check_pty(int);
 
+static gid_t tty_gid = TTY_GID;
+
+void	ptydevname(int, struct pt_softc *);
+dev_t	pty_getfree(void);
+
+void	ptmattach(int);
+int	ptmopen(dev_t, int, int, struct proc *);
+int	ptmclose(dev_t, int, int, struct proc *);
+int	ptmread(dev_t, struct uio *, int);
+int	ptmwrite(dev_t, struct uio *, int);
+int	ptmwrite(dev_t, struct uio *, int);
+int	ptmioctl(dev_t, u_long, caddr_t, int, struct proc *p);
+int	ptmpoll(dev_t, int, struct proc *p);
+static int ptm_vn_open(struct nameidata *);
+
+void
+ptydevname(int minor, struct pt_softc *pti)
+{
+	char buf[11] = "/dev/XtyXX";
+	int i, j;
+
+	i = minor / (sizeof(TTY_LETTERS) - 1);
+	j = minor % (sizeof(TTY_SUFFIX) - 1);
+	if (i >= sizeof(TTY_LETTERS)) {
+		pti->pty_pn[0] = '\0';
+		pti->pty_sn[0] = '\0';
+		return;
+	}
+	buf[5] = 'p';
+	buf[8] = TTY_LETTERS[i];
+	buf[9] = TTY_SUFFIX[j];
+	memcpy(pti->pty_pn, buf, sizeof(buf));
+	buf[5] = 't';
+	memcpy(pti->pty_sn, buf, sizeof(buf));
+}
+
 /*
  * Allocate and zero array of nelem elements.
  */
@@ -153,6 +202,7 @@ check_pty(int minor)
 		    M_DEVBUF, M_WAITOK);
 		bzero(pti, sizeof(struct pt_softc));
 		pti->pt_tty = ttymalloc();
+		ptydevname(minor, pti);
 		pt_softc[minor] = pti;
 	}
 	rw_exit_write(&pt_softc_lock);
@@ -174,6 +224,11 @@ ptyattach(int n)
 		n = DEFAULT_NPTYS;
 	pt_softc = ptyarralloc(n);
 	npty = n;
+
+	/*
+	 * If we have pty, we need ptm too.
+	 */
+	ptmattach(1);
 }
 
 /*ARGSUSED*/
@@ -258,8 +313,8 @@ again:
 			    p->p_flag & P_PPWAIT)
 				return (EIO);
 			pgsignal(p->p_pgrp, SIGTTIN, 1);
-			error = ttysleep(tp, &lbolt, 
-					 TTIPRI | PCATCH, ttybg, 0);
+			error = ttysleep(tp, &lbolt,
+			    TTIPRI | PCATCH, ttybg, 0);
 			if (error)
 				return (error);
 		}
@@ -267,7 +322,7 @@ again:
 			if (flag & IO_NDELAY)
 				return (EWOULDBLOCK);
 			error = ttysleep(tp, &tp->t_canq,
-					 TTIPRI | PCATCH, ttyin, 0);
+			    TTIPRI | PCATCH, ttyin, 0);
 			if (error)
 				return (error);
 			goto again;
@@ -464,7 +519,7 @@ ptcread(dev, uio, flag)
 		if (flag & IO_NDELAY)
 			return (EWOULDBLOCK);
 		error = tsleep(&tp->t_outq.c_cf, TTIPRI | PCATCH,
-			       ttyin, 0);
+		    ttyin, 0);
 		if (error)
 			return (error);
 	}
@@ -567,7 +622,7 @@ block:
 		return (0);
 	}
 	error = tsleep(&tp->t_rawq.c_cf, TTOPRI | PCATCH,
-		       ttyout, 0);
+	    ttyout, 0);
 	if (error) {
 		/* adjust for data copied in but not written */
 		uio->uio_resid += cc;
@@ -595,22 +650,22 @@ ptcpoll(dev_t dev, int events, struct proc *p)
 		 */
 		s = spltty();
 		if ((tp->t_outq.c_cc && !ISSET(tp->t_state, TS_TTSTOP)) ||
-		     ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
-		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))
+		    ((pti->pt_flags & PF_PKT) && pti->pt_send) ||
+		    ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))
 			revents |= events & (POLLIN | POLLRDNORM);
 		splx(s);
 	}
 	if (events & (POLLOUT | POLLWRNORM)) {
 		if ((pti->pt_flags & PF_REMOTE) ?
-		     (tp->t_canq.c_cc == 0) :
-		     ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
-		      (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON))))
+		    (tp->t_canq.c_cc == 0) :
+		    ((tp->t_rawq.c_cc + tp->t_canq.c_cc < TTYHOG - 2) ||
+		    (tp->t_canq.c_cc == 0 && ISSET(tp->t_lflag, ICANON))))
 			revents |= events & (POLLOUT | POLLWRNORM);
 	}
 	if (events & (POLLPRI | POLLRDBAND)) {
 		/* If in packet or user control mode, check for data. */
 		if (((pti->pt_flags & PF_PKT) && pti->pt_send) ||
-		     ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))
+		    ((pti->pt_flags & PF_UCNTL) && pti->pt_ucntl))
 			revents |= events & (POLLPRI | POLLRDBAND);
 	}
 
@@ -822,7 +877,7 @@ ptyioctl(dev, cmd, data, flag, p)
 			return (0);
 
 #ifdef COMPAT_OLDTTY
-		case TIOCSETP:		
+		case TIOCSETP:
 		case TIOCSETN:
 #endif
 		case TIOCSETD:
@@ -861,7 +916,7 @@ ptyioctl(dev, cmd, data, flag, p)
 	 * If external processing and packet mode send ioctl packet.
 	 */
 	if ((tp->t_lflag&EXTPROC) && (pti->pt_flags & PF_PKT)) {
-		switch(cmd) {
+		switch (cmd) {
 		case TIOCSETA:
 		case TIOCSETAW:
 		case TIOCSETAF:
@@ -880,8 +935,8 @@ ptyioctl(dev, cmd, data, flag, p)
 			break;
 		}
 	}
-	stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s')) 
-		&& CCEQ(cc[VSTART], CTRL('q'));
+	stop = (tp->t_iflag & IXON) && CCEQ(cc[VSTOP], CTRL('s')) &&
+	    CCEQ(cc[VSTART], CTRL('q'));
 	if (pti->pt_flags & PF_NOSTOP) {
 		if (stop) {
 			pti->pt_send &= ~TIOCPKT_NOSTOP;
@@ -933,8 +988,263 @@ sysctl_pty(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 		return(err);
 	case KERN_TTY_NPTYS:
 		return (sysctl_rdint(oldp, oldlenp, newp, npty));
+#ifdef notyet
+	case KERN_TTY_GID:
+		return (sysctl_int(oldp, oldlenp, newp, newlen, &tty_gid));
+#endif
 	default:
 		return (EOPNOTSUPP);
 	}
 	/* NOTREACHED */
 }
+
+/*
+ * Check if a pty is free to use.
+ */
+static __inline int
+pty_isfree_locked(int minor)
+{
+	struct pt_softc *pt = pt_softc[minor];
+	return (pt->pt_tty == NULL || pt->pt_tty->t_oproc == NULL);
+}
+
+static int
+pty_isfree(int minor)
+{
+	int isfree;
+
+	rw_enter_read(&pt_softc_lock);
+	isfree = pty_isfree_locked(minor);
+	rw_exit_read(&pt_softc_lock);
+	return(isfree);
+}
+
+dev_t
+pty_getfree(void)
+{
+	int i;
+
+	rw_enter_read(&pt_softc_lock);
+	for (i = 0; i < npty; i++) {
+		if (pty_isfree_locked(i))
+			break;
+	}
+	rw_exit_read(&pt_softc_lock);
+	return (makedev(pts_major, i));
+}
+
+/*
+ * Hacked up version of vn_open. We _only_ handle ptys and only open
+ * them with FREAD|FWRITE and never deal with creat or stuff like that.
+ *
+ * We need it because we have to fake up root credentials to open the pty.
+ */
+static int
+ptm_vn_open(struct nameidata *ndp)
+{
+	struct vnode *vp;
+	struct proc *p = ndp->ni_cnd.cn_proc;
+	struct ucred *cred;
+	int error;
+
+	if ((error = namei(ndp)) != 0)
+		return (error);
+	vp = ndp->ni_vp;
+	if (vp->v_type != VCHR) {
+		error = EINVAL;
+		goto bad;
+	}
+
+	/*
+	 * Get us a fresh cred with root privileges.
+	 */
+	cred = crget();
+	error = VOP_OPEN(vp, FREAD|FWRITE, cred, p);
+	crfree(cred);
+
+	if (error)
+		goto bad;
+
+	vp->v_writecount++;
+
+	return (0);
+bad:
+	vput(vp);
+	return (error);
+}
+
+void
+ptmattach(int n)
+{
+	/* find the major and minor of the pty devices */
+	int i;
+
+	for (i = 0; i < nchrdev; i++)
+		if (cdevsw[i].d_open == ptsopen)
+			break;
+
+	if (i == nchrdev)
+		panic("ptmattach: Can't find pty slave in cdevsw");
+
+	pts_major = i;
+}
+
+int
+ptmopen(dev_t dev, int flag, int mode, struct proc *p)
+{
+	return(0);
+}
+
+
+int
+ptmclose(dev_t dev, int flag, int mode, struct proc *p)
+{
+	return (0);
+}
+
+int
+ptmread(dev_t dev, struct uio *uio, int ioflag)
+{
+	return (EIO);
+}
+
+int
+ptmwrite(dev_t dev, struct uio *uio, int ioflag)
+{
+	return (EIO);
+}
+
+int
+ptmioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
+{
+	dev_t newdev, error;
+	struct pt_softc * pti;
+	struct nameidata cnd, snd;
+	struct filedesc *fdp = p->p_fd;
+	struct file *cfp = NULL, *sfp = NULL;
+	int cindx, sindx;
+	uid_t uid;
+	gid_t gid;
+	struct vattr vattr;
+	struct ucred *cred;
+	struct ptmget *ptm = (struct ptmget *)data;
+
+	error = 0;
+	switch (cmd) {
+	case PTMGET:
+		fdplock(fdp, p);
+		/* Grab two filedescriptors. */
+		if ((error = falloc(p, &cfp, &cindx)) != 0) {
+			fdpunlock(fdp);
+			break;
+		}
+		if ((error = falloc(p, &sfp, &sindx)) != 0) {
+			fdremove(fdp, cindx);
+			closef(cfp, p);
+			fdpunlock(fdp);
+			break;
+		}
+
+retry:
+		/* Find and open a free master pty. */
+		newdev = pty_getfree();
+		if ((error = check_pty(minor(newdev))))
+			goto bad;
+		pti = pt_softc[minor(newdev)];
+		NDINIT(&cnd, LOOKUP, NOFOLLOW|LOCKLEAF, UIO_SYSSPACE,
+		    pti->pty_pn, p);
+		if ((error = ptm_vn_open(&cnd)) != 0) {
+			/*
+			 * Check if the master open failed because we lost
+			 * the race to grab it.
+			 */
+			if (error == EIO && !pty_isfree(minor(newdev)))
+				goto retry;
+			goto bad;
+		}
+		cfp->f_flag = FREAD|FWRITE;
+		cfp->f_type = DTYPE_VNODE;
+		cfp->f_ops = &vnops;
+		cfp->f_data = (caddr_t) cnd.ni_vp;
+		VOP_UNLOCK(cnd.ni_vp, 0, p);
+		FILE_SET_MATURE(cfp);
+
+		/*
+		 * Open the slave.
+		 * namei -> setattr -> unlock -> revoke -> vrele ->
+		 * namei -> open -> unlock
+		 * Three stage rocket:
+		 * 1. Change the owner and permissions on the slave.
+		 * 2. Revoke all the users of the slave.
+		 * 3. open the slave.
+		 */
+		NDINIT(&snd, LOOKUP, NOFOLLOW|LOCKLEAF, UIO_SYSSPACE,
+		    pti->pty_sn, p);
+		if ((error = namei(&snd)) != 0)
+			goto bad;
+		if ((snd.ni_vp->v_mount->mnt_flag & MNT_RDONLY) == 0) {
+			gid = tty_gid;
+			/* get real uid */
+			uid = p->p_cred->p_ruid;
+
+			VATTR_NULL(&vattr);
+			vattr.va_uid = uid;
+			vattr.va_gid = gid;
+			vattr.va_mode = (S_IRUSR|S_IWUSR|S_IWGRP) & ALLPERMS;
+			/* Get a fake cred to pretend we're root. */
+			cred = crget();
+			error = VOP_SETATTR(snd.ni_vp, &vattr, cred, p);
+			crfree(cred);
+			if (error)
+				goto bad;
+		}
+		VOP_UNLOCK(snd.ni_vp, 0, p);
+		if (snd.ni_vp->v_usecount > 1 ||
+		    (snd.ni_vp->v_flag & (VALIASED | VLAYER)))
+			VOP_REVOKE(snd.ni_vp, REVOKEALL);
+
+		/*
+		 * The vnode is useless after the revoke, we need to
+		 * namei again.
+		 */
+		vrele(snd.ni_vp);
+
+		NDINIT(&snd, LOOKUP, NOFOLLOW|LOCKLEAF, UIO_SYSSPACE,
+		    pti->pty_sn, p);
+		/* now open it */
+		if ((error = ptm_vn_open(&snd)) != 0)
+			goto bad;
+		sfp->f_flag = FREAD|FWRITE;
+		sfp->f_type = DTYPE_VNODE;
+		sfp->f_ops = &vnops;
+		sfp->f_data = (caddr_t) snd.ni_vp;
+		VOP_UNLOCK(snd.ni_vp, 0, p);
+		FILE_SET_MATURE(sfp);
+
+		/* now, put the indexen and names into struct ptmget */
+		ptm->cfd = cindx;
+		ptm->sfd = sindx;
+		memcpy(ptm->cn, pti->pty_pn, sizeof(pti->pty_pn));
+		memcpy(ptm->sn, pti->pty_sn, sizeof(pti->pty_sn));
+
+		fdpunlock(fdp);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+	return (error);
+bad:
+	fdremove(fdp, cindx);
+	closef(cfp, p);
+	fdremove(fdp, sindx);
+	closef(sfp, p);
+	fdpunlock(fdp);
+	return (error);
+}
+
+int
+ptmpoll(dev_t dev, int events, struct proc *p)
+{
+	return (seltrue(dev, events, p));
+}
diff --git a/sys/sys/conf.h b/sys/sys/conf.h
index 7e2530401ee..00f95e9d09e 100644
--- a/sys/sys/conf.h
+++ b/sys/sys/conf.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.h,v 1.72 2003/09/23 16:51:13 millert Exp $	*/
+/*	$OpenBSD: conf.h,v 1.73 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: conf.h,v 1.33 1996/05/03 20:03:32 christos Exp $	*/
 
 /*-
@@ -275,7 +275,13 @@ extern struct cdevsw cdevsw[];
 	dev_init(c,n,tty), dev_init(c,n,poll), (dev_type_mmap((*))) enodev, \
 	D_TTY | D_KQFILTER, dev_init(c,n,kqfilter) }
 
-/* open, close, read, ioctl, poll, kqfilter -- XXX should be a generic device */
+/* open, close, read, write, ioctl, mmap */
+#define cdev_ptm_init(c,n) { \
+	dev_init(c,n,open), dev_init(c,n,close), dev_init(c,n,read), \
+	dev_init(c,n,write), dev_init(c,n,ioctl), (dev_type_stop((*))) enodev, \
+	0, (dev_type_poll((*))) enodev, (dev_type_mmap((*))) enodev }
+
+/* open, close, read, ioctl, poll, kqfilter XXX should be a generic device */
 #define cdev_log_init(c,n) { \
 	dev_init(c,n,open), dev_init(c,n,close), dev_init(c,n,read), \
 	(dev_type_write((*))) enodev, dev_init(c,n,ioctl), \
@@ -533,6 +539,8 @@ cdev_decl(pts);
 #define	ptcioctl	ptyioctl
 cdev_decl(ptc);
 
+cdev_decl(ptm);
+
 cdev_decl(ctty);
 
 cdev_decl(audio);
diff --git a/sys/sys/tty.h b/sys/sys/tty.h
index d5b2bdf30e0..0df3ba033cd 100644
--- a/sys/sys/tty.h
+++ b/sys/sys/tty.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tty.h,v 1.17 2004/02/10 01:19:47 millert Exp $	*/
+/*	$OpenBSD: tty.h,v 1.18 2004/02/10 01:31:21 millert Exp $	*/
 /*	$NetBSD: tty.h,v 1.30.4.1 1996/06/02 09:08:13 mrg Exp $	*/
 
 /*-
@@ -62,6 +62,18 @@
 	{ "nptys", CTLTYPE_INT }, \
 }
 
+/* ptmget, for /dev/ptm pty getting ioctl PTMGET */
+
+struct ptmget {
+	int	cfd;
+	int	sfd;
+	char	cn[16];
+	char	sn[16];
+};
+#define PTMGET _IOR('t', 1, struct ptmget) /* get ptys */
+#define PATH_PTMDEV	"/dev/ptm"
+#define TTY_GID		4	/* XXX evil hardcoding of tty gid */
+
 /*
  * Clists are actually ring buffers. The c_cc, c_cf, c_cl fields have
  * exactly the same behaviour as in true clists.