xref: /freebsd/sys/kern/tty.c (revision a35d88931c87cfe6bd38f01d7bad22140b3b38f3)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Copyright (c) 2002 Networks Associates Technologies, Inc.
11  * All rights reserved.
12  *
13  * Portions of this software were developed for the FreeBSD Project by
14  * ThinkSec AS and NAI Labs, the Security Research Division of Network
15  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
16  * ("CBOSS"), as part of the DARPA CHATS research program.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 4. Neither the name of the University nor the names of its contributors
27  *    may be used to endorse or promote products derived from this software
28  *    without specific prior written permission.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40  * SUCH DAMAGE.
41  *
42  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
43  */
44 
45 /*-
46  * TODO:
47  *	o Fix races for sending the start char in ttyflush().
48  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
49  *	  With luck, there will be MIN chars before select() returns().
50  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
51  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
52  *	  FIONREAD.
53  *	o Do the new sio locking stuff here and use it to avoid special
54  *	  case for EXTPROC?
55  *	o Lock PENDIN too?
56  *	o Move EXTPROC and/or PENDIN to t_state?
57  *	o Wrap most of ttioctl in spltty/splx.
58  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
59  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
60  *	o Don't allow certain termios flags to affect disciplines other
61  *	  than TTYDISC.  Cancel their effects before switch disciplines
62  *	  and ignore them if they are set while we are in another
63  *	  discipline.
64  *	o Now that historical speed conversions are handled here, don't
65  *	  do them in drivers.
66  *	o Check for TS_CARR_ON being set while everything is closed and not
67  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
68  *	  so it would live until the next open even if carrier drops.
69  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
70  *	  only when _all_ openers leave open().
71  */
72 
73 #include <sys/cdefs.h>
74 __FBSDID("$FreeBSD$");
75 
76 #include "opt_compat.h"
77 #include "opt_tty.h"
78 
79 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/filio.h>
82 #include <sys/lock.h>
83 #include <sys/mutex.h>
84 #include <sys/namei.h>
85 #include <sys/sx.h>
86 #ifndef BURN_BRIDGES
87 #if defined(COMPAT_43)
88 #include <sys/ioctl_compat.h>
89 #endif
90 #endif
91 #include <sys/proc.h>
92 #define	TTYDEFCHARS
93 #include <sys/tty.h>
94 #undef	TTYDEFCHARS
95 #include <sys/fcntl.h>
96 #include <sys/conf.h>
97 #include <sys/poll.h>
98 #include <sys/kernel.h>
99 #include <sys/vnode.h>
100 #include <sys/serial.h>
101 #include <sys/signalvar.h>
102 #include <sys/resourcevar.h>
103 #include <sys/malloc.h>
104 #include <sys/filedesc.h>
105 #include <sys/sched.h>
106 #include <sys/sysctl.h>
107 #include <sys/timepps.h>
108 
109 #include <machine/stdarg.h>
110 
111 #include <vm/vm.h>
112 #include <vm/pmap.h>
113 #include <vm/vm_map.h>
114 
115 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
116 
117 long tk_cancc;
118 long tk_nin;
119 long tk_nout;
120 long tk_rawcc;
121 
122 static	d_open_t	ttysopen;
123 static	d_close_t	ttysclose;
124 static	d_read_t	ttysrdwr;
125 static	d_ioctl_t	ttysioctl;
126 static	d_purge_t	ttypurge;
127 
128 /* Default cdevsw for common tty devices */
129 static struct cdevsw tty_cdevsw = {
130 	.d_version =	D_VERSION,
131 	.d_open =	ttyopen,
132 	.d_close =	ttyclose,
133 	.d_ioctl =	ttyioctl,
134 	.d_purge =	ttypurge,
135 	.d_name =	"ttydrv",
136 	.d_flags =	D_TTY | D_NEEDGIANT,
137 };
138 
139 /* Cdevsw for slave tty devices */
140 static struct cdevsw ttys_cdevsw = {
141 	.d_version =	D_VERSION,
142 	.d_open =	ttysopen,
143 	.d_close =	ttysclose,
144 	.d_read =	ttysrdwr,
145 	.d_write =	ttysrdwr,
146 	.d_ioctl =	ttysioctl,
147 	.d_name =	"TTYS",
148 	.d_flags =	D_TTY | D_NEEDGIANT,
149 };
150 
151 static int	proc_compare(struct proc *p1, struct proc *p2);
152 static int	ttnread(struct tty *tp);
153 static void	ttyecho(int c, struct tty *tp);
154 static int	ttyoutput(int c, struct tty *tp);
155 static void	ttypend(struct tty *tp);
156 static void	ttyretype(struct tty *tp);
157 static void	ttyrub(int c, struct tty *tp);
158 static void	ttyrubo(struct tty *tp, int cnt);
159 static void	ttyunblock(struct tty *tp);
160 static int	ttywflush(struct tty *tp);
161 static int	filt_ttyread(struct knote *kn, long hint);
162 static void	filt_ttyrdetach(struct knote *kn);
163 static int	filt_ttywrite(struct knote *kn, long hint);
164 static void	filt_ttywdetach(struct knote *kn);
165 
166 /*
167  * Table with character classes and parity. The 8th bit indicates parity,
168  * the 7th bit indicates the character is an alphameric or underscore (for
169  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
170  * are 0 then the character needs no special processing on output; classes
171  * other than 0 might be translated or (not currently) require delays.
172  */
173 #define	E	0x00	/* Even parity. */
174 #define	O	0x80	/* Odd parity. */
175 #define	PARITY(c)	(char_type[c] & O)
176 
177 #define	ALPHA	0x40	/* Alpha or underscore. */
178 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
179 
180 #define	CCLASSMASK	0x3f
181 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
182 
183 #define	BS	BACKSPACE
184 #define	CC	CONTROL
185 #define	CR	RETURN
186 #define	NA	ORDINARY | ALPHA
187 #define	NL	NEWLINE
188 #define	NO	ORDINARY
189 #define	TB	TAB
190 #define	VT	VTAB
191 
192 static u_char const char_type[] = {
193 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
194 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
195 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
196 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
197 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
198 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
199 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
200 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
201 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
202 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
203 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
204 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
205 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
206 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
207 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
208 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
209 	/*
210 	 * Meta chars; should be settable per character set;
211 	 * for now, treat them all as normal characters.
212 	 */
213 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
214 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
215 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
216 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
217 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
218 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
219 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
220 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
221 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
222 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
223 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
224 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
225 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
226 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
227 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
228 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
229 };
230 #undef	BS
231 #undef	CC
232 #undef	CR
233 #undef	NA
234 #undef	NL
235 #undef	NO
236 #undef	TB
237 #undef	VT
238 
239 /* Macros to clear/set/test flags. */
240 #define	SET(t, f)	(t) |= (f)
241 #define	CLR(t, f)	(t) &= ~(f)
242 #define	ISSET(t, f)	((t) & (f))
243 
244 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
245 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
246 
247 /*
248  * list of struct tty where pstat(8) can pick it up with sysctl
249  *
250  * The lock order is to grab the list mutex before the tty mutex.
251  * Together with additions going on the tail of the list, this allows
252  * the sysctl to avoid doing retries.
253  */
254 static	TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
255 static struct mtx tty_list_mutex;
256 
257 static struct unrhdr *tty_unit;
258 
259 static int  drainwait = 5*60;
260 SYSCTL_INT(_kern, OID_AUTO, drainwait, CTLFLAG_RW, &drainwait,
261 	0, "Output drain timeout in seconds");
262 
263 static struct tty *
264 tty_gettp(struct cdev *dev)
265 {
266 	struct tty *tp;
267 	struct cdevsw *csw;
268 
269 	csw = dev_refthread(dev);
270 	KASSERT(csw != NULL, ("No cdevsw in ttycode (%s)", devtoname(dev)));
271 	KASSERT(csw->d_flags & D_TTY,
272 	    ("non D_TTY (%s) in tty code", devtoname(dev)));
273 	dev_relthread(dev);
274 	tp = dev->si_tty;
275 	KASSERT(tp != NULL,
276 	    ("no tty pointer on (%s) in tty code", devtoname(dev)));
277 	return (tp);
278 }
279 
280 /*
281  * Initial open of tty, or (re)entry to standard tty line discipline.
282  */
283 int
284 tty_open(struct cdev *device, struct tty *tp)
285 {
286 	int s;
287 
288 	s = spltty();
289 	tp->t_dev = device;
290 	tp->t_hotchar = 0;
291 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
292 		ttyref(tp);
293 		SET(tp->t_state, TS_ISOPEN);
294 		if (ISSET(tp->t_cflag, CLOCAL))
295 			SET(tp->t_state, TS_CONNECTED);
296 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
297 	}
298 	/* XXX don't hang forever on output */
299 	if (tp->t_timeout < 0)
300 		tp->t_timeout = drainwait*hz;
301 	ttsetwater(tp);
302 	splx(s);
303 	return (0);
304 }
305 
306 /*
307  * Handle close() on a tty line: flush and set to initial state,
308  * bumping generation number so that pending read/write calls
309  * can detect recycling of the tty.
310  * XXX our caller should have done `spltty(); l_close(); tty_close();'
311  * and l_close() should have flushed, but we repeat the spltty() and
312  * the flush in case there are buggy callers.
313  */
314 int
315 tty_close(struct tty *tp)
316 {
317 	int s;
318 
319 	funsetown(&tp->t_sigio);
320 	s = spltty();
321 	if (constty == tp)
322 		constty_clear();
323 
324 	ttyflush(tp, FREAD | FWRITE);
325 	clist_free_cblocks(&tp->t_canq);
326 	clist_free_cblocks(&tp->t_outq);
327 	clist_free_cblocks(&tp->t_rawq);
328 
329 	tp->t_gen++;
330 	tp->t_line = TTYDISC;
331 	tp->t_hotchar = 0;
332 	tp->t_pgrp = NULL;
333 	tp->t_session = NULL;
334 	tp->t_state = 0;
335 	knlist_clear(&tp->t_rsel.si_note, 0);
336 	knlist_clear(&tp->t_wsel.si_note, 0);
337 	ttyrel(tp);
338 	splx(s);
339 	return (0);
340 }
341 
342 #define	FLUSHQ(q) {							\
343 	if ((q)->c_cc)							\
344 		ndflush(q, (q)->c_cc);					\
345 }
346 
347 /* Is 'c' a line delimiter ("break" character)? */
348 #define	TTBREAKC(c, lflag)							\
349 	((c) == '\n' || (((c) == cc[VEOF] ||				\
350 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
351 	 (c) != _POSIX_VDISABLE))
352 
353 /*
354  * Process input of a single character received on a tty.
355  */
356 int
357 ttyinput(int c, struct tty *tp)
358 {
359 	tcflag_t iflag, lflag;
360 	cc_t *cc;
361 	int i, err;
362 
363 	/*
364 	 * If input is pending take it first.
365 	 */
366 	lflag = tp->t_lflag;
367 	if (ISSET(lflag, PENDIN))
368 		ttypend(tp);
369 	/*
370 	 * Gather stats.
371 	 */
372 	if (ISSET(lflag, ICANON)) {
373 		++tk_cancc;
374 		++tp->t_cancc;
375 	} else {
376 		++tk_rawcc;
377 		++tp->t_rawcc;
378 	}
379 	++tk_nin;
380 
381 	/*
382 	 * Block further input iff:
383 	 * current input > threshold AND input is available to user program
384 	 * AND input flow control is enabled and not yet invoked.
385 	 * The 3 is slop for PARMRK.
386 	 */
387 	iflag = tp->t_iflag;
388 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
389 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
390 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
391 	    !ISSET(tp->t_state, TS_TBLOCK))
392 		ttyblock(tp);
393 
394 	/* Handle exceptional conditions (break, parity, framing). */
395 	cc = tp->t_cc;
396 	err = (ISSET(c, TTY_ERRORMASK));
397 	if (err) {
398 		CLR(c, TTY_ERRORMASK);
399 		if (ISSET(err, TTY_BI)) {
400 			if (ISSET(iflag, IGNBRK))
401 				return (0);
402 			if (ISSET(iflag, BRKINT)) {
403 				ttyflush(tp, FREAD | FWRITE);
404 				if (tp->t_pgrp != NULL) {
405 					PGRP_LOCK(tp->t_pgrp);
406 					pgsignal(tp->t_pgrp, SIGINT, 1);
407 					PGRP_UNLOCK(tp->t_pgrp);
408 				}
409 				goto endcase;
410 			}
411 			if (ISSET(iflag, PARMRK))
412 				goto parmrk;
413 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
414 			|| ISSET(err, TTY_FE)) {
415 			if (ISSET(iflag, IGNPAR))
416 				return (0);
417 			else if (ISSET(iflag, PARMRK)) {
418 parmrk:
419 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
420 				    MAX_INPUT - 3)
421 					goto input_overflow;
422 				(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
423 				(void)putc(0 | TTY_QUOTE, &tp->t_rawq);
424 				(void)putc(c | TTY_QUOTE, &tp->t_rawq);
425 				goto endcase;
426 			} else
427 				c = 0;
428 		}
429 	}
430 
431 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
432 		CLR(c, 0x80);
433 	if (!ISSET(lflag, EXTPROC)) {
434 		/*
435 		 * Check for literal nexting very first
436 		 */
437 		if (ISSET(tp->t_state, TS_LNCH)) {
438 			SET(c, TTY_QUOTE);
439 			CLR(tp->t_state, TS_LNCH);
440 		}
441 		/*
442 		 * Scan for special characters.  This code
443 		 * is really just a big case statement with
444 		 * non-constant cases.  The bottom of the
445 		 * case statement is labeled ``endcase'', so goto
446 		 * it after a case match, or similar.
447 		 */
448 
449 		/*
450 		 * Control chars which aren't controlled
451 		 * by ICANON, ISIG, or IXON.
452 		 */
453 		if (ISSET(lflag, IEXTEN)) {
454 			if (CCEQ(cc[VLNEXT], c)) {
455 				if (ISSET(lflag, ECHO)) {
456 					if (ISSET(lflag, ECHOE)) {
457 						(void)ttyoutput('^', tp);
458 						(void)ttyoutput('\b', tp);
459 					} else
460 						ttyecho(c, tp);
461 				}
462 				SET(tp->t_state, TS_LNCH);
463 				goto endcase;
464 			}
465 			if (CCEQ(cc[VDISCARD], c)) {
466 				if (ISSET(lflag, FLUSHO))
467 					CLR(tp->t_lflag, FLUSHO);
468 				else {
469 					ttyflush(tp, FWRITE);
470 					ttyecho(c, tp);
471 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
472 						ttyretype(tp);
473 					SET(tp->t_lflag, FLUSHO);
474 				}
475 				goto startoutput;
476 			}
477 		}
478 		/*
479 		 * Signals.
480 		 */
481 		if (ISSET(lflag, ISIG)) {
482 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
483 				if (!ISSET(lflag, NOFLSH))
484 					ttyflush(tp, FREAD | FWRITE);
485 				ttyecho(c, tp);
486 				if (tp->t_pgrp != NULL) {
487 					PGRP_LOCK(tp->t_pgrp);
488 					pgsignal(tp->t_pgrp,
489 					    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
490 					PGRP_UNLOCK(tp->t_pgrp);
491 				}
492 				goto endcase;
493 			}
494 			if (CCEQ(cc[VSUSP], c)) {
495 				if (!ISSET(lflag, NOFLSH))
496 					ttyflush(tp, FREAD);
497 				ttyecho(c, tp);
498 				if (tp->t_pgrp != NULL) {
499 					PGRP_LOCK(tp->t_pgrp);
500 					pgsignal(tp->t_pgrp, SIGTSTP, 1);
501 					PGRP_UNLOCK(tp->t_pgrp);
502 				}
503 				goto endcase;
504 			}
505 		}
506 		/*
507 		 * Handle start/stop characters.
508 		 */
509 		if (ISSET(iflag, IXON)) {
510 			if (CCEQ(cc[VSTOP], c)) {
511 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
512 					SET(tp->t_state, TS_TTSTOP);
513 					(*tp->t_stop)(tp, 0);
514 					return (0);
515 				}
516 				if (!CCEQ(cc[VSTART], c))
517 					return (0);
518 				/*
519 				 * if VSTART == VSTOP then toggle
520 				 */
521 				goto endcase;
522 			}
523 			if (CCEQ(cc[VSTART], c))
524 				goto restartoutput;
525 		}
526 		/*
527 		 * IGNCR, ICRNL, & INLCR
528 		 */
529 		if (c == '\r') {
530 			if (ISSET(iflag, IGNCR))
531 				return (0);
532 			else if (ISSET(iflag, ICRNL))
533 				c = '\n';
534 		} else if (c == '\n' && ISSET(iflag, INLCR))
535 			c = '\r';
536 	}
537 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
538 		/*
539 		 * From here on down canonical mode character
540 		 * processing takes place.
541 		 */
542 		/*
543 		 * erase or erase2 (^H / ^?)
544 		 */
545 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
546 			if (tp->t_rawq.c_cc)
547 				ttyrub(unputc(&tp->t_rawq), tp);
548 			goto endcase;
549 		}
550 		/*
551 		 * kill (^U)
552 		 */
553 		if (CCEQ(cc[VKILL], c)) {
554 			if (ISSET(lflag, ECHOKE) &&
555 			    tp->t_rawq.c_cc == tp->t_rocount &&
556 			    !ISSET(lflag, ECHOPRT))
557 				while (tp->t_rawq.c_cc)
558 					ttyrub(unputc(&tp->t_rawq), tp);
559 			else {
560 				ttyecho(c, tp);
561 				if (ISSET(lflag, ECHOK) ||
562 				    ISSET(lflag, ECHOKE))
563 					ttyecho('\n', tp);
564 				FLUSHQ(&tp->t_rawq);
565 				tp->t_rocount = 0;
566 			}
567 			CLR(tp->t_state, TS_LOCAL);
568 			goto endcase;
569 		}
570 		/*
571 		 * word erase (^W)
572 		 */
573 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
574 			int ctype;
575 
576 			/*
577 			 * erase whitespace
578 			 */
579 			while ((c = unputc(&tp->t_rawq)) == ' ' || c == '\t')
580 				ttyrub(c, tp);
581 			if (c == -1)
582 				goto endcase;
583 			/*
584 			 * erase last char of word and remember the
585 			 * next chars type (for ALTWERASE)
586 			 */
587 			ttyrub(c, tp);
588 			c = unputc(&tp->t_rawq);
589 			if (c == -1)
590 				goto endcase;
591 			if (c == ' ' || c == '\t') {
592 				(void)putc(c, &tp->t_rawq);
593 				goto endcase;
594 			}
595 			ctype = ISALPHA(c);
596 			/*
597 			 * erase rest of word
598 			 */
599 			do {
600 				ttyrub(c, tp);
601 				c = unputc(&tp->t_rawq);
602 				if (c == -1)
603 					goto endcase;
604 			} while (c != ' ' && c != '\t' &&
605 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
606 			(void)putc(c, &tp->t_rawq);
607 			goto endcase;
608 		}
609 		/*
610 		 * reprint line (^R)
611 		 */
612 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
613 			ttyretype(tp);
614 			goto endcase;
615 		}
616 		/*
617 		 * ^T - kernel info and generate SIGINFO
618 		 */
619 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
620 			if (ISSET(lflag, ISIG) && tp->t_pgrp != NULL) {
621 				PGRP_LOCK(tp->t_pgrp);
622 				pgsignal(tp->t_pgrp, SIGINFO, 1);
623 				PGRP_UNLOCK(tp->t_pgrp);
624 			}
625 			if (!ISSET(lflag, NOKERNINFO))
626 				ttyinfo(tp);
627 			goto endcase;
628 		}
629 	}
630 	/*
631 	 * Check for input buffer overflow
632 	 */
633 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
634 input_overflow:
635 		if (ISSET(iflag, IMAXBEL)) {
636 			if (tp->t_outq.c_cc < tp->t_ohiwat)
637 				(void)ttyoutput(CTRL('g'), tp);
638 		}
639 		goto endcase;
640 	}
641 
642 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
643 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
644 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
645 
646 	/*
647 	 * Put data char in q for user and
648 	 * wakeup on seeing a line delimiter.
649 	 */
650 	if (putc(c, &tp->t_rawq) >= 0) {
651 		if (!ISSET(lflag, ICANON)) {
652 			ttwakeup(tp);
653 			ttyecho(c, tp);
654 			goto endcase;
655 		}
656 		if (TTBREAKC(c, lflag)) {
657 			tp->t_rocount = 0;
658 			catq(&tp->t_rawq, &tp->t_canq);
659 			ttwakeup(tp);
660 		} else if (tp->t_rocount++ == 0)
661 			tp->t_rocol = tp->t_column;
662 		if (ISSET(tp->t_state, TS_ERASE)) {
663 			/*
664 			 * end of prterase \.../
665 			 */
666 			CLR(tp->t_state, TS_ERASE);
667 			(void)ttyoutput('/', tp);
668 		}
669 		i = tp->t_column;
670 		ttyecho(c, tp);
671 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
672 			/*
673 			 * Place the cursor over the '^' of the ^D.
674 			 */
675 			i = imin(2, tp->t_column - i);
676 			while (i > 0) {
677 				(void)ttyoutput('\b', tp);
678 				i--;
679 			}
680 		}
681 	}
682 endcase:
683 	/*
684 	 * IXANY means allow any character to restart output.
685 	 */
686 	if (ISSET(tp->t_state, TS_TTSTOP) &&
687 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
688 		return (0);
689 restartoutput:
690 	CLR(tp->t_lflag, FLUSHO);
691 	CLR(tp->t_state, TS_TTSTOP);
692 startoutput:
693 	return (ttstart(tp));
694 }
695 
696 /*
697  * Output a single character on a tty, doing output processing
698  * as needed (expanding tabs, newline processing, etc.).
699  * Returns < 0 if succeeds, otherwise returns char to resend.
700  * Must be recursive.
701  */
702 static int
703 ttyoutput(int c, struct tty *tp)
704 {
705 	tcflag_t oflag;
706 	int col, s;
707 
708 	oflag = tp->t_oflag;
709 	if (!ISSET(oflag, OPOST)) {
710 		if (ISSET(tp->t_lflag, FLUSHO))
711 			return (-1);
712 		if (putc(c, &tp->t_outq))
713 			return (c);
714 		tk_nout++;
715 		tp->t_outcc++;
716 		return (-1);
717 	}
718 	/*
719 	 * Do tab expansion if OXTABS is set.  Special case if we external
720 	 * processing, we don't do the tab expansion because we'll probably
721 	 * get it wrong.  If tab expansion needs to be done, let it happen
722 	 * externally.
723 	 */
724 	CLR(c, ~TTY_CHARMASK);
725 	if (c == '\t' &&
726 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
727 		c = 8 - (tp->t_column & 7);
728 		if (!ISSET(tp->t_lflag, FLUSHO)) {
729 			s = spltty();		/* Don't interrupt tabs. */
730 			c -= b_to_q("        ", c, &tp->t_outq);
731 			tk_nout += c;
732 			tp->t_outcc += c;
733 			splx(s);
734 		}
735 		tp->t_column += c;
736 		return (c ? -1 : '\t');
737 	}
738 	if (c == CEOT && ISSET(oflag, ONOEOT))
739 		return (-1);
740 
741 	/*
742 	 * Newline translation: if ONLCR is set,
743 	 * translate newline into "\r\n".
744 	 */
745 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
746 		tk_nout++;
747 		tp->t_outcc++;
748 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
749 			return (c);
750 	}
751 	/* If OCRNL is set, translate "\r" into "\n". */
752 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
753 		c = '\n';
754 	/* If ONOCR is set, don't transmit CRs when on column 0. */
755 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
756 		return (-1);
757 
758 	tk_nout++;
759 	tp->t_outcc++;
760 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
761 		return (c);
762 
763 	col = tp->t_column;
764 	switch (CCLASS(c)) {
765 	case BACKSPACE:
766 		if (col > 0)
767 			--col;
768 		break;
769 	case CONTROL:
770 		break;
771 	case NEWLINE:
772 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
773 			col = 0;
774 		break;
775 	case RETURN:
776 		col = 0;
777 		break;
778 	case ORDINARY:
779 		++col;
780 		break;
781 	case TAB:
782 		col = (col + 8) & ~7;
783 		break;
784 	}
785 	tp->t_column = col;
786 	return (-1);
787 }
788 
789 /*
790  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
791  * has been called to do discipline-specific functions and/or reject any
792  * of these ioctl commands.
793  */
794 /* ARGSUSED */
795 int
796 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
797 {
798 	struct proc *p;
799 	struct thread *td;
800 	struct pgrp *pgrp;
801 	int s, error, bits, sig, sig2;
802 
803 	td = curthread;			/* XXX */
804 	p = td->td_proc;
805 
806 	/* If the ioctl involves modification, hang if in the background. */
807 	switch (cmd) {
808 	case  TIOCCBRK:
809 	case  TIOCCONS:
810 	case  TIOCDRAIN:
811 	case  TIOCEXCL:
812 	case  TIOCFLUSH:
813 #ifdef TIOCHPCL
814 	case  TIOCHPCL:
815 #endif
816 	case  TIOCNXCL:
817 	case  TIOCSBRK:
818 	case  TIOCSCTTY:
819 	case  TIOCSDRAINWAIT:
820 	case  TIOCSETA:
821 	case  TIOCSETAF:
822 	case  TIOCSETAW:
823 	case  TIOCSETD:
824 	case  TIOCSPGRP:
825 	case  TIOCSTART:
826 	case  TIOCSTAT:
827 	case  TIOCSTI:
828 	case  TIOCSTOP:
829 	case  TIOCSWINSZ:
830 #ifndef BURN_BRIDGES
831 #if defined(COMPAT_43)
832 	case  TIOCLBIC:
833 	case  TIOCLBIS:
834 	case  TIOCLSET:
835 	case  TIOCSETC:
836 	case OTIOCSETD:
837 	case  TIOCSETN:
838 	case  TIOCSETP:
839 	case  TIOCSLTC:
840 #endif
841 #endif
842 		sx_slock(&proctree_lock);
843 		PROC_LOCK(p);
844 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
845 		    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
846 		    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
847 			pgrp = p->p_pgrp;
848 			PROC_UNLOCK(p);
849 			if (pgrp->pg_jobc == 0) {
850 				sx_sunlock(&proctree_lock);
851 				return (EIO);
852 			}
853 			PGRP_LOCK(pgrp);
854 			sx_sunlock(&proctree_lock);
855 			pgsignal(pgrp, SIGTTOU, 1);
856 			PGRP_UNLOCK(pgrp);
857 			error = ttysleep(tp, &lbolt, TTOPRI | PCATCH, "ttybg1",
858 					 0);
859 			if (error)
860 				return (error);
861 			sx_slock(&proctree_lock);
862 			PROC_LOCK(p);
863 		}
864 		PROC_UNLOCK(p);
865 		sx_sunlock(&proctree_lock);
866 		break;
867 	}
868 
869 	if (tp->t_break != NULL) {
870 		switch (cmd) {
871 		case TIOCSBRK:
872 			tp->t_break(tp, 1);
873 			return (0);
874 		case TIOCCBRK:
875 			tp->t_break(tp, 0);
876 			return (0);
877 		default:
878 			break;
879 		}
880 	}
881 
882 	if (tp->t_modem != NULL) {
883 		switch (cmd) {
884 		case TIOCSDTR:
885 			tp->t_modem(tp, SER_DTR, 0);
886 			return (0);
887 		case TIOCCDTR:
888 			tp->t_modem(tp, 0, SER_DTR);
889 			return (0);
890 		case TIOCMSET:
891 			bits = *(int *)data;
892 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
893 			sig2 = ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1;
894 			tp->t_modem(tp, sig, sig2);
895 			return (0);
896 		case TIOCMBIS:
897 			bits = *(int *)data;
898 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
899 			tp->t_modem(tp, sig, 0);
900 			return (0);
901 		case TIOCMBIC:
902 			bits = *(int *)data;
903 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
904 			tp->t_modem(tp, 0, sig);
905 			return (0);
906 		case TIOCMGET:
907 			sig = tp->t_modem(tp, 0, 0);
908 			/* See <sys/serial.h. for the "<< 1" stuff */
909 			bits = TIOCM_LE + (sig << 1);
910 			*(int *)data = bits;
911 			return (0);
912 		default:
913 			break;
914 		}
915 	}
916 
917 	switch (cmd) {			/* Process the ioctl. */
918 	case FIOASYNC:			/* set/clear async i/o */
919 		s = spltty();
920 		if (*(int *)data)
921 			SET(tp->t_state, TS_ASYNC);
922 		else
923 			CLR(tp->t_state, TS_ASYNC);
924 		splx(s);
925 		break;
926 	case FIONBIO:			/* set/clear non-blocking i/o */
927 		break;			/* XXX: delete. */
928 	case FIONREAD:			/* get # bytes to read */
929 		s = spltty();
930 		*(int *)data = ttnread(tp);
931 		splx(s);
932 		break;
933 
934 	case FIOSETOWN:
935 		/*
936 		 * Policy -- Don't allow FIOSETOWN on someone else's
937 		 *           controlling tty
938 		 */
939 		if (tp->t_session != NULL && !isctty(p, tp))
940 			return (ENOTTY);
941 
942 		error = fsetown(*(int *)data, &tp->t_sigio);
943 		if (error)
944 			return (error);
945 		break;
946 	case FIOGETOWN:
947 		if (tp->t_session != NULL && !isctty(p, tp))
948 			return (ENOTTY);
949 		*(int *)data = fgetown(&tp->t_sigio);
950 		break;
951 
952 	case TIOCEXCL:			/* set exclusive use of tty */
953 		s = spltty();
954 		SET(tp->t_state, TS_XCLUDE);
955 		splx(s);
956 		break;
957 	case TIOCFLUSH: {		/* flush buffers */
958 		int flags = *(int *)data;
959 
960 		if (flags == 0)
961 			flags = FREAD | FWRITE;
962 		else
963 			flags &= FREAD | FWRITE;
964 		ttyflush(tp, flags);
965 		break;
966 	}
967 	case TIOCCONS:			/* become virtual console */
968 		if (*(int *)data) {
969 			struct nameidata nid;
970 
971 			if (constty && constty != tp &&
972 			    ISSET(constty->t_state, TS_CONNECTED))
973 				return (EBUSY);
974 
975 			/* Ensure user can open the real console. */
976 			NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
977 			    "/dev/console", td);
978 			if ((error = namei(&nid)) != 0)
979 				return (error);
980 			NDFREE(&nid, NDF_ONLY_PNBUF);
981 			error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
982 			vput(nid.ni_vp);
983 			if (error)
984 				return (error);
985 
986 			constty_set(tp);
987 		} else if (tp == constty)
988 			constty_clear();
989 		break;
990 	case TIOCDRAIN:			/* wait till output drained */
991 		error = ttywait(tp);
992 		if (error)
993 			return (error);
994 		break;
995 	case TIOCGETA: {		/* get termios struct */
996 		struct termios *t = (struct termios *)data;
997 
998 		bcopy(&tp->t_termios, t, sizeof(struct termios));
999 		break;
1000 	}
1001 	case TIOCGETD:			/* get line discipline */
1002 		*(int *)data = tp->t_line;
1003 		break;
1004 	case TIOCGWINSZ:		/* get window size */
1005 		*(struct winsize *)data = tp->t_winsize;
1006 		break;
1007 	case TIOCGPGRP:			/* get pgrp of tty */
1008 		if (!isctty(p, tp))
1009 			return (ENOTTY);
1010 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1011 		break;
1012 #ifdef TIOCHPCL
1013 	case TIOCHPCL:			/* hang up on last close */
1014 		s = spltty();
1015 		SET(tp->t_cflag, HUPCL);
1016 		splx(s);
1017 		break;
1018 #endif
1019 	case TIOCMGDTRWAIT:
1020 		*(int *)data = tp->t_dtr_wait * 100 / hz;
1021 		break;
1022 	case TIOCMSDTRWAIT:
1023 		/* must be root since the wait applies to following logins */
1024 		error = suser(td);
1025 		if (error)
1026 			return (error);
1027 		tp->t_dtr_wait = *(int *)data * hz / 100;
1028 		break;
1029 	case TIOCNXCL:			/* reset exclusive use of tty */
1030 		s = spltty();
1031 		CLR(tp->t_state, TS_XCLUDE);
1032 		splx(s);
1033 		break;
1034 	case TIOCOUTQ:			/* output queue size */
1035 		*(int *)data = tp->t_outq.c_cc;
1036 		break;
1037 	case TIOCSETA:			/* set termios struct */
1038 	case TIOCSETAW:			/* drain output, set */
1039 	case TIOCSETAF: {		/* drn out, fls in, set */
1040 		struct termios *t = (struct termios *)data;
1041 
1042 		if (t->c_ispeed == 0)
1043 			t->c_ispeed = t->c_ospeed;
1044 		if (t->c_ispeed == 0)
1045 			t->c_ispeed = tp->t_ospeed;
1046 		if (t->c_ispeed == 0)
1047 			return (EINVAL);
1048 		s = spltty();
1049 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1050 			error = ttywait(tp);
1051 			if (error) {
1052 				splx(s);
1053 				return (error);
1054 			}
1055 			if (cmd == TIOCSETAF)
1056 				ttyflush(tp, FREAD);
1057 		}
1058 		if (!ISSET(t->c_cflag, CIGNORE)) {
1059 			/*
1060 			 * Set device hardware.
1061 			 */
1062 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1063 				splx(s);
1064 				return (error);
1065 			}
1066 			if (ISSET(t->c_cflag, CLOCAL) &&
1067 			    !ISSET(tp->t_cflag, CLOCAL)) {
1068 				/*
1069 				 * XXX disconnections would be too hard to
1070 				 * get rid of without this kludge.  The only
1071 				 * way to get rid of controlling terminals
1072 				 * is to exit from the session leader.
1073 				 */
1074 				CLR(tp->t_state, TS_ZOMBIE);
1075 
1076 				wakeup(TSA_CARR_ON(tp));
1077 				ttwakeup(tp);
1078 				ttwwakeup(tp);
1079 			}
1080 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1081 			     ISSET(t->c_cflag, CLOCAL)) &&
1082 			    !ISSET(tp->t_state, TS_ZOMBIE))
1083 				SET(tp->t_state, TS_CONNECTED);
1084 			else
1085 				CLR(tp->t_state, TS_CONNECTED);
1086 			tp->t_cflag = t->c_cflag;
1087 			tp->t_ispeed = t->c_ispeed;
1088 			if (t->c_ospeed != 0)
1089 				tp->t_ospeed = t->c_ospeed;
1090 			ttsetwater(tp);
1091 		}
1092 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1093 		    cmd != TIOCSETAF) {
1094 			if (ISSET(t->c_lflag, ICANON))
1095 				SET(tp->t_lflag, PENDIN);
1096 			else {
1097 				/*
1098 				 * XXX we really shouldn't allow toggling
1099 				 * ICANON while we're in a non-termios line
1100 				 * discipline.  Now we have to worry about
1101 				 * panicing for a null queue.
1102 				 */
1103 				if (tp->t_canq.c_cbreserved > 0 &&
1104 				    tp->t_rawq.c_cbreserved > 0) {
1105 					catq(&tp->t_rawq, &tp->t_canq);
1106 					/*
1107 					 * XXX the queue limits may be
1108 					 * different, so the old queue
1109 					 * swapping method no longer works.
1110 					 */
1111 					catq(&tp->t_canq, &tp->t_rawq);
1112 				}
1113 				CLR(tp->t_lflag, PENDIN);
1114 			}
1115 			ttwakeup(tp);
1116 		}
1117 		tp->t_iflag = t->c_iflag;
1118 		tp->t_oflag = t->c_oflag;
1119 		/*
1120 		 * Make the EXTPROC bit read only.
1121 		 */
1122 		if (ISSET(tp->t_lflag, EXTPROC))
1123 			SET(t->c_lflag, EXTPROC);
1124 		else
1125 			CLR(t->c_lflag, EXTPROC);
1126 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1127 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1128 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1129 			ttwakeup(tp);
1130 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1131 		splx(s);
1132 		break;
1133 	}
1134 	case TIOCSETD: {		/* set line discipline */
1135 		int t = *(int *)data;
1136 
1137 		if ((u_int)t >= nlinesw)
1138 			return (ENXIO);
1139 		if (t == tp->t_line)
1140 			return (0);
1141 		s = spltty();
1142 		ttyld_close(tp, flag);
1143 		tp->t_line = t;
1144 		/* XXX: we should use the correct cdev here */
1145 		error = ttyld_open(tp, tp->t_dev);
1146 		if (error) {
1147 			/*
1148 			 * If we fail to switch line discipline we cannot
1149 			 * fall back to the previous, because we can not
1150 			 * trust that ldisc to open successfully either.
1151 			 * Fall back to the default ldisc which we know
1152 			 * will allways succeed.
1153 			 */
1154 			tp->t_line = TTYDISC;
1155 			(void)ttyld_open(tp, tp->t_dev);
1156 		}
1157 		splx(s);
1158 		return (error);
1159 		break;
1160 	}
1161 	case TIOCSTART:			/* start output, like ^Q */
1162 		s = spltty();
1163 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1164 		    ISSET(tp->t_lflag, FLUSHO)) {
1165 			CLR(tp->t_lflag, FLUSHO);
1166 			CLR(tp->t_state, TS_TTSTOP);
1167 			ttstart(tp);
1168 		}
1169 		splx(s);
1170 		break;
1171 	case TIOCSTI:			/* simulate terminal input */
1172 		if ((flag & FREAD) == 0 && suser(td))
1173 			return (EPERM);
1174 		if (!isctty(p, tp) && suser(td))
1175 			return (EACCES);
1176 		s = spltty();
1177 		ttyld_rint(tp, *(u_char *)data);
1178 		splx(s);
1179 		break;
1180 	case TIOCSTOP:			/* stop output, like ^S */
1181 		s = spltty();
1182 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1183 			SET(tp->t_state, TS_TTSTOP);
1184 			(*tp->t_stop)(tp, 0);
1185 		}
1186 		splx(s);
1187 		break;
1188 	case TIOCSCTTY:			/* become controlling tty */
1189 		/* Session ctty vnode pointer set in vnode layer. */
1190 		sx_slock(&proctree_lock);
1191 		if (!SESS_LEADER(p) ||
1192 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1193 		     (tp->t_session != p->p_session))) {
1194 			sx_sunlock(&proctree_lock);
1195 			return (EPERM);
1196 		}
1197 		tp->t_session = p->p_session;
1198 		tp->t_pgrp = p->p_pgrp;
1199 		SESS_LOCK(p->p_session);
1200 		ttyref(tp);		/* ttyrel(): kern_proc.c:pgdelete() */
1201 		p->p_session->s_ttyp = tp;
1202 		SESS_UNLOCK(p->p_session);
1203 		PROC_LOCK(p);
1204 		p->p_flag |= P_CONTROLT;
1205 		PROC_UNLOCK(p);
1206 		sx_sunlock(&proctree_lock);
1207 		break;
1208 	case TIOCSPGRP: {		/* set pgrp of tty */
1209 		sx_slock(&proctree_lock);
1210 		pgrp = pgfind(*(int *)data);
1211 		if (!isctty(p, tp)) {
1212 			if (pgrp != NULL)
1213 				PGRP_UNLOCK(pgrp);
1214 			sx_sunlock(&proctree_lock);
1215 			return (ENOTTY);
1216 		}
1217 		if (pgrp == NULL) {
1218 			sx_sunlock(&proctree_lock);
1219 			return (EPERM);
1220 		}
1221 		PGRP_UNLOCK(pgrp);
1222 		if (pgrp->pg_session != p->p_session) {
1223 			sx_sunlock(&proctree_lock);
1224 			return (EPERM);
1225 		}
1226 		sx_sunlock(&proctree_lock);
1227 		tp->t_pgrp = pgrp;
1228 		break;
1229 	}
1230 	case TIOCSTAT:			/* simulate control-T */
1231 		s = spltty();
1232 		ttyinfo(tp);
1233 		splx(s);
1234 		break;
1235 	case TIOCSWINSZ:		/* set window size */
1236 		if (bcmp((caddr_t)&tp->t_winsize, data,
1237 		    sizeof (struct winsize))) {
1238 			tp->t_winsize = *(struct winsize *)data;
1239 			if (tp->t_pgrp != NULL) {
1240 				PGRP_LOCK(tp->t_pgrp);
1241 				pgsignal(tp->t_pgrp, SIGWINCH, 1);
1242 				PGRP_UNLOCK(tp->t_pgrp);
1243 			}
1244 		}
1245 		break;
1246 	case TIOCSDRAINWAIT:
1247 		error = suser(td);
1248 		if (error)
1249 			return (error);
1250 		tp->t_timeout = *(int *)data * hz;
1251 		wakeup(TSA_OCOMPLETE(tp));
1252 		wakeup(TSA_OLOWAT(tp));
1253 		break;
1254 	case TIOCGDRAINWAIT:
1255 		*(int *)data = tp->t_timeout / hz;
1256 		break;
1257 	default:
1258 #if defined(COMPAT_43)
1259 #ifndef BURN_BRIDGES
1260 		return (ttcompat(tp, cmd, data, flag));
1261 #else
1262 		return (ENOIOCTL);
1263 #endif
1264 #else
1265 		return (ENOIOCTL);
1266 #endif
1267 	}
1268 	return (0);
1269 }
1270 
1271 int
1272 ttypoll(struct cdev *dev, int events, struct thread *td)
1273 {
1274 	int s;
1275 	int revents = 0;
1276 	struct tty *tp;
1277 
1278 	tp = tty_gettp(dev);
1279 
1280 	if (tp == NULL)	/* XXX used to return ENXIO, but that means true! */
1281 		return ((events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM))
1282 			| POLLHUP);
1283 
1284 	s = spltty();
1285 	if (events & (POLLIN | POLLRDNORM)) {
1286 		if (ttnread(tp) > 0 || ISSET(tp->t_state, TS_ZOMBIE))
1287 			revents |= events & (POLLIN | POLLRDNORM);
1288 		else
1289 			selrecord(td, &tp->t_rsel);
1290 	}
1291 	if (events & (POLLOUT | POLLWRNORM)) {
1292 		if ((tp->t_outq.c_cc <= tp->t_olowat &&
1293 		     ISSET(tp->t_state, TS_CONNECTED))
1294 		    || ISSET(tp->t_state, TS_ZOMBIE))
1295 			revents |= events & (POLLOUT | POLLWRNORM);
1296 		else
1297 			selrecord(td, &tp->t_wsel);
1298 	}
1299 	splx(s);
1300 	return (revents);
1301 }
1302 
1303 static struct filterops ttyread_filtops =
1304 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1305 static struct filterops ttywrite_filtops =
1306 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1307 
1308 int
1309 ttykqfilter(struct cdev *dev, struct knote *kn)
1310 {
1311 	struct tty *tp;
1312 	struct knlist *klist;
1313 	int s;
1314 
1315 	tp = tty_gettp(dev);
1316 
1317 	switch (kn->kn_filter) {
1318 	case EVFILT_READ:
1319 		klist = &tp->t_rsel.si_note;
1320 		kn->kn_fop = &ttyread_filtops;
1321 		break;
1322 	case EVFILT_WRITE:
1323 		klist = &tp->t_wsel.si_note;
1324 		kn->kn_fop = &ttywrite_filtops;
1325 		break;
1326 	default:
1327 		return (EINVAL);
1328 	}
1329 
1330 	kn->kn_hook = (caddr_t)dev;
1331 
1332 	s = spltty();
1333 	knlist_add(klist, kn, 0);
1334 	splx(s);
1335 
1336 	return (0);
1337 }
1338 
1339 static void
1340 filt_ttyrdetach(struct knote *kn)
1341 {
1342 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1343 	int s = spltty();
1344 
1345 	knlist_remove(&tp->t_rsel.si_note, kn, 0);
1346 	splx(s);
1347 }
1348 
1349 static int
1350 filt_ttyread(struct knote *kn, long hint)
1351 {
1352 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1353 
1354 	kn->kn_data = ttnread(tp);
1355 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1356 		kn->kn_flags |= EV_EOF;
1357 		return (1);
1358 	}
1359 	return (kn->kn_data > 0);
1360 }
1361 
1362 static void
1363 filt_ttywdetach(struct knote *kn)
1364 {
1365 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1366 	int s = spltty();
1367 
1368 	knlist_remove(&tp->t_wsel.si_note, kn, 0);
1369 	splx(s);
1370 }
1371 
1372 static int
1373 filt_ttywrite(struct knote *kn, long hint)
1374 {
1375 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1376 
1377 	kn->kn_data = tp->t_outq.c_cc;
1378 	if (ISSET(tp->t_state, TS_ZOMBIE))
1379 		return (1);
1380 	return (kn->kn_data <= tp->t_olowat &&
1381 	    ISSET(tp->t_state, TS_CONNECTED));
1382 }
1383 
1384 /*
1385  * Must be called at spltty().
1386  */
1387 static int
1388 ttnread(struct tty *tp)
1389 {
1390 	int nread;
1391 
1392 	if (ISSET(tp->t_lflag, PENDIN))
1393 		ttypend(tp);
1394 	nread = tp->t_canq.c_cc;
1395 	if (!ISSET(tp->t_lflag, ICANON)) {
1396 		nread += tp->t_rawq.c_cc;
1397 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1398 			nread = 0;
1399 	}
1400 	return (nread);
1401 }
1402 
1403 /*
1404  * Wait for output to drain.
1405  */
1406 int
1407 ttywait(struct tty *tp)
1408 {
1409 	int error, s;
1410 
1411 	error = 0;
1412 	s = spltty();
1413 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1414 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1415 		(*tp->t_oproc)(tp);
1416 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1417 		    ISSET(tp->t_state, TS_CONNECTED)) {
1418 			SET(tp->t_state, TS_SO_OCOMPLETE);
1419 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1420 					 TTOPRI | PCATCH, "ttywai",
1421 					 tp->t_timeout);
1422 			if (error) {
1423 				if (error == EWOULDBLOCK)
1424 					error = EIO;
1425 				break;
1426 			}
1427 		} else
1428 			break;
1429 	}
1430 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1431 		error = EIO;
1432 	splx(s);
1433 	return (error);
1434 }
1435 
1436 /*
1437  * Flush if successfully wait.
1438  */
1439 static int
1440 ttywflush(struct tty *tp)
1441 {
1442 	int error;
1443 
1444 	if ((error = ttywait(tp)) == 0)
1445 		ttyflush(tp, FREAD);
1446 	return (error);
1447 }
1448 
1449 /*
1450  * Flush tty read and/or write queues, notifying anyone waiting.
1451  */
1452 void
1453 ttyflush(struct tty *tp, int rw)
1454 {
1455 	int s;
1456 
1457 	s = spltty();
1458 #if 0
1459 again:
1460 #endif
1461 	if (rw & FWRITE) {
1462 		FLUSHQ(&tp->t_outq);
1463 		CLR(tp->t_state, TS_TTSTOP);
1464 	}
1465 	(*tp->t_stop)(tp, rw);
1466 	if (rw & FREAD) {
1467 		FLUSHQ(&tp->t_canq);
1468 		FLUSHQ(&tp->t_rawq);
1469 		CLR(tp->t_lflag, PENDIN);
1470 		tp->t_rocount = 0;
1471 		tp->t_rocol = 0;
1472 		CLR(tp->t_state, TS_LOCAL);
1473 		ttwakeup(tp);
1474 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1475 			if (rw & FWRITE)
1476 				FLUSHQ(&tp->t_outq);
1477 			ttyunblock(tp);
1478 
1479 			/*
1480 			 * Don't let leave any state that might clobber the
1481 			 * next line discipline (although we should do more
1482 			 * to send the START char).  Not clearing the state
1483 			 * may have caused the "putc to a clist with no
1484 			 * reserved cblocks" panic/printf.
1485 			 */
1486 			CLR(tp->t_state, TS_TBLOCK);
1487 
1488 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1489 			if (ISSET(tp->t_iflag, IXOFF)) {
1490 				/*
1491 				 * XXX wait a bit in the hope that the stop
1492 				 * character (if any) will go out.  Waiting
1493 				 * isn't good since it allows races.  This
1494 				 * will be fixed when the stop character is
1495 				 * put in a special queue.  Don't bother with
1496 				 * the checks in ttywait() since the timeout
1497 				 * will save us.
1498 				 */
1499 				SET(tp->t_state, TS_SO_OCOMPLETE);
1500 				ttysleep(tp, TSA_OCOMPLETE(tp), TTOPRI,
1501 					 "ttyfls", hz / 10);
1502 				/*
1503 				 * Don't try sending the stop character again.
1504 				 */
1505 				CLR(tp->t_state, TS_TBLOCK);
1506 				goto again;
1507 			}
1508 #endif
1509 		}
1510 	}
1511 	if (rw & FWRITE) {
1512 		FLUSHQ(&tp->t_outq);
1513 		ttwwakeup(tp);
1514 	}
1515 	splx(s);
1516 }
1517 
1518 /*
1519  * Copy in the default termios characters.
1520  */
1521 void
1522 termioschars(struct termios *t)
1523 {
1524 
1525 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1526 }
1527 
1528 /*
1529  * Old interface.
1530  */
1531 void
1532 ttychars(struct tty *tp)
1533 {
1534 
1535 	termioschars(&tp->t_termios);
1536 }
1537 
1538 /*
1539  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1540  * on our input flow control bit and propagate the changes to the driver.
1541  * XXX the stop character should be put in a special high priority queue.
1542  */
1543 void
1544 ttyblock(struct tty *tp)
1545 {
1546 
1547 	SET(tp->t_state, TS_TBLOCK);
1548 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1549 	    putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1550 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1551 	ttstart(tp);
1552 }
1553 
1554 /*
1555  * Handle input low water.  Send start character for the IXOFF case.  Turn
1556  * off our input flow control bit and propagate the changes to the driver.
1557  * XXX the start character should be put in a special high priority queue.
1558  */
1559 static void
1560 ttyunblock(struct tty *tp)
1561 {
1562 
1563 	CLR(tp->t_state, TS_TBLOCK);
1564 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1565 	    putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1566 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1567 	ttstart(tp);
1568 }
1569 
1570 #ifdef notyet
1571 /* Not used by any current (i386) drivers. */
1572 /*
1573  * Restart after an inter-char delay.
1574  */
1575 void
1576 ttrstrt(void *tp_arg)
1577 {
1578 	struct tty *tp;
1579 	int s;
1580 
1581 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1582 
1583 	tp = tp_arg;
1584 	s = spltty();
1585 
1586 	CLR(tp->t_state, TS_TIMEOUT);
1587 	ttstart(tp);
1588 
1589 	splx(s);
1590 }
1591 #endif
1592 
1593 int
1594 ttstart(struct tty *tp)
1595 {
1596 
1597 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1598 		(*tp->t_oproc)(tp);
1599 	return (0);
1600 }
1601 
1602 /*
1603  * "close" a line discipline
1604  */
1605 int
1606 ttylclose(struct tty *tp, int flag)
1607 {
1608 
1609 	if (flag & FNONBLOCK || ttywflush(tp))
1610 		ttyflush(tp, FREAD | FWRITE);
1611 	return (0);
1612 }
1613 
1614 /*
1615  * Handle modem control transition on a tty.
1616  * Flag indicates new state of carrier.
1617  * Returns 0 if the line should be turned off, otherwise 1.
1618  */
1619 int
1620 ttymodem(struct tty *tp, int flag)
1621 {
1622 
1623 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1624 		/*
1625 		 * MDMBUF: do flow control according to carrier flag
1626 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1627 		 * works if IXON and IXANY are clear.
1628 		 */
1629 		if (flag) {
1630 			CLR(tp->t_state, TS_CAR_OFLOW);
1631 			CLR(tp->t_state, TS_TTSTOP);
1632 			ttstart(tp);
1633 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1634 			SET(tp->t_state, TS_CAR_OFLOW);
1635 			SET(tp->t_state, TS_TTSTOP);
1636 			(*tp->t_stop)(tp, 0);
1637 		}
1638 	} else if (flag == 0) {
1639 		/*
1640 		 * Lost carrier.
1641 		 */
1642 		CLR(tp->t_state, TS_CARR_ON);
1643 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1644 		    !ISSET(tp->t_cflag, CLOCAL)) {
1645 			SET(tp->t_state, TS_ZOMBIE);
1646 			CLR(tp->t_state, TS_CONNECTED);
1647 			if (tp->t_session) {
1648 				sx_slock(&proctree_lock);
1649 				if (tp->t_session->s_leader) {
1650 					struct proc *p;
1651 
1652 					p = tp->t_session->s_leader;
1653 					PROC_LOCK(p);
1654 					psignal(p, SIGHUP);
1655 					PROC_UNLOCK(p);
1656 				}
1657 				sx_sunlock(&proctree_lock);
1658 			}
1659 			ttyflush(tp, FREAD | FWRITE);
1660 			return (0);
1661 		}
1662 	} else {
1663 		/*
1664 		 * Carrier now on.
1665 		 */
1666 		SET(tp->t_state, TS_CARR_ON);
1667 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1668 			SET(tp->t_state, TS_CONNECTED);
1669 		wakeup(TSA_CARR_ON(tp));
1670 		ttwakeup(tp);
1671 		ttwwakeup(tp);
1672 	}
1673 	return (1);
1674 }
1675 
1676 /*
1677  * Reinput pending characters after state switch
1678  * call at spltty().
1679  */
1680 static void
1681 ttypend(struct tty *tp)
1682 {
1683 	struct clist tq;
1684 	int c;
1685 
1686 	CLR(tp->t_lflag, PENDIN);
1687 	SET(tp->t_state, TS_TYPEN);
1688 	/*
1689 	 * XXX this assumes too much about clist internals.  It may even
1690 	 * fail if the cblock slush pool is empty.  We can't allocate more
1691 	 * cblocks here because we are called from an interrupt handler
1692 	 * and clist_alloc_cblocks() can wait.
1693 	 */
1694 	tq = tp->t_rawq;
1695 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1696 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1697 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1698 	while ((c = getc(&tq)) >= 0)
1699 		ttyinput(c, tp);
1700 	CLR(tp->t_state, TS_TYPEN);
1701 }
1702 
1703 /*
1704  * Process a read call on a tty device.
1705  */
1706 int
1707 ttread(struct tty *tp, struct uio *uio, int flag)
1708 {
1709 	struct clist *qp;
1710 	int c;
1711 	tcflag_t lflag;
1712 	cc_t *cc = tp->t_cc;
1713 	struct thread *td;
1714 	struct proc *p;
1715 	int s, first, error = 0;
1716 	int has_stime = 0, last_cc = 0;
1717 	long slp = 0;		/* XXX this should be renamed `timo'. */
1718 	struct timeval stime;
1719 	struct pgrp *pg;
1720 
1721 	td = curthread;
1722 	p = td->td_proc;
1723 loop:
1724 	s = spltty();
1725 	lflag = tp->t_lflag;
1726 	/*
1727 	 * take pending input first
1728 	 */
1729 	if (ISSET(lflag, PENDIN)) {
1730 		ttypend(tp);
1731 		splx(s);	/* reduce latency */
1732 		s = spltty();
1733 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1734 	}
1735 
1736 	/*
1737 	 * Hang process if it's in the background.
1738 	 */
1739 	if (isbackground(p, tp)) {
1740 		splx(s);
1741 		sx_slock(&proctree_lock);
1742 		PROC_LOCK(p);
1743 		if (SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTIN) ||
1744 		    SIGISMEMBER(td->td_sigmask, SIGTTIN) ||
1745 		    (p->p_flag & P_PPWAIT) || p->p_pgrp->pg_jobc == 0) {
1746 			PROC_UNLOCK(p);
1747 			sx_sunlock(&proctree_lock);
1748 			return (EIO);
1749 		}
1750 		pg = p->p_pgrp;
1751 		PROC_UNLOCK(p);
1752 		PGRP_LOCK(pg);
1753 		sx_sunlock(&proctree_lock);
1754 		pgsignal(pg, SIGTTIN, 1);
1755 		PGRP_UNLOCK(pg);
1756 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg2", 0);
1757 		if (error)
1758 			return (error);
1759 		goto loop;
1760 	}
1761 
1762 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1763 		splx(s);
1764 		return (0);	/* EOF */
1765 	}
1766 
1767 	/*
1768 	 * If canonical, use the canonical queue,
1769 	 * else use the raw queue.
1770 	 *
1771 	 * (should get rid of clists...)
1772 	 */
1773 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1774 
1775 	if (flag & IO_NDELAY) {
1776 		if (qp->c_cc > 0)
1777 			goto read;
1778 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1779 			splx(s);
1780 			return (0);
1781 		}
1782 		splx(s);
1783 		return (EWOULDBLOCK);
1784 	}
1785 	if (!ISSET(lflag, ICANON)) {
1786 		int m = cc[VMIN];
1787 		long t = cc[VTIME];
1788 		struct timeval timecopy;
1789 
1790 		/*
1791 		 * Check each of the four combinations.
1792 		 * (m > 0 && t == 0) is the normal read case.
1793 		 * It should be fairly efficient, so we check that and its
1794 		 * companion case (m == 0 && t == 0) first.
1795 		 * For the other two cases, we compute the target sleep time
1796 		 * into slp.
1797 		 */
1798 		if (t == 0) {
1799 			if (qp->c_cc < m)
1800 				goto sleep;
1801 			if (qp->c_cc > 0)
1802 				goto read;
1803 
1804 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1805 			splx(s);
1806 			return (0);
1807 		}
1808 		t *= 100000;		/* time in us */
1809 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1810 			 ((t1).tv_usec - (t2).tv_usec))
1811 		if (m > 0) {
1812 			if (qp->c_cc <= 0)
1813 				goto sleep;
1814 			if (qp->c_cc >= m)
1815 				goto read;
1816 			getmicrotime(&timecopy);
1817 			if (!has_stime) {
1818 				/* first character, start timer */
1819 				has_stime = 1;
1820 				stime = timecopy;
1821 				slp = t;
1822 			} else if (qp->c_cc > last_cc) {
1823 				/* got a character, restart timer */
1824 				stime = timecopy;
1825 				slp = t;
1826 			} else {
1827 				/* nothing, check expiration */
1828 				slp = t - diff(timecopy, stime);
1829 				if (slp <= 0)
1830 					goto read;
1831 			}
1832 			last_cc = qp->c_cc;
1833 		} else {	/* m == 0 */
1834 			if (qp->c_cc > 0)
1835 				goto read;
1836 			getmicrotime(&timecopy);
1837 			if (!has_stime) {
1838 				has_stime = 1;
1839 				stime = timecopy;
1840 				slp = t;
1841 			} else {
1842 				slp = t - diff(timecopy, stime);
1843 				if (slp <= 0) {
1844 					/* Timed out, but 0 is enough input. */
1845 					splx(s);
1846 					return (0);
1847 				}
1848 			}
1849 		}
1850 #undef diff
1851 		/*
1852 		 * Rounding down may make us wake up just short
1853 		 * of the target, so we round up.
1854 		 * The formula is ceiling(slp * hz/1000000).
1855 		 * 32-bit arithmetic is enough for hz < 169.
1856 		 * XXX see tvtohz() for how to avoid overflow if hz
1857 		 * is large (divide by `tick' and/or arrange to
1858 		 * use tvtohz() if hz is large).
1859 		 */
1860 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1861 		goto sleep;
1862 	}
1863 	if (qp->c_cc <= 0) {
1864 sleep:
1865 		/*
1866 		 * There is no input, or not enough input and we can block.
1867 		 */
1868 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), TTIPRI | PCATCH,
1869 				 ISSET(tp->t_state, TS_CONNECTED) ?
1870 				 "ttyin" : "ttyhup", (int)slp);
1871 		splx(s);
1872 		if (error == EWOULDBLOCK)
1873 			error = 0;
1874 		else if (error)
1875 			return (error);
1876 		/*
1877 		 * XXX what happens if another process eats some input
1878 		 * while we are asleep (not just here)?  It would be
1879 		 * safest to detect changes and reset our state variables
1880 		 * (has_stime and last_cc).
1881 		 */
1882 		slp = 0;
1883 		goto loop;
1884 	}
1885 read:
1886 	splx(s);
1887 	/*
1888 	 * Input present, check for input mapping and processing.
1889 	 */
1890 	first = 1;
1891 	if (ISSET(lflag, ICANON | ISIG))
1892 		goto slowcase;
1893 	for (;;) {
1894 		char ibuf[IBUFSIZ];
1895 		int icc;
1896 
1897 		icc = imin(uio->uio_resid, IBUFSIZ);
1898 		icc = q_to_b(qp, ibuf, icc);
1899 		if (icc <= 0) {
1900 			if (first)
1901 				goto loop;
1902 			break;
1903 		}
1904 		error = uiomove(ibuf, icc, uio);
1905 		/*
1906 		 * XXX if there was an error then we should ungetc() the
1907 		 * unmoved chars and reduce icc here.
1908 		 */
1909 		if (error)
1910 			break;
1911 		if (uio->uio_resid == 0)
1912 			break;
1913 		first = 0;
1914 	}
1915 	goto out;
1916 slowcase:
1917 	for (;;) {
1918 		c = getc(qp);
1919 		if (c < 0) {
1920 			if (first)
1921 				goto loop;
1922 			break;
1923 		}
1924 		/*
1925 		 * delayed suspend (^Y)
1926 		 */
1927 		if (CCEQ(cc[VDSUSP], c) &&
1928 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1929 			if (tp->t_pgrp != NULL) {
1930 				PGRP_LOCK(tp->t_pgrp);
1931 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
1932 				PGRP_UNLOCK(tp->t_pgrp);
1933 			}
1934 			if (first) {
1935 				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
1936 						 "ttybg3", 0);
1937 				if (error)
1938 					break;
1939 				goto loop;
1940 			}
1941 			break;
1942 		}
1943 		/*
1944 		 * Interpret EOF only in canonical mode.
1945 		 */
1946 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1947 			break;
1948 		/*
1949 		 * Give user character.
1950 		 */
1951 		error = ureadc(c, uio);
1952 		if (error)
1953 			/* XXX should ungetc(c, qp). */
1954 			break;
1955 		if (uio->uio_resid == 0)
1956 			break;
1957 		/*
1958 		 * In canonical mode check for a "break character"
1959 		 * marking the end of a "line of input".
1960 		 */
1961 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1962 			break;
1963 		first = 0;
1964 	}
1965 
1966 out:
1967 	/*
1968 	 * Look to unblock input now that (presumably)
1969 	 * the input queue has gone down.
1970 	 */
1971 	s = spltty();
1972 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1973 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1974 		ttyunblock(tp);
1975 	splx(s);
1976 
1977 	return (error);
1978 }
1979 
1980 /*
1981  * Check the output queue on tp for space for a kernel message (from uprintf
1982  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1983  * lose messages due to normal flow control, but don't let the tty run amok.
1984  * Sleeps here are not interruptible, but we return prematurely if new signals
1985  * arrive.
1986  */
1987 int
1988 ttycheckoutq(struct tty *tp, int wait)
1989 {
1990 	int hiwat, s;
1991 	sigset_t oldmask;
1992 	struct thread *td;
1993 	struct proc *p;
1994 
1995 	td = curthread;
1996 	p = td->td_proc;
1997 	hiwat = tp->t_ohiwat;
1998 	SIGEMPTYSET(oldmask);
1999 	s = spltty();
2000 	if (wait) {
2001 		PROC_LOCK(p);
2002 		oldmask = td->td_siglist;
2003 		PROC_UNLOCK(p);
2004 	}
2005 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100)
2006 		while (tp->t_outq.c_cc > hiwat) {
2007 			ttstart(tp);
2008 			if (tp->t_outq.c_cc <= hiwat)
2009 				break;
2010 			if (!wait) {
2011 				splx(s);
2012 				return (0);
2013 			}
2014 			PROC_LOCK(p);
2015 			if (!SIGSETEQ(td->td_siglist, oldmask)) {
2016 				PROC_UNLOCK(p);
2017 				splx(s);
2018 				return (0);
2019 			}
2020 			PROC_UNLOCK(p);
2021 			SET(tp->t_state, TS_SO_OLOWAT);
2022 			tsleep(TSA_OLOWAT(tp), PZERO - 1, "ttoutq", hz);
2023 		}
2024 	splx(s);
2025 	return (1);
2026 }
2027 
2028 /*
2029  * Process a write call on a tty device.
2030  */
2031 int
2032 ttwrite(struct tty *tp, struct uio *uio, int flag)
2033 {
2034 	char *cp = NULL;
2035 	int cc, ce;
2036 	struct thread *td;
2037 	struct proc *p;
2038 	int i, hiwat, cnt, error, s;
2039 	char obuf[OBUFSIZ];
2040 
2041 	hiwat = tp->t_ohiwat;
2042 	cnt = uio->uio_resid;
2043 	error = 0;
2044 	cc = 0;
2045 	td = curthread;
2046 	p = td->td_proc;
2047 loop:
2048 	s = spltty();
2049 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2050 		splx(s);
2051 		if (uio->uio_resid == cnt)
2052 			error = EIO;
2053 		goto out;
2054 	}
2055 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2056 		if (flag & IO_NDELAY) {
2057 			splx(s);
2058 			error = EWOULDBLOCK;
2059 			goto out;
2060 		}
2061 		error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
2062 				 "ttywdcd", 0);
2063 		splx(s);
2064 		if (error)
2065 			goto out;
2066 		goto loop;
2067 	}
2068 	splx(s);
2069 	/*
2070 	 * Hang the process if it's in the background.
2071 	 */
2072 	sx_slock(&proctree_lock);
2073 	PROC_LOCK(p);
2074 	if (isbackground(p, tp) &&
2075 	    ISSET(tp->t_lflag, TOSTOP) && !(p->p_flag & P_PPWAIT) &&
2076 	    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
2077 	    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
2078 		if (p->p_pgrp->pg_jobc == 0) {
2079 			PROC_UNLOCK(p);
2080 			sx_sunlock(&proctree_lock);
2081 			error = EIO;
2082 			goto out;
2083 		}
2084 		PROC_UNLOCK(p);
2085 		PGRP_LOCK(p->p_pgrp);
2086 		sx_sunlock(&proctree_lock);
2087 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2088 		PGRP_UNLOCK(p->p_pgrp);
2089 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg4", 0);
2090 		if (error)
2091 			goto out;
2092 		goto loop;
2093 	} else {
2094 		PROC_UNLOCK(p);
2095 		sx_sunlock(&proctree_lock);
2096 	}
2097 	/*
2098 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2099 	 * output translation.  Keep track of high water mark, sleep on
2100 	 * overflow awaiting device aid in acquiring new space.
2101 	 */
2102 	while (uio->uio_resid > 0 || cc > 0) {
2103 		if (ISSET(tp->t_lflag, FLUSHO)) {
2104 			uio->uio_resid = 0;
2105 			return (0);
2106 		}
2107 		if (tp->t_outq.c_cc > hiwat)
2108 			goto ovhiwat;
2109 		/*
2110 		 * Grab a hunk of data from the user, unless we have some
2111 		 * leftover from last time.
2112 		 */
2113 		if (cc == 0) {
2114 			cc = imin(uio->uio_resid, OBUFSIZ);
2115 			cp = obuf;
2116 			error = uiomove(cp, cc, uio);
2117 			if (error) {
2118 				cc = 0;
2119 				break;
2120 			}
2121 		}
2122 		/*
2123 		 * If nothing fancy need be done, grab those characters we
2124 		 * can handle without any of ttyoutput's processing and
2125 		 * just transfer them to the output q.  For those chars
2126 		 * which require special processing (as indicated by the
2127 		 * bits in char_type), call ttyoutput.  After processing
2128 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2129 		 * immediately.
2130 		 */
2131 		while (cc > 0) {
2132 			if (!ISSET(tp->t_oflag, OPOST))
2133 				ce = cc;
2134 			else {
2135 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2136 						char_type, CCLASSMASK);
2137 				/*
2138 				 * If ce is zero, then we're processing
2139 				 * a special character through ttyoutput.
2140 				 */
2141 				if (ce == 0) {
2142 					tp->t_rocount = 0;
2143 					if (ttyoutput(*cp, tp) >= 0) {
2144 						/* No Clists, wait a bit. */
2145 						ttstart(tp);
2146 						if (flag & IO_NDELAY) {
2147 							error = EWOULDBLOCK;
2148 							goto out;
2149 						}
2150 						error = ttysleep(tp, &lbolt,
2151 								 TTOPRI|PCATCH,
2152 								 "ttybf1", 0);
2153 						if (error)
2154 							goto out;
2155 						goto loop;
2156 					}
2157 					cp++;
2158 					cc--;
2159 					if (ISSET(tp->t_lflag, FLUSHO) ||
2160 					    tp->t_outq.c_cc > hiwat)
2161 						goto ovhiwat;
2162 					continue;
2163 				}
2164 			}
2165 			/*
2166 			 * A bunch of normal characters have been found.
2167 			 * Transfer them en masse to the output queue and
2168 			 * continue processing at the top of the loop.
2169 			 * If there are any further characters in this
2170 			 * <= OBUFSIZ chunk, the first should be a character
2171 			 * requiring special handling by ttyoutput.
2172 			 */
2173 			tp->t_rocount = 0;
2174 			i = b_to_q(cp, ce, &tp->t_outq);
2175 			ce -= i;
2176 			tp->t_column += ce;
2177 			cp += ce, cc -= ce, tk_nout += ce;
2178 			tp->t_outcc += ce;
2179 			if (i > 0) {
2180 				/* No Clists, wait a bit. */
2181 				ttstart(tp);
2182 				if (flag & IO_NDELAY) {
2183 					error = EWOULDBLOCK;
2184 					goto out;
2185 				}
2186 				error = ttysleep(tp, &lbolt, TTOPRI | PCATCH,
2187 						 "ttybf2", 0);
2188 				if (error)
2189 					goto out;
2190 				goto loop;
2191 			}
2192 			if (ISSET(tp->t_lflag, FLUSHO) ||
2193 			    tp->t_outq.c_cc > hiwat)
2194 				break;
2195 		}
2196 		ttstart(tp);
2197 	}
2198 out:
2199 	/*
2200 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2201 	 * offset and iov pointers have moved forward, but it doesn't matter
2202 	 * (the call will either return short or restart with a new uio).
2203 	 */
2204 	uio->uio_resid += cc;
2205 	return (error);
2206 
2207 ovhiwat:
2208 	ttstart(tp);
2209 	s = spltty();
2210 	/*
2211 	 * This can only occur if FLUSHO is set in t_lflag,
2212 	 * or if ttstart/oproc is synchronous (or very fast).
2213 	 */
2214 	if (tp->t_outq.c_cc <= hiwat) {
2215 		splx(s);
2216 		goto loop;
2217 	}
2218 	if (flag & IO_NDELAY) {
2219 		splx(s);
2220 		uio->uio_resid += cc;
2221 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2222 	}
2223 	SET(tp->t_state, TS_SO_OLOWAT);
2224 	error = ttysleep(tp, TSA_OLOWAT(tp), TTOPRI | PCATCH, "ttywri",
2225 			 tp->t_timeout);
2226 	splx(s);
2227 	if (error == EWOULDBLOCK)
2228 		error = EIO;
2229 	if (error)
2230 		goto out;
2231 	goto loop;
2232 }
2233 
2234 /*
2235  * Rubout one character from the rawq of tp
2236  * as cleanly as possible.
2237  */
2238 static void
2239 ttyrub(int c, struct tty *tp)
2240 {
2241 	char *cp;
2242 	int savecol;
2243 	int tabc, s;
2244 
2245 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2246 		return;
2247 	CLR(tp->t_lflag, FLUSHO);
2248 	if (ISSET(tp->t_lflag, ECHOE)) {
2249 		if (tp->t_rocount == 0) {
2250 			/*
2251 			 * Screwed by ttwrite; retype
2252 			 */
2253 			ttyretype(tp);
2254 			return;
2255 		}
2256 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2257 			ttyrubo(tp, 2);
2258 		else {
2259 			CLR(c, ~TTY_CHARMASK);
2260 			switch (CCLASS(c)) {
2261 			case ORDINARY:
2262 				ttyrubo(tp, 1);
2263 				break;
2264 			case BACKSPACE:
2265 			case CONTROL:
2266 			case NEWLINE:
2267 			case RETURN:
2268 			case VTAB:
2269 				if (ISSET(tp->t_lflag, ECHOCTL))
2270 					ttyrubo(tp, 2);
2271 				break;
2272 			case TAB:
2273 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2274 					ttyretype(tp);
2275 					return;
2276 				}
2277 				s = spltty();
2278 				savecol = tp->t_column;
2279 				SET(tp->t_state, TS_CNTTB);
2280 				SET(tp->t_lflag, FLUSHO);
2281 				tp->t_column = tp->t_rocol;
2282 				cp = tp->t_rawq.c_cf;
2283 				if (cp)
2284 					tabc = *cp;	/* XXX FIX NEXTC */
2285 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2286 					ttyecho(tabc, tp);
2287 				CLR(tp->t_lflag, FLUSHO);
2288 				CLR(tp->t_state, TS_CNTTB);
2289 				splx(s);
2290 
2291 				/* savecol will now be length of the tab. */
2292 				savecol -= tp->t_column;
2293 				tp->t_column += savecol;
2294 				if (savecol > 8)
2295 					savecol = 8;	/* overflow screw */
2296 				while (--savecol >= 0)
2297 					(void)ttyoutput('\b', tp);
2298 				break;
2299 			default:			/* XXX */
2300 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2301 				(void)printf(PANICSTR, c, CCLASS(c));
2302 #ifdef notdef
2303 				panic(PANICSTR, c, CCLASS(c));
2304 #endif
2305 			}
2306 		}
2307 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2308 		if (!ISSET(tp->t_state, TS_ERASE)) {
2309 			SET(tp->t_state, TS_ERASE);
2310 			(void)ttyoutput('\\', tp);
2311 		}
2312 		ttyecho(c, tp);
2313 	} else {
2314 		ttyecho(tp->t_cc[VERASE], tp);
2315 		/*
2316 		 * This code may be executed not only when an ERASE key
2317 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2318 		 * So, I didn't think it was worthwhile to pass the extra
2319 		 * information (which would need an extra parameter,
2320 		 * changing every call) needed to distinguish the ERASE2
2321 		 * case from the ERASE.
2322 		 */
2323 	}
2324 	--tp->t_rocount;
2325 }
2326 
2327 /*
2328  * Back over cnt characters, erasing them.
2329  */
2330 static void
2331 ttyrubo(struct tty *tp, int cnt)
2332 {
2333 
2334 	while (cnt-- > 0) {
2335 		(void)ttyoutput('\b', tp);
2336 		(void)ttyoutput(' ', tp);
2337 		(void)ttyoutput('\b', tp);
2338 	}
2339 }
2340 
2341 /*
2342  * ttyretype --
2343  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2344  *	been checked.
2345  */
2346 static void
2347 ttyretype(struct tty *tp)
2348 {
2349 	char *cp;
2350 	int s, c;
2351 
2352 	/* Echo the reprint character. */
2353 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2354 		ttyecho(tp->t_cc[VREPRINT], tp);
2355 
2356 	(void)ttyoutput('\n', tp);
2357 
2358 	/*
2359 	 * XXX
2360 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2361 	 * BIT OF FIRST CHAR.
2362 	 */
2363 	s = spltty();
2364 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2365 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2366 		ttyecho(c, tp);
2367 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2368 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2369 		ttyecho(c, tp);
2370 	CLR(tp->t_state, TS_ERASE);
2371 	splx(s);
2372 
2373 	tp->t_rocount = tp->t_rawq.c_cc;
2374 	tp->t_rocol = 0;
2375 }
2376 
2377 /*
2378  * Echo a typed character to the terminal.
2379  */
2380 static void
2381 ttyecho(int c, struct tty *tp)
2382 {
2383 
2384 	if (!ISSET(tp->t_state, TS_CNTTB))
2385 		CLR(tp->t_lflag, FLUSHO);
2386 	if ((!ISSET(tp->t_lflag, ECHO) &&
2387 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2388 	    ISSET(tp->t_lflag, EXTPROC))
2389 		return;
2390 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2391 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2392 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2393 		(void)ttyoutput('^', tp);
2394 		CLR(c, ~TTY_CHARMASK);
2395 		if (c == 0177)
2396 			c = '?';
2397 		else
2398 			c += 'A' - 1;
2399 	}
2400 	(void)ttyoutput(c, tp);
2401 }
2402 
2403 /*
2404  * Wake up any readers on a tty.
2405  */
2406 void
2407 ttwakeup(struct tty *tp)
2408 {
2409 
2410 	if (SEL_WAITING(&tp->t_rsel))
2411 		selwakeuppri(&tp->t_rsel, TTIPRI);
2412 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2413 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2414 	wakeup(TSA_HUP_OR_INPUT(tp));
2415 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
2416 }
2417 
2418 /*
2419  * Wake up any writers on a tty.
2420  */
2421 void
2422 ttwwakeup(struct tty *tp)
2423 {
2424 
2425 	if (SEL_WAITING(&tp->t_wsel) && tp->t_outq.c_cc <= tp->t_olowat)
2426 		selwakeuppri(&tp->t_wsel, TTOPRI);
2427 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2428 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2429 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2430 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2431 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2432 		wakeup(TSA_OCOMPLETE(tp));
2433 	}
2434 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2435 	    tp->t_outq.c_cc <= tp->t_olowat) {
2436 		CLR(tp->t_state, TS_SO_OLOWAT);
2437 		wakeup(TSA_OLOWAT(tp));
2438 	}
2439 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
2440 }
2441 
2442 /*
2443  * Look up a code for a specified speed in a conversion table;
2444  * used by drivers to map software speed values to hardware parameters.
2445  */
2446 int
2447 ttspeedtab(int speed, struct speedtab *table)
2448 {
2449 
2450 	for ( ; table->sp_speed != -1; table++)
2451 		if (table->sp_speed == speed)
2452 			return (table->sp_code);
2453 	return (-1);
2454 }
2455 
2456 /*
2457  * Set input and output watermarks and buffer sizes.  For input, the
2458  * high watermark is about one second's worth of input above empty, the
2459  * low watermark is slightly below high water, and the buffer size is a
2460  * driver-dependent amount above high water.  For output, the watermarks
2461  * are near the ends of the buffer, with about 1 second's worth of input
2462  * between them.  All this only applies to the standard line discipline.
2463  */
2464 void
2465 ttsetwater(struct tty *tp)
2466 {
2467 	int cps, ttmaxhiwat, x;
2468 
2469 	/* Input. */
2470 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2471 	switch (tp->t_ispeedwat) {
2472 	case (speed_t)-1:
2473 		cps = tp->t_ispeed / 10;
2474 		break;
2475 	case 0:
2476 		/*
2477 		 * This case is for old drivers that don't know about
2478 		 * t_ispeedwat.  Arrange for them to get the old buffer
2479 		 * sizes and watermarks.
2480 		 */
2481 		cps = TTYHOG - 2 * 256;
2482 		tp->t_ififosize = 2 * 256;
2483 		break;
2484 	default:
2485 		cps = tp->t_ispeedwat / 10;
2486 		break;
2487 	}
2488 	tp->t_ihiwat = cps;
2489 	tp->t_ilowat = 7 * cps / 8;
2490 	x = cps + tp->t_ififosize;
2491 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2492 
2493 	/* Output. */
2494 	switch (tp->t_ospeedwat) {
2495 	case (speed_t)-1:
2496 		cps = tp->t_ospeed / 10;
2497 		ttmaxhiwat = 2 * TTMAXHIWAT;
2498 		break;
2499 	case 0:
2500 		cps = tp->t_ospeed / 10;
2501 		ttmaxhiwat = TTMAXHIWAT;
2502 		break;
2503 	default:
2504 		cps = tp->t_ospeedwat / 10;
2505 		ttmaxhiwat = 8 * TTMAXHIWAT;
2506 		break;
2507 	}
2508 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2509 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2510 	x += cps;
2511 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2512 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2513 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2514 	x += OBUFSIZ + 100;
2515 	clist_alloc_cblocks(&tp->t_outq, x, x);
2516 #undef	CLAMP
2517 }
2518 
2519 /*
2520  * Report on state of foreground process group.
2521  */
2522 void
2523 ttyinfo(struct tty *tp)
2524 {
2525 	struct timeval utime, stime;
2526 	struct proc *p, *pick;
2527 	struct thread *td;
2528 	const char *stateprefix, *state;
2529 	long rss;
2530 	int load, pctcpu;
2531 
2532 	if (ttycheckoutq(tp,0) == 0)
2533 		return;
2534 
2535 	/* Print load average. */
2536 	load = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2537 	ttyprintf(tp, "load: %d.%02d ", load / 100, load % 100);
2538 
2539 	/*
2540 	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
2541 	 * that pending input will be retyped on BS.
2542 	 */
2543 	if (tp->t_session == NULL) {
2544 		ttyprintf(tp, "not a controlling terminal\n");
2545 		tp->t_rocount = 0;
2546 		return;
2547 	}
2548 	if (tp->t_pgrp == NULL) {
2549 		ttyprintf(tp, "no foreground process group\n");
2550 		tp->t_rocount = 0;
2551 		return;
2552 	}
2553 	sx_slock(&proctree_lock);
2554 	if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL) {
2555 		sx_sunlock(&proctree_lock);
2556 		ttyprintf(tp, "empty foreground process group\n");
2557 		tp->t_rocount = 0;
2558 		return;
2559 	}
2560 
2561 	/*
2562 	 * Pick the most interesting process and copy some of its
2563 	 * state for printing later.  sched_lock must be held for
2564 	 * most parts of this.  Holding it throughout is simplest
2565 	 * and prevents even unimportant inconsistencies in the
2566 	 * copy of the state, but may increase interrupt latency
2567 	 * too much.
2568 	 */
2569 	mtx_lock_spin(&sched_lock);
2570 	for (pick = NULL; p != NULL; p = LIST_NEXT(p, p_pglist))
2571 		if (proc_compare(pick, p))
2572 			pick = p;
2573 
2574 	td = FIRST_THREAD_IN_PROC(pick);	/* XXXKSE */
2575 #if 0
2576 	KASSERT(td != NULL, ("ttyinfo: no thread"));
2577 #else
2578 	if (td == NULL) {
2579 		mtx_unlock_spin(&sched_lock);
2580 		sx_sunlock(&proctree_lock);
2581 		ttyprintf(tp, "foreground process without thread\n");
2582 		tp->t_rocount = 0;
2583 		return;
2584 	}
2585 #endif
2586 	stateprefix = "";
2587 	if (TD_IS_RUNNING(td))
2588 		state = "running";
2589 	else if (TD_ON_RUNQ(td) || TD_CAN_RUN(td))
2590 		state = "runnable";
2591 	else if (TD_IS_SLEEPING(td)) {
2592 		/* XXX: If we're sleeping, are we ever not in a queue? */
2593 		if (TD_ON_SLEEPQ(td))
2594 			state = td->td_wmesg;
2595 		else
2596 			state = "sleeping without queue";
2597 	} else if (TD_ON_LOCK(td)) {
2598 		state = td->td_lockname;
2599 		stateprefix = "*";
2600 	} else if (TD_IS_SUSPENDED(td))
2601 		state = "suspended";
2602 	else if (TD_AWAITING_INTR(td))
2603 		state = "intrwait";
2604 	else
2605 		state = "unknown";
2606 	pctcpu = (sched_pctcpu(td) * 10000 + FSCALE / 2) >> FSHIFT;
2607 	if (pick->p_state == PRS_NEW || pick->p_state == PRS_ZOMBIE)
2608 		rss = 0;
2609 	else
2610 		rss = pgtok(vmspace_resident_count(pick->p_vmspace));
2611 	mtx_unlock_spin(&sched_lock);
2612 	PROC_LOCK(pick);
2613 	calcru(pick, &utime, &stime);
2614 	PROC_UNLOCK(pick);
2615 
2616 	/* Print command, pid, state, utime, stime, %cpu, and rss. */
2617 	ttyprintf(tp,
2618 	    " cmd: %s %d [%s%s] %ld.%02ldu %ld.%02lds %d%% %ldk\n",
2619 	    pick->p_comm, pick->p_pid, stateprefix, state,
2620 	    (long)utime.tv_sec, utime.tv_usec / 10000,
2621 	    (long)stime.tv_sec, stime.tv_usec / 10000,
2622 	    pctcpu / 100, rss);
2623 	tp->t_rocount = 0;
2624 	sx_sunlock(&proctree_lock);
2625 }
2626 
2627 /*
2628  * Returns 1 if p2 is "better" than p1
2629  *
2630  * The algorithm for picking the "interesting" process is thus:
2631  *
2632  *	1) Only foreground processes are eligible - implied.
2633  *	2) Runnable processes are favored over anything else.  The runner
2634  *	   with the highest cpu utilization is picked (p_estcpu).  Ties are
2635  *	   broken by picking the highest pid.
2636  *	3) The sleeper with the shortest sleep time is next.  With ties,
2637  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2638  *	4) Further ties are broken by picking the highest pid.
2639  */
2640 #define ISRUN(p, val)						\
2641 do {								\
2642 	struct thread *td;					\
2643 	val = 0;						\
2644 	FOREACH_THREAD_IN_PROC(p, td) {				\
2645 		if (TD_ON_RUNQ(td) ||				\
2646 		    TD_IS_RUNNING(td)) {			\
2647 			val = 1;				\
2648 			break;					\
2649 		}						\
2650 	}							\
2651 } while (0)
2652 
2653 #define TESTAB(a, b)    ((a)<<1 | (b))
2654 #define ONLYA   2
2655 #define ONLYB   1
2656 #define BOTH    3
2657 
2658 static int
2659 proc_compare(struct proc *p1, struct proc *p2)
2660 {
2661 
2662 	int esta, estb;
2663 	struct ksegrp *kg;
2664 	mtx_assert(&sched_lock, MA_OWNED);
2665 	if (p1 == NULL)
2666 		return (1);
2667 
2668 	ISRUN(p1, esta);
2669 	ISRUN(p2, estb);
2670 
2671 	/*
2672 	 * see if at least one of them is runnable
2673 	 */
2674 	switch (TESTAB(esta, estb)) {
2675 	case ONLYA:
2676 		return (0);
2677 	case ONLYB:
2678 		return (1);
2679 	case BOTH:
2680 		/*
2681 		 * tie - favor one with highest recent cpu utilization
2682 		 */
2683 		esta = estb = 0;
2684 		FOREACH_KSEGRP_IN_PROC(p1,kg) {
2685 			esta += kg->kg_estcpu;
2686 		}
2687 		FOREACH_KSEGRP_IN_PROC(p2,kg) {
2688 			estb += kg->kg_estcpu;
2689 		}
2690 		if (estb > esta)
2691 			return (1);
2692 		if (esta > estb)
2693 			return (0);
2694 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2695 	}
2696 	/*
2697 	 * weed out zombies
2698 	 */
2699 	switch (TESTAB(p1->p_state == PRS_ZOMBIE, p2->p_state == PRS_ZOMBIE)) {
2700 	case ONLYA:
2701 		return (1);
2702 	case ONLYB:
2703 		return (0);
2704 	case BOTH:
2705 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2706 	}
2707 
2708 #if 0 /* XXXKSE */
2709 	/*
2710 	 * pick the one with the smallest sleep time
2711 	 */
2712 	if (p2->p_slptime > p1->p_slptime)
2713 		return (0);
2714 	if (p1->p_slptime > p2->p_slptime)
2715 		return (1);
2716 	/*
2717 	 * favor one sleeping in a non-interruptible sleep
2718 	 */
2719 	if (p1->p_sflag & PS_SINTR && (p2->p_sflag & PS_SINTR) == 0)
2720 		return (1);
2721 	if (p2->p_sflag & PS_SINTR && (p1->p_sflag & PS_SINTR) == 0)
2722 		return (0);
2723 #endif
2724 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2725 }
2726 
2727 /*
2728  * Output char to tty; console putchar style.
2729  */
2730 int
2731 tputchar(int c, struct tty *tp)
2732 {
2733 	int s;
2734 
2735 	s = spltty();
2736 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2737 		splx(s);
2738 		return (-1);
2739 	}
2740 	if (c == '\n')
2741 		(void)ttyoutput('\r', tp);
2742 	(void)ttyoutput(c, tp);
2743 	ttstart(tp);
2744 	splx(s);
2745 	return (0);
2746 }
2747 
2748 /*
2749  * Sleep on chan, returning ERESTART if tty changed while we napped and
2750  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2751  * the tty is revoked, restarting a pending call will redo validation done
2752  * at the start of the call.
2753  */
2754 int
2755 ttysleep(struct tty *tp, void *chan, int pri, char *wmesg, int timo)
2756 {
2757 	int error;
2758 	int gen;
2759 
2760 	gen = tp->t_gen;
2761 	error = tsleep(chan, pri, wmesg, timo);
2762 	if (tp->t_state & TS_GONE)
2763 		return (ENXIO);
2764 	if (error)
2765 		return (error);
2766 	return (tp->t_gen == gen ? 0 : ERESTART);
2767 }
2768 
2769 /*
2770  * Gain a reference to a TTY
2771  */
2772 int
2773 ttyref(struct tty *tp)
2774 {
2775 	int i;
2776 
2777 	mtx_lock(&tp->t_mtx);
2778 	KASSERT(tp->t_refcnt > 0,
2779 	    ("ttyref(): tty refcnt is %d (%s)",
2780 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2781 	i = ++tp->t_refcnt;
2782 	mtx_unlock(&tp->t_mtx);
2783 	return (i);
2784 }
2785 
2786 /*
2787  * Drop a reference to a TTY.
2788  * When reference count drops to zero, we free it.
2789  */
2790 int
2791 ttyrel(struct tty *tp)
2792 {
2793 	int i;
2794 
2795 	mtx_lock(&tty_list_mutex);
2796 	mtx_lock(&tp->t_mtx);
2797 	KASSERT(tp->t_refcnt > 0,
2798 	    ("ttyrel(): tty refcnt is %d (%s)",
2799 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2800 	i = --tp->t_refcnt;
2801 	if (i != 0) {
2802 		mtx_unlock(&tp->t_mtx);
2803 		mtx_unlock(&tty_list_mutex);
2804 		return (i);
2805 	}
2806 	TAILQ_REMOVE(&tty_list, tp, t_list);
2807 	mtx_unlock(&tp->t_mtx);
2808 	mtx_unlock(&tty_list_mutex);
2809 	knlist_destroy(&tp->t_rsel.si_note);
2810 	knlist_destroy(&tp->t_wsel.si_note);
2811 	mtx_destroy(&tp->t_mtx);
2812 	free(tp, M_TTYS);
2813 	return (i);
2814 }
2815 
2816 /*
2817  * Allocate a tty struct.  Clists in the struct will be allocated by
2818  * tty_open().
2819  */
2820 struct tty *
2821 ttymalloc(struct tty *tp)
2822 {
2823 	static int once;
2824 
2825 	if (!once) {
2826 		mtx_init(&tty_list_mutex, "ttylist", NULL, MTX_DEF);
2827 		once++;
2828 	}
2829 
2830 	if (tp) {
2831 		/*
2832 		 * XXX: Either this argument should go away, or we should
2833 		 * XXX: require it and do a ttyrel(tp) here and allocate
2834 		 * XXX: a new tty.  For now do nothing.
2835 		 */
2836 		return(tp);
2837 	}
2838 	tp = malloc(sizeof *tp, M_TTYS, M_WAITOK | M_ZERO);
2839 	mtx_init(&tp->t_mtx, "tty", NULL, MTX_DEF);
2840 
2841 	/*
2842 	 * Set up the initial state
2843 	 */
2844 	tp->t_refcnt = 1;
2845 	tp->t_timeout = -1;
2846 	tp->t_dtr_wait = 3 * hz;
2847 
2848 	ttyinitmode(tp, 0, 0);
2849 	bcopy(ttydefchars, tp->t_init_in.c_cc, sizeof tp->t_init_in.c_cc);
2850 
2851 	/* Make callout the same as callin */
2852 	tp->t_init_out = tp->t_init_in;
2853 
2854 	mtx_lock(&tty_list_mutex);
2855 	TAILQ_INSERT_TAIL(&tty_list, tp, t_list);
2856 	mtx_unlock(&tty_list_mutex);
2857 	knlist_init(&tp->t_rsel.si_note, &tp->t_mtx);
2858 	knlist_init(&tp->t_wsel.si_note, &tp->t_mtx);
2859 	return (tp);
2860 }
2861 
2862 struct tty *
2863 ttyalloc()
2864 {
2865 
2866 	return (ttymalloc(NULL));
2867 }
2868 
2869 static void
2870 ttypurge(struct cdev *dev)
2871 {
2872 
2873 	if (dev->si_tty == NULL)
2874 		return;
2875 	ttygone(dev->si_tty);
2876 }
2877 
2878 /*
2879  * ttycreate()
2880  *
2881  * Create the device entries for this tty thereby opening it for business.
2882  *
2883  * The flags argument controls if "cua" units are created.
2884  *
2885  * The t_sc filed is copied to si_drv1 in the created cdevs.  This
2886  * is particularly important for ->t_cioctl() users.
2887  *
2888  * XXX: implement the init and lock devices by cloning.
2889  */
2890 
2891 int
2892 ttycreate(struct tty *tp, struct cdevsw *csw, int unit, int flags, const char *fmt, ...)
2893 {
2894 	char namebuf[SPECNAMELEN - 3];		/* XXX space for "tty" */
2895 	va_list ap;
2896 	struct cdev *cp;
2897 	int i, minor, sminor, sunit;
2898 
2899 	mtx_assert(&Giant, MA_OWNED);
2900 
2901 	if (tty_unit == NULL)
2902 		tty_unit = new_unrhdr(0, 0xffff);
2903 
2904 	sunit = alloc_unr(tty_unit);
2905 	tp->t_devunit = sunit;
2906 
2907 	if (csw == NULL) {
2908 		csw = &tty_cdevsw;
2909 		unit = sunit;
2910 	}
2911 	KASSERT(csw->d_purge == NULL || csw->d_purge == ttypurge,
2912 	    ("tty should not have d_purge"));
2913 
2914 	csw->d_purge = ttypurge;
2915 
2916 	minor = unit2minor(unit);
2917 	sminor = unit2minor(sunit);
2918 	va_start(ap, fmt);
2919 	i = vsnrprintf(namebuf, sizeof namebuf, 32, fmt, ap);
2920 	va_end(ap);
2921 	KASSERT(i < sizeof namebuf, ("Too long tty name (%s)", namebuf));
2922 
2923 	cp = make_dev(csw, minor,
2924 	    UID_ROOT, GID_WHEEL, 0600, "tty%s", namebuf);
2925 	tp->t_dev = cp;
2926 	tp->t_mdev = cp;
2927 	cp->si_tty = tp;
2928 	cp->si_drv1 = tp->t_sc;
2929 
2930 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_INIT,
2931 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.init", namebuf);
2932 	dev_depends(tp->t_dev, cp);
2933 	cp->si_drv1 = tp->t_sc;
2934 	cp->si_drv2 = &tp->t_init_in;
2935 	cp->si_tty = tp;
2936 
2937 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_LOCK,
2938 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.lock", namebuf);
2939 	dev_depends(tp->t_dev, cp);
2940 	cp->si_drv1 = tp->t_sc;
2941 	cp->si_drv2 = &tp->t_lock_in;
2942 	cp->si_tty = tp;
2943 
2944 	if (flags & MINOR_CALLOUT) {
2945 		cp = make_dev(csw, minor | MINOR_CALLOUT,
2946 		    UID_UUCP, GID_DIALER, 0660, "cua%s", namebuf);
2947 		dev_depends(tp->t_dev, cp);
2948 		cp->si_drv1 = tp->t_sc;
2949 		cp->si_tty = tp;
2950 
2951 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_INIT,
2952 		    UID_UUCP, GID_DIALER, 0660, "cua%s.init", namebuf);
2953 		dev_depends(tp->t_dev, cp);
2954 		cp->si_drv1 = tp->t_sc;
2955 		cp->si_drv2 = &tp->t_init_out;
2956 		cp->si_tty = tp;
2957 
2958 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_LOCK,
2959 		    UID_UUCP, GID_DIALER, 0660, "cua%s.lock", namebuf);
2960 		dev_depends(tp->t_dev, cp);
2961 		cp->si_drv1 = tp->t_sc;
2962 		cp->si_drv2 = &tp->t_lock_out;
2963 		cp->si_tty = tp;
2964 	}
2965 
2966 	return (0);
2967 }
2968 
2969 /*
2970  * This function is called when the hardware disappears.  We set a flag
2971  * and wake up stuff so all sleeping threads will notice.
2972  */
2973 void
2974 ttygone(struct tty *tp)
2975 {
2976 
2977 	tp->t_state |= TS_GONE;
2978 	wakeup(&tp->t_dtr_wait);
2979 	wakeup(TSA_CARR_ON(tp));
2980 	wakeup(TSA_HUP_OR_INPUT(tp));
2981 	wakeup(TSA_OCOMPLETE(tp));
2982 	wakeup(TSA_OLOWAT(tp));
2983 	if (tp->t_purge != NULL)
2984 		tp->t_purge(tp);
2985 }
2986 
2987 /*
2988  * ttyfree()
2989  *
2990  * Called when the driver is ready to free the tty structure.
2991  *
2992  * XXX: This shall sleep until all threads have left the driver.
2993  */
2994 
2995 void
2996 ttyfree(struct tty *tp)
2997 {
2998 	u_int unit;
2999 
3000 	mtx_assert(&Giant, MA_OWNED);
3001 	ttygone(tp);
3002 	unit = tp->t_devunit;
3003 	destroy_dev(tp->t_mdev);
3004 	free_unr(tty_unit, unit);
3005 }
3006 
3007 static int
3008 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
3009 {
3010 	struct tty *tp, *tp2;
3011 	struct xtty xt;
3012 	int error;
3013 
3014 	error = 0;
3015 	mtx_lock(&tty_list_mutex);
3016 	tp = TAILQ_FIRST(&tty_list);
3017 	if (tp != NULL)
3018 		ttyref(tp);
3019 	mtx_unlock(&tty_list_mutex);
3020 	while (tp != NULL) {
3021 		bzero(&xt, sizeof xt);
3022 		xt.xt_size = sizeof xt;
3023 #define XT_COPY(field) xt.xt_##field = tp->t_##field
3024 		xt.xt_rawcc = tp->t_rawq.c_cc;
3025 		xt.xt_cancc = tp->t_canq.c_cc;
3026 		xt.xt_outcc = tp->t_outq.c_cc;
3027 		XT_COPY(line);
3028 		if (tp->t_dev != NULL)
3029 			xt.xt_dev = dev2udev(tp->t_dev);
3030 		XT_COPY(state);
3031 		XT_COPY(flags);
3032 		XT_COPY(timeout);
3033 		if (tp->t_pgrp != NULL)
3034 			xt.xt_pgid = tp->t_pgrp->pg_id;
3035 		if (tp->t_session != NULL)
3036 			xt.xt_sid = tp->t_session->s_sid;
3037 		XT_COPY(termios);
3038 		XT_COPY(winsize);
3039 		XT_COPY(column);
3040 		XT_COPY(rocount);
3041 		XT_COPY(rocol);
3042 		XT_COPY(ififosize);
3043 		XT_COPY(ihiwat);
3044 		XT_COPY(ilowat);
3045 		XT_COPY(ispeedwat);
3046 		XT_COPY(ohiwat);
3047 		XT_COPY(olowat);
3048 		XT_COPY(ospeedwat);
3049 #undef XT_COPY
3050 		error = SYSCTL_OUT(req, &xt, sizeof xt);
3051 		if (error != 0) {
3052 			ttyrel(tp);
3053 			return (error);
3054 		}
3055 		mtx_lock(&tty_list_mutex);
3056 		tp2 = TAILQ_NEXT(tp, t_list);
3057 		if (tp2 != NULL)
3058 			ttyref(tp2);
3059 		mtx_unlock(&tty_list_mutex);
3060 		ttyrel(tp);
3061 		tp = tp2;
3062 	}
3063 	return (0);
3064 }
3065 
3066 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
3067 	0, 0, sysctl_kern_ttys, "S,xtty", "All ttys");
3068 SYSCTL_LONG(_kern, OID_AUTO, tty_nin, CTLFLAG_RD,
3069 	&tk_nin, 0, "Total TTY in characters");
3070 SYSCTL_LONG(_kern, OID_AUTO, tty_nout, CTLFLAG_RD,
3071 	&tk_nout, 0, "Total TTY out characters");
3072 
3073 void
3074 nottystop(struct tty *tp, int rw)
3075 {
3076 
3077 	return;
3078 }
3079 
3080 int
3081 ttyopen(struct cdev *dev, int flag, int mode, struct thread *td)
3082 {
3083 	int		error;
3084 	int		s;
3085 	struct tty	*tp;
3086 
3087 	tp = dev->si_tty;
3088 	s = spltty();
3089 	/*
3090 	 * We jump to this label after all non-interrupted sleeps to pick
3091 	 * up any changes of the device state.
3092 	 */
3093 open_top:
3094 	if (tp->t_state & TS_GONE)
3095 		return (ENXIO);
3096 	error = ttydtrwaitsleep(tp);
3097 	if (error)
3098 		goto out;
3099 	if (tp->t_state & TS_ISOPEN) {
3100 		/*
3101 		 * The device is open, so everything has been initialized.
3102 		 * Handle conflicts.
3103 		 */
3104 		if (ISCALLOUT(dev) && !tp->t_actout)
3105 			return (EBUSY);
3106 		if (tp->t_actout && !ISCALLOUT(dev)) {
3107 			if (flag & O_NONBLOCK)
3108 				return (EBUSY);
3109 			error =	tsleep(&tp->t_actout,
3110 				       TTIPRI | PCATCH, "siobi", 0);
3111 			if (error != 0 || (tp->t_flags & TS_GONE))
3112 				goto out;
3113 			goto open_top;
3114 		}
3115 		if (tp->t_state & TS_XCLUDE && suser(td))
3116 			return (EBUSY);
3117 	} else {
3118 		/*
3119 		 * The device isn't open, so there are no conflicts.
3120 		 * Initialize it.  Initialization is done twice in many
3121 		 * cases: to preempt sleeping callin opens if we are
3122 		 * callout, and to complete a callin open after DCD rises.
3123 		 */
3124 		tp->t_termios = ISCALLOUT(dev) ? tp->t_init_out : tp->t_init_in;
3125 		tp->t_cflag = tp->t_termios.c_cflag;
3126 		tp->t_modem(tp, SER_DTR | SER_RTS, 0);
3127 		++tp->t_wopeners;
3128 		error = tp->t_param(tp, &tp->t_termios);
3129 		--tp->t_wopeners;
3130 		if (error == 0 && tp->t_open != NULL)
3131 			error = tp->t_open(tp, dev);
3132 		if (error != 0)
3133 			goto out;
3134 		if (ISCALLOUT(dev) || (tp->t_modem(tp, 0, 0) & SER_DCD))
3135 			ttyld_modem(tp, 1);
3136 	}
3137 	/*
3138 	 * Wait for DCD if necessary.
3139 	 */
3140 	if (!(tp->t_state & TS_CARR_ON) && !ISCALLOUT(dev)
3141 	    && !(tp->t_cflag & CLOCAL) && !(flag & O_NONBLOCK)) {
3142 		++tp->t_wopeners;
3143 		error = tsleep(TSA_CARR_ON(tp), TTIPRI | PCATCH, "ttydcd", 0);
3144 		--tp->t_wopeners;
3145 		if (error != 0 || (tp->t_state & TS_GONE))
3146 			goto out;
3147 		goto open_top;
3148 	}
3149 	error =	ttyld_open(tp, dev);
3150 	ttyldoptim(tp);
3151 	if (tp->t_state & TS_ISOPEN && ISCALLOUT(dev))
3152 		tp->t_actout = TRUE;
3153 out:
3154 	splx(s);
3155 	if (!(tp->t_state & TS_ISOPEN) && tp->t_wopeners == 0 &&
3156 	    tp->t_close != NULL)
3157 		tp->t_close(tp);
3158 	return (error);
3159 }
3160 
3161 int
3162 ttyclose(struct cdev *dev, int flag, int mode, struct thread *td)
3163 {
3164 	struct tty *tp;
3165 
3166 	tp = dev->si_tty;
3167 	ttyld_close(tp, flag);
3168 	ttyldoptim(tp);
3169 	if (tp->t_close != NULL)
3170 		tp->t_close(tp);
3171 	tty_close(tp);
3172 	tp->t_do_timestamp = 0;
3173 	if (tp->t_pps != NULL)
3174 		tp->t_pps->ppsparam.mode = 0;
3175 	return (0);
3176 }
3177 
3178 int
3179 ttyread(struct cdev *dev, struct uio *uio, int flag)
3180 {
3181 	struct tty *tp;
3182 
3183 	tp = tty_gettp(dev);
3184 
3185 	if (tp->t_state & TS_GONE)
3186 		return (ENODEV);
3187 	return (ttyld_read(tp, uio, flag));
3188 }
3189 
3190 int
3191 ttywrite(struct cdev *dev, struct uio *uio, int flag)
3192 {
3193 	struct tty *tp;
3194 
3195 	tp = tty_gettp(dev);
3196 
3197 	if (tp->t_state & TS_GONE)
3198 		return (ENODEV);
3199 	return (ttyld_write(tp, uio, flag));
3200 }
3201 
3202 int
3203 ttyioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3204 {
3205 	struct	tty *tp;
3206 	int	error;
3207 
3208 	tp = dev->si_tty;
3209 
3210 	if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) {
3211 		int cc;
3212 		struct termios *dt = (struct termios *)data;
3213 		struct termios *lt =
3214 		    ISCALLOUT(dev) ?  &tp->t_lock_out : &tp->t_lock_in;
3215 
3216 		dt->c_iflag = (tp->t_iflag & lt->c_iflag)
3217 		    | (dt->c_iflag & ~lt->c_iflag);
3218 		dt->c_oflag = (tp->t_oflag & lt->c_oflag)
3219 		    | (dt->c_oflag & ~lt->c_oflag);
3220 		dt->c_cflag = (tp->t_cflag & lt->c_cflag)
3221 		    | (dt->c_cflag & ~lt->c_cflag);
3222 		dt->c_lflag = (tp->t_lflag & lt->c_lflag)
3223 		    | (dt->c_lflag & ~lt->c_lflag);
3224 		for (cc = 0; cc < NCCS; ++cc)
3225 		    if (lt->c_cc[cc] != 0)
3226 		        dt->c_cc[cc] = tp->t_cc[cc];
3227 		if (lt->c_ispeed != 0)
3228 		    dt->c_ispeed = tp->t_ispeed;
3229 		if (lt->c_ospeed != 0)
3230 		    dt->c_ospeed = tp->t_ospeed;
3231 	}
3232 
3233 	error = ttyld_ioctl(tp, cmd, data, flag, td);
3234 	if (error == ENOIOCTL)
3235 		error = ttioctl(tp, cmd, data, flag);
3236 	ttyldoptim(tp);
3237 	if (error != ENOIOCTL)
3238 		return (error);
3239 	return (ENOTTY);
3240 }
3241 
3242 void
3243 ttyldoptim(struct tty *tp)
3244 {
3245 	struct termios	*t;
3246 
3247 	t = &tp->t_termios;
3248 	if (!(t->c_iflag & (ICRNL | IGNCR | IMAXBEL | INLCR | ISTRIP | IXON))
3249 	    && (!(t->c_iflag & BRKINT) || (t->c_iflag & IGNBRK))
3250 	    && (!(t->c_iflag & PARMRK)
3251 		|| (t->c_iflag & (IGNPAR | IGNBRK)) == (IGNPAR | IGNBRK))
3252 	    && !(t->c_lflag & (ECHO | ICANON | IEXTEN | ISIG | PENDIN))
3253 	    && linesw[tp->t_line]->l_rint == ttyinput)
3254 		tp->t_state |= TS_CAN_BYPASS_L_RINT;
3255 	else
3256 		tp->t_state &= ~TS_CAN_BYPASS_L_RINT;
3257 }
3258 
3259 static void
3260 ttydtrwaitwakeup(void *arg)
3261 {
3262 	struct tty *tp;
3263 
3264 	tp = arg;
3265 	tp->t_state &= ~TS_DTR_WAIT;
3266 	wakeup(&tp->t_dtr_wait);
3267 }
3268 
3269 
3270 void
3271 ttydtrwaitstart(struct tty *tp)
3272 {
3273 
3274 	if (tp->t_dtr_wait == 0)
3275 		return;
3276 	if (tp->t_state & TS_DTR_WAIT)
3277 		return;
3278 	timeout(ttydtrwaitwakeup, tp, tp->t_dtr_wait);
3279 	tp->t_state |= TS_DTR_WAIT;
3280 }
3281 
3282 int
3283 ttydtrwaitsleep(struct tty *tp)
3284 {
3285 	int error;
3286 
3287 	error = 0;
3288 	while (error == 0) {
3289 		if (tp->t_state & TS_GONE)
3290 			error = ENXIO;
3291 		else if (!(tp->t_state & TS_DTR_WAIT))
3292 			break;
3293 		else
3294 			error = tsleep(&tp->t_dtr_wait, TTIPRI | PCATCH,
3295 			    "dtrwait", 0);
3296 	}
3297 	return (error);
3298 }
3299 
3300 static int
3301 ttysopen(struct cdev *dev, int flag, int mode, struct thread *td)
3302 {
3303 	struct tty *tp;
3304 
3305 	tp = dev->si_tty;
3306 	KASSERT(tp != NULL,
3307 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3308 	if (tp->t_state & TS_GONE)
3309 		return (ENODEV);
3310 	return (0);
3311 }
3312 
3313 static int
3314 ttysclose(struct cdev *dev, int flag, int mode, struct thread *td)
3315 {
3316 
3317 	return (0);
3318 }
3319 
3320 static int
3321 ttysrdwr(struct cdev *dev, struct uio *uio, int flag)
3322 {
3323 
3324 	return (ENODEV);
3325 }
3326 
3327 static int
3328 ttysioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3329 {
3330 	struct tty	*tp;
3331 	int		error;
3332 	struct termios	*ct;
3333 
3334 	tp = dev->si_tty;
3335 	KASSERT(tp != NULL,
3336 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3337 	if (tp->t_state & TS_GONE)
3338 		return (ENODEV);
3339 	ct = dev->si_drv2;
3340 	switch (cmd) {
3341 	case TIOCSETA:
3342 		error = suser(td);
3343 		if (error != 0)
3344 			return (error);
3345 		*ct = *(struct termios *)data;
3346 		return (0);
3347 	case TIOCGETA:
3348 		*(struct termios *)data = *ct;
3349 		return (0);
3350 	case TIOCGETD:
3351 		*(int *)data = TTYDISC;
3352 		return (0);
3353 	case TIOCGWINSZ:
3354 		bzero(data, sizeof(struct winsize));
3355 		return (0);
3356 	default:
3357 		if (tp->t_cioctl != NULL)
3358 			return(tp->t_cioctl(dev, cmd, data, flag, td));
3359 		return (ENOTTY);
3360 	}
3361 }
3362 
3363 /*
3364  * Initialize a tty to sane modes.
3365  */
3366 void
3367 ttyinitmode(struct tty *tp, int echo, int speed)
3368 {
3369 
3370 	if (speed == 0)
3371 		speed = TTYDEF_SPEED;
3372 	tp->t_init_in.c_iflag = TTYDEF_IFLAG;
3373 	tp->t_init_in.c_oflag = TTYDEF_OFLAG;
3374 	tp->t_init_in.c_cflag = TTYDEF_CFLAG;
3375 	if (echo)
3376 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_ECHO;
3377 	else
3378 		tp->t_init_in.c_lflag = TTYDEF_LFLAG;
3379 
3380 	tp->t_init_in.c_ispeed = tp->t_init_in.c_ospeed = speed;
3381 	termioschars(&tp->t_init_in);
3382 	tp->t_init_out = tp->t_init_in;
3383 	tp->t_termios = tp->t_init_in;
3384 }
3385 
3386 /*
3387  * Use more "normal" termios paramters for consoles.
3388  */
3389 void
3390 ttyconsolemode(struct tty *tp, int speed)
3391 {
3392 
3393 	if (speed == 0)
3394 		speed = TTYDEF_SPEED;
3395 	ttyinitmode(tp, 1, speed);
3396 	tp->t_init_in.c_cflag |= CLOCAL;
3397 	tp->t_lock_out.c_cflag = tp->t_lock_in.c_cflag = CLOCAL;
3398 	tp->t_lock_out.c_ispeed = tp->t_lock_out.c_ospeed =
3399 	tp->t_lock_in.c_ispeed = tp->t_lock_in.c_ospeed = speed;
3400 	tp->t_init_out = tp->t_init_in;
3401 	tp->t_termios = tp->t_init_in;
3402 }
3403 
3404 /*
3405  * Record the relationship between the serial ports notion of modem control
3406  * signals and the one used in certain ioctls in a way the compiler can enforce
3407  * XXX: We should define TIOCM_* in terms of SER_ if we can limit the
3408  * XXX: consequences of the #include work that would take.
3409  */
3410 CTASSERT(SER_DTR == TIOCM_DTR / 2);
3411 CTASSERT(SER_RTS == TIOCM_RTS / 2);
3412 CTASSERT(SER_STX == TIOCM_ST / 2);
3413 CTASSERT(SER_SRX == TIOCM_SR / 2);
3414 CTASSERT(SER_CTS == TIOCM_CTS / 2);
3415 CTASSERT(SER_DCD == TIOCM_DCD / 2);
3416 CTASSERT(SER_RI == TIOCM_RI / 2);
3417 CTASSERT(SER_DSR == TIOCM_DSR / 2);
3418 
3419