xref: /freebsd/sys/kern/tty.c (revision 721351876cd4d3a8a700f62d2061331fa951a488)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Copyright (c) 2002 Networks Associates Technologies, Inc.
11  * All rights reserved.
12  *
13  * Portions of this software were developed for the FreeBSD Project by
14  * ThinkSec AS and NAI Labs, the Security Research Division of Network
15  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
16  * ("CBOSS"), as part of the DARPA CHATS research program.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 4. Neither the name of the University nor the names of its contributors
27  *    may be used to endorse or promote products derived from this software
28  *    without specific prior written permission.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40  * SUCH DAMAGE.
41  *
42  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
43  */
44 
45 /*-
46  * TODO:
47  *	o Fix races for sending the start char in ttyflush().
48  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
49  *	  With luck, there will be MIN chars before select() returns().
50  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
51  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
52  *	  FIONREAD.
53  *	o Do the new sio locking stuff here and use it to avoid special
54  *	  case for EXTPROC?
55  *	o Lock PENDIN too?
56  *	o Move EXTPROC and/or PENDIN to t_state?
57  *	o Wrap most of ttioctl in spltty/splx.
58  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
59  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
60  *	o Don't allow certain termios flags to affect disciplines other
61  *	  than TTYDISC.  Cancel their effects before switch disciplines
62  *	  and ignore them if they are set while we are in another
63  *	  discipline.
64  *	o Now that historical speed conversions are handled here, don't
65  *	  do them in drivers.
66  *	o Check for TS_CARR_ON being set while everything is closed and not
67  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
68  *	  so it would live until the next open even if carrier drops.
69  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
70  *	  only when _all_ openers leave open().
71  */
72 
73 #include <sys/cdefs.h>
74 __FBSDID("$FreeBSD$");
75 
76 #include "opt_compat.h"
77 #include "opt_tty.h"
78 
79 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/cons.h>
82 #include <sys/filio.h>
83 #include <sys/lock.h>
84 #include <sys/mutex.h>
85 #include <sys/namei.h>
86 #include <sys/sx.h>
87 #if defined(COMPAT_43TTY)
88 #include <sys/ioctl_compat.h>
89 #endif
90 #include <sys/priv.h>
91 #include <sys/proc.h>
92 #define	TTYDEFCHARS
93 #include <sys/tty.h>
94 #undef	TTYDEFCHARS
95 #include <sys/fcntl.h>
96 #include <sys/conf.h>
97 #include <sys/poll.h>
98 #include <sys/kernel.h>
99 #include <sys/vnode.h>
100 #include <sys/serial.h>
101 #include <sys/signalvar.h>
102 #include <sys/resourcevar.h>
103 #include <sys/malloc.h>
104 #include <sys/filedesc.h>
105 #include <sys/sched.h>
106 #include <sys/sysctl.h>
107 #include <sys/timepps.h>
108 
109 #include <machine/stdarg.h>
110 
111 #include <vm/vm.h>
112 #include <vm/pmap.h>
113 #include <vm/vm_map.h>
114 
115 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
116 
117 long tk_cancc;
118 long tk_nin;
119 long tk_nout;
120 long tk_rawcc;
121 
122 static	d_open_t	ttysopen;
123 static	d_close_t	ttysclose;
124 static	d_read_t	ttysrdwr;
125 static	d_ioctl_t	ttysioctl;
126 static	d_purge_t	ttypurge;
127 
128 /* Default cdevsw for common tty devices */
129 static struct cdevsw tty_cdevsw = {
130 	.d_version =	D_VERSION,
131 	.d_open =	ttyopen,
132 	.d_close =	ttyclose,
133 	.d_ioctl =	ttyioctl,
134 	.d_purge =	ttypurge,
135 	.d_name =	"ttydrv",
136 	.d_flags =	D_TTY | D_NEEDGIANT,
137 };
138 
139 /* Cdevsw for slave tty devices */
140 static struct cdevsw ttys_cdevsw = {
141 	.d_version =	D_VERSION,
142 	.d_open =	ttysopen,
143 	.d_close =	ttysclose,
144 	.d_read =	ttysrdwr,
145 	.d_write =	ttysrdwr,
146 	.d_ioctl =	ttysioctl,
147 	.d_name =	"TTYS",
148 	.d_flags =	D_TTY | D_NEEDGIANT,
149 };
150 
151 static int	proc_sum(struct proc *, int *);
152 static int	proc_compare(struct proc *, struct proc *);
153 static int	thread_compare(struct thread *, struct thread *);
154 static int	ttnread(struct tty *tp);
155 static void	ttyecho(int c, struct tty *tp);
156 static int	ttyoutput(int c, struct tty *tp);
157 static void	ttypend(struct tty *tp);
158 static void	ttyretype(struct tty *tp);
159 static void	ttyrub(int c, struct tty *tp);
160 static void	ttyrubo(struct tty *tp, int cnt);
161 static void	ttyunblock(struct tty *tp);
162 static int	ttywflush(struct tty *tp);
163 static int	filt_ttyread(struct knote *kn, long hint);
164 static void	filt_ttyrdetach(struct knote *kn);
165 static int	filt_ttywrite(struct knote *kn, long hint);
166 static void	filt_ttywdetach(struct knote *kn);
167 
168 /*
169  * Table with character classes and parity. The 8th bit indicates parity,
170  * the 7th bit indicates the character is an alphameric or underscore (for
171  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
172  * are 0 then the character needs no special processing on output; classes
173  * other than 0 might be translated or (not currently) require delays.
174  */
175 #define	E	0x00	/* Even parity. */
176 #define	O	0x80	/* Odd parity. */
177 #define	PARITY(c)	(char_type[c] & O)
178 
179 #define	ALPHA	0x40	/* Alpha or underscore. */
180 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
181 
182 #define	CCLASSMASK	0x3f
183 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
184 
185 #define	BS	BACKSPACE
186 #define	CC	CONTROL
187 #define	CR	RETURN
188 #define	NA	ORDINARY | ALPHA
189 #define	NL	NEWLINE
190 #define	NO	ORDINARY
191 #define	TB	TAB
192 #define	VT	VTAB
193 
194 static u_char const char_type[] = {
195 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
196 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
197 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
198 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
199 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
200 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
201 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
202 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
203 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
204 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
205 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
206 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
207 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
208 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
209 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
210 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
211 	/*
212 	 * Meta chars; should be settable per character set;
213 	 * for now, treat them all as normal characters.
214 	 */
215 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
216 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
217 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
218 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
219 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
220 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
221 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
222 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
223 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
224 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
225 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
226 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
227 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
228 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
229 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
230 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
231 };
232 #undef	BS
233 #undef	CC
234 #undef	CR
235 #undef	NA
236 #undef	NL
237 #undef	NO
238 #undef	TB
239 #undef	VT
240 
241 /* Macros to clear/set/test flags. */
242 #define	SET(t, f)	(t) |= (f)
243 #define	CLR(t, f)	(t) &= ~(f)
244 #define	ISSET(t, f)	((t) & (f))
245 
246 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
247 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
248 
249 /*
250  * list of struct tty where pstat(8) can pick it up with sysctl
251  *
252  * The lock order is to grab the list mutex before the tty mutex.
253  * Together with additions going on the tail of the list, this allows
254  * the sysctl to avoid doing retries.
255  */
256 static	TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
257 static struct mtx tty_list_mutex;
258 MTX_SYSINIT(tty_list, &tty_list_mutex, "ttylist", MTX_DEF);
259 
260 static struct unrhdr *tty_unit;
261 
262 static int  drainwait = 5*60;
263 SYSCTL_INT(_kern, OID_AUTO, drainwait, CTLFLAG_RW, &drainwait,
264 	0, "Output drain timeout in seconds");
265 
266 static struct tty *
267 tty_gettp(struct cdev *dev)
268 {
269 	struct tty *tp;
270 	struct cdevsw *csw;
271 
272 	csw = dev_refthread(dev);
273 	if (csw == NULL)
274 		return (NULL);
275 	KASSERT(csw->d_flags & D_TTY,
276 	    ("non D_TTY (%s) in tty code", devtoname(dev)));
277 	tp = dev->si_tty;
278 	dev_relthread(dev);
279 	KASSERT(tp != NULL,
280 	    ("no tty pointer on (%s) in tty code", devtoname(dev)));
281 	return (tp);
282 }
283 
284 /*
285  * Initial open of tty, or (re)entry to standard tty line discipline.
286  */
287 int
288 tty_open(struct cdev *device, struct tty *tp)
289 {
290 	int s;
291 
292 	s = spltty();
293 	tp->t_dev = device;
294 	tp->t_hotchar = 0;
295 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
296 		ttyref(tp);
297 		SET(tp->t_state, TS_ISOPEN);
298 		if (ISSET(tp->t_cflag, CLOCAL))
299 			SET(tp->t_state, TS_CONNECTED);
300 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
301 	}
302 	/* XXX don't hang forever on output */
303 	if (tp->t_timeout < 0)
304 		tp->t_timeout = drainwait*hz;
305 	ttsetwater(tp);
306 	splx(s);
307 	return (0);
308 }
309 
310 /*
311  * Handle close() on a tty line: flush and set to initial state,
312  * bumping generation number so that pending read/write calls
313  * can detect recycling of the tty.
314  * XXX our caller should have done `spltty(); l_close(); tty_close();'
315  * and l_close() should have flushed, but we repeat the spltty() and
316  * the flush in case there are buggy callers.
317  */
318 int
319 tty_close(struct tty *tp)
320 {
321 	int ostate, s;
322 
323 	funsetown(&tp->t_sigio);
324 	s = spltty();
325 	if (constty == tp)
326 		constty_clear();
327 
328 	ttyflush(tp, FREAD | FWRITE);
329 	clist_free_cblocks(&tp->t_canq);
330 	clist_free_cblocks(&tp->t_outq);
331 	clist_free_cblocks(&tp->t_rawq);
332 
333 	tp->t_gen++;
334 	tp->t_line = TTYDISC;
335 	tp->t_hotchar = 0;
336 	tp->t_pgrp = NULL;
337 	tp->t_session = NULL;
338 	ostate = tp->t_state;
339 	tp->t_state = 0;
340 	knlist_clear(&tp->t_rsel.si_note, 0);
341 	knlist_clear(&tp->t_wsel.si_note, 0);
342 	/*
343 	 * Both final close and revocation close might end up calling
344 	 * this method.  Only the thread clearing TS_ISOPEN should
345 	 * release the reference to the tty.
346 	 */
347 	if (ISSET(ostate, TS_ISOPEN))
348 		ttyrel(tp);
349 	splx(s);
350 	return (0);
351 }
352 
353 #define	FLUSHQ(q) {							\
354 	if ((q)->c_cc)							\
355 		ndflush(q, (q)->c_cc);					\
356 }
357 
358 /* Is 'c' a line delimiter ("break" character)? */
359 #define	TTBREAKC(c, lflag)							\
360 	((c) == '\n' || (((c) == cc[VEOF] ||				\
361 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
362 	 (c) != _POSIX_VDISABLE))
363 
364 /*
365  * Process input of a single character received on a tty.
366  */
367 int
368 ttyinput(int c, struct tty *tp)
369 {
370 	tcflag_t iflag, lflag;
371 	cc_t *cc;
372 	int i, err;
373 
374 	/*
375 	 * If input is pending take it first.
376 	 */
377 	lflag = tp->t_lflag;
378 	if (ISSET(lflag, PENDIN))
379 		ttypend(tp);
380 	/*
381 	 * Gather stats.
382 	 */
383 	if (ISSET(lflag, ICANON)) {
384 		++tk_cancc;
385 		++tp->t_cancc;
386 	} else {
387 		++tk_rawcc;
388 		++tp->t_rawcc;
389 	}
390 	++tk_nin;
391 
392 	/*
393 	 * Block further input iff:
394 	 * current input > threshold AND input is available to user program
395 	 * AND input flow control is enabled and not yet invoked.
396 	 * The 3 is slop for PARMRK.
397 	 */
398 	iflag = tp->t_iflag;
399 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
400 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
401 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
402 	    !ISSET(tp->t_state, TS_TBLOCK))
403 		ttyblock(tp);
404 
405 	/* Handle exceptional conditions (break, parity, framing). */
406 	cc = tp->t_cc;
407 	err = (ISSET(c, TTY_ERRORMASK));
408 	if (err) {
409 		CLR(c, TTY_ERRORMASK);
410 		if (ISSET(err, TTY_BI)) {
411 			if (ISSET(iflag, IGNBRK))
412 				return (0);
413 			if (ISSET(iflag, BRKINT)) {
414 				ttyflush(tp, FREAD | FWRITE);
415 				if (tp->t_pgrp != NULL) {
416 					PGRP_LOCK(tp->t_pgrp);
417 					pgsignal(tp->t_pgrp, SIGINT, 1);
418 					PGRP_UNLOCK(tp->t_pgrp);
419 				}
420 				goto endcase;
421 			}
422 			if (ISSET(iflag, PARMRK))
423 				goto parmrk;
424 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
425 			|| ISSET(err, TTY_FE)) {
426 			if (ISSET(iflag, IGNPAR))
427 				return (0);
428 			else if (ISSET(iflag, PARMRK)) {
429 parmrk:
430 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
431 				    MAX_INPUT - 3)
432 					goto input_overflow;
433 				(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
434 				(void)putc(0 | TTY_QUOTE, &tp->t_rawq);
435 				(void)putc(c | TTY_QUOTE, &tp->t_rawq);
436 				goto endcase;
437 			} else
438 				c = 0;
439 		}
440 	}
441 
442 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
443 		CLR(c, 0x80);
444 	if (!ISSET(lflag, EXTPROC)) {
445 		/*
446 		 * Check for literal nexting very first
447 		 */
448 		if (ISSET(tp->t_state, TS_LNCH)) {
449 			SET(c, TTY_QUOTE);
450 			CLR(tp->t_state, TS_LNCH);
451 		}
452 		/*
453 		 * Scan for special characters.  This code
454 		 * is really just a big case statement with
455 		 * non-constant cases.  The bottom of the
456 		 * case statement is labeled ``endcase'', so goto
457 		 * it after a case match, or similar.
458 		 */
459 
460 		/*
461 		 * Control chars which aren't controlled
462 		 * by ICANON, ISIG, or IXON.
463 		 */
464 		if (ISSET(lflag, IEXTEN)) {
465 			if (CCEQ(cc[VLNEXT], c)) {
466 				if (ISSET(lflag, ECHO)) {
467 					if (ISSET(lflag, ECHOE)) {
468 						(void)ttyoutput('^', tp);
469 						(void)ttyoutput('\b', tp);
470 					} else
471 						ttyecho(c, tp);
472 				}
473 				SET(tp->t_state, TS_LNCH);
474 				goto endcase;
475 			}
476 			if (CCEQ(cc[VDISCARD], c)) {
477 				if (ISSET(lflag, FLUSHO))
478 					CLR(tp->t_lflag, FLUSHO);
479 				else {
480 					ttyflush(tp, FWRITE);
481 					ttyecho(c, tp);
482 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
483 						ttyretype(tp);
484 					SET(tp->t_lflag, FLUSHO);
485 				}
486 				goto startoutput;
487 			}
488 		}
489 		/*
490 		 * Signals.
491 		 */
492 		if (ISSET(lflag, ISIG)) {
493 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
494 				if (!ISSET(lflag, NOFLSH))
495 					ttyflush(tp, FREAD | FWRITE);
496 				ttyecho(c, tp);
497 				if (tp->t_pgrp != NULL) {
498 					PGRP_LOCK(tp->t_pgrp);
499 					pgsignal(tp->t_pgrp,
500 					    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
501 					PGRP_UNLOCK(tp->t_pgrp);
502 				}
503 				goto endcase;
504 			}
505 			if (CCEQ(cc[VSUSP], c)) {
506 				if (!ISSET(lflag, NOFLSH))
507 					ttyflush(tp, FREAD);
508 				ttyecho(c, tp);
509 				if (tp->t_pgrp != NULL) {
510 					PGRP_LOCK(tp->t_pgrp);
511 					pgsignal(tp->t_pgrp, SIGTSTP, 1);
512 					PGRP_UNLOCK(tp->t_pgrp);
513 				}
514 				goto endcase;
515 			}
516 		}
517 		/*
518 		 * Handle start/stop characters.
519 		 */
520 		if (ISSET(iflag, IXON)) {
521 			if (CCEQ(cc[VSTOP], c)) {
522 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
523 					SET(tp->t_state, TS_TTSTOP);
524 					tt_stop(tp, 0);
525 					return (0);
526 				}
527 				if (!CCEQ(cc[VSTART], c))
528 					return (0);
529 				/*
530 				 * if VSTART == VSTOP then toggle
531 				 */
532 				goto endcase;
533 			}
534 			if (CCEQ(cc[VSTART], c))
535 				goto restartoutput;
536 		}
537 		/*
538 		 * IGNCR, ICRNL, & INLCR
539 		 */
540 		if (c == '\r') {
541 			if (ISSET(iflag, IGNCR))
542 				return (0);
543 			else if (ISSET(iflag, ICRNL))
544 				c = '\n';
545 		} else if (c == '\n' && ISSET(iflag, INLCR))
546 			c = '\r';
547 	}
548 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
549 		/*
550 		 * From here on down canonical mode character
551 		 * processing takes place.
552 		 */
553 		/*
554 		 * erase or erase2 (^H / ^?)
555 		 */
556 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
557 			if (tp->t_rawq.c_cc)
558 				ttyrub(unputc(&tp->t_rawq), tp);
559 			goto endcase;
560 		}
561 		/*
562 		 * kill (^U)
563 		 */
564 		if (CCEQ(cc[VKILL], c)) {
565 			if (ISSET(lflag, ECHOKE) &&
566 			    tp->t_rawq.c_cc == tp->t_rocount &&
567 			    !ISSET(lflag, ECHOPRT))
568 				while (tp->t_rawq.c_cc)
569 					ttyrub(unputc(&tp->t_rawq), tp);
570 			else {
571 				ttyecho(c, tp);
572 				if (ISSET(lflag, ECHOK) ||
573 				    ISSET(lflag, ECHOKE))
574 					ttyecho('\n', tp);
575 				FLUSHQ(&tp->t_rawq);
576 				tp->t_rocount = 0;
577 			}
578 			CLR(tp->t_state, TS_LOCAL);
579 			goto endcase;
580 		}
581 		/*
582 		 * word erase (^W)
583 		 */
584 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
585 			int ctype;
586 
587 			/*
588 			 * erase whitespace
589 			 */
590 			while ((c = unputc(&tp->t_rawq)) == ' ' || c == '\t')
591 				ttyrub(c, tp);
592 			if (c == -1)
593 				goto endcase;
594 			/*
595 			 * erase last char of word and remember the
596 			 * next chars type (for ALTWERASE)
597 			 */
598 			ttyrub(c, tp);
599 			c = unputc(&tp->t_rawq);
600 			if (c == -1)
601 				goto endcase;
602 			if (c == ' ' || c == '\t') {
603 				(void)putc(c, &tp->t_rawq);
604 				goto endcase;
605 			}
606 			ctype = ISALPHA(c);
607 			/*
608 			 * erase rest of word
609 			 */
610 			do {
611 				ttyrub(c, tp);
612 				c = unputc(&tp->t_rawq);
613 				if (c == -1)
614 					goto endcase;
615 			} while (c != ' ' && c != '\t' &&
616 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
617 			(void)putc(c, &tp->t_rawq);
618 			goto endcase;
619 		}
620 		/*
621 		 * reprint line (^R)
622 		 */
623 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
624 			ttyretype(tp);
625 			goto endcase;
626 		}
627 		/*
628 		 * ^T - kernel info and generate SIGINFO
629 		 */
630 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
631 			if (ISSET(lflag, ISIG) && tp->t_pgrp != NULL) {
632 				PGRP_LOCK(tp->t_pgrp);
633 				pgsignal(tp->t_pgrp, SIGINFO, 1);
634 				PGRP_UNLOCK(tp->t_pgrp);
635 			}
636 			if (!ISSET(lflag, NOKERNINFO))
637 				ttyinfo(tp);
638 			goto endcase;
639 		}
640 	}
641 	/*
642 	 * Check for input buffer overflow
643 	 */
644 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
645 input_overflow:
646 		if (ISSET(iflag, IMAXBEL)) {
647 			if (tp->t_outq.c_cc < tp->t_ohiwat)
648 				(void)ttyoutput(CTRL('g'), tp);
649 		}
650 		goto endcase;
651 	}
652 
653 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
654 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
655 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
656 
657 	/*
658 	 * Put data char in q for user and
659 	 * wakeup on seeing a line delimiter.
660 	 */
661 	if (putc(c, &tp->t_rawq) >= 0) {
662 		if (!ISSET(lflag, ICANON)) {
663 			ttwakeup(tp);
664 			ttyecho(c, tp);
665 			goto endcase;
666 		}
667 		if (TTBREAKC(c, lflag)) {
668 			tp->t_rocount = 0;
669 			catq(&tp->t_rawq, &tp->t_canq);
670 			ttwakeup(tp);
671 		} else if (tp->t_rocount++ == 0)
672 			tp->t_rocol = tp->t_column;
673 		if (ISSET(tp->t_state, TS_ERASE)) {
674 			/*
675 			 * end of prterase \.../
676 			 */
677 			CLR(tp->t_state, TS_ERASE);
678 			(void)ttyoutput('/', tp);
679 		}
680 		i = tp->t_column;
681 		ttyecho(c, tp);
682 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
683 			/*
684 			 * Place the cursor over the '^' of the ^D.
685 			 */
686 			i = imin(2, tp->t_column - i);
687 			while (i > 0) {
688 				(void)ttyoutput('\b', tp);
689 				i--;
690 			}
691 		}
692 	}
693 endcase:
694 	/*
695 	 * IXANY means allow any character to restart output.
696 	 */
697 	if (ISSET(tp->t_state, TS_TTSTOP) &&
698 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
699 		return (0);
700 restartoutput:
701 	CLR(tp->t_lflag, FLUSHO);
702 	CLR(tp->t_state, TS_TTSTOP);
703 startoutput:
704 	return (ttstart(tp));
705 }
706 
707 /*
708  * Output a single character on a tty, doing output processing
709  * as needed (expanding tabs, newline processing, etc.).
710  * Returns < 0 if succeeds, otherwise returns char to resend.
711  * Must be recursive.
712  */
713 static int
714 ttyoutput(int c, struct tty *tp)
715 {
716 	tcflag_t oflag;
717 	int col, s;
718 
719 	oflag = tp->t_oflag;
720 	if (!ISSET(oflag, OPOST)) {
721 		if (ISSET(tp->t_lflag, FLUSHO))
722 			return (-1);
723 		if (putc(c, &tp->t_outq))
724 			return (c);
725 		tk_nout++;
726 		tp->t_outcc++;
727 		return (-1);
728 	}
729 	/*
730 	 * Do tab expansion if OXTABS is set.  Special case if we external
731 	 * processing, we don't do the tab expansion because we'll probably
732 	 * get it wrong.  If tab expansion needs to be done, let it happen
733 	 * externally.
734 	 */
735 	CLR(c, ~TTY_CHARMASK);
736 	if (c == '\t' &&
737 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
738 		c = 8 - (tp->t_column & 7);
739 		if (!ISSET(tp->t_lflag, FLUSHO)) {
740 			s = spltty();		/* Don't interrupt tabs. */
741 			c -= b_to_q("        ", c, &tp->t_outq);
742 			tk_nout += c;
743 			tp->t_outcc += c;
744 			splx(s);
745 		}
746 		tp->t_column += c;
747 		return (c ? -1 : '\t');
748 	}
749 	if (c == CEOT && ISSET(oflag, ONOEOT))
750 		return (-1);
751 
752 	/*
753 	 * Newline translation: if ONLCR is set,
754 	 * translate newline into "\r\n".
755 	 */
756 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
757 		tk_nout++;
758 		tp->t_outcc++;
759 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
760 			return (c);
761 	}
762 	/* If OCRNL is set, translate "\r" into "\n". */
763 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
764 		c = '\n';
765 	/* If ONOCR is set, don't transmit CRs when on column 0. */
766 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
767 		return (-1);
768 
769 	tk_nout++;
770 	tp->t_outcc++;
771 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
772 		return (c);
773 
774 	col = tp->t_column;
775 	switch (CCLASS(c)) {
776 	case BACKSPACE:
777 		if (col > 0)
778 			--col;
779 		break;
780 	case CONTROL:
781 		break;
782 	case NEWLINE:
783 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
784 			col = 0;
785 		break;
786 	case RETURN:
787 		col = 0;
788 		break;
789 	case ORDINARY:
790 		++col;
791 		break;
792 	case TAB:
793 		col = (col + 8) & ~7;
794 		break;
795 	}
796 	tp->t_column = col;
797 	return (-1);
798 }
799 
800 /*
801  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
802  * has been called to do discipline-specific functions and/or reject any
803  * of these ioctl commands.
804  */
805 /* ARGSUSED */
806 int
807 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
808 {
809 	struct proc *p;
810 	struct thread *td;
811 	struct pgrp *pgrp;
812 	int s, error, bits, sig, sig2;
813 
814 	td = curthread;			/* XXX */
815 	p = td->td_proc;
816 
817 	/* If the ioctl involves modification, hang if in the background. */
818 	switch (cmd) {
819 	case  TIOCCBRK:
820 	case  TIOCCONS:
821 	case  TIOCDRAIN:
822 	case  TIOCEXCL:
823 	case  TIOCFLUSH:
824 #ifdef TIOCHPCL
825 	case  TIOCHPCL:
826 #endif
827 	case  TIOCNXCL:
828 	case  TIOCSBRK:
829 	case  TIOCSCTTY:
830 	case  TIOCSDRAINWAIT:
831 	case  TIOCSETA:
832 	case  TIOCSETAF:
833 	case  TIOCSETAW:
834 	case  TIOCSETD:
835 	case  TIOCSPGRP:
836 	case  TIOCSTART:
837 	case  TIOCSTAT:
838 	case  TIOCSTI:
839 	case  TIOCSTOP:
840 	case  TIOCSWINSZ:
841 #if defined(COMPAT_43TTY)
842 	case  TIOCLBIC:
843 	case  TIOCLBIS:
844 	case  TIOCLSET:
845 	case  TIOCSETC:
846 	case OTIOCSETD:
847 	case  TIOCSETN:
848 	case  TIOCSETP:
849 	case  TIOCSLTC:
850 #endif
851 		sx_slock(&proctree_lock);
852 		PROC_LOCK(p);
853 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
854 		    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
855 		    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
856 			pgrp = p->p_pgrp;
857 			PROC_UNLOCK(p);
858 			if (pgrp->pg_jobc == 0) {
859 				sx_sunlock(&proctree_lock);
860 				return (EIO);
861 			}
862 			PGRP_LOCK(pgrp);
863 			sx_sunlock(&proctree_lock);
864 			pgsignal(pgrp, SIGTTOU, 1);
865 			PGRP_UNLOCK(pgrp);
866 			error = ttysleep(tp, &lbolt, TTOPRI | PCATCH, "ttybg1",
867 					 0);
868 			if (error)
869 				return (error);
870 			sx_slock(&proctree_lock);
871 			PROC_LOCK(p);
872 		}
873 		PROC_UNLOCK(p);
874 		sx_sunlock(&proctree_lock);
875 		break;
876 	}
877 
878 
879 	if (tp->t_modem != NULL) {
880 		switch (cmd) {
881 		case TIOCSDTR:
882 			tt_modem(tp, SER_DTR, 0);
883 			return (0);
884 		case TIOCCDTR:
885 			tt_modem(tp, 0, SER_DTR);
886 			return (0);
887 		case TIOCMSET:
888 			bits = *(int *)data;
889 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
890 			sig2 = ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1;
891 			tt_modem(tp, sig, sig2);
892 			return (0);
893 		case TIOCMBIS:
894 			bits = *(int *)data;
895 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
896 			tt_modem(tp, sig, 0);
897 			return (0);
898 		case TIOCMBIC:
899 			bits = *(int *)data;
900 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
901 			tt_modem(tp, 0, sig);
902 			return (0);
903 		case TIOCMGET:
904 			sig = tt_modem(tp, 0, 0);
905 			/* See <sys/serial.h. for the "<< 1" stuff */
906 			bits = TIOCM_LE + (sig << 1);
907 			*(int *)data = bits;
908 			return (0);
909 		default:
910 			break;
911 		}
912 	}
913 
914 	if (tp->t_pps != NULL) {
915 		error = pps_ioctl(cmd, data, tp->t_pps);
916 		if (error != ENOIOCTL)
917 			return (error);
918 	}
919 
920 	switch (cmd) {			/* Process the ioctl. */
921 	case FIOASYNC:			/* set/clear async i/o */
922 		s = spltty();
923 		if (*(int *)data)
924 			SET(tp->t_state, TS_ASYNC);
925 		else
926 			CLR(tp->t_state, TS_ASYNC);
927 		splx(s);
928 		break;
929 	case FIONBIO:			/* set/clear non-blocking i/o */
930 		break;			/* XXX: delete. */
931 	case FIONREAD:			/* get # bytes to read */
932 		s = spltty();
933 		*(int *)data = ttnread(tp);
934 		splx(s);
935 		break;
936 
937 	case FIOSETOWN:
938 		/*
939 		 * Policy -- Don't allow FIOSETOWN on someone else's
940 		 *           controlling tty
941 		 */
942 		if (tp->t_session != NULL && !isctty(p, tp))
943 			return (ENOTTY);
944 
945 		error = fsetown(*(int *)data, &tp->t_sigio);
946 		if (error)
947 			return (error);
948 		break;
949 	case FIOGETOWN:
950 		if (tp->t_session != NULL && !isctty(p, tp))
951 			return (ENOTTY);
952 		*(int *)data = fgetown(&tp->t_sigio);
953 		break;
954 
955 	case TIOCEXCL:			/* set exclusive use of tty */
956 		s = spltty();
957 		SET(tp->t_state, TS_XCLUDE);
958 		splx(s);
959 		break;
960 	case TIOCFLUSH: {		/* flush buffers */
961 		int flags = *(int *)data;
962 
963 		if (flags == 0)
964 			flags = FREAD | FWRITE;
965 		else
966 			flags &= FREAD | FWRITE;
967 		ttyflush(tp, flags);
968 		break;
969 	}
970 	case TIOCCONS:			/* become virtual console */
971 		if (*(int *)data) {
972 			struct nameidata nid;
973 
974 			if (constty && constty != tp &&
975 			    ISSET(constty->t_state, TS_CONNECTED))
976 				return (EBUSY);
977 
978 			/* Ensure user can open the real console. */
979 			NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
980 			    "/dev/console", td);
981 			if ((error = namei(&nid)) != 0)
982 				return (error);
983 			NDFREE(&nid, NDF_ONLY_PNBUF);
984 			error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
985 			vput(nid.ni_vp);
986 			if (error)
987 				return (error);
988 
989 			constty_set(tp);
990 		} else if (tp == constty)
991 			constty_clear();
992 		break;
993 	case TIOCDRAIN:			/* wait till output drained */
994 		error = ttywait(tp);
995 		if (error)
996 			return (error);
997 		break;
998 	case TIOCGETA: {		/* get termios struct */
999 		struct termios *t = (struct termios *)data;
1000 
1001 		bcopy(&tp->t_termios, t, sizeof(struct termios));
1002 		break;
1003 	}
1004 	case TIOCGETD:			/* get line discipline */
1005 		*(int *)data = tp->t_line;
1006 		break;
1007 	case TIOCGWINSZ:		/* get window size */
1008 		*(struct winsize *)data = tp->t_winsize;
1009 		break;
1010 	case TIOCGPGRP:			/* get pgrp of tty */
1011 		if (!isctty(p, tp))
1012 			return (ENOTTY);
1013 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1014 		break;
1015 	case TIOCGSID:                  /* get sid of tty */
1016 		if (!isctty(p, tp))
1017 			return (ENOTTY);
1018 		*(int *)data = tp->t_session->s_sid;
1019 		break;
1020 #ifdef TIOCHPCL
1021 	case TIOCHPCL:			/* hang up on last close */
1022 		s = spltty();
1023 		SET(tp->t_cflag, HUPCL);
1024 		splx(s);
1025 		break;
1026 #endif
1027 	case TIOCMGDTRWAIT:
1028 		*(int *)data = tp->t_dtr_wait * 100 / hz;
1029 		break;
1030 	case TIOCMSDTRWAIT:
1031 		/* must be root since the wait applies to following logins */
1032 		error = priv_check(td, PRIV_TTY_DTRWAIT);
1033 		if (error)
1034 			return (error);
1035 		tp->t_dtr_wait = *(int *)data * hz / 100;
1036 		break;
1037 	case TIOCNXCL:			/* reset exclusive use of tty */
1038 		s = spltty();
1039 		CLR(tp->t_state, TS_XCLUDE);
1040 		splx(s);
1041 		break;
1042 	case TIOCOUTQ:			/* output queue size */
1043 		*(int *)data = tp->t_outq.c_cc;
1044 		break;
1045 	case TIOCSETA:			/* set termios struct */
1046 	case TIOCSETAW:			/* drain output, set */
1047 	case TIOCSETAF: {		/* drn out, fls in, set */
1048 		struct termios *t = (struct termios *)data;
1049 
1050 		if (t->c_ispeed == 0)
1051 			t->c_ispeed = t->c_ospeed;
1052 		if (t->c_ispeed == 0)
1053 			t->c_ispeed = tp->t_ospeed;
1054 		if (t->c_ispeed == 0)
1055 			return (EINVAL);
1056 		s = spltty();
1057 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1058 			error = ttywait(tp);
1059 			if (error) {
1060 				splx(s);
1061 				return (error);
1062 			}
1063 			if (cmd == TIOCSETAF)
1064 				ttyflush(tp, FREAD);
1065 		}
1066 		if (!ISSET(t->c_cflag, CIGNORE)) {
1067 			/*
1068 			 * Set device hardware.
1069 			 */
1070 			error = tt_param(tp, t);
1071 			if (error) {
1072 				splx(s);
1073 				return (error);
1074 			}
1075 			if (ISSET(t->c_cflag, CLOCAL) &&
1076 			    !ISSET(tp->t_cflag, CLOCAL)) {
1077 				/*
1078 				 * XXX disconnections would be too hard to
1079 				 * get rid of without this kludge.  The only
1080 				 * way to get rid of controlling terminals
1081 				 * is to exit from the session leader.
1082 				 */
1083 				CLR(tp->t_state, TS_ZOMBIE);
1084 
1085 				wakeup(TSA_CARR_ON(tp));
1086 				ttwakeup(tp);
1087 				ttwwakeup(tp);
1088 			}
1089 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1090 			     ISSET(t->c_cflag, CLOCAL)) &&
1091 			    !ISSET(tp->t_state, TS_ZOMBIE))
1092 				SET(tp->t_state, TS_CONNECTED);
1093 			else
1094 				CLR(tp->t_state, TS_CONNECTED);
1095 			tp->t_cflag = t->c_cflag;
1096 			tp->t_ispeed = t->c_ispeed;
1097 			if (t->c_ospeed != 0)
1098 				tp->t_ospeed = t->c_ospeed;
1099 			ttsetwater(tp);
1100 		}
1101 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1102 		    cmd != TIOCSETAF) {
1103 			if (ISSET(t->c_lflag, ICANON))
1104 				SET(tp->t_lflag, PENDIN);
1105 			else {
1106 				/*
1107 				 * XXX we really shouldn't allow toggling
1108 				 * ICANON while we're in a non-termios line
1109 				 * discipline.  Now we have to worry about
1110 				 * panicing for a null queue.
1111 				 */
1112 				if (tp->t_canq.c_cbreserved > 0 &&
1113 				    tp->t_rawq.c_cbreserved > 0) {
1114 					catq(&tp->t_rawq, &tp->t_canq);
1115 					/*
1116 					 * XXX the queue limits may be
1117 					 * different, so the old queue
1118 					 * swapping method no longer works.
1119 					 */
1120 					catq(&tp->t_canq, &tp->t_rawq);
1121 				}
1122 				CLR(tp->t_lflag, PENDIN);
1123 			}
1124 			ttwakeup(tp);
1125 		}
1126 		tp->t_iflag = t->c_iflag;
1127 		tp->t_oflag = t->c_oflag;
1128 		/*
1129 		 * Make the EXTPROC bit read only.
1130 		 */
1131 		if (ISSET(tp->t_lflag, EXTPROC))
1132 			SET(t->c_lflag, EXTPROC);
1133 		else
1134 			CLR(t->c_lflag, EXTPROC);
1135 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1136 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1137 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1138 			ttwakeup(tp);
1139 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1140 		splx(s);
1141 		break;
1142 	}
1143 	case TIOCSETD: {		/* set line discipline */
1144 		int t = *(int *)data;
1145 
1146 		if ((u_int)t >= nlinesw)
1147 			return (ENXIO);
1148 		if (t == tp->t_line)
1149 			return (0);
1150 		s = spltty();
1151 		ttyld_close(tp, flag);
1152 		tp->t_line = t;
1153 		/* XXX: we should use the correct cdev here */
1154 		error = ttyld_open(tp, tp->t_dev);
1155 		if (error) {
1156 			/*
1157 			 * If we fail to switch line discipline we cannot
1158 			 * fall back to the previous, because we can not
1159 			 * trust that ldisc to open successfully either.
1160 			 * Fall back to the default ldisc which we know
1161 			 * will allways succeed.
1162 			 */
1163 			tp->t_line = TTYDISC;
1164 			(void)ttyld_open(tp, tp->t_dev);
1165 		}
1166 		splx(s);
1167 		return (error);
1168 		break;
1169 	}
1170 	case TIOCSTART:			/* start output, like ^Q */
1171 		s = spltty();
1172 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1173 		    ISSET(tp->t_lflag, FLUSHO)) {
1174 			CLR(tp->t_lflag, FLUSHO);
1175 			CLR(tp->t_state, TS_TTSTOP);
1176 			ttstart(tp);
1177 		}
1178 		splx(s);
1179 		break;
1180 	case TIOCSTI:			/* simulate terminal input */
1181 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_TTY_STI))
1182 			return (EPERM);
1183 		if (!isctty(p, tp) && priv_check(td, PRIV_TTY_STI))
1184 			return (EACCES);
1185 		s = spltty();
1186 		ttyld_rint(tp, *(u_char *)data);
1187 		splx(s);
1188 		break;
1189 	case TIOCSTOP:			/* stop output, like ^S */
1190 		s = spltty();
1191 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1192 			SET(tp->t_state, TS_TTSTOP);
1193 			tt_stop(tp, 0);
1194 		}
1195 		splx(s);
1196 		break;
1197 	case TIOCSCTTY:			/* become controlling tty */
1198 		/* Session ctty vnode pointer set in vnode layer. */
1199 		sx_slock(&proctree_lock);
1200 		if (!SESS_LEADER(p) ||
1201 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1202 		     (tp->t_session != p->p_session))) {
1203 			sx_sunlock(&proctree_lock);
1204 			return (EPERM);
1205 		}
1206 		tp->t_session = p->p_session;
1207 		tp->t_pgrp = p->p_pgrp;
1208 		SESS_LOCK(p->p_session);
1209 		ttyref(tp);		/* ttyrel(): kern_proc.c:pgdelete() */
1210 		p->p_session->s_ttyp = tp;
1211 		SESS_UNLOCK(p->p_session);
1212 		PROC_LOCK(p);
1213 		p->p_flag |= P_CONTROLT;
1214 		PROC_UNLOCK(p);
1215 		sx_sunlock(&proctree_lock);
1216 		break;
1217 	case TIOCSPGRP: {		/* set pgrp of tty */
1218 		sx_slock(&proctree_lock);
1219 		pgrp = pgfind(*(int *)data);
1220 		if (!isctty(p, tp)) {
1221 			if (pgrp != NULL)
1222 				PGRP_UNLOCK(pgrp);
1223 			sx_sunlock(&proctree_lock);
1224 			return (ENOTTY);
1225 		}
1226 		if (pgrp == NULL) {
1227 			sx_sunlock(&proctree_lock);
1228 			return (EPERM);
1229 		}
1230 		PGRP_UNLOCK(pgrp);
1231 		if (pgrp->pg_session != p->p_session) {
1232 			sx_sunlock(&proctree_lock);
1233 			return (EPERM);
1234 		}
1235 		sx_sunlock(&proctree_lock);
1236 		tp->t_pgrp = pgrp;
1237 		break;
1238 	}
1239 	case TIOCSTAT:			/* simulate control-T */
1240 		s = spltty();
1241 		ttyinfo(tp);
1242 		splx(s);
1243 		break;
1244 	case TIOCSWINSZ:		/* set window size */
1245 		if (bcmp((caddr_t)&tp->t_winsize, data,
1246 		    sizeof (struct winsize))) {
1247 			tp->t_winsize = *(struct winsize *)data;
1248 			if (tp->t_pgrp != NULL) {
1249 				PGRP_LOCK(tp->t_pgrp);
1250 				pgsignal(tp->t_pgrp, SIGWINCH, 1);
1251 				PGRP_UNLOCK(tp->t_pgrp);
1252 			}
1253 		}
1254 		break;
1255 	case TIOCSDRAINWAIT:
1256 		error = priv_check(td, PRIV_TTY_DRAINWAIT);
1257 		if (error)
1258 			return (error);
1259 		tp->t_timeout = *(int *)data * hz;
1260 		wakeup(TSA_OCOMPLETE(tp));
1261 		wakeup(TSA_OLOWAT(tp));
1262 		break;
1263 	case TIOCGDRAINWAIT:
1264 		*(int *)data = tp->t_timeout / hz;
1265 		break;
1266 	case TIOCSBRK:
1267 		return (tt_break(tp, 1));
1268 	case TIOCCBRK:
1269 		return (tt_break(tp, 0));
1270 	default:
1271 #if defined(COMPAT_43TTY)
1272 		return (ttcompat(tp, cmd, data, flag));
1273 #else
1274 		return (ENOIOCTL);
1275 #endif
1276 	}
1277 	return (0);
1278 }
1279 
1280 int
1281 ttypoll(struct cdev *dev, int events, struct thread *td)
1282 {
1283 	int s;
1284 	int revents = 0;
1285 	struct tty *tp;
1286 
1287 	tp = tty_gettp(dev);
1288 
1289 	if (tp == NULL)	/* XXX used to return ENXIO, but that means true! */
1290 		return ((events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM))
1291 			| POLLHUP);
1292 
1293 	s = spltty();
1294 	if (events & (POLLIN | POLLRDNORM)) {
1295 		if (ISSET(tp->t_state, TS_ZOMBIE))
1296 			revents |= (events & (POLLIN | POLLRDNORM)) |
1297 			    POLLHUP;
1298 		else if (ttnread(tp) > 0)
1299 			revents |= events & (POLLIN | POLLRDNORM);
1300 		else
1301 			selrecord(td, &tp->t_rsel);
1302 	}
1303 	if (events & POLLOUT) {
1304 		if (ISSET(tp->t_state, TS_ZOMBIE))
1305 			revents |= POLLHUP;
1306 		else if (tp->t_outq.c_cc <= tp->t_olowat &&
1307 		    ISSET(tp->t_state, TS_CONNECTED))
1308 			revents |= events & POLLOUT;
1309 		else
1310 			selrecord(td, &tp->t_wsel);
1311 	}
1312 	splx(s);
1313 	return (revents);
1314 }
1315 
1316 static struct filterops ttyread_filtops =
1317 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1318 static struct filterops ttywrite_filtops =
1319 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1320 
1321 int
1322 ttykqfilter(struct cdev *dev, struct knote *kn)
1323 {
1324 	struct tty *tp;
1325 	struct knlist *klist;
1326 	int s;
1327 
1328 	tp = tty_gettp(dev);
1329 	if (tp == NULL || (tp->t_state & TS_GONE))
1330 		return (ENODEV);
1331 
1332 	switch (kn->kn_filter) {
1333 	case EVFILT_READ:
1334 		klist = &tp->t_rsel.si_note;
1335 		kn->kn_fop = &ttyread_filtops;
1336 		break;
1337 	case EVFILT_WRITE:
1338 		klist = &tp->t_wsel.si_note;
1339 		kn->kn_fop = &ttywrite_filtops;
1340 		break;
1341 	default:
1342 		return (EINVAL);
1343 	}
1344 
1345 	kn->kn_hook = (caddr_t)tp;
1346 
1347 	s = spltty();
1348 	knlist_add(klist, kn, 0);
1349 	splx(s);
1350 
1351 	return (0);
1352 }
1353 
1354 static void
1355 filt_ttyrdetach(struct knote *kn)
1356 {
1357 	struct tty *tp = (struct tty *)kn->kn_hook;
1358 	int s = spltty();
1359 
1360 	knlist_remove(&tp->t_rsel.si_note, kn, 0);
1361 	splx(s);
1362 }
1363 
1364 static int
1365 filt_ttyread(struct knote *kn, long hint)
1366 {
1367 	struct tty *tp = (struct tty *)kn->kn_hook;
1368 
1369 	kn->kn_data = ttnread(tp);
1370 	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE)) {
1371 		kn->kn_flags |= EV_EOF;
1372 		return (1);
1373 	}
1374 	return (kn->kn_data > 0);
1375 }
1376 
1377 static void
1378 filt_ttywdetach(struct knote *kn)
1379 {
1380 	struct tty *tp = (struct tty *)kn->kn_hook;
1381 	int s = spltty();
1382 
1383 	knlist_remove(&tp->t_wsel.si_note, kn, 0);
1384 	splx(s);
1385 }
1386 
1387 static int
1388 filt_ttywrite(struct knote *kn, long hint)
1389 {
1390 	struct tty *tp = (struct tty *)kn->kn_hook;
1391 
1392 	kn->kn_data = tp->t_outq.c_cc;
1393 	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE))
1394 		return (1);
1395 	return (kn->kn_data <= tp->t_olowat &&
1396 	    ISSET(tp->t_state, TS_CONNECTED));
1397 }
1398 
1399 /*
1400  * Must be called at spltty().
1401  */
1402 static int
1403 ttnread(struct tty *tp)
1404 {
1405 	int nread;
1406 
1407 	if (ISSET(tp->t_lflag, PENDIN))
1408 		ttypend(tp);
1409 	nread = tp->t_canq.c_cc;
1410 	if (!ISSET(tp->t_lflag, ICANON)) {
1411 		nread += tp->t_rawq.c_cc;
1412 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1413 			nread = 0;
1414 	}
1415 	return (nread);
1416 }
1417 
1418 /*
1419  * Wait for output to drain.
1420  */
1421 int
1422 ttywait(struct tty *tp)
1423 {
1424 	int error, s;
1425 
1426 	error = 0;
1427 	s = spltty();
1428 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1429 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1430 		tt_oproc(tp);
1431 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1432 		    ISSET(tp->t_state, TS_CONNECTED)) {
1433 			SET(tp->t_state, TS_SO_OCOMPLETE);
1434 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1435 					 TTOPRI | PCATCH, "ttywai",
1436 					 tp->t_timeout);
1437 			if (error) {
1438 				if (error == EWOULDBLOCK)
1439 					error = EIO;
1440 				break;
1441 			}
1442 		} else
1443 			break;
1444 	}
1445 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1446 		error = EIO;
1447 	splx(s);
1448 	return (error);
1449 }
1450 
1451 /*
1452  * Flush if successfully wait.
1453  */
1454 static int
1455 ttywflush(struct tty *tp)
1456 {
1457 	int error;
1458 
1459 	if ((error = ttywait(tp)) == 0)
1460 		ttyflush(tp, FREAD);
1461 	return (error);
1462 }
1463 
1464 /*
1465  * Flush tty read and/or write queues, notifying anyone waiting.
1466  */
1467 void
1468 ttyflush(struct tty *tp, int rw)
1469 {
1470 	int s;
1471 
1472 	s = spltty();
1473 #if 0
1474 again:
1475 #endif
1476 	if (rw & FWRITE) {
1477 		FLUSHQ(&tp->t_outq);
1478 		CLR(tp->t_state, TS_TTSTOP);
1479 	}
1480 	tt_stop(tp, rw);
1481 	if (rw & FREAD) {
1482 		FLUSHQ(&tp->t_canq);
1483 		FLUSHQ(&tp->t_rawq);
1484 		CLR(tp->t_lflag, PENDIN);
1485 		tp->t_rocount = 0;
1486 		tp->t_rocol = 0;
1487 		CLR(tp->t_state, TS_LOCAL);
1488 		ttwakeup(tp);
1489 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1490 			if (rw & FWRITE)
1491 				FLUSHQ(&tp->t_outq);
1492 			ttyunblock(tp);
1493 
1494 			/*
1495 			 * Don't let leave any state that might clobber the
1496 			 * next line discipline (although we should do more
1497 			 * to send the START char).  Not clearing the state
1498 			 * may have caused the "putc to a clist with no
1499 			 * reserved cblocks" panic/printf.
1500 			 */
1501 			CLR(tp->t_state, TS_TBLOCK);
1502 
1503 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1504 			if (ISSET(tp->t_iflag, IXOFF)) {
1505 				/*
1506 				 * XXX wait a bit in the hope that the stop
1507 				 * character (if any) will go out.  Waiting
1508 				 * isn't good since it allows races.  This
1509 				 * will be fixed when the stop character is
1510 				 * put in a special queue.  Don't bother with
1511 				 * the checks in ttywait() since the timeout
1512 				 * will save us.
1513 				 */
1514 				SET(tp->t_state, TS_SO_OCOMPLETE);
1515 				ttysleep(tp, TSA_OCOMPLETE(tp), TTOPRI,
1516 					 "ttyfls", hz / 10);
1517 				/*
1518 				 * Don't try sending the stop character again.
1519 				 */
1520 				CLR(tp->t_state, TS_TBLOCK);
1521 				goto again;
1522 			}
1523 #endif
1524 		}
1525 	}
1526 	if (rw & FWRITE) {
1527 		FLUSHQ(&tp->t_outq);
1528 		ttwwakeup(tp);
1529 	}
1530 	splx(s);
1531 }
1532 
1533 /*
1534  * Copy in the default termios characters.
1535  */
1536 void
1537 termioschars(struct termios *t)
1538 {
1539 
1540 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1541 }
1542 
1543 /*
1544  * Old interface.
1545  */
1546 void
1547 ttychars(struct tty *tp)
1548 {
1549 
1550 	termioschars(&tp->t_termios);
1551 }
1552 
1553 /*
1554  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1555  * on our input flow control bit and propagate the changes to the driver.
1556  * XXX the stop character should be put in a special high priority queue.
1557  */
1558 void
1559 ttyblock(struct tty *tp)
1560 {
1561 
1562 	SET(tp->t_state, TS_TBLOCK);
1563 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1564 	    putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1565 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1566 	ttstart(tp);
1567 }
1568 
1569 /*
1570  * Handle input low water.  Send start character for the IXOFF case.  Turn
1571  * off our input flow control bit and propagate the changes to the driver.
1572  * XXX the start character should be put in a special high priority queue.
1573  */
1574 static void
1575 ttyunblock(struct tty *tp)
1576 {
1577 
1578 	CLR(tp->t_state, TS_TBLOCK);
1579 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1580 	    putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1581 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1582 	ttstart(tp);
1583 }
1584 
1585 #ifdef notyet
1586 /* Not used by any current (i386) drivers. */
1587 /*
1588  * Restart after an inter-char delay.
1589  */
1590 void
1591 ttrstrt(void *tp_arg)
1592 {
1593 	struct tty *tp;
1594 	int s;
1595 
1596 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1597 
1598 	tp = tp_arg;
1599 	s = spltty();
1600 
1601 	CLR(tp->t_state, TS_TIMEOUT);
1602 	ttstart(tp);
1603 
1604 	splx(s);
1605 }
1606 #endif
1607 
1608 int
1609 ttstart(struct tty *tp)
1610 {
1611 
1612 	tt_oproc(tp);
1613 	return (0);
1614 }
1615 
1616 /*
1617  * "close" a line discipline
1618  */
1619 int
1620 ttylclose(struct tty *tp, int flag)
1621 {
1622 
1623 	if (flag & FNONBLOCK || ttywflush(tp))
1624 		ttyflush(tp, FREAD | FWRITE);
1625 	return (0);
1626 }
1627 
1628 /*
1629  * Handle modem control transition on a tty.
1630  * Flag indicates new state of carrier.
1631  * Returns 0 if the line should be turned off, otherwise 1.
1632  */
1633 int
1634 ttymodem(struct tty *tp, int flag)
1635 {
1636 
1637 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1638 		/*
1639 		 * MDMBUF: do flow control according to carrier flag
1640 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1641 		 * works if IXON and IXANY are clear.
1642 		 */
1643 		if (flag) {
1644 			CLR(tp->t_state, TS_CAR_OFLOW);
1645 			CLR(tp->t_state, TS_TTSTOP);
1646 			ttstart(tp);
1647 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1648 			SET(tp->t_state, TS_CAR_OFLOW);
1649 			SET(tp->t_state, TS_TTSTOP);
1650 			tt_stop(tp, 0);
1651 		}
1652 	} else if (flag == 0) {
1653 		/*
1654 		 * Lost carrier.
1655 		 */
1656 		CLR(tp->t_state, TS_CARR_ON);
1657 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1658 		    !ISSET(tp->t_cflag, CLOCAL)) {
1659 			SET(tp->t_state, TS_ZOMBIE);
1660 			CLR(tp->t_state, TS_CONNECTED);
1661 			if (tp->t_session) {
1662 				sx_slock(&proctree_lock);
1663 				if (tp->t_session && tp->t_session->s_leader) {
1664 					struct proc *p;
1665 
1666 					p = tp->t_session->s_leader;
1667 					PROC_LOCK(p);
1668 					psignal(p, SIGHUP);
1669 					PROC_UNLOCK(p);
1670 				}
1671 				sx_sunlock(&proctree_lock);
1672 			}
1673 			ttyflush(tp, FREAD | FWRITE);
1674 			return (0);
1675 		}
1676 	} else {
1677 		/*
1678 		 * Carrier now on.
1679 		 */
1680 		SET(tp->t_state, TS_CARR_ON);
1681 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1682 			SET(tp->t_state, TS_CONNECTED);
1683 		wakeup(TSA_CARR_ON(tp));
1684 		ttwakeup(tp);
1685 		ttwwakeup(tp);
1686 	}
1687 	return (1);
1688 }
1689 
1690 /*
1691  * Reinput pending characters after state switch
1692  * call at spltty().
1693  */
1694 static void
1695 ttypend(struct tty *tp)
1696 {
1697 	struct clist tq;
1698 	int c;
1699 
1700 	CLR(tp->t_lflag, PENDIN);
1701 	SET(tp->t_state, TS_TYPEN);
1702 	/*
1703 	 * XXX this assumes too much about clist internals.  It may even
1704 	 * fail if the cblock slush pool is empty.  We can't allocate more
1705 	 * cblocks here because we are called from an interrupt handler
1706 	 * and clist_alloc_cblocks() can wait.
1707 	 */
1708 	tq = tp->t_rawq;
1709 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1710 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1711 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1712 	while ((c = getc(&tq)) >= 0)
1713 		ttyinput(c, tp);
1714 	CLR(tp->t_state, TS_TYPEN);
1715 }
1716 
1717 /*
1718  * Process a read call on a tty device.
1719  */
1720 int
1721 ttread(struct tty *tp, struct uio *uio, int flag)
1722 {
1723 	struct clist *qp;
1724 	int c;
1725 	tcflag_t lflag;
1726 	cc_t *cc = tp->t_cc;
1727 	struct thread *td;
1728 	struct proc *p;
1729 	int s, first, error = 0;
1730 	int has_stime = 0, last_cc = 0;
1731 	long slp = 0;		/* XXX this should be renamed `timo'. */
1732 	struct timeval stime = { 0, 0 };
1733 	struct pgrp *pg;
1734 
1735 	td = curthread;
1736 	p = td->td_proc;
1737 loop:
1738 	s = spltty();
1739 	lflag = tp->t_lflag;
1740 	/*
1741 	 * take pending input first
1742 	 */
1743 	if (ISSET(lflag, PENDIN)) {
1744 		ttypend(tp);
1745 		splx(s);	/* reduce latency */
1746 		s = spltty();
1747 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1748 	}
1749 
1750 	/*
1751 	 * Hang process if it's in the background.
1752 	 */
1753 	if (isbackground(p, tp)) {
1754 		splx(s);
1755 		sx_slock(&proctree_lock);
1756 		PROC_LOCK(p);
1757 		if (SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTIN) ||
1758 		    SIGISMEMBER(td->td_sigmask, SIGTTIN) ||
1759 		    (p->p_flag & P_PPWAIT) || p->p_pgrp->pg_jobc == 0) {
1760 			PROC_UNLOCK(p);
1761 			sx_sunlock(&proctree_lock);
1762 			return (EIO);
1763 		}
1764 		pg = p->p_pgrp;
1765 		PROC_UNLOCK(p);
1766 		PGRP_LOCK(pg);
1767 		sx_sunlock(&proctree_lock);
1768 		pgsignal(pg, SIGTTIN, 1);
1769 		PGRP_UNLOCK(pg);
1770 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg2", 0);
1771 		if (error)
1772 			return (error);
1773 		goto loop;
1774 	}
1775 
1776 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1777 		splx(s);
1778 		return (0);	/* EOF */
1779 	}
1780 
1781 	/*
1782 	 * If canonical, use the canonical queue,
1783 	 * else use the raw queue.
1784 	 *
1785 	 * (should get rid of clists...)
1786 	 */
1787 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1788 
1789 	if (flag & IO_NDELAY) {
1790 		if (qp->c_cc > 0)
1791 			goto read;
1792 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1793 			splx(s);
1794 			return (0);
1795 		}
1796 		splx(s);
1797 		return (EWOULDBLOCK);
1798 	}
1799 	if (!ISSET(lflag, ICANON)) {
1800 		int m = cc[VMIN];
1801 		long t = cc[VTIME];
1802 		struct timeval timecopy;
1803 
1804 		/*
1805 		 * Check each of the four combinations.
1806 		 * (m > 0 && t == 0) is the normal read case.
1807 		 * It should be fairly efficient, so we check that and its
1808 		 * companion case (m == 0 && t == 0) first.
1809 		 * For the other two cases, we compute the target sleep time
1810 		 * into slp.
1811 		 */
1812 		if (t == 0) {
1813 			if (qp->c_cc < m)
1814 				goto sleep;
1815 			if (qp->c_cc > 0)
1816 				goto read;
1817 
1818 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1819 			splx(s);
1820 			return (0);
1821 		}
1822 		t *= 100000;		/* time in us */
1823 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1824 			 ((t1).tv_usec - (t2).tv_usec))
1825 		if (m > 0) {
1826 			if (qp->c_cc <= 0)
1827 				goto sleep;
1828 			if (qp->c_cc >= m)
1829 				goto read;
1830 			getmicrotime(&timecopy);
1831 			if (!has_stime) {
1832 				/* first character, start timer */
1833 				has_stime = 1;
1834 				stime = timecopy;
1835 				slp = t;
1836 			} else if (qp->c_cc > last_cc) {
1837 				/* got a character, restart timer */
1838 				stime = timecopy;
1839 				slp = t;
1840 			} else {
1841 				/* nothing, check expiration */
1842 				slp = t - diff(timecopy, stime);
1843 				if (slp <= 0)
1844 					goto read;
1845 			}
1846 			last_cc = qp->c_cc;
1847 		} else {	/* m == 0 */
1848 			if (qp->c_cc > 0)
1849 				goto read;
1850 			getmicrotime(&timecopy);
1851 			if (!has_stime) {
1852 				has_stime = 1;
1853 				stime = timecopy;
1854 				slp = t;
1855 			} else {
1856 				slp = t - diff(timecopy, stime);
1857 				if (slp <= 0) {
1858 					/* Timed out, but 0 is enough input. */
1859 					splx(s);
1860 					return (0);
1861 				}
1862 			}
1863 		}
1864 #undef diff
1865 		if (slp != 0) {
1866 			struct timeval tv;	/* XXX style bug. */
1867 
1868 			tv.tv_sec = slp / 1000000;
1869 			tv.tv_usec = slp % 1000000;
1870 			slp = tvtohz(&tv);
1871 			/*
1872 			 * XXX bad variable names.  slp was the timeout in
1873 			 * usec.  Now it is the timeout in ticks.
1874 			 */
1875 		}
1876 		goto sleep;
1877 	}
1878 	if (qp->c_cc <= 0) {
1879 sleep:
1880 		/*
1881 		 * There is no input, or not enough input and we can block.
1882 		 */
1883 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), TTIPRI | PCATCH,
1884 				 ISSET(tp->t_state, TS_CONNECTED) ?
1885 				 "ttyin" : "ttyhup", (int)slp);
1886 		splx(s);
1887 		if (error == EWOULDBLOCK)
1888 			error = 0;
1889 		else if (error)
1890 			return (error);
1891 		/*
1892 		 * XXX what happens if another process eats some input
1893 		 * while we are asleep (not just here)?  It would be
1894 		 * safest to detect changes and reset our state variables
1895 		 * (has_stime and last_cc).
1896 		 */
1897 		slp = 0;
1898 		goto loop;
1899 	}
1900 read:
1901 	splx(s);
1902 	/*
1903 	 * Input present, check for input mapping and processing.
1904 	 */
1905 	first = 1;
1906 	if (ISSET(lflag, ICANON | ISIG))
1907 		goto slowcase;
1908 	for (;;) {
1909 		char ibuf[IBUFSIZ];
1910 		int icc;
1911 
1912 		icc = imin(uio->uio_resid, IBUFSIZ);
1913 		icc = q_to_b(qp, ibuf, icc);
1914 		if (icc <= 0) {
1915 			if (first)
1916 				goto loop;
1917 			break;
1918 		}
1919 		error = uiomove(ibuf, icc, uio);
1920 		/*
1921 		 * XXX if there was an error then we should ungetc() the
1922 		 * unmoved chars and reduce icc here.
1923 		 */
1924 		if (error)
1925 			break;
1926 		if (uio->uio_resid == 0)
1927 			break;
1928 		first = 0;
1929 	}
1930 	goto out;
1931 slowcase:
1932 	for (;;) {
1933 		c = getc(qp);
1934 		if (c < 0) {
1935 			if (first)
1936 				goto loop;
1937 			break;
1938 		}
1939 		/*
1940 		 * delayed suspend (^Y)
1941 		 */
1942 		if (CCEQ(cc[VDSUSP], c) &&
1943 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1944 			if (tp->t_pgrp != NULL) {
1945 				PGRP_LOCK(tp->t_pgrp);
1946 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
1947 				PGRP_UNLOCK(tp->t_pgrp);
1948 			}
1949 			if (first) {
1950 				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
1951 						 "ttybg3", 0);
1952 				if (error)
1953 					break;
1954 				goto loop;
1955 			}
1956 			break;
1957 		}
1958 		/*
1959 		 * Interpret EOF only in canonical mode.
1960 		 */
1961 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1962 			break;
1963 		/*
1964 		 * Give user character.
1965 		 */
1966 		error = ureadc(c, uio);
1967 		if (error)
1968 			/* XXX should ungetc(c, qp). */
1969 			break;
1970 		if (uio->uio_resid == 0)
1971 			break;
1972 		/*
1973 		 * In canonical mode check for a "break character"
1974 		 * marking the end of a "line of input".
1975 		 */
1976 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1977 			break;
1978 		first = 0;
1979 	}
1980 
1981 out:
1982 	/*
1983 	 * Look to unblock input now that (presumably)
1984 	 * the input queue has gone down.
1985 	 */
1986 	s = spltty();
1987 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1988 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1989 		ttyunblock(tp);
1990 	splx(s);
1991 
1992 	return (error);
1993 }
1994 
1995 /*
1996  * Check the output queue on tp for space for a kernel message (from uprintf
1997  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1998  * lose messages due to normal flow control, but don't let the tty run amok.
1999  * Sleeps here are not interruptible, but we return prematurely if new signals
2000  * arrive.
2001  */
2002 int
2003 ttycheckoutq(struct tty *tp, int wait)
2004 {
2005 	int hiwat, s;
2006 	sigset_t oldmask;
2007 	struct thread *td;
2008 	struct proc *p;
2009 
2010 	td = curthread;
2011 	p = td->td_proc;
2012 	hiwat = tp->t_ohiwat;
2013 	SIGEMPTYSET(oldmask);
2014 	s = spltty();
2015 	if (wait) {
2016 		PROC_LOCK(p);
2017 		oldmask = td->td_siglist;
2018 		PROC_UNLOCK(p);
2019 	}
2020 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100)
2021 		while (tp->t_outq.c_cc > hiwat) {
2022 			ttstart(tp);
2023 			if (tp->t_outq.c_cc <= hiwat)
2024 				break;
2025 			if (!wait) {
2026 				splx(s);
2027 				return (0);
2028 			}
2029 			PROC_LOCK(p);
2030 			if (!SIGSETEQ(td->td_siglist, oldmask)) {
2031 				PROC_UNLOCK(p);
2032 				splx(s);
2033 				return (0);
2034 			}
2035 			PROC_UNLOCK(p);
2036 			SET(tp->t_state, TS_SO_OLOWAT);
2037 			tsleep(TSA_OLOWAT(tp), PZERO - 1, "ttoutq", hz);
2038 		}
2039 	splx(s);
2040 	return (1);
2041 }
2042 
2043 /*
2044  * Process a write call on a tty device.
2045  */
2046 int
2047 ttwrite(struct tty *tp, struct uio *uio, int flag)
2048 {
2049 	char *cp = NULL;
2050 	int cc, ce;
2051 	struct thread *td;
2052 	struct proc *p;
2053 	int i, hiwat, cnt, error, s;
2054 	char obuf[OBUFSIZ];
2055 
2056 	hiwat = tp->t_ohiwat;
2057 	cnt = uio->uio_resid;
2058 	error = 0;
2059 	cc = 0;
2060 	td = curthread;
2061 	p = td->td_proc;
2062 loop:
2063 	s = spltty();
2064 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2065 		splx(s);
2066 		if (uio->uio_resid == cnt)
2067 			error = EIO;
2068 		goto out;
2069 	}
2070 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2071 		if (flag & IO_NDELAY) {
2072 			splx(s);
2073 			error = EWOULDBLOCK;
2074 			goto out;
2075 		}
2076 		error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
2077 				 "ttywdcd", 0);
2078 		splx(s);
2079 		if (error)
2080 			goto out;
2081 		goto loop;
2082 	}
2083 	splx(s);
2084 	/*
2085 	 * Hang the process if it's in the background.
2086 	 */
2087 	sx_slock(&proctree_lock);
2088 	PROC_LOCK(p);
2089 	if (isbackground(p, tp) &&
2090 	    ISSET(tp->t_lflag, TOSTOP) && !(p->p_flag & P_PPWAIT) &&
2091 	    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
2092 	    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
2093 		if (p->p_pgrp->pg_jobc == 0) {
2094 			PROC_UNLOCK(p);
2095 			sx_sunlock(&proctree_lock);
2096 			error = EIO;
2097 			goto out;
2098 		}
2099 		PROC_UNLOCK(p);
2100 		PGRP_LOCK(p->p_pgrp);
2101 		sx_sunlock(&proctree_lock);
2102 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2103 		PGRP_UNLOCK(p->p_pgrp);
2104 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg4", 0);
2105 		if (error)
2106 			goto out;
2107 		goto loop;
2108 	} else {
2109 		PROC_UNLOCK(p);
2110 		sx_sunlock(&proctree_lock);
2111 	}
2112 	/*
2113 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2114 	 * output translation.  Keep track of high water mark, sleep on
2115 	 * overflow awaiting device aid in acquiring new space.
2116 	 */
2117 	while (uio->uio_resid > 0 || cc > 0) {
2118 		if (ISSET(tp->t_lflag, FLUSHO)) {
2119 			uio->uio_resid = 0;
2120 			return (0);
2121 		}
2122 		if (tp->t_outq.c_cc > hiwat)
2123 			goto ovhiwat;
2124 		/*
2125 		 * Grab a hunk of data from the user, unless we have some
2126 		 * leftover from last time.
2127 		 */
2128 		if (cc == 0) {
2129 			cc = imin(uio->uio_resid, OBUFSIZ);
2130 			cp = obuf;
2131 			error = uiomove(cp, cc, uio);
2132 			if (error) {
2133 				cc = 0;
2134 				break;
2135 			}
2136 		}
2137 		/*
2138 		 * If nothing fancy need be done, grab those characters we
2139 		 * can handle without any of ttyoutput's processing and
2140 		 * just transfer them to the output q.  For those chars
2141 		 * which require special processing (as indicated by the
2142 		 * bits in char_type), call ttyoutput.  After processing
2143 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2144 		 * immediately.
2145 		 */
2146 		while (cc > 0) {
2147 			if (!ISSET(tp->t_oflag, OPOST))
2148 				ce = cc;
2149 			else {
2150 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2151 						char_type, CCLASSMASK);
2152 				/*
2153 				 * If ce is zero, then we're processing
2154 				 * a special character through ttyoutput.
2155 				 */
2156 				if (ce == 0) {
2157 					tp->t_rocount = 0;
2158 					if (ttyoutput(*cp, tp) >= 0) {
2159 						/* No Clists, wait a bit. */
2160 						ttstart(tp);
2161 						if (flag & IO_NDELAY) {
2162 							error = EWOULDBLOCK;
2163 							goto out;
2164 						}
2165 						error = ttysleep(tp, &lbolt,
2166 								 TTOPRI|PCATCH,
2167 								 "ttybf1", 0);
2168 						if (error)
2169 							goto out;
2170 						goto loop;
2171 					}
2172 					cp++;
2173 					cc--;
2174 					if (ISSET(tp->t_lflag, FLUSHO) ||
2175 					    tp->t_outq.c_cc > hiwat)
2176 						goto ovhiwat;
2177 					continue;
2178 				}
2179 			}
2180 			/*
2181 			 * A bunch of normal characters have been found.
2182 			 * Transfer them en masse to the output queue and
2183 			 * continue processing at the top of the loop.
2184 			 * If there are any further characters in this
2185 			 * <= OBUFSIZ chunk, the first should be a character
2186 			 * requiring special handling by ttyoutput.
2187 			 */
2188 			tp->t_rocount = 0;
2189 			i = b_to_q(cp, ce, &tp->t_outq);
2190 			ce -= i;
2191 			tp->t_column += ce;
2192 			cp += ce, cc -= ce, tk_nout += ce;
2193 			tp->t_outcc += ce;
2194 			if (i > 0) {
2195 				/* No Clists, wait a bit. */
2196 				ttstart(tp);
2197 				if (flag & IO_NDELAY) {
2198 					error = EWOULDBLOCK;
2199 					goto out;
2200 				}
2201 				error = ttysleep(tp, &lbolt, TTOPRI | PCATCH,
2202 						 "ttybf2", 0);
2203 				if (error)
2204 					goto out;
2205 				goto loop;
2206 			}
2207 			if (ISSET(tp->t_lflag, FLUSHO) ||
2208 			    tp->t_outq.c_cc > hiwat)
2209 				break;
2210 		}
2211 		ttstart(tp);
2212 	}
2213 out:
2214 	/*
2215 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2216 	 * offset and iov pointers have moved forward, but it doesn't matter
2217 	 * (the call will either return short or restart with a new uio).
2218 	 */
2219 	uio->uio_resid += cc;
2220 	return (error);
2221 
2222 ovhiwat:
2223 	ttstart(tp);
2224 	s = spltty();
2225 	/*
2226 	 * This can only occur if FLUSHO is set in t_lflag,
2227 	 * or if ttstart/oproc is synchronous (or very fast).
2228 	 */
2229 	if (tp->t_outq.c_cc <= hiwat) {
2230 		splx(s);
2231 		goto loop;
2232 	}
2233 	if (flag & IO_NDELAY) {
2234 		splx(s);
2235 		uio->uio_resid += cc;
2236 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2237 	}
2238 	SET(tp->t_state, TS_SO_OLOWAT);
2239 	error = ttysleep(tp, TSA_OLOWAT(tp), TTOPRI | PCATCH, "ttywri",
2240 			 tp->t_timeout);
2241 	splx(s);
2242 	if (error == EWOULDBLOCK)
2243 		error = EIO;
2244 	if (error)
2245 		goto out;
2246 	goto loop;
2247 }
2248 
2249 /*
2250  * Rubout one character from the rawq of tp
2251  * as cleanly as possible.
2252  */
2253 static void
2254 ttyrub(int c, struct tty *tp)
2255 {
2256 	char *cp;
2257 	int savecol;
2258 	int tabc, s;
2259 
2260 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2261 		return;
2262 	CLR(tp->t_lflag, FLUSHO);
2263 	if (ISSET(tp->t_lflag, ECHOE)) {
2264 		if (tp->t_rocount == 0) {
2265 			/*
2266 			 * Screwed by ttwrite; retype
2267 			 */
2268 			ttyretype(tp);
2269 			return;
2270 		}
2271 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2272 			ttyrubo(tp, 2);
2273 		else {
2274 			CLR(c, ~TTY_CHARMASK);
2275 			switch (CCLASS(c)) {
2276 			case ORDINARY:
2277 				ttyrubo(tp, 1);
2278 				break;
2279 			case BACKSPACE:
2280 			case CONTROL:
2281 			case NEWLINE:
2282 			case RETURN:
2283 			case VTAB:
2284 				if (ISSET(tp->t_lflag, ECHOCTL))
2285 					ttyrubo(tp, 2);
2286 				break;
2287 			case TAB:
2288 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2289 					ttyretype(tp);
2290 					return;
2291 				}
2292 				s = spltty();
2293 				savecol = tp->t_column;
2294 				SET(tp->t_state, TS_CNTTB);
2295 				SET(tp->t_lflag, FLUSHO);
2296 				tp->t_column = tp->t_rocol;
2297 				cp = tp->t_rawq.c_cf;
2298 				if (cp)
2299 					tabc = *cp;	/* XXX FIX NEXTC */
2300 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2301 					ttyecho(tabc, tp);
2302 				CLR(tp->t_lflag, FLUSHO);
2303 				CLR(tp->t_state, TS_CNTTB);
2304 				splx(s);
2305 
2306 				/* savecol will now be length of the tab. */
2307 				savecol -= tp->t_column;
2308 				tp->t_column += savecol;
2309 				if (savecol > 8)
2310 					savecol = 8;	/* overflow screw */
2311 				while (--savecol >= 0)
2312 					(void)ttyoutput('\b', tp);
2313 				break;
2314 			default:			/* XXX */
2315 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2316 				(void)printf(PANICSTR, c, CCLASS(c));
2317 #ifdef notdef
2318 				panic(PANICSTR, c, CCLASS(c));
2319 #endif
2320 			}
2321 		}
2322 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2323 		if (!ISSET(tp->t_state, TS_ERASE)) {
2324 			SET(tp->t_state, TS_ERASE);
2325 			(void)ttyoutput('\\', tp);
2326 		}
2327 		ttyecho(c, tp);
2328 	} else {
2329 		ttyecho(tp->t_cc[VERASE], tp);
2330 		/*
2331 		 * This code may be executed not only when an ERASE key
2332 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2333 		 * So, I didn't think it was worthwhile to pass the extra
2334 		 * information (which would need an extra parameter,
2335 		 * changing every call) needed to distinguish the ERASE2
2336 		 * case from the ERASE.
2337 		 */
2338 	}
2339 	--tp->t_rocount;
2340 }
2341 
2342 /*
2343  * Back over cnt characters, erasing them.
2344  */
2345 static void
2346 ttyrubo(struct tty *tp, int cnt)
2347 {
2348 
2349 	while (cnt-- > 0) {
2350 		(void)ttyoutput('\b', tp);
2351 		(void)ttyoutput(' ', tp);
2352 		(void)ttyoutput('\b', tp);
2353 	}
2354 }
2355 
2356 /*
2357  * ttyretype --
2358  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2359  *	been checked.
2360  */
2361 static void
2362 ttyretype(struct tty *tp)
2363 {
2364 	char *cp;
2365 	int s, c;
2366 
2367 	/* Echo the reprint character. */
2368 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2369 		ttyecho(tp->t_cc[VREPRINT], tp);
2370 
2371 	(void)ttyoutput('\n', tp);
2372 
2373 	/*
2374 	 * XXX
2375 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2376 	 * BIT OF FIRST CHAR.
2377 	 */
2378 	s = spltty();
2379 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2380 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2381 		ttyecho(c, tp);
2382 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2383 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2384 		ttyecho(c, tp);
2385 	CLR(tp->t_state, TS_ERASE);
2386 	splx(s);
2387 
2388 	tp->t_rocount = tp->t_rawq.c_cc;
2389 	tp->t_rocol = 0;
2390 }
2391 
2392 /*
2393  * Echo a typed character to the terminal.
2394  */
2395 static void
2396 ttyecho(int c, struct tty *tp)
2397 {
2398 
2399 	if (!ISSET(tp->t_state, TS_CNTTB))
2400 		CLR(tp->t_lflag, FLUSHO);
2401 	if ((!ISSET(tp->t_lflag, ECHO) &&
2402 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2403 	    ISSET(tp->t_lflag, EXTPROC))
2404 		return;
2405 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2406 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2407 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2408 		(void)ttyoutput('^', tp);
2409 		CLR(c, ~TTY_CHARMASK);
2410 		if (c == 0177)
2411 			c = '?';
2412 		else
2413 			c += 'A' - 1;
2414 	}
2415 	(void)ttyoutput(c, tp);
2416 }
2417 
2418 /*
2419  * Wake up any readers on a tty.
2420  */
2421 void
2422 ttwakeup(struct tty *tp)
2423 {
2424 
2425 	if (SEL_WAITING(&tp->t_rsel))
2426 		selwakeuppri(&tp->t_rsel, TTIPRI);
2427 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2428 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2429 	wakeup(TSA_HUP_OR_INPUT(tp));
2430 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
2431 }
2432 
2433 /*
2434  * Wake up any writers on a tty.
2435  */
2436 void
2437 ttwwakeup(struct tty *tp)
2438 {
2439 
2440 	if (SEL_WAITING(&tp->t_wsel) && tp->t_outq.c_cc <= tp->t_olowat)
2441 		selwakeuppri(&tp->t_wsel, TTOPRI);
2442 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2443 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2444 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2445 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2446 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2447 		wakeup(TSA_OCOMPLETE(tp));
2448 	}
2449 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2450 	    tp->t_outq.c_cc <= tp->t_olowat) {
2451 		CLR(tp->t_state, TS_SO_OLOWAT);
2452 		wakeup(TSA_OLOWAT(tp));
2453 	}
2454 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
2455 }
2456 
2457 /*
2458  * Look up a code for a specified speed in a conversion table;
2459  * used by drivers to map software speed values to hardware parameters.
2460  */
2461 int
2462 ttspeedtab(int speed, struct speedtab *table)
2463 {
2464 
2465 	for ( ; table->sp_speed != -1; table++)
2466 		if (table->sp_speed == speed)
2467 			return (table->sp_code);
2468 	return (-1);
2469 }
2470 
2471 /*
2472  * Set input and output watermarks and buffer sizes.  For input, the
2473  * high watermark is about one second's worth of input above empty, the
2474  * low watermark is slightly below high water, and the buffer size is a
2475  * driver-dependent amount above high water.  For output, the watermarks
2476  * are near the ends of the buffer, with about 1 second's worth of input
2477  * between them.  All this only applies to the standard line discipline.
2478  */
2479 void
2480 ttsetwater(struct tty *tp)
2481 {
2482 	int cps, ttmaxhiwat, x;
2483 
2484 	/* Input. */
2485 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2486 	switch (tp->t_ispeedwat) {
2487 	case (speed_t)-1:
2488 		cps = tp->t_ispeed / 10;
2489 		break;
2490 	case 0:
2491 		/*
2492 		 * This case is for old drivers that don't know about
2493 		 * t_ispeedwat.  Arrange for them to get the old buffer
2494 		 * sizes and watermarks.
2495 		 */
2496 		cps = TTYHOG - 2 * 256;
2497 		tp->t_ififosize = 2 * 256;
2498 		break;
2499 	default:
2500 		cps = tp->t_ispeedwat / 10;
2501 		break;
2502 	}
2503 	tp->t_ihiwat = cps;
2504 	tp->t_ilowat = 7 * cps / 8;
2505 	x = cps + tp->t_ififosize;
2506 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2507 
2508 	/* Output. */
2509 	switch (tp->t_ospeedwat) {
2510 	case (speed_t)-1:
2511 		cps = tp->t_ospeed / 10;
2512 		ttmaxhiwat = 2 * TTMAXHIWAT;
2513 		break;
2514 	case 0:
2515 		cps = tp->t_ospeed / 10;
2516 		ttmaxhiwat = TTMAXHIWAT;
2517 		break;
2518 	default:
2519 		cps = tp->t_ospeedwat / 10;
2520 		ttmaxhiwat = 8 * TTMAXHIWAT;
2521 		break;
2522 	}
2523 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2524 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2525 	x += cps;
2526 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2527 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2528 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2529 	x += OBUFSIZ + 100;
2530 	clist_alloc_cblocks(&tp->t_outq, x, x);
2531 #undef	CLAMP
2532 }
2533 
2534 /*
2535  * Report on state of foreground process group.
2536  */
2537 void
2538 ttyinfo(struct tty *tp)
2539 {
2540 	struct timeval utime, stime;
2541 	struct proc *p, *pick;
2542 	struct thread *td, *picktd;
2543 	const char *stateprefix, *state;
2544 	long rss;
2545 	int load, pctcpu;
2546 	pid_t pid;
2547 	char comm[MAXCOMLEN + 1];
2548 	struct rusage ru;
2549 
2550 	if (ttycheckoutq(tp,0) == 0)
2551 		return;
2552 
2553 	/* Print load average. */
2554 	load = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2555 	ttyprintf(tp, "load: %d.%02d ", load / 100, load % 100);
2556 
2557 	/*
2558 	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
2559 	 * that pending input will be retyped on BS.
2560 	 */
2561 	if (tp->t_session == NULL) {
2562 		ttyprintf(tp, "not a controlling terminal\n");
2563 		tp->t_rocount = 0;
2564 		return;
2565 	}
2566 	if (tp->t_pgrp == NULL) {
2567 		ttyprintf(tp, "no foreground process group\n");
2568 		tp->t_rocount = 0;
2569 		return;
2570 	}
2571 	PGRP_LOCK(tp->t_pgrp);
2572 	if (LIST_EMPTY(&tp->t_pgrp->pg_members)) {
2573 		PGRP_UNLOCK(tp->t_pgrp);
2574 		ttyprintf(tp, "empty foreground process group\n");
2575 		tp->t_rocount = 0;
2576 		return;
2577 	}
2578 
2579 	/*
2580 	 * Pick the most interesting process and copy some of its
2581 	 * state for printing later.  This operation could rely on stale
2582 	 * data as we can't hold the proc slock or thread locks over the
2583 	 * whole list. However, we're guaranteed not to reference an exited
2584 	 * thread or proc since we hold the tty locked.
2585 	 */
2586 	pick = NULL;
2587 	LIST_FOREACH(p, &tp->t_pgrp->pg_members, p_pglist)
2588 		if (proc_compare(pick, p))
2589 			pick = p;
2590 
2591 	PROC_LOCK(pick);
2592 	picktd = NULL;
2593 	td = FIRST_THREAD_IN_PROC(pick);
2594 	FOREACH_THREAD_IN_PROC(pick, td)
2595 		if (thread_compare(picktd, td))
2596 			picktd = td;
2597 	td = picktd;
2598 	stateprefix = "";
2599 	thread_lock(td);
2600 	if (TD_IS_RUNNING(td))
2601 		state = "running";
2602 	else if (TD_ON_RUNQ(td) || TD_CAN_RUN(td))
2603 		state = "runnable";
2604 	else if (TD_IS_SLEEPING(td)) {
2605 		/* XXX: If we're sleeping, are we ever not in a queue? */
2606 		if (TD_ON_SLEEPQ(td))
2607 			state = td->td_wmesg;
2608 		else
2609 			state = "sleeping without queue";
2610 	} else if (TD_ON_LOCK(td)) {
2611 		state = td->td_lockname;
2612 		stateprefix = "*";
2613 	} else if (TD_IS_SUSPENDED(td))
2614 		state = "suspended";
2615 	else if (TD_AWAITING_INTR(td))
2616 		state = "intrwait";
2617 	else
2618 		state = "unknown";
2619 	pctcpu = (sched_pctcpu(td) * 10000 + FSCALE / 2) >> FSHIFT;
2620 	thread_unlock(td);
2621 	if (pick->p_state == PRS_NEW || pick->p_state == PRS_ZOMBIE)
2622 		rss = 0;
2623 	else
2624 		rss = pgtok(vmspace_resident_count(pick->p_vmspace));
2625 	PROC_UNLOCK(pick);
2626 	PROC_LOCK(pick);
2627 	PGRP_UNLOCK(tp->t_pgrp);
2628 	rufetchcalc(pick, &ru, &utime, &stime);
2629 	pid = pick->p_pid;
2630 	bcopy(pick->p_comm, comm, sizeof(comm));
2631 	PROC_UNLOCK(pick);
2632 
2633 	/* Print command, pid, state, utime, stime, %cpu, and rss. */
2634 	ttyprintf(tp,
2635 	    " cmd: %s %d [%s%s] %ld.%02ldu %ld.%02lds %d%% %ldk\n",
2636 	    comm, pid, stateprefix, state,
2637 	    (long)utime.tv_sec, utime.tv_usec / 10000,
2638 	    (long)stime.tv_sec, stime.tv_usec / 10000,
2639 	    pctcpu / 100, rss);
2640 	tp->t_rocount = 0;
2641 }
2642 
2643 /*
2644  * Returns 1 if p2 is "better" than p1
2645  *
2646  * The algorithm for picking the "interesting" process is thus:
2647  *
2648  *	1) Only foreground processes are eligible - implied.
2649  *	2) Runnable processes are favored over anything else.  The runner
2650  *	   with the highest cpu utilization is picked (p_estcpu).  Ties are
2651  *	   broken by picking the highest pid.
2652  *	3) The sleeper with the shortest sleep time is next.  With ties,
2653  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2654  *	4) Further ties are broken by picking the highest pid.
2655  */
2656 
2657 #define TESTAB(a, b)    ((a)<<1 | (b))
2658 #define ONLYA   2
2659 #define ONLYB   1
2660 #define BOTH    3
2661 
2662 static int
2663 proc_sum(struct proc *p, int *estcpup)
2664 {
2665 	struct thread *td;
2666 	int estcpu;
2667 	int val;
2668 
2669 	val = 0;
2670 	estcpu = 0;
2671 	FOREACH_THREAD_IN_PROC(p, td) {
2672 		thread_lock(td);
2673 		if (TD_ON_RUNQ(td) ||
2674 		    TD_IS_RUNNING(td))
2675 			val = 1;
2676 		estcpu += sched_pctcpu(td);
2677 		thread_unlock(td);
2678 	}
2679 	*estcpup = estcpu;
2680 
2681 	return (val);
2682 }
2683 
2684 static int
2685 thread_compare(struct thread *td, struct thread *td2)
2686 {
2687 	int runa, runb;
2688 	int slpa, slpb;
2689 	fixpt_t esta, estb;
2690 
2691 	if (td == NULL)
2692 		return (1);
2693 
2694 	/*
2695 	 * Fetch running stats, pctcpu usage, and interruptable flag.
2696  	 */
2697 	thread_lock(td);
2698 	runa = TD_IS_RUNNING(td) | TD_ON_RUNQ(td);
2699 	slpa = td->td_flags & TDF_SINTR;
2700 	esta = sched_pctcpu(td);
2701 	thread_unlock(td);
2702 	thread_lock(td2);
2703 	runb = TD_IS_RUNNING(td2) | TD_ON_RUNQ(td2);
2704 	estb = sched_pctcpu(td2);
2705 	slpb = td2->td_flags & TDF_SINTR;
2706 	thread_unlock(td2);
2707 	/*
2708 	 * see if at least one of them is runnable
2709 	 */
2710 	switch (TESTAB(runa, runb)) {
2711 	case ONLYA:
2712 		return (0);
2713 	case ONLYB:
2714 		return (1);
2715 	case BOTH:
2716 		break;
2717 	}
2718 	/*
2719 	 *  favor one with highest recent cpu utilization
2720 	 */
2721 	if (estb > esta)
2722 		return (1);
2723 	if (esta > estb)
2724 		return (0);
2725 	/*
2726 	 * favor one sleeping in a non-interruptible sleep
2727 	 */
2728 	switch (TESTAB(slpa, slpb)) {
2729 	case ONLYA:
2730 		return (0);
2731 	case ONLYB:
2732 		return (1);
2733 	case BOTH:
2734 		break;
2735 	}
2736 
2737 	return (td < td2);
2738 }
2739 
2740 static int
2741 proc_compare(struct proc *p1, struct proc *p2)
2742 {
2743 
2744 	int runa, runb;
2745 	fixpt_t esta, estb;
2746 
2747 	if (p1 == NULL)
2748 		return (1);
2749 
2750 	/*
2751 	 * Fetch various stats about these processes.  After we drop the
2752 	 * lock the information could be stale but the race is unimportant.
2753 	 */
2754 	PROC_LOCK(p1);
2755 	runa = proc_sum(p1, &esta);
2756 	PROC_UNLOCK(p1);
2757 	PROC_LOCK(p2);
2758 	runb = proc_sum(p2, &estb);
2759 	PROC_UNLOCK(p2);
2760 
2761 	/*
2762 	 * see if at least one of them is runnable
2763 	 */
2764 	switch (TESTAB(runa, runb)) {
2765 	case ONLYA:
2766 		return (0);
2767 	case ONLYB:
2768 		return (1);
2769 	case BOTH:
2770 		break;
2771 	}
2772 	/*
2773 	 *  favor one with highest recent cpu utilization
2774 	 */
2775 	if (estb > esta)
2776 		return (1);
2777 	if (esta > estb)
2778 		return (0);
2779 	/*
2780 	 * weed out zombies
2781 	 */
2782 	switch (TESTAB(p1->p_state == PRS_ZOMBIE, p2->p_state == PRS_ZOMBIE)) {
2783 	case ONLYA:
2784 		return (1);
2785 	case ONLYB:
2786 		return (0);
2787 	case BOTH:
2788 		break;
2789 	}
2790 
2791 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2792 }
2793 
2794 /*
2795  * Output char to tty; console putchar style.
2796  */
2797 int
2798 tputchar(int c, struct tty *tp)
2799 {
2800 	int s;
2801 
2802 	s = spltty();
2803 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2804 		splx(s);
2805 		return (-1);
2806 	}
2807 	if (c == '\n')
2808 		(void)ttyoutput('\r', tp);
2809 	(void)ttyoutput(c, tp);
2810 	ttstart(tp);
2811 	splx(s);
2812 	return (0);
2813 }
2814 
2815 /*
2816  * Sleep on chan, returning ERESTART if tty changed while we napped and
2817  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2818  * the tty is revoked, restarting a pending call will redo validation done
2819  * at the start of the call.
2820  */
2821 int
2822 ttysleep(struct tty *tp, void *chan, int pri, char *wmesg, int timo)
2823 {
2824 	int error;
2825 	int gen;
2826 
2827 	gen = tp->t_gen;
2828 	error = tsleep(chan, pri, wmesg, timo);
2829 	if (tp->t_state & TS_GONE)
2830 		return (ENXIO);
2831 	if (error)
2832 		return (error);
2833 	return (tp->t_gen == gen ? 0 : ERESTART);
2834 }
2835 
2836 /*
2837  * Gain a reference to a TTY
2838  */
2839 int
2840 ttyref(struct tty *tp)
2841 {
2842 	int i;
2843 
2844 	mtx_lock(&tp->t_mtx);
2845 	KASSERT(tp->t_refcnt > 0,
2846 	    ("ttyref(): tty refcnt is %d (%s)",
2847 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2848 	i = ++tp->t_refcnt;
2849 	mtx_unlock(&tp->t_mtx);
2850 	return (i);
2851 }
2852 
2853 /*
2854  * Drop a reference to a TTY.
2855  * When reference count drops to zero, we free it.
2856  */
2857 int
2858 ttyrel(struct tty *tp)
2859 {
2860 	int i;
2861 
2862 	mtx_lock(&tty_list_mutex);
2863 	mtx_lock(&tp->t_mtx);
2864 	KASSERT(tp->t_refcnt > 0,
2865 	    ("ttyrel(): tty refcnt is %d (%s)",
2866 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2867 	i = --tp->t_refcnt;
2868 	if (i != 0) {
2869 		mtx_unlock(&tp->t_mtx);
2870 		mtx_unlock(&tty_list_mutex);
2871 		return (i);
2872 	}
2873 	TAILQ_REMOVE(&tty_list, tp, t_list);
2874 	mtx_unlock(&tp->t_mtx);
2875 	mtx_unlock(&tty_list_mutex);
2876 	knlist_destroy(&tp->t_rsel.si_note);
2877 	knlist_destroy(&tp->t_wsel.si_note);
2878 	mtx_destroy(&tp->t_mtx);
2879 	free(tp, M_TTYS);
2880 	return (i);
2881 }
2882 
2883 /*
2884  * Allocate a tty struct.  Clists in the struct will be allocated by
2885  * tty_open().
2886  */
2887 struct tty *
2888 ttyalloc()
2889 {
2890 	struct tty *tp;
2891 
2892 	tp = malloc(sizeof *tp, M_TTYS, M_WAITOK | M_ZERO);
2893 	mtx_init(&tp->t_mtx, "tty", NULL, MTX_DEF);
2894 
2895 	/*
2896 	 * Set up the initial state
2897 	 */
2898 	tp->t_refcnt = 1;
2899 	tp->t_timeout = -1;
2900 	tp->t_dtr_wait = 3 * hz;
2901 
2902 	ttyinitmode(tp, 0, 0);
2903 	bcopy(ttydefchars, tp->t_init_in.c_cc, sizeof tp->t_init_in.c_cc);
2904 
2905 	/* Make callout the same as callin */
2906 	tp->t_init_out = tp->t_init_in;
2907 
2908 	mtx_lock(&tty_list_mutex);
2909 	TAILQ_INSERT_TAIL(&tty_list, tp, t_list);
2910 	mtx_unlock(&tty_list_mutex);
2911 	knlist_init(&tp->t_rsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2912 	knlist_init(&tp->t_wsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2913 	return (tp);
2914 }
2915 
2916 static void
2917 ttypurge(struct cdev *dev)
2918 {
2919 
2920 	if (dev->si_tty == NULL)
2921 		return;
2922 	ttygone(dev->si_tty);
2923 }
2924 
2925 /*
2926  * ttycreate()
2927  *
2928  * Create the device entries for this tty thereby opening it for business.
2929  *
2930  * The flags argument controls if "cua" units are created.
2931  *
2932  * The t_sc filed is copied to si_drv1 in the created cdevs.  This
2933  * is particularly important for ->t_cioctl() users.
2934  *
2935  * XXX: implement the init and lock devices by cloning.
2936  */
2937 
2938 int
2939 ttycreate(struct tty *tp, int flags, const char *fmt, ...)
2940 {
2941 	char namebuf[SPECNAMELEN - 3];		/* XXX space for "tty" */
2942 	struct cdevsw *csw = NULL;
2943 	int unit = 0;
2944 	va_list ap;
2945 	struct cdev *cp;
2946 	int i, minor, sminor, sunit;
2947 
2948 	mtx_assert(&Giant, MA_OWNED);
2949 
2950 	if (tty_unit == NULL)
2951 		tty_unit = new_unrhdr(0, 0xffff, NULL);
2952 
2953 	sunit = alloc_unr(tty_unit);
2954 	tp->t_devunit = sunit;
2955 
2956 	if (csw == NULL) {
2957 		csw = &tty_cdevsw;
2958 		unit = sunit;
2959 	}
2960 	KASSERT(csw->d_purge == NULL || csw->d_purge == ttypurge,
2961 	    ("tty should not have d_purge"));
2962 
2963 	csw->d_purge = ttypurge;
2964 
2965 	minor = unit2minor(unit);
2966 	sminor = unit2minor(sunit);
2967 	va_start(ap, fmt);
2968 	i = vsnrprintf(namebuf, sizeof namebuf, 32, fmt, ap);
2969 	va_end(ap);
2970 	KASSERT(i < sizeof namebuf, ("Too long tty name (%s)", namebuf));
2971 
2972 	cp = make_dev(csw, minor,
2973 	    UID_ROOT, GID_WHEEL, 0600, "tty%s", namebuf);
2974 	tp->t_dev = cp;
2975 	tp->t_mdev = cp;
2976 	cp->si_tty = tp;
2977 	cp->si_drv1 = tp->t_sc;
2978 
2979 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_INIT,
2980 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.init", namebuf);
2981 	dev_depends(tp->t_dev, cp);
2982 	cp->si_drv1 = tp->t_sc;
2983 	cp->si_drv2 = &tp->t_init_in;
2984 	cp->si_tty = tp;
2985 
2986 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_LOCK,
2987 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.lock", namebuf);
2988 	dev_depends(tp->t_dev, cp);
2989 	cp->si_drv1 = tp->t_sc;
2990 	cp->si_drv2 = &tp->t_lock_in;
2991 	cp->si_tty = tp;
2992 
2993 	if (flags & TS_CALLOUT) {
2994 		cp = make_dev(csw, minor | MINOR_CALLOUT,
2995 		    UID_UUCP, GID_DIALER, 0660, "cua%s", namebuf);
2996 		dev_depends(tp->t_dev, cp);
2997 		cp->si_drv1 = tp->t_sc;
2998 		cp->si_tty = tp;
2999 
3000 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_INIT,
3001 		    UID_UUCP, GID_DIALER, 0660, "cua%s.init", namebuf);
3002 		dev_depends(tp->t_dev, cp);
3003 		cp->si_drv1 = tp->t_sc;
3004 		cp->si_drv2 = &tp->t_init_out;
3005 		cp->si_tty = tp;
3006 
3007 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_LOCK,
3008 		    UID_UUCP, GID_DIALER, 0660, "cua%s.lock", namebuf);
3009 		dev_depends(tp->t_dev, cp);
3010 		cp->si_drv1 = tp->t_sc;
3011 		cp->si_drv2 = &tp->t_lock_out;
3012 		cp->si_tty = tp;
3013 	}
3014 
3015 	return (0);
3016 }
3017 
3018 /*
3019  * This function is called when the hardware disappears.  We set a flag
3020  * and wake up stuff so all sleeping threads will notice.
3021  */
3022 void
3023 ttygone(struct tty *tp)
3024 {
3025 
3026 	tp->t_state |= TS_GONE;
3027 	if (SEL_WAITING(&tp->t_rsel))
3028 		selwakeuppri(&tp->t_rsel, TTIPRI);
3029 	if (SEL_WAITING(&tp->t_wsel))
3030 		selwakeuppri(&tp->t_wsel, TTOPRI);
3031 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
3032 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
3033 	wakeup(&tp->t_dtr_wait);
3034 	wakeup(TSA_CARR_ON(tp));
3035 	wakeup(TSA_HUP_OR_INPUT(tp));
3036 	wakeup(TSA_OCOMPLETE(tp));
3037 	wakeup(TSA_OLOWAT(tp));
3038 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
3039 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
3040 	tt_purge(tp);
3041 }
3042 
3043 /*
3044  * ttyfree()
3045  *
3046  * Called when the driver is ready to free the tty structure.
3047  *
3048  * XXX: This shall sleep until all threads have left the driver.
3049  */
3050 void
3051 ttyfree(struct tty *tp)
3052 {
3053 	struct cdev *dev;
3054 	u_int unit;
3055 
3056 	mtx_assert(&Giant, MA_OWNED);
3057 	ttygone(tp);
3058 	unit = tp->t_devunit;
3059 	dev = tp->t_mdev;
3060 	dev->si_tty = NULL;
3061 	tp->t_dev = NULL;
3062 	destroy_dev(dev);
3063 	ttyrel(tp);
3064 	free_unr(tty_unit, unit);
3065 }
3066 
3067 static int
3068 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
3069 {
3070 	struct tty *tp, *tp2;
3071 	struct xtty xt;
3072 	int error;
3073 
3074 	error = 0;
3075 	mtx_lock(&tty_list_mutex);
3076 	tp = TAILQ_FIRST(&tty_list);
3077 	if (tp != NULL)
3078 		ttyref(tp);
3079 	while (tp != NULL) {
3080 		if (tp->t_state & TS_GONE)
3081 			goto nexttp;
3082 		bzero(&xt, sizeof xt);
3083 		xt.xt_size = sizeof xt;
3084 #define XT_COPY(field) xt.xt_##field = tp->t_##field
3085 		xt.xt_rawcc = tp->t_rawq.c_cc;
3086 		xt.xt_cancc = tp->t_canq.c_cc;
3087 		xt.xt_outcc = tp->t_outq.c_cc;
3088 		XT_COPY(line);
3089 
3090 		/*
3091 		 * XXX: We hold the tty list lock while doing this to
3092 		 * work around a race with pty/pts tty destruction.
3093 		 * They set t_dev to NULL and then call ttyrel() to
3094 		 * free the structure which will block on the list
3095 		 * lock before they call destroy_dev() on the cdev
3096 		 * backing t_dev.
3097 		 *
3098 		 * XXX: ttyfree() now does the same since it has been
3099 		 * fixed to not leak ttys.
3100 		 */
3101 		if (tp->t_dev != NULL)
3102 			xt.xt_dev = dev2udev(tp->t_dev);
3103 		XT_COPY(state);
3104 		XT_COPY(flags);
3105 		XT_COPY(timeout);
3106 		if (tp->t_pgrp != NULL)
3107 			xt.xt_pgid = tp->t_pgrp->pg_id;
3108 		if (tp->t_session != NULL)
3109 			xt.xt_sid = tp->t_session->s_sid;
3110 		XT_COPY(termios);
3111 		XT_COPY(winsize);
3112 		XT_COPY(column);
3113 		XT_COPY(rocount);
3114 		XT_COPY(rocol);
3115 		XT_COPY(ififosize);
3116 		XT_COPY(ihiwat);
3117 		XT_COPY(ilowat);
3118 		XT_COPY(ispeedwat);
3119 		XT_COPY(ohiwat);
3120 		XT_COPY(olowat);
3121 		XT_COPY(ospeedwat);
3122 #undef XT_COPY
3123 		mtx_unlock(&tty_list_mutex);
3124 		error = SYSCTL_OUT(req, &xt, sizeof xt);
3125 		if (error != 0) {
3126 			ttyrel(tp);
3127 			return (error);
3128 		}
3129 		mtx_lock(&tty_list_mutex);
3130 nexttp:		tp2 = TAILQ_NEXT(tp, t_list);
3131 		if (tp2 != NULL)
3132 			ttyref(tp2);
3133 		mtx_unlock(&tty_list_mutex);
3134 		ttyrel(tp);
3135 		tp = tp2;
3136 		mtx_lock(&tty_list_mutex);
3137 	}
3138 	mtx_unlock(&tty_list_mutex);
3139 	return (0);
3140 }
3141 
3142 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
3143 	0, 0, sysctl_kern_ttys, "S,xtty", "All ttys");
3144 SYSCTL_LONG(_kern, OID_AUTO, tty_nin, CTLFLAG_RD,
3145 	&tk_nin, 0, "Total TTY in characters");
3146 SYSCTL_LONG(_kern, OID_AUTO, tty_nout, CTLFLAG_RD,
3147 	&tk_nout, 0, "Total TTY out characters");
3148 
3149 void
3150 nottystop(struct tty *tp, int rw)
3151 {
3152 
3153 	return;
3154 }
3155 
3156 int
3157 ttyopen(struct cdev *dev, int flag, int mode, struct thread *td)
3158 {
3159 	int		error;
3160 	int		s;
3161 	struct tty	*tp;
3162 
3163 	tp = dev->si_tty;
3164 
3165 	s = spltty();
3166 	/*
3167 	 * We jump to this label after all non-interrupted sleeps to pick
3168 	 * up any changes of the device state.
3169 	 */
3170 open_top:
3171 	if (tp->t_state & TS_GONE)
3172 		return (ENXIO);
3173 	error = ttydtrwaitsleep(tp);
3174 	if (error)
3175 		goto out;
3176 	if (tp->t_state & TS_ISOPEN) {
3177 		/*
3178 		 * The device is open, so everything has been initialized.
3179 		 * Handle conflicts.
3180 		 */
3181 		if (ISCALLOUT(dev) && !tp->t_actout)
3182 			return (EBUSY);
3183 		if (tp->t_actout && !ISCALLOUT(dev)) {
3184 			if (flag & O_NONBLOCK)
3185 				return (EBUSY);
3186 			error =	tsleep(&tp->t_actout,
3187 				       TTIPRI | PCATCH, "ttybi", 0);
3188 			if (error != 0 || (tp->t_state & TS_GONE))
3189 				goto out;
3190 			goto open_top;
3191 		}
3192 		if (tp->t_state & TS_XCLUDE && priv_check(td,
3193 		    PRIV_TTY_EXCLUSIVE))
3194 			return (EBUSY);
3195 	} else {
3196 		/*
3197 		 * The device isn't open, so there are no conflicts.
3198 		 * Initialize it.  Initialization is done twice in many
3199 		 * cases: to preempt sleeping callin opens if we are
3200 		 * callout, and to complete a callin open after DCD rises.
3201 		 */
3202 		tp->t_termios = ISCALLOUT(dev) ? tp->t_init_out : tp->t_init_in;
3203 		tp->t_cflag = tp->t_termios.c_cflag;
3204 		if (tp->t_modem != NULL)
3205 			tt_modem(tp, SER_DTR | SER_RTS, 0);
3206 		++tp->t_wopeners;
3207 		error = tt_param(tp, &tp->t_termios);
3208 		--tp->t_wopeners;
3209 		if (error == 0)
3210 			error = tt_open(tp, dev);
3211 		if (error != 0)
3212 			goto out;
3213 		if (ISCALLOUT(dev) || (tt_modem(tp, 0, 0) & SER_DCD))
3214 			ttyld_modem(tp, 1);
3215 	}
3216 	/*
3217 	 * Wait for DCD if necessary.
3218 	 */
3219 	if (!(tp->t_state & TS_CARR_ON) && !ISCALLOUT(dev)
3220 	    && !(tp->t_cflag & CLOCAL) && !(flag & O_NONBLOCK)) {
3221 		++tp->t_wopeners;
3222 		error = tsleep(TSA_CARR_ON(tp), TTIPRI | PCATCH, "ttydcd", 0);
3223 		--tp->t_wopeners;
3224 		if (error != 0 || (tp->t_state & TS_GONE))
3225 			goto out;
3226 		goto open_top;
3227 	}
3228 	error =	ttyld_open(tp, dev);
3229 	ttyldoptim(tp);
3230 	if (tp->t_state & TS_ISOPEN && ISCALLOUT(dev))
3231 		tp->t_actout = TRUE;
3232 out:
3233 	splx(s);
3234 	if (!(tp->t_state & TS_ISOPEN) && tp->t_wopeners == 0)
3235 		tt_close(tp);
3236 	return (error);
3237 }
3238 
3239 int
3240 ttyclose(struct cdev *dev, int flag, int mode, struct thread *td)
3241 {
3242 	struct tty *tp;
3243 
3244 	tp = dev->si_tty;
3245 	ttyld_close(tp, flag);
3246 	ttyldoptim(tp);
3247 	tt_close(tp);
3248 	tp->t_do_timestamp = 0;
3249 	if (tp->t_pps != NULL)
3250 		tp->t_pps->ppsparam.mode = 0;
3251 	tty_close(tp);
3252 	return (0);
3253 }
3254 
3255 int
3256 ttyread(struct cdev *dev, struct uio *uio, int flag)
3257 {
3258 	struct tty *tp;
3259 
3260 	tp = tty_gettp(dev);
3261 
3262 	if (tp == NULL || (tp->t_state & TS_GONE))
3263 		return (ENODEV);
3264 	return (ttyld_read(tp, uio, flag));
3265 }
3266 
3267 int
3268 ttywrite(struct cdev *dev, struct uio *uio, int flag)
3269 {
3270 	struct tty *tp;
3271 
3272 	tp = tty_gettp(dev);
3273 
3274 	if (tp == NULL || (tp->t_state & TS_GONE))
3275 		return (ENODEV);
3276 	return (ttyld_write(tp, uio, flag));
3277 }
3278 
3279 int
3280 ttyioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3281 {
3282 	struct	tty *tp;
3283 	int	error;
3284 
3285 	tp = dev->si_tty;
3286 
3287 	if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) {
3288 		int cc;
3289 		struct termios *dt = (struct termios *)data;
3290 		struct termios *lt =
3291 		    ISCALLOUT(dev) ?  &tp->t_lock_out : &tp->t_lock_in;
3292 
3293 		dt->c_iflag = (tp->t_iflag & lt->c_iflag)
3294 		    | (dt->c_iflag & ~lt->c_iflag);
3295 		dt->c_oflag = (tp->t_oflag & lt->c_oflag)
3296 		    | (dt->c_oflag & ~lt->c_oflag);
3297 		dt->c_cflag = (tp->t_cflag & lt->c_cflag)
3298 		    | (dt->c_cflag & ~lt->c_cflag);
3299 		dt->c_lflag = (tp->t_lflag & lt->c_lflag)
3300 		    | (dt->c_lflag & ~lt->c_lflag);
3301 		for (cc = 0; cc < NCCS; ++cc)
3302 		    if (lt->c_cc[cc] != 0)
3303 		        dt->c_cc[cc] = tp->t_cc[cc];
3304 		if (lt->c_ispeed != 0)
3305 		    dt->c_ispeed = tp->t_ispeed;
3306 		if (lt->c_ospeed != 0)
3307 		    dt->c_ospeed = tp->t_ospeed;
3308 	}
3309 
3310 	error = ttyld_ioctl(tp, cmd, data, flag, td);
3311 	if (error == ENOIOCTL)
3312 		error = ttioctl(tp, cmd, data, flag);
3313 	ttyldoptim(tp);
3314 	if (error != ENOIOCTL)
3315 		return (error);
3316 	return (ENOTTY);
3317 }
3318 
3319 void
3320 ttyldoptim(struct tty *tp)
3321 {
3322 	struct termios	*t;
3323 
3324 	t = &tp->t_termios;
3325 	if (!(t->c_iflag & (ICRNL | IGNCR | IMAXBEL | INLCR | ISTRIP | IXON))
3326 	    && (!(t->c_iflag & BRKINT) || (t->c_iflag & IGNBRK))
3327 	    && (!(t->c_iflag & PARMRK)
3328 		|| (t->c_iflag & (IGNPAR | IGNBRK)) == (IGNPAR | IGNBRK))
3329 	    && !(t->c_lflag & (ECHO | ICANON | IEXTEN | ISIG | PENDIN))
3330 	    && linesw[tp->t_line]->l_rint == ttyinput)
3331 		tp->t_state |= TS_CAN_BYPASS_L_RINT;
3332 	else
3333 		tp->t_state &= ~TS_CAN_BYPASS_L_RINT;
3334 }
3335 
3336 static void
3337 ttydtrwaitwakeup(void *arg)
3338 {
3339 	struct tty *tp;
3340 
3341 	tp = arg;
3342 	tp->t_state &= ~TS_DTR_WAIT;
3343 	wakeup(&tp->t_dtr_wait);
3344 }
3345 
3346 
3347 void
3348 ttydtrwaitstart(struct tty *tp)
3349 {
3350 
3351 	if (tp->t_dtr_wait == 0)
3352 		return;
3353 	if (tp->t_state & TS_DTR_WAIT)
3354 		return;
3355 	timeout(ttydtrwaitwakeup, tp, tp->t_dtr_wait);
3356 	tp->t_state |= TS_DTR_WAIT;
3357 }
3358 
3359 int
3360 ttydtrwaitsleep(struct tty *tp)
3361 {
3362 	int error;
3363 
3364 	error = 0;
3365 	while (error == 0) {
3366 		if (tp->t_state & TS_GONE)
3367 			error = ENXIO;
3368 		else if (!(tp->t_state & TS_DTR_WAIT))
3369 			break;
3370 		else
3371 			error = tsleep(&tp->t_dtr_wait, TTIPRI | PCATCH,
3372 			    "dtrwait", 0);
3373 	}
3374 	return (error);
3375 }
3376 
3377 static int
3378 ttysopen(struct cdev *dev, int flag, int mode, struct thread *td)
3379 {
3380 	struct tty *tp;
3381 
3382 	tp = dev->si_tty;
3383 	KASSERT(tp != NULL,
3384 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3385 	if (tp->t_state & TS_GONE)
3386 		return (ENODEV);
3387 	return (0);
3388 }
3389 
3390 static int
3391 ttysclose(struct cdev *dev, int flag, int mode, struct thread *td)
3392 {
3393 
3394 	return (0);
3395 }
3396 
3397 static int
3398 ttysrdwr(struct cdev *dev, struct uio *uio, int flag)
3399 {
3400 
3401 	return (ENODEV);
3402 }
3403 
3404 static int
3405 ttysioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3406 {
3407 	struct tty	*tp;
3408 	int		error;
3409 	struct termios	*ct;
3410 
3411 	tp = dev->si_tty;
3412 	KASSERT(tp != NULL,
3413 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3414 	if (tp->t_state & TS_GONE)
3415 		return (ENODEV);
3416 	ct = dev->si_drv2;
3417 	switch (cmd) {
3418 	case TIOCSETA:
3419 		error = priv_check(td, PRIV_TTY_SETA);
3420 		if (error != 0)
3421 			return (error);
3422 		*ct = *(struct termios *)data;
3423 		return (0);
3424 	case TIOCGETA:
3425 		*(struct termios *)data = *ct;
3426 		return (0);
3427 	case TIOCGETD:
3428 		*(int *)data = TTYDISC;
3429 		return (0);
3430 	case TIOCGWINSZ:
3431 		bzero(data, sizeof(struct winsize));
3432 		return (0);
3433 	default:
3434 		if (tp->t_cioctl != NULL)
3435 			return(tp->t_cioctl(dev, cmd, data, flag, td));
3436 		return (ENOTTY);
3437 	}
3438 }
3439 
3440 /*
3441  * Initialize a tty to sane modes.
3442  */
3443 void
3444 ttyinitmode(struct tty *tp, int echo, int speed)
3445 {
3446 
3447 	if (speed == 0)
3448 		speed = TTYDEF_SPEED;
3449 	tp->t_init_in.c_iflag = TTYDEF_IFLAG;
3450 	tp->t_init_in.c_oflag = TTYDEF_OFLAG;
3451 	tp->t_init_in.c_cflag = TTYDEF_CFLAG;
3452 	if (echo)
3453 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_ECHO;
3454 	else
3455 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_NOECHO;
3456 
3457 	tp->t_init_in.c_ispeed = tp->t_init_in.c_ospeed = speed;
3458 	termioschars(&tp->t_init_in);
3459 	tp->t_init_out = tp->t_init_in;
3460 	tp->t_termios = tp->t_init_in;
3461 }
3462 
3463 /*
3464  * Use more "normal" termios paramters for consoles.
3465  */
3466 void
3467 ttyconsolemode(struct tty *tp, int speed)
3468 {
3469 
3470 	if (speed == 0)
3471 		speed = TTYDEF_SPEED;
3472 	ttyinitmode(tp, 1, speed);
3473 	tp->t_init_in.c_cflag |= CLOCAL;
3474 	tp->t_lock_out.c_cflag = tp->t_lock_in.c_cflag = CLOCAL;
3475 	tp->t_lock_out.c_ispeed = tp->t_lock_out.c_ospeed =
3476 	tp->t_lock_in.c_ispeed = tp->t_lock_in.c_ospeed = speed;
3477 	tp->t_init_out = tp->t_init_in;
3478 	tp->t_termios = tp->t_init_in;
3479 	ttsetwater(tp);
3480 }
3481 
3482 /*
3483  * Record the relationship between the serial ports notion of modem control
3484  * signals and the one used in certain ioctls in a way the compiler can enforce
3485  * XXX: We should define TIOCM_* in terms of SER_ if we can limit the
3486  * XXX: consequences of the #include work that would take.
3487  */
3488 CTASSERT(SER_DTR == TIOCM_DTR / 2);
3489 CTASSERT(SER_RTS == TIOCM_RTS / 2);
3490 CTASSERT(SER_STX == TIOCM_ST / 2);
3491 CTASSERT(SER_SRX == TIOCM_SR / 2);
3492 CTASSERT(SER_CTS == TIOCM_CTS / 2);
3493 CTASSERT(SER_DCD == TIOCM_DCD / 2);
3494 CTASSERT(SER_RI == TIOCM_RI / 2);
3495 CTASSERT(SER_DSR == TIOCM_DSR / 2);
3496 
3497