xref: /freebsd/sys/kern/tty.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Copyright (c) 2002 Networks Associates Technologies, Inc.
11  * All rights reserved.
12  *
13  * Portions of this software were developed for the FreeBSD Project by
14  * ThinkSec AS and NAI Labs, the Security Research Division of Network
15  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
16  * ("CBOSS"), as part of the DARPA CHATS research program.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 4. Neither the name of the University nor the names of its contributors
27  *    may be used to endorse or promote products derived from this software
28  *    without specific prior written permission.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40  * SUCH DAMAGE.
41  *
42  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
43  */
44 
45 /*-
46  * TODO:
47  *	o Fix races for sending the start char in ttyflush().
48  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
49  *	  With luck, there will be MIN chars before select() returns().
50  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
51  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
52  *	  FIONREAD.
53  *	o Do the new sio locking stuff here and use it to avoid special
54  *	  case for EXTPROC?
55  *	o Lock PENDIN too?
56  *	o Move EXTPROC and/or PENDIN to t_state?
57  *	o Wrap most of ttioctl in spltty/splx.
58  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
59  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
60  *	o Don't allow certain termios flags to affect disciplines other
61  *	  than TTYDISC.  Cancel their effects before switch disciplines
62  *	  and ignore them if they are set while we are in another
63  *	  discipline.
64  *	o Now that historical speed conversions are handled here, don't
65  *	  do them in drivers.
66  *	o Check for TS_CARR_ON being set while everything is closed and not
67  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
68  *	  so it would live until the next open even if carrier drops.
69  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
70  *	  only when _all_ openers leave open().
71  */
72 
73 #include <sys/cdefs.h>
74 __FBSDID("$FreeBSD$");
75 
76 #include "opt_compat.h"
77 #include "opt_tty.h"
78 
79 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/filio.h>
82 #include <sys/lock.h>
83 #include <sys/mutex.h>
84 #include <sys/namei.h>
85 #include <sys/sx.h>
86 #if defined(COMPAT_43TTY)
87 #include <sys/ioctl_compat.h>
88 #endif
89 #include <sys/priv.h>
90 #include <sys/proc.h>
91 #define	TTYDEFCHARS
92 #include <sys/tty.h>
93 #undef	TTYDEFCHARS
94 #include <sys/fcntl.h>
95 #include <sys/conf.h>
96 #include <sys/poll.h>
97 #include <sys/kernel.h>
98 #include <sys/vnode.h>
99 #include <sys/serial.h>
100 #include <sys/signalvar.h>
101 #include <sys/resourcevar.h>
102 #include <sys/malloc.h>
103 #include <sys/filedesc.h>
104 #include <sys/sched.h>
105 #include <sys/sysctl.h>
106 #include <sys/timepps.h>
107 
108 #include <machine/stdarg.h>
109 
110 #include <vm/vm.h>
111 #include <vm/pmap.h>
112 #include <vm/vm_map.h>
113 
114 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
115 
116 long tk_cancc;
117 long tk_nin;
118 long tk_nout;
119 long tk_rawcc;
120 
121 static	d_open_t	ttysopen;
122 static	d_close_t	ttysclose;
123 static	d_read_t	ttysrdwr;
124 static	d_ioctl_t	ttysioctl;
125 static	d_purge_t	ttypurge;
126 
127 /* Default cdevsw for common tty devices */
128 static struct cdevsw tty_cdevsw = {
129 	.d_version =	D_VERSION,
130 	.d_open =	ttyopen,
131 	.d_close =	ttyclose,
132 	.d_ioctl =	ttyioctl,
133 	.d_purge =	ttypurge,
134 	.d_name =	"ttydrv",
135 	.d_flags =	D_TTY | D_NEEDGIANT,
136 };
137 
138 /* Cdevsw for slave tty devices */
139 static struct cdevsw ttys_cdevsw = {
140 	.d_version =	D_VERSION,
141 	.d_open =	ttysopen,
142 	.d_close =	ttysclose,
143 	.d_read =	ttysrdwr,
144 	.d_write =	ttysrdwr,
145 	.d_ioctl =	ttysioctl,
146 	.d_name =	"TTYS",
147 	.d_flags =	D_TTY | D_NEEDGIANT,
148 };
149 
150 static int	proc_sum(struct proc *, int *);
151 static int	proc_compare(struct proc *, struct proc *);
152 static int	thread_compare(struct thread *, struct thread *);
153 static int	ttnread(struct tty *tp);
154 static void	ttyecho(int c, struct tty *tp);
155 static int	ttyoutput(int c, struct tty *tp);
156 static void	ttypend(struct tty *tp);
157 static void	ttyretype(struct tty *tp);
158 static void	ttyrub(int c, struct tty *tp);
159 static void	ttyrubo(struct tty *tp, int cnt);
160 static void	ttyunblock(struct tty *tp);
161 static int	ttywflush(struct tty *tp);
162 static int	filt_ttyread(struct knote *kn, long hint);
163 static void	filt_ttyrdetach(struct knote *kn);
164 static int	filt_ttywrite(struct knote *kn, long hint);
165 static void	filt_ttywdetach(struct knote *kn);
166 
167 /*
168  * Table with character classes and parity. The 8th bit indicates parity,
169  * the 7th bit indicates the character is an alphameric or underscore (for
170  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
171  * are 0 then the character needs no special processing on output; classes
172  * other than 0 might be translated or (not currently) require delays.
173  */
174 #define	E	0x00	/* Even parity. */
175 #define	O	0x80	/* Odd parity. */
176 #define	PARITY(c)	(char_type[c] & O)
177 
178 #define	ALPHA	0x40	/* Alpha or underscore. */
179 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
180 
181 #define	CCLASSMASK	0x3f
182 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
183 
184 #define	BS	BACKSPACE
185 #define	CC	CONTROL
186 #define	CR	RETURN
187 #define	NA	ORDINARY | ALPHA
188 #define	NL	NEWLINE
189 #define	NO	ORDINARY
190 #define	TB	TAB
191 #define	VT	VTAB
192 
193 static u_char const char_type[] = {
194 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
195 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
196 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
197 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
198 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
199 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
200 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
201 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
202 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
203 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
204 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
205 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
206 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
207 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
208 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
209 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
210 	/*
211 	 * Meta chars; should be settable per character set;
212 	 * for now, treat them all as normal characters.
213 	 */
214 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
215 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
216 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
217 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
218 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
219 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
220 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
221 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
222 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
223 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
224 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
225 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
226 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
227 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
228 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
229 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
230 };
231 #undef	BS
232 #undef	CC
233 #undef	CR
234 #undef	NA
235 #undef	NL
236 #undef	NO
237 #undef	TB
238 #undef	VT
239 
240 /* Macros to clear/set/test flags. */
241 #define	SET(t, f)	(t) |= (f)
242 #define	CLR(t, f)	(t) &= ~(f)
243 #define	ISSET(t, f)	((t) & (f))
244 
245 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
246 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
247 
248 /*
249  * list of struct tty where pstat(8) can pick it up with sysctl
250  *
251  * The lock order is to grab the list mutex before the tty mutex.
252  * Together with additions going on the tail of the list, this allows
253  * the sysctl to avoid doing retries.
254  */
255 static	TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
256 static struct mtx tty_list_mutex;
257 MTX_SYSINIT(tty_list, &tty_list_mutex, "ttylist", MTX_DEF);
258 
259 static struct unrhdr *tty_unit;
260 
261 static int  drainwait = 5*60;
262 SYSCTL_INT(_kern, OID_AUTO, drainwait, CTLFLAG_RW, &drainwait,
263 	0, "Output drain timeout in seconds");
264 
265 static struct tty *
266 tty_gettp(struct cdev *dev)
267 {
268 	struct tty *tp;
269 	struct cdevsw *csw;
270 
271 	csw = dev_refthread(dev);
272 	KASSERT(csw != NULL, ("No cdevsw in ttycode (%s)", devtoname(dev)));
273 	KASSERT(csw->d_flags & D_TTY,
274 	    ("non D_TTY (%s) in tty code", devtoname(dev)));
275 	dev_relthread(dev);
276 	tp = dev->si_tty;
277 	KASSERT(tp != NULL,
278 	    ("no tty pointer on (%s) in tty code", devtoname(dev)));
279 	return (tp);
280 }
281 
282 /*
283  * Initial open of tty, or (re)entry to standard tty line discipline.
284  */
285 int
286 tty_open(struct cdev *device, struct tty *tp)
287 {
288 	int s;
289 
290 	s = spltty();
291 	tp->t_dev = device;
292 	tp->t_hotchar = 0;
293 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
294 		ttyref(tp);
295 		SET(tp->t_state, TS_ISOPEN);
296 		if (ISSET(tp->t_cflag, CLOCAL))
297 			SET(tp->t_state, TS_CONNECTED);
298 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
299 	}
300 	/* XXX don't hang forever on output */
301 	if (tp->t_timeout < 0)
302 		tp->t_timeout = drainwait*hz;
303 	ttsetwater(tp);
304 	splx(s);
305 	return (0);
306 }
307 
308 /*
309  * Handle close() on a tty line: flush and set to initial state,
310  * bumping generation number so that pending read/write calls
311  * can detect recycling of the tty.
312  * XXX our caller should have done `spltty(); l_close(); tty_close();'
313  * and l_close() should have flushed, but we repeat the spltty() and
314  * the flush in case there are buggy callers.
315  */
316 int
317 tty_close(struct tty *tp)
318 {
319 	int ostate, s;
320 
321 	funsetown(&tp->t_sigio);
322 	s = spltty();
323 	if (constty == tp)
324 		constty_clear();
325 
326 	ttyflush(tp, FREAD | FWRITE);
327 	clist_free_cblocks(&tp->t_canq);
328 	clist_free_cblocks(&tp->t_outq);
329 	clist_free_cblocks(&tp->t_rawq);
330 
331 	tp->t_gen++;
332 	tp->t_line = TTYDISC;
333 	tp->t_hotchar = 0;
334 	tp->t_pgrp = NULL;
335 	tp->t_session = NULL;
336 	ostate = tp->t_state;
337 	tp->t_state = 0;
338 	knlist_clear(&tp->t_rsel.si_note, 0);
339 	knlist_clear(&tp->t_wsel.si_note, 0);
340 	/*
341 	 * Both final close and revocation close might end up calling
342 	 * this method.  Only the thread clearing TS_ISOPEN should
343 	 * release the reference to the tty.
344 	 */
345 	if (ISSET(ostate, TS_ISOPEN))
346 		ttyrel(tp);
347 	splx(s);
348 	return (0);
349 }
350 
351 #define	FLUSHQ(q) {							\
352 	if ((q)->c_cc)							\
353 		ndflush(q, (q)->c_cc);					\
354 }
355 
356 /* Is 'c' a line delimiter ("break" character)? */
357 #define	TTBREAKC(c, lflag)							\
358 	((c) == '\n' || (((c) == cc[VEOF] ||				\
359 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
360 	 (c) != _POSIX_VDISABLE))
361 
362 /*
363  * Process input of a single character received on a tty.
364  */
365 int
366 ttyinput(int c, struct tty *tp)
367 {
368 	tcflag_t iflag, lflag;
369 	cc_t *cc;
370 	int i, err;
371 
372 	/*
373 	 * If input is pending take it first.
374 	 */
375 	lflag = tp->t_lflag;
376 	if (ISSET(lflag, PENDIN))
377 		ttypend(tp);
378 	/*
379 	 * Gather stats.
380 	 */
381 	if (ISSET(lflag, ICANON)) {
382 		++tk_cancc;
383 		++tp->t_cancc;
384 	} else {
385 		++tk_rawcc;
386 		++tp->t_rawcc;
387 	}
388 	++tk_nin;
389 
390 	/*
391 	 * Block further input iff:
392 	 * current input > threshold AND input is available to user program
393 	 * AND input flow control is enabled and not yet invoked.
394 	 * The 3 is slop for PARMRK.
395 	 */
396 	iflag = tp->t_iflag;
397 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
398 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
399 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
400 	    !ISSET(tp->t_state, TS_TBLOCK))
401 		ttyblock(tp);
402 
403 	/* Handle exceptional conditions (break, parity, framing). */
404 	cc = tp->t_cc;
405 	err = (ISSET(c, TTY_ERRORMASK));
406 	if (err) {
407 		CLR(c, TTY_ERRORMASK);
408 		if (ISSET(err, TTY_BI)) {
409 			if (ISSET(iflag, IGNBRK))
410 				return (0);
411 			if (ISSET(iflag, BRKINT)) {
412 				ttyflush(tp, FREAD | FWRITE);
413 				if (tp->t_pgrp != NULL) {
414 					PGRP_LOCK(tp->t_pgrp);
415 					pgsignal(tp->t_pgrp, SIGINT, 1);
416 					PGRP_UNLOCK(tp->t_pgrp);
417 				}
418 				goto endcase;
419 			}
420 			if (ISSET(iflag, PARMRK))
421 				goto parmrk;
422 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
423 			|| ISSET(err, TTY_FE)) {
424 			if (ISSET(iflag, IGNPAR))
425 				return (0);
426 			else if (ISSET(iflag, PARMRK)) {
427 parmrk:
428 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
429 				    MAX_INPUT - 3)
430 					goto input_overflow;
431 				(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
432 				(void)putc(0 | TTY_QUOTE, &tp->t_rawq);
433 				(void)putc(c | TTY_QUOTE, &tp->t_rawq);
434 				goto endcase;
435 			} else
436 				c = 0;
437 		}
438 	}
439 
440 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
441 		CLR(c, 0x80);
442 	if (!ISSET(lflag, EXTPROC)) {
443 		/*
444 		 * Check for literal nexting very first
445 		 */
446 		if (ISSET(tp->t_state, TS_LNCH)) {
447 			SET(c, TTY_QUOTE);
448 			CLR(tp->t_state, TS_LNCH);
449 		}
450 		/*
451 		 * Scan for special characters.  This code
452 		 * is really just a big case statement with
453 		 * non-constant cases.  The bottom of the
454 		 * case statement is labeled ``endcase'', so goto
455 		 * it after a case match, or similar.
456 		 */
457 
458 		/*
459 		 * Control chars which aren't controlled
460 		 * by ICANON, ISIG, or IXON.
461 		 */
462 		if (ISSET(lflag, IEXTEN)) {
463 			if (CCEQ(cc[VLNEXT], c)) {
464 				if (ISSET(lflag, ECHO)) {
465 					if (ISSET(lflag, ECHOE)) {
466 						(void)ttyoutput('^', tp);
467 						(void)ttyoutput('\b', tp);
468 					} else
469 						ttyecho(c, tp);
470 				}
471 				SET(tp->t_state, TS_LNCH);
472 				goto endcase;
473 			}
474 			if (CCEQ(cc[VDISCARD], c)) {
475 				if (ISSET(lflag, FLUSHO))
476 					CLR(tp->t_lflag, FLUSHO);
477 				else {
478 					ttyflush(tp, FWRITE);
479 					ttyecho(c, tp);
480 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
481 						ttyretype(tp);
482 					SET(tp->t_lflag, FLUSHO);
483 				}
484 				goto startoutput;
485 			}
486 		}
487 		/*
488 		 * Signals.
489 		 */
490 		if (ISSET(lflag, ISIG)) {
491 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
492 				if (!ISSET(lflag, NOFLSH))
493 					ttyflush(tp, FREAD | FWRITE);
494 				ttyecho(c, tp);
495 				if (tp->t_pgrp != NULL) {
496 					PGRP_LOCK(tp->t_pgrp);
497 					pgsignal(tp->t_pgrp,
498 					    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
499 					PGRP_UNLOCK(tp->t_pgrp);
500 				}
501 				goto endcase;
502 			}
503 			if (CCEQ(cc[VSUSP], c)) {
504 				if (!ISSET(lflag, NOFLSH))
505 					ttyflush(tp, FREAD);
506 				ttyecho(c, tp);
507 				if (tp->t_pgrp != NULL) {
508 					PGRP_LOCK(tp->t_pgrp);
509 					pgsignal(tp->t_pgrp, SIGTSTP, 1);
510 					PGRP_UNLOCK(tp->t_pgrp);
511 				}
512 				goto endcase;
513 			}
514 		}
515 		/*
516 		 * Handle start/stop characters.
517 		 */
518 		if (ISSET(iflag, IXON)) {
519 			if (CCEQ(cc[VSTOP], c)) {
520 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
521 					SET(tp->t_state, TS_TTSTOP);
522 					tt_stop(tp, 0);
523 					return (0);
524 				}
525 				if (!CCEQ(cc[VSTART], c))
526 					return (0);
527 				/*
528 				 * if VSTART == VSTOP then toggle
529 				 */
530 				goto endcase;
531 			}
532 			if (CCEQ(cc[VSTART], c))
533 				goto restartoutput;
534 		}
535 		/*
536 		 * IGNCR, ICRNL, & INLCR
537 		 */
538 		if (c == '\r') {
539 			if (ISSET(iflag, IGNCR))
540 				return (0);
541 			else if (ISSET(iflag, ICRNL))
542 				c = '\n';
543 		} else if (c == '\n' && ISSET(iflag, INLCR))
544 			c = '\r';
545 	}
546 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
547 		/*
548 		 * From here on down canonical mode character
549 		 * processing takes place.
550 		 */
551 		/*
552 		 * erase or erase2 (^H / ^?)
553 		 */
554 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
555 			if (tp->t_rawq.c_cc)
556 				ttyrub(unputc(&tp->t_rawq), tp);
557 			goto endcase;
558 		}
559 		/*
560 		 * kill (^U)
561 		 */
562 		if (CCEQ(cc[VKILL], c)) {
563 			if (ISSET(lflag, ECHOKE) &&
564 			    tp->t_rawq.c_cc == tp->t_rocount &&
565 			    !ISSET(lflag, ECHOPRT))
566 				while (tp->t_rawq.c_cc)
567 					ttyrub(unputc(&tp->t_rawq), tp);
568 			else {
569 				ttyecho(c, tp);
570 				if (ISSET(lflag, ECHOK) ||
571 				    ISSET(lflag, ECHOKE))
572 					ttyecho('\n', tp);
573 				FLUSHQ(&tp->t_rawq);
574 				tp->t_rocount = 0;
575 			}
576 			CLR(tp->t_state, TS_LOCAL);
577 			goto endcase;
578 		}
579 		/*
580 		 * word erase (^W)
581 		 */
582 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
583 			int ctype;
584 
585 			/*
586 			 * erase whitespace
587 			 */
588 			while ((c = unputc(&tp->t_rawq)) == ' ' || c == '\t')
589 				ttyrub(c, tp);
590 			if (c == -1)
591 				goto endcase;
592 			/*
593 			 * erase last char of word and remember the
594 			 * next chars type (for ALTWERASE)
595 			 */
596 			ttyrub(c, tp);
597 			c = unputc(&tp->t_rawq);
598 			if (c == -1)
599 				goto endcase;
600 			if (c == ' ' || c == '\t') {
601 				(void)putc(c, &tp->t_rawq);
602 				goto endcase;
603 			}
604 			ctype = ISALPHA(c);
605 			/*
606 			 * erase rest of word
607 			 */
608 			do {
609 				ttyrub(c, tp);
610 				c = unputc(&tp->t_rawq);
611 				if (c == -1)
612 					goto endcase;
613 			} while (c != ' ' && c != '\t' &&
614 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
615 			(void)putc(c, &tp->t_rawq);
616 			goto endcase;
617 		}
618 		/*
619 		 * reprint line (^R)
620 		 */
621 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
622 			ttyretype(tp);
623 			goto endcase;
624 		}
625 		/*
626 		 * ^T - kernel info and generate SIGINFO
627 		 */
628 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
629 			if (ISSET(lflag, ISIG) && tp->t_pgrp != NULL) {
630 				PGRP_LOCK(tp->t_pgrp);
631 				pgsignal(tp->t_pgrp, SIGINFO, 1);
632 				PGRP_UNLOCK(tp->t_pgrp);
633 			}
634 			if (!ISSET(lflag, NOKERNINFO))
635 				ttyinfo(tp);
636 			goto endcase;
637 		}
638 	}
639 	/*
640 	 * Check for input buffer overflow
641 	 */
642 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
643 input_overflow:
644 		if (ISSET(iflag, IMAXBEL)) {
645 			if (tp->t_outq.c_cc < tp->t_ohiwat)
646 				(void)ttyoutput(CTRL('g'), tp);
647 		}
648 		goto endcase;
649 	}
650 
651 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
652 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
653 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
654 
655 	/*
656 	 * Put data char in q for user and
657 	 * wakeup on seeing a line delimiter.
658 	 */
659 	if (putc(c, &tp->t_rawq) >= 0) {
660 		if (!ISSET(lflag, ICANON)) {
661 			ttwakeup(tp);
662 			ttyecho(c, tp);
663 			goto endcase;
664 		}
665 		if (TTBREAKC(c, lflag)) {
666 			tp->t_rocount = 0;
667 			catq(&tp->t_rawq, &tp->t_canq);
668 			ttwakeup(tp);
669 		} else if (tp->t_rocount++ == 0)
670 			tp->t_rocol = tp->t_column;
671 		if (ISSET(tp->t_state, TS_ERASE)) {
672 			/*
673 			 * end of prterase \.../
674 			 */
675 			CLR(tp->t_state, TS_ERASE);
676 			(void)ttyoutput('/', tp);
677 		}
678 		i = tp->t_column;
679 		ttyecho(c, tp);
680 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
681 			/*
682 			 * Place the cursor over the '^' of the ^D.
683 			 */
684 			i = imin(2, tp->t_column - i);
685 			while (i > 0) {
686 				(void)ttyoutput('\b', tp);
687 				i--;
688 			}
689 		}
690 	}
691 endcase:
692 	/*
693 	 * IXANY means allow any character to restart output.
694 	 */
695 	if (ISSET(tp->t_state, TS_TTSTOP) &&
696 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
697 		return (0);
698 restartoutput:
699 	CLR(tp->t_lflag, FLUSHO);
700 	CLR(tp->t_state, TS_TTSTOP);
701 startoutput:
702 	return (ttstart(tp));
703 }
704 
705 /*
706  * Output a single character on a tty, doing output processing
707  * as needed (expanding tabs, newline processing, etc.).
708  * Returns < 0 if succeeds, otherwise returns char to resend.
709  * Must be recursive.
710  */
711 static int
712 ttyoutput(int c, struct tty *tp)
713 {
714 	tcflag_t oflag;
715 	int col, s;
716 
717 	oflag = tp->t_oflag;
718 	if (!ISSET(oflag, OPOST)) {
719 		if (ISSET(tp->t_lflag, FLUSHO))
720 			return (-1);
721 		if (putc(c, &tp->t_outq))
722 			return (c);
723 		tk_nout++;
724 		tp->t_outcc++;
725 		return (-1);
726 	}
727 	/*
728 	 * Do tab expansion if OXTABS is set.  Special case if we external
729 	 * processing, we don't do the tab expansion because we'll probably
730 	 * get it wrong.  If tab expansion needs to be done, let it happen
731 	 * externally.
732 	 */
733 	CLR(c, ~TTY_CHARMASK);
734 	if (c == '\t' &&
735 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
736 		c = 8 - (tp->t_column & 7);
737 		if (!ISSET(tp->t_lflag, FLUSHO)) {
738 			s = spltty();		/* Don't interrupt tabs. */
739 			c -= b_to_q("        ", c, &tp->t_outq);
740 			tk_nout += c;
741 			tp->t_outcc += c;
742 			splx(s);
743 		}
744 		tp->t_column += c;
745 		return (c ? -1 : '\t');
746 	}
747 	if (c == CEOT && ISSET(oflag, ONOEOT))
748 		return (-1);
749 
750 	/*
751 	 * Newline translation: if ONLCR is set,
752 	 * translate newline into "\r\n".
753 	 */
754 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
755 		tk_nout++;
756 		tp->t_outcc++;
757 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
758 			return (c);
759 	}
760 	/* If OCRNL is set, translate "\r" into "\n". */
761 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
762 		c = '\n';
763 	/* If ONOCR is set, don't transmit CRs when on column 0. */
764 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
765 		return (-1);
766 
767 	tk_nout++;
768 	tp->t_outcc++;
769 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
770 		return (c);
771 
772 	col = tp->t_column;
773 	switch (CCLASS(c)) {
774 	case BACKSPACE:
775 		if (col > 0)
776 			--col;
777 		break;
778 	case CONTROL:
779 		break;
780 	case NEWLINE:
781 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
782 			col = 0;
783 		break;
784 	case RETURN:
785 		col = 0;
786 		break;
787 	case ORDINARY:
788 		++col;
789 		break;
790 	case TAB:
791 		col = (col + 8) & ~7;
792 		break;
793 	}
794 	tp->t_column = col;
795 	return (-1);
796 }
797 
798 /*
799  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
800  * has been called to do discipline-specific functions and/or reject any
801  * of these ioctl commands.
802  */
803 /* ARGSUSED */
804 int
805 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
806 {
807 	struct proc *p;
808 	struct thread *td;
809 	struct pgrp *pgrp;
810 	int s, error, bits, sig, sig2;
811 
812 	td = curthread;			/* XXX */
813 	p = td->td_proc;
814 
815 	/* If the ioctl involves modification, hang if in the background. */
816 	switch (cmd) {
817 	case  TIOCCBRK:
818 	case  TIOCCONS:
819 	case  TIOCDRAIN:
820 	case  TIOCEXCL:
821 	case  TIOCFLUSH:
822 #ifdef TIOCHPCL
823 	case  TIOCHPCL:
824 #endif
825 	case  TIOCNXCL:
826 	case  TIOCSBRK:
827 	case  TIOCSCTTY:
828 	case  TIOCSDRAINWAIT:
829 	case  TIOCSETA:
830 	case  TIOCSETAF:
831 	case  TIOCSETAW:
832 	case  TIOCSETD:
833 	case  TIOCSPGRP:
834 	case  TIOCSTART:
835 	case  TIOCSTAT:
836 	case  TIOCSTI:
837 	case  TIOCSTOP:
838 	case  TIOCSWINSZ:
839 #if defined(COMPAT_43TTY)
840 	case  TIOCLBIC:
841 	case  TIOCLBIS:
842 	case  TIOCLSET:
843 	case  TIOCSETC:
844 	case OTIOCSETD:
845 	case  TIOCSETN:
846 	case  TIOCSETP:
847 	case  TIOCSLTC:
848 #endif
849 		sx_slock(&proctree_lock);
850 		PROC_LOCK(p);
851 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
852 		    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
853 		    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
854 			pgrp = p->p_pgrp;
855 			PROC_UNLOCK(p);
856 			if (pgrp->pg_jobc == 0) {
857 				sx_sunlock(&proctree_lock);
858 				return (EIO);
859 			}
860 			PGRP_LOCK(pgrp);
861 			sx_sunlock(&proctree_lock);
862 			pgsignal(pgrp, SIGTTOU, 1);
863 			PGRP_UNLOCK(pgrp);
864 			error = ttysleep(tp, &lbolt, TTOPRI | PCATCH, "ttybg1",
865 					 0);
866 			if (error)
867 				return (error);
868 			sx_slock(&proctree_lock);
869 			PROC_LOCK(p);
870 		}
871 		PROC_UNLOCK(p);
872 		sx_sunlock(&proctree_lock);
873 		break;
874 	}
875 
876 
877 	if (tp->t_modem != NULL) {
878 		switch (cmd) {
879 		case TIOCSDTR:
880 			tt_modem(tp, SER_DTR, 0);
881 			return (0);
882 		case TIOCCDTR:
883 			tt_modem(tp, 0, SER_DTR);
884 			return (0);
885 		case TIOCMSET:
886 			bits = *(int *)data;
887 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
888 			sig2 = ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1;
889 			tt_modem(tp, sig, sig2);
890 			return (0);
891 		case TIOCMBIS:
892 			bits = *(int *)data;
893 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
894 			tt_modem(tp, sig, 0);
895 			return (0);
896 		case TIOCMBIC:
897 			bits = *(int *)data;
898 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
899 			tt_modem(tp, 0, sig);
900 			return (0);
901 		case TIOCMGET:
902 			sig = tt_modem(tp, 0, 0);
903 			/* See <sys/serial.h. for the "<< 1" stuff */
904 			bits = TIOCM_LE + (sig << 1);
905 			*(int *)data = bits;
906 			return (0);
907 		default:
908 			break;
909 		}
910 	}
911 
912 	if (tp->t_pps != NULL) {
913 		error = pps_ioctl(cmd, data, tp->t_pps);
914 		if (error != ENOIOCTL)
915 			return (error);
916 	}
917 
918 	switch (cmd) {			/* Process the ioctl. */
919 	case FIOASYNC:			/* set/clear async i/o */
920 		s = spltty();
921 		if (*(int *)data)
922 			SET(tp->t_state, TS_ASYNC);
923 		else
924 			CLR(tp->t_state, TS_ASYNC);
925 		splx(s);
926 		break;
927 	case FIONBIO:			/* set/clear non-blocking i/o */
928 		break;			/* XXX: delete. */
929 	case FIONREAD:			/* get # bytes to read */
930 		s = spltty();
931 		*(int *)data = ttnread(tp);
932 		splx(s);
933 		break;
934 
935 	case FIOSETOWN:
936 		/*
937 		 * Policy -- Don't allow FIOSETOWN on someone else's
938 		 *           controlling tty
939 		 */
940 		if (tp->t_session != NULL && !isctty(p, tp))
941 			return (ENOTTY);
942 
943 		error = fsetown(*(int *)data, &tp->t_sigio);
944 		if (error)
945 			return (error);
946 		break;
947 	case FIOGETOWN:
948 		if (tp->t_session != NULL && !isctty(p, tp))
949 			return (ENOTTY);
950 		*(int *)data = fgetown(&tp->t_sigio);
951 		break;
952 
953 	case TIOCEXCL:			/* set exclusive use of tty */
954 		s = spltty();
955 		SET(tp->t_state, TS_XCLUDE);
956 		splx(s);
957 		break;
958 	case TIOCFLUSH: {		/* flush buffers */
959 		int flags = *(int *)data;
960 
961 		if (flags == 0)
962 			flags = FREAD | FWRITE;
963 		else
964 			flags &= FREAD | FWRITE;
965 		ttyflush(tp, flags);
966 		break;
967 	}
968 	case TIOCCONS:			/* become virtual console */
969 		if (*(int *)data) {
970 			struct nameidata nid;
971 
972 			if (constty && constty != tp &&
973 			    ISSET(constty->t_state, TS_CONNECTED))
974 				return (EBUSY);
975 
976 			/* Ensure user can open the real console. */
977 			NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
978 			    "/dev/console", td);
979 			if ((error = namei(&nid)) != 0)
980 				return (error);
981 			NDFREE(&nid, NDF_ONLY_PNBUF);
982 			error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
983 			vput(nid.ni_vp);
984 			if (error)
985 				return (error);
986 
987 			constty_set(tp);
988 		} else if (tp == constty)
989 			constty_clear();
990 		break;
991 	case TIOCDRAIN:			/* wait till output drained */
992 		error = ttywait(tp);
993 		if (error)
994 			return (error);
995 		break;
996 	case TIOCGETA: {		/* get termios struct */
997 		struct termios *t = (struct termios *)data;
998 
999 		bcopy(&tp->t_termios, t, sizeof(struct termios));
1000 		break;
1001 	}
1002 	case TIOCGETD:			/* get line discipline */
1003 		*(int *)data = tp->t_line;
1004 		break;
1005 	case TIOCGWINSZ:		/* get window size */
1006 		*(struct winsize *)data = tp->t_winsize;
1007 		break;
1008 	case TIOCGPGRP:			/* get pgrp of tty */
1009 		if (!isctty(p, tp))
1010 			return (ENOTTY);
1011 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1012 		break;
1013 #ifdef TIOCHPCL
1014 	case TIOCHPCL:			/* hang up on last close */
1015 		s = spltty();
1016 		SET(tp->t_cflag, HUPCL);
1017 		splx(s);
1018 		break;
1019 #endif
1020 	case TIOCMGDTRWAIT:
1021 		*(int *)data = tp->t_dtr_wait * 100 / hz;
1022 		break;
1023 	case TIOCMSDTRWAIT:
1024 		/* must be root since the wait applies to following logins */
1025 		error = priv_check(td, PRIV_TTY_DTRWAIT);
1026 		if (error)
1027 			return (error);
1028 		tp->t_dtr_wait = *(int *)data * hz / 100;
1029 		break;
1030 	case TIOCNXCL:			/* reset exclusive use of tty */
1031 		s = spltty();
1032 		CLR(tp->t_state, TS_XCLUDE);
1033 		splx(s);
1034 		break;
1035 	case TIOCOUTQ:			/* output queue size */
1036 		*(int *)data = tp->t_outq.c_cc;
1037 		break;
1038 	case TIOCSETA:			/* set termios struct */
1039 	case TIOCSETAW:			/* drain output, set */
1040 	case TIOCSETAF: {		/* drn out, fls in, set */
1041 		struct termios *t = (struct termios *)data;
1042 
1043 		if (t->c_ispeed == 0)
1044 			t->c_ispeed = t->c_ospeed;
1045 		if (t->c_ispeed == 0)
1046 			t->c_ispeed = tp->t_ospeed;
1047 		if (t->c_ispeed == 0)
1048 			return (EINVAL);
1049 		s = spltty();
1050 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1051 			error = ttywait(tp);
1052 			if (error) {
1053 				splx(s);
1054 				return (error);
1055 			}
1056 			if (cmd == TIOCSETAF)
1057 				ttyflush(tp, FREAD);
1058 		}
1059 		if (!ISSET(t->c_cflag, CIGNORE)) {
1060 			/*
1061 			 * Set device hardware.
1062 			 */
1063 			error = tt_param(tp, t);
1064 			if (error) {
1065 				splx(s);
1066 				return (error);
1067 			}
1068 			if (ISSET(t->c_cflag, CLOCAL) &&
1069 			    !ISSET(tp->t_cflag, CLOCAL)) {
1070 				/*
1071 				 * XXX disconnections would be too hard to
1072 				 * get rid of without this kludge.  The only
1073 				 * way to get rid of controlling terminals
1074 				 * is to exit from the session leader.
1075 				 */
1076 				CLR(tp->t_state, TS_ZOMBIE);
1077 
1078 				wakeup(TSA_CARR_ON(tp));
1079 				ttwakeup(tp);
1080 				ttwwakeup(tp);
1081 			}
1082 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1083 			     ISSET(t->c_cflag, CLOCAL)) &&
1084 			    !ISSET(tp->t_state, TS_ZOMBIE))
1085 				SET(tp->t_state, TS_CONNECTED);
1086 			else
1087 				CLR(tp->t_state, TS_CONNECTED);
1088 			tp->t_cflag = t->c_cflag;
1089 			tp->t_ispeed = t->c_ispeed;
1090 			if (t->c_ospeed != 0)
1091 				tp->t_ospeed = t->c_ospeed;
1092 			ttsetwater(tp);
1093 		}
1094 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1095 		    cmd != TIOCSETAF) {
1096 			if (ISSET(t->c_lflag, ICANON))
1097 				SET(tp->t_lflag, PENDIN);
1098 			else {
1099 				/*
1100 				 * XXX we really shouldn't allow toggling
1101 				 * ICANON while we're in a non-termios line
1102 				 * discipline.  Now we have to worry about
1103 				 * panicing for a null queue.
1104 				 */
1105 				if (tp->t_canq.c_cbreserved > 0 &&
1106 				    tp->t_rawq.c_cbreserved > 0) {
1107 					catq(&tp->t_rawq, &tp->t_canq);
1108 					/*
1109 					 * XXX the queue limits may be
1110 					 * different, so the old queue
1111 					 * swapping method no longer works.
1112 					 */
1113 					catq(&tp->t_canq, &tp->t_rawq);
1114 				}
1115 				CLR(tp->t_lflag, PENDIN);
1116 			}
1117 			ttwakeup(tp);
1118 		}
1119 		tp->t_iflag = t->c_iflag;
1120 		tp->t_oflag = t->c_oflag;
1121 		/*
1122 		 * Make the EXTPROC bit read only.
1123 		 */
1124 		if (ISSET(tp->t_lflag, EXTPROC))
1125 			SET(t->c_lflag, EXTPROC);
1126 		else
1127 			CLR(t->c_lflag, EXTPROC);
1128 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1129 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1130 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1131 			ttwakeup(tp);
1132 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1133 		splx(s);
1134 		break;
1135 	}
1136 	case TIOCSETD: {		/* set line discipline */
1137 		int t = *(int *)data;
1138 
1139 		if ((u_int)t >= nlinesw)
1140 			return (ENXIO);
1141 		if (t == tp->t_line)
1142 			return (0);
1143 		s = spltty();
1144 		ttyld_close(tp, flag);
1145 		tp->t_line = t;
1146 		/* XXX: we should use the correct cdev here */
1147 		error = ttyld_open(tp, tp->t_dev);
1148 		if (error) {
1149 			/*
1150 			 * If we fail to switch line discipline we cannot
1151 			 * fall back to the previous, because we can not
1152 			 * trust that ldisc to open successfully either.
1153 			 * Fall back to the default ldisc which we know
1154 			 * will allways succeed.
1155 			 */
1156 			tp->t_line = TTYDISC;
1157 			(void)ttyld_open(tp, tp->t_dev);
1158 		}
1159 		splx(s);
1160 		return (error);
1161 		break;
1162 	}
1163 	case TIOCSTART:			/* start output, like ^Q */
1164 		s = spltty();
1165 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1166 		    ISSET(tp->t_lflag, FLUSHO)) {
1167 			CLR(tp->t_lflag, FLUSHO);
1168 			CLR(tp->t_state, TS_TTSTOP);
1169 			ttstart(tp);
1170 		}
1171 		splx(s);
1172 		break;
1173 	case TIOCSTI:			/* simulate terminal input */
1174 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_TTY_STI))
1175 			return (EPERM);
1176 		if (!isctty(p, tp) && priv_check(td, PRIV_TTY_STI))
1177 			return (EACCES);
1178 		s = spltty();
1179 		ttyld_rint(tp, *(u_char *)data);
1180 		splx(s);
1181 		break;
1182 	case TIOCSTOP:			/* stop output, like ^S */
1183 		s = spltty();
1184 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1185 			SET(tp->t_state, TS_TTSTOP);
1186 			tt_stop(tp, 0);
1187 		}
1188 		splx(s);
1189 		break;
1190 	case TIOCSCTTY:			/* become controlling tty */
1191 		/* Session ctty vnode pointer set in vnode layer. */
1192 		sx_slock(&proctree_lock);
1193 		if (!SESS_LEADER(p) ||
1194 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1195 		     (tp->t_session != p->p_session))) {
1196 			sx_sunlock(&proctree_lock);
1197 			return (EPERM);
1198 		}
1199 		tp->t_session = p->p_session;
1200 		tp->t_pgrp = p->p_pgrp;
1201 		SESS_LOCK(p->p_session);
1202 		ttyref(tp);		/* ttyrel(): kern_proc.c:pgdelete() */
1203 		p->p_session->s_ttyp = tp;
1204 		SESS_UNLOCK(p->p_session);
1205 		PROC_LOCK(p);
1206 		p->p_flag |= P_CONTROLT;
1207 		PROC_UNLOCK(p);
1208 		sx_sunlock(&proctree_lock);
1209 		break;
1210 	case TIOCSPGRP: {		/* set pgrp of tty */
1211 		sx_slock(&proctree_lock);
1212 		pgrp = pgfind(*(int *)data);
1213 		if (!isctty(p, tp)) {
1214 			if (pgrp != NULL)
1215 				PGRP_UNLOCK(pgrp);
1216 			sx_sunlock(&proctree_lock);
1217 			return (ENOTTY);
1218 		}
1219 		if (pgrp == NULL) {
1220 			sx_sunlock(&proctree_lock);
1221 			return (EPERM);
1222 		}
1223 		PGRP_UNLOCK(pgrp);
1224 		if (pgrp->pg_session != p->p_session) {
1225 			sx_sunlock(&proctree_lock);
1226 			return (EPERM);
1227 		}
1228 		sx_sunlock(&proctree_lock);
1229 		tp->t_pgrp = pgrp;
1230 		break;
1231 	}
1232 	case TIOCSTAT:			/* simulate control-T */
1233 		s = spltty();
1234 		ttyinfo(tp);
1235 		splx(s);
1236 		break;
1237 	case TIOCSWINSZ:		/* set window size */
1238 		if (bcmp((caddr_t)&tp->t_winsize, data,
1239 		    sizeof (struct winsize))) {
1240 			tp->t_winsize = *(struct winsize *)data;
1241 			if (tp->t_pgrp != NULL) {
1242 				PGRP_LOCK(tp->t_pgrp);
1243 				pgsignal(tp->t_pgrp, SIGWINCH, 1);
1244 				PGRP_UNLOCK(tp->t_pgrp);
1245 			}
1246 		}
1247 		break;
1248 	case TIOCSDRAINWAIT:
1249 		error = priv_check(td, PRIV_TTY_DRAINWAIT);
1250 		if (error)
1251 			return (error);
1252 		tp->t_timeout = *(int *)data * hz;
1253 		wakeup(TSA_OCOMPLETE(tp));
1254 		wakeup(TSA_OLOWAT(tp));
1255 		break;
1256 	case TIOCGDRAINWAIT:
1257 		*(int *)data = tp->t_timeout / hz;
1258 		break;
1259 	case TIOCSBRK:
1260 		return (tt_break(tp, 1));
1261 	case TIOCCBRK:
1262 		return (tt_break(tp, 0));
1263 	default:
1264 #if defined(COMPAT_43TTY)
1265 		return (ttcompat(tp, cmd, data, flag));
1266 #else
1267 		return (ENOIOCTL);
1268 #endif
1269 	}
1270 	return (0);
1271 }
1272 
1273 int
1274 ttypoll(struct cdev *dev, int events, struct thread *td)
1275 {
1276 	int s;
1277 	int revents = 0;
1278 	struct tty *tp;
1279 
1280 	tp = tty_gettp(dev);
1281 
1282 	if (tp == NULL)	/* XXX used to return ENXIO, but that means true! */
1283 		return ((events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM))
1284 			| POLLHUP);
1285 
1286 	s = spltty();
1287 	if (events & (POLLIN | POLLRDNORM)) {
1288 		if (ISSET(tp->t_state, TS_ZOMBIE))
1289 			revents |= (events & (POLLIN | POLLRDNORM)) |
1290 			    POLLHUP;
1291 		else if (ttnread(tp) > 0)
1292 			revents |= events & (POLLIN | POLLRDNORM);
1293 		else
1294 			selrecord(td, &tp->t_rsel);
1295 	}
1296 	if (events & POLLOUT) {
1297 		if (ISSET(tp->t_state, TS_ZOMBIE))
1298 			revents |= POLLHUP;
1299 		else if (tp->t_outq.c_cc <= tp->t_olowat &&
1300 		    ISSET(tp->t_state, TS_CONNECTED))
1301 			revents |= events & POLLOUT;
1302 		else
1303 			selrecord(td, &tp->t_wsel);
1304 	}
1305 	splx(s);
1306 	return (revents);
1307 }
1308 
1309 static struct filterops ttyread_filtops =
1310 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1311 static struct filterops ttywrite_filtops =
1312 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1313 
1314 int
1315 ttykqfilter(struct cdev *dev, struct knote *kn)
1316 {
1317 	struct tty *tp;
1318 	struct knlist *klist;
1319 	int s;
1320 
1321 	tp = tty_gettp(dev);
1322 	if (tp->t_state & TS_GONE)
1323 		return (ENODEV);
1324 
1325 	switch (kn->kn_filter) {
1326 	case EVFILT_READ:
1327 		klist = &tp->t_rsel.si_note;
1328 		kn->kn_fop = &ttyread_filtops;
1329 		break;
1330 	case EVFILT_WRITE:
1331 		klist = &tp->t_wsel.si_note;
1332 		kn->kn_fop = &ttywrite_filtops;
1333 		break;
1334 	default:
1335 		return (EINVAL);
1336 	}
1337 
1338 	kn->kn_hook = (caddr_t)tp;
1339 
1340 	s = spltty();
1341 	knlist_add(klist, kn, 0);
1342 	splx(s);
1343 
1344 	return (0);
1345 }
1346 
1347 static void
1348 filt_ttyrdetach(struct knote *kn)
1349 {
1350 	struct tty *tp = (struct tty *)kn->kn_hook;
1351 	int s = spltty();
1352 
1353 	knlist_remove(&tp->t_rsel.si_note, kn, 0);
1354 	splx(s);
1355 }
1356 
1357 static int
1358 filt_ttyread(struct knote *kn, long hint)
1359 {
1360 	struct tty *tp = (struct tty *)kn->kn_hook;
1361 
1362 	kn->kn_data = ttnread(tp);
1363 	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE)) {
1364 		kn->kn_flags |= EV_EOF;
1365 		return (1);
1366 	}
1367 	return (kn->kn_data > 0);
1368 }
1369 
1370 static void
1371 filt_ttywdetach(struct knote *kn)
1372 {
1373 	struct tty *tp = (struct tty *)kn->kn_hook;
1374 	int s = spltty();
1375 
1376 	knlist_remove(&tp->t_wsel.si_note, kn, 0);
1377 	splx(s);
1378 }
1379 
1380 static int
1381 filt_ttywrite(struct knote *kn, long hint)
1382 {
1383 	struct tty *tp = (struct tty *)kn->kn_hook;
1384 
1385 	kn->kn_data = tp->t_outq.c_cc;
1386 	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE))
1387 		return (1);
1388 	return (kn->kn_data <= tp->t_olowat &&
1389 	    ISSET(tp->t_state, TS_CONNECTED));
1390 }
1391 
1392 /*
1393  * Must be called at spltty().
1394  */
1395 static int
1396 ttnread(struct tty *tp)
1397 {
1398 	int nread;
1399 
1400 	if (ISSET(tp->t_lflag, PENDIN))
1401 		ttypend(tp);
1402 	nread = tp->t_canq.c_cc;
1403 	if (!ISSET(tp->t_lflag, ICANON)) {
1404 		nread += tp->t_rawq.c_cc;
1405 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1406 			nread = 0;
1407 	}
1408 	return (nread);
1409 }
1410 
1411 /*
1412  * Wait for output to drain.
1413  */
1414 int
1415 ttywait(struct tty *tp)
1416 {
1417 	int error, s;
1418 
1419 	error = 0;
1420 	s = spltty();
1421 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1422 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1423 		tt_oproc(tp);
1424 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1425 		    ISSET(tp->t_state, TS_CONNECTED)) {
1426 			SET(tp->t_state, TS_SO_OCOMPLETE);
1427 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1428 					 TTOPRI | PCATCH, "ttywai",
1429 					 tp->t_timeout);
1430 			if (error) {
1431 				if (error == EWOULDBLOCK)
1432 					error = EIO;
1433 				break;
1434 			}
1435 		} else
1436 			break;
1437 	}
1438 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1439 		error = EIO;
1440 	splx(s);
1441 	return (error);
1442 }
1443 
1444 /*
1445  * Flush if successfully wait.
1446  */
1447 static int
1448 ttywflush(struct tty *tp)
1449 {
1450 	int error;
1451 
1452 	if ((error = ttywait(tp)) == 0)
1453 		ttyflush(tp, FREAD);
1454 	return (error);
1455 }
1456 
1457 /*
1458  * Flush tty read and/or write queues, notifying anyone waiting.
1459  */
1460 void
1461 ttyflush(struct tty *tp, int rw)
1462 {
1463 	int s;
1464 
1465 	s = spltty();
1466 #if 0
1467 again:
1468 #endif
1469 	if (rw & FWRITE) {
1470 		FLUSHQ(&tp->t_outq);
1471 		CLR(tp->t_state, TS_TTSTOP);
1472 	}
1473 	tt_stop(tp, rw);
1474 	if (rw & FREAD) {
1475 		FLUSHQ(&tp->t_canq);
1476 		FLUSHQ(&tp->t_rawq);
1477 		CLR(tp->t_lflag, PENDIN);
1478 		tp->t_rocount = 0;
1479 		tp->t_rocol = 0;
1480 		CLR(tp->t_state, TS_LOCAL);
1481 		ttwakeup(tp);
1482 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1483 			if (rw & FWRITE)
1484 				FLUSHQ(&tp->t_outq);
1485 			ttyunblock(tp);
1486 
1487 			/*
1488 			 * Don't let leave any state that might clobber the
1489 			 * next line discipline (although we should do more
1490 			 * to send the START char).  Not clearing the state
1491 			 * may have caused the "putc to a clist with no
1492 			 * reserved cblocks" panic/printf.
1493 			 */
1494 			CLR(tp->t_state, TS_TBLOCK);
1495 
1496 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1497 			if (ISSET(tp->t_iflag, IXOFF)) {
1498 				/*
1499 				 * XXX wait a bit in the hope that the stop
1500 				 * character (if any) will go out.  Waiting
1501 				 * isn't good since it allows races.  This
1502 				 * will be fixed when the stop character is
1503 				 * put in a special queue.  Don't bother with
1504 				 * the checks in ttywait() since the timeout
1505 				 * will save us.
1506 				 */
1507 				SET(tp->t_state, TS_SO_OCOMPLETE);
1508 				ttysleep(tp, TSA_OCOMPLETE(tp), TTOPRI,
1509 					 "ttyfls", hz / 10);
1510 				/*
1511 				 * Don't try sending the stop character again.
1512 				 */
1513 				CLR(tp->t_state, TS_TBLOCK);
1514 				goto again;
1515 			}
1516 #endif
1517 		}
1518 	}
1519 	if (rw & FWRITE) {
1520 		FLUSHQ(&tp->t_outq);
1521 		ttwwakeup(tp);
1522 	}
1523 	splx(s);
1524 }
1525 
1526 /*
1527  * Copy in the default termios characters.
1528  */
1529 void
1530 termioschars(struct termios *t)
1531 {
1532 
1533 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1534 }
1535 
1536 /*
1537  * Old interface.
1538  */
1539 void
1540 ttychars(struct tty *tp)
1541 {
1542 
1543 	termioschars(&tp->t_termios);
1544 }
1545 
1546 /*
1547  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1548  * on our input flow control bit and propagate the changes to the driver.
1549  * XXX the stop character should be put in a special high priority queue.
1550  */
1551 void
1552 ttyblock(struct tty *tp)
1553 {
1554 
1555 	SET(tp->t_state, TS_TBLOCK);
1556 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1557 	    putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1558 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1559 	ttstart(tp);
1560 }
1561 
1562 /*
1563  * Handle input low water.  Send start character for the IXOFF case.  Turn
1564  * off our input flow control bit and propagate the changes to the driver.
1565  * XXX the start character should be put in a special high priority queue.
1566  */
1567 static void
1568 ttyunblock(struct tty *tp)
1569 {
1570 
1571 	CLR(tp->t_state, TS_TBLOCK);
1572 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1573 	    putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1574 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1575 	ttstart(tp);
1576 }
1577 
1578 #ifdef notyet
1579 /* Not used by any current (i386) drivers. */
1580 /*
1581  * Restart after an inter-char delay.
1582  */
1583 void
1584 ttrstrt(void *tp_arg)
1585 {
1586 	struct tty *tp;
1587 	int s;
1588 
1589 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1590 
1591 	tp = tp_arg;
1592 	s = spltty();
1593 
1594 	CLR(tp->t_state, TS_TIMEOUT);
1595 	ttstart(tp);
1596 
1597 	splx(s);
1598 }
1599 #endif
1600 
1601 int
1602 ttstart(struct tty *tp)
1603 {
1604 
1605 	tt_oproc(tp);
1606 	return (0);
1607 }
1608 
1609 /*
1610  * "close" a line discipline
1611  */
1612 int
1613 ttylclose(struct tty *tp, int flag)
1614 {
1615 
1616 	if (flag & FNONBLOCK || ttywflush(tp))
1617 		ttyflush(tp, FREAD | FWRITE);
1618 	return (0);
1619 }
1620 
1621 /*
1622  * Handle modem control transition on a tty.
1623  * Flag indicates new state of carrier.
1624  * Returns 0 if the line should be turned off, otherwise 1.
1625  */
1626 int
1627 ttymodem(struct tty *tp, int flag)
1628 {
1629 
1630 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1631 		/*
1632 		 * MDMBUF: do flow control according to carrier flag
1633 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1634 		 * works if IXON and IXANY are clear.
1635 		 */
1636 		if (flag) {
1637 			CLR(tp->t_state, TS_CAR_OFLOW);
1638 			CLR(tp->t_state, TS_TTSTOP);
1639 			ttstart(tp);
1640 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1641 			SET(tp->t_state, TS_CAR_OFLOW);
1642 			SET(tp->t_state, TS_TTSTOP);
1643 			tt_stop(tp, 0);
1644 		}
1645 	} else if (flag == 0) {
1646 		/*
1647 		 * Lost carrier.
1648 		 */
1649 		CLR(tp->t_state, TS_CARR_ON);
1650 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1651 		    !ISSET(tp->t_cflag, CLOCAL)) {
1652 			SET(tp->t_state, TS_ZOMBIE);
1653 			CLR(tp->t_state, TS_CONNECTED);
1654 			if (tp->t_session) {
1655 				sx_slock(&proctree_lock);
1656 				if (tp->t_session && tp->t_session->s_leader) {
1657 					struct proc *p;
1658 
1659 					p = tp->t_session->s_leader;
1660 					PROC_LOCK(p);
1661 					psignal(p, SIGHUP);
1662 					PROC_UNLOCK(p);
1663 				}
1664 				sx_sunlock(&proctree_lock);
1665 			}
1666 			ttyflush(tp, FREAD | FWRITE);
1667 			return (0);
1668 		}
1669 	} else {
1670 		/*
1671 		 * Carrier now on.
1672 		 */
1673 		SET(tp->t_state, TS_CARR_ON);
1674 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1675 			SET(tp->t_state, TS_CONNECTED);
1676 		wakeup(TSA_CARR_ON(tp));
1677 		ttwakeup(tp);
1678 		ttwwakeup(tp);
1679 	}
1680 	return (1);
1681 }
1682 
1683 /*
1684  * Reinput pending characters after state switch
1685  * call at spltty().
1686  */
1687 static void
1688 ttypend(struct tty *tp)
1689 {
1690 	struct clist tq;
1691 	int c;
1692 
1693 	CLR(tp->t_lflag, PENDIN);
1694 	SET(tp->t_state, TS_TYPEN);
1695 	/*
1696 	 * XXX this assumes too much about clist internals.  It may even
1697 	 * fail if the cblock slush pool is empty.  We can't allocate more
1698 	 * cblocks here because we are called from an interrupt handler
1699 	 * and clist_alloc_cblocks() can wait.
1700 	 */
1701 	tq = tp->t_rawq;
1702 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1703 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1704 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1705 	while ((c = getc(&tq)) >= 0)
1706 		ttyinput(c, tp);
1707 	CLR(tp->t_state, TS_TYPEN);
1708 }
1709 
1710 /*
1711  * Process a read call on a tty device.
1712  */
1713 int
1714 ttread(struct tty *tp, struct uio *uio, int flag)
1715 {
1716 	struct clist *qp;
1717 	int c;
1718 	tcflag_t lflag;
1719 	cc_t *cc = tp->t_cc;
1720 	struct thread *td;
1721 	struct proc *p;
1722 	int s, first, error = 0;
1723 	int has_stime = 0, last_cc = 0;
1724 	long slp = 0;		/* XXX this should be renamed `timo'. */
1725 	struct timeval stime = { 0, 0 };
1726 	struct pgrp *pg;
1727 
1728 	td = curthread;
1729 	p = td->td_proc;
1730 loop:
1731 	s = spltty();
1732 	lflag = tp->t_lflag;
1733 	/*
1734 	 * take pending input first
1735 	 */
1736 	if (ISSET(lflag, PENDIN)) {
1737 		ttypend(tp);
1738 		splx(s);	/* reduce latency */
1739 		s = spltty();
1740 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1741 	}
1742 
1743 	/*
1744 	 * Hang process if it's in the background.
1745 	 */
1746 	if (isbackground(p, tp)) {
1747 		splx(s);
1748 		sx_slock(&proctree_lock);
1749 		PROC_LOCK(p);
1750 		if (SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTIN) ||
1751 		    SIGISMEMBER(td->td_sigmask, SIGTTIN) ||
1752 		    (p->p_flag & P_PPWAIT) || p->p_pgrp->pg_jobc == 0) {
1753 			PROC_UNLOCK(p);
1754 			sx_sunlock(&proctree_lock);
1755 			return (EIO);
1756 		}
1757 		pg = p->p_pgrp;
1758 		PROC_UNLOCK(p);
1759 		PGRP_LOCK(pg);
1760 		sx_sunlock(&proctree_lock);
1761 		pgsignal(pg, SIGTTIN, 1);
1762 		PGRP_UNLOCK(pg);
1763 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg2", 0);
1764 		if (error)
1765 			return (error);
1766 		goto loop;
1767 	}
1768 
1769 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1770 		splx(s);
1771 		return (0);	/* EOF */
1772 	}
1773 
1774 	/*
1775 	 * If canonical, use the canonical queue,
1776 	 * else use the raw queue.
1777 	 *
1778 	 * (should get rid of clists...)
1779 	 */
1780 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1781 
1782 	if (flag & IO_NDELAY) {
1783 		if (qp->c_cc > 0)
1784 			goto read;
1785 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1786 			splx(s);
1787 			return (0);
1788 		}
1789 		splx(s);
1790 		return (EWOULDBLOCK);
1791 	}
1792 	if (!ISSET(lflag, ICANON)) {
1793 		int m = cc[VMIN];
1794 		long t = cc[VTIME];
1795 		struct timeval timecopy;
1796 
1797 		/*
1798 		 * Check each of the four combinations.
1799 		 * (m > 0 && t == 0) is the normal read case.
1800 		 * It should be fairly efficient, so we check that and its
1801 		 * companion case (m == 0 && t == 0) first.
1802 		 * For the other two cases, we compute the target sleep time
1803 		 * into slp.
1804 		 */
1805 		if (t == 0) {
1806 			if (qp->c_cc < m)
1807 				goto sleep;
1808 			if (qp->c_cc > 0)
1809 				goto read;
1810 
1811 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1812 			splx(s);
1813 			return (0);
1814 		}
1815 		t *= 100000;		/* time in us */
1816 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1817 			 ((t1).tv_usec - (t2).tv_usec))
1818 		if (m > 0) {
1819 			if (qp->c_cc <= 0)
1820 				goto sleep;
1821 			if (qp->c_cc >= m)
1822 				goto read;
1823 			getmicrotime(&timecopy);
1824 			if (!has_stime) {
1825 				/* first character, start timer */
1826 				has_stime = 1;
1827 				stime = timecopy;
1828 				slp = t;
1829 			} else if (qp->c_cc > last_cc) {
1830 				/* got a character, restart timer */
1831 				stime = timecopy;
1832 				slp = t;
1833 			} else {
1834 				/* nothing, check expiration */
1835 				slp = t - diff(timecopy, stime);
1836 				if (slp <= 0)
1837 					goto read;
1838 			}
1839 			last_cc = qp->c_cc;
1840 		} else {	/* m == 0 */
1841 			if (qp->c_cc > 0)
1842 				goto read;
1843 			getmicrotime(&timecopy);
1844 			if (!has_stime) {
1845 				has_stime = 1;
1846 				stime = timecopy;
1847 				slp = t;
1848 			} else {
1849 				slp = t - diff(timecopy, stime);
1850 				if (slp <= 0) {
1851 					/* Timed out, but 0 is enough input. */
1852 					splx(s);
1853 					return (0);
1854 				}
1855 			}
1856 		}
1857 #undef diff
1858 		if (slp != 0) {
1859 			struct timeval tv;	/* XXX style bug. */
1860 
1861 			tv.tv_sec = slp / 1000000;
1862 			tv.tv_usec = slp % 1000000;
1863 			slp = tvtohz(&tv);
1864 			/*
1865 			 * XXX bad variable names.  slp was the timeout in
1866 			 * usec.  Now it is the timeout in ticks.
1867 			 */
1868 		}
1869 		goto sleep;
1870 	}
1871 	if (qp->c_cc <= 0) {
1872 sleep:
1873 		/*
1874 		 * There is no input, or not enough input and we can block.
1875 		 */
1876 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), TTIPRI | PCATCH,
1877 				 ISSET(tp->t_state, TS_CONNECTED) ?
1878 				 "ttyin" : "ttyhup", (int)slp);
1879 		splx(s);
1880 		if (error == EWOULDBLOCK)
1881 			error = 0;
1882 		else if (error)
1883 			return (error);
1884 		/*
1885 		 * XXX what happens if another process eats some input
1886 		 * while we are asleep (not just here)?  It would be
1887 		 * safest to detect changes and reset our state variables
1888 		 * (has_stime and last_cc).
1889 		 */
1890 		slp = 0;
1891 		goto loop;
1892 	}
1893 read:
1894 	splx(s);
1895 	/*
1896 	 * Input present, check for input mapping and processing.
1897 	 */
1898 	first = 1;
1899 	if (ISSET(lflag, ICANON | ISIG))
1900 		goto slowcase;
1901 	for (;;) {
1902 		char ibuf[IBUFSIZ];
1903 		int icc;
1904 
1905 		icc = imin(uio->uio_resid, IBUFSIZ);
1906 		icc = q_to_b(qp, ibuf, icc);
1907 		if (icc <= 0) {
1908 			if (first)
1909 				goto loop;
1910 			break;
1911 		}
1912 		error = uiomove(ibuf, icc, uio);
1913 		/*
1914 		 * XXX if there was an error then we should ungetc() the
1915 		 * unmoved chars and reduce icc here.
1916 		 */
1917 		if (error)
1918 			break;
1919 		if (uio->uio_resid == 0)
1920 			break;
1921 		first = 0;
1922 	}
1923 	goto out;
1924 slowcase:
1925 	for (;;) {
1926 		c = getc(qp);
1927 		if (c < 0) {
1928 			if (first)
1929 				goto loop;
1930 			break;
1931 		}
1932 		/*
1933 		 * delayed suspend (^Y)
1934 		 */
1935 		if (CCEQ(cc[VDSUSP], c) &&
1936 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1937 			if (tp->t_pgrp != NULL) {
1938 				PGRP_LOCK(tp->t_pgrp);
1939 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
1940 				PGRP_UNLOCK(tp->t_pgrp);
1941 			}
1942 			if (first) {
1943 				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
1944 						 "ttybg3", 0);
1945 				if (error)
1946 					break;
1947 				goto loop;
1948 			}
1949 			break;
1950 		}
1951 		/*
1952 		 * Interpret EOF only in canonical mode.
1953 		 */
1954 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1955 			break;
1956 		/*
1957 		 * Give user character.
1958 		 */
1959 		error = ureadc(c, uio);
1960 		if (error)
1961 			/* XXX should ungetc(c, qp). */
1962 			break;
1963 		if (uio->uio_resid == 0)
1964 			break;
1965 		/*
1966 		 * In canonical mode check for a "break character"
1967 		 * marking the end of a "line of input".
1968 		 */
1969 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1970 			break;
1971 		first = 0;
1972 	}
1973 
1974 out:
1975 	/*
1976 	 * Look to unblock input now that (presumably)
1977 	 * the input queue has gone down.
1978 	 */
1979 	s = spltty();
1980 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1981 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1982 		ttyunblock(tp);
1983 	splx(s);
1984 
1985 	return (error);
1986 }
1987 
1988 /*
1989  * Check the output queue on tp for space for a kernel message (from uprintf
1990  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1991  * lose messages due to normal flow control, but don't let the tty run amok.
1992  * Sleeps here are not interruptible, but we return prematurely if new signals
1993  * arrive.
1994  */
1995 int
1996 ttycheckoutq(struct tty *tp, int wait)
1997 {
1998 	int hiwat, s;
1999 	sigset_t oldmask;
2000 	struct thread *td;
2001 	struct proc *p;
2002 
2003 	td = curthread;
2004 	p = td->td_proc;
2005 	hiwat = tp->t_ohiwat;
2006 	SIGEMPTYSET(oldmask);
2007 	s = spltty();
2008 	if (wait) {
2009 		PROC_LOCK(p);
2010 		oldmask = td->td_siglist;
2011 		PROC_UNLOCK(p);
2012 	}
2013 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100)
2014 		while (tp->t_outq.c_cc > hiwat) {
2015 			ttstart(tp);
2016 			if (tp->t_outq.c_cc <= hiwat)
2017 				break;
2018 			if (!wait) {
2019 				splx(s);
2020 				return (0);
2021 			}
2022 			PROC_LOCK(p);
2023 			if (!SIGSETEQ(td->td_siglist, oldmask)) {
2024 				PROC_UNLOCK(p);
2025 				splx(s);
2026 				return (0);
2027 			}
2028 			PROC_UNLOCK(p);
2029 			SET(tp->t_state, TS_SO_OLOWAT);
2030 			tsleep(TSA_OLOWAT(tp), PZERO - 1, "ttoutq", hz);
2031 		}
2032 	splx(s);
2033 	return (1);
2034 }
2035 
2036 /*
2037  * Process a write call on a tty device.
2038  */
2039 int
2040 ttwrite(struct tty *tp, struct uio *uio, int flag)
2041 {
2042 	char *cp = NULL;
2043 	int cc, ce;
2044 	struct thread *td;
2045 	struct proc *p;
2046 	int i, hiwat, cnt, error, s;
2047 	char obuf[OBUFSIZ];
2048 
2049 	hiwat = tp->t_ohiwat;
2050 	cnt = uio->uio_resid;
2051 	error = 0;
2052 	cc = 0;
2053 	td = curthread;
2054 	p = td->td_proc;
2055 loop:
2056 	s = spltty();
2057 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2058 		splx(s);
2059 		if (uio->uio_resid == cnt)
2060 			error = EIO;
2061 		goto out;
2062 	}
2063 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2064 		if (flag & IO_NDELAY) {
2065 			splx(s);
2066 			error = EWOULDBLOCK;
2067 			goto out;
2068 		}
2069 		error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
2070 				 "ttywdcd", 0);
2071 		splx(s);
2072 		if (error)
2073 			goto out;
2074 		goto loop;
2075 	}
2076 	splx(s);
2077 	/*
2078 	 * Hang the process if it's in the background.
2079 	 */
2080 	sx_slock(&proctree_lock);
2081 	PROC_LOCK(p);
2082 	if (isbackground(p, tp) &&
2083 	    ISSET(tp->t_lflag, TOSTOP) && !(p->p_flag & P_PPWAIT) &&
2084 	    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
2085 	    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
2086 		if (p->p_pgrp->pg_jobc == 0) {
2087 			PROC_UNLOCK(p);
2088 			sx_sunlock(&proctree_lock);
2089 			error = EIO;
2090 			goto out;
2091 		}
2092 		PROC_UNLOCK(p);
2093 		PGRP_LOCK(p->p_pgrp);
2094 		sx_sunlock(&proctree_lock);
2095 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2096 		PGRP_UNLOCK(p->p_pgrp);
2097 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg4", 0);
2098 		if (error)
2099 			goto out;
2100 		goto loop;
2101 	} else {
2102 		PROC_UNLOCK(p);
2103 		sx_sunlock(&proctree_lock);
2104 	}
2105 	/*
2106 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2107 	 * output translation.  Keep track of high water mark, sleep on
2108 	 * overflow awaiting device aid in acquiring new space.
2109 	 */
2110 	while (uio->uio_resid > 0 || cc > 0) {
2111 		if (ISSET(tp->t_lflag, FLUSHO)) {
2112 			uio->uio_resid = 0;
2113 			return (0);
2114 		}
2115 		if (tp->t_outq.c_cc > hiwat)
2116 			goto ovhiwat;
2117 		/*
2118 		 * Grab a hunk of data from the user, unless we have some
2119 		 * leftover from last time.
2120 		 */
2121 		if (cc == 0) {
2122 			cc = imin(uio->uio_resid, OBUFSIZ);
2123 			cp = obuf;
2124 			error = uiomove(cp, cc, uio);
2125 			if (error) {
2126 				cc = 0;
2127 				break;
2128 			}
2129 		}
2130 		/*
2131 		 * If nothing fancy need be done, grab those characters we
2132 		 * can handle without any of ttyoutput's processing and
2133 		 * just transfer them to the output q.  For those chars
2134 		 * which require special processing (as indicated by the
2135 		 * bits in char_type), call ttyoutput.  After processing
2136 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2137 		 * immediately.
2138 		 */
2139 		while (cc > 0) {
2140 			if (!ISSET(tp->t_oflag, OPOST))
2141 				ce = cc;
2142 			else {
2143 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2144 						char_type, CCLASSMASK);
2145 				/*
2146 				 * If ce is zero, then we're processing
2147 				 * a special character through ttyoutput.
2148 				 */
2149 				if (ce == 0) {
2150 					tp->t_rocount = 0;
2151 					if (ttyoutput(*cp, tp) >= 0) {
2152 						/* No Clists, wait a bit. */
2153 						ttstart(tp);
2154 						if (flag & IO_NDELAY) {
2155 							error = EWOULDBLOCK;
2156 							goto out;
2157 						}
2158 						error = ttysleep(tp, &lbolt,
2159 								 TTOPRI|PCATCH,
2160 								 "ttybf1", 0);
2161 						if (error)
2162 							goto out;
2163 						goto loop;
2164 					}
2165 					cp++;
2166 					cc--;
2167 					if (ISSET(tp->t_lflag, FLUSHO) ||
2168 					    tp->t_outq.c_cc > hiwat)
2169 						goto ovhiwat;
2170 					continue;
2171 				}
2172 			}
2173 			/*
2174 			 * A bunch of normal characters have been found.
2175 			 * Transfer them en masse to the output queue and
2176 			 * continue processing at the top of the loop.
2177 			 * If there are any further characters in this
2178 			 * <= OBUFSIZ chunk, the first should be a character
2179 			 * requiring special handling by ttyoutput.
2180 			 */
2181 			tp->t_rocount = 0;
2182 			i = b_to_q(cp, ce, &tp->t_outq);
2183 			ce -= i;
2184 			tp->t_column += ce;
2185 			cp += ce, cc -= ce, tk_nout += ce;
2186 			tp->t_outcc += ce;
2187 			if (i > 0) {
2188 				/* No Clists, wait a bit. */
2189 				ttstart(tp);
2190 				if (flag & IO_NDELAY) {
2191 					error = EWOULDBLOCK;
2192 					goto out;
2193 				}
2194 				error = ttysleep(tp, &lbolt, TTOPRI | PCATCH,
2195 						 "ttybf2", 0);
2196 				if (error)
2197 					goto out;
2198 				goto loop;
2199 			}
2200 			if (ISSET(tp->t_lflag, FLUSHO) ||
2201 			    tp->t_outq.c_cc > hiwat)
2202 				break;
2203 		}
2204 		ttstart(tp);
2205 	}
2206 out:
2207 	/*
2208 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2209 	 * offset and iov pointers have moved forward, but it doesn't matter
2210 	 * (the call will either return short or restart with a new uio).
2211 	 */
2212 	uio->uio_resid += cc;
2213 	return (error);
2214 
2215 ovhiwat:
2216 	ttstart(tp);
2217 	s = spltty();
2218 	/*
2219 	 * This can only occur if FLUSHO is set in t_lflag,
2220 	 * or if ttstart/oproc is synchronous (or very fast).
2221 	 */
2222 	if (tp->t_outq.c_cc <= hiwat) {
2223 		splx(s);
2224 		goto loop;
2225 	}
2226 	if (flag & IO_NDELAY) {
2227 		splx(s);
2228 		uio->uio_resid += cc;
2229 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2230 	}
2231 	SET(tp->t_state, TS_SO_OLOWAT);
2232 	error = ttysleep(tp, TSA_OLOWAT(tp), TTOPRI | PCATCH, "ttywri",
2233 			 tp->t_timeout);
2234 	splx(s);
2235 	if (error == EWOULDBLOCK)
2236 		error = EIO;
2237 	if (error)
2238 		goto out;
2239 	goto loop;
2240 }
2241 
2242 /*
2243  * Rubout one character from the rawq of tp
2244  * as cleanly as possible.
2245  */
2246 static void
2247 ttyrub(int c, struct tty *tp)
2248 {
2249 	char *cp;
2250 	int savecol;
2251 	int tabc, s;
2252 
2253 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2254 		return;
2255 	CLR(tp->t_lflag, FLUSHO);
2256 	if (ISSET(tp->t_lflag, ECHOE)) {
2257 		if (tp->t_rocount == 0) {
2258 			/*
2259 			 * Screwed by ttwrite; retype
2260 			 */
2261 			ttyretype(tp);
2262 			return;
2263 		}
2264 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2265 			ttyrubo(tp, 2);
2266 		else {
2267 			CLR(c, ~TTY_CHARMASK);
2268 			switch (CCLASS(c)) {
2269 			case ORDINARY:
2270 				ttyrubo(tp, 1);
2271 				break;
2272 			case BACKSPACE:
2273 			case CONTROL:
2274 			case NEWLINE:
2275 			case RETURN:
2276 			case VTAB:
2277 				if (ISSET(tp->t_lflag, ECHOCTL))
2278 					ttyrubo(tp, 2);
2279 				break;
2280 			case TAB:
2281 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2282 					ttyretype(tp);
2283 					return;
2284 				}
2285 				s = spltty();
2286 				savecol = tp->t_column;
2287 				SET(tp->t_state, TS_CNTTB);
2288 				SET(tp->t_lflag, FLUSHO);
2289 				tp->t_column = tp->t_rocol;
2290 				cp = tp->t_rawq.c_cf;
2291 				if (cp)
2292 					tabc = *cp;	/* XXX FIX NEXTC */
2293 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2294 					ttyecho(tabc, tp);
2295 				CLR(tp->t_lflag, FLUSHO);
2296 				CLR(tp->t_state, TS_CNTTB);
2297 				splx(s);
2298 
2299 				/* savecol will now be length of the tab. */
2300 				savecol -= tp->t_column;
2301 				tp->t_column += savecol;
2302 				if (savecol > 8)
2303 					savecol = 8;	/* overflow screw */
2304 				while (--savecol >= 0)
2305 					(void)ttyoutput('\b', tp);
2306 				break;
2307 			default:			/* XXX */
2308 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2309 				(void)printf(PANICSTR, c, CCLASS(c));
2310 #ifdef notdef
2311 				panic(PANICSTR, c, CCLASS(c));
2312 #endif
2313 			}
2314 		}
2315 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2316 		if (!ISSET(tp->t_state, TS_ERASE)) {
2317 			SET(tp->t_state, TS_ERASE);
2318 			(void)ttyoutput('\\', tp);
2319 		}
2320 		ttyecho(c, tp);
2321 	} else {
2322 		ttyecho(tp->t_cc[VERASE], tp);
2323 		/*
2324 		 * This code may be executed not only when an ERASE key
2325 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2326 		 * So, I didn't think it was worthwhile to pass the extra
2327 		 * information (which would need an extra parameter,
2328 		 * changing every call) needed to distinguish the ERASE2
2329 		 * case from the ERASE.
2330 		 */
2331 	}
2332 	--tp->t_rocount;
2333 }
2334 
2335 /*
2336  * Back over cnt characters, erasing them.
2337  */
2338 static void
2339 ttyrubo(struct tty *tp, int cnt)
2340 {
2341 
2342 	while (cnt-- > 0) {
2343 		(void)ttyoutput('\b', tp);
2344 		(void)ttyoutput(' ', tp);
2345 		(void)ttyoutput('\b', tp);
2346 	}
2347 }
2348 
2349 /*
2350  * ttyretype --
2351  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2352  *	been checked.
2353  */
2354 static void
2355 ttyretype(struct tty *tp)
2356 {
2357 	char *cp;
2358 	int s, c;
2359 
2360 	/* Echo the reprint character. */
2361 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2362 		ttyecho(tp->t_cc[VREPRINT], tp);
2363 
2364 	(void)ttyoutput('\n', tp);
2365 
2366 	/*
2367 	 * XXX
2368 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2369 	 * BIT OF FIRST CHAR.
2370 	 */
2371 	s = spltty();
2372 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2373 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2374 		ttyecho(c, tp);
2375 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2376 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2377 		ttyecho(c, tp);
2378 	CLR(tp->t_state, TS_ERASE);
2379 	splx(s);
2380 
2381 	tp->t_rocount = tp->t_rawq.c_cc;
2382 	tp->t_rocol = 0;
2383 }
2384 
2385 /*
2386  * Echo a typed character to the terminal.
2387  */
2388 static void
2389 ttyecho(int c, struct tty *tp)
2390 {
2391 
2392 	if (!ISSET(tp->t_state, TS_CNTTB))
2393 		CLR(tp->t_lflag, FLUSHO);
2394 	if ((!ISSET(tp->t_lflag, ECHO) &&
2395 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2396 	    ISSET(tp->t_lflag, EXTPROC))
2397 		return;
2398 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2399 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2400 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2401 		(void)ttyoutput('^', tp);
2402 		CLR(c, ~TTY_CHARMASK);
2403 		if (c == 0177)
2404 			c = '?';
2405 		else
2406 			c += 'A' - 1;
2407 	}
2408 	(void)ttyoutput(c, tp);
2409 }
2410 
2411 /*
2412  * Wake up any readers on a tty.
2413  */
2414 void
2415 ttwakeup(struct tty *tp)
2416 {
2417 
2418 	if (SEL_WAITING(&tp->t_rsel))
2419 		selwakeuppri(&tp->t_rsel, TTIPRI);
2420 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2421 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2422 	wakeup(TSA_HUP_OR_INPUT(tp));
2423 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
2424 }
2425 
2426 /*
2427  * Wake up any writers on a tty.
2428  */
2429 void
2430 ttwwakeup(struct tty *tp)
2431 {
2432 
2433 	if (SEL_WAITING(&tp->t_wsel) && tp->t_outq.c_cc <= tp->t_olowat)
2434 		selwakeuppri(&tp->t_wsel, TTOPRI);
2435 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2436 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2437 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2438 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2439 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2440 		wakeup(TSA_OCOMPLETE(tp));
2441 	}
2442 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2443 	    tp->t_outq.c_cc <= tp->t_olowat) {
2444 		CLR(tp->t_state, TS_SO_OLOWAT);
2445 		wakeup(TSA_OLOWAT(tp));
2446 	}
2447 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
2448 }
2449 
2450 /*
2451  * Look up a code for a specified speed in a conversion table;
2452  * used by drivers to map software speed values to hardware parameters.
2453  */
2454 int
2455 ttspeedtab(int speed, struct speedtab *table)
2456 {
2457 
2458 	for ( ; table->sp_speed != -1; table++)
2459 		if (table->sp_speed == speed)
2460 			return (table->sp_code);
2461 	return (-1);
2462 }
2463 
2464 /*
2465  * Set input and output watermarks and buffer sizes.  For input, the
2466  * high watermark is about one second's worth of input above empty, the
2467  * low watermark is slightly below high water, and the buffer size is a
2468  * driver-dependent amount above high water.  For output, the watermarks
2469  * are near the ends of the buffer, with about 1 second's worth of input
2470  * between them.  All this only applies to the standard line discipline.
2471  */
2472 void
2473 ttsetwater(struct tty *tp)
2474 {
2475 	int cps, ttmaxhiwat, x;
2476 
2477 	/* Input. */
2478 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2479 	switch (tp->t_ispeedwat) {
2480 	case (speed_t)-1:
2481 		cps = tp->t_ispeed / 10;
2482 		break;
2483 	case 0:
2484 		/*
2485 		 * This case is for old drivers that don't know about
2486 		 * t_ispeedwat.  Arrange for them to get the old buffer
2487 		 * sizes and watermarks.
2488 		 */
2489 		cps = TTYHOG - 2 * 256;
2490 		tp->t_ififosize = 2 * 256;
2491 		break;
2492 	default:
2493 		cps = tp->t_ispeedwat / 10;
2494 		break;
2495 	}
2496 	tp->t_ihiwat = cps;
2497 	tp->t_ilowat = 7 * cps / 8;
2498 	x = cps + tp->t_ififosize;
2499 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2500 
2501 	/* Output. */
2502 	switch (tp->t_ospeedwat) {
2503 	case (speed_t)-1:
2504 		cps = tp->t_ospeed / 10;
2505 		ttmaxhiwat = 2 * TTMAXHIWAT;
2506 		break;
2507 	case 0:
2508 		cps = tp->t_ospeed / 10;
2509 		ttmaxhiwat = TTMAXHIWAT;
2510 		break;
2511 	default:
2512 		cps = tp->t_ospeedwat / 10;
2513 		ttmaxhiwat = 8 * TTMAXHIWAT;
2514 		break;
2515 	}
2516 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2517 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2518 	x += cps;
2519 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2520 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2521 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2522 	x += OBUFSIZ + 100;
2523 	clist_alloc_cblocks(&tp->t_outq, x, x);
2524 #undef	CLAMP
2525 }
2526 
2527 /*
2528  * Report on state of foreground process group.
2529  */
2530 void
2531 ttyinfo(struct tty *tp)
2532 {
2533 	struct timeval utime, stime;
2534 	struct proc *p, *pick;
2535 	struct thread *td, *picktd;
2536 	const char *stateprefix, *state;
2537 	long rss;
2538 	int load, pctcpu;
2539 	pid_t pid;
2540 	char comm[MAXCOMLEN + 1];
2541 	struct rusage ru;
2542 
2543 	if (ttycheckoutq(tp,0) == 0)
2544 		return;
2545 
2546 	/* Print load average. */
2547 	load = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2548 	ttyprintf(tp, "load: %d.%02d ", load / 100, load % 100);
2549 
2550 	/*
2551 	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
2552 	 * that pending input will be retyped on BS.
2553 	 */
2554 	if (tp->t_session == NULL) {
2555 		ttyprintf(tp, "not a controlling terminal\n");
2556 		tp->t_rocount = 0;
2557 		return;
2558 	}
2559 	if (tp->t_pgrp == NULL) {
2560 		ttyprintf(tp, "no foreground process group\n");
2561 		tp->t_rocount = 0;
2562 		return;
2563 	}
2564 	PGRP_LOCK(tp->t_pgrp);
2565 	if (LIST_EMPTY(&tp->t_pgrp->pg_members)) {
2566 		PGRP_UNLOCK(tp->t_pgrp);
2567 		ttyprintf(tp, "empty foreground process group\n");
2568 		tp->t_rocount = 0;
2569 		return;
2570 	}
2571 
2572 	/*
2573 	 * Pick the most interesting process and copy some of its
2574 	 * state for printing later.  This operation could rely on stale
2575 	 * data as we can't hold the proc slock or thread locks over the
2576 	 * whole list. However, we're guaranteed not to reference an exited
2577 	 * thread or proc since we hold the tty locked.
2578 	 */
2579 	pick = NULL;
2580 	LIST_FOREACH(p, &tp->t_pgrp->pg_members, p_pglist)
2581 		if (proc_compare(pick, p))
2582 			pick = p;
2583 
2584 	PROC_SLOCK(pick);
2585 	picktd = NULL;
2586 	td = FIRST_THREAD_IN_PROC(pick);
2587 	FOREACH_THREAD_IN_PROC(pick, td)
2588 		if (thread_compare(picktd, td))
2589 			picktd = td;
2590 	td = picktd;
2591 	stateprefix = "";
2592 	thread_lock(td);
2593 	if (TD_IS_RUNNING(td))
2594 		state = "running";
2595 	else if (TD_ON_RUNQ(td) || TD_CAN_RUN(td))
2596 		state = "runnable";
2597 	else if (TD_IS_SLEEPING(td)) {
2598 		/* XXX: If we're sleeping, are we ever not in a queue? */
2599 		if (TD_ON_SLEEPQ(td))
2600 			state = td->td_wmesg;
2601 		else
2602 			state = "sleeping without queue";
2603 	} else if (TD_ON_LOCK(td)) {
2604 		state = td->td_lockname;
2605 		stateprefix = "*";
2606 	} else if (TD_IS_SUSPENDED(td))
2607 		state = "suspended";
2608 	else if (TD_AWAITING_INTR(td))
2609 		state = "intrwait";
2610 	else
2611 		state = "unknown";
2612 	pctcpu = (sched_pctcpu(td) * 10000 + FSCALE / 2) >> FSHIFT;
2613 	thread_unlock(td);
2614 	if (pick->p_state == PRS_NEW || pick->p_state == PRS_ZOMBIE)
2615 		rss = 0;
2616 	else
2617 		rss = pgtok(vmspace_resident_count(pick->p_vmspace));
2618 	PROC_SUNLOCK(pick);
2619 	PROC_LOCK(pick);
2620 	PGRP_UNLOCK(tp->t_pgrp);
2621 	rufetchcalc(pick, &ru, &utime, &stime);
2622 	pid = pick->p_pid;
2623 	bcopy(pick->p_comm, comm, sizeof(comm));
2624 	PROC_UNLOCK(pick);
2625 
2626 	/* Print command, pid, state, utime, stime, %cpu, and rss. */
2627 	ttyprintf(tp,
2628 	    " cmd: %s %d [%s%s] %ld.%02ldu %ld.%02lds %d%% %ldk\n",
2629 	    comm, pid, stateprefix, state,
2630 	    (long)utime.tv_sec, utime.tv_usec / 10000,
2631 	    (long)stime.tv_sec, stime.tv_usec / 10000,
2632 	    pctcpu / 100, rss);
2633 	tp->t_rocount = 0;
2634 }
2635 
2636 /*
2637  * Returns 1 if p2 is "better" than p1
2638  *
2639  * The algorithm for picking the "interesting" process is thus:
2640  *
2641  *	1) Only foreground processes are eligible - implied.
2642  *	2) Runnable processes are favored over anything else.  The runner
2643  *	   with the highest cpu utilization is picked (p_estcpu).  Ties are
2644  *	   broken by picking the highest pid.
2645  *	3) The sleeper with the shortest sleep time is next.  With ties,
2646  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2647  *	4) Further ties are broken by picking the highest pid.
2648  */
2649 
2650 #define TESTAB(a, b)    ((a)<<1 | (b))
2651 #define ONLYA   2
2652 #define ONLYB   1
2653 #define BOTH    3
2654 
2655 static int
2656 proc_sum(struct proc *p, int *estcpup)
2657 {
2658 	struct thread *td;
2659 	int estcpu;
2660 	int val;
2661 
2662 	val = 0;
2663 	estcpu = 0;
2664 	FOREACH_THREAD_IN_PROC(p, td) {
2665 		thread_lock(td);
2666 		if (TD_ON_RUNQ(td) ||
2667 		    TD_IS_RUNNING(td))
2668 			val = 1;
2669 		estcpu += sched_pctcpu(td);
2670 		thread_unlock(td);
2671 	}
2672 	*estcpup = estcpu;
2673 
2674 	return (val);
2675 }
2676 
2677 static int
2678 thread_compare(struct thread *td, struct thread *td2)
2679 {
2680 	int runa, runb;
2681 	int slpa, slpb;
2682 	fixpt_t esta, estb;
2683 
2684 	if (td == NULL)
2685 		return (1);
2686 
2687 	/*
2688 	 * Fetch running stats, pctcpu usage, and interruptable flag.
2689  	 */
2690 	thread_lock(td);
2691 	runa = TD_IS_RUNNING(td) | TD_ON_RUNQ(td);
2692 	slpa = td->td_flags & TDF_SINTR;
2693 	esta = sched_pctcpu(td);
2694 	thread_unlock(td);
2695 	thread_lock(td2);
2696 	runb = TD_IS_RUNNING(td2) | TD_ON_RUNQ(td2);
2697 	estb = sched_pctcpu(td2);
2698 	slpb = td2->td_flags & TDF_SINTR;
2699 	thread_unlock(td2);
2700 	/*
2701 	 * see if at least one of them is runnable
2702 	 */
2703 	switch (TESTAB(runa, runb)) {
2704 	case ONLYA:
2705 		return (0);
2706 	case ONLYB:
2707 		return (1);
2708 	case BOTH:
2709 		break;
2710 	}
2711 	/*
2712 	 *  favor one with highest recent cpu utilization
2713 	 */
2714 	if (estb > esta)
2715 		return (1);
2716 	if (esta > estb)
2717 		return (0);
2718 	/*
2719 	 * favor one sleeping in a non-interruptible sleep
2720 	 */
2721 	switch (TESTAB(slpa, slpb)) {
2722 	case ONLYA:
2723 		return (0);
2724 	case ONLYB:
2725 		return (1);
2726 	case BOTH:
2727 		break;
2728 	}
2729 
2730 	return (td < td2);
2731 }
2732 
2733 static int
2734 proc_compare(struct proc *p1, struct proc *p2)
2735 {
2736 
2737 	int runa, runb;
2738 	fixpt_t esta, estb;
2739 
2740 	if (p1 == NULL)
2741 		return (1);
2742 
2743 	/*
2744 	 * Fetch various stats about these processes.  After we drop the
2745 	 * lock the information could be stale but the race is unimportant.
2746 	 */
2747 	PROC_SLOCK(p1);
2748 	runa = proc_sum(p1, &esta);
2749 	PROC_SUNLOCK(p1);
2750 	PROC_SLOCK(p2);
2751 	runb = proc_sum(p2, &estb);
2752 	PROC_SUNLOCK(p2);
2753 
2754 	/*
2755 	 * see if at least one of them is runnable
2756 	 */
2757 	switch (TESTAB(runa, runb)) {
2758 	case ONLYA:
2759 		return (0);
2760 	case ONLYB:
2761 		return (1);
2762 	case BOTH:
2763 		break;
2764 	}
2765 	/*
2766 	 *  favor one with highest recent cpu utilization
2767 	 */
2768 	if (estb > esta)
2769 		return (1);
2770 	if (esta > estb)
2771 		return (0);
2772 	/*
2773 	 * weed out zombies
2774 	 */
2775 	switch (TESTAB(p1->p_state == PRS_ZOMBIE, p2->p_state == PRS_ZOMBIE)) {
2776 	case ONLYA:
2777 		return (1);
2778 	case ONLYB:
2779 		return (0);
2780 	case BOTH:
2781 		break;
2782 	}
2783 
2784 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2785 }
2786 
2787 /*
2788  * Output char to tty; console putchar style.
2789  */
2790 int
2791 tputchar(int c, struct tty *tp)
2792 {
2793 	int s;
2794 
2795 	s = spltty();
2796 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2797 		splx(s);
2798 		return (-1);
2799 	}
2800 	if (c == '\n')
2801 		(void)ttyoutput('\r', tp);
2802 	(void)ttyoutput(c, tp);
2803 	ttstart(tp);
2804 	splx(s);
2805 	return (0);
2806 }
2807 
2808 /*
2809  * Sleep on chan, returning ERESTART if tty changed while we napped and
2810  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2811  * the tty is revoked, restarting a pending call will redo validation done
2812  * at the start of the call.
2813  */
2814 int
2815 ttysleep(struct tty *tp, void *chan, int pri, char *wmesg, int timo)
2816 {
2817 	int error;
2818 	int gen;
2819 
2820 	gen = tp->t_gen;
2821 	error = tsleep(chan, pri, wmesg, timo);
2822 	if (tp->t_state & TS_GONE)
2823 		return (ENXIO);
2824 	if (error)
2825 		return (error);
2826 	return (tp->t_gen == gen ? 0 : ERESTART);
2827 }
2828 
2829 /*
2830  * Gain a reference to a TTY
2831  */
2832 int
2833 ttyref(struct tty *tp)
2834 {
2835 	int i;
2836 
2837 	mtx_lock(&tp->t_mtx);
2838 	KASSERT(tp->t_refcnt > 0,
2839 	    ("ttyref(): tty refcnt is %d (%s)",
2840 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2841 	i = ++tp->t_refcnt;
2842 	mtx_unlock(&tp->t_mtx);
2843 	return (i);
2844 }
2845 
2846 /*
2847  * Drop a reference to a TTY.
2848  * When reference count drops to zero, we free it.
2849  */
2850 int
2851 ttyrel(struct tty *tp)
2852 {
2853 	int i;
2854 
2855 	mtx_lock(&tty_list_mutex);
2856 	mtx_lock(&tp->t_mtx);
2857 	KASSERT(tp->t_refcnt > 0,
2858 	    ("ttyrel(): tty refcnt is %d (%s)",
2859 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2860 	i = --tp->t_refcnt;
2861 	if (i != 0) {
2862 		mtx_unlock(&tp->t_mtx);
2863 		mtx_unlock(&tty_list_mutex);
2864 		return (i);
2865 	}
2866 	TAILQ_REMOVE(&tty_list, tp, t_list);
2867 	mtx_unlock(&tp->t_mtx);
2868 	mtx_unlock(&tty_list_mutex);
2869 	knlist_destroy(&tp->t_rsel.si_note);
2870 	knlist_destroy(&tp->t_wsel.si_note);
2871 	mtx_destroy(&tp->t_mtx);
2872 	free(tp, M_TTYS);
2873 	return (i);
2874 }
2875 
2876 /*
2877  * Allocate a tty struct.  Clists in the struct will be allocated by
2878  * tty_open().
2879  */
2880 struct tty *
2881 ttyalloc()
2882 {
2883 	struct tty *tp;
2884 
2885 	tp = malloc(sizeof *tp, M_TTYS, M_WAITOK | M_ZERO);
2886 	mtx_init(&tp->t_mtx, "tty", NULL, MTX_DEF);
2887 
2888 	/*
2889 	 * Set up the initial state
2890 	 */
2891 	tp->t_refcnt = 1;
2892 	tp->t_timeout = -1;
2893 	tp->t_dtr_wait = 3 * hz;
2894 
2895 	ttyinitmode(tp, 0, 0);
2896 	bcopy(ttydefchars, tp->t_init_in.c_cc, sizeof tp->t_init_in.c_cc);
2897 
2898 	/* Make callout the same as callin */
2899 	tp->t_init_out = tp->t_init_in;
2900 
2901 	mtx_lock(&tty_list_mutex);
2902 	TAILQ_INSERT_TAIL(&tty_list, tp, t_list);
2903 	mtx_unlock(&tty_list_mutex);
2904 	knlist_init(&tp->t_rsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2905 	knlist_init(&tp->t_wsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2906 	return (tp);
2907 }
2908 
2909 static void
2910 ttypurge(struct cdev *dev)
2911 {
2912 
2913 	if (dev->si_tty == NULL)
2914 		return;
2915 	ttygone(dev->si_tty);
2916 }
2917 
2918 /*
2919  * ttycreate()
2920  *
2921  * Create the device entries for this tty thereby opening it for business.
2922  *
2923  * The flags argument controls if "cua" units are created.
2924  *
2925  * The t_sc filed is copied to si_drv1 in the created cdevs.  This
2926  * is particularly important for ->t_cioctl() users.
2927  *
2928  * XXX: implement the init and lock devices by cloning.
2929  */
2930 
2931 int
2932 ttycreate(struct tty *tp, int flags, const char *fmt, ...)
2933 {
2934 	char namebuf[SPECNAMELEN - 3];		/* XXX space for "tty" */
2935 	struct cdevsw *csw = NULL;
2936 	int unit = 0;
2937 	va_list ap;
2938 	struct cdev *cp;
2939 	int i, minor, sminor, sunit;
2940 
2941 	mtx_assert(&Giant, MA_OWNED);
2942 
2943 	if (tty_unit == NULL)
2944 		tty_unit = new_unrhdr(0, 0xffff, NULL);
2945 
2946 	sunit = alloc_unr(tty_unit);
2947 	tp->t_devunit = sunit;
2948 
2949 	if (csw == NULL) {
2950 		csw = &tty_cdevsw;
2951 		unit = sunit;
2952 	}
2953 	KASSERT(csw->d_purge == NULL || csw->d_purge == ttypurge,
2954 	    ("tty should not have d_purge"));
2955 
2956 	csw->d_purge = ttypurge;
2957 
2958 	minor = unit2minor(unit);
2959 	sminor = unit2minor(sunit);
2960 	va_start(ap, fmt);
2961 	i = vsnrprintf(namebuf, sizeof namebuf, 32, fmt, ap);
2962 	va_end(ap);
2963 	KASSERT(i < sizeof namebuf, ("Too long tty name (%s)", namebuf));
2964 
2965 	cp = make_dev(csw, minor,
2966 	    UID_ROOT, GID_WHEEL, 0600, "tty%s", namebuf);
2967 	tp->t_dev = cp;
2968 	tp->t_mdev = cp;
2969 	cp->si_tty = tp;
2970 	cp->si_drv1 = tp->t_sc;
2971 
2972 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_INIT,
2973 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.init", namebuf);
2974 	dev_depends(tp->t_dev, cp);
2975 	cp->si_drv1 = tp->t_sc;
2976 	cp->si_drv2 = &tp->t_init_in;
2977 	cp->si_tty = tp;
2978 
2979 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_LOCK,
2980 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.lock", namebuf);
2981 	dev_depends(tp->t_dev, cp);
2982 	cp->si_drv1 = tp->t_sc;
2983 	cp->si_drv2 = &tp->t_lock_in;
2984 	cp->si_tty = tp;
2985 
2986 	if (flags & TS_CALLOUT) {
2987 		cp = make_dev(csw, minor | MINOR_CALLOUT,
2988 		    UID_UUCP, GID_DIALER, 0660, "cua%s", namebuf);
2989 		dev_depends(tp->t_dev, cp);
2990 		cp->si_drv1 = tp->t_sc;
2991 		cp->si_tty = tp;
2992 
2993 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_INIT,
2994 		    UID_UUCP, GID_DIALER, 0660, "cua%s.init", namebuf);
2995 		dev_depends(tp->t_dev, cp);
2996 		cp->si_drv1 = tp->t_sc;
2997 		cp->si_drv2 = &tp->t_init_out;
2998 		cp->si_tty = tp;
2999 
3000 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_LOCK,
3001 		    UID_UUCP, GID_DIALER, 0660, "cua%s.lock", namebuf);
3002 		dev_depends(tp->t_dev, cp);
3003 		cp->si_drv1 = tp->t_sc;
3004 		cp->si_drv2 = &tp->t_lock_out;
3005 		cp->si_tty = tp;
3006 	}
3007 
3008 	return (0);
3009 }
3010 
3011 /*
3012  * This function is called when the hardware disappears.  We set a flag
3013  * and wake up stuff so all sleeping threads will notice.
3014  */
3015 void
3016 ttygone(struct tty *tp)
3017 {
3018 
3019 	tp->t_state |= TS_GONE;
3020 	if (SEL_WAITING(&tp->t_rsel))
3021 		selwakeuppri(&tp->t_rsel, TTIPRI);
3022 	if (SEL_WAITING(&tp->t_wsel))
3023 		selwakeuppri(&tp->t_wsel, TTOPRI);
3024 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
3025 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
3026 	wakeup(&tp->t_dtr_wait);
3027 	wakeup(TSA_CARR_ON(tp));
3028 	wakeup(TSA_HUP_OR_INPUT(tp));
3029 	wakeup(TSA_OCOMPLETE(tp));
3030 	wakeup(TSA_OLOWAT(tp));
3031 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
3032 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
3033 	tt_purge(tp);
3034 }
3035 
3036 /*
3037  * ttyfree()
3038  *
3039  * Called when the driver is ready to free the tty structure.
3040  *
3041  * XXX: This shall sleep until all threads have left the driver.
3042  */
3043 void
3044 ttyfree(struct tty *tp)
3045 {
3046 	struct cdev *dev;
3047 	u_int unit;
3048 
3049 	mtx_assert(&Giant, MA_OWNED);
3050 	ttygone(tp);
3051 	unit = tp->t_devunit;
3052 	dev = tp->t_mdev;
3053 	tp->t_dev = NULL;
3054 	ttyrel(tp);
3055 	destroy_dev(dev);
3056 	free_unr(tty_unit, unit);
3057 }
3058 
3059 static int
3060 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
3061 {
3062 	struct tty *tp, *tp2;
3063 	struct xtty xt;
3064 	int error;
3065 
3066 	error = 0;
3067 	mtx_lock(&tty_list_mutex);
3068 	tp = TAILQ_FIRST(&tty_list);
3069 	if (tp != NULL)
3070 		ttyref(tp);
3071 	while (tp != NULL) {
3072 		bzero(&xt, sizeof xt);
3073 		xt.xt_size = sizeof xt;
3074 #define XT_COPY(field) xt.xt_##field = tp->t_##field
3075 		xt.xt_rawcc = tp->t_rawq.c_cc;
3076 		xt.xt_cancc = tp->t_canq.c_cc;
3077 		xt.xt_outcc = tp->t_outq.c_cc;
3078 		XT_COPY(line);
3079 
3080 		/*
3081 		 * XXX: We hold the tty list lock while doing this to
3082 		 * work around a race with pty/pts tty destruction.
3083 		 * They set t_dev to NULL and then call ttyrel() to
3084 		 * free the structure which will block on the list
3085 		 * lock before they call destroy_dev() on the cdev
3086 		 * backing t_dev.
3087 		 *
3088 		 * XXX: ttyfree() now does the same since it has been
3089 		 * fixed to not leak ttys.
3090 		 */
3091 		if (tp->t_dev != NULL)
3092 			xt.xt_dev = dev2udev(tp->t_dev);
3093 		XT_COPY(state);
3094 		XT_COPY(flags);
3095 		XT_COPY(timeout);
3096 		if (tp->t_pgrp != NULL)
3097 			xt.xt_pgid = tp->t_pgrp->pg_id;
3098 		if (tp->t_session != NULL)
3099 			xt.xt_sid = tp->t_session->s_sid;
3100 		XT_COPY(termios);
3101 		XT_COPY(winsize);
3102 		XT_COPY(column);
3103 		XT_COPY(rocount);
3104 		XT_COPY(rocol);
3105 		XT_COPY(ififosize);
3106 		XT_COPY(ihiwat);
3107 		XT_COPY(ilowat);
3108 		XT_COPY(ispeedwat);
3109 		XT_COPY(ohiwat);
3110 		XT_COPY(olowat);
3111 		XT_COPY(ospeedwat);
3112 #undef XT_COPY
3113 		mtx_unlock(&tty_list_mutex);
3114 		error = SYSCTL_OUT(req, &xt, sizeof xt);
3115 		if (error != 0) {
3116 			ttyrel(tp);
3117 			return (error);
3118 		}
3119 		mtx_lock(&tty_list_mutex);
3120 		tp2 = TAILQ_NEXT(tp, t_list);
3121 		if (tp2 != NULL)
3122 			ttyref(tp2);
3123 		mtx_unlock(&tty_list_mutex);
3124 		ttyrel(tp);
3125 		tp = tp2;
3126 		mtx_lock(&tty_list_mutex);
3127 	}
3128 	mtx_unlock(&tty_list_mutex);
3129 	return (0);
3130 }
3131 
3132 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
3133 	0, 0, sysctl_kern_ttys, "S,xtty", "All ttys");
3134 SYSCTL_LONG(_kern, OID_AUTO, tty_nin, CTLFLAG_RD,
3135 	&tk_nin, 0, "Total TTY in characters");
3136 SYSCTL_LONG(_kern, OID_AUTO, tty_nout, CTLFLAG_RD,
3137 	&tk_nout, 0, "Total TTY out characters");
3138 
3139 void
3140 nottystop(struct tty *tp, int rw)
3141 {
3142 
3143 	return;
3144 }
3145 
3146 int
3147 ttyopen(struct cdev *dev, int flag, int mode, struct thread *td)
3148 {
3149 	int		error;
3150 	int		s;
3151 	struct tty	*tp;
3152 
3153 	tp = dev->si_tty;
3154 
3155 	s = spltty();
3156 	/*
3157 	 * We jump to this label after all non-interrupted sleeps to pick
3158 	 * up any changes of the device state.
3159 	 */
3160 open_top:
3161 	if (tp->t_state & TS_GONE)
3162 		return (ENXIO);
3163 	error = ttydtrwaitsleep(tp);
3164 	if (error)
3165 		goto out;
3166 	if (tp->t_state & TS_ISOPEN) {
3167 		/*
3168 		 * The device is open, so everything has been initialized.
3169 		 * Handle conflicts.
3170 		 */
3171 		if (ISCALLOUT(dev) && !tp->t_actout)
3172 			return (EBUSY);
3173 		if (tp->t_actout && !ISCALLOUT(dev)) {
3174 			if (flag & O_NONBLOCK)
3175 				return (EBUSY);
3176 			error =	tsleep(&tp->t_actout,
3177 				       TTIPRI | PCATCH, "ttybi", 0);
3178 			if (error != 0 || (tp->t_flags & TS_GONE))
3179 				goto out;
3180 			goto open_top;
3181 		}
3182 		if (tp->t_state & TS_XCLUDE && priv_check(td,
3183 		    PRIV_TTY_EXCLUSIVE))
3184 			return (EBUSY);
3185 	} else {
3186 		/*
3187 		 * The device isn't open, so there are no conflicts.
3188 		 * Initialize it.  Initialization is done twice in many
3189 		 * cases: to preempt sleeping callin opens if we are
3190 		 * callout, and to complete a callin open after DCD rises.
3191 		 */
3192 		tp->t_termios = ISCALLOUT(dev) ? tp->t_init_out : tp->t_init_in;
3193 		tp->t_cflag = tp->t_termios.c_cflag;
3194 		if (tp->t_modem != NULL)
3195 			tt_modem(tp, SER_DTR | SER_RTS, 0);
3196 		++tp->t_wopeners;
3197 		error = tt_param(tp, &tp->t_termios);
3198 		--tp->t_wopeners;
3199 		if (error == 0)
3200 			error = tt_open(tp, dev);
3201 		if (error != 0)
3202 			goto out;
3203 		if (ISCALLOUT(dev) || (tt_modem(tp, 0, 0) & SER_DCD))
3204 			ttyld_modem(tp, 1);
3205 	}
3206 	/*
3207 	 * Wait for DCD if necessary.
3208 	 */
3209 	if (!(tp->t_state & TS_CARR_ON) && !ISCALLOUT(dev)
3210 	    && !(tp->t_cflag & CLOCAL) && !(flag & O_NONBLOCK)) {
3211 		++tp->t_wopeners;
3212 		error = tsleep(TSA_CARR_ON(tp), TTIPRI | PCATCH, "ttydcd", 0);
3213 		--tp->t_wopeners;
3214 		if (error != 0 || (tp->t_state & TS_GONE))
3215 			goto out;
3216 		goto open_top;
3217 	}
3218 	error =	ttyld_open(tp, dev);
3219 	ttyldoptim(tp);
3220 	if (tp->t_state & TS_ISOPEN && ISCALLOUT(dev))
3221 		tp->t_actout = TRUE;
3222 out:
3223 	splx(s);
3224 	if (!(tp->t_state & TS_ISOPEN) && tp->t_wopeners == 0)
3225 		tt_close(tp);
3226 	return (error);
3227 }
3228 
3229 int
3230 ttyclose(struct cdev *dev, int flag, int mode, struct thread *td)
3231 {
3232 	struct tty *tp;
3233 
3234 	tp = dev->si_tty;
3235 	ttyld_close(tp, flag);
3236 	ttyldoptim(tp);
3237 	tt_close(tp);
3238 	tp->t_do_timestamp = 0;
3239 	if (tp->t_pps != NULL)
3240 		tp->t_pps->ppsparam.mode = 0;
3241 	tty_close(tp);
3242 	return (0);
3243 }
3244 
3245 int
3246 ttyread(struct cdev *dev, struct uio *uio, int flag)
3247 {
3248 	struct tty *tp;
3249 
3250 	tp = tty_gettp(dev);
3251 
3252 	if (tp->t_state & TS_GONE)
3253 		return (ENODEV);
3254 	return (ttyld_read(tp, uio, flag));
3255 }
3256 
3257 int
3258 ttywrite(struct cdev *dev, struct uio *uio, int flag)
3259 {
3260 	struct tty *tp;
3261 
3262 	tp = tty_gettp(dev);
3263 
3264 	if (tp->t_state & TS_GONE)
3265 		return (ENODEV);
3266 	return (ttyld_write(tp, uio, flag));
3267 }
3268 
3269 int
3270 ttyioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3271 {
3272 	struct	tty *tp;
3273 	int	error;
3274 
3275 	tp = dev->si_tty;
3276 
3277 	if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) {
3278 		int cc;
3279 		struct termios *dt = (struct termios *)data;
3280 		struct termios *lt =
3281 		    ISCALLOUT(dev) ?  &tp->t_lock_out : &tp->t_lock_in;
3282 
3283 		dt->c_iflag = (tp->t_iflag & lt->c_iflag)
3284 		    | (dt->c_iflag & ~lt->c_iflag);
3285 		dt->c_oflag = (tp->t_oflag & lt->c_oflag)
3286 		    | (dt->c_oflag & ~lt->c_oflag);
3287 		dt->c_cflag = (tp->t_cflag & lt->c_cflag)
3288 		    | (dt->c_cflag & ~lt->c_cflag);
3289 		dt->c_lflag = (tp->t_lflag & lt->c_lflag)
3290 		    | (dt->c_lflag & ~lt->c_lflag);
3291 		for (cc = 0; cc < NCCS; ++cc)
3292 		    if (lt->c_cc[cc] != 0)
3293 		        dt->c_cc[cc] = tp->t_cc[cc];
3294 		if (lt->c_ispeed != 0)
3295 		    dt->c_ispeed = tp->t_ispeed;
3296 		if (lt->c_ospeed != 0)
3297 		    dt->c_ospeed = tp->t_ospeed;
3298 	}
3299 
3300 	error = ttyld_ioctl(tp, cmd, data, flag, td);
3301 	if (error == ENOIOCTL)
3302 		error = ttioctl(tp, cmd, data, flag);
3303 	ttyldoptim(tp);
3304 	if (error != ENOIOCTL)
3305 		return (error);
3306 	return (ENOTTY);
3307 }
3308 
3309 void
3310 ttyldoptim(struct tty *tp)
3311 {
3312 	struct termios	*t;
3313 
3314 	t = &tp->t_termios;
3315 	if (!(t->c_iflag & (ICRNL | IGNCR | IMAXBEL | INLCR | ISTRIP | IXON))
3316 	    && (!(t->c_iflag & BRKINT) || (t->c_iflag & IGNBRK))
3317 	    && (!(t->c_iflag & PARMRK)
3318 		|| (t->c_iflag & (IGNPAR | IGNBRK)) == (IGNPAR | IGNBRK))
3319 	    && !(t->c_lflag & (ECHO | ICANON | IEXTEN | ISIG | PENDIN))
3320 	    && linesw[tp->t_line]->l_rint == ttyinput)
3321 		tp->t_state |= TS_CAN_BYPASS_L_RINT;
3322 	else
3323 		tp->t_state &= ~TS_CAN_BYPASS_L_RINT;
3324 }
3325 
3326 static void
3327 ttydtrwaitwakeup(void *arg)
3328 {
3329 	struct tty *tp;
3330 
3331 	tp = arg;
3332 	tp->t_state &= ~TS_DTR_WAIT;
3333 	wakeup(&tp->t_dtr_wait);
3334 }
3335 
3336 
3337 void
3338 ttydtrwaitstart(struct tty *tp)
3339 {
3340 
3341 	if (tp->t_dtr_wait == 0)
3342 		return;
3343 	if (tp->t_state & TS_DTR_WAIT)
3344 		return;
3345 	timeout(ttydtrwaitwakeup, tp, tp->t_dtr_wait);
3346 	tp->t_state |= TS_DTR_WAIT;
3347 }
3348 
3349 int
3350 ttydtrwaitsleep(struct tty *tp)
3351 {
3352 	int error;
3353 
3354 	error = 0;
3355 	while (error == 0) {
3356 		if (tp->t_state & TS_GONE)
3357 			error = ENXIO;
3358 		else if (!(tp->t_state & TS_DTR_WAIT))
3359 			break;
3360 		else
3361 			error = tsleep(&tp->t_dtr_wait, TTIPRI | PCATCH,
3362 			    "dtrwait", 0);
3363 	}
3364 	return (error);
3365 }
3366 
3367 static int
3368 ttysopen(struct cdev *dev, int flag, int mode, struct thread *td)
3369 {
3370 	struct tty *tp;
3371 
3372 	tp = dev->si_tty;
3373 	KASSERT(tp != NULL,
3374 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3375 	if (tp->t_state & TS_GONE)
3376 		return (ENODEV);
3377 	return (0);
3378 }
3379 
3380 static int
3381 ttysclose(struct cdev *dev, int flag, int mode, struct thread *td)
3382 {
3383 
3384 	return (0);
3385 }
3386 
3387 static int
3388 ttysrdwr(struct cdev *dev, struct uio *uio, int flag)
3389 {
3390 
3391 	return (ENODEV);
3392 }
3393 
3394 static int
3395 ttysioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3396 {
3397 	struct tty	*tp;
3398 	int		error;
3399 	struct termios	*ct;
3400 
3401 	tp = dev->si_tty;
3402 	KASSERT(tp != NULL,
3403 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3404 	if (tp->t_state & TS_GONE)
3405 		return (ENODEV);
3406 	ct = dev->si_drv2;
3407 	switch (cmd) {
3408 	case TIOCSETA:
3409 		error = priv_check(td, PRIV_TTY_SETA);
3410 		if (error != 0)
3411 			return (error);
3412 		*ct = *(struct termios *)data;
3413 		return (0);
3414 	case TIOCGETA:
3415 		*(struct termios *)data = *ct;
3416 		return (0);
3417 	case TIOCGETD:
3418 		*(int *)data = TTYDISC;
3419 		return (0);
3420 	case TIOCGWINSZ:
3421 		bzero(data, sizeof(struct winsize));
3422 		return (0);
3423 	default:
3424 		if (tp->t_cioctl != NULL)
3425 			return(tp->t_cioctl(dev, cmd, data, flag, td));
3426 		return (ENOTTY);
3427 	}
3428 }
3429 
3430 /*
3431  * Initialize a tty to sane modes.
3432  */
3433 void
3434 ttyinitmode(struct tty *tp, int echo, int speed)
3435 {
3436 
3437 	if (speed == 0)
3438 		speed = TTYDEF_SPEED;
3439 	tp->t_init_in.c_iflag = TTYDEF_IFLAG;
3440 	tp->t_init_in.c_oflag = TTYDEF_OFLAG;
3441 	tp->t_init_in.c_cflag = TTYDEF_CFLAG;
3442 	if (echo)
3443 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_ECHO;
3444 	else
3445 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_NOECHO;
3446 
3447 	tp->t_init_in.c_ispeed = tp->t_init_in.c_ospeed = speed;
3448 	termioschars(&tp->t_init_in);
3449 	tp->t_init_out = tp->t_init_in;
3450 	tp->t_termios = tp->t_init_in;
3451 }
3452 
3453 /*
3454  * Use more "normal" termios paramters for consoles.
3455  */
3456 void
3457 ttyconsolemode(struct tty *tp, int speed)
3458 {
3459 
3460 	if (speed == 0)
3461 		speed = TTYDEF_SPEED;
3462 	ttyinitmode(tp, 1, speed);
3463 	tp->t_init_in.c_cflag |= CLOCAL;
3464 	tp->t_lock_out.c_cflag = tp->t_lock_in.c_cflag = CLOCAL;
3465 	tp->t_lock_out.c_ispeed = tp->t_lock_out.c_ospeed =
3466 	tp->t_lock_in.c_ispeed = tp->t_lock_in.c_ospeed = speed;
3467 	tp->t_init_out = tp->t_init_in;
3468 	tp->t_termios = tp->t_init_in;
3469 	ttsetwater(tp);
3470 }
3471 
3472 /*
3473  * Record the relationship between the serial ports notion of modem control
3474  * signals and the one used in certain ioctls in a way the compiler can enforce
3475  * XXX: We should define TIOCM_* in terms of SER_ if we can limit the
3476  * XXX: consequences of the #include work that would take.
3477  */
3478 CTASSERT(SER_DTR == TIOCM_DTR / 2);
3479 CTASSERT(SER_RTS == TIOCM_RTS / 2);
3480 CTASSERT(SER_STX == TIOCM_ST / 2);
3481 CTASSERT(SER_SRX == TIOCM_SR / 2);
3482 CTASSERT(SER_CTS == TIOCM_CTS / 2);
3483 CTASSERT(SER_DCD == TIOCM_DCD / 2);
3484 CTASSERT(SER_RI == TIOCM_RI / 2);
3485 CTASSERT(SER_DSR == TIOCM_DSR / 2);
3486 
3487