xref: /freebsd/sys/kern/tty.c (revision 2be1a816b9ff69588e55be0a84cbe2a31efc0f2f)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Copyright (c) 2002 Networks Associates Technologies, Inc.
11  * All rights reserved.
12  *
13  * Portions of this software were developed for the FreeBSD Project by
14  * ThinkSec AS and NAI Labs, the Security Research Division of Network
15  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
16  * ("CBOSS"), as part of the DARPA CHATS research program.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 4. Neither the name of the University nor the names of its contributors
27  *    may be used to endorse or promote products derived from this software
28  *    without specific prior written permission.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40  * SUCH DAMAGE.
41  *
42  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
43  */
44 
45 /*-
46  * TODO:
47  *	o Fix races for sending the start char in ttyflush().
48  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
49  *	  With luck, there will be MIN chars before select() returns().
50  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
51  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
52  *	  FIONREAD.
53  *	o Do the new sio locking stuff here and use it to avoid special
54  *	  case for EXTPROC?
55  *	o Lock PENDIN too?
56  *	o Move EXTPROC and/or PENDIN to t_state?
57  *	o Wrap most of ttioctl in spltty/splx.
58  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
59  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
60  *	o Don't allow certain termios flags to affect disciplines other
61  *	  than TTYDISC.  Cancel their effects before switch disciplines
62  *	  and ignore them if they are set while we are in another
63  *	  discipline.
64  *	o Now that historical speed conversions are handled here, don't
65  *	  do them in drivers.
66  *	o Check for TS_CARR_ON being set while everything is closed and not
67  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
68  *	  so it would live until the next open even if carrier drops.
69  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
70  *	  only when _all_ openers leave open().
71  */
72 
73 #include <sys/cdefs.h>
74 __FBSDID("$FreeBSD$");
75 
76 #include "opt_compat.h"
77 #include "opt_tty.h"
78 
79 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/filio.h>
82 #include <sys/lock.h>
83 #include <sys/mutex.h>
84 #include <sys/namei.h>
85 #include <sys/sx.h>
86 #if defined(COMPAT_43TTY)
87 #include <sys/ioctl_compat.h>
88 #endif
89 #include <sys/priv.h>
90 #include <sys/proc.h>
91 #define	TTYDEFCHARS
92 #include <sys/tty.h>
93 #undef	TTYDEFCHARS
94 #include <sys/fcntl.h>
95 #include <sys/conf.h>
96 #include <sys/poll.h>
97 #include <sys/kernel.h>
98 #include <sys/vnode.h>
99 #include <sys/serial.h>
100 #include <sys/signalvar.h>
101 #include <sys/resourcevar.h>
102 #include <sys/malloc.h>
103 #include <sys/filedesc.h>
104 #include <sys/sched.h>
105 #include <sys/sysctl.h>
106 #include <sys/timepps.h>
107 
108 #include <machine/stdarg.h>
109 
110 #include <vm/vm.h>
111 #include <vm/pmap.h>
112 #include <vm/vm_map.h>
113 
114 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
115 
116 long tk_cancc;
117 long tk_nin;
118 long tk_nout;
119 long tk_rawcc;
120 
121 static	d_open_t	ttysopen;
122 static	d_close_t	ttysclose;
123 static	d_read_t	ttysrdwr;
124 static	d_ioctl_t	ttysioctl;
125 static	d_purge_t	ttypurge;
126 
127 /* Default cdevsw for common tty devices */
128 static struct cdevsw tty_cdevsw = {
129 	.d_version =	D_VERSION,
130 	.d_open =	ttyopen,
131 	.d_close =	ttyclose,
132 	.d_ioctl =	ttyioctl,
133 	.d_purge =	ttypurge,
134 	.d_name =	"ttydrv",
135 	.d_flags =	D_TTY | D_NEEDGIANT,
136 };
137 
138 /* Cdevsw for slave tty devices */
139 static struct cdevsw ttys_cdevsw = {
140 	.d_version =	D_VERSION,
141 	.d_open =	ttysopen,
142 	.d_close =	ttysclose,
143 	.d_read =	ttysrdwr,
144 	.d_write =	ttysrdwr,
145 	.d_ioctl =	ttysioctl,
146 	.d_name =	"TTYS",
147 	.d_flags =	D_TTY | D_NEEDGIANT,
148 };
149 
150 static int	proc_sum(struct proc *, int *);
151 static int	proc_compare(struct proc *, struct proc *);
152 static int	thread_compare(struct thread *, struct thread *);
153 static int	ttnread(struct tty *tp);
154 static void	ttyecho(int c, struct tty *tp);
155 static int	ttyoutput(int c, struct tty *tp);
156 static void	ttypend(struct tty *tp);
157 static void	ttyretype(struct tty *tp);
158 static void	ttyrub(int c, struct tty *tp);
159 static void	ttyrubo(struct tty *tp, int cnt);
160 static void	ttyunblock(struct tty *tp);
161 static int	ttywflush(struct tty *tp);
162 static int	filt_ttyread(struct knote *kn, long hint);
163 static void	filt_ttyrdetach(struct knote *kn);
164 static int	filt_ttywrite(struct knote *kn, long hint);
165 static void	filt_ttywdetach(struct knote *kn);
166 
167 /*
168  * Table with character classes and parity. The 8th bit indicates parity,
169  * the 7th bit indicates the character is an alphameric or underscore (for
170  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
171  * are 0 then the character needs no special processing on output; classes
172  * other than 0 might be translated or (not currently) require delays.
173  */
174 #define	E	0x00	/* Even parity. */
175 #define	O	0x80	/* Odd parity. */
176 #define	PARITY(c)	(char_type[c] & O)
177 
178 #define	ALPHA	0x40	/* Alpha or underscore. */
179 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
180 
181 #define	CCLASSMASK	0x3f
182 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
183 
184 #define	BS	BACKSPACE
185 #define	CC	CONTROL
186 #define	CR	RETURN
187 #define	NA	ORDINARY | ALPHA
188 #define	NL	NEWLINE
189 #define	NO	ORDINARY
190 #define	TB	TAB
191 #define	VT	VTAB
192 
193 static u_char const char_type[] = {
194 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
195 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
196 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
197 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
198 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
199 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
200 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
201 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
202 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
203 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
204 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
205 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
206 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
207 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
208 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
209 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
210 	/*
211 	 * Meta chars; should be settable per character set;
212 	 * for now, treat them all as normal characters.
213 	 */
214 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
215 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
216 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
217 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
218 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
219 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
220 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
221 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
222 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
223 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
224 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
225 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
226 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
227 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
228 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
229 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
230 };
231 #undef	BS
232 #undef	CC
233 #undef	CR
234 #undef	NA
235 #undef	NL
236 #undef	NO
237 #undef	TB
238 #undef	VT
239 
240 /* Macros to clear/set/test flags. */
241 #define	SET(t, f)	(t) |= (f)
242 #define	CLR(t, f)	(t) &= ~(f)
243 #define	ISSET(t, f)	((t) & (f))
244 
245 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
246 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
247 
248 /*
249  * list of struct tty where pstat(8) can pick it up with sysctl
250  *
251  * The lock order is to grab the list mutex before the tty mutex.
252  * Together with additions going on the tail of the list, this allows
253  * the sysctl to avoid doing retries.
254  */
255 static	TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
256 static struct mtx tty_list_mutex;
257 MTX_SYSINIT(tty_list, &tty_list_mutex, "ttylist", MTX_DEF);
258 
259 static struct unrhdr *tty_unit;
260 
261 static int  drainwait = 5*60;
262 SYSCTL_INT(_kern, OID_AUTO, drainwait, CTLFLAG_RW, &drainwait,
263 	0, "Output drain timeout in seconds");
264 
265 static struct tty *
266 tty_gettp(struct cdev *dev)
267 {
268 	struct tty *tp;
269 	struct cdevsw *csw;
270 
271 	csw = dev_refthread(dev);
272 	KASSERT(csw != NULL, ("No cdevsw in ttycode (%s)", devtoname(dev)));
273 	KASSERT(csw->d_flags & D_TTY,
274 	    ("non D_TTY (%s) in tty code", devtoname(dev)));
275 	dev_relthread(dev);
276 	tp = dev->si_tty;
277 	KASSERT(tp != NULL,
278 	    ("no tty pointer on (%s) in tty code", devtoname(dev)));
279 	return (tp);
280 }
281 
282 /*
283  * Initial open of tty, or (re)entry to standard tty line discipline.
284  */
285 int
286 tty_open(struct cdev *device, struct tty *tp)
287 {
288 	int s;
289 
290 	s = spltty();
291 	tp->t_dev = device;
292 	tp->t_hotchar = 0;
293 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
294 		ttyref(tp);
295 		SET(tp->t_state, TS_ISOPEN);
296 		if (ISSET(tp->t_cflag, CLOCAL))
297 			SET(tp->t_state, TS_CONNECTED);
298 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
299 	}
300 	/* XXX don't hang forever on output */
301 	if (tp->t_timeout < 0)
302 		tp->t_timeout = drainwait*hz;
303 	ttsetwater(tp);
304 	splx(s);
305 	return (0);
306 }
307 
308 /*
309  * Handle close() on a tty line: flush and set to initial state,
310  * bumping generation number so that pending read/write calls
311  * can detect recycling of the tty.
312  * XXX our caller should have done `spltty(); l_close(); tty_close();'
313  * and l_close() should have flushed, but we repeat the spltty() and
314  * the flush in case there are buggy callers.
315  */
316 int
317 tty_close(struct tty *tp)
318 {
319 	int ostate, s;
320 
321 	funsetown(&tp->t_sigio);
322 	s = spltty();
323 	if (constty == tp)
324 		constty_clear();
325 
326 	ttyflush(tp, FREAD | FWRITE);
327 	clist_free_cblocks(&tp->t_canq);
328 	clist_free_cblocks(&tp->t_outq);
329 	clist_free_cblocks(&tp->t_rawq);
330 
331 	tp->t_gen++;
332 	tp->t_line = TTYDISC;
333 	tp->t_hotchar = 0;
334 	tp->t_pgrp = NULL;
335 	tp->t_session = NULL;
336 	ostate = tp->t_state;
337 	tp->t_state = 0;
338 	knlist_clear(&tp->t_rsel.si_note, 0);
339 	knlist_clear(&tp->t_wsel.si_note, 0);
340 	/*
341 	 * Both final close and revocation close might end up calling
342 	 * this method.  Only the thread clearing TS_ISOPEN should
343 	 * release the reference to the tty.
344 	 */
345 	if (ISSET(ostate, TS_ISOPEN))
346 		ttyrel(tp);
347 	splx(s);
348 	return (0);
349 }
350 
351 #define	FLUSHQ(q) {							\
352 	if ((q)->c_cc)							\
353 		ndflush(q, (q)->c_cc);					\
354 }
355 
356 /* Is 'c' a line delimiter ("break" character)? */
357 #define	TTBREAKC(c, lflag)							\
358 	((c) == '\n' || (((c) == cc[VEOF] ||				\
359 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
360 	 (c) != _POSIX_VDISABLE))
361 
362 /*
363  * Process input of a single character received on a tty.
364  */
365 int
366 ttyinput(int c, struct tty *tp)
367 {
368 	tcflag_t iflag, lflag;
369 	cc_t *cc;
370 	int i, err;
371 
372 	/*
373 	 * If input is pending take it first.
374 	 */
375 	lflag = tp->t_lflag;
376 	if (ISSET(lflag, PENDIN))
377 		ttypend(tp);
378 	/*
379 	 * Gather stats.
380 	 */
381 	if (ISSET(lflag, ICANON)) {
382 		++tk_cancc;
383 		++tp->t_cancc;
384 	} else {
385 		++tk_rawcc;
386 		++tp->t_rawcc;
387 	}
388 	++tk_nin;
389 
390 	/*
391 	 * Block further input iff:
392 	 * current input > threshold AND input is available to user program
393 	 * AND input flow control is enabled and not yet invoked.
394 	 * The 3 is slop for PARMRK.
395 	 */
396 	iflag = tp->t_iflag;
397 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
398 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
399 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
400 	    !ISSET(tp->t_state, TS_TBLOCK))
401 		ttyblock(tp);
402 
403 	/* Handle exceptional conditions (break, parity, framing). */
404 	cc = tp->t_cc;
405 	err = (ISSET(c, TTY_ERRORMASK));
406 	if (err) {
407 		CLR(c, TTY_ERRORMASK);
408 		if (ISSET(err, TTY_BI)) {
409 			if (ISSET(iflag, IGNBRK))
410 				return (0);
411 			if (ISSET(iflag, BRKINT)) {
412 				ttyflush(tp, FREAD | FWRITE);
413 				if (tp->t_pgrp != NULL) {
414 					PGRP_LOCK(tp->t_pgrp);
415 					pgsignal(tp->t_pgrp, SIGINT, 1);
416 					PGRP_UNLOCK(tp->t_pgrp);
417 				}
418 				goto endcase;
419 			}
420 			if (ISSET(iflag, PARMRK))
421 				goto parmrk;
422 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
423 			|| ISSET(err, TTY_FE)) {
424 			if (ISSET(iflag, IGNPAR))
425 				return (0);
426 			else if (ISSET(iflag, PARMRK)) {
427 parmrk:
428 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
429 				    MAX_INPUT - 3)
430 					goto input_overflow;
431 				(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
432 				(void)putc(0 | TTY_QUOTE, &tp->t_rawq);
433 				(void)putc(c | TTY_QUOTE, &tp->t_rawq);
434 				goto endcase;
435 			} else
436 				c = 0;
437 		}
438 	}
439 
440 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
441 		CLR(c, 0x80);
442 	if (!ISSET(lflag, EXTPROC)) {
443 		/*
444 		 * Check for literal nexting very first
445 		 */
446 		if (ISSET(tp->t_state, TS_LNCH)) {
447 			SET(c, TTY_QUOTE);
448 			CLR(tp->t_state, TS_LNCH);
449 		}
450 		/*
451 		 * Scan for special characters.  This code
452 		 * is really just a big case statement with
453 		 * non-constant cases.  The bottom of the
454 		 * case statement is labeled ``endcase'', so goto
455 		 * it after a case match, or similar.
456 		 */
457 
458 		/*
459 		 * Control chars which aren't controlled
460 		 * by ICANON, ISIG, or IXON.
461 		 */
462 		if (ISSET(lflag, IEXTEN)) {
463 			if (CCEQ(cc[VLNEXT], c)) {
464 				if (ISSET(lflag, ECHO)) {
465 					if (ISSET(lflag, ECHOE)) {
466 						(void)ttyoutput('^', tp);
467 						(void)ttyoutput('\b', tp);
468 					} else
469 						ttyecho(c, tp);
470 				}
471 				SET(tp->t_state, TS_LNCH);
472 				goto endcase;
473 			}
474 			if (CCEQ(cc[VDISCARD], c)) {
475 				if (ISSET(lflag, FLUSHO))
476 					CLR(tp->t_lflag, FLUSHO);
477 				else {
478 					ttyflush(tp, FWRITE);
479 					ttyecho(c, tp);
480 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
481 						ttyretype(tp);
482 					SET(tp->t_lflag, FLUSHO);
483 				}
484 				goto startoutput;
485 			}
486 		}
487 		/*
488 		 * Signals.
489 		 */
490 		if (ISSET(lflag, ISIG)) {
491 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
492 				if (!ISSET(lflag, NOFLSH))
493 					ttyflush(tp, FREAD | FWRITE);
494 				ttyecho(c, tp);
495 				if (tp->t_pgrp != NULL) {
496 					PGRP_LOCK(tp->t_pgrp);
497 					pgsignal(tp->t_pgrp,
498 					    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
499 					PGRP_UNLOCK(tp->t_pgrp);
500 				}
501 				goto endcase;
502 			}
503 			if (CCEQ(cc[VSUSP], c)) {
504 				if (!ISSET(lflag, NOFLSH))
505 					ttyflush(tp, FREAD);
506 				ttyecho(c, tp);
507 				if (tp->t_pgrp != NULL) {
508 					PGRP_LOCK(tp->t_pgrp);
509 					pgsignal(tp->t_pgrp, SIGTSTP, 1);
510 					PGRP_UNLOCK(tp->t_pgrp);
511 				}
512 				goto endcase;
513 			}
514 		}
515 		/*
516 		 * Handle start/stop characters.
517 		 */
518 		if (ISSET(iflag, IXON)) {
519 			if (CCEQ(cc[VSTOP], c)) {
520 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
521 					SET(tp->t_state, TS_TTSTOP);
522 					tt_stop(tp, 0);
523 					return (0);
524 				}
525 				if (!CCEQ(cc[VSTART], c))
526 					return (0);
527 				/*
528 				 * if VSTART == VSTOP then toggle
529 				 */
530 				goto endcase;
531 			}
532 			if (CCEQ(cc[VSTART], c))
533 				goto restartoutput;
534 		}
535 		/*
536 		 * IGNCR, ICRNL, & INLCR
537 		 */
538 		if (c == '\r') {
539 			if (ISSET(iflag, IGNCR))
540 				return (0);
541 			else if (ISSET(iflag, ICRNL))
542 				c = '\n';
543 		} else if (c == '\n' && ISSET(iflag, INLCR))
544 			c = '\r';
545 	}
546 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
547 		/*
548 		 * From here on down canonical mode character
549 		 * processing takes place.
550 		 */
551 		/*
552 		 * erase or erase2 (^H / ^?)
553 		 */
554 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
555 			if (tp->t_rawq.c_cc)
556 				ttyrub(unputc(&tp->t_rawq), tp);
557 			goto endcase;
558 		}
559 		/*
560 		 * kill (^U)
561 		 */
562 		if (CCEQ(cc[VKILL], c)) {
563 			if (ISSET(lflag, ECHOKE) &&
564 			    tp->t_rawq.c_cc == tp->t_rocount &&
565 			    !ISSET(lflag, ECHOPRT))
566 				while (tp->t_rawq.c_cc)
567 					ttyrub(unputc(&tp->t_rawq), tp);
568 			else {
569 				ttyecho(c, tp);
570 				if (ISSET(lflag, ECHOK) ||
571 				    ISSET(lflag, ECHOKE))
572 					ttyecho('\n', tp);
573 				FLUSHQ(&tp->t_rawq);
574 				tp->t_rocount = 0;
575 			}
576 			CLR(tp->t_state, TS_LOCAL);
577 			goto endcase;
578 		}
579 		/*
580 		 * word erase (^W)
581 		 */
582 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
583 			int ctype;
584 
585 			/*
586 			 * erase whitespace
587 			 */
588 			while ((c = unputc(&tp->t_rawq)) == ' ' || c == '\t')
589 				ttyrub(c, tp);
590 			if (c == -1)
591 				goto endcase;
592 			/*
593 			 * erase last char of word and remember the
594 			 * next chars type (for ALTWERASE)
595 			 */
596 			ttyrub(c, tp);
597 			c = unputc(&tp->t_rawq);
598 			if (c == -1)
599 				goto endcase;
600 			if (c == ' ' || c == '\t') {
601 				(void)putc(c, &tp->t_rawq);
602 				goto endcase;
603 			}
604 			ctype = ISALPHA(c);
605 			/*
606 			 * erase rest of word
607 			 */
608 			do {
609 				ttyrub(c, tp);
610 				c = unputc(&tp->t_rawq);
611 				if (c == -1)
612 					goto endcase;
613 			} while (c != ' ' && c != '\t' &&
614 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
615 			(void)putc(c, &tp->t_rawq);
616 			goto endcase;
617 		}
618 		/*
619 		 * reprint line (^R)
620 		 */
621 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
622 			ttyretype(tp);
623 			goto endcase;
624 		}
625 		/*
626 		 * ^T - kernel info and generate SIGINFO
627 		 */
628 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
629 			if (ISSET(lflag, ISIG) && tp->t_pgrp != NULL) {
630 				PGRP_LOCK(tp->t_pgrp);
631 				pgsignal(tp->t_pgrp, SIGINFO, 1);
632 				PGRP_UNLOCK(tp->t_pgrp);
633 			}
634 			if (!ISSET(lflag, NOKERNINFO))
635 				ttyinfo(tp);
636 			goto endcase;
637 		}
638 	}
639 	/*
640 	 * Check for input buffer overflow
641 	 */
642 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
643 input_overflow:
644 		if (ISSET(iflag, IMAXBEL)) {
645 			if (tp->t_outq.c_cc < tp->t_ohiwat)
646 				(void)ttyoutput(CTRL('g'), tp);
647 		}
648 		goto endcase;
649 	}
650 
651 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
652 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
653 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
654 
655 	/*
656 	 * Put data char in q for user and
657 	 * wakeup on seeing a line delimiter.
658 	 */
659 	if (putc(c, &tp->t_rawq) >= 0) {
660 		if (!ISSET(lflag, ICANON)) {
661 			ttwakeup(tp);
662 			ttyecho(c, tp);
663 			goto endcase;
664 		}
665 		if (TTBREAKC(c, lflag)) {
666 			tp->t_rocount = 0;
667 			catq(&tp->t_rawq, &tp->t_canq);
668 			ttwakeup(tp);
669 		} else if (tp->t_rocount++ == 0)
670 			tp->t_rocol = tp->t_column;
671 		if (ISSET(tp->t_state, TS_ERASE)) {
672 			/*
673 			 * end of prterase \.../
674 			 */
675 			CLR(tp->t_state, TS_ERASE);
676 			(void)ttyoutput('/', tp);
677 		}
678 		i = tp->t_column;
679 		ttyecho(c, tp);
680 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
681 			/*
682 			 * Place the cursor over the '^' of the ^D.
683 			 */
684 			i = imin(2, tp->t_column - i);
685 			while (i > 0) {
686 				(void)ttyoutput('\b', tp);
687 				i--;
688 			}
689 		}
690 	}
691 endcase:
692 	/*
693 	 * IXANY means allow any character to restart output.
694 	 */
695 	if (ISSET(tp->t_state, TS_TTSTOP) &&
696 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
697 		return (0);
698 restartoutput:
699 	CLR(tp->t_lflag, FLUSHO);
700 	CLR(tp->t_state, TS_TTSTOP);
701 startoutput:
702 	return (ttstart(tp));
703 }
704 
705 /*
706  * Output a single character on a tty, doing output processing
707  * as needed (expanding tabs, newline processing, etc.).
708  * Returns < 0 if succeeds, otherwise returns char to resend.
709  * Must be recursive.
710  */
711 static int
712 ttyoutput(int c, struct tty *tp)
713 {
714 	tcflag_t oflag;
715 	int col, s;
716 
717 	oflag = tp->t_oflag;
718 	if (!ISSET(oflag, OPOST)) {
719 		if (ISSET(tp->t_lflag, FLUSHO))
720 			return (-1);
721 		if (putc(c, &tp->t_outq))
722 			return (c);
723 		tk_nout++;
724 		tp->t_outcc++;
725 		return (-1);
726 	}
727 	/*
728 	 * Do tab expansion if OXTABS is set.  Special case if we external
729 	 * processing, we don't do the tab expansion because we'll probably
730 	 * get it wrong.  If tab expansion needs to be done, let it happen
731 	 * externally.
732 	 */
733 	CLR(c, ~TTY_CHARMASK);
734 	if (c == '\t' &&
735 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
736 		c = 8 - (tp->t_column & 7);
737 		if (!ISSET(tp->t_lflag, FLUSHO)) {
738 			s = spltty();		/* Don't interrupt tabs. */
739 			c -= b_to_q("        ", c, &tp->t_outq);
740 			tk_nout += c;
741 			tp->t_outcc += c;
742 			splx(s);
743 		}
744 		tp->t_column += c;
745 		return (c ? -1 : '\t');
746 	}
747 	if (c == CEOT && ISSET(oflag, ONOEOT))
748 		return (-1);
749 
750 	/*
751 	 * Newline translation: if ONLCR is set,
752 	 * translate newline into "\r\n".
753 	 */
754 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
755 		tk_nout++;
756 		tp->t_outcc++;
757 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
758 			return (c);
759 	}
760 	/* If OCRNL is set, translate "\r" into "\n". */
761 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
762 		c = '\n';
763 	/* If ONOCR is set, don't transmit CRs when on column 0. */
764 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
765 		return (-1);
766 
767 	tk_nout++;
768 	tp->t_outcc++;
769 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
770 		return (c);
771 
772 	col = tp->t_column;
773 	switch (CCLASS(c)) {
774 	case BACKSPACE:
775 		if (col > 0)
776 			--col;
777 		break;
778 	case CONTROL:
779 		break;
780 	case NEWLINE:
781 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
782 			col = 0;
783 		break;
784 	case RETURN:
785 		col = 0;
786 		break;
787 	case ORDINARY:
788 		++col;
789 		break;
790 	case TAB:
791 		col = (col + 8) & ~7;
792 		break;
793 	}
794 	tp->t_column = col;
795 	return (-1);
796 }
797 
798 /*
799  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
800  * has been called to do discipline-specific functions and/or reject any
801  * of these ioctl commands.
802  */
803 /* ARGSUSED */
804 int
805 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
806 {
807 	struct proc *p;
808 	struct thread *td;
809 	struct pgrp *pgrp;
810 	int s, error, bits, sig, sig2;
811 
812 	td = curthread;			/* XXX */
813 	p = td->td_proc;
814 
815 	/* If the ioctl involves modification, hang if in the background. */
816 	switch (cmd) {
817 	case  TIOCCBRK:
818 	case  TIOCCONS:
819 	case  TIOCDRAIN:
820 	case  TIOCEXCL:
821 	case  TIOCFLUSH:
822 #ifdef TIOCHPCL
823 	case  TIOCHPCL:
824 #endif
825 	case  TIOCNXCL:
826 	case  TIOCSBRK:
827 	case  TIOCSCTTY:
828 	case  TIOCSDRAINWAIT:
829 	case  TIOCSETA:
830 	case  TIOCSETAF:
831 	case  TIOCSETAW:
832 	case  TIOCSETD:
833 	case  TIOCSPGRP:
834 	case  TIOCSTART:
835 	case  TIOCSTAT:
836 	case  TIOCSTI:
837 	case  TIOCSTOP:
838 	case  TIOCSWINSZ:
839 #if defined(COMPAT_43TTY)
840 	case  TIOCLBIC:
841 	case  TIOCLBIS:
842 	case  TIOCLSET:
843 	case  TIOCSETC:
844 	case OTIOCSETD:
845 	case  TIOCSETN:
846 	case  TIOCSETP:
847 	case  TIOCSLTC:
848 #endif
849 		sx_slock(&proctree_lock);
850 		PROC_LOCK(p);
851 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
852 		    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
853 		    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
854 			pgrp = p->p_pgrp;
855 			PROC_UNLOCK(p);
856 			if (pgrp->pg_jobc == 0) {
857 				sx_sunlock(&proctree_lock);
858 				return (EIO);
859 			}
860 			PGRP_LOCK(pgrp);
861 			sx_sunlock(&proctree_lock);
862 			pgsignal(pgrp, SIGTTOU, 1);
863 			PGRP_UNLOCK(pgrp);
864 			error = ttysleep(tp, &lbolt, TTOPRI | PCATCH, "ttybg1",
865 					 0);
866 			if (error)
867 				return (error);
868 			sx_slock(&proctree_lock);
869 			PROC_LOCK(p);
870 		}
871 		PROC_UNLOCK(p);
872 		sx_sunlock(&proctree_lock);
873 		break;
874 	}
875 
876 
877 	if (tp->t_modem != NULL) {
878 		switch (cmd) {
879 		case TIOCSDTR:
880 			tt_modem(tp, SER_DTR, 0);
881 			return (0);
882 		case TIOCCDTR:
883 			tt_modem(tp, 0, SER_DTR);
884 			return (0);
885 		case TIOCMSET:
886 			bits = *(int *)data;
887 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
888 			sig2 = ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1;
889 			tt_modem(tp, sig, sig2);
890 			return (0);
891 		case TIOCMBIS:
892 			bits = *(int *)data;
893 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
894 			tt_modem(tp, sig, 0);
895 			return (0);
896 		case TIOCMBIC:
897 			bits = *(int *)data;
898 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
899 			tt_modem(tp, 0, sig);
900 			return (0);
901 		case TIOCMGET:
902 			sig = tt_modem(tp, 0, 0);
903 			/* See <sys/serial.h. for the "<< 1" stuff */
904 			bits = TIOCM_LE + (sig << 1);
905 			*(int *)data = bits;
906 			return (0);
907 		default:
908 			break;
909 		}
910 	}
911 
912 	if (tp->t_pps != NULL) {
913 		error = pps_ioctl(cmd, data, tp->t_pps);
914 		if (error != ENOIOCTL)
915 			return (error);
916 	}
917 
918 	switch (cmd) {			/* Process the ioctl. */
919 	case FIOASYNC:			/* set/clear async i/o */
920 		s = spltty();
921 		if (*(int *)data)
922 			SET(tp->t_state, TS_ASYNC);
923 		else
924 			CLR(tp->t_state, TS_ASYNC);
925 		splx(s);
926 		break;
927 	case FIONBIO:			/* set/clear non-blocking i/o */
928 		break;			/* XXX: delete. */
929 	case FIONREAD:			/* get # bytes to read */
930 		s = spltty();
931 		*(int *)data = ttnread(tp);
932 		splx(s);
933 		break;
934 
935 	case FIOSETOWN:
936 		/*
937 		 * Policy -- Don't allow FIOSETOWN on someone else's
938 		 *           controlling tty
939 		 */
940 		if (tp->t_session != NULL && !isctty(p, tp))
941 			return (ENOTTY);
942 
943 		error = fsetown(*(int *)data, &tp->t_sigio);
944 		if (error)
945 			return (error);
946 		break;
947 	case FIOGETOWN:
948 		if (tp->t_session != NULL && !isctty(p, tp))
949 			return (ENOTTY);
950 		*(int *)data = fgetown(&tp->t_sigio);
951 		break;
952 
953 	case TIOCEXCL:			/* set exclusive use of tty */
954 		s = spltty();
955 		SET(tp->t_state, TS_XCLUDE);
956 		splx(s);
957 		break;
958 	case TIOCFLUSH: {		/* flush buffers */
959 		int flags = *(int *)data;
960 
961 		if (flags == 0)
962 			flags = FREAD | FWRITE;
963 		else
964 			flags &= FREAD | FWRITE;
965 		ttyflush(tp, flags);
966 		break;
967 	}
968 	case TIOCCONS:			/* become virtual console */
969 		if (*(int *)data) {
970 			struct nameidata nid;
971 
972 			if (constty && constty != tp &&
973 			    ISSET(constty->t_state, TS_CONNECTED))
974 				return (EBUSY);
975 
976 			/* Ensure user can open the real console. */
977 			NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
978 			    "/dev/console", td);
979 			if ((error = namei(&nid)) != 0)
980 				return (error);
981 			NDFREE(&nid, NDF_ONLY_PNBUF);
982 			error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
983 			vput(nid.ni_vp);
984 			if (error)
985 				return (error);
986 
987 			constty_set(tp);
988 		} else if (tp == constty)
989 			constty_clear();
990 		break;
991 	case TIOCDRAIN:			/* wait till output drained */
992 		error = ttywait(tp);
993 		if (error)
994 			return (error);
995 		break;
996 	case TIOCGETA: {		/* get termios struct */
997 		struct termios *t = (struct termios *)data;
998 
999 		bcopy(&tp->t_termios, t, sizeof(struct termios));
1000 		break;
1001 	}
1002 	case TIOCGETD:			/* get line discipline */
1003 		*(int *)data = tp->t_line;
1004 		break;
1005 	case TIOCGWINSZ:		/* get window size */
1006 		*(struct winsize *)data = tp->t_winsize;
1007 		break;
1008 	case TIOCGPGRP:			/* get pgrp of tty */
1009 		if (!isctty(p, tp))
1010 			return (ENOTTY);
1011 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1012 		break;
1013 	case TIOCGSID:                  /* get sid of tty */
1014 		if (!isctty(p, tp))
1015 			return (ENOTTY);
1016 		*(int *)data = tp->t_session->s_sid;
1017 		break;
1018 #ifdef TIOCHPCL
1019 	case TIOCHPCL:			/* hang up on last close */
1020 		s = spltty();
1021 		SET(tp->t_cflag, HUPCL);
1022 		splx(s);
1023 		break;
1024 #endif
1025 	case TIOCMGDTRWAIT:
1026 		*(int *)data = tp->t_dtr_wait * 100 / hz;
1027 		break;
1028 	case TIOCMSDTRWAIT:
1029 		/* must be root since the wait applies to following logins */
1030 		error = priv_check(td, PRIV_TTY_DTRWAIT);
1031 		if (error)
1032 			return (error);
1033 		tp->t_dtr_wait = *(int *)data * hz / 100;
1034 		break;
1035 	case TIOCNXCL:			/* reset exclusive use of tty */
1036 		s = spltty();
1037 		CLR(tp->t_state, TS_XCLUDE);
1038 		splx(s);
1039 		break;
1040 	case TIOCOUTQ:			/* output queue size */
1041 		*(int *)data = tp->t_outq.c_cc;
1042 		break;
1043 	case TIOCSETA:			/* set termios struct */
1044 	case TIOCSETAW:			/* drain output, set */
1045 	case TIOCSETAF: {		/* drn out, fls in, set */
1046 		struct termios *t = (struct termios *)data;
1047 
1048 		if (t->c_ispeed == 0)
1049 			t->c_ispeed = t->c_ospeed;
1050 		if (t->c_ispeed == 0)
1051 			t->c_ispeed = tp->t_ospeed;
1052 		if (t->c_ispeed == 0)
1053 			return (EINVAL);
1054 		s = spltty();
1055 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1056 			error = ttywait(tp);
1057 			if (error) {
1058 				splx(s);
1059 				return (error);
1060 			}
1061 			if (cmd == TIOCSETAF)
1062 				ttyflush(tp, FREAD);
1063 		}
1064 		if (!ISSET(t->c_cflag, CIGNORE)) {
1065 			/*
1066 			 * Set device hardware.
1067 			 */
1068 			error = tt_param(tp, t);
1069 			if (error) {
1070 				splx(s);
1071 				return (error);
1072 			}
1073 			if (ISSET(t->c_cflag, CLOCAL) &&
1074 			    !ISSET(tp->t_cflag, CLOCAL)) {
1075 				/*
1076 				 * XXX disconnections would be too hard to
1077 				 * get rid of without this kludge.  The only
1078 				 * way to get rid of controlling terminals
1079 				 * is to exit from the session leader.
1080 				 */
1081 				CLR(tp->t_state, TS_ZOMBIE);
1082 
1083 				wakeup(TSA_CARR_ON(tp));
1084 				ttwakeup(tp);
1085 				ttwwakeup(tp);
1086 			}
1087 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1088 			     ISSET(t->c_cflag, CLOCAL)) &&
1089 			    !ISSET(tp->t_state, TS_ZOMBIE))
1090 				SET(tp->t_state, TS_CONNECTED);
1091 			else
1092 				CLR(tp->t_state, TS_CONNECTED);
1093 			tp->t_cflag = t->c_cflag;
1094 			tp->t_ispeed = t->c_ispeed;
1095 			if (t->c_ospeed != 0)
1096 				tp->t_ospeed = t->c_ospeed;
1097 			ttsetwater(tp);
1098 		}
1099 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1100 		    cmd != TIOCSETAF) {
1101 			if (ISSET(t->c_lflag, ICANON))
1102 				SET(tp->t_lflag, PENDIN);
1103 			else {
1104 				/*
1105 				 * XXX we really shouldn't allow toggling
1106 				 * ICANON while we're in a non-termios line
1107 				 * discipline.  Now we have to worry about
1108 				 * panicing for a null queue.
1109 				 */
1110 				if (tp->t_canq.c_cbreserved > 0 &&
1111 				    tp->t_rawq.c_cbreserved > 0) {
1112 					catq(&tp->t_rawq, &tp->t_canq);
1113 					/*
1114 					 * XXX the queue limits may be
1115 					 * different, so the old queue
1116 					 * swapping method no longer works.
1117 					 */
1118 					catq(&tp->t_canq, &tp->t_rawq);
1119 				}
1120 				CLR(tp->t_lflag, PENDIN);
1121 			}
1122 			ttwakeup(tp);
1123 		}
1124 		tp->t_iflag = t->c_iflag;
1125 		tp->t_oflag = t->c_oflag;
1126 		/*
1127 		 * Make the EXTPROC bit read only.
1128 		 */
1129 		if (ISSET(tp->t_lflag, EXTPROC))
1130 			SET(t->c_lflag, EXTPROC);
1131 		else
1132 			CLR(t->c_lflag, EXTPROC);
1133 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1134 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1135 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1136 			ttwakeup(tp);
1137 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1138 		splx(s);
1139 		break;
1140 	}
1141 	case TIOCSETD: {		/* set line discipline */
1142 		int t = *(int *)data;
1143 
1144 		if ((u_int)t >= nlinesw)
1145 			return (ENXIO);
1146 		if (t == tp->t_line)
1147 			return (0);
1148 		s = spltty();
1149 		ttyld_close(tp, flag);
1150 		tp->t_line = t;
1151 		/* XXX: we should use the correct cdev here */
1152 		error = ttyld_open(tp, tp->t_dev);
1153 		if (error) {
1154 			/*
1155 			 * If we fail to switch line discipline we cannot
1156 			 * fall back to the previous, because we can not
1157 			 * trust that ldisc to open successfully either.
1158 			 * Fall back to the default ldisc which we know
1159 			 * will allways succeed.
1160 			 */
1161 			tp->t_line = TTYDISC;
1162 			(void)ttyld_open(tp, tp->t_dev);
1163 		}
1164 		splx(s);
1165 		return (error);
1166 		break;
1167 	}
1168 	case TIOCSTART:			/* start output, like ^Q */
1169 		s = spltty();
1170 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1171 		    ISSET(tp->t_lflag, FLUSHO)) {
1172 			CLR(tp->t_lflag, FLUSHO);
1173 			CLR(tp->t_state, TS_TTSTOP);
1174 			ttstart(tp);
1175 		}
1176 		splx(s);
1177 		break;
1178 	case TIOCSTI:			/* simulate terminal input */
1179 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_TTY_STI))
1180 			return (EPERM);
1181 		if (!isctty(p, tp) && priv_check(td, PRIV_TTY_STI))
1182 			return (EACCES);
1183 		s = spltty();
1184 		ttyld_rint(tp, *(u_char *)data);
1185 		splx(s);
1186 		break;
1187 	case TIOCSTOP:			/* stop output, like ^S */
1188 		s = spltty();
1189 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1190 			SET(tp->t_state, TS_TTSTOP);
1191 			tt_stop(tp, 0);
1192 		}
1193 		splx(s);
1194 		break;
1195 	case TIOCSCTTY:			/* become controlling tty */
1196 		/* Session ctty vnode pointer set in vnode layer. */
1197 		sx_slock(&proctree_lock);
1198 		if (!SESS_LEADER(p) ||
1199 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1200 		     (tp->t_session != p->p_session))) {
1201 			sx_sunlock(&proctree_lock);
1202 			return (EPERM);
1203 		}
1204 		tp->t_session = p->p_session;
1205 		tp->t_pgrp = p->p_pgrp;
1206 		SESS_LOCK(p->p_session);
1207 		ttyref(tp);		/* ttyrel(): kern_proc.c:pgdelete() */
1208 		p->p_session->s_ttyp = tp;
1209 		SESS_UNLOCK(p->p_session);
1210 		PROC_LOCK(p);
1211 		p->p_flag |= P_CONTROLT;
1212 		PROC_UNLOCK(p);
1213 		sx_sunlock(&proctree_lock);
1214 		break;
1215 	case TIOCSPGRP: {		/* set pgrp of tty */
1216 		sx_slock(&proctree_lock);
1217 		pgrp = pgfind(*(int *)data);
1218 		if (!isctty(p, tp)) {
1219 			if (pgrp != NULL)
1220 				PGRP_UNLOCK(pgrp);
1221 			sx_sunlock(&proctree_lock);
1222 			return (ENOTTY);
1223 		}
1224 		if (pgrp == NULL) {
1225 			sx_sunlock(&proctree_lock);
1226 			return (EPERM);
1227 		}
1228 		PGRP_UNLOCK(pgrp);
1229 		if (pgrp->pg_session != p->p_session) {
1230 			sx_sunlock(&proctree_lock);
1231 			return (EPERM);
1232 		}
1233 		sx_sunlock(&proctree_lock);
1234 		tp->t_pgrp = pgrp;
1235 		break;
1236 	}
1237 	case TIOCSTAT:			/* simulate control-T */
1238 		s = spltty();
1239 		ttyinfo(tp);
1240 		splx(s);
1241 		break;
1242 	case TIOCSWINSZ:		/* set window size */
1243 		if (bcmp((caddr_t)&tp->t_winsize, data,
1244 		    sizeof (struct winsize))) {
1245 			tp->t_winsize = *(struct winsize *)data;
1246 			if (tp->t_pgrp != NULL) {
1247 				PGRP_LOCK(tp->t_pgrp);
1248 				pgsignal(tp->t_pgrp, SIGWINCH, 1);
1249 				PGRP_UNLOCK(tp->t_pgrp);
1250 			}
1251 		}
1252 		break;
1253 	case TIOCSDRAINWAIT:
1254 		error = priv_check(td, PRIV_TTY_DRAINWAIT);
1255 		if (error)
1256 			return (error);
1257 		tp->t_timeout = *(int *)data * hz;
1258 		wakeup(TSA_OCOMPLETE(tp));
1259 		wakeup(TSA_OLOWAT(tp));
1260 		break;
1261 	case TIOCGDRAINWAIT:
1262 		*(int *)data = tp->t_timeout / hz;
1263 		break;
1264 	case TIOCSBRK:
1265 		return (tt_break(tp, 1));
1266 	case TIOCCBRK:
1267 		return (tt_break(tp, 0));
1268 	default:
1269 #if defined(COMPAT_43TTY)
1270 		return (ttcompat(tp, cmd, data, flag));
1271 #else
1272 		return (ENOIOCTL);
1273 #endif
1274 	}
1275 	return (0);
1276 }
1277 
1278 int
1279 ttypoll(struct cdev *dev, int events, struct thread *td)
1280 {
1281 	int s;
1282 	int revents = 0;
1283 	struct tty *tp;
1284 
1285 	tp = tty_gettp(dev);
1286 
1287 	if (tp == NULL)	/* XXX used to return ENXIO, but that means true! */
1288 		return ((events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM))
1289 			| POLLHUP);
1290 
1291 	s = spltty();
1292 	if (events & (POLLIN | POLLRDNORM)) {
1293 		if (ISSET(tp->t_state, TS_ZOMBIE))
1294 			revents |= (events & (POLLIN | POLLRDNORM)) |
1295 			    POLLHUP;
1296 		else if (ttnread(tp) > 0)
1297 			revents |= events & (POLLIN | POLLRDNORM);
1298 		else
1299 			selrecord(td, &tp->t_rsel);
1300 	}
1301 	if (events & POLLOUT) {
1302 		if (ISSET(tp->t_state, TS_ZOMBIE))
1303 			revents |= POLLHUP;
1304 		else if (tp->t_outq.c_cc <= tp->t_olowat &&
1305 		    ISSET(tp->t_state, TS_CONNECTED))
1306 			revents |= events & POLLOUT;
1307 		else
1308 			selrecord(td, &tp->t_wsel);
1309 	}
1310 	splx(s);
1311 	return (revents);
1312 }
1313 
1314 static struct filterops ttyread_filtops =
1315 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1316 static struct filterops ttywrite_filtops =
1317 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1318 
1319 int
1320 ttykqfilter(struct cdev *dev, struct knote *kn)
1321 {
1322 	struct tty *tp;
1323 	struct knlist *klist;
1324 	int s;
1325 
1326 	tp = tty_gettp(dev);
1327 	if (tp->t_state & TS_GONE)
1328 		return (ENODEV);
1329 
1330 	switch (kn->kn_filter) {
1331 	case EVFILT_READ:
1332 		klist = &tp->t_rsel.si_note;
1333 		kn->kn_fop = &ttyread_filtops;
1334 		break;
1335 	case EVFILT_WRITE:
1336 		klist = &tp->t_wsel.si_note;
1337 		kn->kn_fop = &ttywrite_filtops;
1338 		break;
1339 	default:
1340 		return (EINVAL);
1341 	}
1342 
1343 	kn->kn_hook = (caddr_t)tp;
1344 
1345 	s = spltty();
1346 	knlist_add(klist, kn, 0);
1347 	splx(s);
1348 
1349 	return (0);
1350 }
1351 
1352 static void
1353 filt_ttyrdetach(struct knote *kn)
1354 {
1355 	struct tty *tp = (struct tty *)kn->kn_hook;
1356 	int s = spltty();
1357 
1358 	knlist_remove(&tp->t_rsel.si_note, kn, 0);
1359 	splx(s);
1360 }
1361 
1362 static int
1363 filt_ttyread(struct knote *kn, long hint)
1364 {
1365 	struct tty *tp = (struct tty *)kn->kn_hook;
1366 
1367 	kn->kn_data = ttnread(tp);
1368 	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE)) {
1369 		kn->kn_flags |= EV_EOF;
1370 		return (1);
1371 	}
1372 	return (kn->kn_data > 0);
1373 }
1374 
1375 static void
1376 filt_ttywdetach(struct knote *kn)
1377 {
1378 	struct tty *tp = (struct tty *)kn->kn_hook;
1379 	int s = spltty();
1380 
1381 	knlist_remove(&tp->t_wsel.si_note, kn, 0);
1382 	splx(s);
1383 }
1384 
1385 static int
1386 filt_ttywrite(struct knote *kn, long hint)
1387 {
1388 	struct tty *tp = (struct tty *)kn->kn_hook;
1389 
1390 	kn->kn_data = tp->t_outq.c_cc;
1391 	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE))
1392 		return (1);
1393 	return (kn->kn_data <= tp->t_olowat &&
1394 	    ISSET(tp->t_state, TS_CONNECTED));
1395 }
1396 
1397 /*
1398  * Must be called at spltty().
1399  */
1400 static int
1401 ttnread(struct tty *tp)
1402 {
1403 	int nread;
1404 
1405 	if (ISSET(tp->t_lflag, PENDIN))
1406 		ttypend(tp);
1407 	nread = tp->t_canq.c_cc;
1408 	if (!ISSET(tp->t_lflag, ICANON)) {
1409 		nread += tp->t_rawq.c_cc;
1410 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1411 			nread = 0;
1412 	}
1413 	return (nread);
1414 }
1415 
1416 /*
1417  * Wait for output to drain.
1418  */
1419 int
1420 ttywait(struct tty *tp)
1421 {
1422 	int error, s;
1423 
1424 	error = 0;
1425 	s = spltty();
1426 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1427 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1428 		tt_oproc(tp);
1429 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1430 		    ISSET(tp->t_state, TS_CONNECTED)) {
1431 			SET(tp->t_state, TS_SO_OCOMPLETE);
1432 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1433 					 TTOPRI | PCATCH, "ttywai",
1434 					 tp->t_timeout);
1435 			if (error) {
1436 				if (error == EWOULDBLOCK)
1437 					error = EIO;
1438 				break;
1439 			}
1440 		} else
1441 			break;
1442 	}
1443 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1444 		error = EIO;
1445 	splx(s);
1446 	return (error);
1447 }
1448 
1449 /*
1450  * Flush if successfully wait.
1451  */
1452 static int
1453 ttywflush(struct tty *tp)
1454 {
1455 	int error;
1456 
1457 	if ((error = ttywait(tp)) == 0)
1458 		ttyflush(tp, FREAD);
1459 	return (error);
1460 }
1461 
1462 /*
1463  * Flush tty read and/or write queues, notifying anyone waiting.
1464  */
1465 void
1466 ttyflush(struct tty *tp, int rw)
1467 {
1468 	int s;
1469 
1470 	s = spltty();
1471 #if 0
1472 again:
1473 #endif
1474 	if (rw & FWRITE) {
1475 		FLUSHQ(&tp->t_outq);
1476 		CLR(tp->t_state, TS_TTSTOP);
1477 	}
1478 	tt_stop(tp, rw);
1479 	if (rw & FREAD) {
1480 		FLUSHQ(&tp->t_canq);
1481 		FLUSHQ(&tp->t_rawq);
1482 		CLR(tp->t_lflag, PENDIN);
1483 		tp->t_rocount = 0;
1484 		tp->t_rocol = 0;
1485 		CLR(tp->t_state, TS_LOCAL);
1486 		ttwakeup(tp);
1487 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1488 			if (rw & FWRITE)
1489 				FLUSHQ(&tp->t_outq);
1490 			ttyunblock(tp);
1491 
1492 			/*
1493 			 * Don't let leave any state that might clobber the
1494 			 * next line discipline (although we should do more
1495 			 * to send the START char).  Not clearing the state
1496 			 * may have caused the "putc to a clist with no
1497 			 * reserved cblocks" panic/printf.
1498 			 */
1499 			CLR(tp->t_state, TS_TBLOCK);
1500 
1501 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1502 			if (ISSET(tp->t_iflag, IXOFF)) {
1503 				/*
1504 				 * XXX wait a bit in the hope that the stop
1505 				 * character (if any) will go out.  Waiting
1506 				 * isn't good since it allows races.  This
1507 				 * will be fixed when the stop character is
1508 				 * put in a special queue.  Don't bother with
1509 				 * the checks in ttywait() since the timeout
1510 				 * will save us.
1511 				 */
1512 				SET(tp->t_state, TS_SO_OCOMPLETE);
1513 				ttysleep(tp, TSA_OCOMPLETE(tp), TTOPRI,
1514 					 "ttyfls", hz / 10);
1515 				/*
1516 				 * Don't try sending the stop character again.
1517 				 */
1518 				CLR(tp->t_state, TS_TBLOCK);
1519 				goto again;
1520 			}
1521 #endif
1522 		}
1523 	}
1524 	if (rw & FWRITE) {
1525 		FLUSHQ(&tp->t_outq);
1526 		ttwwakeup(tp);
1527 	}
1528 	splx(s);
1529 }
1530 
1531 /*
1532  * Copy in the default termios characters.
1533  */
1534 void
1535 termioschars(struct termios *t)
1536 {
1537 
1538 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1539 }
1540 
1541 /*
1542  * Old interface.
1543  */
1544 void
1545 ttychars(struct tty *tp)
1546 {
1547 
1548 	termioschars(&tp->t_termios);
1549 }
1550 
1551 /*
1552  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1553  * on our input flow control bit and propagate the changes to the driver.
1554  * XXX the stop character should be put in a special high priority queue.
1555  */
1556 void
1557 ttyblock(struct tty *tp)
1558 {
1559 
1560 	SET(tp->t_state, TS_TBLOCK);
1561 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1562 	    putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1563 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1564 	ttstart(tp);
1565 }
1566 
1567 /*
1568  * Handle input low water.  Send start character for the IXOFF case.  Turn
1569  * off our input flow control bit and propagate the changes to the driver.
1570  * XXX the start character should be put in a special high priority queue.
1571  */
1572 static void
1573 ttyunblock(struct tty *tp)
1574 {
1575 
1576 	CLR(tp->t_state, TS_TBLOCK);
1577 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1578 	    putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1579 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1580 	ttstart(tp);
1581 }
1582 
1583 #ifdef notyet
1584 /* Not used by any current (i386) drivers. */
1585 /*
1586  * Restart after an inter-char delay.
1587  */
1588 void
1589 ttrstrt(void *tp_arg)
1590 {
1591 	struct tty *tp;
1592 	int s;
1593 
1594 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1595 
1596 	tp = tp_arg;
1597 	s = spltty();
1598 
1599 	CLR(tp->t_state, TS_TIMEOUT);
1600 	ttstart(tp);
1601 
1602 	splx(s);
1603 }
1604 #endif
1605 
1606 int
1607 ttstart(struct tty *tp)
1608 {
1609 
1610 	tt_oproc(tp);
1611 	return (0);
1612 }
1613 
1614 /*
1615  * "close" a line discipline
1616  */
1617 int
1618 ttylclose(struct tty *tp, int flag)
1619 {
1620 
1621 	if (flag & FNONBLOCK || ttywflush(tp))
1622 		ttyflush(tp, FREAD | FWRITE);
1623 	return (0);
1624 }
1625 
1626 /*
1627  * Handle modem control transition on a tty.
1628  * Flag indicates new state of carrier.
1629  * Returns 0 if the line should be turned off, otherwise 1.
1630  */
1631 int
1632 ttymodem(struct tty *tp, int flag)
1633 {
1634 
1635 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1636 		/*
1637 		 * MDMBUF: do flow control according to carrier flag
1638 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1639 		 * works if IXON and IXANY are clear.
1640 		 */
1641 		if (flag) {
1642 			CLR(tp->t_state, TS_CAR_OFLOW);
1643 			CLR(tp->t_state, TS_TTSTOP);
1644 			ttstart(tp);
1645 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1646 			SET(tp->t_state, TS_CAR_OFLOW);
1647 			SET(tp->t_state, TS_TTSTOP);
1648 			tt_stop(tp, 0);
1649 		}
1650 	} else if (flag == 0) {
1651 		/*
1652 		 * Lost carrier.
1653 		 */
1654 		CLR(tp->t_state, TS_CARR_ON);
1655 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1656 		    !ISSET(tp->t_cflag, CLOCAL)) {
1657 			SET(tp->t_state, TS_ZOMBIE);
1658 			CLR(tp->t_state, TS_CONNECTED);
1659 			if (tp->t_session) {
1660 				sx_slock(&proctree_lock);
1661 				if (tp->t_session && tp->t_session->s_leader) {
1662 					struct proc *p;
1663 
1664 					p = tp->t_session->s_leader;
1665 					PROC_LOCK(p);
1666 					psignal(p, SIGHUP);
1667 					PROC_UNLOCK(p);
1668 				}
1669 				sx_sunlock(&proctree_lock);
1670 			}
1671 			ttyflush(tp, FREAD | FWRITE);
1672 			return (0);
1673 		}
1674 	} else {
1675 		/*
1676 		 * Carrier now on.
1677 		 */
1678 		SET(tp->t_state, TS_CARR_ON);
1679 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1680 			SET(tp->t_state, TS_CONNECTED);
1681 		wakeup(TSA_CARR_ON(tp));
1682 		ttwakeup(tp);
1683 		ttwwakeup(tp);
1684 	}
1685 	return (1);
1686 }
1687 
1688 /*
1689  * Reinput pending characters after state switch
1690  * call at spltty().
1691  */
1692 static void
1693 ttypend(struct tty *tp)
1694 {
1695 	struct clist tq;
1696 	int c;
1697 
1698 	CLR(tp->t_lflag, PENDIN);
1699 	SET(tp->t_state, TS_TYPEN);
1700 	/*
1701 	 * XXX this assumes too much about clist internals.  It may even
1702 	 * fail if the cblock slush pool is empty.  We can't allocate more
1703 	 * cblocks here because we are called from an interrupt handler
1704 	 * and clist_alloc_cblocks() can wait.
1705 	 */
1706 	tq = tp->t_rawq;
1707 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1708 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1709 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1710 	while ((c = getc(&tq)) >= 0)
1711 		ttyinput(c, tp);
1712 	CLR(tp->t_state, TS_TYPEN);
1713 }
1714 
1715 /*
1716  * Process a read call on a tty device.
1717  */
1718 int
1719 ttread(struct tty *tp, struct uio *uio, int flag)
1720 {
1721 	struct clist *qp;
1722 	int c;
1723 	tcflag_t lflag;
1724 	cc_t *cc = tp->t_cc;
1725 	struct thread *td;
1726 	struct proc *p;
1727 	int s, first, error = 0;
1728 	int has_stime = 0, last_cc = 0;
1729 	long slp = 0;		/* XXX this should be renamed `timo'. */
1730 	struct timeval stime = { 0, 0 };
1731 	struct pgrp *pg;
1732 
1733 	td = curthread;
1734 	p = td->td_proc;
1735 loop:
1736 	s = spltty();
1737 	lflag = tp->t_lflag;
1738 	/*
1739 	 * take pending input first
1740 	 */
1741 	if (ISSET(lflag, PENDIN)) {
1742 		ttypend(tp);
1743 		splx(s);	/* reduce latency */
1744 		s = spltty();
1745 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1746 	}
1747 
1748 	/*
1749 	 * Hang process if it's in the background.
1750 	 */
1751 	if (isbackground(p, tp)) {
1752 		splx(s);
1753 		sx_slock(&proctree_lock);
1754 		PROC_LOCK(p);
1755 		if (SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTIN) ||
1756 		    SIGISMEMBER(td->td_sigmask, SIGTTIN) ||
1757 		    (p->p_flag & P_PPWAIT) || p->p_pgrp->pg_jobc == 0) {
1758 			PROC_UNLOCK(p);
1759 			sx_sunlock(&proctree_lock);
1760 			return (EIO);
1761 		}
1762 		pg = p->p_pgrp;
1763 		PROC_UNLOCK(p);
1764 		PGRP_LOCK(pg);
1765 		sx_sunlock(&proctree_lock);
1766 		pgsignal(pg, SIGTTIN, 1);
1767 		PGRP_UNLOCK(pg);
1768 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg2", 0);
1769 		if (error)
1770 			return (error);
1771 		goto loop;
1772 	}
1773 
1774 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1775 		splx(s);
1776 		return (0);	/* EOF */
1777 	}
1778 
1779 	/*
1780 	 * If canonical, use the canonical queue,
1781 	 * else use the raw queue.
1782 	 *
1783 	 * (should get rid of clists...)
1784 	 */
1785 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1786 
1787 	if (flag & IO_NDELAY) {
1788 		if (qp->c_cc > 0)
1789 			goto read;
1790 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1791 			splx(s);
1792 			return (0);
1793 		}
1794 		splx(s);
1795 		return (EWOULDBLOCK);
1796 	}
1797 	if (!ISSET(lflag, ICANON)) {
1798 		int m = cc[VMIN];
1799 		long t = cc[VTIME];
1800 		struct timeval timecopy;
1801 
1802 		/*
1803 		 * Check each of the four combinations.
1804 		 * (m > 0 && t == 0) is the normal read case.
1805 		 * It should be fairly efficient, so we check that and its
1806 		 * companion case (m == 0 && t == 0) first.
1807 		 * For the other two cases, we compute the target sleep time
1808 		 * into slp.
1809 		 */
1810 		if (t == 0) {
1811 			if (qp->c_cc < m)
1812 				goto sleep;
1813 			if (qp->c_cc > 0)
1814 				goto read;
1815 
1816 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1817 			splx(s);
1818 			return (0);
1819 		}
1820 		t *= 100000;		/* time in us */
1821 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1822 			 ((t1).tv_usec - (t2).tv_usec))
1823 		if (m > 0) {
1824 			if (qp->c_cc <= 0)
1825 				goto sleep;
1826 			if (qp->c_cc >= m)
1827 				goto read;
1828 			getmicrotime(&timecopy);
1829 			if (!has_stime) {
1830 				/* first character, start timer */
1831 				has_stime = 1;
1832 				stime = timecopy;
1833 				slp = t;
1834 			} else if (qp->c_cc > last_cc) {
1835 				/* got a character, restart timer */
1836 				stime = timecopy;
1837 				slp = t;
1838 			} else {
1839 				/* nothing, check expiration */
1840 				slp = t - diff(timecopy, stime);
1841 				if (slp <= 0)
1842 					goto read;
1843 			}
1844 			last_cc = qp->c_cc;
1845 		} else {	/* m == 0 */
1846 			if (qp->c_cc > 0)
1847 				goto read;
1848 			getmicrotime(&timecopy);
1849 			if (!has_stime) {
1850 				has_stime = 1;
1851 				stime = timecopy;
1852 				slp = t;
1853 			} else {
1854 				slp = t - diff(timecopy, stime);
1855 				if (slp <= 0) {
1856 					/* Timed out, but 0 is enough input. */
1857 					splx(s);
1858 					return (0);
1859 				}
1860 			}
1861 		}
1862 #undef diff
1863 		if (slp != 0) {
1864 			struct timeval tv;	/* XXX style bug. */
1865 
1866 			tv.tv_sec = slp / 1000000;
1867 			tv.tv_usec = slp % 1000000;
1868 			slp = tvtohz(&tv);
1869 			/*
1870 			 * XXX bad variable names.  slp was the timeout in
1871 			 * usec.  Now it is the timeout in ticks.
1872 			 */
1873 		}
1874 		goto sleep;
1875 	}
1876 	if (qp->c_cc <= 0) {
1877 sleep:
1878 		/*
1879 		 * There is no input, or not enough input and we can block.
1880 		 */
1881 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), TTIPRI | PCATCH,
1882 				 ISSET(tp->t_state, TS_CONNECTED) ?
1883 				 "ttyin" : "ttyhup", (int)slp);
1884 		splx(s);
1885 		if (error == EWOULDBLOCK)
1886 			error = 0;
1887 		else if (error)
1888 			return (error);
1889 		/*
1890 		 * XXX what happens if another process eats some input
1891 		 * while we are asleep (not just here)?  It would be
1892 		 * safest to detect changes and reset our state variables
1893 		 * (has_stime and last_cc).
1894 		 */
1895 		slp = 0;
1896 		goto loop;
1897 	}
1898 read:
1899 	splx(s);
1900 	/*
1901 	 * Input present, check for input mapping and processing.
1902 	 */
1903 	first = 1;
1904 	if (ISSET(lflag, ICANON | ISIG))
1905 		goto slowcase;
1906 	for (;;) {
1907 		char ibuf[IBUFSIZ];
1908 		int icc;
1909 
1910 		icc = imin(uio->uio_resid, IBUFSIZ);
1911 		icc = q_to_b(qp, ibuf, icc);
1912 		if (icc <= 0) {
1913 			if (first)
1914 				goto loop;
1915 			break;
1916 		}
1917 		error = uiomove(ibuf, icc, uio);
1918 		/*
1919 		 * XXX if there was an error then we should ungetc() the
1920 		 * unmoved chars and reduce icc here.
1921 		 */
1922 		if (error)
1923 			break;
1924 		if (uio->uio_resid == 0)
1925 			break;
1926 		first = 0;
1927 	}
1928 	goto out;
1929 slowcase:
1930 	for (;;) {
1931 		c = getc(qp);
1932 		if (c < 0) {
1933 			if (first)
1934 				goto loop;
1935 			break;
1936 		}
1937 		/*
1938 		 * delayed suspend (^Y)
1939 		 */
1940 		if (CCEQ(cc[VDSUSP], c) &&
1941 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1942 			if (tp->t_pgrp != NULL) {
1943 				PGRP_LOCK(tp->t_pgrp);
1944 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
1945 				PGRP_UNLOCK(tp->t_pgrp);
1946 			}
1947 			if (first) {
1948 				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
1949 						 "ttybg3", 0);
1950 				if (error)
1951 					break;
1952 				goto loop;
1953 			}
1954 			break;
1955 		}
1956 		/*
1957 		 * Interpret EOF only in canonical mode.
1958 		 */
1959 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1960 			break;
1961 		/*
1962 		 * Give user character.
1963 		 */
1964 		error = ureadc(c, uio);
1965 		if (error)
1966 			/* XXX should ungetc(c, qp). */
1967 			break;
1968 		if (uio->uio_resid == 0)
1969 			break;
1970 		/*
1971 		 * In canonical mode check for a "break character"
1972 		 * marking the end of a "line of input".
1973 		 */
1974 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1975 			break;
1976 		first = 0;
1977 	}
1978 
1979 out:
1980 	/*
1981 	 * Look to unblock input now that (presumably)
1982 	 * the input queue has gone down.
1983 	 */
1984 	s = spltty();
1985 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1986 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1987 		ttyunblock(tp);
1988 	splx(s);
1989 
1990 	return (error);
1991 }
1992 
1993 /*
1994  * Check the output queue on tp for space for a kernel message (from uprintf
1995  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1996  * lose messages due to normal flow control, but don't let the tty run amok.
1997  * Sleeps here are not interruptible, but we return prematurely if new signals
1998  * arrive.
1999  */
2000 int
2001 ttycheckoutq(struct tty *tp, int wait)
2002 {
2003 	int hiwat, s;
2004 	sigset_t oldmask;
2005 	struct thread *td;
2006 	struct proc *p;
2007 
2008 	td = curthread;
2009 	p = td->td_proc;
2010 	hiwat = tp->t_ohiwat;
2011 	SIGEMPTYSET(oldmask);
2012 	s = spltty();
2013 	if (wait) {
2014 		PROC_LOCK(p);
2015 		oldmask = td->td_siglist;
2016 		PROC_UNLOCK(p);
2017 	}
2018 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100)
2019 		while (tp->t_outq.c_cc > hiwat) {
2020 			ttstart(tp);
2021 			if (tp->t_outq.c_cc <= hiwat)
2022 				break;
2023 			if (!wait) {
2024 				splx(s);
2025 				return (0);
2026 			}
2027 			PROC_LOCK(p);
2028 			if (!SIGSETEQ(td->td_siglist, oldmask)) {
2029 				PROC_UNLOCK(p);
2030 				splx(s);
2031 				return (0);
2032 			}
2033 			PROC_UNLOCK(p);
2034 			SET(tp->t_state, TS_SO_OLOWAT);
2035 			tsleep(TSA_OLOWAT(tp), PZERO - 1, "ttoutq", hz);
2036 		}
2037 	splx(s);
2038 	return (1);
2039 }
2040 
2041 /*
2042  * Process a write call on a tty device.
2043  */
2044 int
2045 ttwrite(struct tty *tp, struct uio *uio, int flag)
2046 {
2047 	char *cp = NULL;
2048 	int cc, ce;
2049 	struct thread *td;
2050 	struct proc *p;
2051 	int i, hiwat, cnt, error, s;
2052 	char obuf[OBUFSIZ];
2053 
2054 	hiwat = tp->t_ohiwat;
2055 	cnt = uio->uio_resid;
2056 	error = 0;
2057 	cc = 0;
2058 	td = curthread;
2059 	p = td->td_proc;
2060 loop:
2061 	s = spltty();
2062 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2063 		splx(s);
2064 		if (uio->uio_resid == cnt)
2065 			error = EIO;
2066 		goto out;
2067 	}
2068 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2069 		if (flag & IO_NDELAY) {
2070 			splx(s);
2071 			error = EWOULDBLOCK;
2072 			goto out;
2073 		}
2074 		error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
2075 				 "ttywdcd", 0);
2076 		splx(s);
2077 		if (error)
2078 			goto out;
2079 		goto loop;
2080 	}
2081 	splx(s);
2082 	/*
2083 	 * Hang the process if it's in the background.
2084 	 */
2085 	sx_slock(&proctree_lock);
2086 	PROC_LOCK(p);
2087 	if (isbackground(p, tp) &&
2088 	    ISSET(tp->t_lflag, TOSTOP) && !(p->p_flag & P_PPWAIT) &&
2089 	    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
2090 	    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
2091 		if (p->p_pgrp->pg_jobc == 0) {
2092 			PROC_UNLOCK(p);
2093 			sx_sunlock(&proctree_lock);
2094 			error = EIO;
2095 			goto out;
2096 		}
2097 		PROC_UNLOCK(p);
2098 		PGRP_LOCK(p->p_pgrp);
2099 		sx_sunlock(&proctree_lock);
2100 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2101 		PGRP_UNLOCK(p->p_pgrp);
2102 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg4", 0);
2103 		if (error)
2104 			goto out;
2105 		goto loop;
2106 	} else {
2107 		PROC_UNLOCK(p);
2108 		sx_sunlock(&proctree_lock);
2109 	}
2110 	/*
2111 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2112 	 * output translation.  Keep track of high water mark, sleep on
2113 	 * overflow awaiting device aid in acquiring new space.
2114 	 */
2115 	while (uio->uio_resid > 0 || cc > 0) {
2116 		if (ISSET(tp->t_lflag, FLUSHO)) {
2117 			uio->uio_resid = 0;
2118 			return (0);
2119 		}
2120 		if (tp->t_outq.c_cc > hiwat)
2121 			goto ovhiwat;
2122 		/*
2123 		 * Grab a hunk of data from the user, unless we have some
2124 		 * leftover from last time.
2125 		 */
2126 		if (cc == 0) {
2127 			cc = imin(uio->uio_resid, OBUFSIZ);
2128 			cp = obuf;
2129 			error = uiomove(cp, cc, uio);
2130 			if (error) {
2131 				cc = 0;
2132 				break;
2133 			}
2134 		}
2135 		/*
2136 		 * If nothing fancy need be done, grab those characters we
2137 		 * can handle without any of ttyoutput's processing and
2138 		 * just transfer them to the output q.  For those chars
2139 		 * which require special processing (as indicated by the
2140 		 * bits in char_type), call ttyoutput.  After processing
2141 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2142 		 * immediately.
2143 		 */
2144 		while (cc > 0) {
2145 			if (!ISSET(tp->t_oflag, OPOST))
2146 				ce = cc;
2147 			else {
2148 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2149 						char_type, CCLASSMASK);
2150 				/*
2151 				 * If ce is zero, then we're processing
2152 				 * a special character through ttyoutput.
2153 				 */
2154 				if (ce == 0) {
2155 					tp->t_rocount = 0;
2156 					if (ttyoutput(*cp, tp) >= 0) {
2157 						/* No Clists, wait a bit. */
2158 						ttstart(tp);
2159 						if (flag & IO_NDELAY) {
2160 							error = EWOULDBLOCK;
2161 							goto out;
2162 						}
2163 						error = ttysleep(tp, &lbolt,
2164 								 TTOPRI|PCATCH,
2165 								 "ttybf1", 0);
2166 						if (error)
2167 							goto out;
2168 						goto loop;
2169 					}
2170 					cp++;
2171 					cc--;
2172 					if (ISSET(tp->t_lflag, FLUSHO) ||
2173 					    tp->t_outq.c_cc > hiwat)
2174 						goto ovhiwat;
2175 					continue;
2176 				}
2177 			}
2178 			/*
2179 			 * A bunch of normal characters have been found.
2180 			 * Transfer them en masse to the output queue and
2181 			 * continue processing at the top of the loop.
2182 			 * If there are any further characters in this
2183 			 * <= OBUFSIZ chunk, the first should be a character
2184 			 * requiring special handling by ttyoutput.
2185 			 */
2186 			tp->t_rocount = 0;
2187 			i = b_to_q(cp, ce, &tp->t_outq);
2188 			ce -= i;
2189 			tp->t_column += ce;
2190 			cp += ce, cc -= ce, tk_nout += ce;
2191 			tp->t_outcc += ce;
2192 			if (i > 0) {
2193 				/* No Clists, wait a bit. */
2194 				ttstart(tp);
2195 				if (flag & IO_NDELAY) {
2196 					error = EWOULDBLOCK;
2197 					goto out;
2198 				}
2199 				error = ttysleep(tp, &lbolt, TTOPRI | PCATCH,
2200 						 "ttybf2", 0);
2201 				if (error)
2202 					goto out;
2203 				goto loop;
2204 			}
2205 			if (ISSET(tp->t_lflag, FLUSHO) ||
2206 			    tp->t_outq.c_cc > hiwat)
2207 				break;
2208 		}
2209 		ttstart(tp);
2210 	}
2211 out:
2212 	/*
2213 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2214 	 * offset and iov pointers have moved forward, but it doesn't matter
2215 	 * (the call will either return short or restart with a new uio).
2216 	 */
2217 	uio->uio_resid += cc;
2218 	return (error);
2219 
2220 ovhiwat:
2221 	ttstart(tp);
2222 	s = spltty();
2223 	/*
2224 	 * This can only occur if FLUSHO is set in t_lflag,
2225 	 * or if ttstart/oproc is synchronous (or very fast).
2226 	 */
2227 	if (tp->t_outq.c_cc <= hiwat) {
2228 		splx(s);
2229 		goto loop;
2230 	}
2231 	if (flag & IO_NDELAY) {
2232 		splx(s);
2233 		uio->uio_resid += cc;
2234 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2235 	}
2236 	SET(tp->t_state, TS_SO_OLOWAT);
2237 	error = ttysleep(tp, TSA_OLOWAT(tp), TTOPRI | PCATCH, "ttywri",
2238 			 tp->t_timeout);
2239 	splx(s);
2240 	if (error == EWOULDBLOCK)
2241 		error = EIO;
2242 	if (error)
2243 		goto out;
2244 	goto loop;
2245 }
2246 
2247 /*
2248  * Rubout one character from the rawq of tp
2249  * as cleanly as possible.
2250  */
2251 static void
2252 ttyrub(int c, struct tty *tp)
2253 {
2254 	char *cp;
2255 	int savecol;
2256 	int tabc, s;
2257 
2258 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2259 		return;
2260 	CLR(tp->t_lflag, FLUSHO);
2261 	if (ISSET(tp->t_lflag, ECHOE)) {
2262 		if (tp->t_rocount == 0) {
2263 			/*
2264 			 * Screwed by ttwrite; retype
2265 			 */
2266 			ttyretype(tp);
2267 			return;
2268 		}
2269 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2270 			ttyrubo(tp, 2);
2271 		else {
2272 			CLR(c, ~TTY_CHARMASK);
2273 			switch (CCLASS(c)) {
2274 			case ORDINARY:
2275 				ttyrubo(tp, 1);
2276 				break;
2277 			case BACKSPACE:
2278 			case CONTROL:
2279 			case NEWLINE:
2280 			case RETURN:
2281 			case VTAB:
2282 				if (ISSET(tp->t_lflag, ECHOCTL))
2283 					ttyrubo(tp, 2);
2284 				break;
2285 			case TAB:
2286 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2287 					ttyretype(tp);
2288 					return;
2289 				}
2290 				s = spltty();
2291 				savecol = tp->t_column;
2292 				SET(tp->t_state, TS_CNTTB);
2293 				SET(tp->t_lflag, FLUSHO);
2294 				tp->t_column = tp->t_rocol;
2295 				cp = tp->t_rawq.c_cf;
2296 				if (cp)
2297 					tabc = *cp;	/* XXX FIX NEXTC */
2298 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2299 					ttyecho(tabc, tp);
2300 				CLR(tp->t_lflag, FLUSHO);
2301 				CLR(tp->t_state, TS_CNTTB);
2302 				splx(s);
2303 
2304 				/* savecol will now be length of the tab. */
2305 				savecol -= tp->t_column;
2306 				tp->t_column += savecol;
2307 				if (savecol > 8)
2308 					savecol = 8;	/* overflow screw */
2309 				while (--savecol >= 0)
2310 					(void)ttyoutput('\b', tp);
2311 				break;
2312 			default:			/* XXX */
2313 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2314 				(void)printf(PANICSTR, c, CCLASS(c));
2315 #ifdef notdef
2316 				panic(PANICSTR, c, CCLASS(c));
2317 #endif
2318 			}
2319 		}
2320 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2321 		if (!ISSET(tp->t_state, TS_ERASE)) {
2322 			SET(tp->t_state, TS_ERASE);
2323 			(void)ttyoutput('\\', tp);
2324 		}
2325 		ttyecho(c, tp);
2326 	} else {
2327 		ttyecho(tp->t_cc[VERASE], tp);
2328 		/*
2329 		 * This code may be executed not only when an ERASE key
2330 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2331 		 * So, I didn't think it was worthwhile to pass the extra
2332 		 * information (which would need an extra parameter,
2333 		 * changing every call) needed to distinguish the ERASE2
2334 		 * case from the ERASE.
2335 		 */
2336 	}
2337 	--tp->t_rocount;
2338 }
2339 
2340 /*
2341  * Back over cnt characters, erasing them.
2342  */
2343 static void
2344 ttyrubo(struct tty *tp, int cnt)
2345 {
2346 
2347 	while (cnt-- > 0) {
2348 		(void)ttyoutput('\b', tp);
2349 		(void)ttyoutput(' ', tp);
2350 		(void)ttyoutput('\b', tp);
2351 	}
2352 }
2353 
2354 /*
2355  * ttyretype --
2356  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2357  *	been checked.
2358  */
2359 static void
2360 ttyretype(struct tty *tp)
2361 {
2362 	char *cp;
2363 	int s, c;
2364 
2365 	/* Echo the reprint character. */
2366 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2367 		ttyecho(tp->t_cc[VREPRINT], tp);
2368 
2369 	(void)ttyoutput('\n', tp);
2370 
2371 	/*
2372 	 * XXX
2373 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2374 	 * BIT OF FIRST CHAR.
2375 	 */
2376 	s = spltty();
2377 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2378 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2379 		ttyecho(c, tp);
2380 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2381 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2382 		ttyecho(c, tp);
2383 	CLR(tp->t_state, TS_ERASE);
2384 	splx(s);
2385 
2386 	tp->t_rocount = tp->t_rawq.c_cc;
2387 	tp->t_rocol = 0;
2388 }
2389 
2390 /*
2391  * Echo a typed character to the terminal.
2392  */
2393 static void
2394 ttyecho(int c, struct tty *tp)
2395 {
2396 
2397 	if (!ISSET(tp->t_state, TS_CNTTB))
2398 		CLR(tp->t_lflag, FLUSHO);
2399 	if ((!ISSET(tp->t_lflag, ECHO) &&
2400 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2401 	    ISSET(tp->t_lflag, EXTPROC))
2402 		return;
2403 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2404 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2405 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2406 		(void)ttyoutput('^', tp);
2407 		CLR(c, ~TTY_CHARMASK);
2408 		if (c == 0177)
2409 			c = '?';
2410 		else
2411 			c += 'A' - 1;
2412 	}
2413 	(void)ttyoutput(c, tp);
2414 }
2415 
2416 /*
2417  * Wake up any readers on a tty.
2418  */
2419 void
2420 ttwakeup(struct tty *tp)
2421 {
2422 
2423 	if (SEL_WAITING(&tp->t_rsel))
2424 		selwakeuppri(&tp->t_rsel, TTIPRI);
2425 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2426 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2427 	wakeup(TSA_HUP_OR_INPUT(tp));
2428 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
2429 }
2430 
2431 /*
2432  * Wake up any writers on a tty.
2433  */
2434 void
2435 ttwwakeup(struct tty *tp)
2436 {
2437 
2438 	if (SEL_WAITING(&tp->t_wsel) && tp->t_outq.c_cc <= tp->t_olowat)
2439 		selwakeuppri(&tp->t_wsel, TTOPRI);
2440 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2441 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2442 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2443 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2444 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2445 		wakeup(TSA_OCOMPLETE(tp));
2446 	}
2447 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2448 	    tp->t_outq.c_cc <= tp->t_olowat) {
2449 		CLR(tp->t_state, TS_SO_OLOWAT);
2450 		wakeup(TSA_OLOWAT(tp));
2451 	}
2452 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
2453 }
2454 
2455 /*
2456  * Look up a code for a specified speed in a conversion table;
2457  * used by drivers to map software speed values to hardware parameters.
2458  */
2459 int
2460 ttspeedtab(int speed, struct speedtab *table)
2461 {
2462 
2463 	for ( ; table->sp_speed != -1; table++)
2464 		if (table->sp_speed == speed)
2465 			return (table->sp_code);
2466 	return (-1);
2467 }
2468 
2469 /*
2470  * Set input and output watermarks and buffer sizes.  For input, the
2471  * high watermark is about one second's worth of input above empty, the
2472  * low watermark is slightly below high water, and the buffer size is a
2473  * driver-dependent amount above high water.  For output, the watermarks
2474  * are near the ends of the buffer, with about 1 second's worth of input
2475  * between them.  All this only applies to the standard line discipline.
2476  */
2477 void
2478 ttsetwater(struct tty *tp)
2479 {
2480 	int cps, ttmaxhiwat, x;
2481 
2482 	/* Input. */
2483 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2484 	switch (tp->t_ispeedwat) {
2485 	case (speed_t)-1:
2486 		cps = tp->t_ispeed / 10;
2487 		break;
2488 	case 0:
2489 		/*
2490 		 * This case is for old drivers that don't know about
2491 		 * t_ispeedwat.  Arrange for them to get the old buffer
2492 		 * sizes and watermarks.
2493 		 */
2494 		cps = TTYHOG - 2 * 256;
2495 		tp->t_ififosize = 2 * 256;
2496 		break;
2497 	default:
2498 		cps = tp->t_ispeedwat / 10;
2499 		break;
2500 	}
2501 	tp->t_ihiwat = cps;
2502 	tp->t_ilowat = 7 * cps / 8;
2503 	x = cps + tp->t_ififosize;
2504 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2505 
2506 	/* Output. */
2507 	switch (tp->t_ospeedwat) {
2508 	case (speed_t)-1:
2509 		cps = tp->t_ospeed / 10;
2510 		ttmaxhiwat = 2 * TTMAXHIWAT;
2511 		break;
2512 	case 0:
2513 		cps = tp->t_ospeed / 10;
2514 		ttmaxhiwat = TTMAXHIWAT;
2515 		break;
2516 	default:
2517 		cps = tp->t_ospeedwat / 10;
2518 		ttmaxhiwat = 8 * TTMAXHIWAT;
2519 		break;
2520 	}
2521 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2522 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2523 	x += cps;
2524 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2525 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2526 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2527 	x += OBUFSIZ + 100;
2528 	clist_alloc_cblocks(&tp->t_outq, x, x);
2529 #undef	CLAMP
2530 }
2531 
2532 /*
2533  * Report on state of foreground process group.
2534  */
2535 void
2536 ttyinfo(struct tty *tp)
2537 {
2538 	struct timeval utime, stime;
2539 	struct proc *p, *pick;
2540 	struct thread *td, *picktd;
2541 	const char *stateprefix, *state;
2542 	long rss;
2543 	int load, pctcpu;
2544 	pid_t pid;
2545 	char comm[MAXCOMLEN + 1];
2546 	struct rusage ru;
2547 
2548 	if (ttycheckoutq(tp,0) == 0)
2549 		return;
2550 
2551 	/* Print load average. */
2552 	load = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2553 	ttyprintf(tp, "load: %d.%02d ", load / 100, load % 100);
2554 
2555 	/*
2556 	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
2557 	 * that pending input will be retyped on BS.
2558 	 */
2559 	if (tp->t_session == NULL) {
2560 		ttyprintf(tp, "not a controlling terminal\n");
2561 		tp->t_rocount = 0;
2562 		return;
2563 	}
2564 	if (tp->t_pgrp == NULL) {
2565 		ttyprintf(tp, "no foreground process group\n");
2566 		tp->t_rocount = 0;
2567 		return;
2568 	}
2569 	PGRP_LOCK(tp->t_pgrp);
2570 	if (LIST_EMPTY(&tp->t_pgrp->pg_members)) {
2571 		PGRP_UNLOCK(tp->t_pgrp);
2572 		ttyprintf(tp, "empty foreground process group\n");
2573 		tp->t_rocount = 0;
2574 		return;
2575 	}
2576 
2577 	/*
2578 	 * Pick the most interesting process and copy some of its
2579 	 * state for printing later.  This operation could rely on stale
2580 	 * data as we can't hold the proc slock or thread locks over the
2581 	 * whole list. However, we're guaranteed not to reference an exited
2582 	 * thread or proc since we hold the tty locked.
2583 	 */
2584 	pick = NULL;
2585 	LIST_FOREACH(p, &tp->t_pgrp->pg_members, p_pglist)
2586 		if (proc_compare(pick, p))
2587 			pick = p;
2588 
2589 	PROC_LOCK(pick);
2590 	picktd = NULL;
2591 	td = FIRST_THREAD_IN_PROC(pick);
2592 	FOREACH_THREAD_IN_PROC(pick, td)
2593 		if (thread_compare(picktd, td))
2594 			picktd = td;
2595 	td = picktd;
2596 	stateprefix = "";
2597 	thread_lock(td);
2598 	if (TD_IS_RUNNING(td))
2599 		state = "running";
2600 	else if (TD_ON_RUNQ(td) || TD_CAN_RUN(td))
2601 		state = "runnable";
2602 	else if (TD_IS_SLEEPING(td)) {
2603 		/* XXX: If we're sleeping, are we ever not in a queue? */
2604 		if (TD_ON_SLEEPQ(td))
2605 			state = td->td_wmesg;
2606 		else
2607 			state = "sleeping without queue";
2608 	} else if (TD_ON_LOCK(td)) {
2609 		state = td->td_lockname;
2610 		stateprefix = "*";
2611 	} else if (TD_IS_SUSPENDED(td))
2612 		state = "suspended";
2613 	else if (TD_AWAITING_INTR(td))
2614 		state = "intrwait";
2615 	else
2616 		state = "unknown";
2617 	pctcpu = (sched_pctcpu(td) * 10000 + FSCALE / 2) >> FSHIFT;
2618 	thread_unlock(td);
2619 	if (pick->p_state == PRS_NEW || pick->p_state == PRS_ZOMBIE)
2620 		rss = 0;
2621 	else
2622 		rss = pgtok(vmspace_resident_count(pick->p_vmspace));
2623 	PROC_UNLOCK(pick);
2624 	PROC_LOCK(pick);
2625 	PGRP_UNLOCK(tp->t_pgrp);
2626 	rufetchcalc(pick, &ru, &utime, &stime);
2627 	pid = pick->p_pid;
2628 	bcopy(pick->p_comm, comm, sizeof(comm));
2629 	PROC_UNLOCK(pick);
2630 
2631 	/* Print command, pid, state, utime, stime, %cpu, and rss. */
2632 	ttyprintf(tp,
2633 	    " cmd: %s %d [%s%s] %ld.%02ldu %ld.%02lds %d%% %ldk\n",
2634 	    comm, pid, stateprefix, state,
2635 	    (long)utime.tv_sec, utime.tv_usec / 10000,
2636 	    (long)stime.tv_sec, stime.tv_usec / 10000,
2637 	    pctcpu / 100, rss);
2638 	tp->t_rocount = 0;
2639 }
2640 
2641 /*
2642  * Returns 1 if p2 is "better" than p1
2643  *
2644  * The algorithm for picking the "interesting" process is thus:
2645  *
2646  *	1) Only foreground processes are eligible - implied.
2647  *	2) Runnable processes are favored over anything else.  The runner
2648  *	   with the highest cpu utilization is picked (p_estcpu).  Ties are
2649  *	   broken by picking the highest pid.
2650  *	3) The sleeper with the shortest sleep time is next.  With ties,
2651  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2652  *	4) Further ties are broken by picking the highest pid.
2653  */
2654 
2655 #define TESTAB(a, b)    ((a)<<1 | (b))
2656 #define ONLYA   2
2657 #define ONLYB   1
2658 #define BOTH    3
2659 
2660 static int
2661 proc_sum(struct proc *p, int *estcpup)
2662 {
2663 	struct thread *td;
2664 	int estcpu;
2665 	int val;
2666 
2667 	val = 0;
2668 	estcpu = 0;
2669 	FOREACH_THREAD_IN_PROC(p, td) {
2670 		thread_lock(td);
2671 		if (TD_ON_RUNQ(td) ||
2672 		    TD_IS_RUNNING(td))
2673 			val = 1;
2674 		estcpu += sched_pctcpu(td);
2675 		thread_unlock(td);
2676 	}
2677 	*estcpup = estcpu;
2678 
2679 	return (val);
2680 }
2681 
2682 static int
2683 thread_compare(struct thread *td, struct thread *td2)
2684 {
2685 	int runa, runb;
2686 	int slpa, slpb;
2687 	fixpt_t esta, estb;
2688 
2689 	if (td == NULL)
2690 		return (1);
2691 
2692 	/*
2693 	 * Fetch running stats, pctcpu usage, and interruptable flag.
2694  	 */
2695 	thread_lock(td);
2696 	runa = TD_IS_RUNNING(td) | TD_ON_RUNQ(td);
2697 	slpa = td->td_flags & TDF_SINTR;
2698 	esta = sched_pctcpu(td);
2699 	thread_unlock(td);
2700 	thread_lock(td2);
2701 	runb = TD_IS_RUNNING(td2) | TD_ON_RUNQ(td2);
2702 	estb = sched_pctcpu(td2);
2703 	slpb = td2->td_flags & TDF_SINTR;
2704 	thread_unlock(td2);
2705 	/*
2706 	 * see if at least one of them is runnable
2707 	 */
2708 	switch (TESTAB(runa, runb)) {
2709 	case ONLYA:
2710 		return (0);
2711 	case ONLYB:
2712 		return (1);
2713 	case BOTH:
2714 		break;
2715 	}
2716 	/*
2717 	 *  favor one with highest recent cpu utilization
2718 	 */
2719 	if (estb > esta)
2720 		return (1);
2721 	if (esta > estb)
2722 		return (0);
2723 	/*
2724 	 * favor one sleeping in a non-interruptible sleep
2725 	 */
2726 	switch (TESTAB(slpa, slpb)) {
2727 	case ONLYA:
2728 		return (0);
2729 	case ONLYB:
2730 		return (1);
2731 	case BOTH:
2732 		break;
2733 	}
2734 
2735 	return (td < td2);
2736 }
2737 
2738 static int
2739 proc_compare(struct proc *p1, struct proc *p2)
2740 {
2741 
2742 	int runa, runb;
2743 	fixpt_t esta, estb;
2744 
2745 	if (p1 == NULL)
2746 		return (1);
2747 
2748 	/*
2749 	 * Fetch various stats about these processes.  After we drop the
2750 	 * lock the information could be stale but the race is unimportant.
2751 	 */
2752 	PROC_LOCK(p1);
2753 	runa = proc_sum(p1, &esta);
2754 	PROC_UNLOCK(p1);
2755 	PROC_LOCK(p2);
2756 	runb = proc_sum(p2, &estb);
2757 	PROC_UNLOCK(p2);
2758 
2759 	/*
2760 	 * see if at least one of them is runnable
2761 	 */
2762 	switch (TESTAB(runa, runb)) {
2763 	case ONLYA:
2764 		return (0);
2765 	case ONLYB:
2766 		return (1);
2767 	case BOTH:
2768 		break;
2769 	}
2770 	/*
2771 	 *  favor one with highest recent cpu utilization
2772 	 */
2773 	if (estb > esta)
2774 		return (1);
2775 	if (esta > estb)
2776 		return (0);
2777 	/*
2778 	 * weed out zombies
2779 	 */
2780 	switch (TESTAB(p1->p_state == PRS_ZOMBIE, p2->p_state == PRS_ZOMBIE)) {
2781 	case ONLYA:
2782 		return (1);
2783 	case ONLYB:
2784 		return (0);
2785 	case BOTH:
2786 		break;
2787 	}
2788 
2789 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2790 }
2791 
2792 /*
2793  * Output char to tty; console putchar style.
2794  */
2795 int
2796 tputchar(int c, struct tty *tp)
2797 {
2798 	int s;
2799 
2800 	s = spltty();
2801 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2802 		splx(s);
2803 		return (-1);
2804 	}
2805 	if (c == '\n')
2806 		(void)ttyoutput('\r', tp);
2807 	(void)ttyoutput(c, tp);
2808 	ttstart(tp);
2809 	splx(s);
2810 	return (0);
2811 }
2812 
2813 /*
2814  * Sleep on chan, returning ERESTART if tty changed while we napped and
2815  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2816  * the tty is revoked, restarting a pending call will redo validation done
2817  * at the start of the call.
2818  */
2819 int
2820 ttysleep(struct tty *tp, void *chan, int pri, char *wmesg, int timo)
2821 {
2822 	int error;
2823 	int gen;
2824 
2825 	gen = tp->t_gen;
2826 	error = tsleep(chan, pri, wmesg, timo);
2827 	if (tp->t_state & TS_GONE)
2828 		return (ENXIO);
2829 	if (error)
2830 		return (error);
2831 	return (tp->t_gen == gen ? 0 : ERESTART);
2832 }
2833 
2834 /*
2835  * Gain a reference to a TTY
2836  */
2837 int
2838 ttyref(struct tty *tp)
2839 {
2840 	int i;
2841 
2842 	mtx_lock(&tp->t_mtx);
2843 	KASSERT(tp->t_refcnt > 0,
2844 	    ("ttyref(): tty refcnt is %d (%s)",
2845 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2846 	i = ++tp->t_refcnt;
2847 	mtx_unlock(&tp->t_mtx);
2848 	return (i);
2849 }
2850 
2851 /*
2852  * Drop a reference to a TTY.
2853  * When reference count drops to zero, we free it.
2854  */
2855 int
2856 ttyrel(struct tty *tp)
2857 {
2858 	int i;
2859 
2860 	mtx_lock(&tty_list_mutex);
2861 	mtx_lock(&tp->t_mtx);
2862 	KASSERT(tp->t_refcnt > 0,
2863 	    ("ttyrel(): tty refcnt is %d (%s)",
2864 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2865 	i = --tp->t_refcnt;
2866 	if (i != 0) {
2867 		mtx_unlock(&tp->t_mtx);
2868 		mtx_unlock(&tty_list_mutex);
2869 		return (i);
2870 	}
2871 	TAILQ_REMOVE(&tty_list, tp, t_list);
2872 	mtx_unlock(&tp->t_mtx);
2873 	mtx_unlock(&tty_list_mutex);
2874 	knlist_destroy(&tp->t_rsel.si_note);
2875 	knlist_destroy(&tp->t_wsel.si_note);
2876 	mtx_destroy(&tp->t_mtx);
2877 	free(tp, M_TTYS);
2878 	return (i);
2879 }
2880 
2881 /*
2882  * Allocate a tty struct.  Clists in the struct will be allocated by
2883  * tty_open().
2884  */
2885 struct tty *
2886 ttyalloc()
2887 {
2888 	struct tty *tp;
2889 
2890 	tp = malloc(sizeof *tp, M_TTYS, M_WAITOK | M_ZERO);
2891 	mtx_init(&tp->t_mtx, "tty", NULL, MTX_DEF);
2892 
2893 	/*
2894 	 * Set up the initial state
2895 	 */
2896 	tp->t_refcnt = 1;
2897 	tp->t_timeout = -1;
2898 	tp->t_dtr_wait = 3 * hz;
2899 
2900 	ttyinitmode(tp, 0, 0);
2901 	bcopy(ttydefchars, tp->t_init_in.c_cc, sizeof tp->t_init_in.c_cc);
2902 
2903 	/* Make callout the same as callin */
2904 	tp->t_init_out = tp->t_init_in;
2905 
2906 	mtx_lock(&tty_list_mutex);
2907 	TAILQ_INSERT_TAIL(&tty_list, tp, t_list);
2908 	mtx_unlock(&tty_list_mutex);
2909 	knlist_init(&tp->t_rsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2910 	knlist_init(&tp->t_wsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2911 	return (tp);
2912 }
2913 
2914 static void
2915 ttypurge(struct cdev *dev)
2916 {
2917 
2918 	if (dev->si_tty == NULL)
2919 		return;
2920 	ttygone(dev->si_tty);
2921 }
2922 
2923 /*
2924  * ttycreate()
2925  *
2926  * Create the device entries for this tty thereby opening it for business.
2927  *
2928  * The flags argument controls if "cua" units are created.
2929  *
2930  * The t_sc filed is copied to si_drv1 in the created cdevs.  This
2931  * is particularly important for ->t_cioctl() users.
2932  *
2933  * XXX: implement the init and lock devices by cloning.
2934  */
2935 
2936 int
2937 ttycreate(struct tty *tp, int flags, const char *fmt, ...)
2938 {
2939 	char namebuf[SPECNAMELEN - 3];		/* XXX space for "tty" */
2940 	struct cdevsw *csw = NULL;
2941 	int unit = 0;
2942 	va_list ap;
2943 	struct cdev *cp;
2944 	int i, minor, sminor, sunit;
2945 
2946 	mtx_assert(&Giant, MA_OWNED);
2947 
2948 	if (tty_unit == NULL)
2949 		tty_unit = new_unrhdr(0, 0xffff, NULL);
2950 
2951 	sunit = alloc_unr(tty_unit);
2952 	tp->t_devunit = sunit;
2953 
2954 	if (csw == NULL) {
2955 		csw = &tty_cdevsw;
2956 		unit = sunit;
2957 	}
2958 	KASSERT(csw->d_purge == NULL || csw->d_purge == ttypurge,
2959 	    ("tty should not have d_purge"));
2960 
2961 	csw->d_purge = ttypurge;
2962 
2963 	minor = unit2minor(unit);
2964 	sminor = unit2minor(sunit);
2965 	va_start(ap, fmt);
2966 	i = vsnrprintf(namebuf, sizeof namebuf, 32, fmt, ap);
2967 	va_end(ap);
2968 	KASSERT(i < sizeof namebuf, ("Too long tty name (%s)", namebuf));
2969 
2970 	cp = make_dev(csw, minor,
2971 	    UID_ROOT, GID_WHEEL, 0600, "tty%s", namebuf);
2972 	tp->t_dev = cp;
2973 	tp->t_mdev = cp;
2974 	cp->si_tty = tp;
2975 	cp->si_drv1 = tp->t_sc;
2976 
2977 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_INIT,
2978 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.init", namebuf);
2979 	dev_depends(tp->t_dev, cp);
2980 	cp->si_drv1 = tp->t_sc;
2981 	cp->si_drv2 = &tp->t_init_in;
2982 	cp->si_tty = tp;
2983 
2984 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_LOCK,
2985 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.lock", namebuf);
2986 	dev_depends(tp->t_dev, cp);
2987 	cp->si_drv1 = tp->t_sc;
2988 	cp->si_drv2 = &tp->t_lock_in;
2989 	cp->si_tty = tp;
2990 
2991 	if (flags & TS_CALLOUT) {
2992 		cp = make_dev(csw, minor | MINOR_CALLOUT,
2993 		    UID_UUCP, GID_DIALER, 0660, "cua%s", namebuf);
2994 		dev_depends(tp->t_dev, cp);
2995 		cp->si_drv1 = tp->t_sc;
2996 		cp->si_tty = tp;
2997 
2998 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_INIT,
2999 		    UID_UUCP, GID_DIALER, 0660, "cua%s.init", namebuf);
3000 		dev_depends(tp->t_dev, cp);
3001 		cp->si_drv1 = tp->t_sc;
3002 		cp->si_drv2 = &tp->t_init_out;
3003 		cp->si_tty = tp;
3004 
3005 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_LOCK,
3006 		    UID_UUCP, GID_DIALER, 0660, "cua%s.lock", namebuf);
3007 		dev_depends(tp->t_dev, cp);
3008 		cp->si_drv1 = tp->t_sc;
3009 		cp->si_drv2 = &tp->t_lock_out;
3010 		cp->si_tty = tp;
3011 	}
3012 
3013 	return (0);
3014 }
3015 
3016 /*
3017  * This function is called when the hardware disappears.  We set a flag
3018  * and wake up stuff so all sleeping threads will notice.
3019  */
3020 void
3021 ttygone(struct tty *tp)
3022 {
3023 
3024 	tp->t_state |= TS_GONE;
3025 	if (SEL_WAITING(&tp->t_rsel))
3026 		selwakeuppri(&tp->t_rsel, TTIPRI);
3027 	if (SEL_WAITING(&tp->t_wsel))
3028 		selwakeuppri(&tp->t_wsel, TTOPRI);
3029 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
3030 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
3031 	wakeup(&tp->t_dtr_wait);
3032 	wakeup(TSA_CARR_ON(tp));
3033 	wakeup(TSA_HUP_OR_INPUT(tp));
3034 	wakeup(TSA_OCOMPLETE(tp));
3035 	wakeup(TSA_OLOWAT(tp));
3036 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
3037 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
3038 	tt_purge(tp);
3039 }
3040 
3041 /*
3042  * ttyfree()
3043  *
3044  * Called when the driver is ready to free the tty structure.
3045  *
3046  * XXX: This shall sleep until all threads have left the driver.
3047  */
3048 void
3049 ttyfree(struct tty *tp)
3050 {
3051 	struct cdev *dev;
3052 	u_int unit;
3053 
3054 	mtx_assert(&Giant, MA_OWNED);
3055 	ttygone(tp);
3056 	unit = tp->t_devunit;
3057 	dev = tp->t_mdev;
3058 	tp->t_dev = NULL;
3059 	ttyrel(tp);
3060 	destroy_dev(dev);
3061 	free_unr(tty_unit, unit);
3062 }
3063 
3064 static int
3065 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
3066 {
3067 	struct tty *tp, *tp2;
3068 	struct xtty xt;
3069 	int error;
3070 
3071 	error = 0;
3072 	mtx_lock(&tty_list_mutex);
3073 	tp = TAILQ_FIRST(&tty_list);
3074 	if (tp != NULL)
3075 		ttyref(tp);
3076 	while (tp != NULL) {
3077 		bzero(&xt, sizeof xt);
3078 		xt.xt_size = sizeof xt;
3079 #define XT_COPY(field) xt.xt_##field = tp->t_##field
3080 		xt.xt_rawcc = tp->t_rawq.c_cc;
3081 		xt.xt_cancc = tp->t_canq.c_cc;
3082 		xt.xt_outcc = tp->t_outq.c_cc;
3083 		XT_COPY(line);
3084 
3085 		/*
3086 		 * XXX: We hold the tty list lock while doing this to
3087 		 * work around a race with pty/pts tty destruction.
3088 		 * They set t_dev to NULL and then call ttyrel() to
3089 		 * free the structure which will block on the list
3090 		 * lock before they call destroy_dev() on the cdev
3091 		 * backing t_dev.
3092 		 *
3093 		 * XXX: ttyfree() now does the same since it has been
3094 		 * fixed to not leak ttys.
3095 		 */
3096 		if (tp->t_dev != NULL)
3097 			xt.xt_dev = dev2udev(tp->t_dev);
3098 		XT_COPY(state);
3099 		XT_COPY(flags);
3100 		XT_COPY(timeout);
3101 		if (tp->t_pgrp != NULL)
3102 			xt.xt_pgid = tp->t_pgrp->pg_id;
3103 		if (tp->t_session != NULL)
3104 			xt.xt_sid = tp->t_session->s_sid;
3105 		XT_COPY(termios);
3106 		XT_COPY(winsize);
3107 		XT_COPY(column);
3108 		XT_COPY(rocount);
3109 		XT_COPY(rocol);
3110 		XT_COPY(ififosize);
3111 		XT_COPY(ihiwat);
3112 		XT_COPY(ilowat);
3113 		XT_COPY(ispeedwat);
3114 		XT_COPY(ohiwat);
3115 		XT_COPY(olowat);
3116 		XT_COPY(ospeedwat);
3117 #undef XT_COPY
3118 		mtx_unlock(&tty_list_mutex);
3119 		error = SYSCTL_OUT(req, &xt, sizeof xt);
3120 		if (error != 0) {
3121 			ttyrel(tp);
3122 			return (error);
3123 		}
3124 		mtx_lock(&tty_list_mutex);
3125 		tp2 = TAILQ_NEXT(tp, t_list);
3126 		if (tp2 != NULL)
3127 			ttyref(tp2);
3128 		mtx_unlock(&tty_list_mutex);
3129 		ttyrel(tp);
3130 		tp = tp2;
3131 		mtx_lock(&tty_list_mutex);
3132 	}
3133 	mtx_unlock(&tty_list_mutex);
3134 	return (0);
3135 }
3136 
3137 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
3138 	0, 0, sysctl_kern_ttys, "S,xtty", "All ttys");
3139 SYSCTL_LONG(_kern, OID_AUTO, tty_nin, CTLFLAG_RD,
3140 	&tk_nin, 0, "Total TTY in characters");
3141 SYSCTL_LONG(_kern, OID_AUTO, tty_nout, CTLFLAG_RD,
3142 	&tk_nout, 0, "Total TTY out characters");
3143 
3144 void
3145 nottystop(struct tty *tp, int rw)
3146 {
3147 
3148 	return;
3149 }
3150 
3151 int
3152 ttyopen(struct cdev *dev, int flag, int mode, struct thread *td)
3153 {
3154 	int		error;
3155 	int		s;
3156 	struct tty	*tp;
3157 
3158 	tp = dev->si_tty;
3159 
3160 	s = spltty();
3161 	/*
3162 	 * We jump to this label after all non-interrupted sleeps to pick
3163 	 * up any changes of the device state.
3164 	 */
3165 open_top:
3166 	if (tp->t_state & TS_GONE)
3167 		return (ENXIO);
3168 	error = ttydtrwaitsleep(tp);
3169 	if (error)
3170 		goto out;
3171 	if (tp->t_state & TS_ISOPEN) {
3172 		/*
3173 		 * The device is open, so everything has been initialized.
3174 		 * Handle conflicts.
3175 		 */
3176 		if (ISCALLOUT(dev) && !tp->t_actout)
3177 			return (EBUSY);
3178 		if (tp->t_actout && !ISCALLOUT(dev)) {
3179 			if (flag & O_NONBLOCK)
3180 				return (EBUSY);
3181 			error =	tsleep(&tp->t_actout,
3182 				       TTIPRI | PCATCH, "ttybi", 0);
3183 			if (error != 0 || (tp->t_flags & TS_GONE))
3184 				goto out;
3185 			goto open_top;
3186 		}
3187 		if (tp->t_state & TS_XCLUDE && priv_check(td,
3188 		    PRIV_TTY_EXCLUSIVE))
3189 			return (EBUSY);
3190 	} else {
3191 		/*
3192 		 * The device isn't open, so there are no conflicts.
3193 		 * Initialize it.  Initialization is done twice in many
3194 		 * cases: to preempt sleeping callin opens if we are
3195 		 * callout, and to complete a callin open after DCD rises.
3196 		 */
3197 		tp->t_termios = ISCALLOUT(dev) ? tp->t_init_out : tp->t_init_in;
3198 		tp->t_cflag = tp->t_termios.c_cflag;
3199 		if (tp->t_modem != NULL)
3200 			tt_modem(tp, SER_DTR | SER_RTS, 0);
3201 		++tp->t_wopeners;
3202 		error = tt_param(tp, &tp->t_termios);
3203 		--tp->t_wopeners;
3204 		if (error == 0)
3205 			error = tt_open(tp, dev);
3206 		if (error != 0)
3207 			goto out;
3208 		if (ISCALLOUT(dev) || (tt_modem(tp, 0, 0) & SER_DCD))
3209 			ttyld_modem(tp, 1);
3210 	}
3211 	/*
3212 	 * Wait for DCD if necessary.
3213 	 */
3214 	if (!(tp->t_state & TS_CARR_ON) && !ISCALLOUT(dev)
3215 	    && !(tp->t_cflag & CLOCAL) && !(flag & O_NONBLOCK)) {
3216 		++tp->t_wopeners;
3217 		error = tsleep(TSA_CARR_ON(tp), TTIPRI | PCATCH, "ttydcd", 0);
3218 		--tp->t_wopeners;
3219 		if (error != 0 || (tp->t_state & TS_GONE))
3220 			goto out;
3221 		goto open_top;
3222 	}
3223 	error =	ttyld_open(tp, dev);
3224 	ttyldoptim(tp);
3225 	if (tp->t_state & TS_ISOPEN && ISCALLOUT(dev))
3226 		tp->t_actout = TRUE;
3227 out:
3228 	splx(s);
3229 	if (!(tp->t_state & TS_ISOPEN) && tp->t_wopeners == 0)
3230 		tt_close(tp);
3231 	return (error);
3232 }
3233 
3234 int
3235 ttyclose(struct cdev *dev, int flag, int mode, struct thread *td)
3236 {
3237 	struct tty *tp;
3238 
3239 	tp = dev->si_tty;
3240 	ttyld_close(tp, flag);
3241 	ttyldoptim(tp);
3242 	tt_close(tp);
3243 	tp->t_do_timestamp = 0;
3244 	if (tp->t_pps != NULL)
3245 		tp->t_pps->ppsparam.mode = 0;
3246 	tty_close(tp);
3247 	return (0);
3248 }
3249 
3250 int
3251 ttyread(struct cdev *dev, struct uio *uio, int flag)
3252 {
3253 	struct tty *tp;
3254 
3255 	tp = tty_gettp(dev);
3256 
3257 	if (tp->t_state & TS_GONE)
3258 		return (ENODEV);
3259 	return (ttyld_read(tp, uio, flag));
3260 }
3261 
3262 int
3263 ttywrite(struct cdev *dev, struct uio *uio, int flag)
3264 {
3265 	struct tty *tp;
3266 
3267 	tp = tty_gettp(dev);
3268 
3269 	if (tp->t_state & TS_GONE)
3270 		return (ENODEV);
3271 	return (ttyld_write(tp, uio, flag));
3272 }
3273 
3274 int
3275 ttyioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3276 {
3277 	struct	tty *tp;
3278 	int	error;
3279 
3280 	tp = dev->si_tty;
3281 
3282 	if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) {
3283 		int cc;
3284 		struct termios *dt = (struct termios *)data;
3285 		struct termios *lt =
3286 		    ISCALLOUT(dev) ?  &tp->t_lock_out : &tp->t_lock_in;
3287 
3288 		dt->c_iflag = (tp->t_iflag & lt->c_iflag)
3289 		    | (dt->c_iflag & ~lt->c_iflag);
3290 		dt->c_oflag = (tp->t_oflag & lt->c_oflag)
3291 		    | (dt->c_oflag & ~lt->c_oflag);
3292 		dt->c_cflag = (tp->t_cflag & lt->c_cflag)
3293 		    | (dt->c_cflag & ~lt->c_cflag);
3294 		dt->c_lflag = (tp->t_lflag & lt->c_lflag)
3295 		    | (dt->c_lflag & ~lt->c_lflag);
3296 		for (cc = 0; cc < NCCS; ++cc)
3297 		    if (lt->c_cc[cc] != 0)
3298 		        dt->c_cc[cc] = tp->t_cc[cc];
3299 		if (lt->c_ispeed != 0)
3300 		    dt->c_ispeed = tp->t_ispeed;
3301 		if (lt->c_ospeed != 0)
3302 		    dt->c_ospeed = tp->t_ospeed;
3303 	}
3304 
3305 	error = ttyld_ioctl(tp, cmd, data, flag, td);
3306 	if (error == ENOIOCTL)
3307 		error = ttioctl(tp, cmd, data, flag);
3308 	ttyldoptim(tp);
3309 	if (error != ENOIOCTL)
3310 		return (error);
3311 	return (ENOTTY);
3312 }
3313 
3314 void
3315 ttyldoptim(struct tty *tp)
3316 {
3317 	struct termios	*t;
3318 
3319 	t = &tp->t_termios;
3320 	if (!(t->c_iflag & (ICRNL | IGNCR | IMAXBEL | INLCR | ISTRIP | IXON))
3321 	    && (!(t->c_iflag & BRKINT) || (t->c_iflag & IGNBRK))
3322 	    && (!(t->c_iflag & PARMRK)
3323 		|| (t->c_iflag & (IGNPAR | IGNBRK)) == (IGNPAR | IGNBRK))
3324 	    && !(t->c_lflag & (ECHO | ICANON | IEXTEN | ISIG | PENDIN))
3325 	    && linesw[tp->t_line]->l_rint == ttyinput)
3326 		tp->t_state |= TS_CAN_BYPASS_L_RINT;
3327 	else
3328 		tp->t_state &= ~TS_CAN_BYPASS_L_RINT;
3329 }
3330 
3331 static void
3332 ttydtrwaitwakeup(void *arg)
3333 {
3334 	struct tty *tp;
3335 
3336 	tp = arg;
3337 	tp->t_state &= ~TS_DTR_WAIT;
3338 	wakeup(&tp->t_dtr_wait);
3339 }
3340 
3341 
3342 void
3343 ttydtrwaitstart(struct tty *tp)
3344 {
3345 
3346 	if (tp->t_dtr_wait == 0)
3347 		return;
3348 	if (tp->t_state & TS_DTR_WAIT)
3349 		return;
3350 	timeout(ttydtrwaitwakeup, tp, tp->t_dtr_wait);
3351 	tp->t_state |= TS_DTR_WAIT;
3352 }
3353 
3354 int
3355 ttydtrwaitsleep(struct tty *tp)
3356 {
3357 	int error;
3358 
3359 	error = 0;
3360 	while (error == 0) {
3361 		if (tp->t_state & TS_GONE)
3362 			error = ENXIO;
3363 		else if (!(tp->t_state & TS_DTR_WAIT))
3364 			break;
3365 		else
3366 			error = tsleep(&tp->t_dtr_wait, TTIPRI | PCATCH,
3367 			    "dtrwait", 0);
3368 	}
3369 	return (error);
3370 }
3371 
3372 static int
3373 ttysopen(struct cdev *dev, int flag, int mode, struct thread *td)
3374 {
3375 	struct tty *tp;
3376 
3377 	tp = dev->si_tty;
3378 	KASSERT(tp != NULL,
3379 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3380 	if (tp->t_state & TS_GONE)
3381 		return (ENODEV);
3382 	return (0);
3383 }
3384 
3385 static int
3386 ttysclose(struct cdev *dev, int flag, int mode, struct thread *td)
3387 {
3388 
3389 	return (0);
3390 }
3391 
3392 static int
3393 ttysrdwr(struct cdev *dev, struct uio *uio, int flag)
3394 {
3395 
3396 	return (ENODEV);
3397 }
3398 
3399 static int
3400 ttysioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3401 {
3402 	struct tty	*tp;
3403 	int		error;
3404 	struct termios	*ct;
3405 
3406 	tp = dev->si_tty;
3407 	KASSERT(tp != NULL,
3408 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3409 	if (tp->t_state & TS_GONE)
3410 		return (ENODEV);
3411 	ct = dev->si_drv2;
3412 	switch (cmd) {
3413 	case TIOCSETA:
3414 		error = priv_check(td, PRIV_TTY_SETA);
3415 		if (error != 0)
3416 			return (error);
3417 		*ct = *(struct termios *)data;
3418 		return (0);
3419 	case TIOCGETA:
3420 		*(struct termios *)data = *ct;
3421 		return (0);
3422 	case TIOCGETD:
3423 		*(int *)data = TTYDISC;
3424 		return (0);
3425 	case TIOCGWINSZ:
3426 		bzero(data, sizeof(struct winsize));
3427 		return (0);
3428 	default:
3429 		if (tp->t_cioctl != NULL)
3430 			return(tp->t_cioctl(dev, cmd, data, flag, td));
3431 		return (ENOTTY);
3432 	}
3433 }
3434 
3435 /*
3436  * Initialize a tty to sane modes.
3437  */
3438 void
3439 ttyinitmode(struct tty *tp, int echo, int speed)
3440 {
3441 
3442 	if (speed == 0)
3443 		speed = TTYDEF_SPEED;
3444 	tp->t_init_in.c_iflag = TTYDEF_IFLAG;
3445 	tp->t_init_in.c_oflag = TTYDEF_OFLAG;
3446 	tp->t_init_in.c_cflag = TTYDEF_CFLAG;
3447 	if (echo)
3448 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_ECHO;
3449 	else
3450 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_NOECHO;
3451 
3452 	tp->t_init_in.c_ispeed = tp->t_init_in.c_ospeed = speed;
3453 	termioschars(&tp->t_init_in);
3454 	tp->t_init_out = tp->t_init_in;
3455 	tp->t_termios = tp->t_init_in;
3456 }
3457 
3458 /*
3459  * Use more "normal" termios paramters for consoles.
3460  */
3461 void
3462 ttyconsolemode(struct tty *tp, int speed)
3463 {
3464 
3465 	if (speed == 0)
3466 		speed = TTYDEF_SPEED;
3467 	ttyinitmode(tp, 1, speed);
3468 	tp->t_init_in.c_cflag |= CLOCAL;
3469 	tp->t_lock_out.c_cflag = tp->t_lock_in.c_cflag = CLOCAL;
3470 	tp->t_lock_out.c_ispeed = tp->t_lock_out.c_ospeed =
3471 	tp->t_lock_in.c_ispeed = tp->t_lock_in.c_ospeed = speed;
3472 	tp->t_init_out = tp->t_init_in;
3473 	tp->t_termios = tp->t_init_in;
3474 	ttsetwater(tp);
3475 }
3476 
3477 /*
3478  * Record the relationship between the serial ports notion of modem control
3479  * signals and the one used in certain ioctls in a way the compiler can enforce
3480  * XXX: We should define TIOCM_* in terms of SER_ if we can limit the
3481  * XXX: consequences of the #include work that would take.
3482  */
3483 CTASSERT(SER_DTR == TIOCM_DTR / 2);
3484 CTASSERT(SER_RTS == TIOCM_RTS / 2);
3485 CTASSERT(SER_STX == TIOCM_ST / 2);
3486 CTASSERT(SER_SRX == TIOCM_SR / 2);
3487 CTASSERT(SER_CTS == TIOCM_CTS / 2);
3488 CTASSERT(SER_DCD == TIOCM_DCD / 2);
3489 CTASSERT(SER_RI == TIOCM_RI / 2);
3490 CTASSERT(SER_DSR == TIOCM_DSR / 2);
3491 
3492