tty.c revision 179251
1/*-
2 * Copyright (c) 1982, 1986, 1990, 1991, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 * (c) UNIX System Laboratories, Inc.
5 * All or some portions of this file are derived from material licensed
6 * to the University of California by American Telephone and Telegraph
7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8 * the permission of UNIX System Laboratories, Inc.
9 *
10 * Copyright (c) 2002 Networks Associates Technologies, Inc.
11 * All rights reserved.
12 *
13 * Portions of this software were developed for the FreeBSD Project by
14 * ThinkSec AS and NAI Labs, the Security Research Division of Network
15 * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
16 * ("CBOSS"), as part of the DARPA CHATS research program.
17 *
18 * Redistribution and use in source and binary forms, with or without
19 * modification, are permitted provided that the following conditions
20 * are met:
21 * 1. Redistributions of source code must retain the above copyright
22 *    notice, this list of conditions and the following disclaimer.
23 * 2. Redistributions in binary form must reproduce the above copyright
24 *    notice, this list of conditions and the following disclaimer in the
25 *    documentation and/or other materials provided with the distribution.
26 * 4. Neither the name of the University nor the names of its contributors
27 *    may be used to endorse or promote products derived from this software
28 *    without specific prior written permission.
29 *
30 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40 * SUCH DAMAGE.
41 *
42 *	@(#)tty.c	8.8 (Berkeley) 1/21/94
43 */
44
45/*-
46 * TODO:
47 *	o Fix races for sending the start char in ttyflush().
48 *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
49 *	  With luck, there will be MIN chars before select() returns().
50 *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
51 *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
52 *	  FIONREAD.
53 *	o Do the new sio locking stuff here and use it to avoid special
54 *	  case for EXTPROC?
55 *	o Lock PENDIN too?
56 *	o Move EXTPROC and/or PENDIN to t_state?
57 *	o Wrap most of ttioctl in spltty/splx.
58 *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
59 *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
60 *	o Don't allow certain termios flags to affect disciplines other
61 *	  than TTYDISC.  Cancel their effects before switch disciplines
62 *	  and ignore them if they are set while we are in another
63 *	  discipline.
64 *	o Now that historical speed conversions are handled here, don't
65 *	  do them in drivers.
66 *	o Check for TS_CARR_ON being set while everything is closed and not
67 *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
68 *	  so it would live until the next open even if carrier drops.
69 *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
70 *	  only when _all_ openers leave open().
71 */
72
73#include <sys/cdefs.h>
74__FBSDID("$FreeBSD: head/sys/kern/tty.c 179251 2008-05-23 16:47:55Z kib $");
75
76#include "opt_compat.h"
77#include "opt_tty.h"
78
79#include <sys/param.h>
80#include <sys/systm.h>
81#include <sys/cons.h>
82#include <sys/filio.h>
83#include <sys/lock.h>
84#include <sys/mutex.h>
85#include <sys/namei.h>
86#include <sys/sx.h>
87#if defined(COMPAT_43TTY)
88#include <sys/ioctl_compat.h>
89#endif
90#include <sys/priv.h>
91#include <sys/proc.h>
92#define	TTYDEFCHARS
93#include <sys/tty.h>
94#undef	TTYDEFCHARS
95#include <sys/fcntl.h>
96#include <sys/conf.h>
97#include <sys/poll.h>
98#include <sys/kernel.h>
99#include <sys/vnode.h>
100#include <sys/serial.h>
101#include <sys/signalvar.h>
102#include <sys/resourcevar.h>
103#include <sys/malloc.h>
104#include <sys/filedesc.h>
105#include <sys/sched.h>
106#include <sys/sysctl.h>
107#include <sys/timepps.h>
108
109#include <machine/stdarg.h>
110
111#include <vm/vm.h>
112#include <vm/pmap.h>
113#include <vm/vm_map.h>
114
115MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
116
117long tk_cancc;
118long tk_nin;
119long tk_nout;
120long tk_rawcc;
121
122static	d_open_t	ttysopen;
123static	d_close_t	ttysclose;
124static	d_read_t	ttysrdwr;
125static	d_ioctl_t	ttysioctl;
126static	d_purge_t	ttypurge;
127
128/* Default cdevsw for common tty devices */
129static struct cdevsw tty_cdevsw = {
130	.d_version =	D_VERSION,
131	.d_open =	ttyopen,
132	.d_close =	ttyclose,
133	.d_ioctl =	ttyioctl,
134	.d_purge =	ttypurge,
135	.d_name =	"ttydrv",
136	.d_flags =	D_TTY | D_NEEDGIANT,
137};
138
139/* Cdevsw for slave tty devices */
140static struct cdevsw ttys_cdevsw = {
141	.d_version =	D_VERSION,
142	.d_open =	ttysopen,
143	.d_close =	ttysclose,
144	.d_read =	ttysrdwr,
145	.d_write =	ttysrdwr,
146	.d_ioctl =	ttysioctl,
147	.d_name =	"TTYS",
148	.d_flags =	D_TTY | D_NEEDGIANT,
149};
150
151static int	proc_sum(struct proc *, int *);
152static int	proc_compare(struct proc *, struct proc *);
153static int	thread_compare(struct thread *, struct thread *);
154static int	ttnread(struct tty *tp);
155static void	ttyecho(int c, struct tty *tp);
156static int	ttyoutput(int c, struct tty *tp);
157static void	ttypend(struct tty *tp);
158static void	ttyretype(struct tty *tp);
159static void	ttyrub(int c, struct tty *tp);
160static void	ttyrubo(struct tty *tp, int cnt);
161static void	ttyunblock(struct tty *tp);
162static int	ttywflush(struct tty *tp);
163static int	filt_ttyread(struct knote *kn, long hint);
164static void	filt_ttyrdetach(struct knote *kn);
165static int	filt_ttywrite(struct knote *kn, long hint);
166static void	filt_ttywdetach(struct knote *kn);
167
168/*
169 * Table with character classes and parity. The 8th bit indicates parity,
170 * the 7th bit indicates the character is an alphameric or underscore (for
171 * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
172 * are 0 then the character needs no special processing on output; classes
173 * other than 0 might be translated or (not currently) require delays.
174 */
175#define	E	0x00	/* Even parity. */
176#define	O	0x80	/* Odd parity. */
177#define	PARITY(c)	(char_type[c] & O)
178
179#define	ALPHA	0x40	/* Alpha or underscore. */
180#define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
181
182#define	CCLASSMASK	0x3f
183#define	CCLASS(c)	(char_type[c] & CCLASSMASK)
184
185#define	BS	BACKSPACE
186#define	CC	CONTROL
187#define	CR	RETURN
188#define	NA	ORDINARY | ALPHA
189#define	NL	NEWLINE
190#define	NO	ORDINARY
191#define	TB	TAB
192#define	VT	VTAB
193
194static u_char const char_type[] = {
195	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
196	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
197	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
198	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
199	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
200	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
201	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
202	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
203	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
204	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
205	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
206	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
207	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
208	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
209	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
210	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
211	/*
212	 * Meta chars; should be settable per character set;
213	 * for now, treat them all as normal characters.
214	 */
215	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
216	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
217	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
218	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
219	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
220	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
221	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
222	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
223	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
224	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
225	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
226	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
227	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
228	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
229	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
230	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
231};
232#undef	BS
233#undef	CC
234#undef	CR
235#undef	NA
236#undef	NL
237#undef	NO
238#undef	TB
239#undef	VT
240
241/* Macros to clear/set/test flags. */
242#define	SET(t, f)	(t) |= (f)
243#define	CLR(t, f)	(t) &= ~(f)
244#define	ISSET(t, f)	((t) & (f))
245
246#undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
247#define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
248
249/*
250 * list of struct tty where pstat(8) can pick it up with sysctl
251 *
252 * The lock order is to grab the list mutex before the tty mutex.
253 * Together with additions going on the tail of the list, this allows
254 * the sysctl to avoid doing retries.
255 */
256static	TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
257static struct mtx tty_list_mutex;
258MTX_SYSINIT(tty_list, &tty_list_mutex, "ttylist", MTX_DEF);
259
260static struct unrhdr *tty_unit;
261
262static int  drainwait = 5*60;
263SYSCTL_INT(_kern, OID_AUTO, drainwait, CTLFLAG_RW, &drainwait,
264	0, "Output drain timeout in seconds");
265
266static struct tty *
267tty_gettp(struct cdev *dev)
268{
269	struct tty *tp;
270	struct cdevsw *csw;
271
272	csw = dev_refthread(dev);
273	if (csw == NULL)
274		return (NULL);
275	KASSERT(csw->d_flags & D_TTY,
276	    ("non D_TTY (%s) in tty code", devtoname(dev)));
277	tp = dev->si_tty;
278	dev_relthread(dev);
279	KASSERT(tp != NULL,
280	    ("no tty pointer on (%s) in tty code", devtoname(dev)));
281	return (tp);
282}
283
284/*
285 * Initial open of tty, or (re)entry to standard tty line discipline.
286 */
287int
288tty_open(struct cdev *device, struct tty *tp)
289{
290	int s;
291
292	s = spltty();
293	tp->t_dev = device;
294	tp->t_hotchar = 0;
295	if (!ISSET(tp->t_state, TS_ISOPEN)) {
296		ttyref(tp);
297		SET(tp->t_state, TS_ISOPEN);
298		if (ISSET(tp->t_cflag, CLOCAL))
299			SET(tp->t_state, TS_CONNECTED);
300		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
301	}
302	/* XXX don't hang forever on output */
303	if (tp->t_timeout < 0)
304		tp->t_timeout = drainwait*hz;
305	ttsetwater(tp);
306	splx(s);
307	return (0);
308}
309
310/*
311 * Handle close() on a tty line: flush and set to initial state,
312 * bumping generation number so that pending read/write calls
313 * can detect recycling of the tty.
314 * XXX our caller should have done `spltty(); l_close(); tty_close();'
315 * and l_close() should have flushed, but we repeat the spltty() and
316 * the flush in case there are buggy callers.
317 */
318int
319tty_close(struct tty *tp)
320{
321	int ostate, s;
322
323	funsetown(&tp->t_sigio);
324	s = spltty();
325	if (constty == tp)
326		constty_clear();
327
328	ttyflush(tp, FREAD | FWRITE);
329	clist_free_cblocks(&tp->t_canq);
330	clist_free_cblocks(&tp->t_outq);
331	clist_free_cblocks(&tp->t_rawq);
332
333	tp->t_gen++;
334	tp->t_line = TTYDISC;
335	tp->t_hotchar = 0;
336	tp->t_pgrp = NULL;
337	tp->t_session = NULL;
338	ostate = tp->t_state;
339	tp->t_state = 0;
340	knlist_clear(&tp->t_rsel.si_note, 0);
341	knlist_clear(&tp->t_wsel.si_note, 0);
342	/*
343	 * Both final close and revocation close might end up calling
344	 * this method.  Only the thread clearing TS_ISOPEN should
345	 * release the reference to the tty.
346	 */
347	if (ISSET(ostate, TS_ISOPEN))
348		ttyrel(tp);
349	splx(s);
350	return (0);
351}
352
353#define	FLUSHQ(q) {							\
354	if ((q)->c_cc)							\
355		ndflush(q, (q)->c_cc);					\
356}
357
358/* Is 'c' a line delimiter ("break" character)? */
359#define	TTBREAKC(c, lflag)							\
360	((c) == '\n' || (((c) == cc[VEOF] ||				\
361	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
362	 (c) != _POSIX_VDISABLE))
363
364/*
365 * Process input of a single character received on a tty.
366 */
367int
368ttyinput(int c, struct tty *tp)
369{
370	tcflag_t iflag, lflag;
371	cc_t *cc;
372	int i, err;
373
374	/*
375	 * If input is pending take it first.
376	 */
377	lflag = tp->t_lflag;
378	if (ISSET(lflag, PENDIN))
379		ttypend(tp);
380	/*
381	 * Gather stats.
382	 */
383	if (ISSET(lflag, ICANON)) {
384		++tk_cancc;
385		++tp->t_cancc;
386	} else {
387		++tk_rawcc;
388		++tp->t_rawcc;
389	}
390	++tk_nin;
391
392	/*
393	 * Block further input iff:
394	 * current input > threshold AND input is available to user program
395	 * AND input flow control is enabled and not yet invoked.
396	 * The 3 is slop for PARMRK.
397	 */
398	iflag = tp->t_iflag;
399	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
400	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
401	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
402	    !ISSET(tp->t_state, TS_TBLOCK))
403		ttyblock(tp);
404
405	/* Handle exceptional conditions (break, parity, framing). */
406	cc = tp->t_cc;
407	err = (ISSET(c, TTY_ERRORMASK));
408	if (err) {
409		CLR(c, TTY_ERRORMASK);
410		if (ISSET(err, TTY_BI)) {
411			if (ISSET(iflag, IGNBRK))
412				return (0);
413			if (ISSET(iflag, BRKINT)) {
414				ttyflush(tp, FREAD | FWRITE);
415				if (tp->t_pgrp != NULL) {
416					PGRP_LOCK(tp->t_pgrp);
417					pgsignal(tp->t_pgrp, SIGINT, 1);
418					PGRP_UNLOCK(tp->t_pgrp);
419				}
420				goto endcase;
421			}
422			if (ISSET(iflag, PARMRK))
423				goto parmrk;
424		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
425			|| ISSET(err, TTY_FE)) {
426			if (ISSET(iflag, IGNPAR))
427				return (0);
428			else if (ISSET(iflag, PARMRK)) {
429parmrk:
430				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
431				    MAX_INPUT - 3)
432					goto input_overflow;
433				(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
434				(void)putc(0 | TTY_QUOTE, &tp->t_rawq);
435				(void)putc(c | TTY_QUOTE, &tp->t_rawq);
436				goto endcase;
437			} else
438				c = 0;
439		}
440	}
441
442	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
443		CLR(c, 0x80);
444	if (!ISSET(lflag, EXTPROC)) {
445		/*
446		 * Check for literal nexting very first
447		 */
448		if (ISSET(tp->t_state, TS_LNCH)) {
449			SET(c, TTY_QUOTE);
450			CLR(tp->t_state, TS_LNCH);
451		}
452		/*
453		 * Scan for special characters.  This code
454		 * is really just a big case statement with
455		 * non-constant cases.  The bottom of the
456		 * case statement is labeled ``endcase'', so goto
457		 * it after a case match, or similar.
458		 */
459
460		/*
461		 * Control chars which aren't controlled
462		 * by ICANON, ISIG, or IXON.
463		 */
464		if (ISSET(lflag, IEXTEN)) {
465			if (CCEQ(cc[VLNEXT], c)) {
466				if (ISSET(lflag, ECHO)) {
467					if (ISSET(lflag, ECHOE)) {
468						(void)ttyoutput('^', tp);
469						(void)ttyoutput('\b', tp);
470					} else
471						ttyecho(c, tp);
472				}
473				SET(tp->t_state, TS_LNCH);
474				goto endcase;
475			}
476			if (CCEQ(cc[VDISCARD], c)) {
477				if (ISSET(lflag, FLUSHO))
478					CLR(tp->t_lflag, FLUSHO);
479				else {
480					ttyflush(tp, FWRITE);
481					ttyecho(c, tp);
482					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
483						ttyretype(tp);
484					SET(tp->t_lflag, FLUSHO);
485				}
486				goto startoutput;
487			}
488		}
489		/*
490		 * Signals.
491		 */
492		if (ISSET(lflag, ISIG)) {
493			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
494				if (!ISSET(lflag, NOFLSH))
495					ttyflush(tp, FREAD | FWRITE);
496				ttyecho(c, tp);
497				if (tp->t_pgrp != NULL) {
498					PGRP_LOCK(tp->t_pgrp);
499					pgsignal(tp->t_pgrp,
500					    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
501					PGRP_UNLOCK(tp->t_pgrp);
502				}
503				goto endcase;
504			}
505			if (CCEQ(cc[VSUSP], c)) {
506				if (!ISSET(lflag, NOFLSH))
507					ttyflush(tp, FREAD);
508				ttyecho(c, tp);
509				if (tp->t_pgrp != NULL) {
510					PGRP_LOCK(tp->t_pgrp);
511					pgsignal(tp->t_pgrp, SIGTSTP, 1);
512					PGRP_UNLOCK(tp->t_pgrp);
513				}
514				goto endcase;
515			}
516		}
517		/*
518		 * Handle start/stop characters.
519		 */
520		if (ISSET(iflag, IXON)) {
521			if (CCEQ(cc[VSTOP], c)) {
522				if (!ISSET(tp->t_state, TS_TTSTOP)) {
523					SET(tp->t_state, TS_TTSTOP);
524					tt_stop(tp, 0);
525					return (0);
526				}
527				if (!CCEQ(cc[VSTART], c))
528					return (0);
529				/*
530				 * if VSTART == VSTOP then toggle
531				 */
532				goto endcase;
533			}
534			if (CCEQ(cc[VSTART], c))
535				goto restartoutput;
536		}
537		/*
538		 * IGNCR, ICRNL, & INLCR
539		 */
540		if (c == '\r') {
541			if (ISSET(iflag, IGNCR))
542				return (0);
543			else if (ISSET(iflag, ICRNL))
544				c = '\n';
545		} else if (c == '\n' && ISSET(iflag, INLCR))
546			c = '\r';
547	}
548	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
549		/*
550		 * From here on down canonical mode character
551		 * processing takes place.
552		 */
553		/*
554		 * erase or erase2 (^H / ^?)
555		 */
556		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
557			if (tp->t_rawq.c_cc)
558				ttyrub(unputc(&tp->t_rawq), tp);
559			goto endcase;
560		}
561		/*
562		 * kill (^U)
563		 */
564		if (CCEQ(cc[VKILL], c)) {
565			if (ISSET(lflag, ECHOKE) &&
566			    tp->t_rawq.c_cc == tp->t_rocount &&
567			    !ISSET(lflag, ECHOPRT))
568				while (tp->t_rawq.c_cc)
569					ttyrub(unputc(&tp->t_rawq), tp);
570			else {
571				ttyecho(c, tp);
572				if (ISSET(lflag, ECHOK) ||
573				    ISSET(lflag, ECHOKE))
574					ttyecho('\n', tp);
575				FLUSHQ(&tp->t_rawq);
576				tp->t_rocount = 0;
577			}
578			CLR(tp->t_state, TS_LOCAL);
579			goto endcase;
580		}
581		/*
582		 * word erase (^W)
583		 */
584		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
585			int ctype;
586
587			/*
588			 * erase whitespace
589			 */
590			while ((c = unputc(&tp->t_rawq)) == ' ' || c == '\t')
591				ttyrub(c, tp);
592			if (c == -1)
593				goto endcase;
594			/*
595			 * erase last char of word and remember the
596			 * next chars type (for ALTWERASE)
597			 */
598			ttyrub(c, tp);
599			c = unputc(&tp->t_rawq);
600			if (c == -1)
601				goto endcase;
602			if (c == ' ' || c == '\t') {
603				(void)putc(c, &tp->t_rawq);
604				goto endcase;
605			}
606			ctype = ISALPHA(c);
607			/*
608			 * erase rest of word
609			 */
610			do {
611				ttyrub(c, tp);
612				c = unputc(&tp->t_rawq);
613				if (c == -1)
614					goto endcase;
615			} while (c != ' ' && c != '\t' &&
616			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
617			(void)putc(c, &tp->t_rawq);
618			goto endcase;
619		}
620		/*
621		 * reprint line (^R)
622		 */
623		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
624			ttyretype(tp);
625			goto endcase;
626		}
627		/*
628		 * ^T - kernel info and generate SIGINFO
629		 */
630		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
631			if (ISSET(lflag, ISIG) && tp->t_pgrp != NULL) {
632				PGRP_LOCK(tp->t_pgrp);
633				pgsignal(tp->t_pgrp, SIGINFO, 1);
634				PGRP_UNLOCK(tp->t_pgrp);
635			}
636			if (!ISSET(lflag, NOKERNINFO))
637				ttyinfo(tp);
638			goto endcase;
639		}
640	}
641	/*
642	 * Check for input buffer overflow
643	 */
644	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
645input_overflow:
646		if (ISSET(iflag, IMAXBEL)) {
647			if (tp->t_outq.c_cc < tp->t_ohiwat)
648				(void)ttyoutput(CTRL('g'), tp);
649		}
650		goto endcase;
651	}
652
653	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
654	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
655		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
656
657	/*
658	 * Put data char in q for user and
659	 * wakeup on seeing a line delimiter.
660	 */
661	if (putc(c, &tp->t_rawq) >= 0) {
662		if (!ISSET(lflag, ICANON)) {
663			ttwakeup(tp);
664			ttyecho(c, tp);
665			goto endcase;
666		}
667		if (TTBREAKC(c, lflag)) {
668			tp->t_rocount = 0;
669			catq(&tp->t_rawq, &tp->t_canq);
670			ttwakeup(tp);
671		} else if (tp->t_rocount++ == 0)
672			tp->t_rocol = tp->t_column;
673		if (ISSET(tp->t_state, TS_ERASE)) {
674			/*
675			 * end of prterase \.../
676			 */
677			CLR(tp->t_state, TS_ERASE);
678			(void)ttyoutput('/', tp);
679		}
680		i = tp->t_column;
681		ttyecho(c, tp);
682		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
683			/*
684			 * Place the cursor over the '^' of the ^D.
685			 */
686			i = imin(2, tp->t_column - i);
687			while (i > 0) {
688				(void)ttyoutput('\b', tp);
689				i--;
690			}
691		}
692	}
693endcase:
694	/*
695	 * IXANY means allow any character to restart output.
696	 */
697	if (ISSET(tp->t_state, TS_TTSTOP) &&
698	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
699		return (0);
700restartoutput:
701	CLR(tp->t_lflag, FLUSHO);
702	CLR(tp->t_state, TS_TTSTOP);
703startoutput:
704	return (ttstart(tp));
705}
706
707/*
708 * Output a single character on a tty, doing output processing
709 * as needed (expanding tabs, newline processing, etc.).
710 * Returns < 0 if succeeds, otherwise returns char to resend.
711 * Must be recursive.
712 */
713static int
714ttyoutput(int c, struct tty *tp)
715{
716	tcflag_t oflag;
717	int col, s;
718
719	oflag = tp->t_oflag;
720	if (!ISSET(oflag, OPOST)) {
721		if (ISSET(tp->t_lflag, FLUSHO))
722			return (-1);
723		if (putc(c, &tp->t_outq))
724			return (c);
725		tk_nout++;
726		tp->t_outcc++;
727		return (-1);
728	}
729	/*
730	 * Do tab expansion if OXTABS is set.  Special case if we external
731	 * processing, we don't do the tab expansion because we'll probably
732	 * get it wrong.  If tab expansion needs to be done, let it happen
733	 * externally.
734	 */
735	CLR(c, ~TTY_CHARMASK);
736	if (c == '\t' &&
737	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
738		c = 8 - (tp->t_column & 7);
739		if (!ISSET(tp->t_lflag, FLUSHO)) {
740			s = spltty();		/* Don't interrupt tabs. */
741			c -= b_to_q("        ", c, &tp->t_outq);
742			tk_nout += c;
743			tp->t_outcc += c;
744			splx(s);
745		}
746		tp->t_column += c;
747		return (c ? -1 : '\t');
748	}
749	if (c == CEOT && ISSET(oflag, ONOEOT))
750		return (-1);
751
752	/*
753	 * Newline translation: if ONLCR is set,
754	 * translate newline into "\r\n".
755	 */
756	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
757		tk_nout++;
758		tp->t_outcc++;
759		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
760			return (c);
761	}
762	/* If OCRNL is set, translate "\r" into "\n". */
763	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
764		c = '\n';
765	/* If ONOCR is set, don't transmit CRs when on column 0. */
766	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
767		return (-1);
768
769	tk_nout++;
770	tp->t_outcc++;
771	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
772		return (c);
773
774	col = tp->t_column;
775	switch (CCLASS(c)) {
776	case BACKSPACE:
777		if (col > 0)
778			--col;
779		break;
780	case CONTROL:
781		break;
782	case NEWLINE:
783		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
784			col = 0;
785		break;
786	case RETURN:
787		col = 0;
788		break;
789	case ORDINARY:
790		++col;
791		break;
792	case TAB:
793		col = (col + 8) & ~7;
794		break;
795	}
796	tp->t_column = col;
797	return (-1);
798}
799
800/*
801 * Ioctls for all tty devices.  Called after line-discipline specific ioctl
802 * has been called to do discipline-specific functions and/or reject any
803 * of these ioctl commands.
804 */
805/* ARGSUSED */
806int
807ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
808{
809	struct proc *p;
810	struct thread *td;
811	struct pgrp *pgrp;
812	int s, error, bits, sig, sig2;
813
814	td = curthread;			/* XXX */
815	p = td->td_proc;
816
817	/* If the ioctl involves modification, hang if in the background. */
818	switch (cmd) {
819	case  TIOCCBRK:
820	case  TIOCCONS:
821	case  TIOCDRAIN:
822	case  TIOCEXCL:
823	case  TIOCFLUSH:
824#ifdef TIOCHPCL
825	case  TIOCHPCL:
826#endif
827	case  TIOCNXCL:
828	case  TIOCSBRK:
829	case  TIOCSCTTY:
830	case  TIOCSDRAINWAIT:
831	case  TIOCSETA:
832	case  TIOCSETAF:
833	case  TIOCSETAW:
834	case  TIOCSETD:
835	case  TIOCSPGRP:
836	case  TIOCSTART:
837	case  TIOCSTAT:
838	case  TIOCSTI:
839	case  TIOCSTOP:
840	case  TIOCSWINSZ:
841#if defined(COMPAT_43TTY)
842	case  TIOCLBIC:
843	case  TIOCLBIS:
844	case  TIOCLSET:
845	case  TIOCSETC:
846	case OTIOCSETD:
847	case  TIOCSETN:
848	case  TIOCSETP:
849	case  TIOCSLTC:
850#endif
851		sx_slock(&proctree_lock);
852		PROC_LOCK(p);
853		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
854		    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
855		    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
856			pgrp = p->p_pgrp;
857			PROC_UNLOCK(p);
858			if (pgrp->pg_jobc == 0) {
859				sx_sunlock(&proctree_lock);
860				return (EIO);
861			}
862			PGRP_LOCK(pgrp);
863			sx_sunlock(&proctree_lock);
864			pgsignal(pgrp, SIGTTOU, 1);
865			PGRP_UNLOCK(pgrp);
866			error = ttysleep(tp, &lbolt, TTOPRI | PCATCH, "ttybg1",
867					 0);
868			if (error)
869				return (error);
870			sx_slock(&proctree_lock);
871			PROC_LOCK(p);
872		}
873		PROC_UNLOCK(p);
874		sx_sunlock(&proctree_lock);
875		break;
876	}
877
878
879	if (tp->t_modem != NULL) {
880		switch (cmd) {
881		case TIOCSDTR:
882			tt_modem(tp, SER_DTR, 0);
883			return (0);
884		case TIOCCDTR:
885			tt_modem(tp, 0, SER_DTR);
886			return (0);
887		case TIOCMSET:
888			bits = *(int *)data;
889			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
890			sig2 = ((~bits) & (TIOCM_DTR | TIOCM_RTS)) >> 1;
891			tt_modem(tp, sig, sig2);
892			return (0);
893		case TIOCMBIS:
894			bits = *(int *)data;
895			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
896			tt_modem(tp, sig, 0);
897			return (0);
898		case TIOCMBIC:
899			bits = *(int *)data;
900			sig = (bits & (TIOCM_DTR | TIOCM_RTS)) >> 1;
901			tt_modem(tp, 0, sig);
902			return (0);
903		case TIOCMGET:
904			sig = tt_modem(tp, 0, 0);
905			/* See <sys/serial.h. for the "<< 1" stuff */
906			bits = TIOCM_LE + (sig << 1);
907			*(int *)data = bits;
908			return (0);
909		default:
910			break;
911		}
912	}
913
914	if (tp->t_pps != NULL) {
915		error = pps_ioctl(cmd, data, tp->t_pps);
916		if (error != ENOIOCTL)
917			return (error);
918	}
919
920	switch (cmd) {			/* Process the ioctl. */
921	case FIOASYNC:			/* set/clear async i/o */
922		s = spltty();
923		if (*(int *)data)
924			SET(tp->t_state, TS_ASYNC);
925		else
926			CLR(tp->t_state, TS_ASYNC);
927		splx(s);
928		break;
929	case FIONBIO:			/* set/clear non-blocking i/o */
930		break;			/* XXX: delete. */
931	case FIONREAD:			/* get # bytes to read */
932		s = spltty();
933		*(int *)data = ttnread(tp);
934		splx(s);
935		break;
936
937	case FIOSETOWN:
938		/*
939		 * Policy -- Don't allow FIOSETOWN on someone else's
940		 *           controlling tty
941		 */
942		if (tp->t_session != NULL && !isctty(p, tp))
943			return (ENOTTY);
944
945		error = fsetown(*(int *)data, &tp->t_sigio);
946		if (error)
947			return (error);
948		break;
949	case FIOGETOWN:
950		if (tp->t_session != NULL && !isctty(p, tp))
951			return (ENOTTY);
952		*(int *)data = fgetown(&tp->t_sigio);
953		break;
954
955	case TIOCEXCL:			/* set exclusive use of tty */
956		s = spltty();
957		SET(tp->t_state, TS_XCLUDE);
958		splx(s);
959		break;
960	case TIOCFLUSH: {		/* flush buffers */
961		int flags = *(int *)data;
962
963		if (flags == 0)
964			flags = FREAD | FWRITE;
965		else
966			flags &= FREAD | FWRITE;
967		ttyflush(tp, flags);
968		break;
969	}
970	case TIOCCONS:			/* become virtual console */
971		if (*(int *)data) {
972			struct nameidata nid;
973
974			if (constty && constty != tp &&
975			    ISSET(constty->t_state, TS_CONNECTED))
976				return (EBUSY);
977
978			/* Ensure user can open the real console. */
979			NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
980			    "/dev/console", td);
981			if ((error = namei(&nid)) != 0)
982				return (error);
983			NDFREE(&nid, NDF_ONLY_PNBUF);
984			error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
985			vput(nid.ni_vp);
986			if (error)
987				return (error);
988
989			constty_set(tp);
990		} else if (tp == constty)
991			constty_clear();
992		break;
993	case TIOCDRAIN:			/* wait till output drained */
994		error = ttywait(tp);
995		if (error)
996			return (error);
997		break;
998	case TIOCGETA: {		/* get termios struct */
999		struct termios *t = (struct termios *)data;
1000
1001		bcopy(&tp->t_termios, t, sizeof(struct termios));
1002		break;
1003	}
1004	case TIOCGETD:			/* get line discipline */
1005		*(int *)data = tp->t_line;
1006		break;
1007	case TIOCGWINSZ:		/* get window size */
1008		*(struct winsize *)data = tp->t_winsize;
1009		break;
1010	case TIOCGPGRP:			/* get pgrp of tty */
1011		if (!isctty(p, tp))
1012			return (ENOTTY);
1013		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1014		break;
1015	case TIOCGSID:                  /* get sid of tty */
1016		if (!isctty(p, tp))
1017			return (ENOTTY);
1018		*(int *)data = tp->t_session->s_sid;
1019		break;
1020#ifdef TIOCHPCL
1021	case TIOCHPCL:			/* hang up on last close */
1022		s = spltty();
1023		SET(tp->t_cflag, HUPCL);
1024		splx(s);
1025		break;
1026#endif
1027	case TIOCMGDTRWAIT:
1028		*(int *)data = tp->t_dtr_wait * 100 / hz;
1029		break;
1030	case TIOCMSDTRWAIT:
1031		/* must be root since the wait applies to following logins */
1032		error = priv_check(td, PRIV_TTY_DTRWAIT);
1033		if (error)
1034			return (error);
1035		tp->t_dtr_wait = *(int *)data * hz / 100;
1036		break;
1037	case TIOCNXCL:			/* reset exclusive use of tty */
1038		s = spltty();
1039		CLR(tp->t_state, TS_XCLUDE);
1040		splx(s);
1041		break;
1042	case TIOCOUTQ:			/* output queue size */
1043		*(int *)data = tp->t_outq.c_cc;
1044		break;
1045	case TIOCSETA:			/* set termios struct */
1046	case TIOCSETAW:			/* drain output, set */
1047	case TIOCSETAF: {		/* drn out, fls in, set */
1048		struct termios *t = (struct termios *)data;
1049
1050		if (t->c_ispeed == 0)
1051			t->c_ispeed = t->c_ospeed;
1052		if (t->c_ispeed == 0)
1053			t->c_ispeed = tp->t_ospeed;
1054		if (t->c_ispeed == 0)
1055			return (EINVAL);
1056		s = spltty();
1057		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1058			error = ttywait(tp);
1059			if (error) {
1060				splx(s);
1061				return (error);
1062			}
1063			if (cmd == TIOCSETAF)
1064				ttyflush(tp, FREAD);
1065		}
1066		if (!ISSET(t->c_cflag, CIGNORE)) {
1067			/*
1068			 * Set device hardware.
1069			 */
1070			error = tt_param(tp, t);
1071			if (error) {
1072				splx(s);
1073				return (error);
1074			}
1075			if (ISSET(t->c_cflag, CLOCAL) &&
1076			    !ISSET(tp->t_cflag, CLOCAL)) {
1077				/*
1078				 * XXX disconnections would be too hard to
1079				 * get rid of without this kludge.  The only
1080				 * way to get rid of controlling terminals
1081				 * is to exit from the session leader.
1082				 */
1083				CLR(tp->t_state, TS_ZOMBIE);
1084
1085				wakeup(TSA_CARR_ON(tp));
1086				ttwakeup(tp);
1087				ttwwakeup(tp);
1088			}
1089			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1090			     ISSET(t->c_cflag, CLOCAL)) &&
1091			    !ISSET(tp->t_state, TS_ZOMBIE))
1092				SET(tp->t_state, TS_CONNECTED);
1093			else
1094				CLR(tp->t_state, TS_CONNECTED);
1095			tp->t_cflag = t->c_cflag;
1096			tp->t_ispeed = t->c_ispeed;
1097			if (t->c_ospeed != 0)
1098				tp->t_ospeed = t->c_ospeed;
1099			ttsetwater(tp);
1100		}
1101		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1102		    cmd != TIOCSETAF) {
1103			if (ISSET(t->c_lflag, ICANON))
1104				SET(tp->t_lflag, PENDIN);
1105			else {
1106				/*
1107				 * XXX we really shouldn't allow toggling
1108				 * ICANON while we're in a non-termios line
1109				 * discipline.  Now we have to worry about
1110				 * panicing for a null queue.
1111				 */
1112				if (tp->t_canq.c_cbreserved > 0 &&
1113				    tp->t_rawq.c_cbreserved > 0) {
1114					catq(&tp->t_rawq, &tp->t_canq);
1115					/*
1116					 * XXX the queue limits may be
1117					 * different, so the old queue
1118					 * swapping method no longer works.
1119					 */
1120					catq(&tp->t_canq, &tp->t_rawq);
1121				}
1122				CLR(tp->t_lflag, PENDIN);
1123			}
1124			ttwakeup(tp);
1125		}
1126		tp->t_iflag = t->c_iflag;
1127		tp->t_oflag = t->c_oflag;
1128		/*
1129		 * Make the EXTPROC bit read only.
1130		 */
1131		if (ISSET(tp->t_lflag, EXTPROC))
1132			SET(t->c_lflag, EXTPROC);
1133		else
1134			CLR(t->c_lflag, EXTPROC);
1135		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1136		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1137		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1138			ttwakeup(tp);
1139		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1140		splx(s);
1141		break;
1142	}
1143	case TIOCSETD: {		/* set line discipline */
1144		int t = *(int *)data;
1145
1146		if ((u_int)t >= nlinesw)
1147			return (ENXIO);
1148		if (t == tp->t_line)
1149			return (0);
1150		s = spltty();
1151		ttyld_close(tp, flag);
1152		tp->t_line = t;
1153		/* XXX: we should use the correct cdev here */
1154		error = ttyld_open(tp, tp->t_dev);
1155		if (error) {
1156			/*
1157			 * If we fail to switch line discipline we cannot
1158			 * fall back to the previous, because we can not
1159			 * trust that ldisc to open successfully either.
1160			 * Fall back to the default ldisc which we know
1161			 * will allways succeed.
1162			 */
1163			tp->t_line = TTYDISC;
1164			(void)ttyld_open(tp, tp->t_dev);
1165		}
1166		splx(s);
1167		return (error);
1168		break;
1169	}
1170	case TIOCSTART:			/* start output, like ^Q */
1171		s = spltty();
1172		if (ISSET(tp->t_state, TS_TTSTOP) ||
1173		    ISSET(tp->t_lflag, FLUSHO)) {
1174			CLR(tp->t_lflag, FLUSHO);
1175			CLR(tp->t_state, TS_TTSTOP);
1176			ttstart(tp);
1177		}
1178		splx(s);
1179		break;
1180	case TIOCSTI:			/* simulate terminal input */
1181		if ((flag & FREAD) == 0 && priv_check(td, PRIV_TTY_STI))
1182			return (EPERM);
1183		if (!isctty(p, tp) && priv_check(td, PRIV_TTY_STI))
1184			return (EACCES);
1185		s = spltty();
1186		ttyld_rint(tp, *(u_char *)data);
1187		splx(s);
1188		break;
1189	case TIOCSTOP:			/* stop output, like ^S */
1190		s = spltty();
1191		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1192			SET(tp->t_state, TS_TTSTOP);
1193			tt_stop(tp, 0);
1194		}
1195		splx(s);
1196		break;
1197	case TIOCSCTTY:			/* become controlling tty */
1198		/* Session ctty vnode pointer set in vnode layer. */
1199		sx_slock(&proctree_lock);
1200		if (!SESS_LEADER(p) ||
1201		    ((p->p_session->s_ttyvp || tp->t_session) &&
1202		     (tp->t_session != p->p_session))) {
1203			sx_sunlock(&proctree_lock);
1204			return (EPERM);
1205		}
1206		tp->t_session = p->p_session;
1207		tp->t_pgrp = p->p_pgrp;
1208		SESS_LOCK(p->p_session);
1209		ttyref(tp);		/* ttyrel(): kern_proc.c:pgdelete() */
1210		p->p_session->s_ttyp = tp;
1211		SESS_UNLOCK(p->p_session);
1212		PROC_LOCK(p);
1213		p->p_flag |= P_CONTROLT;
1214		PROC_UNLOCK(p);
1215		sx_sunlock(&proctree_lock);
1216		break;
1217	case TIOCSPGRP: {		/* set pgrp of tty */
1218		sx_slock(&proctree_lock);
1219		pgrp = pgfind(*(int *)data);
1220		if (!isctty(p, tp)) {
1221			if (pgrp != NULL)
1222				PGRP_UNLOCK(pgrp);
1223			sx_sunlock(&proctree_lock);
1224			return (ENOTTY);
1225		}
1226		if (pgrp == NULL) {
1227			sx_sunlock(&proctree_lock);
1228			return (EPERM);
1229		}
1230		PGRP_UNLOCK(pgrp);
1231		if (pgrp->pg_session != p->p_session) {
1232			sx_sunlock(&proctree_lock);
1233			return (EPERM);
1234		}
1235		sx_sunlock(&proctree_lock);
1236		tp->t_pgrp = pgrp;
1237		break;
1238	}
1239	case TIOCSTAT:			/* simulate control-T */
1240		s = spltty();
1241		ttyinfo(tp);
1242		splx(s);
1243		break;
1244	case TIOCSWINSZ:		/* set window size */
1245		if (bcmp((caddr_t)&tp->t_winsize, data,
1246		    sizeof (struct winsize))) {
1247			tp->t_winsize = *(struct winsize *)data;
1248			if (tp->t_pgrp != NULL) {
1249				PGRP_LOCK(tp->t_pgrp);
1250				pgsignal(tp->t_pgrp, SIGWINCH, 1);
1251				PGRP_UNLOCK(tp->t_pgrp);
1252			}
1253		}
1254		break;
1255	case TIOCSDRAINWAIT:
1256		error = priv_check(td, PRIV_TTY_DRAINWAIT);
1257		if (error)
1258			return (error);
1259		tp->t_timeout = *(int *)data * hz;
1260		wakeup(TSA_OCOMPLETE(tp));
1261		wakeup(TSA_OLOWAT(tp));
1262		break;
1263	case TIOCGDRAINWAIT:
1264		*(int *)data = tp->t_timeout / hz;
1265		break;
1266	case TIOCSBRK:
1267		return (tt_break(tp, 1));
1268	case TIOCCBRK:
1269		return (tt_break(tp, 0));
1270	default:
1271#if defined(COMPAT_43TTY)
1272		return (ttcompat(tp, cmd, data, flag));
1273#else
1274		return (ENOIOCTL);
1275#endif
1276	}
1277	return (0);
1278}
1279
1280int
1281ttypoll(struct cdev *dev, int events, struct thread *td)
1282{
1283	int s;
1284	int revents = 0;
1285	struct tty *tp;
1286
1287	tp = tty_gettp(dev);
1288
1289	if (tp == NULL)	/* XXX used to return ENXIO, but that means true! */
1290		return ((events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM))
1291			| POLLHUP);
1292
1293	s = spltty();
1294	if (events & (POLLIN | POLLRDNORM)) {
1295		if (ISSET(tp->t_state, TS_ZOMBIE))
1296			revents |= (events & (POLLIN | POLLRDNORM)) |
1297			    POLLHUP;
1298		else if (ttnread(tp) > 0)
1299			revents |= events & (POLLIN | POLLRDNORM);
1300		else
1301			selrecord(td, &tp->t_rsel);
1302	}
1303	if (events & POLLOUT) {
1304		if (ISSET(tp->t_state, TS_ZOMBIE))
1305			revents |= POLLHUP;
1306		else if (tp->t_outq.c_cc <= tp->t_olowat &&
1307		    ISSET(tp->t_state, TS_CONNECTED))
1308			revents |= events & POLLOUT;
1309		else
1310			selrecord(td, &tp->t_wsel);
1311	}
1312	splx(s);
1313	return (revents);
1314}
1315
1316static struct filterops ttyread_filtops =
1317	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1318static struct filterops ttywrite_filtops =
1319	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1320
1321int
1322ttykqfilter(struct cdev *dev, struct knote *kn)
1323{
1324	struct tty *tp;
1325	struct knlist *klist;
1326	int s;
1327
1328	tp = tty_gettp(dev);
1329	if (tp == NULL || (tp->t_state & TS_GONE))
1330		return (ENODEV);
1331
1332	switch (kn->kn_filter) {
1333	case EVFILT_READ:
1334		klist = &tp->t_rsel.si_note;
1335		kn->kn_fop = &ttyread_filtops;
1336		break;
1337	case EVFILT_WRITE:
1338		klist = &tp->t_wsel.si_note;
1339		kn->kn_fop = &ttywrite_filtops;
1340		break;
1341	default:
1342		return (EINVAL);
1343	}
1344
1345	kn->kn_hook = (caddr_t)tp;
1346
1347	s = spltty();
1348	knlist_add(klist, kn, 0);
1349	splx(s);
1350
1351	return (0);
1352}
1353
1354static void
1355filt_ttyrdetach(struct knote *kn)
1356{
1357	struct tty *tp = (struct tty *)kn->kn_hook;
1358	int s = spltty();
1359
1360	knlist_remove(&tp->t_rsel.si_note, kn, 0);
1361	splx(s);
1362}
1363
1364static int
1365filt_ttyread(struct knote *kn, long hint)
1366{
1367	struct tty *tp = (struct tty *)kn->kn_hook;
1368
1369	kn->kn_data = ttnread(tp);
1370	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE)) {
1371		kn->kn_flags |= EV_EOF;
1372		return (1);
1373	}
1374	return (kn->kn_data > 0);
1375}
1376
1377static void
1378filt_ttywdetach(struct knote *kn)
1379{
1380	struct tty *tp = (struct tty *)kn->kn_hook;
1381	int s = spltty();
1382
1383	knlist_remove(&tp->t_wsel.si_note, kn, 0);
1384	splx(s);
1385}
1386
1387static int
1388filt_ttywrite(struct knote *kn, long hint)
1389{
1390	struct tty *tp = (struct tty *)kn->kn_hook;
1391
1392	kn->kn_data = tp->t_outq.c_cc;
1393	if ((tp->t_state & TS_GONE) || ISSET(tp->t_state, TS_ZOMBIE))
1394		return (1);
1395	return (kn->kn_data <= tp->t_olowat &&
1396	    ISSET(tp->t_state, TS_CONNECTED));
1397}
1398
1399/*
1400 * Must be called at spltty().
1401 */
1402static int
1403ttnread(struct tty *tp)
1404{
1405	int nread;
1406
1407	if (ISSET(tp->t_lflag, PENDIN))
1408		ttypend(tp);
1409	nread = tp->t_canq.c_cc;
1410	if (!ISSET(tp->t_lflag, ICANON)) {
1411		nread += tp->t_rawq.c_cc;
1412		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1413			nread = 0;
1414	}
1415	return (nread);
1416}
1417
1418/*
1419 * Wait for output to drain.
1420 */
1421int
1422ttywait(struct tty *tp)
1423{
1424	int error, s;
1425
1426	error = 0;
1427	s = spltty();
1428	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1429	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1430		tt_oproc(tp);
1431		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1432		    ISSET(tp->t_state, TS_CONNECTED)) {
1433			SET(tp->t_state, TS_SO_OCOMPLETE);
1434			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1435					 TTOPRI | PCATCH, "ttywai",
1436					 tp->t_timeout);
1437			if (error) {
1438				if (error == EWOULDBLOCK)
1439					error = EIO;
1440				break;
1441			}
1442		} else
1443			break;
1444	}
1445	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1446		error = EIO;
1447	splx(s);
1448	return (error);
1449}
1450
1451/*
1452 * Flush if successfully wait.
1453 */
1454static int
1455ttywflush(struct tty *tp)
1456{
1457	int error;
1458
1459	if ((error = ttywait(tp)) == 0)
1460		ttyflush(tp, FREAD);
1461	return (error);
1462}
1463
1464/*
1465 * Flush tty read and/or write queues, notifying anyone waiting.
1466 */
1467void
1468ttyflush(struct tty *tp, int rw)
1469{
1470	int s;
1471
1472	s = spltty();
1473#if 0
1474again:
1475#endif
1476	if (rw & FWRITE) {
1477		FLUSHQ(&tp->t_outq);
1478		CLR(tp->t_state, TS_TTSTOP);
1479	}
1480	tt_stop(tp, rw);
1481	if (rw & FREAD) {
1482		FLUSHQ(&tp->t_canq);
1483		FLUSHQ(&tp->t_rawq);
1484		CLR(tp->t_lflag, PENDIN);
1485		tp->t_rocount = 0;
1486		tp->t_rocol = 0;
1487		CLR(tp->t_state, TS_LOCAL);
1488		ttwakeup(tp);
1489		if (ISSET(tp->t_state, TS_TBLOCK)) {
1490			if (rw & FWRITE)
1491				FLUSHQ(&tp->t_outq);
1492			ttyunblock(tp);
1493
1494			/*
1495			 * Don't let leave any state that might clobber the
1496			 * next line discipline (although we should do more
1497			 * to send the START char).  Not clearing the state
1498			 * may have caused the "putc to a clist with no
1499			 * reserved cblocks" panic/printf.
1500			 */
1501			CLR(tp->t_state, TS_TBLOCK);
1502
1503#if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1504			if (ISSET(tp->t_iflag, IXOFF)) {
1505				/*
1506				 * XXX wait a bit in the hope that the stop
1507				 * character (if any) will go out.  Waiting
1508				 * isn't good since it allows races.  This
1509				 * will be fixed when the stop character is
1510				 * put in a special queue.  Don't bother with
1511				 * the checks in ttywait() since the timeout
1512				 * will save us.
1513				 */
1514				SET(tp->t_state, TS_SO_OCOMPLETE);
1515				ttysleep(tp, TSA_OCOMPLETE(tp), TTOPRI,
1516					 "ttyfls", hz / 10);
1517				/*
1518				 * Don't try sending the stop character again.
1519				 */
1520				CLR(tp->t_state, TS_TBLOCK);
1521				goto again;
1522			}
1523#endif
1524		}
1525	}
1526	if (rw & FWRITE) {
1527		FLUSHQ(&tp->t_outq);
1528		ttwwakeup(tp);
1529	}
1530	splx(s);
1531}
1532
1533/*
1534 * Copy in the default termios characters.
1535 */
1536void
1537termioschars(struct termios *t)
1538{
1539
1540	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1541}
1542
1543/*
1544 * Old interface.
1545 */
1546void
1547ttychars(struct tty *tp)
1548{
1549
1550	termioschars(&tp->t_termios);
1551}
1552
1553/*
1554 * Handle input high water.  Send stop character for the IXOFF case.  Turn
1555 * on our input flow control bit and propagate the changes to the driver.
1556 * XXX the stop character should be put in a special high priority queue.
1557 */
1558void
1559ttyblock(struct tty *tp)
1560{
1561
1562	SET(tp->t_state, TS_TBLOCK);
1563	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1564	    putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1565		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1566	ttstart(tp);
1567}
1568
1569/*
1570 * Handle input low water.  Send start character for the IXOFF case.  Turn
1571 * off our input flow control bit and propagate the changes to the driver.
1572 * XXX the start character should be put in a special high priority queue.
1573 */
1574static void
1575ttyunblock(struct tty *tp)
1576{
1577
1578	CLR(tp->t_state, TS_TBLOCK);
1579	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1580	    putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1581		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1582	ttstart(tp);
1583}
1584
1585#ifdef notyet
1586/* Not used by any current (i386) drivers. */
1587/*
1588 * Restart after an inter-char delay.
1589 */
1590void
1591ttrstrt(void *tp_arg)
1592{
1593	struct tty *tp;
1594	int s;
1595
1596	KASSERT(tp_arg != NULL, ("ttrstrt"));
1597
1598	tp = tp_arg;
1599	s = spltty();
1600
1601	CLR(tp->t_state, TS_TIMEOUT);
1602	ttstart(tp);
1603
1604	splx(s);
1605}
1606#endif
1607
1608int
1609ttstart(struct tty *tp)
1610{
1611
1612	tt_oproc(tp);
1613	return (0);
1614}
1615
1616/*
1617 * "close" a line discipline
1618 */
1619int
1620ttylclose(struct tty *tp, int flag)
1621{
1622
1623	if (flag & FNONBLOCK || ttywflush(tp))
1624		ttyflush(tp, FREAD | FWRITE);
1625	return (0);
1626}
1627
1628/*
1629 * Handle modem control transition on a tty.
1630 * Flag indicates new state of carrier.
1631 * Returns 0 if the line should be turned off, otherwise 1.
1632 */
1633int
1634ttymodem(struct tty *tp, int flag)
1635{
1636
1637	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1638		/*
1639		 * MDMBUF: do flow control according to carrier flag
1640		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1641		 * works if IXON and IXANY are clear.
1642		 */
1643		if (flag) {
1644			CLR(tp->t_state, TS_CAR_OFLOW);
1645			CLR(tp->t_state, TS_TTSTOP);
1646			ttstart(tp);
1647		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1648			SET(tp->t_state, TS_CAR_OFLOW);
1649			SET(tp->t_state, TS_TTSTOP);
1650			tt_stop(tp, 0);
1651		}
1652	} else if (flag == 0) {
1653		/*
1654		 * Lost carrier.
1655		 */
1656		CLR(tp->t_state, TS_CARR_ON);
1657		if (ISSET(tp->t_state, TS_ISOPEN) &&
1658		    !ISSET(tp->t_cflag, CLOCAL)) {
1659			SET(tp->t_state, TS_ZOMBIE);
1660			CLR(tp->t_state, TS_CONNECTED);
1661			if (tp->t_session) {
1662				sx_slock(&proctree_lock);
1663				if (tp->t_session && tp->t_session->s_leader) {
1664					struct proc *p;
1665
1666					p = tp->t_session->s_leader;
1667					PROC_LOCK(p);
1668					psignal(p, SIGHUP);
1669					PROC_UNLOCK(p);
1670				}
1671				sx_sunlock(&proctree_lock);
1672			}
1673			ttyflush(tp, FREAD | FWRITE);
1674			return (0);
1675		}
1676	} else {
1677		/*
1678		 * Carrier now on.
1679		 */
1680		SET(tp->t_state, TS_CARR_ON);
1681		if (!ISSET(tp->t_state, TS_ZOMBIE))
1682			SET(tp->t_state, TS_CONNECTED);
1683		wakeup(TSA_CARR_ON(tp));
1684		ttwakeup(tp);
1685		ttwwakeup(tp);
1686	}
1687	return (1);
1688}
1689
1690/*
1691 * Reinput pending characters after state switch
1692 * call at spltty().
1693 */
1694static void
1695ttypend(struct tty *tp)
1696{
1697	struct clist tq;
1698	int c;
1699
1700	CLR(tp->t_lflag, PENDIN);
1701	SET(tp->t_state, TS_TYPEN);
1702	/*
1703	 * XXX this assumes too much about clist internals.  It may even
1704	 * fail if the cblock slush pool is empty.  We can't allocate more
1705	 * cblocks here because we are called from an interrupt handler
1706	 * and clist_alloc_cblocks() can wait.
1707	 */
1708	tq = tp->t_rawq;
1709	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1710	tp->t_rawq.c_cbmax = tq.c_cbmax;
1711	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1712	while ((c = getc(&tq)) >= 0)
1713		ttyinput(c, tp);
1714	CLR(tp->t_state, TS_TYPEN);
1715}
1716
1717/*
1718 * Process a read call on a tty device.
1719 */
1720int
1721ttread(struct tty *tp, struct uio *uio, int flag)
1722{
1723	struct clist *qp;
1724	int c;
1725	tcflag_t lflag;
1726	cc_t *cc = tp->t_cc;
1727	struct thread *td;
1728	struct proc *p;
1729	int s, first, error = 0;
1730	int has_stime = 0, last_cc = 0;
1731	long slp = 0;		/* XXX this should be renamed `timo'. */
1732	struct timeval stime = { 0, 0 };
1733	struct pgrp *pg;
1734
1735	td = curthread;
1736	p = td->td_proc;
1737loop:
1738	s = spltty();
1739	lflag = tp->t_lflag;
1740	/*
1741	 * take pending input first
1742	 */
1743	if (ISSET(lflag, PENDIN)) {
1744		ttypend(tp);
1745		splx(s);	/* reduce latency */
1746		s = spltty();
1747		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1748	}
1749
1750	/*
1751	 * Hang process if it's in the background.
1752	 */
1753	if (isbackground(p, tp)) {
1754		splx(s);
1755		sx_slock(&proctree_lock);
1756		PROC_LOCK(p);
1757		if (SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTIN) ||
1758		    SIGISMEMBER(td->td_sigmask, SIGTTIN) ||
1759		    (p->p_flag & P_PPWAIT) || p->p_pgrp->pg_jobc == 0) {
1760			PROC_UNLOCK(p);
1761			sx_sunlock(&proctree_lock);
1762			return (EIO);
1763		}
1764		pg = p->p_pgrp;
1765		PROC_UNLOCK(p);
1766		PGRP_LOCK(pg);
1767		sx_sunlock(&proctree_lock);
1768		pgsignal(pg, SIGTTIN, 1);
1769		PGRP_UNLOCK(pg);
1770		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg2", 0);
1771		if (error)
1772			return (error);
1773		goto loop;
1774	}
1775
1776	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1777		splx(s);
1778		return (0);	/* EOF */
1779	}
1780
1781	/*
1782	 * If canonical, use the canonical queue,
1783	 * else use the raw queue.
1784	 *
1785	 * (should get rid of clists...)
1786	 */
1787	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1788
1789	if (flag & IO_NDELAY) {
1790		if (qp->c_cc > 0)
1791			goto read;
1792		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1793			splx(s);
1794			return (0);
1795		}
1796		splx(s);
1797		return (EWOULDBLOCK);
1798	}
1799	if (!ISSET(lflag, ICANON)) {
1800		int m = cc[VMIN];
1801		long t = cc[VTIME];
1802		struct timeval timecopy;
1803
1804		/*
1805		 * Check each of the four combinations.
1806		 * (m > 0 && t == 0) is the normal read case.
1807		 * It should be fairly efficient, so we check that and its
1808		 * companion case (m == 0 && t == 0) first.
1809		 * For the other two cases, we compute the target sleep time
1810		 * into slp.
1811		 */
1812		if (t == 0) {
1813			if (qp->c_cc < m)
1814				goto sleep;
1815			if (qp->c_cc > 0)
1816				goto read;
1817
1818			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1819			splx(s);
1820			return (0);
1821		}
1822		t *= 100000;		/* time in us */
1823#define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1824			 ((t1).tv_usec - (t2).tv_usec))
1825		if (m > 0) {
1826			if (qp->c_cc <= 0)
1827				goto sleep;
1828			if (qp->c_cc >= m)
1829				goto read;
1830			getmicrotime(&timecopy);
1831			if (!has_stime) {
1832				/* first character, start timer */
1833				has_stime = 1;
1834				stime = timecopy;
1835				slp = t;
1836			} else if (qp->c_cc > last_cc) {
1837				/* got a character, restart timer */
1838				stime = timecopy;
1839				slp = t;
1840			} else {
1841				/* nothing, check expiration */
1842				slp = t - diff(timecopy, stime);
1843				if (slp <= 0)
1844					goto read;
1845			}
1846			last_cc = qp->c_cc;
1847		} else {	/* m == 0 */
1848			if (qp->c_cc > 0)
1849				goto read;
1850			getmicrotime(&timecopy);
1851			if (!has_stime) {
1852				has_stime = 1;
1853				stime = timecopy;
1854				slp = t;
1855			} else {
1856				slp = t - diff(timecopy, stime);
1857				if (slp <= 0) {
1858					/* Timed out, but 0 is enough input. */
1859					splx(s);
1860					return (0);
1861				}
1862			}
1863		}
1864#undef diff
1865		if (slp != 0) {
1866			struct timeval tv;	/* XXX style bug. */
1867
1868			tv.tv_sec = slp / 1000000;
1869			tv.tv_usec = slp % 1000000;
1870			slp = tvtohz(&tv);
1871			/*
1872			 * XXX bad variable names.  slp was the timeout in
1873			 * usec.  Now it is the timeout in ticks.
1874			 */
1875		}
1876		goto sleep;
1877	}
1878	if (qp->c_cc <= 0) {
1879sleep:
1880		/*
1881		 * There is no input, or not enough input and we can block.
1882		 */
1883		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), TTIPRI | PCATCH,
1884				 ISSET(tp->t_state, TS_CONNECTED) ?
1885				 "ttyin" : "ttyhup", (int)slp);
1886		splx(s);
1887		if (error == EWOULDBLOCK)
1888			error = 0;
1889		else if (error)
1890			return (error);
1891		/*
1892		 * XXX what happens if another process eats some input
1893		 * while we are asleep (not just here)?  It would be
1894		 * safest to detect changes and reset our state variables
1895		 * (has_stime and last_cc).
1896		 */
1897		slp = 0;
1898		goto loop;
1899	}
1900read:
1901	splx(s);
1902	/*
1903	 * Input present, check for input mapping and processing.
1904	 */
1905	first = 1;
1906	if (ISSET(lflag, ICANON | ISIG))
1907		goto slowcase;
1908	for (;;) {
1909		char ibuf[IBUFSIZ];
1910		int icc;
1911
1912		icc = imin(uio->uio_resid, IBUFSIZ);
1913		icc = q_to_b(qp, ibuf, icc);
1914		if (icc <= 0) {
1915			if (first)
1916				goto loop;
1917			break;
1918		}
1919		error = uiomove(ibuf, icc, uio);
1920		/*
1921		 * XXX if there was an error then we should ungetc() the
1922		 * unmoved chars and reduce icc here.
1923		 */
1924		if (error)
1925			break;
1926		if (uio->uio_resid == 0)
1927			break;
1928		first = 0;
1929	}
1930	goto out;
1931slowcase:
1932	for (;;) {
1933		c = getc(qp);
1934		if (c < 0) {
1935			if (first)
1936				goto loop;
1937			break;
1938		}
1939		/*
1940		 * delayed suspend (^Y)
1941		 */
1942		if (CCEQ(cc[VDSUSP], c) &&
1943		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1944			if (tp->t_pgrp != NULL) {
1945				PGRP_LOCK(tp->t_pgrp);
1946				pgsignal(tp->t_pgrp, SIGTSTP, 1);
1947				PGRP_UNLOCK(tp->t_pgrp);
1948			}
1949			if (first) {
1950				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
1951						 "ttybg3", 0);
1952				if (error)
1953					break;
1954				goto loop;
1955			}
1956			break;
1957		}
1958		/*
1959		 * Interpret EOF only in canonical mode.
1960		 */
1961		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1962			break;
1963		/*
1964		 * Give user character.
1965		 */
1966		error = ureadc(c, uio);
1967		if (error)
1968			/* XXX should ungetc(c, qp). */
1969			break;
1970		if (uio->uio_resid == 0)
1971			break;
1972		/*
1973		 * In canonical mode check for a "break character"
1974		 * marking the end of a "line of input".
1975		 */
1976		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1977			break;
1978		first = 0;
1979	}
1980
1981out:
1982	/*
1983	 * Look to unblock input now that (presumably)
1984	 * the input queue has gone down.
1985	 */
1986	s = spltty();
1987	if (ISSET(tp->t_state, TS_TBLOCK) &&
1988	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1989		ttyunblock(tp);
1990	splx(s);
1991
1992	return (error);
1993}
1994
1995/*
1996 * Check the output queue on tp for space for a kernel message (from uprintf
1997 * or tprintf).  Allow some space over the normal hiwater mark so we don't
1998 * lose messages due to normal flow control, but don't let the tty run amok.
1999 * Sleeps here are not interruptible, but we return prematurely if new signals
2000 * arrive.
2001 */
2002int
2003ttycheckoutq(struct tty *tp, int wait)
2004{
2005	int hiwat, s;
2006	sigset_t oldmask;
2007	struct thread *td;
2008	struct proc *p;
2009
2010	td = curthread;
2011	p = td->td_proc;
2012	hiwat = tp->t_ohiwat;
2013	SIGEMPTYSET(oldmask);
2014	s = spltty();
2015	if (wait) {
2016		PROC_LOCK(p);
2017		oldmask = td->td_siglist;
2018		PROC_UNLOCK(p);
2019	}
2020	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100)
2021		while (tp->t_outq.c_cc > hiwat) {
2022			ttstart(tp);
2023			if (tp->t_outq.c_cc <= hiwat)
2024				break;
2025			if (!wait) {
2026				splx(s);
2027				return (0);
2028			}
2029			PROC_LOCK(p);
2030			if (!SIGSETEQ(td->td_siglist, oldmask)) {
2031				PROC_UNLOCK(p);
2032				splx(s);
2033				return (0);
2034			}
2035			PROC_UNLOCK(p);
2036			SET(tp->t_state, TS_SO_OLOWAT);
2037			tsleep(TSA_OLOWAT(tp), PZERO - 1, "ttoutq", hz);
2038		}
2039	splx(s);
2040	return (1);
2041}
2042
2043/*
2044 * Process a write call on a tty device.
2045 */
2046int
2047ttwrite(struct tty *tp, struct uio *uio, int flag)
2048{
2049	char *cp = NULL;
2050	int cc, ce;
2051	struct thread *td;
2052	struct proc *p;
2053	int i, hiwat, cnt, error, s;
2054	char obuf[OBUFSIZ];
2055
2056	hiwat = tp->t_ohiwat;
2057	cnt = uio->uio_resid;
2058	error = 0;
2059	cc = 0;
2060	td = curthread;
2061	p = td->td_proc;
2062loop:
2063	s = spltty();
2064	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2065		splx(s);
2066		if (uio->uio_resid == cnt)
2067			error = EIO;
2068		goto out;
2069	}
2070	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2071		if (flag & IO_NDELAY) {
2072			splx(s);
2073			error = EWOULDBLOCK;
2074			goto out;
2075		}
2076		error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
2077				 "ttywdcd", 0);
2078		splx(s);
2079		if (error)
2080			goto out;
2081		goto loop;
2082	}
2083	splx(s);
2084	/*
2085	 * Hang the process if it's in the background.
2086	 */
2087	sx_slock(&proctree_lock);
2088	PROC_LOCK(p);
2089	if (isbackground(p, tp) &&
2090	    ISSET(tp->t_lflag, TOSTOP) && !(p->p_flag & P_PPWAIT) &&
2091	    !SIGISMEMBER(p->p_sigacts->ps_sigignore, SIGTTOU) &&
2092	    !SIGISMEMBER(td->td_sigmask, SIGTTOU)) {
2093		if (p->p_pgrp->pg_jobc == 0) {
2094			PROC_UNLOCK(p);
2095			sx_sunlock(&proctree_lock);
2096			error = EIO;
2097			goto out;
2098		}
2099		PROC_UNLOCK(p);
2100		PGRP_LOCK(p->p_pgrp);
2101		sx_sunlock(&proctree_lock);
2102		pgsignal(p->p_pgrp, SIGTTOU, 1);
2103		PGRP_UNLOCK(p->p_pgrp);
2104		error = ttysleep(tp, &lbolt, TTIPRI | PCATCH, "ttybg4", 0);
2105		if (error)
2106			goto out;
2107		goto loop;
2108	} else {
2109		PROC_UNLOCK(p);
2110		sx_sunlock(&proctree_lock);
2111	}
2112	/*
2113	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2114	 * output translation.  Keep track of high water mark, sleep on
2115	 * overflow awaiting device aid in acquiring new space.
2116	 */
2117	while (uio->uio_resid > 0 || cc > 0) {
2118		if (ISSET(tp->t_lflag, FLUSHO)) {
2119			uio->uio_resid = 0;
2120			return (0);
2121		}
2122		if (tp->t_outq.c_cc > hiwat)
2123			goto ovhiwat;
2124		/*
2125		 * Grab a hunk of data from the user, unless we have some
2126		 * leftover from last time.
2127		 */
2128		if (cc == 0) {
2129			cc = imin(uio->uio_resid, OBUFSIZ);
2130			cp = obuf;
2131			error = uiomove(cp, cc, uio);
2132			if (error) {
2133				cc = 0;
2134				break;
2135			}
2136		}
2137		/*
2138		 * If nothing fancy need be done, grab those characters we
2139		 * can handle without any of ttyoutput's processing and
2140		 * just transfer them to the output q.  For those chars
2141		 * which require special processing (as indicated by the
2142		 * bits in char_type), call ttyoutput.  After processing
2143		 * a hunk of data, look for FLUSHO so ^O's will take effect
2144		 * immediately.
2145		 */
2146		while (cc > 0) {
2147			if (!ISSET(tp->t_oflag, OPOST))
2148				ce = cc;
2149			else {
2150				ce = cc - scanc((u_int)cc, (u_char *)cp,
2151						char_type, CCLASSMASK);
2152				/*
2153				 * If ce is zero, then we're processing
2154				 * a special character through ttyoutput.
2155				 */
2156				if (ce == 0) {
2157					tp->t_rocount = 0;
2158					if (ttyoutput(*cp, tp) >= 0) {
2159						/* No Clists, wait a bit. */
2160						ttstart(tp);
2161						if (flag & IO_NDELAY) {
2162							error = EWOULDBLOCK;
2163							goto out;
2164						}
2165						error = ttysleep(tp, &lbolt,
2166								 TTOPRI|PCATCH,
2167								 "ttybf1", 0);
2168						if (error)
2169							goto out;
2170						goto loop;
2171					}
2172					cp++;
2173					cc--;
2174					if (ISSET(tp->t_lflag, FLUSHO) ||
2175					    tp->t_outq.c_cc > hiwat)
2176						goto ovhiwat;
2177					continue;
2178				}
2179			}
2180			/*
2181			 * A bunch of normal characters have been found.
2182			 * Transfer them en masse to the output queue and
2183			 * continue processing at the top of the loop.
2184			 * If there are any further characters in this
2185			 * <= OBUFSIZ chunk, the first should be a character
2186			 * requiring special handling by ttyoutput.
2187			 */
2188			tp->t_rocount = 0;
2189			i = b_to_q(cp, ce, &tp->t_outq);
2190			ce -= i;
2191			tp->t_column += ce;
2192			cp += ce, cc -= ce, tk_nout += ce;
2193			tp->t_outcc += ce;
2194			if (i > 0) {
2195				/* No Clists, wait a bit. */
2196				ttstart(tp);
2197				if (flag & IO_NDELAY) {
2198					error = EWOULDBLOCK;
2199					goto out;
2200				}
2201				error = ttysleep(tp, &lbolt, TTOPRI | PCATCH,
2202						 "ttybf2", 0);
2203				if (error)
2204					goto out;
2205				goto loop;
2206			}
2207			if (ISSET(tp->t_lflag, FLUSHO) ||
2208			    tp->t_outq.c_cc > hiwat)
2209				break;
2210		}
2211		ttstart(tp);
2212	}
2213out:
2214	/*
2215	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2216	 * offset and iov pointers have moved forward, but it doesn't matter
2217	 * (the call will either return short or restart with a new uio).
2218	 */
2219	uio->uio_resid += cc;
2220	return (error);
2221
2222ovhiwat:
2223	ttstart(tp);
2224	s = spltty();
2225	/*
2226	 * This can only occur if FLUSHO is set in t_lflag,
2227	 * or if ttstart/oproc is synchronous (or very fast).
2228	 */
2229	if (tp->t_outq.c_cc <= hiwat) {
2230		splx(s);
2231		goto loop;
2232	}
2233	if (flag & IO_NDELAY) {
2234		splx(s);
2235		uio->uio_resid += cc;
2236		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2237	}
2238	SET(tp->t_state, TS_SO_OLOWAT);
2239	error = ttysleep(tp, TSA_OLOWAT(tp), TTOPRI | PCATCH, "ttywri",
2240			 tp->t_timeout);
2241	splx(s);
2242	if (error == EWOULDBLOCK)
2243		error = EIO;
2244	if (error)
2245		goto out;
2246	goto loop;
2247}
2248
2249/*
2250 * Rubout one character from the rawq of tp
2251 * as cleanly as possible.
2252 */
2253static void
2254ttyrub(int c, struct tty *tp)
2255{
2256	char *cp;
2257	int savecol;
2258	int tabc, s;
2259
2260	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2261		return;
2262	CLR(tp->t_lflag, FLUSHO);
2263	if (ISSET(tp->t_lflag, ECHOE)) {
2264		if (tp->t_rocount == 0) {
2265			/*
2266			 * Screwed by ttwrite; retype
2267			 */
2268			ttyretype(tp);
2269			return;
2270		}
2271		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2272			ttyrubo(tp, 2);
2273		else {
2274			CLR(c, ~TTY_CHARMASK);
2275			switch (CCLASS(c)) {
2276			case ORDINARY:
2277				ttyrubo(tp, 1);
2278				break;
2279			case BACKSPACE:
2280			case CONTROL:
2281			case NEWLINE:
2282			case RETURN:
2283			case VTAB:
2284				if (ISSET(tp->t_lflag, ECHOCTL))
2285					ttyrubo(tp, 2);
2286				break;
2287			case TAB:
2288				if (tp->t_rocount < tp->t_rawq.c_cc) {
2289					ttyretype(tp);
2290					return;
2291				}
2292				s = spltty();
2293				savecol = tp->t_column;
2294				SET(tp->t_state, TS_CNTTB);
2295				SET(tp->t_lflag, FLUSHO);
2296				tp->t_column = tp->t_rocol;
2297				cp = tp->t_rawq.c_cf;
2298				if (cp)
2299					tabc = *cp;	/* XXX FIX NEXTC */
2300				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2301					ttyecho(tabc, tp);
2302				CLR(tp->t_lflag, FLUSHO);
2303				CLR(tp->t_state, TS_CNTTB);
2304				splx(s);
2305
2306				/* savecol will now be length of the tab. */
2307				savecol -= tp->t_column;
2308				tp->t_column += savecol;
2309				if (savecol > 8)
2310					savecol = 8;	/* overflow screw */
2311				while (--savecol >= 0)
2312					(void)ttyoutput('\b', tp);
2313				break;
2314			default:			/* XXX */
2315#define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2316				(void)printf(PANICSTR, c, CCLASS(c));
2317#ifdef notdef
2318				panic(PANICSTR, c, CCLASS(c));
2319#endif
2320			}
2321		}
2322	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2323		if (!ISSET(tp->t_state, TS_ERASE)) {
2324			SET(tp->t_state, TS_ERASE);
2325			(void)ttyoutput('\\', tp);
2326		}
2327		ttyecho(c, tp);
2328	} else {
2329		ttyecho(tp->t_cc[VERASE], tp);
2330		/*
2331		 * This code may be executed not only when an ERASE key
2332		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2333		 * So, I didn't think it was worthwhile to pass the extra
2334		 * information (which would need an extra parameter,
2335		 * changing every call) needed to distinguish the ERASE2
2336		 * case from the ERASE.
2337		 */
2338	}
2339	--tp->t_rocount;
2340}
2341
2342/*
2343 * Back over cnt characters, erasing them.
2344 */
2345static void
2346ttyrubo(struct tty *tp, int cnt)
2347{
2348
2349	while (cnt-- > 0) {
2350		(void)ttyoutput('\b', tp);
2351		(void)ttyoutput(' ', tp);
2352		(void)ttyoutput('\b', tp);
2353	}
2354}
2355
2356/*
2357 * ttyretype --
2358 *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2359 *	been checked.
2360 */
2361static void
2362ttyretype(struct tty *tp)
2363{
2364	char *cp;
2365	int s, c;
2366
2367	/* Echo the reprint character. */
2368	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2369		ttyecho(tp->t_cc[VREPRINT], tp);
2370
2371	(void)ttyoutput('\n', tp);
2372
2373	/*
2374	 * XXX
2375	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2376	 * BIT OF FIRST CHAR.
2377	 */
2378	s = spltty();
2379	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2380	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2381		ttyecho(c, tp);
2382	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2383	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2384		ttyecho(c, tp);
2385	CLR(tp->t_state, TS_ERASE);
2386	splx(s);
2387
2388	tp->t_rocount = tp->t_rawq.c_cc;
2389	tp->t_rocol = 0;
2390}
2391
2392/*
2393 * Echo a typed character to the terminal.
2394 */
2395static void
2396ttyecho(int c, struct tty *tp)
2397{
2398
2399	if (!ISSET(tp->t_state, TS_CNTTB))
2400		CLR(tp->t_lflag, FLUSHO);
2401	if ((!ISSET(tp->t_lflag, ECHO) &&
2402	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2403	    ISSET(tp->t_lflag, EXTPROC))
2404		return;
2405	if (ISSET(tp->t_lflag, ECHOCTL) &&
2406	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2407	    ISSET(c, TTY_CHARMASK) == 0177)) {
2408		(void)ttyoutput('^', tp);
2409		CLR(c, ~TTY_CHARMASK);
2410		if (c == 0177)
2411			c = '?';
2412		else
2413			c += 'A' - 1;
2414	}
2415	(void)ttyoutput(c, tp);
2416}
2417
2418/*
2419 * Wake up any readers on a tty.
2420 */
2421void
2422ttwakeup(struct tty *tp)
2423{
2424
2425	if (SEL_WAITING(&tp->t_rsel))
2426		selwakeuppri(&tp->t_rsel, TTIPRI);
2427	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2428		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2429	wakeup(TSA_HUP_OR_INPUT(tp));
2430	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
2431}
2432
2433/*
2434 * Wake up any writers on a tty.
2435 */
2436void
2437ttwwakeup(struct tty *tp)
2438{
2439
2440	if (SEL_WAITING(&tp->t_wsel) && tp->t_outq.c_cc <= tp->t_olowat)
2441		selwakeuppri(&tp->t_wsel, TTOPRI);
2442	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2443		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
2444	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2445	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2446		CLR(tp->t_state, TS_SO_OCOMPLETE);
2447		wakeup(TSA_OCOMPLETE(tp));
2448	}
2449	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2450	    tp->t_outq.c_cc <= tp->t_olowat) {
2451		CLR(tp->t_state, TS_SO_OLOWAT);
2452		wakeup(TSA_OLOWAT(tp));
2453	}
2454	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
2455}
2456
2457/*
2458 * Look up a code for a specified speed in a conversion table;
2459 * used by drivers to map software speed values to hardware parameters.
2460 */
2461int
2462ttspeedtab(int speed, struct speedtab *table)
2463{
2464
2465	for ( ; table->sp_speed != -1; table++)
2466		if (table->sp_speed == speed)
2467			return (table->sp_code);
2468	return (-1);
2469}
2470
2471/*
2472 * Set input and output watermarks and buffer sizes.  For input, the
2473 * high watermark is about one second's worth of input above empty, the
2474 * low watermark is slightly below high water, and the buffer size is a
2475 * driver-dependent amount above high water.  For output, the watermarks
2476 * are near the ends of the buffer, with about 1 second's worth of input
2477 * between them.  All this only applies to the standard line discipline.
2478 */
2479void
2480ttsetwater(struct tty *tp)
2481{
2482	int cps, ttmaxhiwat, x;
2483
2484	/* Input. */
2485	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2486	switch (tp->t_ispeedwat) {
2487	case (speed_t)-1:
2488		cps = tp->t_ispeed / 10;
2489		break;
2490	case 0:
2491		/*
2492		 * This case is for old drivers that don't know about
2493		 * t_ispeedwat.  Arrange for them to get the old buffer
2494		 * sizes and watermarks.
2495		 */
2496		cps = TTYHOG - 2 * 256;
2497		tp->t_ififosize = 2 * 256;
2498		break;
2499	default:
2500		cps = tp->t_ispeedwat / 10;
2501		break;
2502	}
2503	tp->t_ihiwat = cps;
2504	tp->t_ilowat = 7 * cps / 8;
2505	x = cps + tp->t_ififosize;
2506	clist_alloc_cblocks(&tp->t_rawq, x, x);
2507
2508	/* Output. */
2509	switch (tp->t_ospeedwat) {
2510	case (speed_t)-1:
2511		cps = tp->t_ospeed / 10;
2512		ttmaxhiwat = 2 * TTMAXHIWAT;
2513		break;
2514	case 0:
2515		cps = tp->t_ospeed / 10;
2516		ttmaxhiwat = TTMAXHIWAT;
2517		break;
2518	default:
2519		cps = tp->t_ospeedwat / 10;
2520		ttmaxhiwat = 8 * TTMAXHIWAT;
2521		break;
2522	}
2523#define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2524	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2525	x += cps;
2526	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2527	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2528	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2529	x += OBUFSIZ + 100;
2530	clist_alloc_cblocks(&tp->t_outq, x, x);
2531#undef	CLAMP
2532}
2533
2534/*
2535 * Report on state of foreground process group.
2536 */
2537void
2538ttyinfo(struct tty *tp)
2539{
2540	struct timeval utime, stime;
2541	struct proc *p, *pick;
2542	struct thread *td, *picktd;
2543	const char *stateprefix, *state;
2544	long rss;
2545	int load, pctcpu;
2546	pid_t pid;
2547	char comm[MAXCOMLEN + 1];
2548	struct rusage ru;
2549
2550	if (ttycheckoutq(tp,0) == 0)
2551		return;
2552
2553	/* Print load average. */
2554	load = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2555	ttyprintf(tp, "load: %d.%02d ", load / 100, load % 100);
2556
2557	/*
2558	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
2559	 * that pending input will be retyped on BS.
2560	 */
2561	if (tp->t_session == NULL) {
2562		ttyprintf(tp, "not a controlling terminal\n");
2563		tp->t_rocount = 0;
2564		return;
2565	}
2566	if (tp->t_pgrp == NULL) {
2567		ttyprintf(tp, "no foreground process group\n");
2568		tp->t_rocount = 0;
2569		return;
2570	}
2571	PGRP_LOCK(tp->t_pgrp);
2572	if (LIST_EMPTY(&tp->t_pgrp->pg_members)) {
2573		PGRP_UNLOCK(tp->t_pgrp);
2574		ttyprintf(tp, "empty foreground process group\n");
2575		tp->t_rocount = 0;
2576		return;
2577	}
2578
2579	/*
2580	 * Pick the most interesting process and copy some of its
2581	 * state for printing later.  This operation could rely on stale
2582	 * data as we can't hold the proc slock or thread locks over the
2583	 * whole list. However, we're guaranteed not to reference an exited
2584	 * thread or proc since we hold the tty locked.
2585	 */
2586	pick = NULL;
2587	LIST_FOREACH(p, &tp->t_pgrp->pg_members, p_pglist)
2588		if (proc_compare(pick, p))
2589			pick = p;
2590
2591	PROC_LOCK(pick);
2592	picktd = NULL;
2593	td = FIRST_THREAD_IN_PROC(pick);
2594	FOREACH_THREAD_IN_PROC(pick, td)
2595		if (thread_compare(picktd, td))
2596			picktd = td;
2597	td = picktd;
2598	stateprefix = "";
2599	thread_lock(td);
2600	if (TD_IS_RUNNING(td))
2601		state = "running";
2602	else if (TD_ON_RUNQ(td) || TD_CAN_RUN(td))
2603		state = "runnable";
2604	else if (TD_IS_SLEEPING(td)) {
2605		/* XXX: If we're sleeping, are we ever not in a queue? */
2606		if (TD_ON_SLEEPQ(td))
2607			state = td->td_wmesg;
2608		else
2609			state = "sleeping without queue";
2610	} else if (TD_ON_LOCK(td)) {
2611		state = td->td_lockname;
2612		stateprefix = "*";
2613	} else if (TD_IS_SUSPENDED(td))
2614		state = "suspended";
2615	else if (TD_AWAITING_INTR(td))
2616		state = "intrwait";
2617	else
2618		state = "unknown";
2619	pctcpu = (sched_pctcpu(td) * 10000 + FSCALE / 2) >> FSHIFT;
2620	thread_unlock(td);
2621	if (pick->p_state == PRS_NEW || pick->p_state == PRS_ZOMBIE)
2622		rss = 0;
2623	else
2624		rss = pgtok(vmspace_resident_count(pick->p_vmspace));
2625	PROC_UNLOCK(pick);
2626	PROC_LOCK(pick);
2627	PGRP_UNLOCK(tp->t_pgrp);
2628	rufetchcalc(pick, &ru, &utime, &stime);
2629	pid = pick->p_pid;
2630	bcopy(pick->p_comm, comm, sizeof(comm));
2631	PROC_UNLOCK(pick);
2632
2633	/* Print command, pid, state, utime, stime, %cpu, and rss. */
2634	ttyprintf(tp,
2635	    " cmd: %s %d [%s%s] %ld.%02ldu %ld.%02lds %d%% %ldk\n",
2636	    comm, pid, stateprefix, state,
2637	    (long)utime.tv_sec, utime.tv_usec / 10000,
2638	    (long)stime.tv_sec, stime.tv_usec / 10000,
2639	    pctcpu / 100, rss);
2640	tp->t_rocount = 0;
2641}
2642
2643/*
2644 * Returns 1 if p2 is "better" than p1
2645 *
2646 * The algorithm for picking the "interesting" process is thus:
2647 *
2648 *	1) Only foreground processes are eligible - implied.
2649 *	2) Runnable processes are favored over anything else.  The runner
2650 *	   with the highest cpu utilization is picked (p_estcpu).  Ties are
2651 *	   broken by picking the highest pid.
2652 *	3) The sleeper with the shortest sleep time is next.  With ties,
2653 *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2654 *	4) Further ties are broken by picking the highest pid.
2655 */
2656
2657#define TESTAB(a, b)    ((a)<<1 | (b))
2658#define ONLYA   2
2659#define ONLYB   1
2660#define BOTH    3
2661
2662static int
2663proc_sum(struct proc *p, int *estcpup)
2664{
2665	struct thread *td;
2666	int estcpu;
2667	int val;
2668
2669	val = 0;
2670	estcpu = 0;
2671	FOREACH_THREAD_IN_PROC(p, td) {
2672		thread_lock(td);
2673		if (TD_ON_RUNQ(td) ||
2674		    TD_IS_RUNNING(td))
2675			val = 1;
2676		estcpu += sched_pctcpu(td);
2677		thread_unlock(td);
2678	}
2679	*estcpup = estcpu;
2680
2681	return (val);
2682}
2683
2684static int
2685thread_compare(struct thread *td, struct thread *td2)
2686{
2687	int runa, runb;
2688	int slpa, slpb;
2689	fixpt_t esta, estb;
2690
2691	if (td == NULL)
2692		return (1);
2693
2694	/*
2695	 * Fetch running stats, pctcpu usage, and interruptable flag.
2696 	 */
2697	thread_lock(td);
2698	runa = TD_IS_RUNNING(td) | TD_ON_RUNQ(td);
2699	slpa = td->td_flags & TDF_SINTR;
2700	esta = sched_pctcpu(td);
2701	thread_unlock(td);
2702	thread_lock(td2);
2703	runb = TD_IS_RUNNING(td2) | TD_ON_RUNQ(td2);
2704	estb = sched_pctcpu(td2);
2705	slpb = td2->td_flags & TDF_SINTR;
2706	thread_unlock(td2);
2707	/*
2708	 * see if at least one of them is runnable
2709	 */
2710	switch (TESTAB(runa, runb)) {
2711	case ONLYA:
2712		return (0);
2713	case ONLYB:
2714		return (1);
2715	case BOTH:
2716		break;
2717	}
2718	/*
2719	 *  favor one with highest recent cpu utilization
2720	 */
2721	if (estb > esta)
2722		return (1);
2723	if (esta > estb)
2724		return (0);
2725	/*
2726	 * favor one sleeping in a non-interruptible sleep
2727	 */
2728	switch (TESTAB(slpa, slpb)) {
2729	case ONLYA:
2730		return (0);
2731	case ONLYB:
2732		return (1);
2733	case BOTH:
2734		break;
2735	}
2736
2737	return (td < td2);
2738}
2739
2740static int
2741proc_compare(struct proc *p1, struct proc *p2)
2742{
2743
2744	int runa, runb;
2745	fixpt_t esta, estb;
2746
2747	if (p1 == NULL)
2748		return (1);
2749
2750	/*
2751	 * Fetch various stats about these processes.  After we drop the
2752	 * lock the information could be stale but the race is unimportant.
2753	 */
2754	PROC_LOCK(p1);
2755	runa = proc_sum(p1, &esta);
2756	PROC_UNLOCK(p1);
2757	PROC_LOCK(p2);
2758	runb = proc_sum(p2, &estb);
2759	PROC_UNLOCK(p2);
2760
2761	/*
2762	 * see if at least one of them is runnable
2763	 */
2764	switch (TESTAB(runa, runb)) {
2765	case ONLYA:
2766		return (0);
2767	case ONLYB:
2768		return (1);
2769	case BOTH:
2770		break;
2771	}
2772	/*
2773	 *  favor one with highest recent cpu utilization
2774	 */
2775	if (estb > esta)
2776		return (1);
2777	if (esta > estb)
2778		return (0);
2779	/*
2780	 * weed out zombies
2781	 */
2782	switch (TESTAB(p1->p_state == PRS_ZOMBIE, p2->p_state == PRS_ZOMBIE)) {
2783	case ONLYA:
2784		return (1);
2785	case ONLYB:
2786		return (0);
2787	case BOTH:
2788		break;
2789	}
2790
2791	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2792}
2793
2794/*
2795 * Output char to tty; console putchar style.
2796 */
2797int
2798tputchar(int c, struct tty *tp)
2799{
2800	int s;
2801
2802	s = spltty();
2803	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2804		splx(s);
2805		return (-1);
2806	}
2807	if (c == '\n')
2808		(void)ttyoutput('\r', tp);
2809	(void)ttyoutput(c, tp);
2810	ttstart(tp);
2811	splx(s);
2812	return (0);
2813}
2814
2815/*
2816 * Sleep on chan, returning ERESTART if tty changed while we napped and
2817 * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2818 * the tty is revoked, restarting a pending call will redo validation done
2819 * at the start of the call.
2820 */
2821int
2822ttysleep(struct tty *tp, void *chan, int pri, char *wmesg, int timo)
2823{
2824	int error;
2825	int gen;
2826
2827	gen = tp->t_gen;
2828	error = tsleep(chan, pri, wmesg, timo);
2829	if (tp->t_state & TS_GONE)
2830		return (ENXIO);
2831	if (error)
2832		return (error);
2833	return (tp->t_gen == gen ? 0 : ERESTART);
2834}
2835
2836/*
2837 * Gain a reference to a TTY
2838 */
2839int
2840ttyref(struct tty *tp)
2841{
2842	int i;
2843
2844	mtx_lock(&tp->t_mtx);
2845	KASSERT(tp->t_refcnt > 0,
2846	    ("ttyref(): tty refcnt is %d (%s)",
2847	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2848	i = ++tp->t_refcnt;
2849	mtx_unlock(&tp->t_mtx);
2850	return (i);
2851}
2852
2853/*
2854 * Drop a reference to a TTY.
2855 * When reference count drops to zero, we free it.
2856 */
2857int
2858ttyrel(struct tty *tp)
2859{
2860	int i;
2861
2862	mtx_lock(&tty_list_mutex);
2863	mtx_lock(&tp->t_mtx);
2864	KASSERT(tp->t_refcnt > 0,
2865	    ("ttyrel(): tty refcnt is %d (%s)",
2866	    tp->t_refcnt, tp->t_dev != NULL ? devtoname(tp->t_dev) : "??"));
2867	i = --tp->t_refcnt;
2868	if (i != 0) {
2869		mtx_unlock(&tp->t_mtx);
2870		mtx_unlock(&tty_list_mutex);
2871		return (i);
2872	}
2873	TAILQ_REMOVE(&tty_list, tp, t_list);
2874	mtx_unlock(&tp->t_mtx);
2875	mtx_unlock(&tty_list_mutex);
2876	knlist_destroy(&tp->t_rsel.si_note);
2877	knlist_destroy(&tp->t_wsel.si_note);
2878	mtx_destroy(&tp->t_mtx);
2879	free(tp, M_TTYS);
2880	return (i);
2881}
2882
2883/*
2884 * Allocate a tty struct.  Clists in the struct will be allocated by
2885 * tty_open().
2886 */
2887struct tty *
2888ttyalloc()
2889{
2890	struct tty *tp;
2891
2892	tp = malloc(sizeof *tp, M_TTYS, M_WAITOK | M_ZERO);
2893	mtx_init(&tp->t_mtx, "tty", NULL, MTX_DEF);
2894
2895	/*
2896	 * Set up the initial state
2897	 */
2898	tp->t_refcnt = 1;
2899	tp->t_timeout = -1;
2900	tp->t_dtr_wait = 3 * hz;
2901
2902	ttyinitmode(tp, 0, 0);
2903	bcopy(ttydefchars, tp->t_init_in.c_cc, sizeof tp->t_init_in.c_cc);
2904
2905	/* Make callout the same as callin */
2906	tp->t_init_out = tp->t_init_in;
2907
2908	mtx_lock(&tty_list_mutex);
2909	TAILQ_INSERT_TAIL(&tty_list, tp, t_list);
2910	mtx_unlock(&tty_list_mutex);
2911	knlist_init(&tp->t_rsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2912	knlist_init(&tp->t_wsel.si_note, &tp->t_mtx, NULL, NULL, NULL);
2913	return (tp);
2914}
2915
2916static void
2917ttypurge(struct cdev *dev)
2918{
2919
2920	if (dev->si_tty == NULL)
2921		return;
2922	ttygone(dev->si_tty);
2923}
2924
2925/*
2926 * ttycreate()
2927 *
2928 * Create the device entries for this tty thereby opening it for business.
2929 *
2930 * The flags argument controls if "cua" units are created.
2931 *
2932 * The t_sc filed is copied to si_drv1 in the created cdevs.  This
2933 * is particularly important for ->t_cioctl() users.
2934 *
2935 * XXX: implement the init and lock devices by cloning.
2936 */
2937
2938int
2939ttycreate(struct tty *tp, int flags, const char *fmt, ...)
2940{
2941	char namebuf[SPECNAMELEN - 3];		/* XXX space for "tty" */
2942	struct cdevsw *csw = NULL;
2943	int unit = 0;
2944	va_list ap;
2945	struct cdev *cp;
2946	int i, minor, sminor, sunit;
2947
2948	mtx_assert(&Giant, MA_OWNED);
2949
2950	if (tty_unit == NULL)
2951		tty_unit = new_unrhdr(0, 0xffff, NULL);
2952
2953	sunit = alloc_unr(tty_unit);
2954	tp->t_devunit = sunit;
2955
2956	if (csw == NULL) {
2957		csw = &tty_cdevsw;
2958		unit = sunit;
2959	}
2960	KASSERT(csw->d_purge == NULL || csw->d_purge == ttypurge,
2961	    ("tty should not have d_purge"));
2962
2963	csw->d_purge = ttypurge;
2964
2965	minor = unit2minor(unit);
2966	sminor = unit2minor(sunit);
2967	va_start(ap, fmt);
2968	i = vsnrprintf(namebuf, sizeof namebuf, 32, fmt, ap);
2969	va_end(ap);
2970	KASSERT(i < sizeof namebuf, ("Too long tty name (%s)", namebuf));
2971
2972	cp = make_dev(csw, minor,
2973	    UID_ROOT, GID_WHEEL, 0600, "tty%s", namebuf);
2974	tp->t_dev = cp;
2975	tp->t_mdev = cp;
2976	cp->si_tty = tp;
2977	cp->si_drv1 = tp->t_sc;
2978
2979	cp = make_dev(&ttys_cdevsw, sminor | MINOR_INIT,
2980	    UID_ROOT, GID_WHEEL, 0600, "tty%s.init", namebuf);
2981	dev_depends(tp->t_dev, cp);
2982	cp->si_drv1 = tp->t_sc;
2983	cp->si_drv2 = &tp->t_init_in;
2984	cp->si_tty = tp;
2985
2986	cp = make_dev(&ttys_cdevsw, sminor | MINOR_LOCK,
2987	    UID_ROOT, GID_WHEEL, 0600, "tty%s.lock", namebuf);
2988	dev_depends(tp->t_dev, cp);
2989	cp->si_drv1 = tp->t_sc;
2990	cp->si_drv2 = &tp->t_lock_in;
2991	cp->si_tty = tp;
2992
2993	if (flags & TS_CALLOUT) {
2994		cp = make_dev(csw, minor | MINOR_CALLOUT,
2995		    UID_UUCP, GID_DIALER, 0660, "cua%s", namebuf);
2996		dev_depends(tp->t_dev, cp);
2997		cp->si_drv1 = tp->t_sc;
2998		cp->si_tty = tp;
2999
3000		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_INIT,
3001		    UID_UUCP, GID_DIALER, 0660, "cua%s.init", namebuf);
3002		dev_depends(tp->t_dev, cp);
3003		cp->si_drv1 = tp->t_sc;
3004		cp->si_drv2 = &tp->t_init_out;
3005		cp->si_tty = tp;
3006
3007		cp = make_dev(&ttys_cdevsw, sminor | MINOR_CALLOUT | MINOR_LOCK,
3008		    UID_UUCP, GID_DIALER, 0660, "cua%s.lock", namebuf);
3009		dev_depends(tp->t_dev, cp);
3010		cp->si_drv1 = tp->t_sc;
3011		cp->si_drv2 = &tp->t_lock_out;
3012		cp->si_tty = tp;
3013	}
3014
3015	return (0);
3016}
3017
3018/*
3019 * This function is called when the hardware disappears.  We set a flag
3020 * and wake up stuff so all sleeping threads will notice.
3021 */
3022void
3023ttygone(struct tty *tp)
3024{
3025
3026	tp->t_state |= TS_GONE;
3027	if (SEL_WAITING(&tp->t_rsel))
3028		selwakeuppri(&tp->t_rsel, TTIPRI);
3029	if (SEL_WAITING(&tp->t_wsel))
3030		selwakeuppri(&tp->t_wsel, TTOPRI);
3031	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
3032		pgsigio(&tp->t_sigio, SIGIO, (tp->t_session != NULL));
3033	wakeup(&tp->t_dtr_wait);
3034	wakeup(TSA_CARR_ON(tp));
3035	wakeup(TSA_HUP_OR_INPUT(tp));
3036	wakeup(TSA_OCOMPLETE(tp));
3037	wakeup(TSA_OLOWAT(tp));
3038	KNOTE_UNLOCKED(&tp->t_rsel.si_note, 0);
3039	KNOTE_UNLOCKED(&tp->t_wsel.si_note, 0);
3040	tt_purge(tp);
3041}
3042
3043/*
3044 * ttyfree()
3045 *
3046 * Called when the driver is ready to free the tty structure.
3047 *
3048 * XXX: This shall sleep until all threads have left the driver.
3049 */
3050void
3051ttyfree(struct tty *tp)
3052{
3053	struct cdev *dev;
3054	u_int unit;
3055
3056	mtx_assert(&Giant, MA_OWNED);
3057	ttygone(tp);
3058	unit = tp->t_devunit;
3059	dev = tp->t_mdev;
3060	dev->si_tty = NULL;
3061	tp->t_dev = NULL;
3062	destroy_dev(dev);
3063	ttyrel(tp);
3064	free_unr(tty_unit, unit);
3065}
3066
3067static int
3068sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
3069{
3070	struct tty *tp, *tp2;
3071	struct xtty xt;
3072	int error;
3073
3074	error = 0;
3075	mtx_lock(&tty_list_mutex);
3076	tp = TAILQ_FIRST(&tty_list);
3077	if (tp != NULL)
3078		ttyref(tp);
3079	while (tp != NULL) {
3080		if (tp->t_state & TS_GONE)
3081			goto nexttp;
3082		bzero(&xt, sizeof xt);
3083		xt.xt_size = sizeof xt;
3084#define XT_COPY(field) xt.xt_##field = tp->t_##field
3085		xt.xt_rawcc = tp->t_rawq.c_cc;
3086		xt.xt_cancc = tp->t_canq.c_cc;
3087		xt.xt_outcc = tp->t_outq.c_cc;
3088		XT_COPY(line);
3089
3090		/*
3091		 * XXX: We hold the tty list lock while doing this to
3092		 * work around a race with pty/pts tty destruction.
3093		 * They set t_dev to NULL and then call ttyrel() to
3094		 * free the structure which will block on the list
3095		 * lock before they call destroy_dev() on the cdev
3096		 * backing t_dev.
3097		 *
3098		 * XXX: ttyfree() now does the same since it has been
3099		 * fixed to not leak ttys.
3100		 */
3101		if (tp->t_dev != NULL)
3102			xt.xt_dev = dev2udev(tp->t_dev);
3103		XT_COPY(state);
3104		XT_COPY(flags);
3105		XT_COPY(timeout);
3106		if (tp->t_pgrp != NULL)
3107			xt.xt_pgid = tp->t_pgrp->pg_id;
3108		if (tp->t_session != NULL)
3109			xt.xt_sid = tp->t_session->s_sid;
3110		XT_COPY(termios);
3111		XT_COPY(winsize);
3112		XT_COPY(column);
3113		XT_COPY(rocount);
3114		XT_COPY(rocol);
3115		XT_COPY(ififosize);
3116		XT_COPY(ihiwat);
3117		XT_COPY(ilowat);
3118		XT_COPY(ispeedwat);
3119		XT_COPY(ohiwat);
3120		XT_COPY(olowat);
3121		XT_COPY(ospeedwat);
3122#undef XT_COPY
3123		mtx_unlock(&tty_list_mutex);
3124		error = SYSCTL_OUT(req, &xt, sizeof xt);
3125		if (error != 0) {
3126			ttyrel(tp);
3127			return (error);
3128		}
3129		mtx_lock(&tty_list_mutex);
3130nexttp:		tp2 = TAILQ_NEXT(tp, t_list);
3131		if (tp2 != NULL)
3132			ttyref(tp2);
3133		mtx_unlock(&tty_list_mutex);
3134		ttyrel(tp);
3135		tp = tp2;
3136		mtx_lock(&tty_list_mutex);
3137	}
3138	mtx_unlock(&tty_list_mutex);
3139	return (0);
3140}
3141
3142SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
3143	0, 0, sysctl_kern_ttys, "S,xtty", "All ttys");
3144SYSCTL_LONG(_kern, OID_AUTO, tty_nin, CTLFLAG_RD,
3145	&tk_nin, 0, "Total TTY in characters");
3146SYSCTL_LONG(_kern, OID_AUTO, tty_nout, CTLFLAG_RD,
3147	&tk_nout, 0, "Total TTY out characters");
3148
3149void
3150nottystop(struct tty *tp, int rw)
3151{
3152
3153	return;
3154}
3155
3156int
3157ttyopen(struct cdev *dev, int flag, int mode, struct thread *td)
3158{
3159	int		error;
3160	int		s;
3161	struct tty	*tp;
3162
3163	tp = dev->si_tty;
3164
3165	s = spltty();
3166	/*
3167	 * We jump to this label after all non-interrupted sleeps to pick
3168	 * up any changes of the device state.
3169	 */
3170open_top:
3171	if (tp->t_state & TS_GONE)
3172		return (ENXIO);
3173	error = ttydtrwaitsleep(tp);
3174	if (error)
3175		goto out;
3176	if (tp->t_state & TS_ISOPEN) {
3177		/*
3178		 * The device is open, so everything has been initialized.
3179		 * Handle conflicts.
3180		 */
3181		if (ISCALLOUT(dev) && !tp->t_actout)
3182			return (EBUSY);
3183		if (tp->t_actout && !ISCALLOUT(dev)) {
3184			if (flag & O_NONBLOCK)
3185				return (EBUSY);
3186			error =	tsleep(&tp->t_actout,
3187				       TTIPRI | PCATCH, "ttybi", 0);
3188			if (error != 0 || (tp->t_state & TS_GONE))
3189				goto out;
3190			goto open_top;
3191		}
3192		if (tp->t_state & TS_XCLUDE && priv_check(td,
3193		    PRIV_TTY_EXCLUSIVE))
3194			return (EBUSY);
3195	} else {
3196		/*
3197		 * The device isn't open, so there are no conflicts.
3198		 * Initialize it.  Initialization is done twice in many
3199		 * cases: to preempt sleeping callin opens if we are
3200		 * callout, and to complete a callin open after DCD rises.
3201		 */
3202		tp->t_termios = ISCALLOUT(dev) ? tp->t_init_out : tp->t_init_in;
3203		tp->t_cflag = tp->t_termios.c_cflag;
3204		if (tp->t_modem != NULL)
3205			tt_modem(tp, SER_DTR | SER_RTS, 0);
3206		++tp->t_wopeners;
3207		error = tt_param(tp, &tp->t_termios);
3208		--tp->t_wopeners;
3209		if (error == 0)
3210			error = tt_open(tp, dev);
3211		if (error != 0)
3212			goto out;
3213		if (ISCALLOUT(dev) || (tt_modem(tp, 0, 0) & SER_DCD))
3214			ttyld_modem(tp, 1);
3215	}
3216	/*
3217	 * Wait for DCD if necessary.
3218	 */
3219	if (!(tp->t_state & TS_CARR_ON) && !ISCALLOUT(dev)
3220	    && !(tp->t_cflag & CLOCAL) && !(flag & O_NONBLOCK)) {
3221		++tp->t_wopeners;
3222		error = tsleep(TSA_CARR_ON(tp), TTIPRI | PCATCH, "ttydcd", 0);
3223		--tp->t_wopeners;
3224		if (error != 0 || (tp->t_state & TS_GONE))
3225			goto out;
3226		goto open_top;
3227	}
3228	error =	ttyld_open(tp, dev);
3229	ttyldoptim(tp);
3230	if (tp->t_state & TS_ISOPEN && ISCALLOUT(dev))
3231		tp->t_actout = TRUE;
3232out:
3233	splx(s);
3234	if (!(tp->t_state & TS_ISOPEN) && tp->t_wopeners == 0)
3235		tt_close(tp);
3236	return (error);
3237}
3238
3239int
3240ttyclose(struct cdev *dev, int flag, int mode, struct thread *td)
3241{
3242	struct tty *tp;
3243
3244	tp = dev->si_tty;
3245	ttyld_close(tp, flag);
3246	ttyldoptim(tp);
3247	tt_close(tp);
3248	tp->t_do_timestamp = 0;
3249	if (tp->t_pps != NULL)
3250		tp->t_pps->ppsparam.mode = 0;
3251	tty_close(tp);
3252	return (0);
3253}
3254
3255int
3256ttyread(struct cdev *dev, struct uio *uio, int flag)
3257{
3258	struct tty *tp;
3259
3260	tp = tty_gettp(dev);
3261
3262	if (tp == NULL || (tp->t_state & TS_GONE))
3263		return (ENODEV);
3264	return (ttyld_read(tp, uio, flag));
3265}
3266
3267int
3268ttywrite(struct cdev *dev, struct uio *uio, int flag)
3269{
3270	struct tty *tp;
3271
3272	tp = tty_gettp(dev);
3273
3274	if (tp == NULL || (tp->t_state & TS_GONE))
3275		return (ENODEV);
3276	return (ttyld_write(tp, uio, flag));
3277}
3278
3279int
3280ttyioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3281{
3282	struct	tty *tp;
3283	int	error;
3284
3285	tp = dev->si_tty;
3286
3287	if (cmd == TIOCSETA || cmd == TIOCSETAW || cmd == TIOCSETAF) {
3288		int cc;
3289		struct termios *dt = (struct termios *)data;
3290		struct termios *lt =
3291		    ISCALLOUT(dev) ?  &tp->t_lock_out : &tp->t_lock_in;
3292
3293		dt->c_iflag = (tp->t_iflag & lt->c_iflag)
3294		    | (dt->c_iflag & ~lt->c_iflag);
3295		dt->c_oflag = (tp->t_oflag & lt->c_oflag)
3296		    | (dt->c_oflag & ~lt->c_oflag);
3297		dt->c_cflag = (tp->t_cflag & lt->c_cflag)
3298		    | (dt->c_cflag & ~lt->c_cflag);
3299		dt->c_lflag = (tp->t_lflag & lt->c_lflag)
3300		    | (dt->c_lflag & ~lt->c_lflag);
3301		for (cc = 0; cc < NCCS; ++cc)
3302		    if (lt->c_cc[cc] != 0)
3303		        dt->c_cc[cc] = tp->t_cc[cc];
3304		if (lt->c_ispeed != 0)
3305		    dt->c_ispeed = tp->t_ispeed;
3306		if (lt->c_ospeed != 0)
3307		    dt->c_ospeed = tp->t_ospeed;
3308	}
3309
3310	error = ttyld_ioctl(tp, cmd, data, flag, td);
3311	if (error == ENOIOCTL)
3312		error = ttioctl(tp, cmd, data, flag);
3313	ttyldoptim(tp);
3314	if (error != ENOIOCTL)
3315		return (error);
3316	return (ENOTTY);
3317}
3318
3319void
3320ttyldoptim(struct tty *tp)
3321{
3322	struct termios	*t;
3323
3324	t = &tp->t_termios;
3325	if (!(t->c_iflag & (ICRNL | IGNCR | IMAXBEL | INLCR | ISTRIP | IXON))
3326	    && (!(t->c_iflag & BRKINT) || (t->c_iflag & IGNBRK))
3327	    && (!(t->c_iflag & PARMRK)
3328		|| (t->c_iflag & (IGNPAR | IGNBRK)) == (IGNPAR | IGNBRK))
3329	    && !(t->c_lflag & (ECHO | ICANON | IEXTEN | ISIG | PENDIN))
3330	    && linesw[tp->t_line]->l_rint == ttyinput)
3331		tp->t_state |= TS_CAN_BYPASS_L_RINT;
3332	else
3333		tp->t_state &= ~TS_CAN_BYPASS_L_RINT;
3334}
3335
3336static void
3337ttydtrwaitwakeup(void *arg)
3338{
3339	struct tty *tp;
3340
3341	tp = arg;
3342	tp->t_state &= ~TS_DTR_WAIT;
3343	wakeup(&tp->t_dtr_wait);
3344}
3345
3346
3347void
3348ttydtrwaitstart(struct tty *tp)
3349{
3350
3351	if (tp->t_dtr_wait == 0)
3352		return;
3353	if (tp->t_state & TS_DTR_WAIT)
3354		return;
3355	timeout(ttydtrwaitwakeup, tp, tp->t_dtr_wait);
3356	tp->t_state |= TS_DTR_WAIT;
3357}
3358
3359int
3360ttydtrwaitsleep(struct tty *tp)
3361{
3362	int error;
3363
3364	error = 0;
3365	while (error == 0) {
3366		if (tp->t_state & TS_GONE)
3367			error = ENXIO;
3368		else if (!(tp->t_state & TS_DTR_WAIT))
3369			break;
3370		else
3371			error = tsleep(&tp->t_dtr_wait, TTIPRI | PCATCH,
3372			    "dtrwait", 0);
3373	}
3374	return (error);
3375}
3376
3377static int
3378ttysopen(struct cdev *dev, int flag, int mode, struct thread *td)
3379{
3380	struct tty *tp;
3381
3382	tp = dev->si_tty;
3383	KASSERT(tp != NULL,
3384	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3385	if (tp->t_state & TS_GONE)
3386		return (ENODEV);
3387	return (0);
3388}
3389
3390static int
3391ttysclose(struct cdev *dev, int flag, int mode, struct thread *td)
3392{
3393
3394	return (0);
3395}
3396
3397static int
3398ttysrdwr(struct cdev *dev, struct uio *uio, int flag)
3399{
3400
3401	return (ENODEV);
3402}
3403
3404static int
3405ttysioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
3406{
3407	struct tty	*tp;
3408	int		error;
3409	struct termios	*ct;
3410
3411	tp = dev->si_tty;
3412	KASSERT(tp != NULL,
3413	    ("ttysopen(): no tty pointer on device (%s)", devtoname(dev)));
3414	if (tp->t_state & TS_GONE)
3415		return (ENODEV);
3416	ct = dev->si_drv2;
3417	switch (cmd) {
3418	case TIOCSETA:
3419		error = priv_check(td, PRIV_TTY_SETA);
3420		if (error != 0)
3421			return (error);
3422		*ct = *(struct termios *)data;
3423		return (0);
3424	case TIOCGETA:
3425		*(struct termios *)data = *ct;
3426		return (0);
3427	case TIOCGETD:
3428		*(int *)data = TTYDISC;
3429		return (0);
3430	case TIOCGWINSZ:
3431		bzero(data, sizeof(struct winsize));
3432		return (0);
3433	default:
3434		if (tp->t_cioctl != NULL)
3435			return(tp->t_cioctl(dev, cmd, data, flag, td));
3436		return (ENOTTY);
3437	}
3438}
3439
3440/*
3441 * Initialize a tty to sane modes.
3442 */
3443void
3444ttyinitmode(struct tty *tp, int echo, int speed)
3445{
3446
3447	if (speed == 0)
3448		speed = TTYDEF_SPEED;
3449	tp->t_init_in.c_iflag = TTYDEF_IFLAG;
3450	tp->t_init_in.c_oflag = TTYDEF_OFLAG;
3451	tp->t_init_in.c_cflag = TTYDEF_CFLAG;
3452	if (echo)
3453		tp->t_init_in.c_lflag = TTYDEF_LFLAG_ECHO;
3454	else
3455		tp->t_init_in.c_lflag = TTYDEF_LFLAG_NOECHO;
3456
3457	tp->t_init_in.c_ispeed = tp->t_init_in.c_ospeed = speed;
3458	termioschars(&tp->t_init_in);
3459	tp->t_init_out = tp->t_init_in;
3460	tp->t_termios = tp->t_init_in;
3461}
3462
3463/*
3464 * Use more "normal" termios paramters for consoles.
3465 */
3466void
3467ttyconsolemode(struct tty *tp, int speed)
3468{
3469
3470	if (speed == 0)
3471		speed = TTYDEF_SPEED;
3472	ttyinitmode(tp, 1, speed);
3473	tp->t_init_in.c_cflag |= CLOCAL;
3474	tp->t_lock_out.c_cflag = tp->t_lock_in.c_cflag = CLOCAL;
3475	tp->t_lock_out.c_ispeed = tp->t_lock_out.c_ospeed =
3476	tp->t_lock_in.c_ispeed = tp->t_lock_in.c_ospeed = speed;
3477	tp->t_init_out = tp->t_init_in;
3478	tp->t_termios = tp->t_init_in;
3479	ttsetwater(tp);
3480}
3481
3482/*
3483 * Record the relationship between the serial ports notion of modem control
3484 * signals and the one used in certain ioctls in a way the compiler can enforce
3485 * XXX: We should define TIOCM_* in terms of SER_ if we can limit the
3486 * XXX: consequences of the #include work that would take.
3487 */
3488CTASSERT(SER_DTR == TIOCM_DTR / 2);
3489CTASSERT(SER_RTS == TIOCM_RTS / 2);
3490CTASSERT(SER_STX == TIOCM_ST / 2);
3491CTASSERT(SER_SRX == TIOCM_SR / 2);
3492CTASSERT(SER_CTS == TIOCM_CTS / 2);
3493CTASSERT(SER_DCD == TIOCM_DCD / 2);
3494CTASSERT(SER_RI == TIOCM_RI / 2);
3495CTASSERT(SER_DSR == TIOCM_DSR / 2);
3496
3497