xref: /freebsd/sys/kern/tty.c (revision ca9ac06c99bfd0150b85d4d83c396ce6237c0e05)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Copyright (c) 2002 Networks Associates Technologies, Inc.
11  * All rights reserved.
12  *
13  * Portions of this software were developed for the FreeBSD Project by
14  * ThinkSec AS and NAI Labs, the Security Research Division of Network
15  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
16  * ("CBOSS"), as part of the DARPA CHATS research program.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 4. Neither the name of the University nor the names of its contributors
27  *    may be used to endorse or promote products derived from this software
28  *    without specific prior written permission.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40  * SUCH DAMAGE.
41  *
42  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
43  */
44 
45 /*-
46  * TODO:
47  *	o Fix races for sending the start char in ttyflush().
48  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
49  *	  With luck, there will be MIN chars before select() returns().
50  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
51  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
52  *	  FIONREAD.
53  *	o Do the new sio locking stuff here and use it to avoid special
54  *	  case for EXTPROC?
55  *	o Lock PENDIN too?
56  *	o Move EXTPROC and/or PENDIN to t_state?
57  *	o Wrap most of ttioctl in spltty/splx.
58  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
59  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
60  *	o Don't allow certain termios flags to affect disciplines other
61  *	  than TTYDISC.  Cancel their effects before switch disciplines
62  *	  and ignore them if they are set while we are in another
63  *	  discipline.
64  *	o Now that historical speed conversions are handled here, don't
65  *	  do them in drivers.
66  *	o Check for TS_CARR_ON being set while everything is closed and not
67  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
68  *	  so it would live until the next open even if carrier drops.
69  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
70  *	  only when _all_ openers leave open().
71  */
72 
73 #include <sys/cdefs.h>
74 __FBSDID("$FreeBSD$");
75 
76 #include "opt_compat.h"
77 #include "opt_tty.h"
78 
79 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/filio.h>
82 #include <sys/lock.h>
83 #include <sys/mutex.h>
84 #include <sys/namei.h>
85 #include <sys/sx.h>
86 #ifndef BURN_BRIDGES
87 #if defined(COMPAT_43)
88 #include <sys/ioctl_compat.h>
89 #endif
90 #endif
91 #include <sys/proc.h>
92 #define	TTYDEFCHARS
93 #include <sys/tty.h>
94 #undef	TTYDEFCHARS
95 #include <sys/fcntl.h>
96 #include <sys/conf.h>
97 #include <sys/poll.h>
98 #include <sys/kernel.h>
99 #include <sys/vnode.h>
100 #include <sys/serial.h>
101 #include <sys/signalvar.h>
102 #include <sys/resourcevar.h>
103 #include <sys/malloc.h>
104 #include <sys/filedesc.h>
105 #include <sys/sched.h>
106 #include <sys/sysctl.h>
107 #include <sys/timepps.h>
108 
109 #include <machine/stdarg.h>
110 
111 #include <vm/vm.h>
112 #include <vm/pmap.h>
113 #include <vm/vm_map.h>
114 
115 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
116 
117 long tk_cancc;
118 long tk_nin;
119 long tk_nout;
120 long tk_rawcc;
121 
122 static	d_open_t	ttysopen;
123 static	d_close_t	ttysclose;
124 static	d_read_t	ttysrdwr;
125 static	d_ioctl_t	ttysioctl;
126 static	d_purge_t	ttypurge;
127 
128 /* Default cdevsw for common tty devices */
129 static struct cdevsw tty_cdevsw = {
130 	.d_version =	D_VERSION,
131 	.d_open =	ttyopen,
132 	.d_close =	ttyclose,
133 	.d_ioctl =	ttyioctl,
134 	.d_purge =	ttypurge,
135 	.d_name =	"ttydrv",
136 	.d_flags =	D_TTY | D_NEEDGIANT,
137 };
138 
139 /* Cdevsw for slave tty devices */
140 static struct cdevsw ttys_cdevsw = {
141 	.d_version =	D_VERSION,
142 	.d_open =	ttysopen,
143 	.d_close =	ttysclose,
144 	.d_read =	ttysrdwr,
145 	.d_write =	ttysrdwr,
146 	.d_ioctl =	ttysioctl,
147 	.d_name =	"TTYS",
148 	.d_flags =	D_TTY | D_NEEDGIANT,
149 };
150 
151 static int	proc_compare(struct proc *p1, struct proc *p2);
152 static int	ttnread(struct tty *tp);
153 static void	ttyecho(int c, struct tty *tp);
154 static int	ttyoutput(int c, struct tty *tp);
155 static void	ttypend(struct tty *tp);
156 static void	ttyretype(struct tty *tp);
157 static void	ttyrub(int c, struct tty *tp);
158 static void	ttyrubo(struct tty *tp, int cnt);
159 static void	ttyunblock(struct tty *tp);
160 static int	ttywflush(struct tty *tp);
161 static int	filt_ttyread(struct knote *kn, long hint);
162 static void	filt_ttyrdetach(struct knote *kn);
163 static int	filt_ttywrite(struct knote *kn, long hint);
164 static void	filt_ttywdetach(struct knote *kn);
165 
166 /*
167  * Table with character classes and parity. The 8th bit indicates parity,
168  * the 7th bit indicates the character is an alphameric or underscore (for
169  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
170  * are 0 then the character needs no special processing on output; classes
171  * other than 0 might be translated or (not currently) require delays.
172  */
173 #define	E	0x00	/* Even parity. */
174 #define	O	0x80	/* Odd parity. */
175 #define	PARITY(c)	(char_type[c] & O)
176 
177 #define	ALPHA	0x40	/* Alpha or underscore. */
178 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
179 
180 #define	CCLASSMASK	0x3f
181 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
182 
183 #define	BS	BACKSPACE
184 #define	CC	CONTROL
185 #define	CR	RETURN
186 #define	NA	ORDINARY | ALPHA
187 #define	NL	NEWLINE
188 #define	NO	ORDINARY
189 #define	TB	TAB
190 #define	VT	VTAB
191 
192 static u_char const char_type[] = {
193 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
194 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
195 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
196 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
197 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
198 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
199 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
200 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
201 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
202 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
203 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
204 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
205 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
206 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
207 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
208 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
209 	/*
210 	 * Meta chars; should be settable per character set;
211 	 * for now, treat them all as normal characters.
212 	 */
213 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
214 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
215 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
216 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
217 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
218 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
219 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
220 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
221 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
222 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
223 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
224 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
225 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
226 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
227 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
228 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
229 };
230 #undef	BS
231 #undef	CC
232 #undef	CR
233 #undef	NA
234 #undef	NL
235 #undef	NO
236 #undef	TB
237 #undef	VT
238 
239 /* Macros to clear/set/test flags. */
240 #define	SET(t, f)	(t) |= (f)
241 #define	CLR(t, f)	(t) &= ~(f)
242 #define	ISSET(t, f)	((t) & (f))
243 
244 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
245 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
246 
247 /*
248  * list of struct tty where pstat(8) can pick it up with sysctl
249  *
250  * The lock order is to grab the list mutex before the tty mutex.
251  * Together with additions going on the tail of the list, this allows
252  * the sysctl to avoid doing retries.
253  */
254 static	TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
255 static struct mtx tty_list_mutex;
256 
257 static struct unrhdr *tty_unit;
258 
259 static int  drainwait = 5*60;
260 SYSCTL_INT(_kern, OID_AUTO, drainwait, CTLFLAG_RW, &drainwait,
261 	0, "Output drain timeout in seconds");
262 
263 static struct tty *
264 tty_gettp(struct cdev *dev)
265 {
266 	struct tty *tp;
267 	struct cdevsw *csw;
268 
269 	csw = dev_refthread(dev);
270 	KASSERT(csw != NULL, ("No cdevsw in ttycode (%s)", devtoname(dev)));
271 	KASSERT(csw->d_flags & D_TTY,
272 	    ("non D_TTY (%s) in tty code", devtoname(dev)));
273 	dev_relthread(dev);
274 	tp = dev->si_tty;
275 	KASSERT(tp != NULL,
276 	    ("no tty pointer on (%s) in tty code", devtoname(dev)));
277 	return (tp);
278 }
279 
280 /*
281  * Initial open of tty, or (re)entry to standard tty line discipline.
282  */
283 int
284 tty_open(struct cdev *device, struct tty *tp)
285 {
286 	int s;
287 
288 	s = spltty();
289 	tp->t_dev = device;
290 	tp->t_hotchar = 0;
291 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
292 		ttyref(tp);
293 		SET(tp->t_state, TS_ISOPEN);
294 		if (ISSET(tp->t_cflag, CLOCAL))
295 			SET(tp->t_state, TS_CONNECTED);
296 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
297 	}
298 	/* XXX don't hang forever on output */
299 	if (tp->t_timeout < 0)
300 		tp->t_timeout = drainwait*hz;
301 	ttsetwater(tp);
302 	splx(s);
303 	return (0);
304 }
305 
306 /*
307  * Handle close() on a tty line: flush and set to initial state,
308  * bumping generation number so that pending read/write calls
309  * can detect recycling of the tty.
310  * XXX our caller should have done `spltty(); l_close(); tty_close();'
311  * and l_close() should have flushed, but we repeat the spltty() and
312  * the flush in case there are buggy callers.
313  */
314 int
315 tty_close(struct tty *tp)
316 {
317 	int s;
318 
319 	funsetown(&tp->t_sigio);
320 	s = spltty();
321 	if (constty == tp)
322 		constty_clear();
323 
324 	ttyflush(tp, FREAD | FWRITE);
325 	clist_free_cblocks(&tp->t_canq);
326 	clist_free_cblocks(&tp->t_outq);
327 	clist_free_cblocks(&tp->t_rawq);
328 
329 	tp->t_gen++;
330 	tp->t_line = TTYDISC;
331 	tp->t_hotchar = 0;
332 	tp->t_pgrp = NULL;
333 	tp->t_session = NULL;
334 	tp->t_state = 0;
335 	knlist_clear(&tp->t_rsel.si_note, 0);
336 	knlist_clear(&tp->t_wsel.si_note, 0);
337 	ttyrel(tp);
338 	splx(s);
339 	return (0);
340 }
341 
342 #define	FLUSHQ(q) {							\
343 	if ((q)->c_cc)							\
344 		ndflush(q, (q)->c_cc);					\
345 }
346 
347 /* Is 'c' a line delimiter ("break" character)? */
348 #define	TTBREAKC(c, lflag)							\
349 	((c) == '\n' || (((c) == cc[VEOF] ||				\
350 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
351 	 (c) != _POSIX_VDISABLE))
352 
353 /*
354  * Process input of a single character received on a tty.
355  */
356 int
357 ttyinput(int c, struct tty *tp)
358 {
359 	tcflag_t iflag, lflag;
360 	cc_t *cc;
361 	int i, err;
362 
363 	/*
364 	 * If input is pending take it first.
365 	 */
366 	lflag = tp->t_lflag;
367 	if (ISSET(lflag, PENDIN))
368 		ttypend(tp);
369 	/*
370 	 * Gather stats.
371 	 */
372 	if (ISSET(lflag, ICANON)) {
373 		++tk_cancc;
374 		++tp->t_cancc;
375 	} else {
376 		++tk_rawcc;
377 		++tp->t_rawcc;
378 	}
379 	++tk_nin;
380 
381 	/*
382 	 * Block further input iff:
383 	 * current input > threshold AND input is available to user program
384 	 * AND input flow control is enabled and not yet invoked.
385 	 * The 3 is slop for PARMRK.
386 	 */
387 	iflag = tp->t_iflag;
388 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
389 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
390 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
391 	    !ISSET(tp->t_state, TS_TBLOCK))
392 		ttyblock(tp);
393 
394 	/* Handle exceptional conditions (break, parity, framing). */
395 	cc = tp->t_cc;
396 	err = (ISSET(c, TTY_ERRORMASK));
397 	if (err) {
398 		CLR(c, TTY_ERRORMASK);
399 		if (ISSET(err, TTY_BI)) {
400 			if (ISSET(iflag, IGNBRK))
401 				return (0);
402 			if (ISSET(iflag, BRKINT)) {
403 				ttyflush(tp, FREAD | FWRITE);
404 				if (tp->t_pgrp != NULL) {
405 					PGRP_LOCK(tp->t_pgrp);
406 					pgsignal(tp->t_pgrp, SIGINT, 1);
407 					PGRP_UNLOCK(tp->t_pgrp);
408 				}
409 				goto endcase;
410 			}
411 			if (ISSET(iflag, PARMRK))
412 				goto parmrk;
413 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
414 			|| ISSET(err, TTY_FE)) {
415 			if (ISSET(iflag, IGNPAR))
416 				return (0);
417 			else if (ISSET(iflag, PARMRK)) {
418 parmrk:
419 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
420 				    MAX_INPUT - 3)
421 					goto input_overflow;
422 				(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
423 				(void)putc(0 | TTY_QUOTE, &tp->t_rawq);
424 				(void)putc(c | TTY_QUOTE, &tp->t_rawq);
425 				goto endcase;
426 			} else
427 				c = 0;
428 		}
429 	}
430 
431 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
432 		CLR(c, 0x80);
433 	if (!ISSET(lflag, EXTPROC)) {
434 		/*
435 		 * Check for literal nexting very first
436 		 */
437 		if (ISSET(tp->t_state, TS_LNCH)) {
438 			SET(c, TTY_QUOTE);
439 			CLR(tp->t_state, TS_LNCH);
440 		}
441 		/*
442 		 * Scan for special characters.  This code
443 		 * is really just a big case statement with
444 		 * non-constant cases.  The bottom of the
445 		 * case statement is labeled ``endcase'', so goto
446 		 * it after a case match, or similar.
447 		 */
448 
449 		/*
450 		 * Control chars which aren't controlled
451 		 * by ICANON, ISIG, or IXON.
452 		 */
453 		if (ISSET(lflag, IEXTEN)) {
454 			if (CCEQ(cc[VLNEXT], c)) {
455 				if (ISSET(lflag, ECHO)) {
456 					if (ISSET(lflag, ECHOE)) {
457 						(void)ttyoutput('^', tp);
458 						(void)ttyoutput('\b', tp);
459 					} else
460 						ttyecho(c, tp);
461 				}
462 				SET(tp->t_state, TS_LNCH);
463 				goto endcase;
464 			}
465 			if (CCEQ(cc[VDISCARD], c)) {
466 				if (ISSET(lflag, FLUSHO))
467 					CLR(tp->t_lflag, FLUSHO);
468 				else {
469 					ttyflush(tp, FWRITE);
470 					ttyecho(c, tp);
471 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
472 						ttyretype(tp);
473 					SET(tp->t_lflag, FLUSHO);
474 				}
475 				goto startoutput;
476 			}
477 		}
478 		/*
479 		 * Signals.
480 		 */
481 		if (ISSET(lflag, ISIG)) {
482 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
483 				if (!ISSET(lflag, NOFLSH))
484 					ttyflush(tp, FREAD | FWRITE);
485 				ttyecho(c, tp);
486 				if (tp->t_pgrp != NULL) {
487 					PGRP_LOCK(tp->t_pgrp);
488 					pgsignal(tp->t_pgrp,
489 					    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
490 					PGRP_UNLOCK(tp->t_pgrp);
491 				}
492 				goto endcase;
493 			}
494 			if (CCEQ(cc[VSUSP], c)) {
495 				if (!ISSET(lflag, NOFLSH))
496 					ttyflush(tp, FREAD);
497 				ttyecho(c, tp);
498 				if (tp->t_pgrp != NULL) {
499 					PGRP_LOCK(tp->t_pgrp);
500 					pgsignal(tp->t_pgrp, SIGTSTP, 1);
501 					PGRP_UNLOCK(tp->t_pgrp);
502 				}
503 				goto endcase;
504 			}
505 		}
506 		/*
507 		 * Handle start/stop characters.
508 		 */
509 		if (ISSET(iflag, IXON)) {
510 			if (CCEQ(cc[VSTOP], c)) {
511 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
512 					SET(tp->t_state, TS_TTSTOP);
513 					(*tp->t_stop)(tp, 0);
514 					return (0);
515 				}
516 				if (!CCEQ(cc[VSTART], c))
517 					return (0);
518 				/*
519 				 * if VSTART == VSTOP then toggle
520 				 */
521 				goto endcase;
522 			}
523 			if (CCEQ(cc[VSTART], c))
524 				goto restartoutput;
525 		}
526 		/*
527 		 * IGNCR, ICRNL, & INLCR
528 		 */
529 		if (c == '\r') {
530 			if (ISSET(iflag, IGNCR))
531 				return (0);
532 			else if (ISSET(iflag, ICRNL))
533 				c = '\n';
534 		} else if (c == '\n' && ISSET(iflag, INLCR))
535 			c = '\r';
536 	}
537 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
538 		/*
539 		 * From here on down canonical mode character
540 		 * processing takes place.
541 		 */
542 		/*
543 		 * erase or erase2 (^H / ^?)
544 		 */
545 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
546 			if (tp->t_rawq.c_cc)
547 				ttyrub(unputc(&tp->t_rawq), tp);
548 			goto endcase;
549 		}
550 		/*
551 		 * kill (^U)
552 		 */
553 		if (CCEQ(cc[VKILL], c)) {
554 			if (ISSET(lflag, ECHOKE) &&
555 			    tp->t_rawq.c_cc == tp->t_rocount &&
556 			    !ISSET(lflag, ECHOPRT))
557 				while (tp->t_rawq.c_cc)
558 					ttyrub(unputc(&tp->t_rawq), tp);
559 			else {
560 				ttyecho(c, tp);
561 				if (ISSET(lflag, ECHOK) ||
562 				    ISSET(lflag, ECHOKE))
563 					ttyecho('\n', tp);
564 				FLUSHQ(&tp->t_rawq);
565 				tp->t_rocount = 0;
566 			}
567 			CLR(tp->t_state, TS_LOCAL);
568 			goto endcase;
569 		}
570 		/*
571 		 * word erase (^W)
572 		 */
573 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
574 			int ctype;
575 
576 			/*
577 			 * erase whitespace
578 			 */
579 			while ((c = unputc(&tp->t_rawq)) == ' ' || c == '\t')
580 				ttyrub(c, tp);
581 			if (c == -1)
582 				goto endcase;
583 			/*
584 			 * erase last char of word and remember the
585 			 * next chars type (for ALTWERASE)
586 			 */
587 			ttyrub(c, tp);
588 			c = unputc(&tp->t_rawq);
589 			if (c == -1)
590 				goto endcase;
591 			if (c == ' ' || c == '\t') {
592 				(void)putc(c, &tp->t_rawq);
593 				goto endcase;
594 			}
595 			ctype = ISALPHA(c);
596 			/*
597 			 * erase rest of word
598 			 */
599 			do {
600 				ttyrub(c, tp);
601 				c = unputc(&tp->t_rawq);
602 				if (c == -1)
603 					goto endcase;
604 			} while (c != ' ' && c != '\t' &&
605 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
606 			(void)putc(c, &tp->t_rawq);
607 			goto endcase;
608 		}
609 		/*
610 		 * reprint line (^R)
611 		 */
612 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
613 			ttyretype(tp);
614 			goto endcase;
615 		}
616 		/*
617 		 * ^T - kernel info and generate SIGINFO
618 		 */
619 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
620 			if (ISSET(lflag, ISIG) && tp->t_pgrp != NULL) {
621 				PGRP_LOCK(tp->t_pgrp);
622 				pgsignal(tp->t_pgrp, SIGINFO, 1);
623 				PGRP_UNLOCK(tp->t_pgrp);
624 			}
625 			if (!ISSET(lflag, NOKERNINFO))
626 				ttyinfo(tp);
627 			goto endcase;
628 		}
629 	}
630 	/*
631 	 * Check for input buffer overflow
632 	 */
633 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
634 input_overflow:
635 		if (ISSET(iflag, IMAXBEL)) {
636 			if (tp->t_outq.c_cc < tp->t_ohiwat)
637 				(void)ttyoutput(CTRL('g'), tp);
638 		}
639 		goto endcase;
640 	}
641 
642 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
643 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
644 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
645 
646 	/*
647 	 * Put data char in q for user and
648 	 * wakeup on seeing a line delimiter.
649 	 */
650 	if (putc(c, &tp->t_rawq) >= 0) {
651 		if (!ISSET(lflag, ICANON)) {
652 			ttwakeup(tp);
653 			ttyecho(c, tp);
654 			goto endcase;
655 		}
656 		if (TTBREAKC(c, lflag)) {
657 			tp->t_rocount = 0;
658 			catq(&tp->t_rawq, &tp->t_canq);
659 			ttwakeup(tp);
660 		} else if (tp->t_rocount++ == 0)
661 			tp->t_rocol = tp->t_column;
662 		if (ISSET(tp->t_state, TS_ERASE)) {
663 			/*
664 			 * end of prterase \.../
665 			 */
666 			CLR(tp->t_state, TS_ERASE);
667 			(void)ttyoutput('/', tp);
668 		}
669 		i = tp->t_column;
670 		ttyecho(c, tp);
671 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
672 			/*
673 			 * Place the cursor over the '^' of the ^D.
674 			 */
675 			i = imin(2, tp->t_column - i);
676 			while (i > 0) {
677 				(void)ttyoutput('\b', tp);
678 				i--;
679 			}
680 		}
681 	}
682 endcase:
683 	/*
684 	 * IXANY means allow any character to restart output.
685 	 */
686 	if (ISSET(tp->t_state, TS_TTSTOP) &&
687 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
688 		return (0);
689 restartoutput:
690 	CLR(tp->t_lflag, FLUSHO);
691 	CLR(tp->t_state, TS_TTSTOP);
692 startoutput:
693 	return (ttstart(tp));
694 }
695 
696 /*
697  * Output a single character on a tty, doing output processing
698  * as needed (expanding tabs, newline processing, etc.).
699  * Returns < 0 if succeeds, otherwise returns char to resend.
700  * Must be recursive.
701  */
702 static int
703 ttyoutput(int c, struct tty *tp)
704 {
705 	tcflag_t oflag;
706 	int col, s;
707 
708 	oflag = tp->t_oflag;
709 	if (!ISSET(oflag, OPOST)) {
710 		if (ISSET(tp->t_lflag, FLUSHO))
711 			return (-1);
712 		if (putc(c, &tp->t_outq))
713 			return (c);
714 		tk_nout++;
715 		tp->t_outcc++;
716 		return (-1);
717 	}
718 	/*
719 	 * Do tab expansion if OXTABS is set.  Special case if we external
720 	 * processing, we don't do the tab expansion because we'll probably
721 	 * get it wrong.  If tab expansion needs to be done, let it happen
722 	 * externally.
723 	 */
724 	CLR(c, ~TTY_CHARMASK);
725 	if (c == '\t' &&
726 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
727 		c = 8 - (tp->t_column & 7);
728 		if (!ISSET(tp->t_lflag, FLUSHO)) {
729 			s = spltty();		/* Don't interrupt tabs. */
730 			c -= b_to_q("        ", c, &tp->t_outq);
731 			tk_nout += c;
732 			tp->t_outcc += c;
733 			splx(s);
734 		}
735 		tp->t_column += c;
736 		return (c ? -1 : '\t');
737 	}
738 	if (c == CEOT && ISSET(oflag, ONOEOT))
739 		return (-1);
740 
741 	/*
742 	 * Newline translation: if ONLCR is set,
743 	 * translate newline into "\r\n".
744 	 */
745 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
746 		tk_nout++;
747 		tp->t_outcc++;
748 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
749 			return (c);
750 	}
751 	/* If OCRNL is set, translate "\r" into "\n". */
752 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
753 		c = '\n';
754 	/* If ONOCR is set, don't transmit CRs when on column 0. */
755 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
756 		return (-1);
757 
758 	tk_nout++;
759 	tp->t_outcc++;
760 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
761 		return (c);
762 
763 	col = tp->t_column;
764 	switch (CCLASS(c)) {
765 	case BACKSPACE:
766 		if (col > 0)
767 			--col;
768 		break;
769 	case CONTROL:
770 		break;
771 	case NEWLINE:
772 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
773 			col = 0;
774 		break;
775 	case RETURN:
776 		col = 0;
777 		break;
778 	case ORDINARY:
779 		++col;
780 		break;
781 	case TAB:
782 		col = (col + 8) & ~7;
783 		break;
784 	}
785 	tp->t_column = col;
786 	return (-1);
787 }
788 
789 /*
790  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
791  * has been called to do discipline-specific functions and/or reject any
792  * of these ioctl commands.
793  */
794 /* ARGSUSED */
795 int
796 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
797 {
798 	struct proc *p;
799 	struct thread *td;
800 	struct pgrp *pgrp;
801 	int s, error, bits, sig, sig2;
802 
803 	td = curthread;			/* XXX */
804 	p = td->td_proc;
805 
806 	/* If the ioctl involves modification, hang if in the background. */
807 	switch (cmd) {
808 	case  TIOCCBRK:
809 	case  TIOCCONS:
810 	case  TIOCDRAIN:
811 	case  TIOCEXCL:
812 	case  TIOCFLUSH:
813 #ifdef TIOCHPCL
814 	case  TIOCHPCL:
815 #endif
816 	case  TIOCNXCL:
817 	case  TIOCSBRK:
818 	case  TIOCSCTTY:
819 	case  TIOCSDRAINWAIT:
820 	case  TIOCSETA:
821 	case  TIOCSETAF:
822 	case  TIOCSETAW:
823 	case  TIOCSETD:
824 	case  TIOCSPGRP:
825 	case  TIOCSTART:
826 	case  TIOCSTAT:
827 	case  TIOCSTI:
828 	case  TIOCSTOP:
829 	case  TIOCSWINSZ:
830 #ifndef BURN_BRIDGES
831 #if defined(COMPAT_43)
832 	case  TIOCLBIC:
833 	case  TIOCLBIS:
834 	case  TIOCLSET:
835 	case  TIOCSETC:
836 	case OTIOCSETD:
837 	case  TIOCSETN:
838 	case  TIOCSETP:
839 	case  TIOCSLTC:
840 #endif
841 #endif
842 		sx_slock(&proctree_lock);
843 		PROC_LOCK(p);
844 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
845 		    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
846 		    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
847 			pgrp = p->p_pgrp;
848 			PROC_UNLOCK(p);
849 			if (pgrp->pg_jobc == 0) {
850 				sx_sunlock(&proctree_lock);
851 				return (EIO);
852 			}
853 			PGRP_LOCK(pgrp);
854 			sx_sunlock(&proctree_lock);
855 			pgsignal(pgrp, SIGTTOU, 1);
856 			PGRP_UNLOCK(pgrp);
857 			error = ttysleep(tp, &lbolt, TTOPRI | PCATCH, "ttybg1",
858 					 0);
859 			if (error)
860 				return (error);
861 			sx_slock(&proctree_lock);
862 			PROC_LOCK(p);
863 		}
864 		PROC_UNLOCK(p);
865 		sx_sunlock(&proctree_lock);
866 		break;
867 	}
868 
869 	if (tp->t_break != NULL) {
870 		switch (cmd) {
871 		case TIOCSBRK:
872 			tp->t_break(tp, 1);
873 			return (0);
874 		case TIOCCBRK:
875 			tp->t_break(tp, 0);
876 			return (0);
877 		default:
878 			break;
879 		}
880 	}
881 
882 	if (tp->t_modem != NULL) {
883 		switch (cmd) {
884 		case TIOCSDTR:
885 			tp->t_modem(tp, SER_DTR, 0);
886 			return (0);
887 		case TIOCCDTR:
888 			tp->t_modem(tp, 0, SER_DTR);
889 			return (0);
890 		case TIOCMSET:
891 			bits = *(int *)data;
892 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
893 			sig2 = ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1;
894 			tp->t_modem(tp, sig, sig2);
895 			return (0);
896 		case TIOCMBIS:
897 			bits = *(int *)data;
898 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
899 			tp->t_modem(tp, sig, 0);
900 			return (0);
901 		case TIOCMBIC:
902 			bits = *(int *)data;
903 			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
904 			tp->t_modem(tp, 0, sig);
905 			return (0);
906 		case TIOCMGET:
907 			sig = tp->t_modem(tp, 0, 0);
908 			/* See <sys/serial.h. for the "<< 1" stuff */
909 			bits = TIOCM_LE + (sig << 1);
910 			*(int *)data = bits;
911 			return (0);
912 		default:
913 			break;
914 		}
915 	}
916 
917 	switch (cmd) {			/* Process the ioctl. */
918 	case FIOASYNC:			/* set/clear async i/o */
919 		s = spltty();
920 		if (*(int *)data)
921 			SET(tp->t_state, TS_ASYNC);
922 		else
923 			CLR(tp->t_state, TS_ASYNC);
924 		splx(s);
925 		break;
926 	case FIONBIO:			/* set/clear non-blocking i/o */
927 		break;			/* XXX: delete. */
928 	case FIONREAD:			/* get # bytes to read */
929 		s = spltty();
930 		*(int *)data = ttnread(tp);
931 		splx(s);
932 		break;
933 
934 	case FIOSETOWN:
935 		/*
936 		 * Policy -- Don't allow FIOSETOWN on someone else's
937 		 *           controlling tty
938 		 */
939 		if (tp->t_session != NULL && !isctty(p, tp))
940 			return (ENOTTY);
941 
942 		error = fsetown(*(int *)data, &tp->t_sigio);
943 		if (error)
944 			return (error);
945 		break;
946 	case FIOGETOWN:
947 		if (tp->t_session != NULL && !isctty(p, tp))
948 			return (ENOTTY);
949 		*(int *)data = fgetown(&tp->t_sigio);
950 		break;
951 
952 	case TIOCEXCL:			/* set exclusive use of tty */
953 		s = spltty();
954 		SET(tp->t_state, TS_XCLUDE);
955 		splx(s);
956 		break;
957 	case TIOCFLUSH: {		/* flush buffers */
958 		int flags = *(int *)data;
959 
960 		if (flags == 0)
961 			flags = FREAD | FWRITE;
962 		else
963 			flags &= FREAD | FWRITE;
964 		ttyflush(tp, flags);
965 		break;
966 	}
967 	case TIOCCONS:			/* become virtual console */
968 		if (*(int *)data) {
969 			struct nameidata nid;
970 
971 			if (constty && constty != tp &&
972 			    ISSET(constty->t_state, TS_CONNECTED))
973 				return (EBUSY);
974 
975 			/* Ensure user can open the real console. */
976 			NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
977 			    "/dev/console", td);
978 			if ((error = namei(&nid)) != 0)
979 				return (error);
980 			NDFREE(&nid, NDF_ONLY_PNBUF);
981 			error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
982 			vput(nid.ni_vp);
983 			if (error)
984 				return (error);
985 
986 			constty_set(tp);
987 		} else if (tp == constty)
988 			constty_clear();
989 		break;
990 	case TIOCDRAIN:			/* wait till output drained */
991 		error = ttywait(tp);
992 		if (error)
993 			return (error);
994 		break;
995 	case TIOCGETA: {		/* get termios struct */
996 		struct termios *t = (struct termios *)data;
997 
998 		bcopy(&tp->t_termios, t, sizeof(struct termios));
999 		break;
1000 	}
1001 	case TIOCGETD:			/* get line discipline */
1002 		*(int *)data = tp->t_line;
1003 		break;
1004 	case TIOCGWINSZ:		/* get window size */
1005 		*(struct winsize *)data = tp->t_winsize;
1006 		break;
1007 	case TIOCGPGRP:			/* get pgrp of tty */
1008 		if (!isctty(p, tp))
1009 			return (ENOTTY);
1010 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1011 		break;
1012 #ifdef TIOCHPCL
1013 	case TIOCHPCL:			/* hang up on last close */
1014 		s = spltty();
1015 		SET(tp->t_cflag, HUPCL);
1016 		splx(s);
1017 		break;
1018 #endif
1019 	case TIOCMGDTRWAIT:
1020 		*(int *)data = tp->t_dtr_wait * 100 / hz;
1021 		break;
1022 	case TIOCMSDTRWAIT:
1023 		/* must be root since the wait applies to following logins */
1024 		error = suser(td);
1025 		if (error)
1026 			return (error);
1027 		tp->t_dtr_wait = *(int *)data * hz / 100;
1028 		break;
1029 	case TIOCNXCL:			/* reset exclusive use of tty */
1030 		s = spltty();
1031 		CLR(tp->t_state, TS_XCLUDE);
1032 		splx(s);
1033 		break;
1034 	case TIOCOUTQ:			/* output queue size */
1035 		*(int *)data = tp->t_outq.c_cc;
1036 		break;
1037 	case TIOCSETA:			/* set termios struct */
1038 	case TIOCSETAW:			/* drain output, set */
1039 	case TIOCSETAF: {		/* drn out, fls in, set */
1040 		struct termios *t = (struct termios *)data;
1041 
1042 		if (t->c_ispeed == 0)
1043 			t->c_ispeed = t->c_ospeed;
1044 		if (t->c_ispeed == 0)
1045 			t->c_ispeed = tp->t_ospeed;
1046 		if (t->c_ispeed == 0)
1047 			return (EINVAL);
1048 		s = spltty();
1049 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1050 			error = ttywait(tp);
1051 			if (error) {
1052 				splx(s);
1053 				return (error);
1054 			}
1055 			if (cmd == TIOCSETAF)
1056 				ttyflush(tp, FREAD);
1057 		}
1058 		if (!ISSET(t->c_cflag, CIGNORE)) {
1059 			/*
1060 			 * Set device hardware.
1061 			 */
1062 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1063 				splx(s);
1064 				return (error);
1065 			}
1066 			if (ISSET(t->c_cflag, CLOCAL) &&
1067 			    !ISSET(tp->t_cflag, CLOCAL)) {
1068 				/*
1069 				 * XXX disconnections would be too hard to
1070 				 * get rid of without this kludge.  The only
1071 				 * way to get rid of controlling terminals
1072 				 * is to exit from the session leader.
1073 				 */
1074 				CLR(tp->t_state, TS_ZOMBIE);
1075 
1076 				wakeup(TSA_CARR_ON(tp));
1077 				ttwakeup(tp);
1078 				ttwwakeup(tp);
1079 			}
1080 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1081 			     ISSET(t->c_cflag, CLOCAL)) &&
1082 			    !ISSET(tp->t_state, TS_ZOMBIE))
1083 				SET(tp->t_state, TS_CONNECTED);
1084 			else
1085 				CLR(tp->t_state, TS_CONNECTED);
1086 			tp->t_cflag = t->c_cflag;
1087 			tp->t_ispeed = t->c_ispeed;
1088 			if (t->c_ospeed != 0)
1089 				tp->t_ospeed = t->c_ospeed;
1090 			ttsetwater(tp);
1091 		}
1092 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1093 		    cmd != TIOCSETAF) {
1094 			if (ISSET(t->c_lflag, ICANON))
1095 				SET(tp->t_lflag, PENDIN);
1096 			else {
1097 				/*
1098 				 * XXX we really shouldn't allow toggling
1099 				 * ICANON while we're in a non-termios line
1100 				 * discipline.  Now we have to worry about
1101 				 * panicing for a null queue.
1102 				 */
1103 				if (tp->t_canq.c_cbreserved > 0 &&
1104 				    tp->t_rawq.c_cbreserved > 0) {
1105 					catq(&tp->t_rawq, &tp->t_canq);
1106 					/*
1107 					 * XXX the queue limits may be
1108 					 * different, so the old queue
1109 					 * swapping method no longer works.
1110 					 */
1111 					catq(&tp->t_canq, &tp->t_rawq);
1112 				}
1113 				CLR(tp->t_lflag, PENDIN);
1114 			}
1115 			ttwakeup(tp);
1116 		}
1117 		tp->t_iflag = t->c_iflag;
1118 		tp->t_oflag = t->c_oflag;
1119 		/*
1120 		 * Make the EXTPROC bit read only.
1121 		 */
1122 		if (ISSET(tp->t_lflag, EXTPROC))
1123 			SET(t->c_lflag, EXTPROC);
1124 		else
1125 			CLR(t->c_lflag, EXTPROC);
1126 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1127 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1128 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1129 			ttwakeup(tp);
1130 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1131 		splx(s);
1132 		break;
1133 	}
1134 	case TIOCSETD: {		/* set line discipline */
1135 		int t = *(int *)data;
1136 
1137 		if ((u_int)t >= nlinesw)
1138 			return (ENXIO);
1139 		if (t == tp->t_line)
1140 			return (0);
1141 		s = spltty();
1142 		ttyld_close(tp, flag);
1143 		tp->t_line = t;
1144 		/* XXX: we should use the correct cdev here */
1145 		error = ttyld_open(tp, tp->t_dev);
1146 		if (error) {
1147 			/*
1148 			 * If we fail to switch line discipline we cannot
1149 			 * fall back to the previous, because we can not
1150 			 * trust that ldisc to open successfully either.
1151 			 * Fall back to the default ldisc which we know
1152 			 * will allways succeed.
1153 			 */
1154 			tp->t_line = TTYDISC;
1155 			(void)ttyld_open(tp, tp->t_dev);
1156 		}
1157 		splx(s);
1158 		return (error);
1159 		break;
1160 	}
1161 	case TIOCSTART:			/* start output, like ^Q */
1162 		s = spltty();
1163 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1164 		    ISSET(tp->t_lflag, FLUSHO)) {
1165 			CLR(tp->t_lflag, FLUSHO);
1166 			CLR(tp->t_state, TS_TTSTOP);
1167 			ttstart(tp);
1168 		}
1169 		splx(s);
1170 		break;
1171 	case TIOCSTI:			/* simulate terminal input */
1172 		if ((flag & FREAD) == 0 && suser(td))
1173 			return (EPERM);
1174 		if (!isctty(p, tp) && suser(td))
1175 			return (EACCES);
1176 		s = spltty();
1177 		ttyld_rint(tp, *(u_char *)data);
1178 		splx(s);
1179 		break;
1180 	case TIOCSTOP:			/* stop output, like ^S */
1181 		s = spltty();
1182 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1183 			SET(tp->t_state, TS_TTSTOP);
1184 			(*tp->t_stop)(tp, 0);
1185 		}
1186 		splx(s);
1187 		break;
1188 	case TIOCSCTTY:			/* become controlling tty */
1189 		/* Session ctty vnode pointer set in vnode layer. */
1190 		sx_slock(&proctree_lock);
1191 		if (!SESS_LEADER(p) ||
1192 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1193 		     (tp->t_session != p->p_session))) {
1194 			sx_sunlock(&proctree_lock);
1195 			return (EPERM);
1196 		}
1197 		tp->t_session = p->p_session;
1198 		tp->t_pgrp = p->p_pgrp;
1199 		SESS_LOCK(p->p_session);
1200 		ttyref(tp);		/* ttyrel(): kern_proc.c:pgdelete() */
1201 		p->p_session->s_ttyp = tp;
1202 		SESS_UNLOCK(p->p_session);
1203 		PROC_LOCK(p);
1204 		p->p_flag |= P_CONTROLT;
1205 		PROC_UNLOCK(p);
1206 		sx_sunlock(&proctree_lock);
1207 		break;
1208 	case TIOCSPGRP: {		/* set pgrp of tty */
1209 		sx_slock(&proctree_lock);
1210 		pgrp = pgfind(*(int *)data);
1211 		if (!isctty(p, tp)) {
1212 			if (pgrp != NULL)
1213 				PGRP_UNLOCK(pgrp);
1214 			sx_sunlock(&proctree_lock);
1215 			return (ENOTTY);
1216 		}
1217 		if (pgrp == NULL) {
1218 			sx_sunlock(&proctree_lock);
1219 			return (EPERM);
1220 		}
1221 		PGRP_UNLOCK(pgrp);
1222 		if (pgrp->pg_session != p->p_session) {
1223 			sx_sunlock(&proctree_lock);
1224 			return (EPERM);
1225 		}
1226 		sx_sunlock(&proctree_lock);
1227 		tp->t_pgrp = pgrp;
1228 		break;
1229 	}
1230 	case TIOCSTAT:			/* simulate control-T */
1231 		s = spltty();
1232 		ttyinfo(tp);
1233 		splx(s);
1234 		break;
1235 	case TIOCSWINSZ:		/* set window size */
1236 		if (bcmp((caddr_t)&tp->t_winsize, data,
1237 		    sizeof (struct winsize))) {
1238 			tp->t_winsize = *(struct winsize *)data;
1239 			if (tp->t_pgrp != NULL) {
1240 				PGRP_LOCK(tp->t_pgrp);
1241 				pgsignal(tp->t_pgrp, SIGWINCH, 1);
1242 				PGRP_UNLOCK(tp->t_pgrp);
1243 			}
1244 		}
1245 		break;
1246 	case TIOCSDRAINWAIT:
1247 		error = suser(td);
1248 		if (error)
1249 			return (error);
1250 		tp->t_timeout = *(int *)data * hz;
1251 		wakeup(TSA_OCOMPLETE(tp));
1252 		wakeup(TSA_OLOWAT(tp));
1253 		break;
1254 	case TIOCGDRAINWAIT:
1255 		*(int *)data = tp->t_timeout / hz;
1256 		break;
1257 	default:
1258 #if defined(COMPAT_43)
1259 #ifndef BURN_BRIDGES
1260 		return (ttcompat(tp, cmd, data, flag));
1261 #else
1262 		return (ENOIOCTL);
1263 #endif
1264 #else
1265 		return (ENOIOCTL);
1266 #endif
1267 	}
1268 	return (0);
1269 }
1270 
1271 int
1272 ttypoll(struct cdev *dev, int events, struct thread *td)
1273 {
1274 	int s;
1275 	int revents = 0;
1276 	struct tty *tp;
1277 
1278 	tp = tty_gettp(dev);
1279 
1280 	if (tp == NULL)	/* XXX used to return ENXIO, but that means true! */
1281 		return ((events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM))
1282 			| POLLHUP);
1283 
1284 	s = spltty();
1285 	if (events & (POLLIN | POLLRDNORM)) {
1286 		if (ISSET(tp->t_state, TS_ZOMBIE))
1287 			revents |= (events & (POLLIN | POLLRDNORM)) |
1288 			    POLLHUP;
1289 		else if (ttnread(tp) > 0)
1290 			revents |= events & (POLLIN | POLLRDNORM);
1291 		else
1292 			selrecord(td, &tp->t_rsel);
1293 	}
1294 	if (events & POLLOUT) {
1295 		if (ISSET(tp->t_state, TS_ZOMBIE))
1296 			revents |= POLLHUP;
1297 		else if (tp->t_outq.c_cc <= tp->t_olowat &&
1298 		    ISSET(tp->t_state, TS_CONNECTED))
1299 			revents |= events & POLLOUT;
1300 		else
1301 			selrecord(td, &tp->t_wsel);
1302 	}
1303 	splx(s);
1304 	return (revents);
1305 }
1306 
1307 static struct filterops ttyread_filtops =
1308 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1309 static struct filterops ttywrite_filtops =
1310 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1311 
1312 int
1313 ttykqfilter(struct cdev *dev, struct knote *kn)
1314 {
1315 	struct tty *tp;
1316 	struct knlist *klist;
1317 	int s;
1318 
1319 	tp = tty_gettp(dev);
1320 
1321 	switch (kn->kn_filter) {
1322 	case EVFILT_READ:
1323 		klist = &tp->t_rsel.si_note;
1324 		kn->kn_fop = &ttyread_filtops;
1325 		break;
1326 	case EVFILT_WRITE:
1327 		klist = &tp->t_wsel.si_note;
1328 		kn->kn_fop = &ttywrite_filtops;
1329 		break;
1330 	default:
1331 		return (EINVAL);
1332 	}
1333 
1334 	kn->kn_hook = (caddr_t)dev;
1335 
1336 	s = spltty();
1337 	knlist_add(klist, kn, 0);
1338 	splx(s);
1339 
1340 	return (0);
1341 }
1342 
1343 static void
1344 filt_ttyrdetach(struct knote *kn)
1345 {
1346 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1347 	int s = spltty();
1348 
1349 	knlist_remove(&tp->t_rsel.si_note, kn, 0);
1350 	splx(s);
1351 }
1352 
1353 static int
1354 filt_ttyread(struct knote *kn, long hint)
1355 {
1356 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1357 
1358 	kn->kn_data = ttnread(tp);
1359 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1360 		kn->kn_flags |= EV_EOF;
1361 		return (1);
1362 	}
1363 	return (kn->kn_data > 0);
1364 }
1365 
1366 static void
1367 filt_ttywdetach(struct knote *kn)
1368 {
1369 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1370 	int s = spltty();
1371 
1372 	knlist_remove(&tp->t_wsel.si_note, kn, 0);
1373 	splx(s);
1374 }
1375 
1376 static int
1377 filt_ttywrite(struct knote *kn, long hint)
1378 {
1379 	struct tty *tp = ((struct cdev *)kn->kn_hook)->si_tty;
1380 
1381 	kn->kn_data = tp->t_outq.c_cc;
1382 	if (ISSET(tp->t_state, TS_ZOMBIE))
1383 		return (1);
1384 	return (kn->kn_data <= tp->t_olowat &&
1385 	    ISSET(tp->t_state, TS_CONNECTED));
1386 }
1387 
1388 /*
1389  * Must be called at spltty().
1390  */
1391 static int
1392 ttnread(struct tty *tp)
1393 {
1394 	int nread;
1395 
1396 	if (ISSET(tp->t_lflag, PENDIN))
1397 		ttypend(tp);
1398 	nread = tp->t_canq.c_cc;
1399 	if (!ISSET(tp->t_lflag, ICANON)) {
1400 		nread += tp->t_rawq.c_cc;
1401 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1402 			nread = 0;
1403 	}
1404 	return (nread);
1405 }
1406 
1407 /*
1408  * Wait for output to drain.
1409  */
1410 int
1411 ttywait(struct tty *tp)
1412 {
1413 	int error, s;
1414 
1415 	error = 0;
1416 	s = spltty();
1417 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1418 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1419 		(*tp->t_oproc)(tp);
1420 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1421 		    ISSET(tp->t_state, TS_CONNECTED)) {
1422 			SET(tp->t_state, TS_SO_OCOMPLETE);
1423 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1424 					 TTOPRI | PCATCH, "ttywai",
1425 					 tp->t_timeout);
1426 			if (error) {
1427 				if (error == EWOULDBLOCK)
1428 					error = EIO;
1429 				break;
1430 			}
1431 		} else
1432 			break;
1433 	}
1434 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1435 		error = EIO;
1436 	splx(s);
1437 	return (error);
1438 }
1439 
1440 /*
1441  * Flush if successfully wait.
1442  */
1443 static int
1444 ttywflush(struct tty *tp)
1445 {
1446 	int error;
1447 
1448 	if ((error = ttywait(tp)) == 0)
1449 		ttyflush(tp, FREAD);
1450 	return (error);
1451 }
1452 
1453 /*
1454  * Flush tty read and/or write queues, notifying anyone waiting.
1455  */
1456 void
1457 ttyflush(struct tty *tp, int rw)
1458 {
1459 	int s;
1460 
1461 	s = spltty();
1462 #if 0
1463 again:
1464 #endif
1465 	if (rw & FWRITE) {
1466 		FLUSHQ(&tp->t_outq);
1467 		CLR(tp->t_state, TS_TTSTOP);
1468 	}
1469 	(*tp->t_stop)(tp, rw);
1470 	if (rw & FREAD) {
1471 		FLUSHQ(&tp->t_canq);
1472 		FLUSHQ(&tp->t_rawq);
1473 		CLR(tp->t_lflag, PENDIN);
1474 		tp->t_rocount = 0;
1475 		tp->t_rocol = 0;
1476 		CLR(tp->t_state, TS_LOCAL);
1477 		ttwakeup(tp);
1478 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1479 			if (rw & FWRITE)
1480 				FLUSHQ(&tp->t_outq);
1481 			ttyunblock(tp);
1482 
1483 			/*
1484 			 * Don't let leave any state that might clobber the
1485 			 * next line discipline (although we should do more
1486 			 * to send the START char).  Not clearing the state
1487 			 * may have caused the "putc to a clist with no
1488 			 * reserved cblocks" panic/printf.
1489 			 */
1490 			CLR(tp->t_state, TS_TBLOCK);
1491 
1492 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1493 			if (ISSET(tp->t_iflag, IXOFF)) {
1494 				/*
1495 				 * XXX wait a bit in the hope that the stop
1496 				 * character (if any) will go out.  Waiting
1497 				 * isn't good since it allows races.  This
1498 				 * will be fixed when the stop character is
1499 				 * put in a special queue.  Don't bother with
1500 				 * the checks in ttywait() since the timeout
1501 				 * will save us.
1502 				 */
1503 				SET(tp->t_state, TS_SO_OCOMPLETE);
1504 				ttysleep(tp, TSA_OCOMPLETE(tp), TTOPRI,
1505 					 "ttyfls", hz / 10);
1506 				/*
1507 				 * Don't try sending the stop character again.
1508 				 */
1509 				CLR(tp->t_state, TS_TBLOCK);
1510 				goto again;
1511 			}
1512 #endif
1513 		}
1514 	}
1515 	if (rw & FWRITE) {
1516 		FLUSHQ(&tp->t_outq);
1517 		ttwwakeup(tp);
1518 	}
1519 	splx(s);
1520 }
1521 
1522 /*
1523  * Copy in the default termios characters.
1524  */
1525 void
1526 termioschars(struct termios *t)
1527 {
1528 
1529 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1530 }
1531 
1532 /*
1533  * Old interface.
1534  */
1535 void
1536 ttychars(struct tty *tp)
1537 {
1538 
1539 	termioschars(&tp->t_termios);
1540 }
1541 
1542 /*
1543  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1544  * on our input flow control bit and propagate the changes to the driver.
1545  * XXX the stop character should be put in a special high priority queue.
1546  */
1547 void
1548 ttyblock(struct tty *tp)
1549 {
1550 
1551 	SET(tp->t_state, TS_TBLOCK);
1552 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1553 	    putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1554 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1555 	ttstart(tp);
1556 }
1557 
1558 /*
1559  * Handle input low water.  Send start character for the IXOFF case.  Turn
1560  * off our input flow control bit and propagate the changes to the driver.
1561  * XXX the start character should be put in a special high priority queue.
1562  */
1563 static void
1564 ttyunblock(struct tty *tp)
1565 {
1566 
1567 	CLR(tp->t_state, TS_TBLOCK);
1568 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1569 	    putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1570 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1571 	ttstart(tp);
1572 }
1573 
1574 #ifdef notyet
1575 /* Not used by any current (i386) drivers. */
1576 /*
1577  * Restart after an inter-char delay.
1578  */
1579 void
1580 ttrstrt(void *tp_arg)
1581 {
1582 	struct tty *tp;
1583 	int s;
1584 
1585 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1586 
1587 	tp = tp_arg;
1588 	s = spltty();
1589 
1590 	CLR(tp->t_state, TS_TIMEOUT);
1591 	ttstart(tp);
1592 
1593 	splx(s);
1594 }
1595 #endif
1596 
1597 int
1598 ttstart(struct tty *tp)
1599 {
1600 
1601 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1602 		(*tp->t_oproc)(tp);
1603 	return (0);
1604 }
1605 
1606 /*
1607  * "close" a line discipline
1608  */
1609 int
1610 ttylclose(struct tty *tp, int flag)
1611 {
1612 
1613 	if (flag & FNONBLOCK || ttywflush(tp))
1614 		ttyflush(tp, FREAD | FWRITE);
1615 	return (0);
1616 }
1617 
1618 /*
1619  * Handle modem control transition on a tty.
1620  * Flag indicates new state of carrier.
1621  * Returns 0 if the line should be turned off, otherwise 1.
1622  */
1623 int
1624 ttymodem(struct tty *tp, int flag)
1625 {
1626 
1627 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1628 		/*
1629 		 * MDMBUF: do flow control according to carrier flag
1630 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1631 		 * works if IXON and IXANY are clear.
1632 		 */
1633 		if (flag) {
1634 			CLR(tp->t_state, TS_CAR_OFLOW);
1635 			CLR(tp->t_state, TS_TTSTOP);
1636 			ttstart(tp);
1637 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1638 			SET(tp->t_state, TS_CAR_OFLOW);
1639 			SET(tp->t_state, TS_TTSTOP);
1640 			(*tp->t_stop)(tp, 0);
1641 		}
1642 	} else if (flag == 0) {
1643 		/*
1644 		 * Lost carrier.
1645 		 */
1646 		CLR(tp->t_state, TS_CARR_ON);
1647 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1648 		    !ISSET(tp->t_cflag, CLOCAL)) {
1649 			SET(tp->t_state, TS_ZOMBIE);
1650 			CLR(tp->t_state, TS_CONNECTED);
1651 			if (tp->t_session) {
1652 				sx_slock(&proctree_lock);
1653 				if (tp->t_session->s_leader) {
1654 					struct proc *p;
1655 
1656 					p = tp->t_session->s_leader;
1657 					PROC_LOCK(p);
1658 					psignal(p, SIGHUP);
1659 					PROC_UNLOCK(p);
1660 				}
1661 				sx_sunlock(&proctree_lock);
1662 			}
1663 			ttyflush(tp, FREAD | FWRITE);
1664 			return (0);
1665 		}
1666 	} else {
1667 		/*
1668 		 * Carrier now on.
1669 		 */
1670 		SET(tp->t_state, TS_CARR_ON);
1671 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1672 			SET(tp->t_state, TS_CONNECTED);
1673 		wakeup(TSA_CARR_ON(tp));
1674 		ttwakeup(tp);
1675 		ttwwakeup(tp);
1676 	}
1677 	return (1);
1678 }
1679 
1680 /*
1681  * Reinput pending characters after state switch
1682  * call at spltty().
1683  */
1684 static void
1685 ttypend(struct tty *tp)
1686 {
1687 	struct clist tq;
1688 	int c;
1689 
1690 	CLR(tp->t_lflag, PENDIN);
1691 	SET(tp->t_state, TS_TYPEN);
1692 	/*
1693 	 * XXX this assumes too much about clist internals.  It may even
1694 	 * fail if the cblock slush pool is empty.  We can't allocate more
1695 	 * cblocks here because we are called from an interrupt handler
1696 	 * and clist_alloc_cblocks() can wait.
1697 	 */
1698 	tq = tp->t_rawq;
1699 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1700 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1701 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1702 	while ((c = getc(&tq)) >= 0)
1703 		ttyinput(c, tp);
1704 	CLR(tp->t_state, TS_TYPEN);
1705 }
1706 
1707 /*
1708  * Process a read call on a tty device.
1709  */
1710 int
1711 ttread(struct tty *tp, struct uio *uio, int flag)
1712 {
1713 	struct clist *qp;
1714 	int c;
1715 	tcflag_t lflag;
1716 	cc_t *cc = tp->t_cc;
1717 	struct thread *td;
1718 	struct proc *p;
1719 	int s, first, error = 0;
1720 	int has_stime = 0, last_cc = 0;
1721 	long slp = 0;		/* XXX this should be renamed `timo'. */
1722 	struct timeval stime;
1723 	struct pgrp *pg;
1724 
1725 	td = curthread;
1726 	p = td->td_proc;
1727 loop:
1728 	s = spltty();
1729 	lflag = tp->t_lflag;
1730 	/*
1731 	 * take pending input first
1732 	 */
1733 	if (ISSET(lflag, PENDIN)) {
1734 		ttypend(tp);
1735 		splx(s);	/* reduce latency */
1736 		s = spltty();
1737 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1738 	}
1739 
1740 	/*
1741 	 * Hang process if it's in the background.
1742 	 */
1743 	if (isbackground(p, tp)) {
1744 		splx(s);
1745 		sx_slock(&proctree_lock);
1746 		PROC_LOCK(p);
1747 		if (SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTIN) ||
1748 		    SIGISMEMBER(td->td_sigmask, SIGTTIN) ||
1749 		    (p->p_flag & P_PPWAIT) || p->p_pgrp->pg_jobc == 0) {
1750 			PROC_UNLOCK(p);
1751 			sx_sunlock(&proctree_lock);
1752 			return (EIO);
1753 		}
1754 		pg = p->p_pgrp;
1755 		PROC_UNLOCK(p);
1756 		PGRP_LOCK(pg);
1757 		sx_sunlock(&proctree_lock);
1758 		pgsignal(pg, SIGTTIN, 1);
1759 		PGRP_UNLOCK(pg);
1760 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg2", 0);
1761 		if (error)
1762 			return (error);
1763 		goto loop;
1764 	}
1765 
1766 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1767 		splx(s);
1768 		return (0);	/* EOF */
1769 	}
1770 
1771 	/*
1772 	 * If canonical, use the canonical queue,
1773 	 * else use the raw queue.
1774 	 *
1775 	 * (should get rid of clists...)
1776 	 */
1777 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1778 
1779 	if (flag & IO_NDELAY) {
1780 		if (qp->c_cc > 0)
1781 			goto read;
1782 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1783 			splx(s);
1784 			return (0);
1785 		}
1786 		splx(s);
1787 		return (EWOULDBLOCK);
1788 	}
1789 	if (!ISSET(lflag, ICANON)) {
1790 		int m = cc[VMIN];
1791 		long t = cc[VTIME];
1792 		struct timeval timecopy;
1793 
1794 		/*
1795 		 * Check each of the four combinations.
1796 		 * (m > 0 && t == 0) is the normal read case.
1797 		 * It should be fairly efficient, so we check that and its
1798 		 * companion case (m == 0 && t == 0) first.
1799 		 * For the other two cases, we compute the target sleep time
1800 		 * into slp.
1801 		 */
1802 		if (t == 0) {
1803 			if (qp->c_cc < m)
1804 				goto sleep;
1805 			if (qp->c_cc > 0)
1806 				goto read;
1807 
1808 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1809 			splx(s);
1810 			return (0);
1811 		}
1812 		t *= 100000;		/* time in us */
1813 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1814 			 ((t1).tv_usec - (t2).tv_usec))
1815 		if (m > 0) {
1816 			if (qp->c_cc <= 0)
1817 				goto sleep;
1818 			if (qp->c_cc >= m)
1819 				goto read;
1820 			getmicrotime(&timecopy);
1821 			if (!has_stime) {
1822 				/* first character, start timer */
1823 				has_stime = 1;
1824 				stime = timecopy;
1825 				slp = t;
1826 			} else if (qp->c_cc > last_cc) {
1827 				/* got a character, restart timer */
1828 				stime = timecopy;
1829 				slp = t;
1830 			} else {
1831 				/* nothing, check expiration */
1832 				slp = t - diff(timecopy, stime);
1833 				if (slp <= 0)
1834 					goto read;
1835 			}
1836 			last_cc = qp->c_cc;
1837 		} else {	/* m == 0 */
1838 			if (qp->c_cc > 0)
1839 				goto read;
1840 			getmicrotime(&timecopy);
1841 			if (!has_stime) {
1842 				has_stime = 1;
1843 				stime = timecopy;
1844 				slp = t;
1845 			} else {
1846 				slp = t - diff(timecopy, stime);
1847 				if (slp <= 0) {
1848 					/* Timed out, but 0 is enough input. */
1849 					splx(s);
1850 					return (0);
1851 				}
1852 			}
1853 		}
1854 #undef diff
1855 		if (slp != 0) {
1856 			struct timeval tv;	/* XXX style bug. */
1857 
1858 			tv.tv_sec = slp / 1000000;
1859 			tv.tv_usec = slp % 1000000;
1860 			slp = tvtohz(&tv);
1861 			/*
1862 			 * XXX bad variable names.  slp was the timeout in
1863 			 * usec.  Now it is the timeout in ticks.
1864 			 */
1865 		}
1866 		goto sleep;
1867 	}
1868 	if (qp->c_cc <= 0) {
1869 sleep:
1870 		/*
1871 		 * There is no input, or not enough input and we can block.
1872 		 */
1873 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), TTIPRI | PCATCH,
1874 				 ISSET(tp->t_state, TS_CONNECTED) ?
1875 				 "ttyin" : "ttyhup", (int)slp);
1876 		splx(s);
1877 		if (error == EWOULDBLOCK)
1878 			error = 0;
1879 		else if (error)
1880 			return (error);
1881 		/*
1882 		 * XXX what happens if another process eats some input
1883 		 * while we are asleep (not just here)?  It would be
1884 		 * safest to detect changes and reset our state variables
1885 		 * (has_stime and last_cc).
1886 		 */
1887 		slp = 0;
1888 		goto loop;
1889 	}
1890 read:
1891 	splx(s);
1892 	/*
1893 	 * Input present, check for input mapping and processing.
1894 	 */
1895 	first = 1;
1896 	if (ISSET(lflag, ICANON | ISIG))
1897 		goto slowcase;
1898 	for (;;) {
1899 		char ibuf[IBUFSIZ];
1900 		int icc;
1901 
1902 		icc = imin(uio->uio_resid, IBUFSIZ);
1903 		icc = q_to_b(qp, ibuf, icc);
1904 		if (icc <= 0) {
1905 			if (first)
1906 				goto loop;
1907 			break;
1908 		}
1909 		error = uiomove(ibuf, icc, uio);
1910 		/*
1911 		 * XXX if there was an error then we should ungetc() the
1912 		 * unmoved chars and reduce icc here.
1913 		 */
1914 		if (error)
1915 			break;
1916 		if (uio->uio_resid == 0)
1917 			break;
1918 		first = 0;
1919 	}
1920 	goto out;
1921 slowcase:
1922 	for (;;) {
1923 		c = getc(qp);
1924 		if (c < 0) {
1925 			if (first)
1926 				goto loop;
1927 			break;
1928 		}
1929 		/*
1930 		 * delayed suspend (^Y)
1931 		 */
1932 		if (CCEQ(cc[VDSUSP], c) &&
1933 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1934 			if (tp->t_pgrp != NULL) {
1935 				PGRP_LOCK(tp->t_pgrp);
1936 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
1937 				PGRP_UNLOCK(tp->t_pgrp);
1938 			}
1939 			if (first) {
1940 				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
1941 						 "ttybg3", 0);
1942 				if (error)
1943 					break;
1944 				goto loop;
1945 			}
1946 			break;
1947 		}
1948 		/*
1949 		 * Interpret EOF only in canonical mode.
1950 		 */
1951 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1952 			break;
1953 		/*
1954 		 * Give user character.
1955 		 */
1956 		error = ureadc(c, uio);
1957 		if (error)
1958 			/* XXX should ungetc(c, qp). */
1959 			break;
1960 		if (uio->uio_resid == 0)
1961 			break;
1962 		/*
1963 		 * In canonical mode check for a "break character"
1964 		 * marking the end of a "line of input".
1965 		 */
1966 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1967 			break;
1968 		first = 0;
1969 	}
1970 
1971 out:
1972 	/*
1973 	 * Look to unblock input now that (presumably)
1974 	 * the input queue has gone down.
1975 	 */
1976 	s = spltty();
1977 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1978 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1979 		ttyunblock(tp);
1980 	splx(s);
1981 
1982 	return (error);
1983 }
1984 
1985 /*
1986  * Check the output queue on tp for space for a kernel message (from uprintf
1987  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1988  * lose messages due to normal flow control, but don't let the tty run amok.
1989  * Sleeps here are not interruptible, but we return prematurely if new signals
1990  * arrive.
1991  */
1992 int
1993 ttycheckoutq(struct tty *tp, int wait)
1994 {
1995 	int hiwat, s;
1996 	sigset_t oldmask;
1997 	struct thread *td;
1998 	struct proc *p;
1999 
2000 	td = curthread;
2001 	p = td->td_proc;
2002 	hiwat = tp->t_ohiwat;
2003 	SIGEMPTYSET(oldmask);
2004 	s = spltty();
2005 	if (wait) {
2006 		PROC_LOCK(p);
2007 		oldmask = td->td_siglist;
2008 		PROC_UNLOCK(p);
2009 	}
2010 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100)
2011 		while (tp->t_outq.c_cc > hiwat) {
2012 			ttstart(tp);
2013 			if (tp->t_outq.c_cc <= hiwat)
2014 				break;
2015 			if (!wait) {
2016 				splx(s);
2017 				return (0);
2018 			}
2019 			PROC_LOCK(p);
2020 			if (!SIGSETEQ(td->td_siglist, oldmask)) {
2021 				PROC_UNLOCK(p);
2022 				splx(s);
2023 				return (0);
2024 			}
2025 			PROC_UNLOCK(p);
2026 			SET(tp->t_state, TS_SO_OLOWAT);
2027 			tsleep(TSA_OLOWAT(tp), PZERO - 1, "ttoutq", hz);
2028 		}
2029 	splx(s);
2030 	return (1);
2031 }
2032 
2033 /*
2034  * Process a write call on a tty device.
2035  */
2036 int
2037 ttwrite(struct tty *tp, struct uio *uio, int flag)
2038 {
2039 	char *cp = NULL;
2040 	int cc, ce;
2041 	struct thread *td;
2042 	struct proc *p;
2043 	int i, hiwat, cnt, error, s;
2044 	char obuf[OBUFSIZ];
2045 
2046 	hiwat = tp->t_ohiwat;
2047 	cnt = uio->uio_resid;
2048 	error = 0;
2049 	cc = 0;
2050 	td = curthread;
2051 	p = td->td_proc;
2052 loop:
2053 	s = spltty();
2054 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2055 		splx(s);
2056 		if (uio->uio_resid == cnt)
2057 			error = EIO;
2058 		goto out;
2059 	}
2060 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2061 		if (flag & IO_NDELAY) {
2062 			splx(s);
2063 			error = EWOULDBLOCK;
2064 			goto out;
2065 		}
2066 		error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
2067 				 "ttywdcd", 0);
2068 		splx(s);
2069 		if (error)
2070 			goto out;
2071 		goto loop;
2072 	}
2073 	splx(s);
2074 	/*
2075 	 * Hang the process if it's in the background.
2076 	 */
2077 	sx_slock(&proctree_lock);
2078 	PROC_LOCK(p);
2079 	if (isbackground(p, tp) &&
2080 	    ISSET(tp->t_lflag, TOSTOP) && !(p->p_flag & P_PPWAIT) &&
2081 	    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
2082 	    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
2083 		if (p->p_pgrp->pg_jobc == 0) {
2084 			PROC_UNLOCK(p);
2085 			sx_sunlock(&proctree_lock);
2086 			error = EIO;
2087 			goto out;
2088 		}
2089 		PROC_UNLOCK(p);
2090 		PGRP_LOCK(p->p_pgrp);
2091 		sx_sunlock(&proctree_lock);
2092 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2093 		PGRP_UNLOCK(p->p_pgrp);
2094 		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg4", 0);
2095 		if (error)
2096 			goto out;
2097 		goto loop;
2098 	} else {
2099 		PROC_UNLOCK(p);
2100 		sx_sunlock(&proctree_lock);
2101 	}
2102 	/*
2103 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2104 	 * output translation.  Keep track of high water mark, sleep on
2105 	 * overflow awaiting device aid in acquiring new space.
2106 	 */
2107 	while (uio->uio_resid > 0 || cc > 0) {
2108 		if (ISSET(tp->t_lflag, FLUSHO)) {
2109 			uio->uio_resid = 0;
2110 			return (0);
2111 		}
2112 		if (tp->t_outq.c_cc > hiwat)
2113 			goto ovhiwat;
2114 		/*
2115 		 * Grab a hunk of data from the user, unless we have some
2116 		 * leftover from last time.
2117 		 */
2118 		if (cc == 0) {
2119 			cc = imin(uio->uio_resid, OBUFSIZ);
2120 			cp = obuf;
2121 			error = uiomove(cp, cc, uio);
2122 			if (error) {
2123 				cc = 0;
2124 				break;
2125 			}
2126 		}
2127 		/*
2128 		 * If nothing fancy need be done, grab those characters we
2129 		 * can handle without any of ttyoutput's processing and
2130 		 * just transfer them to the output q.  For those chars
2131 		 * which require special processing (as indicated by the
2132 		 * bits in char_type), call ttyoutput.  After processing
2133 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2134 		 * immediately.
2135 		 */
2136 		while (cc > 0) {
2137 			if (!ISSET(tp->t_oflag, OPOST))
2138 				ce = cc;
2139 			else {
2140 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2141 						char_type, CCLASSMASK);
2142 				/*
2143 				 * If ce is zero, then we're processing
2144 				 * a special character through ttyoutput.
2145 				 */
2146 				if (ce == 0) {
2147 					tp->t_rocount = 0;
2148 					if (ttyoutput(*cp, tp) >= 0) {
2149 						/* No Clists, wait a bit. */
2150 						ttstart(tp);
2151 						if (flag & IO_NDELAY) {
2152 							error = EWOULDBLOCK;
2153 							goto out;
2154 						}
2155 						error = ttysleep(tp, &lbolt,
2156 								 TTOPRI|PCATCH,
2157 								 "ttybf1", 0);
2158 						if (error)
2159 							goto out;
2160 						goto loop;
2161 					}
2162 					cp++;
2163 					cc--;
2164 					if (ISSET(tp->t_lflag, FLUSHO) ||
2165 					    tp->t_outq.c_cc > hiwat)
2166 						goto ovhiwat;
2167 					continue;
2168 				}
2169 			}
2170 			/*
2171 			 * A bunch of normal characters have been found.
2172 			 * Transfer them en masse to the output queue and
2173 			 * continue processing at the top of the loop.
2174 			 * If there are any further characters in this
2175 			 * <= OBUFSIZ chunk, the first should be a character
2176 			 * requiring special handling by ttyoutput.
2177 			 */
2178 			tp->t_rocount = 0;
2179 			i = b_to_q(cp, ce, &tp->t_outq);
2180 			ce -= i;
2181 			tp->t_column += ce;
2182 			cp += ce, cc -= ce, tk_nout += ce;
2183 			tp->t_outcc += ce;
2184 			if (i > 0) {
2185 				/* No Clists, wait a bit. */
2186 				ttstart(tp);
2187 				if (flag & IO_NDELAY) {
2188 					error = EWOULDBLOCK;
2189 					goto out;
2190 				}
2191 				error = ttysleep(tp, &lbolt, TTOPRI | PCATCH,
2192 						 "ttybf2", 0);
2193 				if (error)
2194 					goto out;
2195 				goto loop;
2196 			}
2197 			if (ISSET(tp->t_lflag, FLUSHO) ||
2198 			    tp->t_outq.c_cc > hiwat)
2199 				break;
2200 		}
2201 		ttstart(tp);
2202 	}
2203 out:
2204 	/*
2205 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2206 	 * offset and iov pointers have moved forward, but it doesn't matter
2207 	 * (the call will either return short or restart with a new uio).
2208 	 */
2209 	uio->uio_resid += cc;
2210 	return (error);
2211 
2212 ovhiwat:
2213 	ttstart(tp);
2214 	s = spltty();
2215 	/*
2216 	 * This can only occur if FLUSHO is set in t_lflag,
2217 	 * or if ttstart/oproc is synchronous (or very fast).
2218 	 */
2219 	if (tp->t_outq.c_cc <= hiwat) {
2220 		splx(s);
2221 		goto loop;
2222 	}
2223 	if (flag & IO_NDELAY) {
2224 		splx(s);
2225 		uio->uio_resid += cc;
2226 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2227 	}
2228 	SET(tp->t_state, TS_SO_OLOWAT);
2229 	error = ttysleep(tp, TSA_OLOWAT(tp), TTOPRI | PCATCH, "ttywri",
2230 			 tp->t_timeout);
2231 	splx(s);
2232 	if (error == EWOULDBLOCK)
2233 		error = EIO;
2234 	if (error)
2235 		goto out;
2236 	goto loop;
2237 }
2238 
2239 /*
2240  * Rubout one character from the rawq of tp
2241  * as cleanly as possible.
2242  */
2243 static void
2244 ttyrub(int c, struct tty *tp)
2245 {
2246 	char *cp;
2247 	int savecol;
2248 	int tabc, s;
2249 
2250 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2251 		return;
2252 	CLR(tp->t_lflag, FLUSHO);
2253 	if (ISSET(tp->t_lflag, ECHOE)) {
2254 		if (tp->t_rocount == 0) {
2255 			/*
2256 			 * Screwed by ttwrite; retype
2257 			 */
2258 			ttyretype(tp);
2259 			return;
2260 		}
2261 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2262 			ttyrubo(tp, 2);
2263 		else {
2264 			CLR(c, ~TTY_CHARMASK);
2265 			switch (CCLASS(c)) {
2266 			case ORDINARY:
2267 				ttyrubo(tp, 1);
2268 				break;
2269 			case BACKSPACE:
2270 			case CONTROL:
2271 			case NEWLINE:
2272 			case RETURN:
2273 			case VTAB:
2274 				if (ISSET(tp->t_lflag, ECHOCTL))
2275 					ttyrubo(tp, 2);
2276 				break;
2277 			case TAB:
2278 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2279 					ttyretype(tp);
2280 					return;
2281 				}
2282 				s = spltty();
2283 				savecol = tp->t_column;
2284 				SET(tp->t_state, TS_CNTTB);
2285 				SET(tp->t_lflag, FLUSHO);
2286 				tp->t_column = tp->t_rocol;
2287 				cp = tp->t_rawq.c_cf;
2288 				if (cp)
2289 					tabc = *cp;	/* XXX FIX NEXTC */
2290 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2291 					ttyecho(tabc, tp);
2292 				CLR(tp->t_lflag, FLUSHO);
2293 				CLR(tp->t_state, TS_CNTTB);
2294 				splx(s);
2295 
2296 				/* savecol will now be length of the tab. */
2297 				savecol -= tp->t_column;
2298 				tp->t_column += savecol;
2299 				if (savecol > 8)
2300 					savecol = 8;	/* overflow screw */
2301 				while (--savecol >= 0)
2302 					(void)ttyoutput('\b', tp);
2303 				break;
2304 			default:			/* XXX */
2305 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2306 				(void)printf(PANICSTR, c, CCLASS(c));
2307 #ifdef notdef
2308 				panic(PANICSTR, c, CCLASS(c));
2309 #endif
2310 			}
2311 		}
2312 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2313 		if (!ISSET(tp->t_state, TS_ERASE)) {
2314 			SET(tp->t_state, TS_ERASE);
2315 			(void)ttyoutput('\\', tp);
2316 		}
2317 		ttyecho(c, tp);
2318 	} else {
2319 		ttyecho(tp->t_cc[VERASE], tp);
2320 		/*
2321 		 * This code may be executed not only when an ERASE key
2322 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2323 		 * So, I didn't think it was worthwhile to pass the extra
2324 		 * information (which would need an extra parameter,
2325 		 * changing every call) needed to distinguish the ERASE2
2326 		 * case from the ERASE.
2327 		 */
2328 	}
2329 	--tp->t_rocount;
2330 }
2331 
2332 /*
2333  * Back over cnt characters, erasing them.
2334  */
2335 static void
2336 ttyrubo(struct tty *tp, int cnt)
2337 {
2338 
2339 	while (cnt-- > 0) {
2340 		(void)ttyoutput('\b', tp);
2341 		(void)ttyoutput(' ', tp);
2342 		(void)ttyoutput('\b', tp);
2343 	}
2344 }
2345 
2346 /*
2347  * ttyretype --
2348  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2349  *	been checked.
2350  */
2351 static void
2352 ttyretype(struct tty *tp)
2353 {
2354 	char *cp;
2355 	int s, c;
2356 
2357 	/* Echo the reprint character. */
2358 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2359 		ttyecho(tp->t_cc[VREPRINT], tp);
2360 
2361 	(void)ttyoutput('\n', tp);
2362 
2363 	/*
2364 	 * XXX
2365 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2366 	 * BIT OF FIRST CHAR.
2367 	 */
2368 	s = spltty();
2369 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2370 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2371 		ttyecho(c, tp);
2372 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2373 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2374 		ttyecho(c, tp);
2375 	CLR(tp->t_state, TS_ERASE);
2376 	splx(s);
2377 
2378 	tp->t_rocount = tp->t_rawq.c_cc;
2379 	tp->t_rocol = 0;
2380 }
2381 
2382 /*
2383  * Echo a typed character to the terminal.
2384  */
2385 static void
2386 ttyecho(int c, struct tty *tp)
2387 {
2388 
2389 	if (!ISSET(tp->t_state, TS_CNTTB))
2390 		CLR(tp->t_lflag, FLUSHO);
2391 	if ((!ISSET(tp->t_lflag, ECHO) &&
2392 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2393 	    ISSET(tp->t_lflag, EXTPROC))
2394 		return;
2395 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2396 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2397 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2398 		(void)ttyoutput('^', tp);
2399 		CLR(c, ~TTY_CHARMASK);
2400 		if (c == 0177)
2401 			c = '?';
2402 		else
2403 			c += 'A' - 1;
2404 	}
2405 	(void)ttyoutput(c, tp);
2406 }
2407 
2408 /*
2409  * Wake up any readers on a tty.
2410  */
2411 void
2412 ttwakeup(struct tty *tp)
2413 {
2414 
2415 	if (SEL_WAITING(&tp->t_rsel))
2416 		selwakeuppri(&tp->t_rsel, TTIPRI);
2417 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2418 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2419 	wakeup(TSA_HUP_OR_INPUT(tp));
2420 	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
2421 }
2422 
2423 /*
2424  * Wake up any writers on a tty.
2425  */
2426 void
2427 ttwwakeup(struct tty *tp)
2428 {
2429 
2430 	if (SEL_WAITING(&tp->t_wsel) && tp->t_outq.c_cc <= tp->t_olowat)
2431 		selwakeuppri(&tp->t_wsel, TTOPRI);
2432 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2433 		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2434 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2435 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2436 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2437 		wakeup(TSA_OCOMPLETE(tp));
2438 	}
2439 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2440 	    tp->t_outq.c_cc <= tp->t_olowat) {
2441 		CLR(tp->t_state, TS_SO_OLOWAT);
2442 		wakeup(TSA_OLOWAT(tp));
2443 	}
2444 	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
2445 }
2446 
2447 /*
2448  * Look up a code for a specified speed in a conversion table;
2449  * used by drivers to map software speed values to hardware parameters.
2450  */
2451 int
2452 ttspeedtab(int speed, struct speedtab *table)
2453 {
2454 
2455 	for ( ; table->sp_speed != -1; table++)
2456 		if (table->sp_speed == speed)
2457 			return (table->sp_code);
2458 	return (-1);
2459 }
2460 
2461 /*
2462  * Set input and output watermarks and buffer sizes.  For input, the
2463  * high watermark is about one second's worth of input above empty, the
2464  * low watermark is slightly below high water, and the buffer size is a
2465  * driver-dependent amount above high water.  For output, the watermarks
2466  * are near the ends of the buffer, with about 1 second's worth of input
2467  * between them.  All this only applies to the standard line discipline.
2468  */
2469 void
2470 ttsetwater(struct tty *tp)
2471 {
2472 	int cps, ttmaxhiwat, x;
2473 
2474 	/* Input. */
2475 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2476 	switch (tp->t_ispeedwat) {
2477 	case (speed_t)-1:
2478 		cps = tp->t_ispeed / 10;
2479 		break;
2480 	case 0:
2481 		/*
2482 		 * This case is for old drivers that don't know about
2483 		 * t_ispeedwat.  Arrange for them to get the old buffer
2484 		 * sizes and watermarks.
2485 		 */
2486 		cps = TTYHOG - 2 * 256;
2487 		tp->t_ififosize = 2 * 256;
2488 		break;
2489 	default:
2490 		cps = tp->t_ispeedwat / 10;
2491 		break;
2492 	}
2493 	tp->t_ihiwat = cps;
2494 	tp->t_ilowat = 7 * cps / 8;
2495 	x = cps + tp->t_ififosize;
2496 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2497 
2498 	/* Output. */
2499 	switch (tp->t_ospeedwat) {
2500 	case (speed_t)-1:
2501 		cps = tp->t_ospeed / 10;
2502 		ttmaxhiwat = 2 * TTMAXHIWAT;
2503 		break;
2504 	case 0:
2505 		cps = tp->t_ospeed / 10;
2506 		ttmaxhiwat = TTMAXHIWAT;
2507 		break;
2508 	default:
2509 		cps = tp->t_ospeedwat / 10;
2510 		ttmaxhiwat = 8 * TTMAXHIWAT;
2511 		break;
2512 	}
2513 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2514 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2515 	x += cps;
2516 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2517 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2518 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2519 	x += OBUFSIZ + 100;
2520 	clist_alloc_cblocks(&tp->t_outq, x, x);
2521 #undef	CLAMP
2522 }
2523 
2524 /*
2525  * Report on state of foreground process group.
2526  */
2527 void
2528 ttyinfo(struct tty *tp)
2529 {
2530 	struct timeval utime, stime;
2531 	struct proc *p, *pick;
2532 	struct thread *td;
2533 	const char *stateprefix, *state;
2534 	long rss;
2535 	int load, pctcpu;
2536 
2537 	if (ttycheckoutq(tp,0) == 0)
2538 		return;
2539 
2540 	/* Print load average. */
2541 	load = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2542 	ttyprintf(tp, "load: %d.%02d ", load / 100, load % 100);
2543 
2544 	/*
2545 	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
2546 	 * that pending input will be retyped on BS.
2547 	 */
2548 	if (tp->t_session == NULL) {
2549 		ttyprintf(tp, "not a controlling terminal\n");
2550 		tp->t_rocount = 0;
2551 		return;
2552 	}
2553 	if (tp->t_pgrp == NULL) {
2554 		ttyprintf(tp, "no foreground process group\n");
2555 		tp->t_rocount = 0;
2556 		return;
2557 	}
2558 	sx_slock(&proctree_lock);
2559 	if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL) {
2560 		sx_sunlock(&proctree_lock);
2561 		ttyprintf(tp, "empty foreground process group\n");
2562 		tp->t_rocount = 0;
2563 		return;
2564 	}
2565 
2566 	/*
2567 	 * Pick the most interesting process and copy some of its
2568 	 * state for printing later.  sched_lock must be held for
2569 	 * most parts of this.  Holding it throughout is simplest
2570 	 * and prevents even unimportant inconsistencies in the
2571 	 * copy of the state, but may increase interrupt latency
2572 	 * too much.
2573 	 */
2574 	mtx_lock_spin(&sched_lock);
2575 	for (pick = NULL; p != NULL; p = LIST_NEXT(p, p_pglist))
2576 		if (proc_compare(pick, p))
2577 			pick = p;
2578 
2579 	td = FIRST_THREAD_IN_PROC(pick);	/* XXXKSE */
2580 #if 0
2581 	KASSERT(td != NULL, ("ttyinfo: no thread"));
2582 #else
2583 	if (td == NULL) {
2584 		mtx_unlock_spin(&sched_lock);
2585 		sx_sunlock(&proctree_lock);
2586 		ttyprintf(tp, "foreground process without thread\n");
2587 		tp->t_rocount = 0;
2588 		return;
2589 	}
2590 #endif
2591 	stateprefix = "";
2592 	if (TD_IS_RUNNING(td))
2593 		state = "running";
2594 	else if (TD_ON_RUNQ(td) || TD_CAN_RUN(td))
2595 		state = "runnable";
2596 	else if (TD_IS_SLEEPING(td)) {
2597 		/* XXX: If we're sleeping, are we ever not in a queue? */
2598 		if (TD_ON_SLEEPQ(td))
2599 			state = td->td_wmesg;
2600 		else
2601 			state = "sleeping without queue";
2602 	} else if (TD_ON_LOCK(td)) {
2603 		state = td->td_lockname;
2604 		stateprefix = "*";
2605 	} else if (TD_IS_SUSPENDED(td))
2606 		state = "suspended";
2607 	else if (TD_AWAITING_INTR(td))
2608 		state = "intrwait";
2609 	else
2610 		state = "unknown";
2611 	pctcpu = (sched_pctcpu(td) * 10000 + FSCALE / 2) >> FSHIFT;
2612 	if (pick->p_state == PRS_NEW || pick->p_state == PRS_ZOMBIE)
2613 		rss = 0;
2614 	else
2615 		rss = pgtok(vmspace_resident_count(pick->p_vmspace));
2616 	mtx_unlock_spin(&sched_lock);
2617 	PROC_LOCK(pick);
2618 	calcru(pick, &utime, &stime);
2619 	PROC_UNLOCK(pick);
2620 
2621 	/* Print command, pid, state, utime, stime, %cpu, and rss. */
2622 	ttyprintf(tp,
2623 	    " cmd: %s %d [%s%s] %ld.%02ldu %ld.%02lds %d%% %ldk\n",
2624 	    pick->p_comm, pick->p_pid, stateprefix, state,
2625 	    (long)utime.tv_sec, utime.tv_usec / 10000,
2626 	    (long)stime.tv_sec, stime.tv_usec / 10000,
2627 	    pctcpu / 100, rss);
2628 	tp->t_rocount = 0;
2629 	sx_sunlock(&proctree_lock);
2630 }
2631 
2632 /*
2633  * Returns 1 if p2 is "better" than p1
2634  *
2635  * The algorithm for picking the "interesting" process is thus:
2636  *
2637  *	1) Only foreground processes are eligible - implied.
2638  *	2) Runnable processes are favored over anything else.  The runner
2639  *	   with the highest cpu utilization is picked (p_estcpu).  Ties are
2640  *	   broken by picking the highest pid.
2641  *	3) The sleeper with the shortest sleep time is next.  With ties,
2642  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2643  *	4) Further ties are broken by picking the highest pid.
2644  */
2645 #define ISRUN(p, val)						\
2646 do {								\
2647 	struct thread *td;					\
2648 	val = 0;						\
2649 	FOREACH_THREAD_IN_PROC(p, td) {				\
2650 		if (TD_ON_RUNQ(td) ||				\
2651 		    TD_IS_RUNNING(td)) {			\
2652 			val = 1;				\
2653 			break;					\
2654 		}						\
2655 	}							\
2656 } while (0)
2657 
2658 #define TESTAB(a, b)    ((a)<<1 | (b))
2659 #define ONLYA   2
2660 #define ONLYB   1
2661 #define BOTH    3
2662 
2663 static int
2664 proc_compare(struct proc *p1, struct proc *p2)
2665 {
2666 
2667 	int esta, estb;
2668 	struct ksegrp *kg;
2669 	mtx_assert(&sched_lock, MA_OWNED);
2670 	if (p1 == NULL)
2671 		return (1);
2672 
2673 	ISRUN(p1, esta);
2674 	ISRUN(p2, estb);
2675 
2676 	/*
2677 	 * see if at least one of them is runnable
2678 	 */
2679 	switch (TESTAB(esta, estb)) {
2680 	case ONLYA:
2681 		return (0);
2682 	case ONLYB:
2683 		return (1);
2684 	case BOTH:
2685 		/*
2686 		 * tie - favor one with highest recent cpu utilization
2687 		 */
2688 		esta = estb = 0;
2689 		FOREACH_KSEGRP_IN_PROC(p1,kg) {
2690 			esta += kg->kg_estcpu;
2691 		}
2692 		FOREACH_KSEGRP_IN_PROC(p2,kg) {
2693 			estb += kg->kg_estcpu;
2694 		}
2695 		if (estb > esta)
2696 			return (1);
2697 		if (esta > estb)
2698 			return (0);
2699 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2700 	}
2701 	/*
2702 	 * weed out zombies
2703 	 */
2704 	switch (TESTAB(p1->p_state == PRS_ZOMBIE, p2->p_state == PRS_ZOMBIE)) {
2705 	case ONLYA:
2706 		return (1);
2707 	case ONLYB:
2708 		return (0);
2709 	case BOTH:
2710 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2711 	}
2712 
2713 #if 0 /* XXXKSE */
2714 	/*
2715 	 * pick the one with the smallest sleep time
2716 	 */
2717 	if (p2->p_slptime > p1->p_slptime)
2718 		return (0);
2719 	if (p1->p_slptime > p2->p_slptime)
2720 		return (1);
2721 	/*
2722 	 * favor one sleeping in a non-interruptible sleep
2723 	 */
2724 	if (p1->p_sflag & PS_SINTR && (p2->p_sflag & PS_SINTR) == 0)
2725 		return (1);
2726 	if (p2->p_sflag & PS_SINTR && (p1->p_sflag & PS_SINTR) == 0)
2727 		return (0);
2728 #endif
2729 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2730 }
2731 
2732 /*
2733  * Output char to tty; console putchar style.
2734  */
2735 int
2736 tputchar(int c, struct tty *tp)
2737 {
2738 	int s;
2739 
2740 	s = spltty();
2741 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2742 		splx(s);
2743 		return (-1);
2744 	}
2745 	if (c == '\n')
2746 		(void)ttyoutput('\r', tp);
2747 	(void)ttyoutput(c, tp);
2748 	ttstart(tp);
2749 	splx(s);
2750 	return (0);
2751 }
2752 
2753 /*
2754  * Sleep on chan, returning ERESTART if tty changed while we napped and
2755  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2756  * the tty is revoked, restarting a pending call will redo validation done
2757  * at the start of the call.
2758  */
2759 int
2760 ttysleep(struct tty *tp, void *chan, int pri, char *wmesg, int timo)
2761 {
2762 	int error;
2763 	int gen;
2764 
2765 	gen = tp->t_gen;
2766 	error = tsleep(chan, pri, wmesg, timo);
2767 	if (tp->t_state & TS_GONE)
2768 		return (ENXIO);
2769 	if (error)
2770 		return (error);
2771 	return (tp->t_gen == gen ? 0 : ERESTART);
2772 }
2773 
2774 /*
2775  * Gain a reference to a TTY
2776  */
2777 int
2778 ttyref(struct tty *tp)
2779 {
2780 	int i;
2781 
2782 	mtx_lock(&tp->t_mtx);
2783 	KASSERT(tp->t_refcnt > 0,
2784 	    ("ttyref(): tty refcnt is %d (%s)",
2785 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2786 	i = ++tp->t_refcnt;
2787 	mtx_unlock(&tp->t_mtx);
2788 	return (i);
2789 }
2790 
2791 /*
2792  * Drop a reference to a TTY.
2793  * When reference count drops to zero, we free it.
2794  */
2795 int
2796 ttyrel(struct tty *tp)
2797 {
2798 	int i;
2799 
2800 	mtx_lock(&tty_list_mutex);
2801 	mtx_lock(&tp->t_mtx);
2802 	KASSERT(tp->t_refcnt > 0,
2803 	    ("ttyrel(): tty refcnt is %d (%s)",
2804 	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2805 	i = --tp->t_refcnt;
2806 	if (i != 0) {
2807 		mtx_unlock(&tp->t_mtx);
2808 		mtx_unlock(&tty_list_mutex);
2809 		return (i);
2810 	}
2811 	TAILQ_REMOVE(&tty_list, tp, t_list);
2812 	mtx_unlock(&tp->t_mtx);
2813 	mtx_unlock(&tty_list_mutex);
2814 	knlist_destroy(&tp->t_rsel.si_note);
2815 	knlist_destroy(&tp->t_wsel.si_note);
2816 	mtx_destroy(&tp->t_mtx);
2817 	free(tp, M_TTYS);
2818 	return (i);
2819 }
2820 
2821 /*
2822  * Allocate a tty struct.  Clists in the struct will be allocated by
2823  * tty_open().
2824  */
2825 struct tty *
2826 ttymalloc(struct tty *tp)
2827 {
2828 	static int once;
2829 
2830 	if (!once) {
2831 		mtx_init(&tty_list_mutex, "ttylist", NULL, MTX_DEF);
2832 		once++;
2833 	}
2834 
2835 	if (tp) {
2836 		/*
2837 		 * XXX: Either this argument should go away, or we should
2838 		 * XXX: require it and do a ttyrel(tp) here and allocate
2839 		 * XXX: a new tty.  For now do nothing.
2840 		 */
2841 		return(tp);
2842 	}
2843 	tp = malloc(sizeof *tp, M_TTYS, M_WAITOK | M_ZERO);
2844 	mtx_init(&tp->t_mtx, "tty", NULL, MTX_DEF);
2845 
2846 	/*
2847 	 * Set up the initial state
2848 	 */
2849 	tp->t_refcnt = 1;
2850 	tp->t_timeout = -1;
2851 	tp->t_dtr_wait = 3 * hz;
2852 
2853 	ttyinitmode(tp, 0, 0);
2854 	bcopy(ttydefchars, tp->t_init_in.c_cc, sizeof tp->t_init_in.c_cc);
2855 
2856 	/* Make callout the same as callin */
2857 	tp->t_init_out = tp->t_init_in;
2858 
2859 	mtx_lock(&tty_list_mutex);
2860 	TAILQ_INSERT_TAIL(&tty_list, tp, t_list);
2861 	mtx_unlock(&tty_list_mutex);
2862 	knlist_init(&tp->t_rsel.si_note, &tp->t_mtx);
2863 	knlist_init(&tp->t_wsel.si_note, &tp->t_mtx);
2864 	return (tp);
2865 }
2866 
2867 struct tty *
2868 ttyalloc()
2869 {
2870 
2871 	return (ttymalloc(NULL));
2872 }
2873 
2874 static void
2875 ttypurge(struct cdev *dev)
2876 {
2877 
2878 	if (dev->si_tty == NULL)
2879 		return;
2880 	ttygone(dev->si_tty);
2881 }
2882 
2883 /*
2884  * ttycreate()
2885  *
2886  * Create the device entries for this tty thereby opening it for business.
2887  *
2888  * The flags argument controls if "cua" units are created.
2889  *
2890  * The t_sc filed is copied to si_drv1 in the created cdevs.  This
2891  * is particularly important for ->t_cioctl() users.
2892  *
2893  * XXX: implement the init and lock devices by cloning.
2894  */
2895 
2896 int
2897 ttycreate(struct tty *tp, struct cdevsw *csw, int unit, int flags, const char *fmt, ...)
2898 {
2899 	char namebuf[SPECNAMELEN - 3];		/* XXX space for "tty" */
2900 	va_list ap;
2901 	struct cdev *cp;
2902 	int i, minor, sminor, sunit;
2903 
2904 	mtx_assert(&Giant, MA_OWNED);
2905 
2906 	if (tty_unit == NULL)
2907 		tty_unit = new_unrhdr(0, 0xffff, NULL);
2908 
2909 	sunit = alloc_unr(tty_unit);
2910 	tp->t_devunit = sunit;
2911 
2912 	if (csw == NULL) {
2913 		csw = &tty_cdevsw;
2914 		unit = sunit;
2915 	}
2916 	KASSERT(csw->d_purge == NULL || csw->d_purge == ttypurge,
2917 	    ("tty should not have d_purge"));
2918 
2919 	csw->d_purge = ttypurge;
2920 
2921 	minor = unit2minor(unit);
2922 	sminor = unit2minor(sunit);
2923 	va_start(ap, fmt);
2924 	i = vsnrprintf(namebuf, sizeof namebuf, 32, fmt, ap);
2925 	va_end(ap);
2926 	KASSERT(i < sizeof namebuf, ("Too long tty name (%s)", namebuf));
2927 
2928 	cp = make_dev(csw, minor,
2929 	    UID_ROOT, GID_WHEEL, 0600, "tty%s", namebuf);
2930 	tp->t_dev = cp;
2931 	tp->t_mdev = cp;
2932 	cp->si_tty = tp;
2933 	cp->si_drv1 = tp->t_sc;
2934 
2935 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_INIT,
2936 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.init", namebuf);
2937 	dev_depends(tp->t_dev, cp);
2938 	cp->si_drv1 = tp->t_sc;
2939 	cp->si_drv2 = &tp->t_init_in;
2940 	cp->si_tty = tp;
2941 
2942 	cp = make_dev(&ttys_cdevsw, sminor | MINOR_LOCK,
2943 	    UID_ROOT, GID_WHEEL, 0600, "tty%s.lock", namebuf);
2944 	dev_depends(tp->t_dev, cp);
2945 	cp->si_drv1 = tp->t_sc;
2946 	cp->si_drv2 = &tp->t_lock_in;
2947 	cp->si_tty = tp;
2948 
2949 	if (flags & MINOR_CALLOUT) {
2950 		cp = make_dev(csw, minor | MINOR_CALLOUT,
2951 		    UID_UUCP, GID_DIALER, 0660, "cua%s", namebuf);
2952 		dev_depends(tp->t_dev, cp);
2953 		cp->si_drv1 = tp->t_sc;
2954 		cp->si_tty = tp;
2955 
2956 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_INIT,
2957 		    UID_UUCP, GID_DIALER, 0660, "cua%s.init", namebuf);
2958 		dev_depends(tp->t_dev, cp);
2959 		cp->si_drv1 = tp->t_sc;
2960 		cp->si_drv2 = &tp->t_init_out;
2961 		cp->si_tty = tp;
2962 
2963 		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_LOCK,
2964 		    UID_UUCP, GID_DIALER, 0660, "cua%s.lock", namebuf);
2965 		dev_depends(tp->t_dev, cp);
2966 		cp->si_drv1 = tp->t_sc;
2967 		cp->si_drv2 = &tp->t_lock_out;
2968 		cp->si_tty = tp;
2969 	}
2970 
2971 	return (0);
2972 }
2973 
2974 /*
2975  * This function is called when the hardware disappears.  We set a flag
2976  * and wake up stuff so all sleeping threads will notice.
2977  */
2978 void
2979 ttygone(struct tty *tp)
2980 {
2981 
2982 	tp->t_state |= TS_GONE;
2983 	wakeup(&tp->t_dtr_wait);
2984 	wakeup(TSA_CARR_ON(tp));
2985 	wakeup(TSA_HUP_OR_INPUT(tp));
2986 	wakeup(TSA_OCOMPLETE(tp));
2987 	wakeup(TSA_OLOWAT(tp));
2988 	if (tp->t_purge != NULL)
2989 		tp->t_purge(tp);
2990 }
2991 
2992 /*
2993  * ttyfree()
2994  *
2995  * Called when the driver is ready to free the tty structure.
2996  *
2997  * XXX: This shall sleep until all threads have left the driver.
2998  */
2999 
3000 void
3001 ttyfree(struct tty *tp)
3002 {
3003 	u_int unit;
3004 
3005 	mtx_assert(&Giant, MA_OWNED);
3006 	ttygone(tp);
3007 	unit = tp->t_devunit;
3008 	destroy_dev(tp->t_mdev);
3009 	free_unr(tty_unit, unit);
3010 }
3011 
3012 static int
3013 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
3014 {
3015 	struct tty *tp, *tp2;
3016 	struct xtty xt;
3017 	int error;
3018 
3019 	error = 0;
3020 	mtx_lock(&tty_list_mutex);
3021 	tp = TAILQ_FIRST(&tty_list);
3022 	if (tp != NULL)
3023 		ttyref(tp);
3024 	mtx_unlock(&tty_list_mutex);
3025 	while (tp != NULL) {
3026 		bzero(&xt, sizeof xt);
3027 		xt.xt_size = sizeof xt;
3028 #define XT_COPY(field) xt.xt_##field = tp->t_##field
3029 		xt.xt_rawcc = tp->t_rawq.c_cc;
3030 		xt.xt_cancc = tp->t_canq.c_cc;
3031 		xt.xt_outcc = tp->t_outq.c_cc;
3032 		XT_COPY(line);
3033 		if (tp->t_dev != NULL)
3034 			xt.xt_dev = dev2udev(tp->t_dev);
3035 		XT_COPY(state);
3036 		XT_COPY(flags);
3037 		XT_COPY(timeout);
3038 		if (tp->t_pgrp != NULL)
3039 			xt.xt_pgid = tp->t_pgrp->pg_id;
3040 		if (tp->t_session != NULL)
3041 			xt.xt_sid = tp->t_session->s_sid;
3042 		XT_COPY(termios);
3043 		XT_COPY(winsize);
3044 		XT_COPY(column);
3045 		XT_COPY(rocount);
3046 		XT_COPY(rocol);
3047 		XT_COPY(ififosize);
3048 		XT_COPY(ihiwat);
3049 		XT_COPY(ilowat);
3050 		XT_COPY(ispeedwat);
3051 		XT_COPY(ohiwat);
3052 		XT_COPY(olowat);
3053 		XT_COPY(ospeedwat);
3054 #undef XT_COPY
3055 		error = SYSCTL_OUT(req, &xt, sizeof xt);
3056 		if (error != 0) {
3057 			ttyrel(tp);
3058 			return (error);
3059 		}
3060 		mtx_lock(&tty_list_mutex);
3061 		tp2 = TAILQ_NEXT(tp, t_list);
3062 		if (tp2 != NULL)
3063 			ttyref(tp2);
3064 		mtx_unlock(&tty_list_mutex);
3065 		ttyrel(tp);
3066 		tp = tp2;
3067 	}
3068 	return (0);
3069 }
3070 
3071 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
3072 	0, 0, sysctl_kern_ttys, "S,xtty", "All ttys");
3073 SYSCTL_LONG(_kern, OID_AUTO, tty_nin, CTLFLAG_RD,
3074 	&tk_nin, 0, "Total TTY in characters");
3075 SYSCTL_LONG(_kern, OID_AUTO, tty_nout, CTLFLAG_RD,
3076 	&tk_nout, 0, "Total TTY out characters");
3077 
3078 void
3079 nottystop(struct tty *tp, int rw)
3080 {
3081 
3082 	return;
3083 }
3084 
3085 int
3086 ttyopen(struct cdev *dev, int flag, int mode, struct thread *td)
3087 {
3088 	int		error;
3089 	int		s;
3090 	struct tty	*tp;
3091 
3092 	tp = dev->si_tty;
3093 	s = spltty();
3094 	/*
3095 	 * We jump to this label after all non-interrupted sleeps to pick
3096 	 * up any changes of the device state.
3097 	 */
3098 open_top:
3099 	if (tp->t_state & TS_GONE)
3100 		return (ENXIO);
3101 	error = ttydtrwaitsleep(tp);
3102 	if (error)
3103 		goto out;
3104 	if (tp->t_state & TS_ISOPEN) {
3105 		/*
3106 		 * The device is open, so everything has been initialized.
3107 		 * Handle conflicts.
3108 		 */
3109 		if (ISCALLOUT(dev) && !tp->t_actout)
3110 			return (EBUSY);
3111 		if (tp->t_actout && !ISCALLOUT(dev)) {
3112 			if (flag & O_NONBLOCK)
3113 				return (EBUSY);
3114 			error =	tsleep(&tp->t_actout,
3115 				       TTIPRI | PCATCH, "ttybi", 0);
3116 			if (error != 0 || (tp->t_flags & TS_GONE))
3117 				goto out;
3118 			goto open_top;
3119 		}
3120 		if (tp->t_state & TS_XCLUDE && suser(td))
3121 			return (EBUSY);
3122 	} else {
3123 		/*
3124 		 * The device isn't open, so there are no conflicts.
3125 		 * Initialize it.  Initialization is done twice in many
3126 		 * cases: to preempt sleeping callin opens if we are
3127 		 * callout, and to complete a callin open after DCD rises.
3128 		 */
3129 		tp->t_termios = ISCALLOUT(dev) ? tp->t_init_out : tp->t_init_in;
3130 		tp->t_cflag = tp->t_termios.c_cflag;
3131 		tp->t_modem(tp, SER_DTR | SER_RTS, 0);
3132 		++tp->t_wopeners;
3133 		error = tp->t_param(tp, &tp->t_termios);
3134 		--tp->t_wopeners;
3135 		if (error == 0 && tp->t_open != NULL)
3136 			error = tp->t_open(tp, dev);
3137 		if (error != 0)
3138 			goto out;
3139 		if (ISCALLOUT(dev) || (tp->t_modem(tp, 0, 0) & SER_DCD))
3140 			ttyld_modem(tp, 1);
3141 	}
3142 	/*
3143 	 * Wait for DCD if necessary.
3144 	 */
3145 	if (!(tp->t_state & TS_CARR_ON) && !ISCALLOUT(dev)
3146 	    && !(tp->t_cflag & CLOCAL) && !(flag & O_NONBLOCK)) {
3147 		++tp->t_wopeners;
3148 		error = tsleep(TSA_CARR_ON(tp), TTIPRI | PCATCH, "ttydcd", 0);
3149 		--tp->t_wopeners;
3150 		if (error != 0 || (tp->t_state & TS_GONE))
3151 			goto out;
3152 		goto open_top;
3153 	}
3154 	error =	ttyld_open(tp, dev);
3155 	ttyldoptim(tp);
3156 	if (tp->t_state & TS_ISOPEN && ISCALLOUT(dev))
3157 		tp->t_actout = TRUE;
3158 out:
3159 	splx(s);
3160 	if (!(tp->t_state & TS_ISOPEN) && tp->t_wopeners == 0 &&
3161 	    tp->t_close != NULL)
3162 		tp->t_close(tp);
3163 	return (error);
3164 }
3165 
3166 int
3167 ttyclose(struct cdev *dev, int flag, int mode, struct thread *td)
3168 {
3169 	struct tty *tp;
3170 
3171 	tp = dev->si_tty;
3172 	ttyld_close(tp, flag);
3173 	ttyldoptim(tp);
3174 	if (tp->t_close != NULL)
3175 		tp->t_close(tp);
3176 	tp->t_do_timestamp = 0;
3177 	if (tp->t_pps != NULL)
3178 		tp->t_pps->ppsparam.mode = 0;
3179 	tty_close(tp);
3180 	return (0);
3181 }
3182 
3183 int
3184 ttyread(struct cdev *dev, struct uio *uio, int flag)
3185 {
3186 	struct tty *tp;
3187 
3188 	tp = tty_gettp(dev);
3189 
3190 	if (tp->t_state & TS_GONE)
3191 		return (ENODEV);
3192 	return (ttyld_read(tp, uio, flag));
3193 }
3194 
3195 int
3196 ttywrite(struct cdev *dev, struct uio *uio, int flag)
3197 {
3198 	struct tty *tp;
3199 
3200 	tp = tty_gettp(dev);
3201 
3202 	if (tp->t_state & TS_GONE)
3203 		return (ENODEV);
3204 	return (ttyld_write(tp, uio, flag));
3205 }
3206 
3207 int
3208 ttyioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3209 {
3210 	struct	tty *tp;
3211 	int	error;
3212 
3213 	tp = dev->si_tty;
3214 
3215 	if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) {
3216 		int cc;
3217 		struct termios *dt = (struct termios *)data;
3218 		struct termios *lt =
3219 		    ISCALLOUT(dev) ?  &tp->t_lock_out : &tp->t_lock_in;
3220 
3221 		dt->c_iflag = (tp->t_iflag & lt->c_iflag)
3222 		    | (dt->c_iflag & ~lt->c_iflag);
3223 		dt->c_oflag = (tp->t_oflag & lt->c_oflag)
3224 		    | (dt->c_oflag & ~lt->c_oflag);
3225 		dt->c_cflag = (tp->t_cflag & lt->c_cflag)
3226 		    | (dt->c_cflag & ~lt->c_cflag);
3227 		dt->c_lflag = (tp->t_lflag & lt->c_lflag)
3228 		    | (dt->c_lflag & ~lt->c_lflag);
3229 		for (cc = 0; cc < NCCS; ++cc)
3230 		    if (lt->c_cc[cc] != 0)
3231 		        dt->c_cc[cc] = tp->t_cc[cc];
3232 		if (lt->c_ispeed != 0)
3233 		    dt->c_ispeed = tp->t_ispeed;
3234 		if (lt->c_ospeed != 0)
3235 		    dt->c_ospeed = tp->t_ospeed;
3236 	}
3237 
3238 	error = ttyld_ioctl(tp, cmd, data, flag, td);
3239 	if (error == ENOIOCTL)
3240 		error = ttioctl(tp, cmd, data, flag);
3241 	ttyldoptim(tp);
3242 	if (error != ENOIOCTL)
3243 		return (error);
3244 	return (ENOTTY);
3245 }
3246 
3247 void
3248 ttyldoptim(struct tty *tp)
3249 {
3250 	struct termios	*t;
3251 
3252 	t = &tp->t_termios;
3253 	if (!(t->c_iflag & (ICRNL | IGNCR | IMAXBEL | INLCR | ISTRIP | IXON))
3254 	    && (!(t->c_iflag & BRKINT) || (t->c_iflag & IGNBRK))
3255 	    && (!(t->c_iflag & PARMRK)
3256 		|| (t->c_iflag & (IGNPAR | IGNBRK)) == (IGNPAR | IGNBRK))
3257 	    && !(t->c_lflag & (ECHO | ICANON | IEXTEN | ISIG | PENDIN))
3258 	    && linesw[tp->t_line]->l_rint == ttyinput)
3259 		tp->t_state |= TS_CAN_BYPASS_L_RINT;
3260 	else
3261 		tp->t_state &= ~TS_CAN_BYPASS_L_RINT;
3262 }
3263 
3264 static void
3265 ttydtrwaitwakeup(void *arg)
3266 {
3267 	struct tty *tp;
3268 
3269 	tp = arg;
3270 	tp->t_state &= ~TS_DTR_WAIT;
3271 	wakeup(&tp->t_dtr_wait);
3272 }
3273 
3274 
3275 void
3276 ttydtrwaitstart(struct tty *tp)
3277 {
3278 
3279 	if (tp->t_dtr_wait == 0)
3280 		return;
3281 	if (tp->t_state & TS_DTR_WAIT)
3282 		return;
3283 	timeout(ttydtrwaitwakeup, tp, tp->t_dtr_wait);
3284 	tp->t_state |= TS_DTR_WAIT;
3285 }
3286 
3287 int
3288 ttydtrwaitsleep(struct tty *tp)
3289 {
3290 	int error;
3291 
3292 	error = 0;
3293 	while (error == 0) {
3294 		if (tp->t_state & TS_GONE)
3295 			error = ENXIO;
3296 		else if (!(tp->t_state & TS_DTR_WAIT))
3297 			break;
3298 		else
3299 			error = tsleep(&tp->t_dtr_wait, TTIPRI | PCATCH,
3300 			    "dtrwait", 0);
3301 	}
3302 	return (error);
3303 }
3304 
3305 static int
3306 ttysopen(struct cdev *dev, int flag, int mode, struct thread *td)
3307 {
3308 	struct tty *tp;
3309 
3310 	tp = dev->si_tty;
3311 	KASSERT(tp != NULL,
3312 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3313 	if (tp->t_state & TS_GONE)
3314 		return (ENODEV);
3315 	return (0);
3316 }
3317 
3318 static int
3319 ttysclose(struct cdev *dev, int flag, int mode, struct thread *td)
3320 {
3321 
3322 	return (0);
3323 }
3324 
3325 static int
3326 ttysrdwr(struct cdev *dev, struct uio *uio, int flag)
3327 {
3328 
3329 	return (ENODEV);
3330 }
3331 
3332 static int
3333 ttysioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3334 {
3335 	struct tty	*tp;
3336 	int		error;
3337 	struct termios	*ct;
3338 
3339 	tp = dev->si_tty;
3340 	KASSERT(tp != NULL,
3341 	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3342 	if (tp->t_state & TS_GONE)
3343 		return (ENODEV);
3344 	ct = dev->si_drv2;
3345 	switch (cmd) {
3346 	case TIOCSETA:
3347 		error = suser(td);
3348 		if (error != 0)
3349 			return (error);
3350 		*ct = *(struct termios *)data;
3351 		return (0);
3352 	case TIOCGETA:
3353 		*(struct termios *)data = *ct;
3354 		return (0);
3355 	case TIOCGETD:
3356 		*(int *)data = TTYDISC;
3357 		return (0);
3358 	case TIOCGWINSZ:
3359 		bzero(data, sizeof(struct winsize));
3360 		return (0);
3361 	default:
3362 		if (tp->t_cioctl != NULL)
3363 			return(tp->t_cioctl(dev, cmd, data, flag, td));
3364 		return (ENOTTY);
3365 	}
3366 }
3367 
3368 /*
3369  * Initialize a tty to sane modes.
3370  */
3371 void
3372 ttyinitmode(struct tty *tp, int echo, int speed)
3373 {
3374 
3375 	if (speed == 0)
3376 		speed = TTYDEF_SPEED;
3377 	tp->t_init_in.c_iflag = TTYDEF_IFLAG;
3378 	tp->t_init_in.c_oflag = TTYDEF_OFLAG;
3379 	tp->t_init_in.c_cflag = TTYDEF_CFLAG;
3380 	if (echo)
3381 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_ECHO;
3382 	else
3383 		tp->t_init_in.c_lflag = TTYDEF_LFLAG_NOECHO;
3384 
3385 	tp->t_init_in.c_ispeed = tp->t_init_in.c_ospeed = speed;
3386 	termioschars(&tp->t_init_in);
3387 	tp->t_init_out = tp->t_init_in;
3388 	tp->t_termios = tp->t_init_in;
3389 }
3390 
3391 /*
3392  * Use more "normal" termios paramters for consoles.
3393  */
3394 void
3395 ttyconsolemode(struct tty *tp, int speed)
3396 {
3397 
3398 	if (speed == 0)
3399 		speed = TTYDEF_SPEED;
3400 	ttyinitmode(tp, 1, speed);
3401 	tp->t_init_in.c_cflag |= CLOCAL;
3402 	tp->t_lock_out.c_cflag = tp->t_lock_in.c_cflag = CLOCAL;
3403 	tp->t_lock_out.c_ispeed = tp->t_lock_out.c_ospeed =
3404 	tp->t_lock_in.c_ispeed = tp->t_lock_in.c_ospeed = speed;
3405 	tp->t_init_out = tp->t_init_in;
3406 	tp->t_termios = tp->t_init_in;
3407 }
3408 
3409 /*
3410  * Record the relationship between the serial ports notion of modem control
3411  * signals and the one used in certain ioctls in a way the compiler can enforce
3412  * XXX: We should define TIOCM_* in terms of SER_ if we can limit the
3413  * XXX: consequences of the #include work that would take.
3414  */
3415 CTASSERT(SER_DTR == TIOCM_DTR / 2);
3416 CTASSERT(SER_RTS == TIOCM_RTS / 2);
3417 CTASSERT(SER_STX == TIOCM_ST / 2);
3418 CTASSERT(SER_SRX == TIOCM_SR / 2);
3419 CTASSERT(SER_CTS == TIOCM_CTS / 2);
3420 CTASSERT(SER_DCD == TIOCM_DCD / 2);
3421 CTASSERT(SER_RI == TIOCM_RI / 2);
3422 CTASSERT(SER_DSR == TIOCM_DSR / 2);
3423 
3424