tty.c revision 179246
1/*-
2 * Copyright (c) 1982, 1986, 1990, 1991, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 * (c) UNIX System Laboratories, Inc.
5 * All or some portions of this file are derived from material licensed
6 * to the University of California by American Telephone and Telegraph
7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8 * the permission of UNIX System Laboratories, Inc.
9 *
10 * Copyright (c) 2002 Networks Associates Technologies, Inc.
11 * All rights reserved.
12 *
13 * Portions of this software were developed for the FreeBSD Project by
14 * ThinkSec AS and NAI Labs, the Security Research Division of Network
15 * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
16 * ("CBOSS"), as part of the DARPA CHATS research program.
17 *
18 * Redistribution and use in source and binary forms, with or without
19 * modification, are permitted provided that the following conditions
20 * are met:
21 * 1. Redistributions of source code must retain the above copyright
22 *    notice, this list of conditions and the following disclaimer.
23 * 2. Redistributions in binary form must reproduce the above copyright
24 *    notice, this list of conditions and the following disclaimer in the
25 *    documentation and/or other materials provided with the distribution.
26 * 4. Neither the name of the University nor the names of its contributors
27 *    may be used to endorse or promote products derived from this software
28 *    without specific prior written permission.
29 *
30 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40 * SUCH DAMAGE.
41 *
42 *	@(#)tty.c	8.8 (Berkeley) 1/21/94
43 */
44
45/*-
46 * TODO:
47 *	o Fix races for sending the start char in ttyflush().
48 *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
49 *	  With luck, there will be MIN chars before select() returns().
50 *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
51 *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
52 *	  FIONREAD.
53 *	o Do the new sio locking stuff here and use it to avoid special
54 *	  case for EXTPROC?
55 *	o Lock PENDIN too?
56 *	o Move EXTPROC and/or PENDIN to t_state?
57 *	o Wrap most of ttioctl in spltty/splx.
58 *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
59 *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
60 *	o Don't allow certain termios flags to affect disciplines other
61 *	  than TTYDISC.  Cancel their effects before switch disciplines
62 *	  and ignore them if they are set while we are in another
63 *	  discipline.
64 *	o Now that historical speed conversions are handled here, don't
65 *	  do them in drivers.
66 *	o Check for TS_CARR_ON being set while everything is closed and not
67 *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
68 *	  so it would live until the next open even if carrier drops.
69 *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
70 *	  only when _all_ openers leave open().
71 */
72
73#include <sys/cdefs.h>
74__FBSDID("$FreeBSD: head/sys/kern/tty.c 179246 2008-05-23 16:06:35Z ed $");
75
76#include "opt_compat.h"
77#include "opt_tty.h"
78
79#include <sys/param.h>
80#include <sys/systm.h>
81#include <sys/cons.h>
82#include <sys/filio.h>
83#include <sys/lock.h>
84#include <sys/mutex.h>
85#include <sys/namei.h>
86#include <sys/sx.h>
87#if defined(COMPAT_43TTY)
88#include <sys/ioctl_compat.h>
89#endif
90#include <sys/priv.h>
91#include <sys/proc.h>
92#define	TTYDEFCHARS
93#include <sys/tty.h>
94#undef	TTYDEFCHARS
95#include <sys/fcntl.h>
96#include <sys/conf.h>
97#include <sys/poll.h>
98#include <sys/kernel.h>
99#include <sys/vnode.h>
100#include <sys/serial.h>
101#include <sys/signalvar.h>
102#include <sys/resourcevar.h>
103#include <sys/malloc.h>
104#include <sys/filedesc.h>
105#include <sys/sched.h>
106#include <sys/sysctl.h>
107#include <sys/timepps.h>
108
109#include <machine/stdarg.h>
110
111#include <vm/vm.h>
112#include <vm/pmap.h>
113#include <vm/vm_map.h>
114
115MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
116
117long tk_cancc;
118long tk_nin;
119long tk_nout;
120long tk_rawcc;
121
122static	d_open_t	ttysopen;
123static	d_close_t	ttysclose;
124static	d_read_t	ttysrdwr;
125static	d_ioctl_t	ttysioctl;
126static	d_purge_t	ttypurge;
127
128/* Default cdevsw for common tty devices */
129static struct cdevsw tty_cdevsw = {
130	.d_version =	D_VERSION,
131	.d_open =	ttyopen,
132	.d_close =	ttyclose,
133	.d_ioctl =	ttyioctl,
134	.d_purge =	ttypurge,
135	.d_name =	"ttydrv",
136	.d_flags =	D_TTY | D_NEEDGIANT,
137};
138
139/* Cdevsw for slave tty devices */
140static struct cdevsw ttys_cdevsw = {
141	.d_version =	D_VERSION,
142	.d_open =	ttysopen,
143	.d_close =	ttysclose,
144	.d_read =	ttysrdwr,
145	.d_write =	ttysrdwr,
146	.d_ioctl =	ttysioctl,
147	.d_name =	"TTYS",
148	.d_flags =	D_TTY | D_NEEDGIANT,
149};
150
151static int	proc_sum(struct proc *, int *);
152static int	proc_compare(struct proc *, struct proc *);
153static int	thread_compare(struct thread *, struct thread *);
154static int	ttnread(struct tty *tp);
155static void	ttyecho(int c, struct tty *tp);
156static int	ttyoutput(int c, struct tty *tp);
157static void	ttypend(struct tty *tp);
158static void	ttyretype(struct tty *tp);
159static void	ttyrub(int c, struct tty *tp);
160static void	ttyrubo(struct tty *tp, int cnt);
161static void	ttyunblock(struct tty *tp);
162static int	ttywflush(struct tty *tp);
163static int	filt_ttyread(struct knote *kn, long hint);
164static void	filt_ttyrdetach(struct knote *kn);
165static int	filt_ttywrite(struct knote *kn, long hint);
166static void	filt_ttywdetach(struct knote *kn);
167
168/*
169 * Table with character classes and parity. The 8th bit indicates parity,
170 * the 7th bit indicates the character is an alphameric or underscore (for
171 * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
172 * are 0 then the character needs no special processing on output; classes
173 * other than 0 might be translated or (not currently) require delays.
174 */
175#define	E	0x00	/* Even parity. */
176#define	O	0x80	/* Odd parity. */
177#define	PARITY(c)	(char_type[c] & O)
178
179#define	ALPHA	0x40	/* Alpha or underscore. */
180#define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
181
182#define	CCLASSMASK	0x3f
183#define	CCLASS(c)	(char_type[c] & CCLASSMASK)
184
185#define	BS	BACKSPACE
186#define	CC	CONTROL
187#define	CR	RETURN
188#define	NA	ORDINARY | ALPHA
189#define	NL	NEWLINE
190#define	NO	ORDINARY
191#define	TB	TAB
192#define	VT	VTAB
193
194static u_char const char_type[] = {
195	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
196	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
197	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
198	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
199	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
200	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
201	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
202	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
203	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
204	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
205	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
206	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
207	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
208	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
209	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
210	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
211	/*
212	 * Meta chars; should be settable per character set;
213	 * for now, treat them all as normal characters.
214	 */
215	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
216	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
217	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
218	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
219	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
220	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
221	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
222	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
223	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
224	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
225	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
226	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
227	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
228	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
229	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
230	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
231};
232#undef	BS
233#undef	CC
234#undef	CR
235#undef	NA
236#undef	NL
237#undef	NO
238#undef	TB
239#undef	VT
240
241/* Macros to clear/set/test flags. */
242#define	SET(t, f)	(t) |= (f)
243#define	CLR(t, f)	(t) &= ~(f)
244#define	ISSET(t, f)	((t) & (f))
245
246#undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
247#define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
248
249/*
250 * list of struct tty where pstat(8) can pick it up with sysctl
251 *
252 * The lock order is to grab the list mutex before the tty mutex.
253 * Together with additions going on the tail of the list, this allows
254 * the sysctl to avoid doing retries.
255 */
256static	TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
257static struct mtx tty_list_mutex;
258MTX_SYSINIT(tty_list, &tty_list_mutex, "ttylist", MTX_DEF);
259
260static struct unrhdr *tty_unit;
261
262static int  drainwait = 5*60;
263SYSCTL_INT(_kern, OID_AUTO, drainwait, CTLFLAG_RW, &drainwait,
264	0, "Output drain timeout in seconds");
265
266static struct tty *
267tty_gettp(struct cdev *dev)
268{
269	struct tty *tp;
270	struct cdevsw *csw;
271
272	csw = dev_refthread(dev);
273	KASSERT(csw != NULL, ("No cdevsw in ttycode (%s)", devtoname(dev)));
274	KASSERT(csw->d_flags & D_TTY,
275	    ("non D_TTY (%s) in tty code", devtoname(dev)));
276	dev_relthread(dev);
277	tp = dev->si_tty;
278	KASSERT(tp != NULL,
279	    ("no tty pointer on (%s) in tty code", devtoname(dev)));
280	return (tp);
281}
282
283/*
284 * Initial open of tty, or (re)entry to standard tty line discipline.
285 */
286int
287tty_open(struct cdev *device, struct tty *tp)
288{
289	int s;
290
291	s = spltty();
292	tp->t_dev = device;
293	tp->t_hotchar = 0;
294	if (!ISSET(tp->t_state, TS_ISOPEN)) {
295		ttyref(tp);
296		SET(tp->t_state, TS_ISOPEN);
297		if (ISSET(tp->t_cflag, CLOCAL))
298			SET(tp->t_state, TS_CONNECTED);
299		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
300	}
301	/* XXX don't hang forever on output */
302	if (tp->t_timeout < 0)
303		tp->t_timeout = drainwait*hz;
304	ttsetwater(tp);
305	splx(s);
306	return (0);
307}
308
309/*
310 * Handle close() on a tty line: flush and set to initial state,
311 * bumping generation number so that pending read/write calls
312 * can detect recycling of the tty.
313 * XXX our caller should have done `spltty(); l_close(); tty_close();'
314 * and l_close() should have flushed, but we repeat the spltty() and
315 * the flush in case there are buggy callers.
316 */
317int
318tty_close(struct tty *tp)
319{
320	int ostate, s;
321
322	funsetown(&tp->t_sigio);
323	s = spltty();
324	if (constty == tp)
325		constty_clear();
326
327	ttyflush(tp, FREAD | FWRITE);
328	clist_free_cblocks(&tp->t_canq);
329	clist_free_cblocks(&tp->t_outq);
330	clist_free_cblocks(&tp->t_rawq);
331
332	tp->t_gen++;
333	tp->t_line = TTYDISC;
334	tp->t_hotchar = 0;
335	tp->t_pgrp = NULL;
336	tp->t_session = NULL;
337	ostate = tp->t_state;
338	tp->t_state = 0;
339	knlist_clear(&tp->t_rsel.si_note, 0);
340	knlist_clear(&tp->t_wsel.si_note, 0);
341	/*
342	 * Both final close and revocation close might end up calling
343	 * this method.  Only the thread clearing TS_ISOPEN should
344	 * release the reference to the tty.
345	 */
346	if (ISSET(ostate, TS_ISOPEN))
347		ttyrel(tp);
348	splx(s);
349	return (0);
350}
351
352#define	FLUSHQ(q) {							\
353	if ((q)->c_cc)							\
354		ndflush(q, (q)->c_cc);					\
355}
356
357/* Is 'c' a line delimiter ("break" character)? */
358#define	TTBREAKC(c, lflag)							\
359	((c) == '\n' || (((c) == cc[VEOF] ||				\
360	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
361	 (c) != _POSIX_VDISABLE))
362
363/*
364 * Process input of a single character received on a tty.
365 */
366int
367ttyinput(int c, struct tty *tp)
368{
369	tcflag_t iflag, lflag;
370	cc_t *cc;
371	int i, err;
372
373	/*
374	 * If input is pending take it first.
375	 */
376	lflag = tp->t_lflag;
377	if (ISSET(lflag, PENDIN))
378		ttypend(tp);
379	/*
380	 * Gather stats.
381	 */
382	if (ISSET(lflag, ICANON)) {
383		++tk_cancc;
384		++tp->t_cancc;
385	} else {
386		++tk_rawcc;
387		++tp->t_rawcc;
388	}
389	++tk_nin;
390
391	/*
392	 * Block further input iff:
393	 * current input > threshold AND input is available to user program
394	 * AND input flow control is enabled and not yet invoked.
395	 * The 3 is slop for PARMRK.
396	 */
397	iflag = tp->t_iflag;
398	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
399	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
400	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
401	    !ISSET(tp->t_state, TS_TBLOCK))
402		ttyblock(tp);
403
404	/* Handle exceptional conditions (break, parity, framing). */
405	cc = tp->t_cc;
406	err = (ISSET(c, TTY_ERRORMASK));
407	if (err) {
408		CLR(c, TTY_ERRORMASK);
409		if (ISSET(err, TTY_BI)) {
410			if (ISSET(iflag, IGNBRK))
411				return (0);
412			if (ISSET(iflag, BRKINT)) {
413				ttyflush(tp, FREAD | FWRITE);
414				if (tp->t_pgrp != NULL) {
415					PGRP_LOCK(tp->t_pgrp);
416					pgsignal(tp->t_pgrp, SIGINT, 1);
417					PGRP_UNLOCK(tp->t_pgrp);
418				}
419				goto endcase;
420			}
421			if (ISSET(iflag, PARMRK))
422				goto parmrk;
423		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
424			|| ISSET(err, TTY_FE)) {
425			if (ISSET(iflag, IGNPAR))
426				return (0);
427			else if (ISSET(iflag, PARMRK)) {
428parmrk:
429				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
430				    MAX_INPUT - 3)
431					goto input_overflow;
432				(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
433				(void)putc(0 | TTY_QUOTE, &tp->t_rawq);
434				(void)putc(c | TTY_QUOTE, &tp->t_rawq);
435				goto endcase;
436			} else
437				c = 0;
438		}
439	}
440
441	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
442		CLR(c, 0x80);
443	if (!ISSET(lflag, EXTPROC)) {
444		/*
445		 * Check for literal nexting very first
446		 */
447		if (ISSET(tp->t_state, TS_LNCH)) {
448			SET(c, TTY_QUOTE);
449			CLR(tp->t_state, TS_LNCH);
450		}
451		/*
452		 * Scan for special characters.  This code
453		 * is really just a big case statement with
454		 * non-constant cases.  The bottom of the
455		 * case statement is labeled ``endcase'', so goto
456		 * it after a case match, or similar.
457		 */
458
459		/*
460		 * Control chars which aren't controlled
461		 * by ICANON, ISIG, or IXON.
462		 */
463		if (ISSET(lflag, IEXTEN)) {
464			if (CCEQ(cc[VLNEXT], c)) {
465				if (ISSET(lflag, ECHO)) {
466					if (ISSET(lflag, ECHOE)) {
467						(void)ttyoutput('^', tp);
468						(void)ttyoutput('\b', tp);
469					} else
470						ttyecho(c, tp);
471				}
472				SET(tp->t_state, TS_LNCH);
473				goto endcase;
474			}
475			if (CCEQ(cc[VDISCARD], c)) {
476				if (ISSET(lflag, FLUSHO))
477					CLR(tp->t_lflag, FLUSHO);
478				else {
479					ttyflush(tp, FWRITE);
480					ttyecho(c, tp);
481					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
482						ttyretype(tp);
483					SET(tp->t_lflag, FLUSHO);
484				}
485				goto startoutput;
486			}
487		}
488		/*
489		 * Signals.
490		 */
491		if (ISSET(lflag, ISIG)) {
492			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
493				if (!ISSET(lflag, NOFLSH))
494					ttyflush(tp, FREAD | FWRITE);
495				ttyecho(c, tp);
496				if (tp->t_pgrp != NULL) {
497					PGRP_LOCK(tp->t_pgrp);
498					pgsignal(tp->t_pgrp,
499					    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
500					PGRP_UNLOCK(tp->t_pgrp);
501				}
502				goto endcase;
503			}
504			if (CCEQ(cc[VSUSP], c)) {
505				if (!ISSET(lflag, NOFLSH))
506					ttyflush(tp, FREAD);
507				ttyecho(c, tp);
508				if (tp->t_pgrp != NULL) {
509					PGRP_LOCK(tp->t_pgrp);
510					pgsignal(tp->t_pgrp, SIGTSTP, 1);
511					PGRP_UNLOCK(tp->t_pgrp);
512				}
513				goto endcase;
514			}
515		}
516		/*
517		 * Handle start/stop characters.
518		 */
519		if (ISSET(iflag, IXON)) {
520			if (CCEQ(cc[VSTOP], c)) {
521				if (!ISSET(tp->t_state, TS_TTSTOP)) {
522					SET(tp->t_state, TS_TTSTOP);
523					tt_stop(tp, 0);
524					return (0);
525				}
526				if (!CCEQ(cc[VSTART], c))
527					return (0);
528				/*
529				 * if VSTART == VSTOP then toggle
530				 */
531				goto endcase;
532			}
533			if (CCEQ(cc[VSTART], c))
534				goto restartoutput;
535		}
536		/*
537		 * IGNCR, ICRNL, & INLCR
538		 */
539		if (c == '\r') {
540			if (ISSET(iflag, IGNCR))
541				return (0);
542			else if (ISSET(iflag, ICRNL))
543				c = '\n';
544		} else if (c == '\n' && ISSET(iflag, INLCR))
545			c = '\r';
546	}
547	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
548		/*
549		 * From here on down canonical mode character
550		 * processing takes place.
551		 */
552		/*
553		 * erase or erase2 (^H / ^?)
554		 */
555		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
556			if (tp->t_rawq.c_cc)
557				ttyrub(unputc(&tp->t_rawq), tp);
558			goto endcase;
559		}
560		/*
561		 * kill (^U)
562		 */
563		if (CCEQ(cc[VKILL], c)) {
564			if (ISSET(lflag, ECHOKE) &&
565			    tp->t_rawq.c_cc == tp->t_rocount &&
566			    !ISSET(lflag, ECHOPRT))
567				while (tp->t_rawq.c_cc)
568					ttyrub(unputc(&tp->t_rawq), tp);
569			else {
570				ttyecho(c, tp);
571				if (ISSET(lflag, ECHOK) ||
572				    ISSET(lflag, ECHOKE))
573					ttyecho('\n', tp);
574				FLUSHQ(&tp->t_rawq);
575				tp->t_rocount = 0;
576			}
577			CLR(tp->t_state, TS_LOCAL);
578			goto endcase;
579		}
580		/*
581		 * word erase (^W)
582		 */
583		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
584			int ctype;
585
586			/*
587			 * erase whitespace
588			 */
589			while ((c = unputc(&tp->t_rawq)) == ' ' || c == '\t')
590				ttyrub(c, tp);
591			if (c == -1)
592				goto endcase;
593			/*
594			 * erase last char of word and remember the
595			 * next chars type (for ALTWERASE)
596			 */
597			ttyrub(c, tp);
598			c = unputc(&tp->t_rawq);
599			if (c == -1)
600				goto endcase;
601			if (c == ' ' || c == '\t') {
602				(void)putc(c, &tp->t_rawq);
603				goto endcase;
604			}
605			ctype = ISALPHA(c);
606			/*
607			 * erase rest of word
608			 */
609			do {
610				ttyrub(c, tp);
611				c = unputc(&tp->t_rawq);
612				if (c == -1)
613					goto endcase;
614			} while (c != ' ' && c != '\t' &&
615			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
616			(void)putc(c, &tp->t_rawq);
617			goto endcase;
618		}
619		/*
620		 * reprint line (^R)
621		 */
622		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
623			ttyretype(tp);
624			goto endcase;
625		}
626		/*
627		 * ^T - kernel info and generate SIGINFO
628		 */
629		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
630			if (ISSET(lflag, ISIG) && tp->t_pgrp != NULL) {
631				PGRP_LOCK(tp->t_pgrp);
632				pgsignal(tp->t_pgrp, SIGINFO, 1);
633				PGRP_UNLOCK(tp->t_pgrp);
634			}
635			if (!ISSET(lflag, NOKERNINFO))
636				ttyinfo(tp);
637			goto endcase;
638		}
639	}
640	/*
641	 * Check for input buffer overflow
642	 */
643	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
644input_overflow:
645		if (ISSET(iflag, IMAXBEL)) {
646			if (tp->t_outq.c_cc < tp->t_ohiwat)
647				(void)ttyoutput(CTRL('g'), tp);
648		}
649		goto endcase;
650	}
651
652	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
653	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
654		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
655
656	/*
657	 * Put data char in q for user and
658	 * wakeup on seeing a line delimiter.
659	 */
660	if (putc(c, &tp->t_rawq) >= 0) {
661		if (!ISSET(lflag, ICANON)) {
662			ttwakeup(tp);
663			ttyecho(c, tp);
664			goto endcase;
665		}
666		if (TTBREAKC(c, lflag)) {
667			tp->t_rocount = 0;
668			catq(&tp->t_rawq, &tp->t_canq);
669			ttwakeup(tp);
670		} else if (tp->t_rocount++ == 0)
671			tp->t_rocol = tp->t_column;
672		if (ISSET(tp->t_state, TS_ERASE)) {
673			/*
674			 * end of prterase \.../
675			 */
676			CLR(tp->t_state, TS_ERASE);
677			(void)ttyoutput('/', tp);
678		}
679		i = tp->t_column;
680		ttyecho(c, tp);
681		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
682			/*
683			 * Place the cursor over the '^' of the ^D.
684			 */
685			i = imin(2, tp->t_column - i);
686			while (i > 0) {
687				(void)ttyoutput('\b', tp);
688				i--;
689			}
690		}
691	}
692endcase:
693	/*
694	 * IXANY means allow any character to restart output.
695	 */
696	if (ISSET(tp->t_state, TS_TTSTOP) &&
697	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
698		return (0);
699restartoutput:
700	CLR(tp->t_lflag, FLUSHO);
701	CLR(tp->t_state, TS_TTSTOP);
702startoutput:
703	return (ttstart(tp));
704}
705
706/*
707 * Output a single character on a tty, doing output processing
708 * as needed (expanding tabs, newline processing, etc.).
709 * Returns < 0 if succeeds, otherwise returns char to resend.
710 * Must be recursive.
711 */
712static int
713ttyoutput(int c, struct tty *tp)
714{
715	tcflag_t oflag;
716	int col, s;
717
718	oflag = tp->t_oflag;
719	if (!ISSET(oflag, OPOST)) {
720		if (ISSET(tp->t_lflag, FLUSHO))
721			return (-1);
722		if (putc(c, &tp->t_outq))
723			return (c);
724		tk_nout++;
725		tp->t_outcc++;
726		return (-1);
727	}
728	/*
729	 * Do tab expansion if OXTABS is set.  Special case if we external
730	 * processing, we don't do the tab expansion because we'll probably
731	 * get it wrong.  If tab expansion needs to be done, let it happen
732	 * externally.
733	 */
734	CLR(c, ~TTY_CHARMASK);
735	if (c == '\t' &&
736	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
737		c = 8 - (tp->t_column & 7);
738		if (!ISSET(tp->t_lflag, FLUSHO)) {
739			s = spltty();		/* Don't interrupt tabs. */
740			c -= b_to_q("        ", c, &tp->t_outq);
741			tk_nout += c;
742			tp->t_outcc += c;
743			splx(s);
744		}
745		tp->t_column += c;
746		return (c ? -1 : '\t');
747	}
748	if (c == CEOT && ISSET(oflag, ONOEOT))
749		return (-1);
750
751	/*
752	 * Newline translation: if ONLCR is set,
753	 * translate newline into "\r\n".
754	 */
755	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
756		tk_nout++;
757		tp->t_outcc++;
758		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
759			return (c);
760	}
761	/* If OCRNL is set, translate "\r" into "\n". */
762	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
763		c = '\n';
764	/* If ONOCR is set, don't transmit CRs when on column 0. */
765	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
766		return (-1);
767
768	tk_nout++;
769	tp->t_outcc++;
770	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
771		return (c);
772
773	col = tp->t_column;
774	switch (CCLASS(c)) {
775	case BACKSPACE:
776		if (col > 0)
777			--col;
778		break;
779	case CONTROL:
780		break;
781	case NEWLINE:
782		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
783			col = 0;
784		break;
785	case RETURN:
786		col = 0;
787		break;
788	case ORDINARY:
789		++col;
790		break;
791	case TAB:
792		col = (col + 8) & ~7;
793		break;
794	}
795	tp->t_column = col;
796	return (-1);
797}
798
799/*
800 * Ioctls for all tty devices.  Called after line-discipline specific ioctl
801 * has been called to do discipline-specific functions and/or reject any
802 * of these ioctl commands.
803 */
804/* ARGSUSED */
805int
806ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
807{
808	struct proc *p;
809	struct thread *td;
810	struct pgrp *pgrp;
811	int s, error, bits, sig, sig2;
812
813	td = curthread;			/* XXX */
814	p = td->td_proc;
815
816	/* If the ioctl involves modification, hang if in the background. */
817	switch (cmd) {
818	case  TIOCCBRK:
819	case  TIOCCONS:
820	case  TIOCDRAIN:
821	case  TIOCEXCL:
822	case  TIOCFLUSH:
823#ifdef TIOCHPCL
824	case  TIOCHPCL:
825#endif
826	case  TIOCNXCL:
827	case  TIOCSBRK:
828	case  TIOCSCTTY:
829	case  TIOCSDRAINWAIT:
830	case  TIOCSETA:
831	case  TIOCSETAF:
832	case  TIOCSETAW:
833	case  TIOCSETD:
834	case  TIOCSPGRP:
835	case  TIOCSTART:
836	case  TIOCSTAT:
837	case  TIOCSTI:
838	case  TIOCSTOP:
839	case  TIOCSWINSZ:
840#if defined(COMPAT_43TTY)
841	case  TIOCLBIC:
842	case  TIOCLBIS:
843	case  TIOCLSET:
844	case  TIOCSETC:
845	case OTIOCSETD:
846	case  TIOCSETN:
847	case  TIOCSETP:
848	case  TIOCSLTC:
849#endif
850		sx_slock(&proctree_lock);
851		PROC_LOCK(p);
852		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
853		    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
854		    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
855			pgrp = p->p_pgrp;
856			PROC_UNLOCK(p);
857			if (pgrp->pg_jobc == 0) {
858				sx_sunlock(&proctree_lock);
859				return (EIO);
860			}
861			PGRP_LOCK(pgrp);
862			sx_sunlock(&proctree_lock);
863			pgsignal(pgrp, SIGTTOU, 1);
864			PGRP_UNLOCK(pgrp);
865			error = ttysleep(tp, &lbolt, TTOPRI | PCATCH, "ttybg1",
866					 0);
867			if (error)
868				return (error);
869			sx_slock(&proctree_lock);
870			PROC_LOCK(p);
871		}
872		PROC_UNLOCK(p);
873		sx_sunlock(&proctree_lock);
874		break;
875	}
876
877
878	if (tp->t_modem != NULL) {
879		switch (cmd) {
880		case TIOCSDTR:
881			tt_modem(tp, SER_DTR, 0);
882			return (0);
883		case TIOCCDTR:
884			tt_modem(tp, 0, SER_DTR);
885			return (0);
886		case TIOCMSET:
887			bits = *(int *)data;
888			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
889			sig2 = ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1;
890			tt_modem(tp, sig, sig2);
891			return (0);
892		case TIOCMBIS:
893			bits = *(int *)data;
894			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
895			tt_modem(tp, sig, 0);
896			return (0);
897		case TIOCMBIC:
898			bits = *(int *)data;
899			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
900			tt_modem(tp, 0, sig);
901			return (0);
902		case TIOCMGET:
903			sig = tt_modem(tp, 0, 0);
904			/* See <sys/serial.h. for the "<< 1" stuff */
905			bits = TIOCM_LE + (sig << 1);
906			*(int *)data = bits;
907			return (0);
908		default:
909			break;
910		}
911	}
912
913	if (tp->t_pps != NULL) {
914		error = pps_ioctl(cmd, data, tp->t_pps);
915		if (error != ENOIOCTL)
916			return (error);
917	}
918
919	switch (cmd) {			/* Process the ioctl. */
920	case FIOASYNC:			/* set/clear async i/o */
921		s = spltty();
922		if (*(int *)data)
923			SET(tp->t_state, TS_ASYNC);
924		else
925			CLR(tp->t_state, TS_ASYNC);
926		splx(s);
927		break;
928	case FIONBIO:			/* set/clear non-blocking i/o */
929		break;			/* XXX: delete. */
930	case FIONREAD:			/* get # bytes to read */
931		s = spltty();
932		*(int *)data = ttnread(tp);
933		splx(s);
934		break;
935
936	case FIOSETOWN:
937		/*
938		 * Policy -- Don't allow FIOSETOWN on someone else's
939		 *           controlling tty
940		 */
941		if (tp->t_session != NULL && !isctty(p, tp))
942			return (ENOTTY);
943
944		error = fsetown(*(int *)data, &tp->t_sigio);
945		if (error)
946			return (error);
947		break;
948	case FIOGETOWN:
949		if (tp->t_session != NULL && !isctty(p, tp))
950			return (ENOTTY);
951		*(int *)data = fgetown(&tp->t_sigio);
952		break;
953
954	case TIOCEXCL:			/* set exclusive use of tty */
955		s = spltty();
956		SET(tp->t_state, TS_XCLUDE);
957		splx(s);
958		break;
959	case TIOCFLUSH: {		/* flush buffers */
960		int flags = *(int *)data;
961
962		if (flags == 0)
963			flags = FREAD | FWRITE;
964		else
965			flags &= FREAD | FWRITE;
966		ttyflush(tp, flags);
967		break;
968	}
969	case TIOCCONS:			/* become virtual console */
970		if (*(int *)data) {
971			struct nameidata nid;
972
973			if (constty && constty != tp &&
974			    ISSET(constty->t_state, TS_CONNECTED))
975				return (EBUSY);
976
977			/* Ensure user can open the real console. */
978			NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
979			    "/dev/console", td);
980			if ((error = namei(&nid)) != 0)
981				return (error);
982			NDFREE(&nid, NDF_ONLY_PNBUF);
983			error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
984			vput(nid.ni_vp);
985			if (error)
986				return (error);
987
988			constty_set(tp);
989		} else if (tp == constty)
990			constty_clear();
991		break;
992	case TIOCDRAIN:			/* wait till output drained */
993		error = ttywait(tp);
994		if (error)
995			return (error);
996		break;
997	case TIOCGETA: {		/* get termios struct */
998		struct termios *t = (struct termios *)data;
999
1000		bcopy(&tp->t_termios, t, sizeof(struct termios));
1001		break;
1002	}
1003	case TIOCGETD:			/* get line discipline */
1004		*(int *)data = tp->t_line;
1005		break;
1006	case TIOCGWINSZ:		/* get window size */
1007		*(struct winsize *)data = tp->t_winsize;
1008		break;
1009	case TIOCGPGRP:			/* get pgrp of tty */
1010		if (!isctty(p, tp))
1011			return (ENOTTY);
1012		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1013		break;
1014	case TIOCGSID:                  /* get sid of tty */
1015		if (!isctty(p, tp))
1016			return (ENOTTY);
1017		*(int *)data = tp->t_session->s_sid;
1018		break;
1019#ifdef TIOCHPCL
1020	case TIOCHPCL:			/* hang up on last close */
1021		s = spltty();
1022		SET(tp->t_cflag, HUPCL);
1023		splx(s);
1024		break;
1025#endif
1026	case TIOCMGDTRWAIT:
1027		*(int *)data = tp->t_dtr_wait * 100 / hz;
1028		break;
1029	case TIOCMSDTRWAIT:
1030		/* must be root since the wait applies to following logins */
1031		error = priv_check(td, PRIV_TTY_DTRWAIT);
1032		if (error)
1033			return (error);
1034		tp->t_dtr_wait = *(int *)data * hz / 100;
1035		break;
1036	case TIOCNXCL:			/* reset exclusive use of tty */
1037		s = spltty();
1038		CLR(tp->t_state, TS_XCLUDE);
1039		splx(s);
1040		break;
1041	case TIOCOUTQ:			/* output queue size */
1042		*(int *)data = tp->t_outq.c_cc;
1043		break;
1044	case TIOCSETA:			/* set termios struct */
1045	case TIOCSETAW:			/* drain output, set */
1046	case TIOCSETAF: {		/* drn out, fls in, set */
1047		struct termios *t = (struct termios *)data;
1048
1049		if (t->c_ispeed == 0)
1050			t->c_ispeed = t->c_ospeed;
1051		if (t->c_ispeed == 0)
1052			t->c_ispeed = tp->t_ospeed;
1053		if (t->c_ispeed == 0)
1054			return (EINVAL);
1055		s = spltty();
1056		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1057			error = ttywait(tp);
1058			if (error) {
1059				splx(s);
1060				return (error);
1061			}
1062			if (cmd == TIOCSETAF)
1063				ttyflush(tp, FREAD);
1064		}
1065		if (!ISSET(t->c_cflag, CIGNORE)) {
1066			/*
1067			 * Set device hardware.
1068			 */
1069			error = tt_param(tp, t);
1070			if (error) {
1071				splx(s);
1072				return (error);
1073			}
1074			if (ISSET(t->c_cflag, CLOCAL) &&
1075			    !ISSET(tp->t_cflag, CLOCAL)) {
1076				/*
1077				 * XXX disconnections would be too hard to
1078				 * get rid of without this kludge.  The only
1079				 * way to get rid of controlling terminals
1080				 * is to exit from the session leader.
1081				 */
1082				CLR(tp->t_state, TS_ZOMBIE);
1083
1084				wakeup(TSA_CARR_ON(tp));
1085				ttwakeup(tp);
1086				ttwwakeup(tp);
1087			}
1088			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1089			     ISSET(t->c_cflag, CLOCAL)) &&
1090			    !ISSET(tp->t_state, TS_ZOMBIE))
1091				SET(tp->t_state, TS_CONNECTED);
1092			else
1093				CLR(tp->t_state, TS_CONNECTED);
1094			tp->t_cflag = t->c_cflag;
1095			tp->t_ispeed = t->c_ispeed;
1096			if (t->c_ospeed != 0)
1097				tp->t_ospeed = t->c_ospeed;
1098			ttsetwater(tp);
1099		}
1100		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1101		    cmd != TIOCSETAF) {
1102			if (ISSET(t->c_lflag, ICANON))
1103				SET(tp->t_lflag, PENDIN);
1104			else {
1105				/*
1106				 * XXX we really shouldn't allow toggling
1107				 * ICANON while we're in a non-termios line
1108				 * discipline.  Now we have to worry about
1109				 * panicing for a null queue.
1110				 */
1111				if (tp->t_canq.c_cbreserved > 0 &&
1112				    tp->t_rawq.c_cbreserved > 0) {
1113					catq(&tp->t_rawq, &tp->t_canq);
1114					/*
1115					 * XXX the queue limits may be
1116					 * different, so the old queue
1117					 * swapping method no longer works.
1118					 */
1119					catq(&tp->t_canq, &tp->t_rawq);
1120				}
1121				CLR(tp->t_lflag, PENDIN);
1122			}
1123			ttwakeup(tp);
1124		}
1125		tp->t_iflag = t->c_iflag;
1126		tp->t_oflag = t->c_oflag;
1127		/*
1128		 * Make the EXTPROC bit read only.
1129		 */
1130		if (ISSET(tp->t_lflag, EXTPROC))
1131			SET(t->c_lflag, EXTPROC);
1132		else
1133			CLR(t->c_lflag, EXTPROC);
1134		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1135		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1136		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1137			ttwakeup(tp);
1138		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1139		splx(s);
1140		break;
1141	}
1142	case TIOCSETD: {		/* set line discipline */
1143		int t = *(int *)data;
1144
1145		if ((u_int)t >= nlinesw)
1146			return (ENXIO);
1147		if (t == tp->t_line)
1148			return (0);
1149		s = spltty();
1150		ttyld_close(tp, flag);
1151		tp->t_line = t;
1152		/* XXX: we should use the correct cdev here */
1153		error = ttyld_open(tp, tp->t_dev);
1154		if (error) {
1155			/*
1156			 * If we fail to switch line discipline we cannot
1157			 * fall back to the previous, because we can not
1158			 * trust that ldisc to open successfully either.
1159			 * Fall back to the default ldisc which we know
1160			 * will allways succeed.
1161			 */
1162			tp->t_line = TTYDISC;
1163			(void)ttyld_open(tp, tp->t_dev);
1164		}
1165		splx(s);
1166		return (error);
1167		break;
1168	}
1169	case TIOCSTART:			/* start output, like ^Q */
1170		s = spltty();
1171		if (ISSET(tp->t_state, TS_TTSTOP) ||
1172		    ISSET(tp->t_lflag, FLUSHO)) {
1173			CLR(tp->t_lflag, FLUSHO);
1174			CLR(tp->t_state, TS_TTSTOP);
1175			ttstart(tp);
1176		}
1177		splx(s);
1178		break;
1179	case TIOCSTI:			/* simulate terminal input */
1180		if ((flag & FREAD) == 0 && priv_check(td, PRIV_TTY_STI))
1181			return (EPERM);
1182		if (!isctty(p, tp) && priv_check(td, PRIV_TTY_STI))
1183			return (EACCES);
1184		s = spltty();
1185		ttyld_rint(tp, *(u_char *)data);
1186		splx(s);
1187		break;
1188	case TIOCSTOP:			/* stop output, like ^S */
1189		s = spltty();
1190		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1191			SET(tp->t_state, TS_TTSTOP);
1192			tt_stop(tp, 0);
1193		}
1194		splx(s);
1195		break;
1196	case TIOCSCTTY:			/* become controlling tty */
1197		/* Session ctty vnode pointer set in vnode layer. */
1198		sx_slock(&proctree_lock);
1199		if (!SESS_LEADER(p) ||
1200		    ((p->p_session->s_ttyvp || tp->t_session) &&
1201		     (tp->t_session != p->p_session))) {
1202			sx_sunlock(&proctree_lock);
1203			return (EPERM);
1204		}
1205		tp->t_session = p->p_session;
1206		tp->t_pgrp = p->p_pgrp;
1207		SESS_LOCK(p->p_session);
1208		ttyref(tp);		/* ttyrel(): kern_proc.c:pgdelete() */
1209		p->p_session->s_ttyp = tp;
1210		SESS_UNLOCK(p->p_session);
1211		PROC_LOCK(p);
1212		p->p_flag |= P_CONTROLT;
1213		PROC_UNLOCK(p);
1214		sx_sunlock(&proctree_lock);
1215		break;
1216	case TIOCSPGRP: {		/* set pgrp of tty */
1217		sx_slock(&proctree_lock);
1218		pgrp = pgfind(*(int *)data);
1219		if (!isctty(p, tp)) {
1220			if (pgrp != NULL)
1221				PGRP_UNLOCK(pgrp);
1222			sx_sunlock(&proctree_lock);
1223			return (ENOTTY);
1224		}
1225		if (pgrp == NULL) {
1226			sx_sunlock(&proctree_lock);
1227			return (EPERM);
1228		}
1229		PGRP_UNLOCK(pgrp);
1230		if (pgrp->pg_session != p->p_session) {
1231			sx_sunlock(&proctree_lock);
1232			return (EPERM);
1233		}
1234		sx_sunlock(&proctree_lock);
1235		tp->t_pgrp = pgrp;
1236		break;
1237	}
1238	case TIOCSTAT:			/* simulate control-T */
1239		s = spltty();
1240		ttyinfo(tp);
1241		splx(s);
1242		break;
1243	case TIOCSWINSZ:		/* set window size */
1244		if (bcmp((caddr_t)&tp->t_winsize, data,
1245		    sizeof (struct winsize))) {
1246			tp->t_winsize = *(struct winsize *)data;
1247			if (tp->t_pgrp != NULL) {
1248				PGRP_LOCK(tp->t_pgrp);
1249				pgsignal(tp->t_pgrp, SIGWINCH, 1);
1250				PGRP_UNLOCK(tp->t_pgrp);
1251			}
1252		}
1253		break;
1254	case TIOCSDRAINWAIT:
1255		error = priv_check(td, PRIV_TTY_DRAINWAIT);
1256		if (error)
1257			return (error);
1258		tp->t_timeout = *(int *)data * hz;
1259		wakeup(TSA_OCOMPLETE(tp));
1260		wakeup(TSA_OLOWAT(tp));
1261		break;
1262	case TIOCGDRAINWAIT:
1263		*(int *)data = tp->t_timeout / hz;
1264		break;
1265	case TIOCSBRK:
1266		return (tt_break(tp, 1));
1267	case TIOCCBRK:
1268		return (tt_break(tp, 0));
1269	default:
1270#if defined(COMPAT_43TTY)
1271		return (ttcompat(tp, cmd, data, flag));
1272#else
1273		return (ENOIOCTL);
1274#endif
1275	}
1276	return (0);
1277}
1278
1279int
1280ttypoll(struct cdev *dev, int events, struct thread *td)
1281{
1282	int s;
1283	int revents = 0;
1284	struct tty *tp;
1285
1286	tp = tty_gettp(dev);
1287
1288	if (tp == NULL)	/* XXX used to return ENXIO, but that means true! */
1289		return ((events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM))
1290			| POLLHUP);
1291
1292	s = spltty();
1293	if (events & (POLLIN | POLLRDNORM)) {
1294		if (ISSET(tp->t_state, TS_ZOMBIE))
1295			revents |= (events & (POLLIN | POLLRDNORM)) |
1296			    POLLHUP;
1297		else if (ttnread(tp) > 0)
1298			revents |= events & (POLLIN | POLLRDNORM);
1299		else
1300			selrecord(td, &tp->t_rsel);
1301	}
1302	if (events & POLLOUT) {
1303		if (ISSET(tp->t_state, TS_ZOMBIE))
1304			revents |= POLLHUP;
1305		else if (tp->t_outq.c_cc <= tp->t_olowat &&
1306		    ISSET(tp->t_state, TS_CONNECTED))
1307			revents |= events & POLLOUT;
1308		else
1309			selrecord(td, &tp->t_wsel);
1310	}
1311	splx(s);
1312	return (revents);
1313}
1314
1315static struct filterops ttyread_filtops =
1316	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1317static struct filterops ttywrite_filtops =
1318	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1319
1320int
1321ttykqfilter(struct cdev *dev, struct knote *kn)
1322{
1323	struct tty *tp;
1324	struct knlist *klist;
1325	int s;
1326
1327	tp = tty_gettp(dev);
1328	if (tp->t_state & TS_GONE)
1329		return (ENODEV);
1330
1331	switch (kn->kn_filter) {
1332	case EVFILT_READ:
1333		klist = &tp->t_rsel.si_note;
1334		kn->kn_fop = &ttyread_filtops;
1335		break;
1336	case EVFILT_WRITE:
1337		klist = &tp->t_wsel.si_note;
1338		kn->kn_fop = &ttywrite_filtops;
1339		break;
1340	default:
1341		return (EINVAL);
1342	}
1343
1344	kn->kn_hook = (caddr_t)tp;
1345
1346	s = spltty();
1347	knlist_add(klist, kn, 0);
1348	splx(s);
1349
1350	return (0);
1351}
1352
1353static void
1354filt_ttyrdetach(struct knote *kn)
1355{
1356	struct tty *tp = (struct tty *)kn->kn_hook;
1357	int s = spltty();
1358
1359	knlist_remove(&tp->t_rsel.si_note, kn, 0);
1360	splx(s);
1361}
1362
1363static int
1364filt_ttyread(struct knote *kn, long hint)
1365{
1366	struct tty *tp = (struct tty *)kn->kn_hook;
1367
1368	kn->kn_data = ttnread(tp);
1369	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE)) {
1370		kn->kn_flags |= EV_EOF;
1371		return (1);
1372	}
1373	return (kn->kn_data > 0);
1374}
1375
1376static void
1377filt_ttywdetach(struct knote *kn)
1378{
1379	struct tty *tp = (struct tty *)kn->kn_hook;
1380	int s = spltty();
1381
1382	knlist_remove(&tp->t_wsel.si_note, kn, 0);
1383	splx(s);
1384}
1385
1386static int
1387filt_ttywrite(struct knote *kn, long hint)
1388{
1389	struct tty *tp = (struct tty *)kn->kn_hook;
1390
1391	kn->kn_data = tp->t_outq.c_cc;
1392	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE))
1393		return (1);
1394	return (kn->kn_data <= tp->t_olowat &&
1395	    ISSET(tp->t_state, TS_CONNECTED));
1396}
1397
1398/*
1399 * Must be called at spltty().
1400 */
1401static int
1402ttnread(struct tty *tp)
1403{
1404	int nread;
1405
1406	if (ISSET(tp->t_lflag, PENDIN))
1407		ttypend(tp);
1408	nread = tp->t_canq.c_cc;
1409	if (!ISSET(tp->t_lflag, ICANON)) {
1410		nread += tp->t_rawq.c_cc;
1411		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1412			nread = 0;
1413	}
1414	return (nread);
1415}
1416
1417/*
1418 * Wait for output to drain.
1419 */
1420int
1421ttywait(struct tty *tp)
1422{
1423	int error, s;
1424
1425	error = 0;
1426	s = spltty();
1427	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1428	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1429		tt_oproc(tp);
1430		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1431		    ISSET(tp->t_state, TS_CONNECTED)) {
1432			SET(tp->t_state, TS_SO_OCOMPLETE);
1433			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1434					 TTOPRI | PCATCH, "ttywai",
1435					 tp->t_timeout);
1436			if (error) {
1437				if (error == EWOULDBLOCK)
1438					error = EIO;
1439				break;
1440			}
1441		} else
1442			break;
1443	}
1444	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1445		error = EIO;
1446	splx(s);
1447	return (error);
1448}
1449
1450/*
1451 * Flush if successfully wait.
1452 */
1453static int
1454ttywflush(struct tty *tp)
1455{
1456	int error;
1457
1458	if ((error = ttywait(tp)) == 0)
1459		ttyflush(tp, FREAD);
1460	return (error);
1461}
1462
1463/*
1464 * Flush tty read and/or write queues, notifying anyone waiting.
1465 */
1466void
1467ttyflush(struct tty *tp, int rw)
1468{
1469	int s;
1470
1471	s = spltty();
1472#if 0
1473again:
1474#endif
1475	if (rw & FWRITE) {
1476		FLUSHQ(&tp->t_outq);
1477		CLR(tp->t_state, TS_TTSTOP);
1478	}
1479	tt_stop(tp, rw);
1480	if (rw & FREAD) {
1481		FLUSHQ(&tp->t_canq);
1482		FLUSHQ(&tp->t_rawq);
1483		CLR(tp->t_lflag, PENDIN);
1484		tp->t_rocount = 0;
1485		tp->t_rocol = 0;
1486		CLR(tp->t_state, TS_LOCAL);
1487		ttwakeup(tp);
1488		if (ISSET(tp->t_state, TS_TBLOCK)) {
1489			if (rw & FWRITE)
1490				FLUSHQ(&tp->t_outq);
1491			ttyunblock(tp);
1492
1493			/*
1494			 * Don't let leave any state that might clobber the
1495			 * next line discipline (although we should do more
1496			 * to send the START char).  Not clearing the state
1497			 * may have caused the "putc to a clist with no
1498			 * reserved cblocks" panic/printf.
1499			 */
1500			CLR(tp->t_state, TS_TBLOCK);
1501
1502#if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1503			if (ISSET(tp->t_iflag, IXOFF)) {
1504				/*
1505				 * XXX wait a bit in the hope that the stop
1506				 * character (if any) will go out.  Waiting
1507				 * isn't good since it allows races.  This
1508				 * will be fixed when the stop character is
1509				 * put in a special queue.  Don't bother with
1510				 * the checks in ttywait() since the timeout
1511				 * will save us.
1512				 */
1513				SET(tp->t_state, TS_SO_OCOMPLETE);
1514				ttysleep(tp, TSA_OCOMPLETE(tp), TTOPRI,
1515					 "ttyfls", hz / 10);
1516				/*
1517				 * Don't try sending the stop character again.
1518				 */
1519				CLR(tp->t_state, TS_TBLOCK);
1520				goto again;
1521			}
1522#endif
1523		}
1524	}
1525	if (rw & FWRITE) {
1526		FLUSHQ(&tp->t_outq);
1527		ttwwakeup(tp);
1528	}
1529	splx(s);
1530}
1531
1532/*
1533 * Copy in the default termios characters.
1534 */
1535void
1536termioschars(struct termios *t)
1537{
1538
1539	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1540}
1541
1542/*
1543 * Old interface.
1544 */
1545void
1546ttychars(struct tty *tp)
1547{
1548
1549	termioschars(&tp->t_termios);
1550}
1551
1552/*
1553 * Handle input high water.  Send stop character for the IXOFF case.  Turn
1554 * on our input flow control bit and propagate the changes to the driver.
1555 * XXX the stop character should be put in a special high priority queue.
1556 */
1557void
1558ttyblock(struct tty *tp)
1559{
1560
1561	SET(tp->t_state, TS_TBLOCK);
1562	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1563	    putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1564		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1565	ttstart(tp);
1566}
1567
1568/*
1569 * Handle input low water.  Send start character for the IXOFF case.  Turn
1570 * off our input flow control bit and propagate the changes to the driver.
1571 * XXX the start character should be put in a special high priority queue.
1572 */
1573static void
1574ttyunblock(struct tty *tp)
1575{
1576
1577	CLR(tp->t_state, TS_TBLOCK);
1578	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1579	    putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1580		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1581	ttstart(tp);
1582}
1583
1584#ifdef notyet
1585/* Not used by any current (i386) drivers. */
1586/*
1587 * Restart after an inter-char delay.
1588 */
1589void
1590ttrstrt(void *tp_arg)
1591{
1592	struct tty *tp;
1593	int s;
1594
1595	KASSERT(tp_arg != NULL, ("ttrstrt"));
1596
1597	tp = tp_arg;
1598	s = spltty();
1599
1600	CLR(tp->t_state, TS_TIMEOUT);
1601	ttstart(tp);
1602
1603	splx(s);
1604}
1605#endif
1606
1607int
1608ttstart(struct tty *tp)
1609{
1610
1611	tt_oproc(tp);
1612	return (0);
1613}
1614
1615/*
1616 * "close" a line discipline
1617 */
1618int
1619ttylclose(struct tty *tp, int flag)
1620{
1621
1622	if (flag & FNONBLOCK || ttywflush(tp))
1623		ttyflush(tp, FREAD | FWRITE);
1624	return (0);
1625}
1626
1627/*
1628 * Handle modem control transition on a tty.
1629 * Flag indicates new state of carrier.
1630 * Returns 0 if the line should be turned off, otherwise 1.
1631 */
1632int
1633ttymodem(struct tty *tp, int flag)
1634{
1635
1636	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1637		/*
1638		 * MDMBUF: do flow control according to carrier flag
1639		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1640		 * works if IXON and IXANY are clear.
1641		 */
1642		if (flag) {
1643			CLR(tp->t_state, TS_CAR_OFLOW);
1644			CLR(tp->t_state, TS_TTSTOP);
1645			ttstart(tp);
1646		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1647			SET(tp->t_state, TS_CAR_OFLOW);
1648			SET(tp->t_state, TS_TTSTOP);
1649			tt_stop(tp, 0);
1650		}
1651	} else if (flag == 0) {
1652		/*
1653		 * Lost carrier.
1654		 */
1655		CLR(tp->t_state, TS_CARR_ON);
1656		if (ISSET(tp->t_state, TS_ISOPEN) &&
1657		    !ISSET(tp->t_cflag, CLOCAL)) {
1658			SET(tp->t_state, TS_ZOMBIE);
1659			CLR(tp->t_state, TS_CONNECTED);
1660			if (tp->t_session) {
1661				sx_slock(&proctree_lock);
1662				if (tp->t_session && tp->t_session->s_leader) {
1663					struct proc *p;
1664
1665					p = tp->t_session->s_leader;
1666					PROC_LOCK(p);
1667					psignal(p, SIGHUP);
1668					PROC_UNLOCK(p);
1669				}
1670				sx_sunlock(&proctree_lock);
1671			}
1672			ttyflush(tp, FREAD | FWRITE);
1673			return (0);
1674		}
1675	} else {
1676		/*
1677		 * Carrier now on.
1678		 */
1679		SET(tp->t_state, TS_CARR_ON);
1680		if (!ISSET(tp->t_state, TS_ZOMBIE))
1681			SET(tp->t_state, TS_CONNECTED);
1682		wakeup(TSA_CARR_ON(tp));
1683		ttwakeup(tp);
1684		ttwwakeup(tp);
1685	}
1686	return (1);
1687}
1688
1689/*
1690 * Reinput pending characters after state switch
1691 * call at spltty().
1692 */
1693static void
1694ttypend(struct tty *tp)
1695{
1696	struct clist tq;
1697	int c;
1698
1699	CLR(tp->t_lflag, PENDIN);
1700	SET(tp->t_state, TS_TYPEN);
1701	/*
1702	 * XXX this assumes too much about clist internals.  It may even
1703	 * fail if the cblock slush pool is empty.  We can't allocate more
1704	 * cblocks here because we are called from an interrupt handler
1705	 * and clist_alloc_cblocks() can wait.
1706	 */
1707	tq = tp->t_rawq;
1708	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1709	tp->t_rawq.c_cbmax = tq.c_cbmax;
1710	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1711	while ((c = getc(&tq)) >= 0)
1712		ttyinput(c, tp);
1713	CLR(tp->t_state, TS_TYPEN);
1714}
1715
1716/*
1717 * Process a read call on a tty device.
1718 */
1719int
1720ttread(struct tty *tp, struct uio *uio, int flag)
1721{
1722	struct clist *qp;
1723	int c;
1724	tcflag_t lflag;
1725	cc_t *cc = tp->t_cc;
1726	struct thread *td;
1727	struct proc *p;
1728	int s, first, error = 0;
1729	int has_stime = 0, last_cc = 0;
1730	long slp = 0;		/* XXX this should be renamed `timo'. */
1731	struct timeval stime = { 0, 0 };
1732	struct pgrp *pg;
1733
1734	td = curthread;
1735	p = td->td_proc;
1736loop:
1737	s = spltty();
1738	lflag = tp->t_lflag;
1739	/*
1740	 * take pending input first
1741	 */
1742	if (ISSET(lflag, PENDIN)) {
1743		ttypend(tp);
1744		splx(s);	/* reduce latency */
1745		s = spltty();
1746		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1747	}
1748
1749	/*
1750	 * Hang process if it's in the background.
1751	 */
1752	if (isbackground(p, tp)) {
1753		splx(s);
1754		sx_slock(&proctree_lock);
1755		PROC_LOCK(p);
1756		if (SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTIN) ||
1757		    SIGISMEMBER(td->td_sigmask, SIGTTIN) ||
1758		    (p->p_flag & P_PPWAIT) || p->p_pgrp->pg_jobc == 0) {
1759			PROC_UNLOCK(p);
1760			sx_sunlock(&proctree_lock);
1761			return (EIO);
1762		}
1763		pg = p->p_pgrp;
1764		PROC_UNLOCK(p);
1765		PGRP_LOCK(pg);
1766		sx_sunlock(&proctree_lock);
1767		pgsignal(pg, SIGTTIN, 1);
1768		PGRP_UNLOCK(pg);
1769		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg2", 0);
1770		if (error)
1771			return (error);
1772		goto loop;
1773	}
1774
1775	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1776		splx(s);
1777		return (0);	/* EOF */
1778	}
1779
1780	/*
1781	 * If canonical, use the canonical queue,
1782	 * else use the raw queue.
1783	 *
1784	 * (should get rid of clists...)
1785	 */
1786	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1787
1788	if (flag & IO_NDELAY) {
1789		if (qp->c_cc > 0)
1790			goto read;
1791		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1792			splx(s);
1793			return (0);
1794		}
1795		splx(s);
1796		return (EWOULDBLOCK);
1797	}
1798	if (!ISSET(lflag, ICANON)) {
1799		int m = cc[VMIN];
1800		long t = cc[VTIME];
1801		struct timeval timecopy;
1802
1803		/*
1804		 * Check each of the four combinations.
1805		 * (m > 0 && t == 0) is the normal read case.
1806		 * It should be fairly efficient, so we check that and its
1807		 * companion case (m == 0 && t == 0) first.
1808		 * For the other two cases, we compute the target sleep time
1809		 * into slp.
1810		 */
1811		if (t == 0) {
1812			if (qp->c_cc < m)
1813				goto sleep;
1814			if (qp->c_cc > 0)
1815				goto read;
1816
1817			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1818			splx(s);
1819			return (0);
1820		}
1821		t *= 100000;		/* time in us */
1822#define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1823			 ((t1).tv_usec - (t2).tv_usec))
1824		if (m > 0) {
1825			if (qp->c_cc <= 0)
1826				goto sleep;
1827			if (qp->c_cc >= m)
1828				goto read;
1829			getmicrotime(&timecopy);
1830			if (!has_stime) {
1831				/* first character, start timer */
1832				has_stime = 1;
1833				stime = timecopy;
1834				slp = t;
1835			} else if (qp->c_cc > last_cc) {
1836				/* got a character, restart timer */
1837				stime = timecopy;
1838				slp = t;
1839			} else {
1840				/* nothing, check expiration */
1841				slp = t - diff(timecopy, stime);
1842				if (slp <= 0)
1843					goto read;
1844			}
1845			last_cc = qp->c_cc;
1846		} else {	/* m == 0 */
1847			if (qp->c_cc > 0)
1848				goto read;
1849			getmicrotime(&timecopy);
1850			if (!has_stime) {
1851				has_stime = 1;
1852				stime = timecopy;
1853				slp = t;
1854			} else {
1855				slp = t - diff(timecopy, stime);
1856				if (slp <= 0) {
1857					/* Timed out, but 0 is enough input. */
1858					splx(s);
1859					return (0);
1860				}
1861			}
1862		}
1863#undef diff
1864		if (slp != 0) {
1865			struct timeval tv;	/* XXX style bug. */
1866
1867			tv.tv_sec = slp / 1000000;
1868			tv.tv_usec = slp % 1000000;
1869			slp = tvtohz(&tv);
1870			/*
1871			 * XXX bad variable names.  slp was the timeout in
1872			 * usec.  Now it is the timeout in ticks.
1873			 */
1874		}
1875		goto sleep;
1876	}
1877	if (qp->c_cc <= 0) {
1878sleep:
1879		/*
1880		 * There is no input, or not enough input and we can block.
1881		 */
1882		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), TTIPRI | PCATCH,
1883				 ISSET(tp->t_state, TS_CONNECTED) ?
1884				 "ttyin" : "ttyhup", (int)slp);
1885		splx(s);
1886		if (error == EWOULDBLOCK)
1887			error = 0;
1888		else if (error)
1889			return (error);
1890		/*
1891		 * XXX what happens if another process eats some input
1892		 * while we are asleep (not just here)?  It would be
1893		 * safest to detect changes and reset our state variables
1894		 * (has_stime and last_cc).
1895		 */
1896		slp = 0;
1897		goto loop;
1898	}
1899read:
1900	splx(s);
1901	/*
1902	 * Input present, check for input mapping and processing.
1903	 */
1904	first = 1;
1905	if (ISSET(lflag, ICANON | ISIG))
1906		goto slowcase;
1907	for (;;) {
1908		char ibuf[IBUFSIZ];
1909		int icc;
1910
1911		icc = imin(uio->uio_resid, IBUFSIZ);
1912		icc = q_to_b(qp, ibuf, icc);
1913		if (icc <= 0) {
1914			if (first)
1915				goto loop;
1916			break;
1917		}
1918		error = uiomove(ibuf, icc, uio);
1919		/*
1920		 * XXX if there was an error then we should ungetc() the
1921		 * unmoved chars and reduce icc here.
1922		 */
1923		if (error)
1924			break;
1925		if (uio->uio_resid == 0)
1926			break;
1927		first = 0;
1928	}
1929	goto out;
1930slowcase:
1931	for (;;) {
1932		c = getc(qp);
1933		if (c < 0) {
1934			if (first)
1935				goto loop;
1936			break;
1937		}
1938		/*
1939		 * delayed suspend (^Y)
1940		 */
1941		if (CCEQ(cc[VDSUSP], c) &&
1942		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1943			if (tp->t_pgrp != NULL) {
1944				PGRP_LOCK(tp->t_pgrp);
1945				pgsignal(tp->t_pgrp, SIGTSTP, 1);
1946				PGRP_UNLOCK(tp->t_pgrp);
1947			}
1948			if (first) {
1949				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
1950						 "ttybg3", 0);
1951				if (error)
1952					break;
1953				goto loop;
1954			}
1955			break;
1956		}
1957		/*
1958		 * Interpret EOF only in canonical mode.
1959		 */
1960		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1961			break;
1962		/*
1963		 * Give user character.
1964		 */
1965		error = ureadc(c, uio);
1966		if (error)
1967			/* XXX should ungetc(c, qp). */
1968			break;
1969		if (uio->uio_resid == 0)
1970			break;
1971		/*
1972		 * In canonical mode check for a "break character"
1973		 * marking the end of a "line of input".
1974		 */
1975		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1976			break;
1977		first = 0;
1978	}
1979
1980out:
1981	/*
1982	 * Look to unblock input now that (presumably)
1983	 * the input queue has gone down.
1984	 */
1985	s = spltty();
1986	if (ISSET(tp->t_state, TS_TBLOCK) &&
1987	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1988		ttyunblock(tp);
1989	splx(s);
1990
1991	return (error);
1992}
1993
1994/*
1995 * Check the output queue on tp for space for a kernel message (from uprintf
1996 * or tprintf).  Allow some space over the normal hiwater mark so we don't
1997 * lose messages due to normal flow control, but don't let the tty run amok.
1998 * Sleeps here are not interruptible, but we return prematurely if new signals
1999 * arrive.
2000 */
2001int
2002ttycheckoutq(struct tty *tp, int wait)
2003{
2004	int hiwat, s;
2005	sigset_t oldmask;
2006	struct thread *td;
2007	struct proc *p;
2008
2009	td = curthread;
2010	p = td->td_proc;
2011	hiwat = tp->t_ohiwat;
2012	SIGEMPTYSET(oldmask);
2013	s = spltty();
2014	if (wait) {
2015		PROC_LOCK(p);
2016		oldmask = td->td_siglist;
2017		PROC_UNLOCK(p);
2018	}
2019	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100)
2020		while (tp->t_outq.c_cc > hiwat) {
2021			ttstart(tp);
2022			if (tp->t_outq.c_cc <= hiwat)
2023				break;
2024			if (!wait) {
2025				splx(s);
2026				return (0);
2027			}
2028			PROC_LOCK(p);
2029			if (!SIGSETEQ(td->td_siglist, oldmask)) {
2030				PROC_UNLOCK(p);
2031				splx(s);
2032				return (0);
2033			}
2034			PROC_UNLOCK(p);
2035			SET(tp->t_state, TS_SO_OLOWAT);
2036			tsleep(TSA_OLOWAT(tp), PZERO - 1, "ttoutq", hz);
2037		}
2038	splx(s);
2039	return (1);
2040}
2041
2042/*
2043 * Process a write call on a tty device.
2044 */
2045int
2046ttwrite(struct tty *tp, struct uio *uio, int flag)
2047{
2048	char *cp = NULL;
2049	int cc, ce;
2050	struct thread *td;
2051	struct proc *p;
2052	int i, hiwat, cnt, error, s;
2053	char obuf[OBUFSIZ];
2054
2055	hiwat = tp->t_ohiwat;
2056	cnt = uio->uio_resid;
2057	error = 0;
2058	cc = 0;
2059	td = curthread;
2060	p = td->td_proc;
2061loop:
2062	s = spltty();
2063	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2064		splx(s);
2065		if (uio->uio_resid == cnt)
2066			error = EIO;
2067		goto out;
2068	}
2069	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2070		if (flag & IO_NDELAY) {
2071			splx(s);
2072			error = EWOULDBLOCK;
2073			goto out;
2074		}
2075		error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
2076				 "ttywdcd", 0);
2077		splx(s);
2078		if (error)
2079			goto out;
2080		goto loop;
2081	}
2082	splx(s);
2083	/*
2084	 * Hang the process if it's in the background.
2085	 */
2086	sx_slock(&proctree_lock);
2087	PROC_LOCK(p);
2088	if (isbackground(p, tp) &&
2089	    ISSET(tp->t_lflag, TOSTOP) && !(p->p_flag & P_PPWAIT) &&
2090	    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
2091	    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
2092		if (p->p_pgrp->pg_jobc == 0) {
2093			PROC_UNLOCK(p);
2094			sx_sunlock(&proctree_lock);
2095			error = EIO;
2096			goto out;
2097		}
2098		PROC_UNLOCK(p);
2099		PGRP_LOCK(p->p_pgrp);
2100		sx_sunlock(&proctree_lock);
2101		pgsignal(p->p_pgrp, SIGTTOU, 1);
2102		PGRP_UNLOCK(p->p_pgrp);
2103		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg4", 0);
2104		if (error)
2105			goto out;
2106		goto loop;
2107	} else {
2108		PROC_UNLOCK(p);
2109		sx_sunlock(&proctree_lock);
2110	}
2111	/*
2112	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2113	 * output translation.  Keep track of high water mark, sleep on
2114	 * overflow awaiting device aid in acquiring new space.
2115	 */
2116	while (uio->uio_resid > 0 || cc > 0) {
2117		if (ISSET(tp->t_lflag, FLUSHO)) {
2118			uio->uio_resid = 0;
2119			return (0);
2120		}
2121		if (tp->t_outq.c_cc > hiwat)
2122			goto ovhiwat;
2123		/*
2124		 * Grab a hunk of data from the user, unless we have some
2125		 * leftover from last time.
2126		 */
2127		if (cc == 0) {
2128			cc = imin(uio->uio_resid, OBUFSIZ);
2129			cp = obuf;
2130			error = uiomove(cp, cc, uio);
2131			if (error) {
2132				cc = 0;
2133				break;
2134			}
2135		}
2136		/*
2137		 * If nothing fancy need be done, grab those characters we
2138		 * can handle without any of ttyoutput's processing and
2139		 * just transfer them to the output q.  For those chars
2140		 * which require special processing (as indicated by the
2141		 * bits in char_type), call ttyoutput.  After processing
2142		 * a hunk of data, look for FLUSHO so ^O's will take effect
2143		 * immediately.
2144		 */
2145		while (cc > 0) {
2146			if (!ISSET(tp->t_oflag, OPOST))
2147				ce = cc;
2148			else {
2149				ce = cc - scanc((u_int)cc, (u_char *)cp,
2150						char_type, CCLASSMASK);
2151				/*
2152				 * If ce is zero, then we're processing
2153				 * a special character through ttyoutput.
2154				 */
2155				if (ce == 0) {
2156					tp->t_rocount = 0;
2157					if (ttyoutput(*cp, tp) >= 0) {
2158						/* No Clists, wait a bit. */
2159						ttstart(tp);
2160						if (flag & IO_NDELAY) {
2161							error = EWOULDBLOCK;
2162							goto out;
2163						}
2164						error = ttysleep(tp, &lbolt,
2165								 TTOPRI|PCATCH,
2166								 "ttybf1", 0);
2167						if (error)
2168							goto out;
2169						goto loop;
2170					}
2171					cp++;
2172					cc--;
2173					if (ISSET(tp->t_lflag, FLUSHO) ||
2174					    tp->t_outq.c_cc > hiwat)
2175						goto ovhiwat;
2176					continue;
2177				}
2178			}
2179			/*
2180			 * A bunch of normal characters have been found.
2181			 * Transfer them en masse to the output queue and
2182			 * continue processing at the top of the loop.
2183			 * If there are any further characters in this
2184			 * <= OBUFSIZ chunk, the first should be a character
2185			 * requiring special handling by ttyoutput.
2186			 */
2187			tp->t_rocount = 0;
2188			i = b_to_q(cp, ce, &tp->t_outq);
2189			ce -= i;
2190			tp->t_column += ce;
2191			cp += ce, cc -= ce, tk_nout += ce;
2192			tp->t_outcc += ce;
2193			if (i > 0) {
2194				/* No Clists, wait a bit. */
2195				ttstart(tp);
2196				if (flag & IO_NDELAY) {
2197					error = EWOULDBLOCK;
2198					goto out;
2199				}
2200				error = ttysleep(tp, &lbolt, TTOPRI | PCATCH,
2201						 "ttybf2", 0);
2202				if (error)
2203					goto out;
2204				goto loop;
2205			}
2206			if (ISSET(tp->t_lflag, FLUSHO) ||
2207			    tp->t_outq.c_cc > hiwat)
2208				break;
2209		}
2210		ttstart(tp);
2211	}
2212out:
2213	/*
2214	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2215	 * offset and iov pointers have moved forward, but it doesn't matter
2216	 * (the call will either return short or restart with a new uio).
2217	 */
2218	uio->uio_resid += cc;
2219	return (error);
2220
2221ovhiwat:
2222	ttstart(tp);
2223	s = spltty();
2224	/*
2225	 * This can only occur if FLUSHO is set in t_lflag,
2226	 * or if ttstart/oproc is synchronous (or very fast).
2227	 */
2228	if (tp->t_outq.c_cc <= hiwat) {
2229		splx(s);
2230		goto loop;
2231	}
2232	if (flag & IO_NDELAY) {
2233		splx(s);
2234		uio->uio_resid += cc;
2235		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2236	}
2237	SET(tp->t_state, TS_SO_OLOWAT);
2238	error = ttysleep(tp, TSA_OLOWAT(tp), TTOPRI | PCATCH, "ttywri",
2239			 tp->t_timeout);
2240	splx(s);
2241	if (error == EWOULDBLOCK)
2242		error = EIO;
2243	if (error)
2244		goto out;
2245	goto loop;
2246}
2247
2248/*
2249 * Rubout one character from the rawq of tp
2250 * as cleanly as possible.
2251 */
2252static void
2253ttyrub(int c, struct tty *tp)
2254{
2255	char *cp;
2256	int savecol;
2257	int tabc, s;
2258
2259	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2260		return;
2261	CLR(tp->t_lflag, FLUSHO);
2262	if (ISSET(tp->t_lflag, ECHOE)) {
2263		if (tp->t_rocount == 0) {
2264			/*
2265			 * Screwed by ttwrite; retype
2266			 */
2267			ttyretype(tp);
2268			return;
2269		}
2270		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2271			ttyrubo(tp, 2);
2272		else {
2273			CLR(c, ~TTY_CHARMASK);
2274			switch (CCLASS(c)) {
2275			case ORDINARY:
2276				ttyrubo(tp, 1);
2277				break;
2278			case BACKSPACE:
2279			case CONTROL:
2280			case NEWLINE:
2281			case RETURN:
2282			case VTAB:
2283				if (ISSET(tp->t_lflag, ECHOCTL))
2284					ttyrubo(tp, 2);
2285				break;
2286			case TAB:
2287				if (tp->t_rocount < tp->t_rawq.c_cc) {
2288					ttyretype(tp);
2289					return;
2290				}
2291				s = spltty();
2292				savecol = tp->t_column;
2293				SET(tp->t_state, TS_CNTTB);
2294				SET(tp->t_lflag, FLUSHO);
2295				tp->t_column = tp->t_rocol;
2296				cp = tp->t_rawq.c_cf;
2297				if (cp)
2298					tabc = *cp;	/* XXX FIX NEXTC */
2299				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2300					ttyecho(tabc, tp);
2301				CLR(tp->t_lflag, FLUSHO);
2302				CLR(tp->t_state, TS_CNTTB);
2303				splx(s);
2304
2305				/* savecol will now be length of the tab. */
2306				savecol -= tp->t_column;
2307				tp->t_column += savecol;
2308				if (savecol > 8)
2309					savecol = 8;	/* overflow screw */
2310				while (--savecol >= 0)
2311					(void)ttyoutput('\b', tp);
2312				break;
2313			default:			/* XXX */
2314#define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2315				(void)printf(PANICSTR, c, CCLASS(c));
2316#ifdef notdef
2317				panic(PANICSTR, c, CCLASS(c));
2318#endif
2319			}
2320		}
2321	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2322		if (!ISSET(tp->t_state, TS_ERASE)) {
2323			SET(tp->t_state, TS_ERASE);
2324			(void)ttyoutput('\\', tp);
2325		}
2326		ttyecho(c, tp);
2327	} else {
2328		ttyecho(tp->t_cc[VERASE], tp);
2329		/*
2330		 * This code may be executed not only when an ERASE key
2331		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2332		 * So, I didn't think it was worthwhile to pass the extra
2333		 * information (which would need an extra parameter,
2334		 * changing every call) needed to distinguish the ERASE2
2335		 * case from the ERASE.
2336		 */
2337	}
2338	--tp->t_rocount;
2339}
2340
2341/*
2342 * Back over cnt characters, erasing them.
2343 */
2344static void
2345ttyrubo(struct tty *tp, int cnt)
2346{
2347
2348	while (cnt-- > 0) {
2349		(void)ttyoutput('\b', tp);
2350		(void)ttyoutput(' ', tp);
2351		(void)ttyoutput('\b', tp);
2352	}
2353}
2354
2355/*
2356 * ttyretype --
2357 *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2358 *	been checked.
2359 */
2360static void
2361ttyretype(struct tty *tp)
2362{
2363	char *cp;
2364	int s, c;
2365
2366	/* Echo the reprint character. */
2367	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2368		ttyecho(tp->t_cc[VREPRINT], tp);
2369
2370	(void)ttyoutput('\n', tp);
2371
2372	/*
2373	 * XXX
2374	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2375	 * BIT OF FIRST CHAR.
2376	 */
2377	s = spltty();
2378	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2379	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2380		ttyecho(c, tp);
2381	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2382	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2383		ttyecho(c, tp);
2384	CLR(tp->t_state, TS_ERASE);
2385	splx(s);
2386
2387	tp->t_rocount = tp->t_rawq.c_cc;
2388	tp->t_rocol = 0;
2389}
2390
2391/*
2392 * Echo a typed character to the terminal.
2393 */
2394static void
2395ttyecho(int c, struct tty *tp)
2396{
2397
2398	if (!ISSET(tp->t_state, TS_CNTTB))
2399		CLR(tp->t_lflag, FLUSHO);
2400	if ((!ISSET(tp->t_lflag, ECHO) &&
2401	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2402	    ISSET(tp->t_lflag, EXTPROC))
2403		return;
2404	if (ISSET(tp->t_lflag, ECHOCTL) &&
2405	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2406	    ISSET(c, TTY_CHARMASK) == 0177)) {
2407		(void)ttyoutput('^', tp);
2408		CLR(c, ~TTY_CHARMASK);
2409		if (c == 0177)
2410			c = '?';
2411		else
2412			c += 'A' - 1;
2413	}
2414	(void)ttyoutput(c, tp);
2415}
2416
2417/*
2418 * Wake up any readers on a tty.
2419 */
2420void
2421ttwakeup(struct tty *tp)
2422{
2423
2424	if (SEL_WAITING(&tp->t_rsel))
2425		selwakeuppri(&tp->t_rsel, TTIPRI);
2426	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2427		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2428	wakeup(TSA_HUP_OR_INPUT(tp));
2429	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
2430}
2431
2432/*
2433 * Wake up any writers on a tty.
2434 */
2435void
2436ttwwakeup(struct tty *tp)
2437{
2438
2439	if (SEL_WAITING(&tp->t_wsel) && tp->t_outq.c_cc <= tp->t_olowat)
2440		selwakeuppri(&tp->t_wsel, TTOPRI);
2441	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2442		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2443	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2444	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2445		CLR(tp->t_state, TS_SO_OCOMPLETE);
2446		wakeup(TSA_OCOMPLETE(tp));
2447	}
2448	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2449	    tp->t_outq.c_cc <= tp->t_olowat) {
2450		CLR(tp->t_state, TS_SO_OLOWAT);
2451		wakeup(TSA_OLOWAT(tp));
2452	}
2453	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
2454}
2455
2456/*
2457 * Look up a code for a specified speed in a conversion table;
2458 * used by drivers to map software speed values to hardware parameters.
2459 */
2460int
2461ttspeedtab(int speed, struct speedtab *table)
2462{
2463
2464	for ( ; table->sp_speed != -1; table++)
2465		if (table->sp_speed == speed)
2466			return (table->sp_code);
2467	return (-1);
2468}
2469
2470/*
2471 * Set input and output watermarks and buffer sizes.  For input, the
2472 * high watermark is about one second's worth of input above empty, the
2473 * low watermark is slightly below high water, and the buffer size is a
2474 * driver-dependent amount above high water.  For output, the watermarks
2475 * are near the ends of the buffer, with about 1 second's worth of input
2476 * between them.  All this only applies to the standard line discipline.
2477 */
2478void
2479ttsetwater(struct tty *tp)
2480{
2481	int cps, ttmaxhiwat, x;
2482
2483	/* Input. */
2484	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2485	switch (tp->t_ispeedwat) {
2486	case (speed_t)-1:
2487		cps = tp->t_ispeed / 10;
2488		break;
2489	case 0:
2490		/*
2491		 * This case is for old drivers that don't know about
2492		 * t_ispeedwat.  Arrange for them to get the old buffer
2493		 * sizes and watermarks.
2494		 */
2495		cps = TTYHOG - 2 * 256;
2496		tp->t_ififosize = 2 * 256;
2497		break;
2498	default:
2499		cps = tp->t_ispeedwat / 10;
2500		break;
2501	}
2502	tp->t_ihiwat = cps;
2503	tp->t_ilowat = 7 * cps / 8;
2504	x = cps + tp->t_ififosize;
2505	clist_alloc_cblocks(&tp->t_rawq, x, x);
2506
2507	/* Output. */
2508	switch (tp->t_ospeedwat) {
2509	case (speed_t)-1:
2510		cps = tp->t_ospeed / 10;
2511		ttmaxhiwat = 2 * TTMAXHIWAT;
2512		break;
2513	case 0:
2514		cps = tp->t_ospeed / 10;
2515		ttmaxhiwat = TTMAXHIWAT;
2516		break;
2517	default:
2518		cps = tp->t_ospeedwat / 10;
2519		ttmaxhiwat = 8 * TTMAXHIWAT;
2520		break;
2521	}
2522#define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2523	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2524	x += cps;
2525	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2526	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2527	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2528	x += OBUFSIZ + 100;
2529	clist_alloc_cblocks(&tp->t_outq, x, x);
2530#undef	CLAMP
2531}
2532
2533/*
2534 * Report on state of foreground process group.
2535 */
2536void
2537ttyinfo(struct tty *tp)
2538{
2539	struct timeval utime, stime;
2540	struct proc *p, *pick;
2541	struct thread *td, *picktd;
2542	const char *stateprefix, *state;
2543	long rss;
2544	int load, pctcpu;
2545	pid_t pid;
2546	char comm[MAXCOMLEN + 1];
2547	struct rusage ru;
2548
2549	if (ttycheckoutq(tp,0) == 0)
2550		return;
2551
2552	/* Print load average. */
2553	load = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2554	ttyprintf(tp, "load: %d.%02d ", load / 100, load % 100);
2555
2556	/*
2557	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
2558	 * that pending input will be retyped on BS.
2559	 */
2560	if (tp->t_session == NULL) {
2561		ttyprintf(tp, "not a controlling terminal\n");
2562		tp->t_rocount = 0;
2563		return;
2564	}
2565	if (tp->t_pgrp == NULL) {
2566		ttyprintf(tp, "no foreground process group\n");
2567		tp->t_rocount = 0;
2568		return;
2569	}
2570	PGRP_LOCK(tp->t_pgrp);
2571	if (LIST_EMPTY(&tp->t_pgrp->pg_members)) {
2572		PGRP_UNLOCK(tp->t_pgrp);
2573		ttyprintf(tp, "empty foreground process group\n");
2574		tp->t_rocount = 0;
2575		return;
2576	}
2577
2578	/*
2579	 * Pick the most interesting process and copy some of its
2580	 * state for printing later.  This operation could rely on stale
2581	 * data as we can't hold the proc slock or thread locks over the
2582	 * whole list. However, we're guaranteed not to reference an exited
2583	 * thread or proc since we hold the tty locked.
2584	 */
2585	pick = NULL;
2586	LIST_FOREACH(p, &tp->t_pgrp->pg_members, p_pglist)
2587		if (proc_compare(pick, p))
2588			pick = p;
2589
2590	PROC_LOCK(pick);
2591	picktd = NULL;
2592	td = FIRST_THREAD_IN_PROC(pick);
2593	FOREACH_THREAD_IN_PROC(pick, td)
2594		if (thread_compare(picktd, td))
2595			picktd = td;
2596	td = picktd;
2597	stateprefix = "";
2598	thread_lock(td);
2599	if (TD_IS_RUNNING(td))
2600		state = "running";
2601	else if (TD_ON_RUNQ(td) || TD_CAN_RUN(td))
2602		state = "runnable";
2603	else if (TD_IS_SLEEPING(td)) {
2604		/* XXX: If we're sleeping, are we ever not in a queue? */
2605		if (TD_ON_SLEEPQ(td))
2606			state = td->td_wmesg;
2607		else
2608			state = "sleeping without queue";
2609	} else if (TD_ON_LOCK(td)) {
2610		state = td->td_lockname;
2611		stateprefix = "*";
2612	} else if (TD_IS_SUSPENDED(td))
2613		state = "suspended";
2614	else if (TD_AWAITING_INTR(td))
2615		state = "intrwait";
2616	else
2617		state = "unknown";
2618	pctcpu = (sched_pctcpu(td) * 10000 + FSCALE / 2) >> FSHIFT;
2619	thread_unlock(td);
2620	if (pick->p_state == PRS_NEW || pick->p_state == PRS_ZOMBIE)
2621		rss = 0;
2622	else
2623		rss = pgtok(vmspace_resident_count(pick->p_vmspace));
2624	PROC_UNLOCK(pick);
2625	PROC_LOCK(pick);
2626	PGRP_UNLOCK(tp->t_pgrp);
2627	rufetchcalc(pick, &ru, &utime, &stime);
2628	pid = pick->p_pid;
2629	bcopy(pick->p_comm, comm, sizeof(comm));
2630	PROC_UNLOCK(pick);
2631
2632	/* Print command, pid, state, utime, stime, %cpu, and rss. */
2633	ttyprintf(tp,
2634	    " cmd: %s %d [%s%s] %ld.%02ldu %ld.%02lds %d%% %ldk\n",
2635	    comm, pid, stateprefix, state,
2636	    (long)utime.tv_sec, utime.tv_usec / 10000,
2637	    (long)stime.tv_sec, stime.tv_usec / 10000,
2638	    pctcpu / 100, rss);
2639	tp->t_rocount = 0;
2640}
2641
2642/*
2643 * Returns 1 if p2 is "better" than p1
2644 *
2645 * The algorithm for picking the "interesting" process is thus:
2646 *
2647 *	1) Only foreground processes are eligible - implied.
2648 *	2) Runnable processes are favored over anything else.  The runner
2649 *	   with the highest cpu utilization is picked (p_estcpu).  Ties are
2650 *	   broken by picking the highest pid.
2651 *	3) The sleeper with the shortest sleep time is next.  With ties,
2652 *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2653 *	4) Further ties are broken by picking the highest pid.
2654 */
2655
2656#define TESTAB(a, b)    ((a)<<1 | (b))
2657#define ONLYA   2
2658#define ONLYB   1
2659#define BOTH    3
2660
2661static int
2662proc_sum(struct proc *p, int *estcpup)
2663{
2664	struct thread *td;
2665	int estcpu;
2666	int val;
2667
2668	val = 0;
2669	estcpu = 0;
2670	FOREACH_THREAD_IN_PROC(p, td) {
2671		thread_lock(td);
2672		if (TD_ON_RUNQ(td) ||
2673		    TD_IS_RUNNING(td))
2674			val = 1;
2675		estcpu += sched_pctcpu(td);
2676		thread_unlock(td);
2677	}
2678	*estcpup = estcpu;
2679
2680	return (val);
2681}
2682
2683static int
2684thread_compare(struct thread *td, struct thread *td2)
2685{
2686	int runa, runb;
2687	int slpa, slpb;
2688	fixpt_t esta, estb;
2689
2690	if (td == NULL)
2691		return (1);
2692
2693	/*
2694	 * Fetch running stats, pctcpu usage, and interruptable flag.
2695 	 */
2696	thread_lock(td);
2697	runa = TD_IS_RUNNING(td) | TD_ON_RUNQ(td);
2698	slpa = td->td_flags & TDF_SINTR;
2699	esta = sched_pctcpu(td);
2700	thread_unlock(td);
2701	thread_lock(td2);
2702	runb = TD_IS_RUNNING(td2) | TD_ON_RUNQ(td2);
2703	estb = sched_pctcpu(td2);
2704	slpb = td2->td_flags & TDF_SINTR;
2705	thread_unlock(td2);
2706	/*
2707	 * see if at least one of them is runnable
2708	 */
2709	switch (TESTAB(runa, runb)) {
2710	case ONLYA:
2711		return (0);
2712	case ONLYB:
2713		return (1);
2714	case BOTH:
2715		break;
2716	}
2717	/*
2718	 *  favor one with highest recent cpu utilization
2719	 */
2720	if (estb > esta)
2721		return (1);
2722	if (esta > estb)
2723		return (0);
2724	/*
2725	 * favor one sleeping in a non-interruptible sleep
2726	 */
2727	switch (TESTAB(slpa, slpb)) {
2728	case ONLYA:
2729		return (0);
2730	case ONLYB:
2731		return (1);
2732	case BOTH:
2733		break;
2734	}
2735
2736	return (td < td2);
2737}
2738
2739static int
2740proc_compare(struct proc *p1, struct proc *p2)
2741{
2742
2743	int runa, runb;
2744	fixpt_t esta, estb;
2745
2746	if (p1 == NULL)
2747		return (1);
2748
2749	/*
2750	 * Fetch various stats about these processes.  After we drop the
2751	 * lock the information could be stale but the race is unimportant.
2752	 */
2753	PROC_LOCK(p1);
2754	runa = proc_sum(p1, &esta);
2755	PROC_UNLOCK(p1);
2756	PROC_LOCK(p2);
2757	runb = proc_sum(p2, &estb);
2758	PROC_UNLOCK(p2);
2759
2760	/*
2761	 * see if at least one of them is runnable
2762	 */
2763	switch (TESTAB(runa, runb)) {
2764	case ONLYA:
2765		return (0);
2766	case ONLYB:
2767		return (1);
2768	case BOTH:
2769		break;
2770	}
2771	/*
2772	 *  favor one with highest recent cpu utilization
2773	 */
2774	if (estb > esta)
2775		return (1);
2776	if (esta > estb)
2777		return (0);
2778	/*
2779	 * weed out zombies
2780	 */
2781	switch (TESTAB(p1->p_state == PRS_ZOMBIE, p2->p_state == PRS_ZOMBIE)) {
2782	case ONLYA:
2783		return (1);
2784	case ONLYB:
2785		return (0);
2786	case BOTH:
2787		break;
2788	}
2789
2790	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2791}
2792
2793/*
2794 * Output char to tty; console putchar style.
2795 */
2796int
2797tputchar(int c, struct tty *tp)
2798{
2799	int s;
2800
2801	s = spltty();
2802	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2803		splx(s);
2804		return (-1);
2805	}
2806	if (c == '\n')
2807		(void)ttyoutput('\r', tp);
2808	(void)ttyoutput(c, tp);
2809	ttstart(tp);
2810	splx(s);
2811	return (0);
2812}
2813
2814/*
2815 * Sleep on chan, returning ERESTART if tty changed while we napped and
2816 * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2817 * the tty is revoked, restarting a pending call will redo validation done
2818 * at the start of the call.
2819 */
2820int
2821ttysleep(struct tty *tp, void *chan, int pri, char *wmesg, int timo)
2822{
2823	int error;
2824	int gen;
2825
2826	gen = tp->t_gen;
2827	error = tsleep(chan, pri, wmesg, timo);
2828	if (tp->t_state & TS_GONE)
2829		return (ENXIO);
2830	if (error)
2831		return (error);
2832	return (tp->t_gen == gen ? 0 : ERESTART);
2833}
2834
2835/*
2836 * Gain a reference to a TTY
2837 */
2838int
2839ttyref(struct tty *tp)
2840{
2841	int i;
2842
2843	mtx_lock(&tp->t_mtx);
2844	KASSERT(tp->t_refcnt > 0,
2845	    ("ttyref(): tty refcnt is %d (%s)",
2846	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2847	i = ++tp->t_refcnt;
2848	mtx_unlock(&tp->t_mtx);
2849	return (i);
2850}
2851
2852/*
2853 * Drop a reference to a TTY.
2854 * When reference count drops to zero, we free it.
2855 */
2856int
2857ttyrel(struct tty *tp)
2858{
2859	int i;
2860
2861	mtx_lock(&tty_list_mutex);
2862	mtx_lock(&tp->t_mtx);
2863	KASSERT(tp->t_refcnt > 0,
2864	    ("ttyrel(): tty refcnt is %d (%s)",
2865	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2866	i = --tp->t_refcnt;
2867	if (i != 0) {
2868		mtx_unlock(&tp->t_mtx);
2869		mtx_unlock(&tty_list_mutex);
2870		return (i);
2871	}
2872	TAILQ_REMOVE(&tty_list, tp, t_list);
2873	mtx_unlock(&tp->t_mtx);
2874	mtx_unlock(&tty_list_mutex);
2875	knlist_destroy(&tp->t_rsel.si_note);
2876	knlist_destroy(&tp->t_wsel.si_note);
2877	mtx_destroy(&tp->t_mtx);
2878	free(tp, M_TTYS);
2879	return (i);
2880}
2881
2882/*
2883 * Allocate a tty struct.  Clists in the struct will be allocated by
2884 * tty_open().
2885 */
2886struct tty *
2887ttyalloc()
2888{
2889	struct tty *tp;
2890
2891	tp = malloc(sizeof *tp, M_TTYS, M_WAITOK | M_ZERO);
2892	mtx_init(&tp->t_mtx, "tty", NULL, MTX_DEF);
2893
2894	/*
2895	 * Set up the initial state
2896	 */
2897	tp->t_refcnt = 1;
2898	tp->t_timeout = -1;
2899	tp->t_dtr_wait = 3 * hz;
2900
2901	ttyinitmode(tp, 0, 0);
2902	bcopy(ttydefchars, tp->t_init_in.c_cc, sizeof tp->t_init_in.c_cc);
2903
2904	/* Make callout the same as callin */
2905	tp->t_init_out = tp->t_init_in;
2906
2907	mtx_lock(&tty_list_mutex);
2908	TAILQ_INSERT_TAIL(&tty_list, tp, t_list);
2909	mtx_unlock(&tty_list_mutex);
2910	knlist_init(&tp->t_rsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2911	knlist_init(&tp->t_wsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2912	return (tp);
2913}
2914
2915static void
2916ttypurge(struct cdev *dev)
2917{
2918
2919	if (dev->si_tty == NULL)
2920		return;
2921	ttygone(dev->si_tty);
2922}
2923
2924/*
2925 * ttycreate()
2926 *
2927 * Create the device entries for this tty thereby opening it for business.
2928 *
2929 * The flags argument controls if "cua" units are created.
2930 *
2931 * The t_sc filed is copied to si_drv1 in the created cdevs.  This
2932 * is particularly important for ->t_cioctl() users.
2933 *
2934 * XXX: implement the init and lock devices by cloning.
2935 */
2936
2937int
2938ttycreate(struct tty *tp, int flags, const char *fmt, ...)
2939{
2940	char namebuf[SPECNAMELEN - 3];		/* XXX space for "tty" */
2941	struct cdevsw *csw = NULL;
2942	int unit = 0;
2943	va_list ap;
2944	struct cdev *cp;
2945	int i, minor, sminor, sunit;
2946
2947	mtx_assert(&Giant, MA_OWNED);
2948
2949	if (tty_unit == NULL)
2950		tty_unit = new_unrhdr(0, 0xffff, NULL);
2951
2952	sunit = alloc_unr(tty_unit);
2953	tp->t_devunit = sunit;
2954
2955	if (csw == NULL) {
2956		csw = &tty_cdevsw;
2957		unit = sunit;
2958	}
2959	KASSERT(csw->d_purge == NULL || csw->d_purge == ttypurge,
2960	    ("tty should not have d_purge"));
2961
2962	csw->d_purge = ttypurge;
2963
2964	minor = unit2minor(unit);
2965	sminor = unit2minor(sunit);
2966	va_start(ap, fmt);
2967	i = vsnrprintf(namebuf, sizeof namebuf, 32, fmt, ap);
2968	va_end(ap);
2969	KASSERT(i < sizeof namebuf, ("Too long tty name (%s)", namebuf));
2970
2971	cp = make_dev(csw, minor,
2972	    UID_ROOT, GID_WHEEL, 0600, "tty%s", namebuf);
2973	tp->t_dev = cp;
2974	tp->t_mdev = cp;
2975	cp->si_tty = tp;
2976	cp->si_drv1 = tp->t_sc;
2977
2978	cp = make_dev(&ttys_cdevsw, sminor | MINOR_INIT,
2979	    UID_ROOT, GID_WHEEL, 0600, "tty%s.init", namebuf);
2980	dev_depends(tp->t_dev, cp);
2981	cp->si_drv1 = tp->t_sc;
2982	cp->si_drv2 = &tp->t_init_in;
2983	cp->si_tty = tp;
2984
2985	cp = make_dev(&ttys_cdevsw, sminor | MINOR_LOCK,
2986	    UID_ROOT, GID_WHEEL, 0600, "tty%s.lock", namebuf);
2987	dev_depends(tp->t_dev, cp);
2988	cp->si_drv1 = tp->t_sc;
2989	cp->si_drv2 = &tp->t_lock_in;
2990	cp->si_tty = tp;
2991
2992	if (flags & TS_CALLOUT) {
2993		cp = make_dev(csw, minor | MINOR_CALLOUT,
2994		    UID_UUCP, GID_DIALER, 0660, "cua%s", namebuf);
2995		dev_depends(tp->t_dev, cp);
2996		cp->si_drv1 = tp->t_sc;
2997		cp->si_tty = tp;
2998
2999		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_INIT,
3000		    UID_UUCP, GID_DIALER, 0660, "cua%s.init", namebuf);
3001		dev_depends(tp->t_dev, cp);
3002		cp->si_drv1 = tp->t_sc;
3003		cp->si_drv2 = &tp->t_init_out;
3004		cp->si_tty = tp;
3005
3006		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_LOCK,
3007		    UID_UUCP, GID_DIALER, 0660, "cua%s.lock", namebuf);
3008		dev_depends(tp->t_dev, cp);
3009		cp->si_drv1 = tp->t_sc;
3010		cp->si_drv2 = &tp->t_lock_out;
3011		cp->si_tty = tp;
3012	}
3013
3014	return (0);
3015}
3016
3017/*
3018 * This function is called when the hardware disappears.  We set a flag
3019 * and wake up stuff so all sleeping threads will notice.
3020 */
3021void
3022ttygone(struct tty *tp)
3023{
3024
3025	tp->t_state |= TS_GONE;
3026	if (SEL_WAITING(&tp->t_rsel))
3027		selwakeuppri(&tp->t_rsel, TTIPRI);
3028	if (SEL_WAITING(&tp->t_wsel))
3029		selwakeuppri(&tp->t_wsel, TTOPRI);
3030	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
3031		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
3032	wakeup(&tp->t_dtr_wait);
3033	wakeup(TSA_CARR_ON(tp));
3034	wakeup(TSA_HUP_OR_INPUT(tp));
3035	wakeup(TSA_OCOMPLETE(tp));
3036	wakeup(TSA_OLOWAT(tp));
3037	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
3038	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
3039	tt_purge(tp);
3040}
3041
3042/*
3043 * ttyfree()
3044 *
3045 * Called when the driver is ready to free the tty structure.
3046 *
3047 * XXX: This shall sleep until all threads have left the driver.
3048 */
3049void
3050ttyfree(struct tty *tp)
3051{
3052	struct cdev *dev;
3053	u_int unit;
3054
3055	mtx_assert(&Giant, MA_OWNED);
3056	ttygone(tp);
3057	unit = tp->t_devunit;
3058	dev = tp->t_mdev;
3059	tp->t_dev = NULL;
3060	ttyrel(tp);
3061	destroy_dev(dev);
3062	free_unr(tty_unit, unit);
3063}
3064
3065static int
3066sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
3067{
3068	struct tty *tp, *tp2;
3069	struct xtty xt;
3070	int error;
3071
3072	error = 0;
3073	mtx_lock(&tty_list_mutex);
3074	tp = TAILQ_FIRST(&tty_list);
3075	if (tp != NULL)
3076		ttyref(tp);
3077	while (tp != NULL) {
3078		bzero(&xt, sizeof xt);
3079		xt.xt_size = sizeof xt;
3080#define XT_COPY(field) xt.xt_##field = tp->t_##field
3081		xt.xt_rawcc = tp->t_rawq.c_cc;
3082		xt.xt_cancc = tp->t_canq.c_cc;
3083		xt.xt_outcc = tp->t_outq.c_cc;
3084		XT_COPY(line);
3085
3086		/*
3087		 * XXX: We hold the tty list lock while doing this to
3088		 * work around a race with pty/pts tty destruction.
3089		 * They set t_dev to NULL and then call ttyrel() to
3090		 * free the structure which will block on the list
3091		 * lock before they call destroy_dev() on the cdev
3092		 * backing t_dev.
3093		 *
3094		 * XXX: ttyfree() now does the same since it has been
3095		 * fixed to not leak ttys.
3096		 */
3097		if (tp->t_dev != NULL)
3098			xt.xt_dev = dev2udev(tp->t_dev);
3099		XT_COPY(state);
3100		XT_COPY(flags);
3101		XT_COPY(timeout);
3102		if (tp->t_pgrp != NULL)
3103			xt.xt_pgid = tp->t_pgrp->pg_id;
3104		if (tp->t_session != NULL)
3105			xt.xt_sid = tp->t_session->s_sid;
3106		XT_COPY(termios);
3107		XT_COPY(winsize);
3108		XT_COPY(column);
3109		XT_COPY(rocount);
3110		XT_COPY(rocol);
3111		XT_COPY(ififosize);
3112		XT_COPY(ihiwat);
3113		XT_COPY(ilowat);
3114		XT_COPY(ispeedwat);
3115		XT_COPY(ohiwat);
3116		XT_COPY(olowat);
3117		XT_COPY(ospeedwat);
3118#undef XT_COPY
3119		mtx_unlock(&tty_list_mutex);
3120		error = SYSCTL_OUT(req, &xt, sizeof xt);
3121		if (error != 0) {
3122			ttyrel(tp);
3123			return (error);
3124		}
3125		mtx_lock(&tty_list_mutex);
3126		tp2 = TAILQ_NEXT(tp, t_list);
3127		if (tp2 != NULL)
3128			ttyref(tp2);
3129		mtx_unlock(&tty_list_mutex);
3130		ttyrel(tp);
3131		tp = tp2;
3132		mtx_lock(&tty_list_mutex);
3133	}
3134	mtx_unlock(&tty_list_mutex);
3135	return (0);
3136}
3137
3138SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
3139	0, 0, sysctl_kern_ttys, "S,xtty", "All ttys");
3140SYSCTL_LONG(_kern, OID_AUTO, tty_nin, CTLFLAG_RD,
3141	&tk_nin, 0, "Total TTY in characters");
3142SYSCTL_LONG(_kern, OID_AUTO, tty_nout, CTLFLAG_RD,
3143	&tk_nout, 0, "Total TTY out characters");
3144
3145void
3146nottystop(struct tty *tp, int rw)
3147{
3148
3149	return;
3150}
3151
3152int
3153ttyopen(struct cdev *dev, int flag, int mode, struct thread *td)
3154{
3155	int		error;
3156	int		s;
3157	struct tty	*tp;
3158
3159	tp = dev->si_tty;
3160
3161	s = spltty();
3162	/*
3163	 * We jump to this label after all non-interrupted sleeps to pick
3164	 * up any changes of the device state.
3165	 */
3166open_top:
3167	if (tp->t_state & TS_GONE)
3168		return (ENXIO);
3169	error = ttydtrwaitsleep(tp);
3170	if (error)
3171		goto out;
3172	if (tp->t_state & TS_ISOPEN) {
3173		/*
3174		 * The device is open, so everything has been initialized.
3175		 * Handle conflicts.
3176		 */
3177		if (ISCALLOUT(dev) && !tp->t_actout)
3178			return (EBUSY);
3179		if (tp->t_actout && !ISCALLOUT(dev)) {
3180			if (flag & O_NONBLOCK)
3181				return (EBUSY);
3182			error =	tsleep(&tp->t_actout,
3183				       TTIPRI | PCATCH, "ttybi", 0);
3184			if (error != 0 || (tp->t_flags & TS_GONE))
3185				goto out;
3186			goto open_top;
3187		}
3188		if (tp->t_state & TS_XCLUDE && priv_check(td,
3189		    PRIV_TTY_EXCLUSIVE))
3190			return (EBUSY);
3191	} else {
3192		/*
3193		 * The device isn't open, so there are no conflicts.
3194		 * Initialize it.  Initialization is done twice in many
3195		 * cases: to preempt sleeping callin opens if we are
3196		 * callout, and to complete a callin open after DCD rises.
3197		 */
3198		tp->t_termios = ISCALLOUT(dev) ? tp->t_init_out : tp->t_init_in;
3199		tp->t_cflag = tp->t_termios.c_cflag;
3200		if (tp->t_modem != NULL)
3201			tt_modem(tp, SER_DTR | SER_RTS, 0);
3202		++tp->t_wopeners;
3203		error = tt_param(tp, &tp->t_termios);
3204		--tp->t_wopeners;
3205		if (error == 0)
3206			error = tt_open(tp, dev);
3207		if (error != 0)
3208			goto out;
3209		if (ISCALLOUT(dev) || (tt_modem(tp, 0, 0) & SER_DCD))
3210			ttyld_modem(tp, 1);
3211	}
3212	/*
3213	 * Wait for DCD if necessary.
3214	 */
3215	if (!(tp->t_state & TS_CARR_ON) && !ISCALLOUT(dev)
3216	    && !(tp->t_cflag & CLOCAL) && !(flag & O_NONBLOCK)) {
3217		++tp->t_wopeners;
3218		error = tsleep(TSA_CARR_ON(tp), TTIPRI | PCATCH, "ttydcd", 0);
3219		--tp->t_wopeners;
3220		if (error != 0 || (tp->t_state & TS_GONE))
3221			goto out;
3222		goto open_top;
3223	}
3224	error =	ttyld_open(tp, dev);
3225	ttyldoptim(tp);
3226	if (tp->t_state & TS_ISOPEN && ISCALLOUT(dev))
3227		tp->t_actout = TRUE;
3228out:
3229	splx(s);
3230	if (!(tp->t_state & TS_ISOPEN) && tp->t_wopeners == 0)
3231		tt_close(tp);
3232	return (error);
3233}
3234
3235int
3236ttyclose(struct cdev *dev, int flag, int mode, struct thread *td)
3237{
3238	struct tty *tp;
3239
3240	tp = dev->si_tty;
3241	ttyld_close(tp, flag);
3242	ttyldoptim(tp);
3243	tt_close(tp);
3244	tp->t_do_timestamp = 0;
3245	if (tp->t_pps != NULL)
3246		tp->t_pps->ppsparam.mode = 0;
3247	tty_close(tp);
3248	return (0);
3249}
3250
3251int
3252ttyread(struct cdev *dev, struct uio *uio, int flag)
3253{
3254	struct tty *tp;
3255
3256	tp = tty_gettp(dev);
3257
3258	if (tp->t_state & TS_GONE)
3259		return (ENODEV);
3260	return (ttyld_read(tp, uio, flag));
3261}
3262
3263int
3264ttywrite(struct cdev *dev, struct uio *uio, int flag)
3265{
3266	struct tty *tp;
3267
3268	tp = tty_gettp(dev);
3269
3270	if (tp->t_state & TS_GONE)
3271		return (ENODEV);
3272	return (ttyld_write(tp, uio, flag));
3273}
3274
3275int
3276ttyioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3277{
3278	struct	tty *tp;
3279	int	error;
3280
3281	tp = dev->si_tty;
3282
3283	if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) {
3284		int cc;
3285		struct termios *dt = (struct termios *)data;
3286		struct termios *lt =
3287		    ISCALLOUT(dev) ?  &tp->t_lock_out : &tp->t_lock_in;
3288
3289		dt->c_iflag = (tp->t_iflag & lt->c_iflag)
3290		    | (dt->c_iflag & ~lt->c_iflag);
3291		dt->c_oflag = (tp->t_oflag & lt->c_oflag)
3292		    | (dt->c_oflag & ~lt->c_oflag);
3293		dt->c_cflag = (tp->t_cflag & lt->c_cflag)
3294		    | (dt->c_cflag & ~lt->c_cflag);
3295		dt->c_lflag = (tp->t_lflag & lt->c_lflag)
3296		    | (dt->c_lflag & ~lt->c_lflag);
3297		for (cc = 0; cc < NCCS; ++cc)
3298		    if (lt->c_cc[cc] != 0)
3299		        dt->c_cc[cc] = tp->t_cc[cc];
3300		if (lt->c_ispeed != 0)
3301		    dt->c_ispeed = tp->t_ispeed;
3302		if (lt->c_ospeed != 0)
3303		    dt->c_ospeed = tp->t_ospeed;
3304	}
3305
3306	error = ttyld_ioctl(tp, cmd, data, flag, td);
3307	if (error == ENOIOCTL)
3308		error = ttioctl(tp, cmd, data, flag);
3309	ttyldoptim(tp);
3310	if (error != ENOIOCTL)
3311		return (error);
3312	return (ENOTTY);
3313}
3314
3315void
3316ttyldoptim(struct tty *tp)
3317{
3318	struct termios	*t;
3319
3320	t = &tp->t_termios;
3321	if (!(t->c_iflag & (ICRNL | IGNCR | IMAXBEL | INLCR | ISTRIP | IXON))
3322	    && (!(t->c_iflag & BRKINT) || (t->c_iflag & IGNBRK))
3323	    && (!(t->c_iflag & PARMRK)
3324		|| (t->c_iflag & (IGNPAR | IGNBRK)) == (IGNPAR | IGNBRK))
3325	    && !(t->c_lflag & (ECHO | ICANON | IEXTEN | ISIG | PENDIN))
3326	    && linesw[tp->t_line]->l_rint == ttyinput)
3327		tp->t_state |= TS_CAN_BYPASS_L_RINT;
3328	else
3329		tp->t_state &= ~TS_CAN_BYPASS_L_RINT;
3330}
3331
3332static void
3333ttydtrwaitwakeup(void *arg)
3334{
3335	struct tty *tp;
3336
3337	tp = arg;
3338	tp->t_state &= ~TS_DTR_WAIT;
3339	wakeup(&tp->t_dtr_wait);
3340}
3341
3342
3343void
3344ttydtrwaitstart(struct tty *tp)
3345{
3346
3347	if (tp->t_dtr_wait == 0)
3348		return;
3349	if (tp->t_state & TS_DTR_WAIT)
3350		return;
3351	timeout(ttydtrwaitwakeup, tp, tp->t_dtr_wait);
3352	tp->t_state |= TS_DTR_WAIT;
3353}
3354
3355int
3356ttydtrwaitsleep(struct tty *tp)
3357{
3358	int error;
3359
3360	error = 0;
3361	while (error == 0) {
3362		if (tp->t_state & TS_GONE)
3363			error = ENXIO;
3364		else if (!(tp->t_state & TS_DTR_WAIT))
3365			break;
3366		else
3367			error = tsleep(&tp->t_dtr_wait, TTIPRI | PCATCH,
3368			    "dtrwait", 0);
3369	}
3370	return (error);
3371}
3372
3373static int
3374ttysopen(struct cdev *dev, int flag, int mode, struct thread *td)
3375{
3376	struct tty *tp;
3377
3378	tp = dev->si_tty;
3379	KASSERT(tp != NULL,
3380	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3381	if (tp->t_state & TS_GONE)
3382		return (ENODEV);
3383	return (0);
3384}
3385
3386static int
3387ttysclose(struct cdev *dev, int flag, int mode, struct thread *td)
3388{
3389
3390	return (0);
3391}
3392
3393static int
3394ttysrdwr(struct cdev *dev, struct uio *uio, int flag)
3395{
3396
3397	return (ENODEV);
3398}
3399
3400static int
3401ttysioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3402{
3403	struct tty	*tp;
3404	int		error;
3405	struct termios	*ct;
3406
3407	tp = dev->si_tty;
3408	KASSERT(tp != NULL,
3409	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3410	if (tp->t_state & TS_GONE)
3411		return (ENODEV);
3412	ct = dev->si_drv2;
3413	switch (cmd) {
3414	case TIOCSETA:
3415		error = priv_check(td, PRIV_TTY_SETA);
3416		if (error != 0)
3417			return (error);
3418		*ct = *(struct termios *)data;
3419		return (0);
3420	case TIOCGETA:
3421		*(struct termios *)data = *ct;
3422		return (0);
3423	case TIOCGETD:
3424		*(int *)data = TTYDISC;
3425		return (0);
3426	case TIOCGWINSZ:
3427		bzero(data, sizeof(struct winsize));
3428		return (0);
3429	default:
3430		if (tp->t_cioctl != NULL)
3431			return(tp->t_cioctl(dev, cmd, data, flag, td));
3432		return (ENOTTY);
3433	}
3434}
3435
3436/*
3437 * Initialize a tty to sane modes.
3438 */
3439void
3440ttyinitmode(struct tty *tp, int echo, int speed)
3441{
3442
3443	if (speed == 0)
3444		speed = TTYDEF_SPEED;
3445	tp->t_init_in.c_iflag = TTYDEF_IFLAG;
3446	tp->t_init_in.c_oflag = TTYDEF_OFLAG;
3447	tp->t_init_in.c_cflag = TTYDEF_CFLAG;
3448	if (echo)
3449		tp->t_init_in.c_lflag = TTYDEF_LFLAG_ECHO;
3450	else
3451		tp->t_init_in.c_lflag = TTYDEF_LFLAG_NOECHO;
3452
3453	tp->t_init_in.c_ispeed = tp->t_init_in.c_ospeed = speed;
3454	termioschars(&tp->t_init_in);
3455	tp->t_init_out = tp->t_init_in;
3456	tp->t_termios = tp->t_init_in;
3457}
3458
3459/*
3460 * Use more "normal" termios paramters for consoles.
3461 */
3462void
3463ttyconsolemode(struct tty *tp, int speed)
3464{
3465
3466	if (speed == 0)
3467		speed = TTYDEF_SPEED;
3468	ttyinitmode(tp, 1, speed);
3469	tp->t_init_in.c_cflag |= CLOCAL;
3470	tp->t_lock_out.c_cflag = tp->t_lock_in.c_cflag = CLOCAL;
3471	tp->t_lock_out.c_ispeed = tp->t_lock_out.c_ospeed =
3472	tp->t_lock_in.c_ispeed = tp->t_lock_in.c_ospeed = speed;
3473	tp->t_init_out = tp->t_init_in;
3474	tp->t_termios = tp->t_init_in;
3475	ttsetwater(tp);
3476}
3477
3478/*
3479 * Record the relationship between the serial ports notion of modem control
3480 * signals and the one used in certain ioctls in a way the compiler can enforce
3481 * XXX: We should define TIOCM_* in terms of SER_ if we can limit the
3482 * XXX: consequences of the #include work that would take.
3483 */
3484CTASSERT(SER_DTR == TIOCM_DTR / 2);
3485CTASSERT(SER_RTS == TIOCM_RTS / 2);
3486CTASSERT(SER_STX == TIOCM_ST / 2);
3487CTASSERT(SER_SRX == TIOCM_SR / 2);
3488CTASSERT(SER_CTS == TIOCM_CTS / 2);
3489CTASSERT(SER_DCD == TIOCM_DCD / 2);
3490CTASSERT(SER_RI == TIOCM_RI / 2);
3491CTASSERT(SER_DSR == TIOCM_DSR / 2);
3492
3493