xref: /freebsd/sys/kern/tty.c (revision 06064893b3c62c648518be78604fac29fc0d9d61)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Copyright (c) 2002 Networks Associates Technologies, Inc.
11  * All rights reserved.
12  *
13  * Portions of this software were developed for the FreeBSD Project by
14  * ThinkSec AS and NAI Labs, the Security Research Division of Network
15  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
16  * ("CBOSS"), as part of the DARPA CHATS research program.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 4. Neither the name of the University nor the names of its contributors
27  *    may be used to endorse or promote products derived from this software
28  *    without specific prior written permission.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40  * SUCH DAMAGE.
41  *
42  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
43  */
44 
45 /*-
46  * TODO:
47  *	o Fix races for sending the start char in ttyflush().
48  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
49  *	  With luck, there will be MIN chars before select() returns().
50  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
51  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
52  *	  FIONREAD.
53  *	o Do the new sio locking stuff here and use it to avoid special
54  *	  case for EXTPROC?
55  *	o Lock PENDIN too?
56  *	o Move EXTPROC and/or PENDIN to t_state?
57  *	o Wrap most of ttioctl in spltty/splx.
58  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
59  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
60  *	o Don't allow certain termios flags to affect disciplines other
61  *	  than TTYDISC.  Cancel their effects before switch disciplines
62  *	  and ignore them if they are set while we are in another
63  *	  discipline.
64  *	o Now that historical speed conversions are handled here, don't
65  *	  do them in drivers.
66  *	o Check for TS_CARR_ON being set while everything is closed and not
67  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
68  *	  so it would live until the next open even if carrier drops.
69  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
70  *	  only when _all_ openers leave open().
71  */
72 
73 #include <sys/cdefs.h>
74 __FBSDID("$FreeBSD$");
75 
76 #include "opt_compat.h"
77 #include "opt_tty.h"
78 
79 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/filio.h>
82 #include <sys/lock.h>
83 #include <sys/mutex.h>
84 #include <sys/namei.h>
85 #include <sys/sx.h>
86 #ifndef BURN_BRIDGES
87 #if defined(COMPAT_43)
88 #include <sys/ioctl_compat.h>
89 #endif
90 #endif
91 #include <sys/proc.h>
92 #define	TTYDEFCHARS
93 #include <sys/tty.h>
94 #undef	TTYDEFCHARS
95 #include <sys/fcntl.h>
96 #include <sys/conf.h>
97 #include <sys/poll.h>
98 #include <sys/kernel.h>
99 #include <sys/vnode.h>
100 #include <sys/serial.h>
101 #include <sys/signalvar.h>
102 #include <sys/resourcevar.h>
103 #include <sys/malloc.h>
104 #include <sys/filedesc.h>
105 #include <sys/sched.h>
106 #include <sys/sysctl.h>
107 #include <sys/timepps.h>
108 
109 #include <machine/stdarg.h>
110 
111 #include <vm/vm.h>
112 #include <vm/pmap.h>
113 #include <vm/vm_map.h>
114 
115 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
116 
117 long tk_cancc;
118 long tk_nin;
119 long tk_nout;
120 long tk_rawcc;
121 
122 static	d_open_t	ttysopen;
123 static	d_close_t	ttysclose;
124 static	d_read_t	ttysrdwr;
125 static	d_ioctl_t	ttysioctl;
126 static	d_purge_t	ttypurge;
127 
128 /* Default cdevsw for common tty devices */
129 static struct cdevsw tty_cdevsw = {
130 	.d_version =	D_VERSION,
131 	.d_open =	ttyopen,
132 	.d_close =	ttyclose,
133 	.d_ioctl =	ttyioctl,
134 	.d_purge =	ttypurge,
135 	.d_name =	"ttydrv",
136 	.d_flags =	D_TTY | D_NEEDGIANT,
137 };
138 
139 /* Cdevsw for slave tty devices */
140 static struct cdevsw ttys_cdevsw = {
141 	.d_version =	D_VERSION,
142 	.d_open =	ttysopen,
143 	.d_close =	ttysclose,
144 	.d_read =	ttysrdwr,
145 	.d_write =	ttysrdwr,
146 	.d_ioctl =	ttysioctl,
147 	.d_name =	"TTYS",
148 	.d_flags =	D_TTY | D_NEEDGIANT,
149 };
150 
151 static int	proc_compare(struct proc *p1, struct proc *p2);
152 static int	ttnread(struct tty *tp);
153 static void	ttyecho(int c, struct tty *tp);
154 static int	ttyoutput(int c, struct tty *tp);
155 static void	ttypend(struct tty *tp);
156 static void	ttyretype(struct tty *tp);
157 static void	ttyrub(int c, struct tty *tp);
158 static void	ttyrubo(struct tty *tp, int cnt);
159 static void	ttyunblock(struct tty *tp);
160 static int	ttywflush(struct tty *tp);
161 static int	filt_ttyread(struct knote *kn, long hint);
162 static void	filt_ttyrdetach(struct knote *kn);
163 static int	filt_ttywrite(struct knote *kn, long hint);
164 static void	filt_ttywdetach(struct knote *kn);
165 
166 /*
167  * Table with character classes and parity. The 8th bit indicates parity,
168  * the 7th bit indicates the character is an alphameric or underscore (for
169  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
170  * are 0 then the character needs no special processing on output; classes
171  * other than 0 might be translated or (not currently) require delays.
172  */
173 #define	E	0x00	/* Even parity. */
174 #define	O	0x80	/* Odd parity. */
175 #define	PARITY(c)	(char_type[c] & O)
176 
177 #define	ALPHA	0x40	/* Alpha or underscore. */
178 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
179 
180 #define	CCLASSMASK	0x3f
181 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
182 
183 #define	BS	BACKSPACE
184 #define	CC	CONTROL
185 #define	CR	RETURN
186 #define	NA	ORDINARY | ALPHA
187 #define	NL	NEWLINE
188 #define	NO	ORDINARY
189 #define	TB	TAB
190 #define	VT	VTAB
191 
192 static u_char const char_type[] = {
193 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
194 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
195 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
196 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
197 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
198 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
199 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
200 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
201 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
202 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
203 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
204 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
205 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
206 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
207 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
208 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
209 	/*
210 	 * Meta chars; should be settable per character set;
211 	 * for now, treat them all as normal characters.
212 	 */
213 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
214 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
215 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
216 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
217 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
218 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
219 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
220 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
221 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
222 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
223 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
224 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
225 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
226 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
227 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
228 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
229 };
230 #undef	BS
231 #undef	CC
232 #undef	CR
233 #undef	NA
234 #undef	NL
235 #undef	NO
236 #undef	TB
237 #undef	VT
238 
239 /* Macros to clear/set/test flags. */
240 #define	SET(t, f)	(t) |= (f)
241 #define	CLR(t, f)	(t) &= ~(f)
242 #define	ISSET(t, f)	((t) & (f))
243 
244 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
245 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
246 
247 /*
248  * list of struct tty where pstat(8) can pick it up with sysctl
249  *
250  * The lock order is to grab the list mutex before the tty mutex.
251  * Together with additions going on the tail of the list, this allows
252  * the sysctl to avoid doing retries.
253  */
254 static	TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
255 static struct mtx tty_list_mutex;
256 
257 static struct unrhdr *tty_unit;
258 
259 static int  drainwait = 5*60;
260 SYSCTL_INT(_kern, OID_AUTO, drainwait, CTLFLAG_RW, &drainwait,
261 	0, "Output drain timeout in seconds");
262 
263 static struct tty *
264 tty_gettp(struct cdev *dev)
265 {
266 	struct tty *tp;
267 	struct cdevsw *csw;
268 
269 	csw = dev_refthread(dev);
270 	KASSERT(csw != NULL, ("No cdevsw in ttycode (%s)", devtoname(dev)));
271 	KASSERT(csw->d_flags & D_TTY,
272 	    ("non D_TTY (%s) in tty code", devtoname(dev)));
273 	dev_relthread(dev);
274 	tp = dev->si_tty;
275 	KASSERT(tp != NULL,
276 	    ("no tty pointer on (%s) in tty code", devtoname(dev)));
277 	return (tp);
278 }
279 
280 /*
281  * Initial open of tty, or (re)entry to standard tty line discipline.
282  */
283 int
284 tty_open(struct cdev *device, struct tty *tp)
285 {
286 	int s;
287 
288 	s = spltty();
289 	tp->t_dev = device;
290 	tp->t_hotchar = 0;
291 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
292 		ttyref(tp);
293 		SET(tp->t_state, TS_ISOPEN);
294 		if (ISSET(tp->t_cflag, CLOCAL))
295 			SET(tp->t_state, TS_CONNECTED);
296 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
297 	}
298 	/* XXX don't hang forever on output */
299 	if (tp->t_timeout < 0)
300 		tp->t_timeout = drainwait*hz;
301 	ttsetwater(tp);
302 	splx(s);
303 	return (0);
304 }
305 
306 /*
307  * Handle close() on a tty line: flush and set to initial state,
308  * bumping generation number so that pending read/write calls
309  * can detect recycling of the tty.
310  * XXX our caller should have done `spltty(); l_close(); tty_close();'
311  * and l_close() should have flushed, but we repeat the spltty() and
312  * the flush in case there are buggy callers.
313  */
314 int
315 tty_close(struct tty *tp)
316 {
317 	int s;
318 
319 	funsetown(&tp->t_sigio);
320 	s = spltty();
321 	if (constty == tp)
322 		constty_clear();
323 
324 	ttyflush(tp, FREAD | FWRITE);
325 	clist_free_cblocks(&tp->t_canq);
326 	clist_free_cblocks(&tp->t_outq);
327 	clist_free_cblocks(&tp->t_rawq);
328 
329 	tp->t_gen++;
330 	tp->t_line = TTYDISC;
331 	tp->t_hotchar = 0;
332 	tp->t_pgrp = NULL;
333 	tp->t_session = NULL;
334 	tp->t_state = 0;
335 	knlist_clear(&tp->t_rsel.si_note, 0);
336 	knlist_clear(&tp->t_wsel.si_note, 0);
337 	ttyrel(tp);
338 	splx(s);
339 	return (0);
340 }
341 
342 #define	FLUSHQ(q) {							\
343 	if ((q)->c_cc)							\
344 		ndflush(q, (q)->c_cc);					\
345 }
346 
347 /* Is 'c' a line delimiter ("break" character)? */
348 #define	TTBREAKC(c, lflag)							\
349 	((c) == '\n' || (((c) == cc[VEOF] ||				\
350 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
351 	 (c) != _POSIX_VDISABLE))
352 
353 /*
354  * Process input of a single character received on a tty.
355  */
356 int
357 ttyinput(int c, struct tty *tp)
358 {
359 	tcflag_t iflag, lflag;
360 	cc_t *cc;
361 	int i, err;
362 
363 	/*
364 	 * If input is pending take it first.
365 	 */
366 	lflag = tp->t_lflag;
367 	if (ISSET(lflag, PENDIN))
368 		ttypend(tp);
369 	/*
370 	 * Gather stats.
371 	 */
372 	if (ISSET(lflag, ICANON)) {
373 		++tk_cancc;
374 		++tp->t_cancc;
375 	} else {
376 		++tk_rawcc;
377 		++tp->t_rawcc;
378 	}
379 	++tk_nin;
380 
381 	/*
382 	 * Block further input iff:
383 	 * current input > threshold AND input is available to user program
384 	 * AND input flow control is enabled and not yet invoked.
385 	 * The 3 is slop for PARMRK.
386 	 */
387 	iflag = tp->t_iflag;
388 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
389 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
390 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
391 	    !ISSET(tp->t_state, TS_TBLOCK))
392 		ttyblock(tp);
393 
394 	/* Handle exceptional conditions (break, parity, framing). */
395 	cc = tp->t_cc;
396 	err = (ISSET(c, TTY_ERRORMASK));
397 	if (err) {
398 		CLR(c, TTY_ERRORMASK);
399 		if (ISSET(err, TTY_BI)) {
400 			if (ISSET(iflag, IGNBRK))
401 				return (0);
402 			if (ISSET(iflag, BRKINT)) {
403 				ttyflush(tp, FREAD | FWRITE);
404 				if (tp->t_pgrp != NULL) {
405 					PGRP_LOCK(tp->t_pgrp);
406 					pgsignal(tp->t_pgrp, SIGINT, 1);
407 					PGRP_UNLOCK(tp->t_pgrp);
408 				}
409 				goto endcase;
410 			}
411 			if (ISSET(iflag, PARMRK))
412 				goto parmrk;
413 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
414 			|| ISSET(err, TTY_FE)) {
415 			if (ISSET(iflag, IGNPAR))
416 				return (0);
417 			else if (ISSET(iflag, PARMRK)) {
418 parmrk:
419 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
420 				    MAX_INPUT - 3)
421 					goto input_overflow;
422 				(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
423 				(void)putc(0 | TTY_QUOTE, &tp->t_rawq);
424 				(void)putc(c | TTY_QUOTE, &tp->t_rawq);
425 				goto endcase;
426 			} else
427 				c = 0;
428 		}
429 	}
430 
431 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
432 		CLR(c, 0x80);
433 	if (!ISSET(lflag, EXTPROC)) {
434 		/*
435 		 * Check for literal nexting very first
436 		 */
437 		if (ISSET(tp->t_state, TS_LNCH)) {
438 			SET(c, TTY_QUOTE);
439 			CLR(tp->t_state, TS_LNCH);
440 		}
441 		/*
442 		 * Scan for special characters.  This code
443 		 * is really just a big case statement with
444 		 * non-constant cases.  The bottom of the
445 		 * case statement is labeled ``endcase'', so goto
446 		 * it after a case match, or similar.
447 		 */
448 
449 		/*
450 		 * Control chars which aren't controlled
451 		 * by ICANON, ISIG, or IXON.
452 		 */
453 		if (ISSET(lflag, IEXTEN)) {
454 			if (CCEQ(cc[VLNEXT], c)) {
455 				if (ISSET(lflag, ECHO)) {
456 					if (ISSET(lflag, ECHOE)) {
457 						(void)ttyoutput('^', tp);
458 						(void)ttyoutput('\b', tp);
459 					} else
460 						ttyecho(c, tp);
461 				}
462 				SET(tp->t_state, TS_LNCH);
463 				goto endcase;
464 			}
465 			if (CCEQ(cc[VDISCARD], c)) {
466 				if (ISSET(lflag, FLUSHO))
467 					CLR(tp->t_lflag, FLUSHO);
468 				else {
469 					ttyflush(tp, FWRITE);
470 					ttyecho(c, tp);
471 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
472 						ttyretype(tp);
473 					SET(tp->t_lflag, FLUSHO);
474 				}
475 				goto startoutput;
476 			}
477 		}
478 		/*
479 		 * Signals.
480 		 */
481 		if (ISSET(lflag, ISIG)) {
482 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
483 				if (!ISSET(lflag, NOFLSH))
484 					ttyflush(tp, FREAD | FWRITE);
485 				ttyecho(c, tp);
486 				if (tp->t_pgrp != NULL) {
487 					PGRP_LOCK(tp->t_pgrp);
488 					pgsignal(tp->t_pgrp,
489 					    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
490 					PGRP_UNLOCK(tp->t_pgrp);
491 				}
492 				goto endcase;
493 			}
494 			if (CCEQ(cc[VSUSP], c)) {
495 				if (!ISSET(lflag, NOFLSH))
496 					ttyflush(tp, FREAD);
497 				ttyecho(c, tp);
498 				if (tp->t_pgrp != NULL) {
499 					PGRP_LOCK(tp->t_pgrp);
500 					pgsignal(tp->t_pgrp, SIGTSTP, 1);
501 					PGRP_UNLOCK(tp->t_pgrp);
502 				}
503 				goto endcase;
504 			}
505 		}
506 		/*
507 		 * Handle start/stop characters.
508 		 */
509 		if (ISSET(iflag, IXON)) {
510 			if (CCEQ(cc[VSTOP], c)) {
511 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
512 					SET(tp->t_state, TS_TTSTOP);
513 					(*tp->t_stop)(tp, 0);
514 					return (0);
515 				}
516 				if (!CCEQ(cc[VSTART], c))
517 					return (0);
518 				/*
519 				 * if VSTART == VSTOP then toggle
520 				 */
521 				goto endcase;
522 			}
523 			if (CCEQ(cc[VSTART], c))
524 				goto restartoutput;
525 		}
526 		/*
527 		 * IGNCR, ICRNL, & INLCR
528 		 */
529 		if (c == '\r') {
530 			if (ISSET(iflag, IGNCR))
531 				return (0);
532 			else if (ISSET(iflag, ICRNL))
533 				c = '\n';
534 		} else if (c == '\n' && ISSET(iflag, INLCR))
535 			c = '\r';
536 	}
537 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
538 		/*
539 		 * From here on down canonical mode character
540 		 * processing takes place.
541 		 */
542 		/*
543 		 * erase or erase2 (^H / ^?)
544 		 */
545 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
546 			if (tp->t_rawq.c_cc)
547 				ttyrub(unputc(&tp->t_rawq), tp);
548 			goto endcase;
549 		}
550 		/*
551 		 * kill (^U)
552 		 */
553 		if (CCEQ(cc[VKILL], c)) {
554 			if (ISSET(lflag, ECHOKE) &&
555 			    tp->t_rawq.c_cc == tp->t_rocount &&
556 			    !ISSET(lflag, ECHOPRT))
557 				while (tp->t_rawq.c_cc)
558 					ttyrub(unputc(&tp->t_rawq), tp);
559 			else {
560 				ttyecho(c, tp);
561 				if (ISSET(lflag, ECHOK) ||
562 				    ISSET(lflag, ECHOKE))
563 					ttyecho('\n', tp);
564 				FLUSHQ(&tp->t_rawq);
565 				tp->t_rocount = 0;
566 			}
567 			CLR(tp->t_state, TS_LOCAL);
568 			goto endcase;
569 		}
570 		/*
571 		 * word erase (^W)
572 		 */
573 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
574 			int ctype;
575 
576 			/*
577 			 * erase whitespace
578 			 */
579 			while ((c = unputc(&tp->t_rawq)) == ' ' || c == '\t')
580 				ttyrub(c, tp);
581 			if (c == -1)
582 				goto endcase;
583 			/*
584 			 * erase last char of word and remember the
585 			 * next chars type (for ALTWERASE)
586 			 */
587 			ttyrub(c, tp);
588 			c = unputc(&tp->t_rawq);
589 			if (c == -1)
590 				goto endcase;
591 			if (c == ' ' || c == '\t') {
592 				(void)putc(c, &tp->t_rawq);
593 				goto endcase;
594 			}
595 			ctype = ISALPHA(c);
596 			/*
597 			 * erase rest of word
598 			 */
599 			do {
600 				ttyrub(c, tp);
601 				c = unputc(&tp->t_rawq);
602 				if (c == -1)
603 					goto endcase;
604 			} while (c != ' ' && c != '\t' &&
605 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
606 			(void)putc(c, &tp->t_rawq);
607 			goto endcase;
608 		}
609 		/*
610 		 * reprint line (^R)
611 		 */
612 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
613 			ttyretype(tp);
614 			goto endcase;
615 		}
616 		/*
617 		 * ^T - kernel info and generate SIGINFO
618 		 */
619 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
620 			if (ISSET(lflag, ISIG) && tp->t_pgrp != NULL) {
621 				PGRP_LOCK(tp->t_pgrp);
622 				pgsignal(tp->t_pgrp, SIGINFO, 1);
623 				PGRP_UNLOCK(tp->t_pgrp);
624 			}
625 			if (!ISSET(lflag, NOKERNINFO))
626 				ttyinfo(tp);
627 			goto endcase;
628 		}
629 	}
630 	/*
631 	 * Check for input buffer overflow
632 	 */
633 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
634 input_overflow:
635 		if (ISSET(iflag, IMAXBEL)) {
636 			if (tp->t_outq.c_cc < tp->t_ohiwat)
637 				(void)ttyoutput(CTRL('g'), tp);
638 		}
639 		goto endcase;
640 	}
641 
642 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
643 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
644 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
645 
646 	/*
647 	 * Put data char in q for user and
648 	 * wakeup on seeing a line delimiter.
649 	 */
650 	if (putc(c, &tp->t_rawq) >= 0) {
651 		if (!ISSET(lflag, ICANON)) {
652 			ttwakeup(tp);
653 			ttyecho(c, tp);
654 			goto endcase;
655 		}
656 		if (TTBREAKC(c, lflag)) {
657 			tp->t_rocount = 0;
658 			catq(&tp->t_rawq, &tp->t_canq);
659 			ttwakeup(tp);
660 		} else if (tp->t_rocount++ == 0)
661 			tp->t_rocol = tp->t_column;
662 		if (ISSET(tp->t_state, TS_ERASE)) {
663 			/*
664 			 * end of prterase \.../
665 			 */
666 			CLR(tp->t_state, TS_ERASE);
667 			(void)ttyoutput('/', tp);
668 		}
669 		i = tp->t_column;
670 		ttyecho(c, tp);
671 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
672 			/*
673 			 * Place the cursor over the '^' of the ^D.
674 			 */
675 			i = imin(2, tp->t_column - i);
676 			while (i > 0) {
677 				(void)ttyoutput('\b', tp);
678 				i--;
679 			}
680 		}
681 	}
682 endcase:
683 	/*
684 	 * IXANY means allow any character to restart output.
685 	 */
686 	if (ISSET(tp->t_state, TS_TTSTOP) &&
687 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
688 		return (0);
689 restartoutput:
690 	CLR(tp->t_lflag, FLUSHO);
691 	CLR(tp->t_state, TS_TTSTOP);
692 startoutput:
693 	return (ttstart(tp));
694 }
695 
696 /*
697  * Output a single character on a tty, doing output processing
698  * as needed (expanding tabs, newline processing, etc.).
699  * Returns < 0 if succeeds, otherwise returns char to resend.
700  * Must be recursive.
701  */
702 static int
703 ttyoutput(int c, struct tty *tp)
704 {
705 	tcflag_t oflag;
706 	int col, s;
707 
708 	oflag = tp->t_oflag;
709 	if (!ISSET(oflag, OPOST)) {
710 		if (ISSET(tp->t_lflag, FLUSHO))
711 			return (-1);
712 		if (putc(c, &tp->t_outq))
713 			return (c);
714 		tk_nout++;
715 		tp->t_outcc++;
716 		return (-1);
717 	}
718 	/*
719 	 * Do tab expansion if OXTABS is set.  Special case if we external
720 	 * processing, we don't do the tab expansion because we'll probably
721 	 * get it wrong.  If tab expansion needs to be done, let it happen
722 	 * externally.
723 	 */
724 	CLR(c, ~TTY_CHARMASK);
725 	if (c == '\t' &&
726 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
727 		c = 8 - (tp->t_column & 7);
728 		if (!ISSET(tp->t_lflag, FLUSHO)) {
729 			s = spltty();		/* Don't interrupt tabs. */
730 			c -= b_to_q("        ", c, &tp->t_outq);
731 			tk_nout += c;
732 			tp->t_outcc += c;
733 			splx(s);
734 		}
735 		tp->t_column += c;
736 		return (c ? -1 : '\t');
737 	}
738 	if (c == CEOT && ISSET(oflag, ONOEOT))
739 		return (-1);
740 
741 	/*
742 	 * Newline translation: if ONLCR is set,
743 	 * translate newline into "\r\n".
744 	 */
745 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
746 		tk_nout++;
747 		tp->t_outcc++;
748 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
749 			return (c);
750 	}
751 	/* If OCRNL is set, translate "\r" into "\n". */
752 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
753 		c = '\n';
754 	/* If ONOCR is set, don't transmit CRs when on column 0. */
755 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
756 		return (-1);
757 
758 	tk_nout++;
759 	tp->t_outcc++;
760 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
761 		return (c);
762 
763 	col = tp->t_column;
764 	switch (CCLASS(c)) {
765 	case BACKSPACE:
766 		if (col > 0)
767 			--col;
768 		break;
769 	case CONTROL:
770 		break;
771 	case NEWLINE:
772 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
773 			col = 0;
774 		break;
775 	case RETURN:
776 		col = 0;
777 		break;
778 	case ORDINARY:
779 		++col;
780 		break;
781 	case TAB:
782 		col = (col + 8) & ~7;
783 		break;
784 	}
785 	tp->t_column = col;
786 	return (-1);
787 }
788 
789 /*
790  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
791  * has been called to do discipline-specific functions and/or reject any
792  * of these ioctl commands.
793  */
794 /* ARGSUSED */
795 int
796 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
797 {
798 	struct proc *p;
799 	struct thread *td;
800 	struct pgrp *pgrp;
801 	int s, error, bits, sig, sig2;
802 
803 	td = curthread;			/* XXX */
804 	p = td->td_proc;
805 
806 	/* If the ioctl involves modification, hang if in the background. */
807 	switch (cmd) {
808 	case  TIOCCBRK:
809 	case  TIOCCONS:
810 	case  TIOCDRAIN:
811 	case  TIOCEXCL:
812 	case  TIOCFLUSH:
813 #ifdef TIOCHPCL
814 	case  TIOCHPCL:
815 #endif
816 	case  TIOCNXCL:
817 	case  TIOCSBRK:
818 	case  TIOCSCTTY:
819 	case  TIOCSDRAINWAIT:
820 	case  TIOCSETA:
821 	case  TIOCSETAF:
822 	case  TIOCSETAW:
823 	case  TIOCSETD:
824 	case  TIOCSPGRP:
825 	case  TIOCSTART:
826 	case  TIOCSTAT:
827 	case  TIOCSTI:
828 	case  TIOCSTOP:
829 	case  TIOCSWINSZ:
830 #ifndef BURN_BRIDGES
831 #if defined(COMPAT_43)
832 	case  TIOCLBIC:
833 	case  TIOCLBIS:
834 	case  TIOCLSET:
835 	case  TIOCSETC:
836 	case OTIOCSETD:
837 	case  TIOCSETN:
838 	case  TIOCSETP:
839 	case  TIOCSLTC:
840 #endif
841 #endif
842 		sx_slock(&proctree_lock);
843 		PROC_LOCK(p);
844 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
845 		    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
846 		    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
847 			pgrp = p->p_pgrp;
848 			PROC_UNLOCK(p);
849 			if (pgrp->pg_jobc == 0) {
850 				sx_sunlock(&proctree_lock);
851 				return (EIO);
852 			}
853 			PGRP_LOCK(pgrp);
854 			sx_sunlock(&proctree_lock);
855 			pgsignal(pgrp, SIGTTOU, 1);
856 			PGRP_UNLOCK(pgrp);
857 			error = ttysleep(tp, &lbolt, TTOPRI | PCATCH, "ttybg1",
858 					 0);
859 			if (error)
860 				return (error);
861 			sx_slock(&proctree_lock);
862 			PROC_LOCK(p);
863 		}
864 		PROC_UNLOCK(p);
865 		sx_sunlock(&proctree_lock);
866 		break;
867 	}
868 
869 	if (tp->t_break != NULL) {
870 		switch (cmd) {
871 		case TIOCSBRK:
872 			tp->t_break(tp, 1);
873 			return (0);
874 		case TIOCCBRK:
875 			tp->t_break(tp, 0);
876 			return (0);
877 		default:
878 			break;
879 		}
880 	}
881 
882 	if (tp->t_modem != NULL) {
883 		switch (cmd) {
884 		case TIOCSDTR:
885 			tp->t_modem(tp, SER_DTR, 0);
886 			return (0);
887 		case TIOCCDTR:
888 			tp->t_modem(tp, 0, SER_DTR);
889 			return (0);
890 		case TIOCMSET:
891 			bits = *(int *)data;
892 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
893 			sig2 = ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1;
894 			tp->t_modem(tp, sig, sig2);
895 			return (0);
896 		case TIOCMBIS:
897 			bits = *(int *)data;
898 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
899 			tp->t_modem(tp, sig, 0);
900 			return (0);
901 		case TIOCMBIC:
902 			bits = *(int *)data;
903 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
904 			tp->t_modem(tp, 0, sig);
905 			return (0);
906 		case TIOCMGET:
907 			sig = tp->t_modem(tp, 0, 0);
908 			/* See <sys/serial.h. for the "<< 1" stuff */
909 			bits = TIOCM_LE + (sig << 1);
910 			*(int *)data = bits;
911 			return (0);
912 		default:
913 			break;
914 		}
915 	}
916 
917 	switch (cmd) {			/* Process the ioctl. */
918 	case FIOASYNC:			/* set/clear async i/o */
919 		s = spltty();
920 		if (*(int *)data)
921 			SET(tp->t_state, TS_ASYNC);
922 		else
923 			CLR(tp->t_state, TS_ASYNC);
924 		splx(s);
925 		break;
926 	case FIONBIO:			/* set/clear non-blocking i/o */
927 		break;			/* XXX: delete. */
928 	case FIONREAD:			/* get # bytes to read */
929 		s = spltty();
930 		*(int *)data = ttnread(tp);
931 		splx(s);
932 		break;
933 
934 	case FIOSETOWN:
935 		/*
936 		 * Policy -- Don't allow FIOSETOWN on someone else's
937 		 *           controlling tty
938 		 */
939 		if (tp->t_session != NULL && !isctty(p, tp))
940 			return (ENOTTY);
941 
942 		error = fsetown(*(int *)data, &tp->t_sigio);
943 		if (error)
944 			return (error);
945 		break;
946 	case FIOGETOWN:
947 		if (tp->t_session != NULL && !isctty(p, tp))
948 			return (ENOTTY);
949 		*(int *)data = fgetown(&tp->t_sigio);
950 		break;
951 
952 	case TIOCEXCL:			/* set exclusive use of tty */
953 		s = spltty();
954 		SET(tp->t_state, TS_XCLUDE);
955 		splx(s);
956 		break;
957 	case TIOCFLUSH: {		/* flush buffers */
958 		int flags = *(int *)data;
959 
960 		if (flags == 0)
961 			flags = FREAD | FWRITE;
962 		else
963 			flags &= FREAD | FWRITE;
964 		ttyflush(tp, flags);
965 		break;
966 	}
967 	case TIOCCONS:			/* become virtual console */
968 		if (*(int *)data) {
969 			struct nameidata nid;
970 
971 			if (constty && constty != tp &&
972 			    ISSET(constty->t_state, TS_CONNECTED))
973 				return (EBUSY);
974 
975 			/* Ensure user can open the real console. */
976 			NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
977 			    "/dev/console", td);
978 			if ((error = namei(&nid)) != 0)
979 				return (error);
980 			NDFREE(&nid, NDF_ONLY_PNBUF);
981 			error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
982 			vput(nid.ni_vp);
983 			if (error)
984 				return (error);
985 
986 			constty_set(tp);
987 		} else if (tp == constty)
988 			constty_clear();
989 		break;
990 	case TIOCDRAIN:			/* wait till output drained */
991 		error = ttywait(tp);
992 		if (error)
993 			return (error);
994 		break;
995 	case TIOCGETA: {		/* get termios struct */
996 		struct termios *t = (struct termios *)data;
997 
998 		bcopy(&tp->t_termios, t, sizeof(struct termios));
999 		break;
1000 	}
1001 	case TIOCGETD:			/* get line discipline */
1002 		*(int *)data = tp->t_line;
1003 		break;
1004 	case TIOCGWINSZ:		/* get window size */
1005 		*(struct winsize *)data = tp->t_winsize;
1006 		break;
1007 	case TIOCGPGRP:			/* get pgrp of tty */
1008 		if (!isctty(p, tp))
1009 			return (ENOTTY);
1010 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1011 		break;
1012 #ifdef TIOCHPCL
1013 	case TIOCHPCL:			/* hang up on last close */
1014 		s = spltty();
1015 		SET(tp->t_cflag, HUPCL);
1016 		splx(s);
1017 		break;
1018 #endif
1019 	case TIOCMGDTRWAIT:
1020 		*(int *)data = tp->t_dtr_wait * 100 / hz;
1021 		break;
1022 	case TIOCMSDTRWAIT:
1023 		/* must be root since the wait applies to following logins */
1024 		error = suser(td);
1025 		if (error)
1026 			return (error);
1027 		tp->t_dtr_wait = *(int *)data * hz / 100;
1028 		break;
1029 	case TIOCNXCL:			/* reset exclusive use of tty */
1030 		s = spltty();
1031 		CLR(tp->t_state, TS_XCLUDE);
1032 		splx(s);
1033 		break;
1034 	case TIOCOUTQ:			/* output queue size */
1035 		*(int *)data = tp->t_outq.c_cc;
1036 		break;
1037 	case TIOCSETA:			/* set termios struct */
1038 	case TIOCSETAW:			/* drain output, set */
1039 	case TIOCSETAF: {		/* drn out, fls in, set */
1040 		struct termios *t = (struct termios *)data;
1041 
1042 		if (t->c_ispeed == 0)
1043 			t->c_ispeed = t->c_ospeed;
1044 		if (t->c_ispeed == 0)
1045 			t->c_ispeed = tp->t_ospeed;
1046 		if (t->c_ispeed == 0)
1047 			return (EINVAL);
1048 		s = spltty();
1049 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1050 			error = ttywait(tp);
1051 			if (error) {
1052 				splx(s);
1053 				return (error);
1054 			}
1055 			if (cmd == TIOCSETAF)
1056 				ttyflush(tp, FREAD);
1057 		}
1058 		if (!ISSET(t->c_cflag, CIGNORE)) {
1059 			/*
1060 			 * Set device hardware.
1061 			 */
1062 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1063 				splx(s);
1064 				return (error);
1065 			}
1066 			if (ISSET(t->c_cflag, CLOCAL) &&
1067 			    !ISSET(tp->t_cflag, CLOCAL)) {
1068 				/*
1069 				 * XXX disconnections would be too hard to
1070 				 * get rid of without this kludge.  The only
1071 				 * way to get rid of controlling terminals
1072 				 * is to exit from the session leader.
1073 				 */
1074 				CLR(tp->t_state, TS_ZOMBIE);
1075 
1076 				wakeup(TSA_CARR_ON(tp));
1077 				ttwakeup(tp);
1078 				ttwwakeup(tp);
1079 			}
1080 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1081 			     ISSET(t->c_cflag, CLOCAL)) &&
1082 			    !ISSET(tp->t_state, TS_ZOMBIE))
1083 				SET(tp->t_state, TS_CONNECTED);
1084 			else
1085 				CLR(tp->t_state, TS_CONNECTED);
1086 			tp->t_cflag = t->c_cflag;
1087 			tp->t_ispeed = t->c_ispeed;
1088 			if (t->c_ospeed != 0)
1089 				tp->t_ospeed = t->c_ospeed;
1090 			ttsetwater(tp);
1091 		}
1092 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1093 		    cmd != TIOCSETAF) {
1094 			if (ISSET(t->c_lflag, ICANON))
1095 				SET(tp->t_lflag, PENDIN);
1096 			else {
1097 				/*
1098 				 * XXX we really shouldn't allow toggling
1099 				 * ICANON while we're in a non-termios line
1100 				 * discipline.  Now we have to worry about
1101 				 * panicing for a null queue.
1102 				 */
1103 				if (tp->t_canq.c_cbreserved > 0 &&
1104 				    tp->t_rawq.c_cbreserved > 0) {
1105 					catq(&tp->t_rawq, &tp->t_canq);
1106 					/*
1107 					 * XXX the queue limits may be
1108 					 * different, so the old queue
1109 					 * swapping method no longer works.
1110 					 */
1111 					catq(&tp->t_canq, &tp->t_rawq);
1112 				}
1113 				CLR(tp->t_lflag, PENDIN);
1114 			}
1115 			ttwakeup(tp);
1116 		}
1117 		tp->t_iflag = t->c_iflag;
1118 		tp->t_oflag = t->c_oflag;
1119 		/*
1120 		 * Make the EXTPROC bit read only.
1121 		 */
1122 		if (ISSET(tp->t_lflag, EXTPROC))
1123 			SET(t->c_lflag, EXTPROC);
1124 		else
1125 			CLR(t->c_lflag, EXTPROC);
1126 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1127 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1128 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1129 			ttwakeup(tp);
1130 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1131 		splx(s);
1132 		break;
1133 	}
1134 	case TIOCSETD: {		/* set line discipline */
1135 		int t = *(int *)data;
1136 
1137 		if ((u_int)t >= nlinesw)
1138 			return (ENXIO);
1139 		if (t == tp->t_line)
1140 			return (0);
1141 		s = spltty();
1142 		ttyld_close(tp, flag);
1143 		tp->t_line = t;
1144 		/* XXX: we should use the correct cdev here */
1145 		error = ttyld_open(tp, tp->t_dev);
1146 		if (error) {
1147 			/*
1148 			 * If we fail to switch line discipline we cannot
1149 			 * fall back to the previous, because we can not
1150 			 * trust that ldisc to open successfully either.
1151 			 * Fall back to the default ldisc which we know
1152 			 * will allways succeed.
1153 			 */
1154 			tp->t_line = TTYDISC;
1155 			(void)ttyld_open(tp, tp->t_dev);
1156 		}
1157 		splx(s);
1158 		return (error);
1159 		break;
1160 	}
1161 	case TIOCSTART:			/* start output, like ^Q */
1162 		s = spltty();
1163 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1164 		    ISSET(tp->t_lflag, FLUSHO)) {
1165 			CLR(tp->t_lflag, FLUSHO);
1166 			CLR(tp->t_state, TS_TTSTOP);
1167 			ttstart(tp);
1168 		}
1169 		splx(s);
1170 		break;
1171 	case TIOCSTI:			/* simulate terminal input */
1172 		if ((flag & FREAD) == 0 && suser(td))
1173 			return (EPERM);
1174 		if (!isctty(p, tp) && suser(td))
1175 			return (EACCES);
1176 		s = spltty();
1177 		ttyld_rint(tp, *(u_char *)data);
1178 		splx(s);
1179 		break;
1180 	case TIOCSTOP:			/* stop output, like ^S */
1181 		s = spltty();
1182 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1183 			SET(tp->t_state, TS_TTSTOP);
1184 			(*tp->t_stop)(tp, 0);
1185 		}
1186 		splx(s);
1187 		break;
1188 	case TIOCSCTTY:			/* become controlling tty */
1189 		/* Session ctty vnode pointer set in vnode layer. */
1190 		sx_slock(&proctree_lock);
1191 		if (!SESS_LEADER(p) ||
1192 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1193 		     (tp->t_session != p->p_session))) {
1194 			sx_sunlock(&proctree_lock);
1195 			return (EPERM);
1196 		}
1197 		tp->t_session = p->p_session;
1198 		tp->t_pgrp = p->p_pgrp;
1199 		SESS_LOCK(p->p_session);
1200 		ttyref(tp);		/* ttyrel(): kern_proc.c:pgdelete() */
1201 		p->p_session->s_ttyp = tp;
1202 		SESS_UNLOCK(p->p_session);
1203 		PROC_LOCK(p);
1204 		p->p_flag |= P_CONTROLT;
1205 		PROC_UNLOCK(p);
1206 		sx_sunlock(&proctree_lock);
1207 		break;
1208 	case TIOCSPGRP: {		/* set pgrp of tty */
1209 		sx_slock(&proctree_lock);
1210 		pgrp = pgfind(*(int *)data);
1211 		if (!isctty(p, tp)) {
1212 			if (pgrp != NULL)
1213 				PGRP_UNLOCK(pgrp);
1214 			sx_sunlock(&proctree_lock);
1215 			return (ENOTTY);
1216 		}
1217 		if (pgrp == NULL) {
1218 			sx_sunlock(&proctree_lock);
1219 			return (EPERM);
1220 		}
1221 		PGRP_UNLOCK(pgrp);
1222 		if (pgrp->pg_session != p->p_session) {
1223 			sx_sunlock(&proctree_lock);
1224 			return (EPERM);
1225 		}
1226 		sx_sunlock(&proctree_lock);
1227 		tp->t_pgrp = pgrp;
1228 		break;
1229 	}
1230 	case TIOCSTAT:			/* simulate control-T */
1231 		s = spltty();
1232 		ttyinfo(tp);
1233 		splx(s);
1234 		break;
1235 	case TIOCSWINSZ:		/* set window size */
1236 		if (bcmp((caddr_t)&tp->t_winsize, data,
1237 		    sizeof (struct winsize))) {
1238 			tp->t_winsize = *(struct winsize *)data;
1239 			if (tp->t_pgrp != NULL) {
1240 				PGRP_LOCK(tp->t_pgrp);
1241 				pgsignal(tp->t_pgrp, SIGWINCH, 1);
1242 				PGRP_UNLOCK(tp->t_pgrp);
1243 			}
1244 		}
1245 		break;
1246 	case TIOCSDRAINWAIT:
1247 		error = suser(td);
1248 		if (error)
1249 			return (error);
1250 		tp->t_timeout = *(int *)data * hz;
1251 		wakeup(TSA_OCOMPLETE(tp));
1252 		wakeup(TSA_OLOWAT(tp));
1253 		break;
1254 	case TIOCGDRAINWAIT:
1255 		*(int *)data = tp->t_timeout / hz;
1256 		break;
1257 	default:
1258 #if defined(COMPAT_43)
1259 #ifndef BURN_BRIDGES
1260 		return (ttcompat(tp, cmd, data, flag));
1261 #else
1262 		return (ENOIOCTL);
1263 #endif
1264 #else
1265 		return (ENOIOCTL);
1266 #endif
1267 	}
1268 	return (0);
1269 }
1270 
1271 int
1272 ttypoll(struct cdev *dev, int events, struct thread *td)
1273 {
1274 	int s;
1275 	int revents = 0;
1276 	struct tty *tp;
1277 
1278 	tp = tty_gettp(dev);
1279 
1280 	if (tp == NULL)	/* XXX used to return ENXIO, but that means true! */
1281 		return ((events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM))
1282 			| POLLHUP);
1283 
1284 	s = spltty();
1285 	if (events & (POLLIN | POLLRDNORM)) {
1286 		if (ISSET(tp->t_state, TS_ZOMBIE))
1287 			revents |= (events & (POLLIN | POLLRDNORM)) |
1288 			    POLLHUP;
1289 		else if (ttnread(tp) > 0)
1290 			revents |= events & (POLLIN | POLLRDNORM);
1291 		else
1292 			selrecord(td, &tp->t_rsel);
1293 	}
1294 	if (events & POLLOUT) {
1295 		if (ISSET(tp->t_state, TS_ZOMBIE))
1296 			revents |= POLLHUP;
1297 		else if (tp->t_outq.c_cc <= tp->t_olowat &&
1298 		    ISSET(tp->t_state, TS_CONNECTED))
1299 			revents |= events & POLLOUT;
1300 		else
1301 			selrecord(td, &tp->t_wsel);
1302 	}
1303 	splx(s);
1304 	return (revents);
1305 }
1306 
1307 static struct filterops ttyread_filtops =
1308 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1309 static struct filterops ttywrite_filtops =
1310 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1311 
1312 int
1313 ttykqfilter(struct cdev *dev, struct knote *kn)
1314 {
1315 	struct tty *tp;
1316 	struct knlist *klist;
1317 	int s;
1318 
1319 	tp = tty_gettp(dev);
1320 
1321 	switch (kn->kn_filter) {
1322 	case EVFILT_READ:
1323 		klist = &tp->t_rsel.si_note;
1324 		kn->kn_fop = &ttyread_filtops;
1325 		break;
1326 	case EVFILT_WRITE:
1327 		klist = &tp->t_wsel.si_note;
1328 		kn->kn_fop = &ttywrite_filtops;
1329 		break;
1330 	default:
1331 		return (EINVAL);
1332 	}
1333 
1334 	kn->kn_hook = (caddr_t)dev;
1335 
1336 	s = spltty();
1337 	knlist_add(klist, kn, 0);
1338 	splx(s);
1339 
1340 	return (0);
1341 }
1342 
1343 static void
1344 filt_ttyrdetach(struct knote *kn)
1345 {
1346 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1347 	int s = spltty();
1348 
1349 	knlist_remove(&tp->t_rsel.si_note, kn, 0);
1350 	splx(s);
1351 }
1352 
1353 static int
1354 filt_ttyread(struct knote *kn, long hint)
1355 {
1356 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1357 
1358 	kn->kn_data = ttnread(tp);
1359 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1360 		kn->kn_flags |= EV_EOF;
1361 		return (1);
1362 	}
1363 	return (kn->kn_data > 0);
1364 }
1365 
1366 static void
1367 filt_ttywdetach(struct knote *kn)
1368 {
1369 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1370 	int s = spltty();
1371 
1372 	knlist_remove(&tp->t_wsel.si_note, kn, 0);
1373 	splx(s);
1374 }
1375 
1376 static int
1377 filt_ttywrite(struct knote *kn, long hint)
1378 {
1379 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1380 
1381 	kn->kn_data = tp->t_outq.c_cc;
1382 	if (ISSET(tp->t_state, TS_ZOMBIE))
1383 		return (1);
1384 	return (kn->kn_data <= tp->t_olowat &&
1385 	    ISSET(tp->t_state, TS_CONNECTED));
1386 }
1387 
1388 /*
1389  * Must be called at spltty().
1390  */
1391 static int
1392 ttnread(struct tty *tp)
1393 {
1394 	int nread;
1395 
1396 	if (ISSET(tp->t_lflag, PENDIN))
1397 		ttypend(tp);
1398 	nread = tp->t_canq.c_cc;
1399 	if (!ISSET(tp->t_lflag, ICANON)) {
1400 		nread += tp->t_rawq.c_cc;
1401 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1402 			nread = 0;
1403 	}
1404 	return (nread);
1405 }
1406 
1407 /*
1408  * Wait for output to drain.
1409  */
1410 int
1411 ttywait(struct tty *tp)
1412 {
1413 	int error, s;
1414 
1415 	error = 0;
1416 	s = spltty();
1417 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1418 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1419 		(*tp->t_oproc)(tp);
1420 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1421 		    ISSET(tp->t_state, TS_CONNECTED)) {
1422 			SET(tp->t_state, TS_SO_OCOMPLETE);
1423 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1424 					 TTOPRI | PCATCH, "ttywai",
1425 					 tp->t_timeout);
1426 			if (error) {
1427 				if (error == EWOULDBLOCK)
1428 					error = EIO;
1429 				break;
1430 			}
1431 		} else
1432 			break;
1433 	}
1434 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1435 		error = EIO;
1436 	splx(s);
1437 	return (error);
1438 }
1439 
1440 /*
1441  * Flush if successfully wait.
1442  */
1443 static int
1444 ttywflush(struct tty *tp)
1445 {
1446 	int error;
1447 
1448 	if ((error = ttywait(tp)) == 0)
1449 		ttyflush(tp, FREAD);
1450 	return (error);
1451 }
1452 
1453 /*
1454  * Flush tty read and/or write queues, notifying anyone waiting.
1455  */
1456 void
1457 ttyflush(struct tty *tp, int rw)
1458 {
1459 	int s;
1460 
1461 	s = spltty();
1462 #if 0
1463 again:
1464 #endif
1465 	if (rw & FWRITE) {
1466 		FLUSHQ(&tp->t_outq);
1467 		CLR(tp->t_state, TS_TTSTOP);
1468 	}
1469 	(*tp->t_stop)(tp, rw);
1470 	if (rw & FREAD) {
1471 		FLUSHQ(&tp->t_canq);
1472 		FLUSHQ(&tp->t_rawq);
1473 		CLR(tp->t_lflag, PENDIN);
1474 		tp->t_rocount = 0;
1475 		tp->t_rocol = 0;
1476 		CLR(tp->t_state, TS_LOCAL);
1477 		ttwakeup(tp);
1478 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1479 			if (rw & FWRITE)
1480 				FLUSHQ(&tp->t_outq);
1481 			ttyunblock(tp);
1482 
1483 			/*
1484 			 * Don't let leave any state that might clobber the
1485 			 * next line discipline (although we should do more
1486 			 * to send the START char).  Not clearing the state
1487 			 * may have caused the "putc to a clist with no
1488 			 * reserved cblocks" panic/printf.
1489 			 */
1490 			CLR(tp->t_state, TS_TBLOCK);
1491 
1492 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1493 			if (ISSET(tp->t_iflag, IXOFF)) {
1494 				/*
1495 				 * XXX wait a bit in the hope that the stop
1496 				 * character (if any) will go out.  Waiting
1497 				 * isn't good since it allows races.  This
1498 				 * will be fixed when the stop character is
1499 				 * put in a special queue.  Don't bother with
1500 				 * the checks in ttywait() since the timeout
1501 				 * will save us.
1502 				 */
1503 				SET(tp->t_state, TS_SO_OCOMPLETE);
1504 				ttysleep(tp, TSA_OCOMPLETE(tp), TTOPRI,
1505 					 "ttyfls", hz / 10);
1506 				/*
1507 				 * Don't try sending the stop character again.
1508 				 */
1509 				CLR(tp->t_state, TS_TBLOCK);
1510 				goto again;
1511 			}
1512 #endif
1513 		}
1514 	}
1515 	if (rw & FWRITE) {
1516 		FLUSHQ(&tp->t_outq);
1517 		ttwwakeup(tp);
1518 	}
1519 	splx(s);
1520 }
1521 
1522 /*
1523  * Copy in the default termios characters.
1524  */
1525 void
1526 termioschars(struct termios *t)
1527 {
1528 
1529 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1530 }
1531 
1532 /*
1533  * Old interface.
1534  */
1535 void
1536 ttychars(struct tty *tp)
1537 {
1538 
1539 	termioschars(&tp->t_termios);
1540 }
1541 
1542 /*
1543  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1544  * on our input flow control bit and propagate the changes to the driver.
1545  * XXX the stop character should be put in a special high priority queue.
1546  */
1547 void
1548 ttyblock(struct tty *tp)
1549 {
1550 
1551 	SET(tp->t_state, TS_TBLOCK);
1552 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1553 	    putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1554 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1555 	ttstart(tp);
1556 }
1557 
1558 /*
1559  * Handle input low water.  Send start character for the IXOFF case.  Turn
1560  * off our input flow control bit and propagate the changes to the driver.
1561  * XXX the start character should be put in a special high priority queue.
1562  */
1563 static void
1564 ttyunblock(struct tty *tp)
1565 {
1566 
1567 	CLR(tp->t_state, TS_TBLOCK);
1568 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1569 	    putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1570 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1571 	ttstart(tp);
1572 }
1573 
1574 #ifdef notyet
1575 /* Not used by any current (i386) drivers. */
1576 /*
1577  * Restart after an inter-char delay.
1578  */
1579 void
1580 ttrstrt(void *tp_arg)
1581 {
1582 	struct tty *tp;
1583 	int s;
1584 
1585 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1586 
1587 	tp = tp_arg;
1588 	s = spltty();
1589 
1590 	CLR(tp->t_state, TS_TIMEOUT);
1591 	ttstart(tp);
1592 
1593 	splx(s);
1594 }
1595 #endif
1596 
1597 int
1598 ttstart(struct tty *tp)
1599 {
1600 
1601 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1602 		(*tp->t_oproc)(tp);
1603 	return (0);
1604 }
1605 
1606 /*
1607  * "close" a line discipline
1608  */
1609 int
1610 ttylclose(struct tty *tp, int flag)
1611 {
1612 
1613 	if (flag & FNONBLOCK || ttywflush(tp))
1614 		ttyflush(tp, FREAD | FWRITE);
1615 	return (0);
1616 }
1617 
1618 /*
1619  * Handle modem control transition on a tty.
1620  * Flag indicates new state of carrier.
1621  * Returns 0 if the line should be turned off, otherwise 1.
1622  */
1623 int
1624 ttymodem(struct tty *tp, int flag)
1625 {
1626 
1627 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1628 		/*
1629 		 * MDMBUF: do flow control according to carrier flag
1630 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1631 		 * works if IXON and IXANY are clear.
1632 		 */
1633 		if (flag) {
1634 			CLR(tp->t_state, TS_CAR_OFLOW);
1635 			CLR(tp->t_state, TS_TTSTOP);
1636 			ttstart(tp);
1637 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1638 			SET(tp->t_state, TS_CAR_OFLOW);
1639 			SET(tp->t_state, TS_TTSTOP);
1640 			(*tp->t_stop)(tp, 0);
1641 		}
1642 	} else if (flag == 0) {
1643 		/*
1644 		 * Lost carrier.
1645 		 */
1646 		CLR(tp->t_state, TS_CARR_ON);
1647 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1648 		    !ISSET(tp->t_cflag, CLOCAL)) {
1649 			SET(tp->t_state, TS_ZOMBIE);
1650 			CLR(tp->t_state, TS_CONNECTED);
1651 			if (tp->t_session) {
1652 				sx_slock(&proctree_lock);
1653 				if (tp->t_session->s_leader) {
1654 					struct proc *p;
1655 
1656 					p = tp->t_session->s_leader;
1657 					PROC_LOCK(p);
1658 					psignal(p, SIGHUP);
1659 					PROC_UNLOCK(p);
1660 				}
1661 				sx_sunlock(&proctree_lock);
1662 			}
1663 			ttyflush(tp, FREAD | FWRITE);
1664 			return (0);
1665 		}
1666 	} else {
1667 		/*
1668 		 * Carrier now on.
1669 		 */
1670 		SET(tp->t_state, TS_CARR_ON);
1671 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1672 			SET(tp->t_state, TS_CONNECTED);
1673 		wakeup(TSA_CARR_ON(tp));
1674 		ttwakeup(tp);
1675 		ttwwakeup(tp);
1676 	}
1677 	return (1);
1678 }
1679 
1680 /*
1681  * Reinput pending characters after state switch
1682  * call at spltty().
1683  */
1684 static void
1685 ttypend(struct tty *tp)
1686 {
1687 	struct clist tq;
1688 	int c;
1689 
1690 	CLR(tp->t_lflag, PENDIN);
1691 	SET(tp->t_state, TS_TYPEN);
1692 	/*
1693 	 * XXX this assumes too much about clist internals.  It may even
1694 	 * fail if the cblock slush pool is empty.  We can't allocate more
1695 	 * cblocks here because we are called from an interrupt handler
1696 	 * and clist_alloc_cblocks() can wait.
1697 	 */
1698 	tq = tp->t_rawq;
1699 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1700 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1701 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1702 	while ((c = getc(&tq)) >= 0)
1703 		ttyinput(c, tp);
1704 	CLR(tp->t_state, TS_TYPEN);
1705 }
1706 
1707 /*
1708  * Process a read call on a tty device.
1709  */
1710 int
1711 ttread(struct tty *tp, struct uio *uio, int flag)
1712 {
1713 	struct clist *qp;
1714 	int c;
1715 	tcflag_t lflag;
1716 	cc_t *cc = tp->t_cc;
1717 	struct thread *td;
1718 	struct proc *p;
1719 	int s, first, error = 0;
1720 	int has_stime = 0, last_cc = 0;
1721 	long slp = 0;		/* XXX this should be renamed `timo'. */
1722 	struct timeval stime;
1723 	struct pgrp *pg;
1724 
1725 	td = curthread;
1726 	p = td->td_proc;
1727 loop:
1728 	s = spltty();
1729 	lflag = tp->t_lflag;
1730 	/*
1731 	 * take pending input first
1732 	 */
1733 	if (ISSET(lflag, PENDIN)) {
1734 		ttypend(tp);
1735 		splx(s);	/* reduce latency */
1736 		s = spltty();
1737 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1738 	}
1739 
1740 	/*
1741 	 * Hang process if it's in the background.
1742 	 */
1743 	if (isbackground(p, tp)) {
1744 		splx(s);
1745 		sx_slock(&proctree_lock);
1746 		PROC_LOCK(p);
1747 		if (SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTIN) ||
1748 		    SIGISMEMBER(td->td_sigmask, SIGTTIN) ||
1749 		    (p->p_flag & P_PPWAIT) || p->p_pgrp->pg_jobc == 0) {
1750 			PROC_UNLOCK(p);
1751 			sx_sunlock(&proctree_lock);
1752 			return (EIO);
1753 		}
1754 		pg = p->p_pgrp;
1755 		PROC_UNLOCK(p);
1756 		PGRP_LOCK(pg);
1757 		sx_sunlock(&proctree_lock);
1758 		pgsignal(pg, SIGTTIN, 1);
1759 		PGRP_UNLOCK(pg);
1760 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg2", 0);
1761 		if (error)
1762 			return (error);
1763 		goto loop;
1764 	}
1765 
1766 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1767 		splx(s);
1768 		return (0);	/* EOF */
1769 	}
1770 
1771 	/*
1772 	 * If canonical, use the canonical queue,
1773 	 * else use the raw queue.
1774 	 *
1775 	 * (should get rid of clists...)
1776 	 */
1777 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1778 
1779 	if (flag & IO_NDELAY) {
1780 		if (qp->c_cc > 0)
1781 			goto read;
1782 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1783 			splx(s);
1784 			return (0);
1785 		}
1786 		splx(s);
1787 		return (EWOULDBLOCK);
1788 	}
1789 	if (!ISSET(lflag, ICANON)) {
1790 		int m = cc[VMIN];
1791 		long t = cc[VTIME];
1792 		struct timeval timecopy;
1793 
1794 		/*
1795 		 * Check each of the four combinations.
1796 		 * (m > 0 && t == 0) is the normal read case.
1797 		 * It should be fairly efficient, so we check that and its
1798 		 * companion case (m == 0 && t == 0) first.
1799 		 * For the other two cases, we compute the target sleep time
1800 		 * into slp.
1801 		 */
1802 		if (t == 0) {
1803 			if (qp->c_cc < m)
1804 				goto sleep;
1805 			if (qp->c_cc > 0)
1806 				goto read;
1807 
1808 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1809 			splx(s);
1810 			return (0);
1811 		}
1812 		t *= 100000;		/* time in us */
1813 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1814 			 ((t1).tv_usec - (t2).tv_usec))
1815 		if (m > 0) {
1816 			if (qp->c_cc <= 0)
1817 				goto sleep;
1818 			if (qp->c_cc >= m)
1819 				goto read;
1820 			getmicrotime(&timecopy);
1821 			if (!has_stime) {
1822 				/* first character, start timer */
1823 				has_stime = 1;
1824 				stime = timecopy;
1825 				slp = t;
1826 			} else if (qp->c_cc > last_cc) {
1827 				/* got a character, restart timer */
1828 				stime = timecopy;
1829 				slp = t;
1830 			} else {
1831 				/* nothing, check expiration */
1832 				slp = t - diff(timecopy, stime);
1833 				if (slp <= 0)
1834 					goto read;
1835 			}
1836 			last_cc = qp->c_cc;
1837 		} else {	/* m == 0 */
1838 			if (qp->c_cc > 0)
1839 				goto read;
1840 			getmicrotime(&timecopy);
1841 			if (!has_stime) {
1842 				has_stime = 1;
1843 				stime = timecopy;
1844 				slp = t;
1845 			} else {
1846 				slp = t - diff(timecopy, stime);
1847 				if (slp <= 0) {
1848 					/* Timed out, but 0 is enough input. */
1849 					splx(s);
1850 					return (0);
1851 				}
1852 			}
1853 		}
1854 #undef diff
1855 		/*
1856 		 * Rounding down may make us wake up just short
1857 		 * of the target, so we round up.
1858 		 * The formula is ceiling(slp * hz/1000000).
1859 		 * 32-bit arithmetic is enough for hz < 169.
1860 		 * XXX see tvtohz() for how to avoid overflow if hz
1861 		 * is large (divide by `tick' and/or arrange to
1862 		 * use tvtohz() if hz is large).
1863 		 */
1864 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1865 		goto sleep;
1866 	}
1867 	if (qp->c_cc <= 0) {
1868 sleep:
1869 		/*
1870 		 * There is no input, or not enough input and we can block.
1871 		 */
1872 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), TTIPRI | PCATCH,
1873 				 ISSET(tp->t_state, TS_CONNECTED) ?
1874 				 "ttyin" : "ttyhup", (int)slp);
1875 		splx(s);
1876 		if (error == EWOULDBLOCK)
1877 			error = 0;
1878 		else if (error)
1879 			return (error);
1880 		/*
1881 		 * XXX what happens if another process eats some input
1882 		 * while we are asleep (not just here)?  It would be
1883 		 * safest to detect changes and reset our state variables
1884 		 * (has_stime and last_cc).
1885 		 */
1886 		slp = 0;
1887 		goto loop;
1888 	}
1889 read:
1890 	splx(s);
1891 	/*
1892 	 * Input present, check for input mapping and processing.
1893 	 */
1894 	first = 1;
1895 	if (ISSET(lflag, ICANON | ISIG))
1896 		goto slowcase;
1897 	for (;;) {
1898 		char ibuf[IBUFSIZ];
1899 		int icc;
1900 
1901 		icc = imin(uio->uio_resid, IBUFSIZ);
1902 		icc = q_to_b(qp, ibuf, icc);
1903 		if (icc <= 0) {
1904 			if (first)
1905 				goto loop;
1906 			break;
1907 		}
1908 		error = uiomove(ibuf, icc, uio);
1909 		/*
1910 		 * XXX if there was an error then we should ungetc() the
1911 		 * unmoved chars and reduce icc here.
1912 		 */
1913 		if (error)
1914 			break;
1915 		if (uio->uio_resid == 0)
1916 			break;
1917 		first = 0;
1918 	}
1919 	goto out;
1920 slowcase:
1921 	for (;;) {
1922 		c = getc(qp);
1923 		if (c < 0) {
1924 			if (first)
1925 				goto loop;
1926 			break;
1927 		}
1928 		/*
1929 		 * delayed suspend (^Y)
1930 		 */
1931 		if (CCEQ(cc[VDSUSP], c) &&
1932 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1933 			if (tp->t_pgrp != NULL) {
1934 				PGRP_LOCK(tp->t_pgrp);
1935 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
1936 				PGRP_UNLOCK(tp->t_pgrp);
1937 			}
1938 			if (first) {
1939 				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
1940 						 "ttybg3", 0);
1941 				if (error)
1942 					break;
1943 				goto loop;
1944 			}
1945 			break;
1946 		}
1947 		/*
1948 		 * Interpret EOF only in canonical mode.
1949 		 */
1950 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1951 			break;
1952 		/*
1953 		 * Give user character.
1954 		 */
1955 		error = ureadc(c, uio);
1956 		if (error)
1957 			/* XXX should ungetc(c, qp). */
1958 			break;
1959 		if (uio->uio_resid == 0)
1960 			break;
1961 		/*
1962 		 * In canonical mode check for a "break character"
1963 		 * marking the end of a "line of input".
1964 		 */
1965 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1966 			break;
1967 		first = 0;
1968 	}
1969 
1970 out:
1971 	/*
1972 	 * Look to unblock input now that (presumably)
1973 	 * the input queue has gone down.
1974 	 */
1975 	s = spltty();
1976 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1977 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1978 		ttyunblock(tp);
1979 	splx(s);
1980 
1981 	return (error);
1982 }
1983 
1984 /*
1985  * Check the output queue on tp for space for a kernel message (from uprintf
1986  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1987  * lose messages due to normal flow control, but don't let the tty run amok.
1988  * Sleeps here are not interruptible, but we return prematurely if new signals
1989  * arrive.
1990  */
1991 int
1992 ttycheckoutq(struct tty *tp, int wait)
1993 {
1994 	int hiwat, s;
1995 	sigset_t oldmask;
1996 	struct thread *td;
1997 	struct proc *p;
1998 
1999 	td = curthread;
2000 	p = td->td_proc;
2001 	hiwat = tp->t_ohiwat;
2002 	SIGEMPTYSET(oldmask);
2003 	s = spltty();
2004 	if (wait) {
2005 		PROC_LOCK(p);
2006 		oldmask = td->td_siglist;
2007 		PROC_UNLOCK(p);
2008 	}
2009 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100)
2010 		while (tp->t_outq.c_cc > hiwat) {
2011 			ttstart(tp);
2012 			if (tp->t_outq.c_cc <= hiwat)
2013 				break;
2014 			if (!wait) {
2015 				splx(s);
2016 				return (0);
2017 			}
2018 			PROC_LOCK(p);
2019 			if (!SIGSETEQ(td->td_siglist, oldmask)) {
2020 				PROC_UNLOCK(p);
2021 				splx(s);
2022 				return (0);
2023 			}
2024 			PROC_UNLOCK(p);
2025 			SET(tp->t_state, TS_SO_OLOWAT);
2026 			tsleep(TSA_OLOWAT(tp), PZERO - 1, "ttoutq", hz);
2027 		}
2028 	splx(s);
2029 	return (1);
2030 }
2031 
2032 /*
2033  * Process a write call on a tty device.
2034  */
2035 int
2036 ttwrite(struct tty *tp, struct uio *uio, int flag)
2037 {
2038 	char *cp = NULL;
2039 	int cc, ce;
2040 	struct thread *td;
2041 	struct proc *p;
2042 	int i, hiwat, cnt, error, s;
2043 	char obuf[OBUFSIZ];
2044 
2045 	hiwat = tp->t_ohiwat;
2046 	cnt = uio->uio_resid;
2047 	error = 0;
2048 	cc = 0;
2049 	td = curthread;
2050 	p = td->td_proc;
2051 loop:
2052 	s = spltty();
2053 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2054 		splx(s);
2055 		if (uio->uio_resid == cnt)
2056 			error = EIO;
2057 		goto out;
2058 	}
2059 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2060 		if (flag & IO_NDELAY) {
2061 			splx(s);
2062 			error = EWOULDBLOCK;
2063 			goto out;
2064 		}
2065 		error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
2066 				 "ttywdcd", 0);
2067 		splx(s);
2068 		if (error)
2069 			goto out;
2070 		goto loop;
2071 	}
2072 	splx(s);
2073 	/*
2074 	 * Hang the process if it's in the background.
2075 	 */
2076 	sx_slock(&proctree_lock);
2077 	PROC_LOCK(p);
2078 	if (isbackground(p, tp) &&
2079 	    ISSET(tp->t_lflag, TOSTOP) && !(p->p_flag & P_PPWAIT) &&
2080 	    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
2081 	    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
2082 		if (p->p_pgrp->pg_jobc == 0) {
2083 			PROC_UNLOCK(p);
2084 			sx_sunlock(&proctree_lock);
2085 			error = EIO;
2086 			goto out;
2087 		}
2088 		PROC_UNLOCK(p);
2089 		PGRP_LOCK(p->p_pgrp);
2090 		sx_sunlock(&proctree_lock);
2091 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2092 		PGRP_UNLOCK(p->p_pgrp);
2093 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg4", 0);
2094 		if (error)
2095 			goto out;
2096 		goto loop;
2097 	} else {
2098 		PROC_UNLOCK(p);
2099 		sx_sunlock(&proctree_lock);
2100 	}
2101 	/*
2102 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2103 	 * output translation.  Keep track of high water mark, sleep on
2104 	 * overflow awaiting device aid in acquiring new space.
2105 	 */
2106 	while (uio->uio_resid > 0 || cc > 0) {
2107 		if (ISSET(tp->t_lflag, FLUSHO)) {
2108 			uio->uio_resid = 0;
2109 			return (0);
2110 		}
2111 		if (tp->t_outq.c_cc > hiwat)
2112 			goto ovhiwat;
2113 		/*
2114 		 * Grab a hunk of data from the user, unless we have some
2115 		 * leftover from last time.
2116 		 */
2117 		if (cc == 0) {
2118 			cc = imin(uio->uio_resid, OBUFSIZ);
2119 			cp = obuf;
2120 			error = uiomove(cp, cc, uio);
2121 			if (error) {
2122 				cc = 0;
2123 				break;
2124 			}
2125 		}
2126 		/*
2127 		 * If nothing fancy need be done, grab those characters we
2128 		 * can handle without any of ttyoutput's processing and
2129 		 * just transfer them to the output q.  For those chars
2130 		 * which require special processing (as indicated by the
2131 		 * bits in char_type), call ttyoutput.  After processing
2132 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2133 		 * immediately.
2134 		 */
2135 		while (cc > 0) {
2136 			if (!ISSET(tp->t_oflag, OPOST))
2137 				ce = cc;
2138 			else {
2139 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2140 						char_type, CCLASSMASK);
2141 				/*
2142 				 * If ce is zero, then we're processing
2143 				 * a special character through ttyoutput.
2144 				 */
2145 				if (ce == 0) {
2146 					tp->t_rocount = 0;
2147 					if (ttyoutput(*cp, tp) >= 0) {
2148 						/* No Clists, wait a bit. */
2149 						ttstart(tp);
2150 						if (flag & IO_NDELAY) {
2151 							error = EWOULDBLOCK;
2152 							goto out;
2153 						}
2154 						error = ttysleep(tp, &lbolt,
2155 								 TTOPRI|PCATCH,
2156 								 "ttybf1", 0);
2157 						if (error)
2158 							goto out;
2159 						goto loop;
2160 					}
2161 					cp++;
2162 					cc--;
2163 					if (ISSET(tp->t_lflag, FLUSHO) ||
2164 					    tp->t_outq.c_cc > hiwat)
2165 						goto ovhiwat;
2166 					continue;
2167 				}
2168 			}
2169 			/*
2170 			 * A bunch of normal characters have been found.
2171 			 * Transfer them en masse to the output queue and
2172 			 * continue processing at the top of the loop.
2173 			 * If there are any further characters in this
2174 			 * <= OBUFSIZ chunk, the first should be a character
2175 			 * requiring special handling by ttyoutput.
2176 			 */
2177 			tp->t_rocount = 0;
2178 			i = b_to_q(cp, ce, &tp->t_outq);
2179 			ce -= i;
2180 			tp->t_column += ce;
2181 			cp += ce, cc -= ce, tk_nout += ce;
2182 			tp->t_outcc += ce;
2183 			if (i > 0) {
2184 				/* No Clists, wait a bit. */
2185 				ttstart(tp);
2186 				if (flag & IO_NDELAY) {
2187 					error = EWOULDBLOCK;
2188 					goto out;
2189 				}
2190 				error = ttysleep(tp, &lbolt, TTOPRI | PCATCH,
2191 						 "ttybf2", 0);
2192 				if (error)
2193 					goto out;
2194 				goto loop;
2195 			}
2196 			if (ISSET(tp->t_lflag, FLUSHO) ||
2197 			    tp->t_outq.c_cc > hiwat)
2198 				break;
2199 		}
2200 		ttstart(tp);
2201 	}
2202 out:
2203 	/*
2204 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2205 	 * offset and iov pointers have moved forward, but it doesn't matter
2206 	 * (the call will either return short or restart with a new uio).
2207 	 */
2208 	uio->uio_resid += cc;
2209 	return (error);
2210 
2211 ovhiwat:
2212 	ttstart(tp);
2213 	s = spltty();
2214 	/*
2215 	 * This can only occur if FLUSHO is set in t_lflag,
2216 	 * or if ttstart/oproc is synchronous (or very fast).
2217 	 */
2218 	if (tp->t_outq.c_cc <= hiwat) {
2219 		splx(s);
2220 		goto loop;
2221 	}
2222 	if (flag & IO_NDELAY) {
2223 		splx(s);
2224 		uio->uio_resid += cc;
2225 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2226 	}
2227 	SET(tp->t_state, TS_SO_OLOWAT);
2228 	error = ttysleep(tp, TSA_OLOWAT(tp), TTOPRI | PCATCH, "ttywri",
2229 			 tp->t_timeout);
2230 	splx(s);
2231 	if (error == EWOULDBLOCK)
2232 		error = EIO;
2233 	if (error)
2234 		goto out;
2235 	goto loop;
2236 }
2237 
2238 /*
2239  * Rubout one character from the rawq of tp
2240  * as cleanly as possible.
2241  */
2242 static void
2243 ttyrub(int c, struct tty *tp)
2244 {
2245 	char *cp;
2246 	int savecol;
2247 	int tabc, s;
2248 
2249 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2250 		return;
2251 	CLR(tp->t_lflag, FLUSHO);
2252 	if (ISSET(tp->t_lflag, ECHOE)) {
2253 		if (tp->t_rocount == 0) {
2254 			/*
2255 			 * Screwed by ttwrite; retype
2256 			 */
2257 			ttyretype(tp);
2258 			return;
2259 		}
2260 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2261 			ttyrubo(tp, 2);
2262 		else {
2263 			CLR(c, ~TTY_CHARMASK);
2264 			switch (CCLASS(c)) {
2265 			case ORDINARY:
2266 				ttyrubo(tp, 1);
2267 				break;
2268 			case BACKSPACE:
2269 			case CONTROL:
2270 			case NEWLINE:
2271 			case RETURN:
2272 			case VTAB:
2273 				if (ISSET(tp->t_lflag, ECHOCTL))
2274 					ttyrubo(tp, 2);
2275 				break;
2276 			case TAB:
2277 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2278 					ttyretype(tp);
2279 					return;
2280 				}
2281 				s = spltty();
2282 				savecol = tp->t_column;
2283 				SET(tp->t_state, TS_CNTTB);
2284 				SET(tp->t_lflag, FLUSHO);
2285 				tp->t_column = tp->t_rocol;
2286 				cp = tp->t_rawq.c_cf;
2287 				if (cp)
2288 					tabc = *cp;	/* XXX FIX NEXTC */
2289 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2290 					ttyecho(tabc, tp);
2291 				CLR(tp->t_lflag, FLUSHO);
2292 				CLR(tp->t_state, TS_CNTTB);
2293 				splx(s);
2294 
2295 				/* savecol will now be length of the tab. */
2296 				savecol -= tp->t_column;
2297 				tp->t_column += savecol;
2298 				if (savecol > 8)
2299 					savecol = 8;	/* overflow screw */
2300 				while (--savecol >= 0)
2301 					(void)ttyoutput('\b', tp);
2302 				break;
2303 			default:			/* XXX */
2304 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2305 				(void)printf(PANICSTR, c, CCLASS(c));
2306 #ifdef notdef
2307 				panic(PANICSTR, c, CCLASS(c));
2308 #endif
2309 			}
2310 		}
2311 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2312 		if (!ISSET(tp->t_state, TS_ERASE)) {
2313 			SET(tp->t_state, TS_ERASE);
2314 			(void)ttyoutput('\\', tp);
2315 		}
2316 		ttyecho(c, tp);
2317 	} else {
2318 		ttyecho(tp->t_cc[VERASE], tp);
2319 		/*
2320 		 * This code may be executed not only when an ERASE key
2321 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2322 		 * So, I didn't think it was worthwhile to pass the extra
2323 		 * information (which would need an extra parameter,
2324 		 * changing every call) needed to distinguish the ERASE2
2325 		 * case from the ERASE.
2326 		 */
2327 	}
2328 	--tp->t_rocount;
2329 }
2330 
2331 /*
2332  * Back over cnt characters, erasing them.
2333  */
2334 static void
2335 ttyrubo(struct tty *tp, int cnt)
2336 {
2337 
2338 	while (cnt-- > 0) {
2339 		(void)ttyoutput('\b', tp);
2340 		(void)ttyoutput(' ', tp);
2341 		(void)ttyoutput('\b', tp);
2342 	}
2343 }
2344 
2345 /*
2346  * ttyretype --
2347  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2348  *	been checked.
2349  */
2350 static void
2351 ttyretype(struct tty *tp)
2352 {
2353 	char *cp;
2354 	int s, c;
2355 
2356 	/* Echo the reprint character. */
2357 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2358 		ttyecho(tp->t_cc[VREPRINT], tp);
2359 
2360 	(void)ttyoutput('\n', tp);
2361 
2362 	/*
2363 	 * XXX
2364 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2365 	 * BIT OF FIRST CHAR.
2366 	 */
2367 	s = spltty();
2368 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2369 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2370 		ttyecho(c, tp);
2371 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2372 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2373 		ttyecho(c, tp);
2374 	CLR(tp->t_state, TS_ERASE);
2375 	splx(s);
2376 
2377 	tp->t_rocount = tp->t_rawq.c_cc;
2378 	tp->t_rocol = 0;
2379 }
2380 
2381 /*
2382  * Echo a typed character to the terminal.
2383  */
2384 static void
2385 ttyecho(int c, struct tty *tp)
2386 {
2387 
2388 	if (!ISSET(tp->t_state, TS_CNTTB))
2389 		CLR(tp->t_lflag, FLUSHO);
2390 	if ((!ISSET(tp->t_lflag, ECHO) &&
2391 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2392 	    ISSET(tp->t_lflag, EXTPROC))
2393 		return;
2394 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2395 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2396 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2397 		(void)ttyoutput('^', tp);
2398 		CLR(c, ~TTY_CHARMASK);
2399 		if (c == 0177)
2400 			c = '?';
2401 		else
2402 			c += 'A' - 1;
2403 	}
2404 	(void)ttyoutput(c, tp);
2405 }
2406 
2407 /*
2408  * Wake up any readers on a tty.
2409  */
2410 void
2411 ttwakeup(struct tty *tp)
2412 {
2413 
2414 	if (SEL_WAITING(&tp->t_rsel))
2415 		selwakeuppri(&tp->t_rsel, TTIPRI);
2416 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2417 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2418 	wakeup(TSA_HUP_OR_INPUT(tp));
2419 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
2420 }
2421 
2422 /*
2423  * Wake up any writers on a tty.
2424  */
2425 void
2426 ttwwakeup(struct tty *tp)
2427 {
2428 
2429 	if (SEL_WAITING(&tp->t_wsel) && tp->t_outq.c_cc <= tp->t_olowat)
2430 		selwakeuppri(&tp->t_wsel, TTOPRI);
2431 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2432 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2433 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2434 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2435 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2436 		wakeup(TSA_OCOMPLETE(tp));
2437 	}
2438 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2439 	    tp->t_outq.c_cc <= tp->t_olowat) {
2440 		CLR(tp->t_state, TS_SO_OLOWAT);
2441 		wakeup(TSA_OLOWAT(tp));
2442 	}
2443 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
2444 }
2445 
2446 /*
2447  * Look up a code for a specified speed in a conversion table;
2448  * used by drivers to map software speed values to hardware parameters.
2449  */
2450 int
2451 ttspeedtab(int speed, struct speedtab *table)
2452 {
2453 
2454 	for ( ; table->sp_speed != -1; table++)
2455 		if (table->sp_speed == speed)
2456 			return (table->sp_code);
2457 	return (-1);
2458 }
2459 
2460 /*
2461  * Set input and output watermarks and buffer sizes.  For input, the
2462  * high watermark is about one second's worth of input above empty, the
2463  * low watermark is slightly below high water, and the buffer size is a
2464  * driver-dependent amount above high water.  For output, the watermarks
2465  * are near the ends of the buffer, with about 1 second's worth of input
2466  * between them.  All this only applies to the standard line discipline.
2467  */
2468 void
2469 ttsetwater(struct tty *tp)
2470 {
2471 	int cps, ttmaxhiwat, x;
2472 
2473 	/* Input. */
2474 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2475 	switch (tp->t_ispeedwat) {
2476 	case (speed_t)-1:
2477 		cps = tp->t_ispeed / 10;
2478 		break;
2479 	case 0:
2480 		/*
2481 		 * This case is for old drivers that don't know about
2482 		 * t_ispeedwat.  Arrange for them to get the old buffer
2483 		 * sizes and watermarks.
2484 		 */
2485 		cps = TTYHOG - 2 * 256;
2486 		tp->t_ififosize = 2 * 256;
2487 		break;
2488 	default:
2489 		cps = tp->t_ispeedwat / 10;
2490 		break;
2491 	}
2492 	tp->t_ihiwat = cps;
2493 	tp->t_ilowat = 7 * cps / 8;
2494 	x = cps + tp->t_ififosize;
2495 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2496 
2497 	/* Output. */
2498 	switch (tp->t_ospeedwat) {
2499 	case (speed_t)-1:
2500 		cps = tp->t_ospeed / 10;
2501 		ttmaxhiwat = 2 * TTMAXHIWAT;
2502 		break;
2503 	case 0:
2504 		cps = tp->t_ospeed / 10;
2505 		ttmaxhiwat = TTMAXHIWAT;
2506 		break;
2507 	default:
2508 		cps = tp->t_ospeedwat / 10;
2509 		ttmaxhiwat = 8 * TTMAXHIWAT;
2510 		break;
2511 	}
2512 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2513 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2514 	x += cps;
2515 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2516 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2517 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2518 	x += OBUFSIZ + 100;
2519 	clist_alloc_cblocks(&tp->t_outq, x, x);
2520 #undef	CLAMP
2521 }
2522 
2523 /*
2524  * Report on state of foreground process group.
2525  */
2526 void
2527 ttyinfo(struct tty *tp)
2528 {
2529 	struct timeval utime, stime;
2530 	struct proc *p, *pick;
2531 	struct thread *td;
2532 	const char *stateprefix, *state;
2533 	long rss;
2534 	int load, pctcpu;
2535 
2536 	if (ttycheckoutq(tp,0) == 0)
2537 		return;
2538 
2539 	/* Print load average. */
2540 	load = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2541 	ttyprintf(tp, "load: %d.%02d ", load / 100, load % 100);
2542 
2543 	/*
2544 	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
2545 	 * that pending input will be retyped on BS.
2546 	 */
2547 	if (tp->t_session == NULL) {
2548 		ttyprintf(tp, "not a controlling terminal\n");
2549 		tp->t_rocount = 0;
2550 		return;
2551 	}
2552 	if (tp->t_pgrp == NULL) {
2553 		ttyprintf(tp, "no foreground process group\n");
2554 		tp->t_rocount = 0;
2555 		return;
2556 	}
2557 	sx_slock(&proctree_lock);
2558 	if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL) {
2559 		sx_sunlock(&proctree_lock);
2560 		ttyprintf(tp, "empty foreground process group\n");
2561 		tp->t_rocount = 0;
2562 		return;
2563 	}
2564 
2565 	/*
2566 	 * Pick the most interesting process and copy some of its
2567 	 * state for printing later.  sched_lock must be held for
2568 	 * most parts of this.  Holding it throughout is simplest
2569 	 * and prevents even unimportant inconsistencies in the
2570 	 * copy of the state, but may increase interrupt latency
2571 	 * too much.
2572 	 */
2573 	mtx_lock_spin(&sched_lock);
2574 	for (pick = NULL; p != NULL; p = LIST_NEXT(p, p_pglist))
2575 		if (proc_compare(pick, p))
2576 			pick = p;
2577 
2578 	td = FIRST_THREAD_IN_PROC(pick);	/* XXXKSE */
2579 #if 0
2580 	KASSERT(td != NULL, ("ttyinfo: no thread"));
2581 #else
2582 	if (td == NULL) {
2583 		mtx_unlock_spin(&sched_lock);
2584 		sx_sunlock(&proctree_lock);
2585 		ttyprintf(tp, "foreground process without thread\n");
2586 		tp->t_rocount = 0;
2587 		return;
2588 	}
2589 #endif
2590 	stateprefix = "";
2591 	if (TD_IS_RUNNING(td))
2592 		state = "running";
2593 	else if (TD_ON_RUNQ(td) || TD_CAN_RUN(td))
2594 		state = "runnable";
2595 	else if (TD_IS_SLEEPING(td)) {
2596 		/* XXX: If we're sleeping, are we ever not in a queue? */
2597 		if (TD_ON_SLEEPQ(td))
2598 			state = td->td_wmesg;
2599 		else
2600 			state = "sleeping without queue";
2601 	} else if (TD_ON_LOCK(td)) {
2602 		state = td->td_lockname;
2603 		stateprefix = "*";
2604 	} else if (TD_IS_SUSPENDED(td))
2605 		state = "suspended";
2606 	else if (TD_AWAITING_INTR(td))
2607 		state = "intrwait";
2608 	else
2609 		state = "unknown";
2610 	pctcpu = (sched_pctcpu(td) * 10000 + FSCALE / 2) >> FSHIFT;
2611 	if (pick->p_state == PRS_NEW || pick->p_state == PRS_ZOMBIE)
2612 		rss = 0;
2613 	else
2614 		rss = pgtok(vmspace_resident_count(pick->p_vmspace));
2615 	mtx_unlock_spin(&sched_lock);
2616 	PROC_LOCK(pick);
2617 	calcru(pick, &utime, &stime);
2618 	PROC_UNLOCK(pick);
2619 
2620 	/* Print command, pid, state, utime, stime, %cpu, and rss. */
2621 	ttyprintf(tp,
2622 	    " cmd: %s %d [%s%s] %ld.%02ldu %ld.%02lds %d%% %ldk\n",
2623 	    pick->p_comm, pick->p_pid, stateprefix, state,
2624 	    (long)utime.tv_sec, utime.tv_usec / 10000,
2625 	    (long)stime.tv_sec, stime.tv_usec / 10000,
2626 	    pctcpu / 100, rss);
2627 	tp->t_rocount = 0;
2628 	sx_sunlock(&proctree_lock);
2629 }
2630 
2631 /*
2632  * Returns 1 if p2 is "better" than p1
2633  *
2634  * The algorithm for picking the "interesting" process is thus:
2635  *
2636  *	1) Only foreground processes are eligible - implied.
2637  *	2) Runnable processes are favored over anything else.  The runner
2638  *	   with the highest cpu utilization is picked (p_estcpu).  Ties are
2639  *	   broken by picking the highest pid.
2640  *	3) The sleeper with the shortest sleep time is next.  With ties,
2641  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2642  *	4) Further ties are broken by picking the highest pid.
2643  */
2644 #define ISRUN(p, val)						\
2645 do {								\
2646 	struct thread *td;					\
2647 	val = 0;						\
2648 	FOREACH_THREAD_IN_PROC(p, td) {				\
2649 		if (TD_ON_RUNQ(td) ||				\
2650 		    TD_IS_RUNNING(td)) {			\
2651 			val = 1;				\
2652 			break;					\
2653 		}						\
2654 	}							\
2655 } while (0)
2656 
2657 #define TESTAB(a, b)    ((a)<<1 | (b))
2658 #define ONLYA   2
2659 #define ONLYB   1
2660 #define BOTH    3
2661 
2662 static int
2663 proc_compare(struct proc *p1, struct proc *p2)
2664 {
2665 
2666 	int esta, estb;
2667 	struct ksegrp *kg;
2668 	mtx_assert(&sched_lock, MA_OWNED);
2669 	if (p1 == NULL)
2670 		return (1);
2671 
2672 	ISRUN(p1, esta);
2673 	ISRUN(p2, estb);
2674 
2675 	/*
2676 	 * see if at least one of them is runnable
2677 	 */
2678 	switch (TESTAB(esta, estb)) {
2679 	case ONLYA:
2680 		return (0);
2681 	case ONLYB:
2682 		return (1);
2683 	case BOTH:
2684 		/*
2685 		 * tie - favor one with highest recent cpu utilization
2686 		 */
2687 		esta = estb = 0;
2688 		FOREACH_KSEGRP_IN_PROC(p1,kg) {
2689 			esta += kg->kg_estcpu;
2690 		}
2691 		FOREACH_KSEGRP_IN_PROC(p2,kg) {
2692 			estb += kg->kg_estcpu;
2693 		}
2694 		if (estb > esta)
2695 			return (1);
2696 		if (esta > estb)
2697 			return (0);
2698 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2699 	}
2700 	/*
2701 	 * weed out zombies
2702 	 */
2703 	switch (TESTAB(p1->p_state == PRS_ZOMBIE, p2->p_state == PRS_ZOMBIE)) {
2704 	case ONLYA:
2705 		return (1);
2706 	case ONLYB:
2707 		return (0);
2708 	case BOTH:
2709 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2710 	}
2711 
2712 #if 0 /* XXXKSE */
2713 	/*
2714 	 * pick the one with the smallest sleep time
2715 	 */
2716 	if (p2->p_slptime > p1->p_slptime)
2717 		return (0);
2718 	if (p1->p_slptime > p2->p_slptime)
2719 		return (1);
2720 	/*
2721 	 * favor one sleeping in a non-interruptible sleep
2722 	 */
2723 	if (p1->p_sflag & PS_SINTR && (p2->p_sflag & PS_SINTR) == 0)
2724 		return (1);
2725 	if (p2->p_sflag & PS_SINTR && (p1->p_sflag & PS_SINTR) == 0)
2726 		return (0);
2727 #endif
2728 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2729 }
2730 
2731 /*
2732  * Output char to tty; console putchar style.
2733  */
2734 int
2735 tputchar(int c, struct tty *tp)
2736 {
2737 	int s;
2738 
2739 	s = spltty();
2740 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2741 		splx(s);
2742 		return (-1);
2743 	}
2744 	if (c == '\n')
2745 		(void)ttyoutput('\r', tp);
2746 	(void)ttyoutput(c, tp);
2747 	ttstart(tp);
2748 	splx(s);
2749 	return (0);
2750 }
2751 
2752 /*
2753  * Sleep on chan, returning ERESTART if tty changed while we napped and
2754  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2755  * the tty is revoked, restarting a pending call will redo validation done
2756  * at the start of the call.
2757  */
2758 int
2759 ttysleep(struct tty *tp, void *chan, int pri, char *wmesg, int timo)
2760 {
2761 	int error;
2762 	int gen;
2763 
2764 	gen = tp->t_gen;
2765 	error = tsleep(chan, pri, wmesg, timo);
2766 	if (tp->t_state & TS_GONE)
2767 		return (ENXIO);
2768 	if (error)
2769 		return (error);
2770 	return (tp->t_gen == gen ? 0 : ERESTART);
2771 }
2772 
2773 /*
2774  * Gain a reference to a TTY
2775  */
2776 int
2777 ttyref(struct tty *tp)
2778 {
2779 	int i;
2780 
2781 	mtx_lock(&tp->t_mtx);
2782 	KASSERT(tp->t_refcnt > 0,
2783 	    ("ttyref(): tty refcnt is %d (%s)",
2784 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2785 	i = ++tp->t_refcnt;
2786 	mtx_unlock(&tp->t_mtx);
2787 	return (i);
2788 }
2789 
2790 /*
2791  * Drop a reference to a TTY.
2792  * When reference count drops to zero, we free it.
2793  */
2794 int
2795 ttyrel(struct tty *tp)
2796 {
2797 	int i;
2798 
2799 	mtx_lock(&tty_list_mutex);
2800 	mtx_lock(&tp->t_mtx);
2801 	KASSERT(tp->t_refcnt > 0,
2802 	    ("ttyrel(): tty refcnt is %d (%s)",
2803 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2804 	i = --tp->t_refcnt;
2805 	if (i != 0) {
2806 		mtx_unlock(&tp->t_mtx);
2807 		mtx_unlock(&tty_list_mutex);
2808 		return (i);
2809 	}
2810 	TAILQ_REMOVE(&tty_list, tp, t_list);
2811 	mtx_unlock(&tp->t_mtx);
2812 	mtx_unlock(&tty_list_mutex);
2813 	knlist_destroy(&tp->t_rsel.si_note);
2814 	knlist_destroy(&tp->t_wsel.si_note);
2815 	mtx_destroy(&tp->t_mtx);
2816 	free(tp, M_TTYS);
2817 	return (i);
2818 }
2819 
2820 /*
2821  * Allocate a tty struct.  Clists in the struct will be allocated by
2822  * tty_open().
2823  */
2824 struct tty *
2825 ttymalloc(struct tty *tp)
2826 {
2827 	static int once;
2828 
2829 	if (!once) {
2830 		mtx_init(&tty_list_mutex, "ttylist", NULL, MTX_DEF);
2831 		once++;
2832 	}
2833 
2834 	if (tp) {
2835 		/*
2836 		 * XXX: Either this argument should go away, or we should
2837 		 * XXX: require it and do a ttyrel(tp) here and allocate
2838 		 * XXX: a new tty.  For now do nothing.
2839 		 */
2840 		return(tp);
2841 	}
2842 	tp = malloc(sizeof *tp, M_TTYS, M_WAITOK | M_ZERO);
2843 	mtx_init(&tp->t_mtx, "tty", NULL, MTX_DEF);
2844 
2845 	/*
2846 	 * Set up the initial state
2847 	 */
2848 	tp->t_refcnt = 1;
2849 	tp->t_timeout = -1;
2850 	tp->t_dtr_wait = 3 * hz;
2851 
2852 	ttyinitmode(tp, 0, 0);
2853 	bcopy(ttydefchars, tp->t_init_in.c_cc, sizeof tp->t_init_in.c_cc);
2854 
2855 	/* Make callout the same as callin */
2856 	tp->t_init_out = tp->t_init_in;
2857 
2858 	mtx_lock(&tty_list_mutex);
2859 	TAILQ_INSERT_TAIL(&tty_list, tp, t_list);
2860 	mtx_unlock(&tty_list_mutex);
2861 	knlist_init(&tp->t_rsel.si_note, &tp->t_mtx);
2862 	knlist_init(&tp->t_wsel.si_note, &tp->t_mtx);
2863 	return (tp);
2864 }
2865 
2866 struct tty *
2867 ttyalloc()
2868 {
2869 
2870 	return (ttymalloc(NULL));
2871 }
2872 
2873 static void
2874 ttypurge(struct cdev *dev)
2875 {
2876 
2877 	if (dev->si_tty == NULL)
2878 		return;
2879 	ttygone(dev->si_tty);
2880 }
2881 
2882 /*
2883  * ttycreate()
2884  *
2885  * Create the device entries for this tty thereby opening it for business.
2886  *
2887  * The flags argument controls if "cua" units are created.
2888  *
2889  * The t_sc filed is copied to si_drv1 in the created cdevs.  This
2890  * is particularly important for ->t_cioctl() users.
2891  *
2892  * XXX: implement the init and lock devices by cloning.
2893  */
2894 
2895 int
2896 ttycreate(struct tty *tp, struct cdevsw *csw, int unit, int flags, const char *fmt, ...)
2897 {
2898 	char namebuf[SPECNAMELEN - 3];		/* XXX space for "tty" */
2899 	va_list ap;
2900 	struct cdev *cp;
2901 	int i, minor, sminor, sunit;
2902 
2903 	mtx_assert(&Giant, MA_OWNED);
2904 
2905 	if (tty_unit == NULL)
2906 		tty_unit = new_unrhdr(0, 0xffff);
2907 
2908 	sunit = alloc_unr(tty_unit);
2909 	tp->t_devunit = sunit;
2910 
2911 	if (csw == NULL) {
2912 		csw = &tty_cdevsw;
2913 		unit = sunit;
2914 	}
2915 	KASSERT(csw->d_purge == NULL || csw->d_purge == ttypurge,
2916 	    ("tty should not have d_purge"));
2917 
2918 	csw->d_purge = ttypurge;
2919 
2920 	minor = unit2minor(unit);
2921 	sminor = unit2minor(sunit);
2922 	va_start(ap, fmt);
2923 	i = vsnrprintf(namebuf, sizeof namebuf, 32, fmt, ap);
2924 	va_end(ap);
2925 	KASSERT(i < sizeof namebuf, ("Too long tty name (%s)", namebuf));
2926 
2927 	cp = make_dev(csw, minor,
2928 	    UID_ROOT, GID_WHEEL, 0600, "tty%s", namebuf);
2929 	tp->t_dev = cp;
2930 	tp->t_mdev = cp;
2931 	cp->si_tty = tp;
2932 	cp->si_drv1 = tp->t_sc;
2933 
2934 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_INIT,
2935 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.init", namebuf);
2936 	dev_depends(tp->t_dev, cp);
2937 	cp->si_drv1 = tp->t_sc;
2938 	cp->si_drv2 = &tp->t_init_in;
2939 	cp->si_tty = tp;
2940 
2941 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_LOCK,
2942 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.lock", namebuf);
2943 	dev_depends(tp->t_dev, cp);
2944 	cp->si_drv1 = tp->t_sc;
2945 	cp->si_drv2 = &tp->t_lock_in;
2946 	cp->si_tty = tp;
2947 
2948 	if (flags & MINOR_CALLOUT) {
2949 		cp = make_dev(csw, minor | MINOR_CALLOUT,
2950 		    UID_UUCP, GID_DIALER, 0660, "cua%s", namebuf);
2951 		dev_depends(tp->t_dev, cp);
2952 		cp->si_drv1 = tp->t_sc;
2953 		cp->si_tty = tp;
2954 
2955 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_INIT,
2956 		    UID_UUCP, GID_DIALER, 0660, "cua%s.init", namebuf);
2957 		dev_depends(tp->t_dev, cp);
2958 		cp->si_drv1 = tp->t_sc;
2959 		cp->si_drv2 = &tp->t_init_out;
2960 		cp->si_tty = tp;
2961 
2962 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_LOCK,
2963 		    UID_UUCP, GID_DIALER, 0660, "cua%s.lock", namebuf);
2964 		dev_depends(tp->t_dev, cp);
2965 		cp->si_drv1 = tp->t_sc;
2966 		cp->si_drv2 = &tp->t_lock_out;
2967 		cp->si_tty = tp;
2968 	}
2969 
2970 	return (0);
2971 }
2972 
2973 /*
2974  * This function is called when the hardware disappears.  We set a flag
2975  * and wake up stuff so all sleeping threads will notice.
2976  */
2977 void
2978 ttygone(struct tty *tp)
2979 {
2980 
2981 	tp->t_state |= TS_GONE;
2982 	wakeup(&tp->t_dtr_wait);
2983 	wakeup(TSA_CARR_ON(tp));
2984 	wakeup(TSA_HUP_OR_INPUT(tp));
2985 	wakeup(TSA_OCOMPLETE(tp));
2986 	wakeup(TSA_OLOWAT(tp));
2987 	if (tp->t_purge != NULL)
2988 		tp->t_purge(tp);
2989 }
2990 
2991 /*
2992  * ttyfree()
2993  *
2994  * Called when the driver is ready to free the tty structure.
2995  *
2996  * XXX: This shall sleep until all threads have left the driver.
2997  */
2998 
2999 void
3000 ttyfree(struct tty *tp)
3001 {
3002 	u_int unit;
3003 
3004 	mtx_assert(&Giant, MA_OWNED);
3005 	ttygone(tp);
3006 	unit = tp->t_devunit;
3007 	destroy_dev(tp->t_mdev);
3008 	free_unr(tty_unit, unit);
3009 }
3010 
3011 static int
3012 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
3013 {
3014 	struct tty *tp, *tp2;
3015 	struct xtty xt;
3016 	int error;
3017 
3018 	error = 0;
3019 	mtx_lock(&tty_list_mutex);
3020 	tp = TAILQ_FIRST(&tty_list);
3021 	if (tp != NULL)
3022 		ttyref(tp);
3023 	mtx_unlock(&tty_list_mutex);
3024 	while (tp != NULL) {
3025 		bzero(&xt, sizeof xt);
3026 		xt.xt_size = sizeof xt;
3027 #define XT_COPY(field) xt.xt_##field = tp->t_##field
3028 		xt.xt_rawcc = tp->t_rawq.c_cc;
3029 		xt.xt_cancc = tp->t_canq.c_cc;
3030 		xt.xt_outcc = tp->t_outq.c_cc;
3031 		XT_COPY(line);
3032 		if (tp->t_dev != NULL)
3033 			xt.xt_dev = dev2udev(tp->t_dev);
3034 		XT_COPY(state);
3035 		XT_COPY(flags);
3036 		XT_COPY(timeout);
3037 		if (tp->t_pgrp != NULL)
3038 			xt.xt_pgid = tp->t_pgrp->pg_id;
3039 		if (tp->t_session != NULL)
3040 			xt.xt_sid = tp->t_session->s_sid;
3041 		XT_COPY(termios);
3042 		XT_COPY(winsize);
3043 		XT_COPY(column);
3044 		XT_COPY(rocount);
3045 		XT_COPY(rocol);
3046 		XT_COPY(ififosize);
3047 		XT_COPY(ihiwat);
3048 		XT_COPY(ilowat);
3049 		XT_COPY(ispeedwat);
3050 		XT_COPY(ohiwat);
3051 		XT_COPY(olowat);
3052 		XT_COPY(ospeedwat);
3053 #undef XT_COPY
3054 		error = SYSCTL_OUT(req, &xt, sizeof xt);
3055 		if (error != 0) {
3056 			ttyrel(tp);
3057 			return (error);
3058 		}
3059 		mtx_lock(&tty_list_mutex);
3060 		tp2 = TAILQ_NEXT(tp, t_list);
3061 		if (tp2 != NULL)
3062 			ttyref(tp2);
3063 		mtx_unlock(&tty_list_mutex);
3064 		ttyrel(tp);
3065 		tp = tp2;
3066 	}
3067 	return (0);
3068 }
3069 
3070 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
3071 	0, 0, sysctl_kern_ttys, "S,xtty", "All ttys");
3072 SYSCTL_LONG(_kern, OID_AUTO, tty_nin, CTLFLAG_RD,
3073 	&tk_nin, 0, "Total TTY in characters");
3074 SYSCTL_LONG(_kern, OID_AUTO, tty_nout, CTLFLAG_RD,
3075 	&tk_nout, 0, "Total TTY out characters");
3076 
3077 void
3078 nottystop(struct tty *tp, int rw)
3079 {
3080 
3081 	return;
3082 }
3083 
3084 int
3085 ttyopen(struct cdev *dev, int flag, int mode, struct thread *td)
3086 {
3087 	int		error;
3088 	int		s;
3089 	struct tty	*tp;
3090 
3091 	tp = dev->si_tty;
3092 	s = spltty();
3093 	/*
3094 	 * We jump to this label after all non-interrupted sleeps to pick
3095 	 * up any changes of the device state.
3096 	 */
3097 open_top:
3098 	if (tp->t_state & TS_GONE)
3099 		return (ENXIO);
3100 	error = ttydtrwaitsleep(tp);
3101 	if (error)
3102 		goto out;
3103 	if (tp->t_state & TS_ISOPEN) {
3104 		/*
3105 		 * The device is open, so everything has been initialized.
3106 		 * Handle conflicts.
3107 		 */
3108 		if (ISCALLOUT(dev) && !tp->t_actout)
3109 			return (EBUSY);
3110 		if (tp->t_actout && !ISCALLOUT(dev)) {
3111 			if (flag & O_NONBLOCK)
3112 				return (EBUSY);
3113 			error =	tsleep(&tp->t_actout,
3114 				       TTIPRI | PCATCH, "siobi", 0);
3115 			if (error != 0 || (tp->t_flags & TS_GONE))
3116 				goto out;
3117 			goto open_top;
3118 		}
3119 		if (tp->t_state & TS_XCLUDE && suser(td))
3120 			return (EBUSY);
3121 	} else {
3122 		/*
3123 		 * The device isn't open, so there are no conflicts.
3124 		 * Initialize it.  Initialization is done twice in many
3125 		 * cases: to preempt sleeping callin opens if we are
3126 		 * callout, and to complete a callin open after DCD rises.
3127 		 */
3128 		tp->t_termios = ISCALLOUT(dev) ? tp->t_init_out : tp->t_init_in;
3129 		tp->t_cflag = tp->t_termios.c_cflag;
3130 		tp->t_modem(tp, SER_DTR | SER_RTS, 0);
3131 		++tp->t_wopeners;
3132 		error = tp->t_param(tp, &tp->t_termios);
3133 		--tp->t_wopeners;
3134 		if (error == 0 && tp->t_open != NULL)
3135 			error = tp->t_open(tp, dev);
3136 		if (error != 0)
3137 			goto out;
3138 		if (ISCALLOUT(dev) || (tp->t_modem(tp, 0, 0) & SER_DCD))
3139 			ttyld_modem(tp, 1);
3140 	}
3141 	/*
3142 	 * Wait for DCD if necessary.
3143 	 */
3144 	if (!(tp->t_state & TS_CARR_ON) && !ISCALLOUT(dev)
3145 	    && !(tp->t_cflag & CLOCAL) && !(flag & O_NONBLOCK)) {
3146 		++tp->t_wopeners;
3147 		error = tsleep(TSA_CARR_ON(tp), TTIPRI | PCATCH, "ttydcd", 0);
3148 		--tp->t_wopeners;
3149 		if (error != 0 || (tp->t_state & TS_GONE))
3150 			goto out;
3151 		goto open_top;
3152 	}
3153 	error =	ttyld_open(tp, dev);
3154 	ttyldoptim(tp);
3155 	if (tp->t_state & TS_ISOPEN && ISCALLOUT(dev))
3156 		tp->t_actout = TRUE;
3157 out:
3158 	splx(s);
3159 	if (!(tp->t_state & TS_ISOPEN) && tp->t_wopeners == 0 &&
3160 	    tp->t_close != NULL)
3161 		tp->t_close(tp);
3162 	return (error);
3163 }
3164 
3165 int
3166 ttyclose(struct cdev *dev, int flag, int mode, struct thread *td)
3167 {
3168 	struct tty *tp;
3169 
3170 	tp = dev->si_tty;
3171 	ttyld_close(tp, flag);
3172 	ttyldoptim(tp);
3173 	if (tp->t_close != NULL)
3174 		tp->t_close(tp);
3175 	tty_close(tp);
3176 	tp->t_do_timestamp = 0;
3177 	if (tp->t_pps != NULL)
3178 		tp->t_pps->ppsparam.mode = 0;
3179 	return (0);
3180 }
3181 
3182 int
3183 ttyread(struct cdev *dev, struct uio *uio, int flag)
3184 {
3185 	struct tty *tp;
3186 
3187 	tp = tty_gettp(dev);
3188 
3189 	if (tp->t_state & TS_GONE)
3190 		return (ENODEV);
3191 	return (ttyld_read(tp, uio, flag));
3192 }
3193 
3194 int
3195 ttywrite(struct cdev *dev, struct uio *uio, int flag)
3196 {
3197 	struct tty *tp;
3198 
3199 	tp = tty_gettp(dev);
3200 
3201 	if (tp->t_state & TS_GONE)
3202 		return (ENODEV);
3203 	return (ttyld_write(tp, uio, flag));
3204 }
3205 
3206 int
3207 ttyioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3208 {
3209 	struct	tty *tp;
3210 	int	error;
3211 
3212 	tp = dev->si_tty;
3213 
3214 	if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) {
3215 		int cc;
3216 		struct termios *dt = (struct termios *)data;
3217 		struct termios *lt =
3218 		    ISCALLOUT(dev) ?  &tp->t_lock_out : &tp->t_lock_in;
3219 
3220 		dt->c_iflag = (tp->t_iflag & lt->c_iflag)
3221 		    | (dt->c_iflag & ~lt->c_iflag);
3222 		dt->c_oflag = (tp->t_oflag & lt->c_oflag)
3223 		    | (dt->c_oflag & ~lt->c_oflag);
3224 		dt->c_cflag = (tp->t_cflag & lt->c_cflag)
3225 		    | (dt->c_cflag & ~lt->c_cflag);
3226 		dt->c_lflag = (tp->t_lflag & lt->c_lflag)
3227 		    | (dt->c_lflag & ~lt->c_lflag);
3228 		for (cc = 0; cc < NCCS; ++cc)
3229 		    if (lt->c_cc[cc] != 0)
3230 		        dt->c_cc[cc] = tp->t_cc[cc];
3231 		if (lt->c_ispeed != 0)
3232 		    dt->c_ispeed = tp->t_ispeed;
3233 		if (lt->c_ospeed != 0)
3234 		    dt->c_ospeed = tp->t_ospeed;
3235 	}
3236 
3237 	error = ttyld_ioctl(tp, cmd, data, flag, td);
3238 	if (error == ENOIOCTL)
3239 		error = ttioctl(tp, cmd, data, flag);
3240 	ttyldoptim(tp);
3241 	if (error != ENOIOCTL)
3242 		return (error);
3243 	return (ENOTTY);
3244 }
3245 
3246 void
3247 ttyldoptim(struct tty *tp)
3248 {
3249 	struct termios	*t;
3250 
3251 	t = &tp->t_termios;
3252 	if (!(t->c_iflag & (ICRNL | IGNCR | IMAXBEL | INLCR | ISTRIP | IXON))
3253 	    && (!(t->c_iflag & BRKINT) || (t->c_iflag & IGNBRK))
3254 	    && (!(t->c_iflag & PARMRK)
3255 		|| (t->c_iflag & (IGNPAR | IGNBRK)) == (IGNPAR | IGNBRK))
3256 	    && !(t->c_lflag & (ECHO | ICANON | IEXTEN | ISIG | PENDIN))
3257 	    && linesw[tp->t_line]->l_rint == ttyinput)
3258 		tp->t_state |= TS_CAN_BYPASS_L_RINT;
3259 	else
3260 		tp->t_state &= ~TS_CAN_BYPASS_L_RINT;
3261 }
3262 
3263 static void
3264 ttydtrwaitwakeup(void *arg)
3265 {
3266 	struct tty *tp;
3267 
3268 	tp = arg;
3269 	tp->t_state &= ~TS_DTR_WAIT;
3270 	wakeup(&tp->t_dtr_wait);
3271 }
3272 
3273 
3274 void
3275 ttydtrwaitstart(struct tty *tp)
3276 {
3277 
3278 	if (tp->t_dtr_wait == 0)
3279 		return;
3280 	if (tp->t_state & TS_DTR_WAIT)
3281 		return;
3282 	timeout(ttydtrwaitwakeup, tp, tp->t_dtr_wait);
3283 	tp->t_state |= TS_DTR_WAIT;
3284 }
3285 
3286 int
3287 ttydtrwaitsleep(struct tty *tp)
3288 {
3289 	int error;
3290 
3291 	error = 0;
3292 	while (error == 0) {
3293 		if (tp->t_state & TS_GONE)
3294 			error = ENXIO;
3295 		else if (!(tp->t_state & TS_DTR_WAIT))
3296 			break;
3297 		else
3298 			error = tsleep(&tp->t_dtr_wait, TTIPRI | PCATCH,
3299 			    "dtrwait", 0);
3300 	}
3301 	return (error);
3302 }
3303 
3304 static int
3305 ttysopen(struct cdev *dev, int flag, int mode, struct thread *td)
3306 {
3307 	struct tty *tp;
3308 
3309 	tp = dev->si_tty;
3310 	KASSERT(tp != NULL,
3311 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3312 	if (tp->t_state & TS_GONE)
3313 		return (ENODEV);
3314 	return (0);
3315 }
3316 
3317 static int
3318 ttysclose(struct cdev *dev, int flag, int mode, struct thread *td)
3319 {
3320 
3321 	return (0);
3322 }
3323 
3324 static int
3325 ttysrdwr(struct cdev *dev, struct uio *uio, int flag)
3326 {
3327 
3328 	return (ENODEV);
3329 }
3330 
3331 static int
3332 ttysioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3333 {
3334 	struct tty	*tp;
3335 	int		error;
3336 	struct termios	*ct;
3337 
3338 	tp = dev->si_tty;
3339 	KASSERT(tp != NULL,
3340 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3341 	if (tp->t_state & TS_GONE)
3342 		return (ENODEV);
3343 	ct = dev->si_drv2;
3344 	switch (cmd) {
3345 	case TIOCSETA:
3346 		error = suser(td);
3347 		if (error != 0)
3348 			return (error);
3349 		*ct = *(struct termios *)data;
3350 		return (0);
3351 	case TIOCGETA:
3352 		*(struct termios *)data = *ct;
3353 		return (0);
3354 	case TIOCGETD:
3355 		*(int *)data = TTYDISC;
3356 		return (0);
3357 	case TIOCGWINSZ:
3358 		bzero(data, sizeof(struct winsize));
3359 		return (0);
3360 	default:
3361 		if (tp->t_cioctl != NULL)
3362 			return(tp->t_cioctl(dev, cmd, data, flag, td));
3363 		return (ENOTTY);
3364 	}
3365 }
3366 
3367 /*
3368  * Initialize a tty to sane modes.
3369  */
3370 void
3371 ttyinitmode(struct tty *tp, int echo, int speed)
3372 {
3373 
3374 	if (speed == 0)
3375 		speed = TTYDEF_SPEED;
3376 	tp->t_init_in.c_iflag = TTYDEF_IFLAG;
3377 	tp->t_init_in.c_oflag = TTYDEF_OFLAG;
3378 	tp->t_init_in.c_cflag = TTYDEF_CFLAG;
3379 	if (echo)
3380 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_ECHO;
3381 	else
3382 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_NOECHO;
3383 
3384 	tp->t_init_in.c_ispeed = tp->t_init_in.c_ospeed = speed;
3385 	termioschars(&tp->t_init_in);
3386 	tp->t_init_out = tp->t_init_in;
3387 	tp->t_termios = tp->t_init_in;
3388 }
3389 
3390 /*
3391  * Use more "normal" termios paramters for consoles.
3392  */
3393 void
3394 ttyconsolemode(struct tty *tp, int speed)
3395 {
3396 
3397 	if (speed == 0)
3398 		speed = TTYDEF_SPEED;
3399 	ttyinitmode(tp, 1, speed);
3400 	tp->t_init_in.c_cflag |= CLOCAL;
3401 	tp->t_lock_out.c_cflag = tp->t_lock_in.c_cflag = CLOCAL;
3402 	tp->t_lock_out.c_ispeed = tp->t_lock_out.c_ospeed =
3403 	tp->t_lock_in.c_ispeed = tp->t_lock_in.c_ospeed = speed;
3404 	tp->t_init_out = tp->t_init_in;
3405 	tp->t_termios = tp->t_init_in;
3406 }
3407 
3408 /*
3409  * Record the relationship between the serial ports notion of modem control
3410  * signals and the one used in certain ioctls in a way the compiler can enforce
3411  * XXX: We should define TIOCM_* in terms of SER_ if we can limit the
3412  * XXX: consequences of the #include work that would take.
3413  */
3414 CTASSERT(SER_DTR == TIOCM_DTR / 2);
3415 CTASSERT(SER_RTS == TIOCM_RTS / 2);
3416 CTASSERT(SER_STX == TIOCM_ST / 2);
3417 CTASSERT(SER_SRX == TIOCM_SR / 2);
3418 CTASSERT(SER_CTS == TIOCM_CTS / 2);
3419 CTASSERT(SER_DCD == TIOCM_DCD / 2);
3420 CTASSERT(SER_RI == TIOCM_RI / 2);
3421 CTASSERT(SER_DSR == TIOCM_DSR / 2);
3422 
3423