xref: /dflybsd-src/sys/kern/tty.c (revision 468b4ddebc1eadd839e8e52d766c331a99af364c)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
39  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
40  * $DragonFly: src/sys/kern/tty.c,v 1.46 2008/09/10 09:50:09 y0netan1 Exp $
41  */
42 
43 /*-
44  * TODO:
45  *	o Fix races for sending the start char in ttyflush().
46  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
47  *	  With luck, there will be MIN chars before select() returns().
48  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
49  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
50  *	  FIONREAD.
51  *	o Do the new sio locking stuff here and use it to avoid special
52  *	  case for EXTPROC?
53  *	o Lock PENDIN too?
54  *	o Move EXTPROC and/or PENDIN to t_state?
55  *	o Wrap most of ttioctl in spltty/splx.
56  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
57  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
58  *	o Don't allow certain termios flags to affect disciplines other
59  *	  than TTYDISC.  Cancel their effects before switch disciplines
60  *	  and ignore them if they are set while we are in another
61  *	  discipline.
62  *	o Now that historical speed conversions are handled here, don't
63  *	  do them in drivers.
64  *	o Check for TS_CARR_ON being set while everything is closed and not
65  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
66  *	  so it would live until the next open even if carrier drops.
67  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
68  *	  only when _all_ openers leave open().
69  */
70 
71 #include "opt_compat.h"
72 #include "opt_uconsole.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/filio.h>
77 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
78 #include <sys/ioctl_compat.h>
79 #endif
80 #include <sys/proc.h>
81 #include <sys/priv.h>
82 #define	TTYDEFCHARS
83 #include <sys/tty.h>
84 #include <sys/clist.h>
85 #undef	TTYDEFCHARS
86 #include <sys/fcntl.h>
87 #include <sys/conf.h>
88 #include <sys/dkstat.h>
89 #include <sys/kernel.h>
90 #include <sys/vnode.h>
91 #include <sys/signalvar.h>
92 #include <sys/signal2.h>
93 #include <sys/resourcevar.h>
94 #include <sys/malloc.h>
95 #include <sys/filedesc.h>
96 #include <sys/sysctl.h>
97 #include <sys/thread2.h>
98 
99 #include <vm/vm.h>
100 #include <sys/lock.h>
101 #include <vm/pmap.h>
102 #include <vm/vm_map.h>
103 
104 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
105 
106 static int	proc_compare (struct proc *p1, struct proc *p2);
107 static int	ttnread (struct tty *tp);
108 static void	ttyecho (int c, struct tty *tp);
109 static int	ttyoutput (int c, struct tty *tp);
110 static void	ttypend (struct tty *tp);
111 static void	ttyretype (struct tty *tp);
112 static void	ttyrub (int c, struct tty *tp);
113 static void	ttyrubo (struct tty *tp, int cnt);
114 static void	ttyunblock (struct tty *tp);
115 static int	ttywflush (struct tty *tp);
116 static int	filt_ttyread (struct knote *kn, long hint);
117 static void 	filt_ttyrdetach (struct knote *kn);
118 static int	filt_ttywrite (struct knote *kn, long hint);
119 static void 	filt_ttywdetach (struct knote *kn);
120 
121 /*
122  * Table with character classes and parity. The 8th bit indicates parity,
123  * the 7th bit indicates the character is an alphameric or underscore (for
124  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
125  * are 0 then the character needs no special processing on output; classes
126  * other than 0 might be translated or (not currently) require delays.
127  */
128 #define	E	0x00	/* Even parity. */
129 #define	O	0x80	/* Odd parity. */
130 #define	PARITY(c)	(char_type[c] & O)
131 
132 #define	ALPHA	0x40	/* Alpha or underscore. */
133 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
134 
135 #define	CCLASSMASK	0x3f
136 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
137 
138 #define	BS	BACKSPACE
139 #define	CC	CONTROL
140 #define	CR	RETURN
141 #define	NA	ORDINARY | ALPHA
142 #define	NL	NEWLINE
143 #define	NO	ORDINARY
144 #define	TB	TAB
145 #define	VT	VTAB
146 
147 static u_char const char_type[] = {
148 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
149 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
150 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
151 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
152 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
153 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
154 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
155 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
156 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
157 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
159 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
160 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
161 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
163 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
164 	/*
165 	 * Meta chars; should be settable per character set;
166 	 * for now, treat them all as normal characters.
167 	 */
168 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 };
185 #undef	BS
186 #undef	CC
187 #undef	CR
188 #undef	NA
189 #undef	NL
190 #undef	NO
191 #undef	TB
192 #undef	VT
193 
194 /* Macros to clear/set/test flags. */
195 #define	SET(t, f)	(t) |= (f)
196 #define	CLR(t, f)	(t) &= ~(f)
197 #define	ISSET(t, f)	((t) & (f))
198 
199 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
200 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
201 
202 uint64_t tk_nin;
203 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
204     "LU", "TTY input statistic");
205 uint64_t tk_nout;
206 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
207     "LU", "TTY output statistic");
208 uint64_t tk_rawcc;
209 
210 /*
211  * list of struct tty where pstat(8) can pick it up with sysctl
212  */
213 static SLIST_HEAD(, tty) tty_list;
214 
215 /*
216  * Initial open of tty, or (re)entry to standard tty line discipline.
217  */
218 int
219 ttyopen(cdev_t device, struct tty *tp)
220 {
221 	crit_enter();
222 	tp->t_dev = device;
223 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
224 		SET(tp->t_state, TS_ISOPEN);
225 		if (ISSET(tp->t_cflag, CLOCAL)) {
226 			SET(tp->t_state, TS_CONNECTED);
227 		}
228 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
229 	}
230 	ttsetwater(tp);
231 	crit_exit();
232 	return (0);
233 }
234 
235 /*
236  * Handle close() on a tty line: flush and set to initial state,
237  * bumping generation number so that pending read/write calls
238  * can detect recycling of the tty.
239  *
240  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
241  * and l_close() should have flushed, but we repeat the spltty() and
242  * the flush in case there are buggy callers.
243  */
244 int
245 ttyclose(struct tty *tp)
246 {
247 	funsetown(tp->t_sigio);
248 	crit_enter();
249 	if (constty == tp)
250 		constty = NULL;
251 
252 	ttyflush(tp, FREAD | FWRITE);
253 	clist_free_cblocks(&tp->t_canq);
254 	clist_free_cblocks(&tp->t_outq);
255 	clist_free_cblocks(&tp->t_rawq);
256 
257 	tp->t_gen++;
258 	tp->t_line = TTYDISC;
259 	ttyclearsession(tp);
260 	tp->t_state = 0;
261 	crit_exit();
262 	return (0);
263 }
264 
265 /*
266  * Disassociate the tty from its session.  Traditionally this has only been
267  * a half-close, meaning that the session was still allowed to point at the
268  * tty (resulting in the tty in the ps command showing something like 'p0-'),
269  * even though the tty is no longer pointing at the session.
270  *
271  * The half close seems to be useful only for 'ps' output but there is as
272  * yet no reason to remove the feature.  The full-close code is currently
273  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
274  */
275 void
276 ttyclearsession(struct tty *tp)
277 {
278 	struct session *sp;
279 
280 	tp->t_pgrp = NULL;
281 	if ((sp = tp->t_session) != NULL) {
282 		tp->t_session = NULL;
283 #ifdef TTY_DO_FULL_CLOSE
284 		/* FULL CLOSE (not yet) */
285 		if (sp->s_ttyp == tp) {
286 			sp->s_ttyp = NULL;
287 		} else {
288 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
289 				"%p/%p\n", sp->s_ttyp, tp);
290 		}
291 #endif
292 	}
293 }
294 
295 /*
296  * Release the tty vnode association for a session.  This is the
297  * 'other half' of the close.  Because multiple opens of /dev/tty
298  * only generate a single open to the actual tty, the file modes
299  * are locked to FREAD|FWRITE.
300  *
301  * If dorevoke is non-zero, the session is also revoked.  We have to
302  * close the vnode if VCTTYISOPEN is set.
303  */
304 void
305 ttyclosesession(struct session *sp, int dorevoke)
306 {
307 	struct vnode *vp;
308 
309 retry:
310 	/*
311 	 * There may not be a controlling terminal or it may have been closed
312 	 * out from under us.
313 	 */
314 	if ((vp = sp->s_ttyvp) == NULL)
315 		return;
316 
317 	/*
318 	 * We need a lock if we have to close or revoke.
319 	 */
320 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
321 		vhold(vp);
322 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
323 			vdrop(vp);
324 			goto retry;
325 		}
326 
327 		/*
328 		 * Retry if the vnode was ripped out from under us
329 		 */
330 		if (vp != sp->s_ttyvp) {
331 			vn_unlock(vp);
332 			vdrop(vp);
333 			goto retry;
334 		}
335 
336 		/*
337 		 * Close and revoke as needed
338 		 */
339 		sp->s_ttyvp = NULL;
340 		if (vp->v_flag & VCTTYISOPEN) {
341 			vclrflags(vp, VCTTYISOPEN);
342 			VOP_CLOSE(vp, FREAD|FWRITE);
343 		}
344 		vn_unlock(vp);
345 		if (dorevoke)
346 			vrevoke(vp, proc0.p_ucred);
347 		vdrop(vp);
348 	} else {
349 		sp->s_ttyvp = NULL;
350 	}
351 	vrele(vp);
352 }
353 
354 #define	FLUSHQ(q) {							\
355 	if ((q)->c_cc)							\
356 		ndflush(q, (q)->c_cc);					\
357 }
358 
359 /* Is 'c' a line delimiter ("break" character)? */
360 #define	TTBREAKC(c, lflag)							\
361 	((c) == '\n' || (((c) == cc[VEOF] ||				\
362 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
363 	 (c) != _POSIX_VDISABLE))
364 
365 /*
366  * Process input of a single character received on a tty.
367  */
368 int
369 ttyinput(int c, struct tty *tp)
370 {
371 	tcflag_t iflag, lflag;
372 	cc_t *cc;
373 	int i, err;
374 
375 	/*
376 	 * If input is pending take it first.
377 	 */
378 	lflag = tp->t_lflag;
379 	if (ISSET(lflag, PENDIN))
380 		ttypend(tp);
381 	/*
382 	 * Gather stats.
383 	 */
384 	if (ISSET(lflag, ICANON))
385 		++tp->t_cancc;
386 	else
387 		++tp->t_rawcc;
388 	++tk_nin;
389 
390 	/*
391 	 * Block further input iff:
392 	 * current input > threshold AND input is available to user program
393 	 * AND input flow control is enabled and not yet invoked.
394 	 * The 3 is slop for PARMRK.
395 	 */
396 	iflag = tp->t_iflag;
397 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
398 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
399 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
400 	    !ISSET(tp->t_state, TS_TBLOCK))
401 		ttyblock(tp);
402 
403 	/* Handle exceptional conditions (break, parity, framing). */
404 	cc = tp->t_cc;
405 	err = (ISSET(c, TTY_ERRORMASK));
406 	if (err) {
407 		CLR(c, TTY_ERRORMASK);
408 		if (ISSET(err, TTY_BI)) {
409 			if (ISSET(iflag, IGNBRK))
410 				return (0);
411 			if (ISSET(iflag, BRKINT)) {
412 				ttyflush(tp, FREAD | FWRITE);
413 				pgsignal(tp->t_pgrp, SIGINT, 1);
414 				goto endcase;
415 			}
416 			if (ISSET(iflag, PARMRK))
417 				goto parmrk;
418 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
419 			|| ISSET(err, TTY_FE)) {
420 			if (ISSET(iflag, IGNPAR))
421 				return (0);
422 			else if (ISSET(iflag, PARMRK)) {
423 parmrk:
424 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
425 				    MAX_INPUT - 3)
426 					goto input_overflow;
427 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
428 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
429 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
430 				goto endcase;
431 			} else
432 				c = 0;
433 		}
434 	}
435 
436 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
437 		CLR(c, 0x80);
438 	if (!ISSET(lflag, EXTPROC)) {
439 		/*
440 		 * Check for literal nexting very first
441 		 */
442 		if (ISSET(tp->t_state, TS_LNCH)) {
443 			SET(c, TTY_QUOTE);
444 			CLR(tp->t_state, TS_LNCH);
445 		}
446 		/*
447 		 * Scan for special characters.  This code
448 		 * is really just a big case statement with
449 		 * non-constant cases.  The bottom of the
450 		 * case statement is labeled ``endcase'', so goto
451 		 * it after a case match, or similar.
452 		 */
453 
454 		/*
455 		 * Control chars which aren't controlled
456 		 * by ICANON, ISIG, or IXON.
457 		 */
458 		if (ISSET(lflag, IEXTEN)) {
459 			if (CCEQ(cc[VLNEXT], c)) {
460 				if (ISSET(lflag, ECHO)) {
461 					if (ISSET(lflag, ECHOE)) {
462 						(void)ttyoutput('^', tp);
463 						(void)ttyoutput('\b', tp);
464 					} else
465 						ttyecho(c, tp);
466 				}
467 				SET(tp->t_state, TS_LNCH);
468 				goto endcase;
469 			}
470 			if (CCEQ(cc[VDISCARD], c)) {
471 				if (ISSET(lflag, FLUSHO))
472 					CLR(tp->t_lflag, FLUSHO);
473 				else {
474 					ttyflush(tp, FWRITE);
475 					ttyecho(c, tp);
476 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
477 						ttyretype(tp);
478 					SET(tp->t_lflag, FLUSHO);
479 				}
480 				goto startoutput;
481 			}
482 		}
483 		/*
484 		 * Signals.
485 		 */
486 		if (ISSET(lflag, ISIG)) {
487 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
488 				if (!ISSET(lflag, NOFLSH))
489 					ttyflush(tp, FREAD | FWRITE);
490 				ttyecho(c, tp);
491 				pgsignal(tp->t_pgrp,
492 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
493 				goto endcase;
494 			}
495 			if (CCEQ(cc[VSUSP], c)) {
496 				if (!ISSET(lflag, NOFLSH))
497 					ttyflush(tp, FREAD);
498 				ttyecho(c, tp);
499 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
500 				goto endcase;
501 			}
502 		}
503 		/*
504 		 * Handle start/stop characters.
505 		 */
506 		if (ISSET(iflag, IXON)) {
507 			if (CCEQ(cc[VSTOP], c)) {
508 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
509 					SET(tp->t_state, TS_TTSTOP);
510 					(*tp->t_stop)(tp, 0);
511 					return (0);
512 				}
513 				if (!CCEQ(cc[VSTART], c))
514 					return (0);
515 				/*
516 				 * if VSTART == VSTOP then toggle
517 				 */
518 				goto endcase;
519 			}
520 			if (CCEQ(cc[VSTART], c))
521 				goto restartoutput;
522 		}
523 		/*
524 		 * IGNCR, ICRNL, & INLCR
525 		 */
526 		if (c == '\r') {
527 			if (ISSET(iflag, IGNCR))
528 				return (0);
529 			else if (ISSET(iflag, ICRNL))
530 				c = '\n';
531 		} else if (c == '\n' && ISSET(iflag, INLCR))
532 			c = '\r';
533 	}
534 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
535 		/*
536 		 * From here on down canonical mode character
537 		 * processing takes place.
538 		 */
539 		/*
540 		 * erase or erase2 (^H / ^?)
541 		 */
542 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
543 			if (tp->t_rawq.c_cc)
544 				ttyrub(clist_unputc(&tp->t_rawq), tp);
545 			goto endcase;
546 		}
547 		/*
548 		 * kill (^U)
549 		 */
550 		if (CCEQ(cc[VKILL], c)) {
551 			if (ISSET(lflag, ECHOKE) &&
552 			    tp->t_rawq.c_cc == tp->t_rocount &&
553 			    !ISSET(lflag, ECHOPRT))
554 				while (tp->t_rawq.c_cc)
555 					ttyrub(clist_unputc(&tp->t_rawq), tp);
556 			else {
557 				ttyecho(c, tp);
558 				if (ISSET(lflag, ECHOK) ||
559 				    ISSET(lflag, ECHOKE))
560 					ttyecho('\n', tp);
561 				FLUSHQ(&tp->t_rawq);
562 				tp->t_rocount = 0;
563 			}
564 			CLR(tp->t_state, TS_LOCAL);
565 			goto endcase;
566 		}
567 		/*
568 		 * word erase (^W)
569 		 */
570 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
571 			int ctype;
572 
573 			/*
574 			 * erase whitespace
575 			 */
576 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
577 				ttyrub(c, tp);
578 			if (c == -1)
579 				goto endcase;
580 			/*
581 			 * erase last char of word and remember the
582 			 * next chars type (for ALTWERASE)
583 			 */
584 			ttyrub(c, tp);
585 			c = clist_unputc(&tp->t_rawq);
586 			if (c == -1)
587 				goto endcase;
588 			if (c == ' ' || c == '\t') {
589 				clist_putc(c, &tp->t_rawq);
590 				goto endcase;
591 			}
592 			ctype = ISALPHA(c);
593 			/*
594 			 * erase rest of word
595 			 */
596 			do {
597 				ttyrub(c, tp);
598 				c = clist_unputc(&tp->t_rawq);
599 				if (c == -1)
600 					goto endcase;
601 			} while (c != ' ' && c != '\t' &&
602 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
603 			clist_putc(c, &tp->t_rawq);
604 			goto endcase;
605 		}
606 		/*
607 		 * reprint line (^R)
608 		 */
609 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
610 			ttyretype(tp);
611 			goto endcase;
612 		}
613 		/*
614 		 * ^T - kernel info and generate SIGINFO
615 		 */
616 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
617 			if (ISSET(lflag, ISIG))
618 				pgsignal(tp->t_pgrp, SIGINFO, 1);
619 			if (!ISSET(lflag, NOKERNINFO))
620 				ttyinfo(tp);
621 			goto endcase;
622 		}
623 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
624 			if (ISSET(lflag, ISIG))
625 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
626 			goto endcase;
627 		}
628 	}
629 	/*
630 	 * Check for input buffer overflow
631 	 */
632 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
633 input_overflow:
634 		if (ISSET(iflag, IMAXBEL)) {
635 			if (tp->t_outq.c_cc < tp->t_ohiwat)
636 				(void)ttyoutput(CTRL('g'), tp);
637 		}
638 		goto endcase;
639 	}
640 
641 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
642 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
643 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
644 
645 	/*
646 	 * Put data char in q for user and
647 	 * wakeup on seeing a line delimiter.
648 	 */
649 	if (clist_putc(c, &tp->t_rawq) >= 0) {
650 		if (!ISSET(lflag, ICANON)) {
651 			ttwakeup(tp);
652 			ttyecho(c, tp);
653 			goto endcase;
654 		}
655 		if (TTBREAKC(c, lflag)) {
656 			tp->t_rocount = 0;
657 			catq(&tp->t_rawq, &tp->t_canq);
658 			ttwakeup(tp);
659 		} else if (tp->t_rocount++ == 0)
660 			tp->t_rocol = tp->t_column;
661 		if (ISSET(tp->t_state, TS_ERASE)) {
662 			/*
663 			 * end of prterase \.../
664 			 */
665 			CLR(tp->t_state, TS_ERASE);
666 			(void)ttyoutput('/', tp);
667 		}
668 		i = tp->t_column;
669 		ttyecho(c, tp);
670 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
671 			/*
672 			 * Place the cursor over the '^' of the ^D.
673 			 */
674 			i = imin(2, tp->t_column - i);
675 			while (i > 0) {
676 				(void)ttyoutput('\b', tp);
677 				i--;
678 			}
679 		}
680 	}
681 endcase:
682 	/*
683 	 * IXANY means allow any character to restart output.
684 	 */
685 	if (ISSET(tp->t_state, TS_TTSTOP) &&
686 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
687 		return (0);
688 restartoutput:
689 	CLR(tp->t_lflag, FLUSHO);
690 	CLR(tp->t_state, TS_TTSTOP);
691 startoutput:
692 	return (ttstart(tp));
693 }
694 
695 /*
696  * Output a single character on a tty, doing output processing
697  * as needed (expanding tabs, newline processing, etc.).
698  * Returns < 0 if succeeds, otherwise returns char to resend.
699  * Must be recursive.
700  */
701 static int
702 ttyoutput(int c, struct tty *tp)
703 {
704 	tcflag_t oflag;
705 	int col;
706 
707 	oflag = tp->t_oflag;
708 	if (!ISSET(oflag, OPOST)) {
709 		if (ISSET(tp->t_lflag, FLUSHO))
710 			return (-1);
711 		if (clist_putc(c, &tp->t_outq))
712 			return (c);
713 		tk_nout++;
714 		tp->t_outcc++;
715 		return (-1);
716 	}
717 	/*
718 	 * Do tab expansion if OXTABS is set.  Special case if we external
719 	 * processing, we don't do the tab expansion because we'll probably
720 	 * get it wrong.  If tab expansion needs to be done, let it happen
721 	 * externally.
722 	 */
723 	CLR(c, ~TTY_CHARMASK);
724 	if (c == '\t' &&
725 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
726 		c = 8 - (tp->t_column & 7);
727 		if (!ISSET(tp->t_lflag, FLUSHO)) {
728 			crit_enter();		/* Don't interrupt tabs. */
729 			c -= b_to_q("        ", c, &tp->t_outq);
730 			tk_nout += c;
731 			tp->t_outcc += c;
732 			crit_exit();
733 		}
734 		tp->t_column += c;
735 		return (c ? -1 : '\t');
736 	}
737 	if (c == CEOT && ISSET(oflag, ONOEOT))
738 		return (-1);
739 
740 	/*
741 	 * Newline translation: if ONLCR is set,
742 	 * translate newline into "\r\n".
743 	 */
744 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
745 		tk_nout++;
746 		tp->t_outcc++;
747 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq))
748 			return (c);
749 	}
750 	/* If OCRNL is set, translate "\r" into "\n". */
751 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
752 		c = '\n';
753 	/* If ONOCR is set, don't transmit CRs when on column 0. */
754 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
755 		return (-1);
756 
757 	tk_nout++;
758 	tp->t_outcc++;
759 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq))
760 		return (c);
761 
762 	col = tp->t_column;
763 	switch (CCLASS(c)) {
764 	case BACKSPACE:
765 		if (col > 0)
766 			--col;
767 		break;
768 	case CONTROL:
769 		break;
770 	case NEWLINE:
771 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
772 			col = 0;
773 		break;
774 	case RETURN:
775 		col = 0;
776 		break;
777 	case ORDINARY:
778 		++col;
779 		break;
780 	case TAB:
781 		col = (col + 8) & ~7;
782 		break;
783 	}
784 	tp->t_column = col;
785 	return (-1);
786 }
787 
788 /*
789  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
790  * has been called to do discipline-specific functions and/or reject any
791  * of these ioctl commands.
792  */
793 /* ARGSUSED */
794 int
795 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
796 {
797 	struct thread *td = curthread;
798 	struct lwp *lp = td->td_lwp;
799 	struct proc *p = td->td_proc;
800 	int error;
801 
802 	KKASSERT(p);
803 
804 	/* If the ioctl involves modification, hang if in the background. */
805 	switch (cmd) {
806 	case  TIOCCBRK:
807 	case  TIOCCONS:
808 	case  TIOCDRAIN:
809 	case  TIOCEXCL:
810 	case  TIOCFLUSH:
811 #ifdef TIOCHPCL
812 	case  TIOCHPCL:
813 #endif
814 	case  TIOCNXCL:
815 	case  TIOCSBRK:
816 	case  TIOCSCTTY:
817 	case  TIOCSDRAINWAIT:
818 	case  TIOCSETA:
819 	case  TIOCSETAF:
820 	case  TIOCSETAW:
821 	case  TIOCSETD:
822 	case  TIOCSPGRP:
823 	case  TIOCSTART:
824 	case  TIOCSTAT:
825 	case  TIOCSTI:
826 	case  TIOCSTOP:
827 	case  TIOCSWINSZ:
828 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
829 	case  TIOCLBIC:
830 	case  TIOCLBIS:
831 	case  TIOCLSET:
832 	case  TIOCSETC:
833 	case OTIOCSETD:
834 	case  TIOCSETN:
835 	case  TIOCSETP:
836 	case  TIOCSLTC:
837 #endif
838 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
839 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
840 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
841 			if (p->p_pgrp->pg_jobc == 0)
842 				return (EIO);
843 			pgsignal(p->p_pgrp, SIGTTOU, 1);
844 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
845 					 0);
846 			if (error)
847 				return (error);
848 		}
849 		break;
850 	}
851 
852 	switch (cmd) {			/* Process the ioctl. */
853 	case FIOASYNC:			/* set/clear async i/o */
854 		crit_enter();
855 		if (*(int *)data)
856 			SET(tp->t_state, TS_ASYNC);
857 		else
858 			CLR(tp->t_state, TS_ASYNC);
859 		crit_exit();
860 		break;
861 	case FIONREAD:			/* get # bytes to read */
862 		crit_enter();
863 		*(int *)data = ttnread(tp);
864 		crit_exit();
865 		break;
866 
867 	case FIOSETOWN:
868 		/*
869 		 * Policy -- Don't allow FIOSETOWN on someone else's
870 		 *           controlling tty
871 		 */
872 		if (tp->t_session != NULL && !isctty(p, tp))
873 			return (ENOTTY);
874 
875 		error = fsetown(*(int *)data, &tp->t_sigio);
876 		if (error)
877 			return (error);
878 		break;
879 	case FIOGETOWN:
880 		if (tp->t_session != NULL && !isctty(p, tp))
881 			return (ENOTTY);
882 		*(int *)data = fgetown(tp->t_sigio);
883 		break;
884 
885 	case TIOCEXCL:			/* set exclusive use of tty */
886 		crit_enter();
887 		SET(tp->t_state, TS_XCLUDE);
888 		crit_exit();
889 		break;
890 	case TIOCFLUSH: {		/* flush buffers */
891 		int flags = *(int *)data;
892 
893 		if (flags == 0)
894 			flags = FREAD | FWRITE;
895 		else
896 			flags &= FREAD | FWRITE;
897 		ttyflush(tp, flags);
898 		break;
899 	}
900 	case TIOCCONS:			/* become virtual console */
901 		if (*(int *)data) {
902 			if (constty && constty != tp &&
903 			    ISSET(constty->t_state, TS_CONNECTED))
904 				return (EBUSY);
905 #ifndef	UCONSOLE
906 			if ((error = priv_check(td, PRIV_ROOT)) != 0)
907 				return (error);
908 #endif
909 			constty = tp;
910 		} else if (tp == constty)
911 			constty = NULL;
912 		break;
913 	case TIOCDRAIN:			/* wait till output drained */
914 		error = ttywait(tp);
915 		if (error)
916 			return (error);
917 		break;
918 	case TIOCGETA: {		/* get termios struct */
919 		struct termios *t = (struct termios *)data;
920 
921 		bcopy(&tp->t_termios, t, sizeof(struct termios));
922 		break;
923 	}
924 	case TIOCGETD:			/* get line discipline */
925 		*(int *)data = tp->t_line;
926 		break;
927 	case TIOCGWINSZ:		/* get window size */
928 		*(struct winsize *)data = tp->t_winsize;
929 		break;
930 	case TIOCGPGRP:			/* get pgrp of tty */
931 		if (!isctty(p, tp))
932 			return (ENOTTY);
933 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
934 		break;
935 	case TIOCGSID:                  /* get sid of tty */
936 		if (!isctty(p, tp))
937 			return (ENOTTY);
938 		*(int *)data = tp->t_session->s_sid;
939 		break;
940 #ifdef TIOCHPCL
941 	case TIOCHPCL:			/* hang up on last close */
942 		crit_enter();
943 		SET(tp->t_cflag, HUPCL);
944 		crit_exit();
945 		break;
946 #endif
947 	case TIOCNXCL:			/* reset exclusive use of tty */
948 		crit_enter();
949 		CLR(tp->t_state, TS_XCLUDE);
950 		crit_exit();
951 		break;
952 	case TIOCOUTQ:			/* output queue size */
953 		*(int *)data = tp->t_outq.c_cc;
954 		break;
955 	case TIOCSETA:			/* set termios struct */
956 	case TIOCSETAW:			/* drain output, set */
957 	case TIOCSETAF: {		/* drn out, fls in, set */
958 		struct termios *t = (struct termios *)data;
959 
960 		if (t->c_ispeed == 0)
961 			t->c_ispeed = t->c_ospeed;
962 		if (t->c_ispeed == 0)
963 			t->c_ispeed = tp->t_ospeed;
964 		if (t->c_ispeed == 0)
965 			return (EINVAL);
966 		crit_enter();
967 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
968 			error = ttywait(tp);
969 			if (error) {
970 				crit_exit();
971 				return (error);
972 			}
973 			if (cmd == TIOCSETAF)
974 				ttyflush(tp, FREAD);
975 		}
976 		if (!ISSET(t->c_cflag, CIGNORE)) {
977 			/*
978 			 * Set device hardware.
979 			 */
980 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
981 				crit_exit();
982 				return (error);
983 			}
984 			if (ISSET(t->c_cflag, CLOCAL) &&
985 			    !ISSET(tp->t_cflag, CLOCAL)) {
986 				/*
987 				 * XXX disconnections would be too hard to
988 				 * get rid of without this kludge.  The only
989 				 * way to get rid of controlling terminals
990 				 * is to exit from the session leader.
991 				 */
992 				CLR(tp->t_state, TS_ZOMBIE);
993 
994 				wakeup(TSA_CARR_ON(tp));
995 				ttwakeup(tp);
996 				ttwwakeup(tp);
997 			}
998 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
999 			     ISSET(t->c_cflag, CLOCAL)) &&
1000 			    !ISSET(tp->t_state, TS_ZOMBIE))
1001 				SET(tp->t_state, TS_CONNECTED);
1002 			else
1003 				CLR(tp->t_state, TS_CONNECTED);
1004 			tp->t_cflag = t->c_cflag;
1005 			tp->t_ispeed = t->c_ispeed;
1006 			if (t->c_ospeed != 0)
1007 				tp->t_ospeed = t->c_ospeed;
1008 			ttsetwater(tp);
1009 		}
1010 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1011 		    cmd != TIOCSETAF) {
1012 			if (ISSET(t->c_lflag, ICANON))
1013 				SET(tp->t_lflag, PENDIN);
1014 			else {
1015 				/*
1016 				 * XXX we really shouldn't allow toggling
1017 				 * ICANON while we're in a non-termios line
1018 				 * discipline.  Now we have to worry about
1019 				 * panicing for a null queue.
1020 				 */
1021 				if (tp->t_canq.c_cbreserved > 0 &&
1022 				    tp->t_rawq.c_cbreserved > 0) {
1023 					catq(&tp->t_rawq, &tp->t_canq);
1024 					/*
1025 					 * XXX the queue limits may be
1026 					 * different, so the old queue
1027 					 * swapping method no longer works.
1028 					 */
1029 					catq(&tp->t_canq, &tp->t_rawq);
1030 				}
1031 				CLR(tp->t_lflag, PENDIN);
1032 			}
1033 			ttwakeup(tp);
1034 		}
1035 		tp->t_iflag = t->c_iflag;
1036 		tp->t_oflag = t->c_oflag;
1037 		/*
1038 		 * Make the EXTPROC bit read only.
1039 		 */
1040 		if (ISSET(tp->t_lflag, EXTPROC))
1041 			SET(t->c_lflag, EXTPROC);
1042 		else
1043 			CLR(t->c_lflag, EXTPROC);
1044 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1045 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1046 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1047 			ttwakeup(tp);
1048 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1049 		crit_exit();
1050 		break;
1051 	}
1052 	case TIOCSETD: {		/* set line discipline */
1053 		int t = *(int *)data;
1054 		cdev_t device = tp->t_dev;
1055 
1056 		if ((u_int)t >= nlinesw)
1057 			return (ENXIO);
1058 		if (t != tp->t_line) {
1059 			crit_enter();
1060 			(*linesw[tp->t_line].l_close)(tp, flag);
1061 			error = (*linesw[t].l_open)(device, tp);
1062 			if (error) {
1063 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1064 				crit_exit();
1065 				return (error);
1066 			}
1067 			tp->t_line = t;
1068 			crit_exit();
1069 		}
1070 		break;
1071 	}
1072 	case TIOCSTART:			/* start output, like ^Q */
1073 		crit_enter();
1074 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1075 		    ISSET(tp->t_lflag, FLUSHO)) {
1076 			CLR(tp->t_lflag, FLUSHO);
1077 			CLR(tp->t_state, TS_TTSTOP);
1078 			ttstart(tp);
1079 		}
1080 		crit_exit();
1081 		break;
1082 	case TIOCSTI:			/* simulate terminal input */
1083 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT))
1084 			return (EPERM);
1085 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT))
1086 			return (EACCES);
1087 		crit_enter();
1088 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1089 		crit_exit();
1090 		break;
1091 	case TIOCSTOP:			/* stop output, like ^S */
1092 		crit_enter();
1093 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1094 			SET(tp->t_state, TS_TTSTOP);
1095 			(*tp->t_stop)(tp, 0);
1096 		}
1097 		crit_exit();
1098 		break;
1099 	case TIOCSCTTY:			/* become controlling tty */
1100 		/* Session ctty vnode pointer set in vnode layer. */
1101 		if (!SESS_LEADER(p) ||
1102 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1103 		    (tp->t_session != p->p_session)))
1104 			return (EPERM);
1105 		tp->t_session = p->p_session;
1106 		tp->t_pgrp = p->p_pgrp;
1107 		p->p_session->s_ttyp = tp;
1108 		p->p_flag |= P_CONTROLT;
1109 		break;
1110 	case TIOCSPGRP: {		/* set pgrp of tty */
1111 		pid_t pgid = *(int *)data;
1112 
1113 		if (!isctty(p, tp))
1114 			return (ENOTTY);
1115 		else if (pgid < 1 || pgid > PID_MAX)
1116 			return (EINVAL);
1117 		else {
1118 			struct pgrp *pgrp = pgfind(pgid);
1119 			if (pgrp == NULL || pgrp->pg_session != p->p_session)
1120 				return (EPERM);
1121 
1122 			tp->t_pgrp = pgrp;
1123 		}
1124 		break;
1125 	}
1126 	case TIOCSTAT:			/* simulate control-T */
1127 		crit_enter();
1128 		ttyinfo(tp);
1129 		crit_exit();
1130 		break;
1131 	case TIOCSWINSZ:		/* set window size */
1132 		if (bcmp((caddr_t)&tp->t_winsize, data,
1133 		    sizeof (struct winsize))) {
1134 			tp->t_winsize = *(struct winsize *)data;
1135 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1136 		}
1137 		break;
1138 	case TIOCSDRAINWAIT:
1139 		error = priv_check(td, PRIV_ROOT);
1140 		if (error)
1141 			return (error);
1142 		tp->t_timeout = *(int *)data * hz;
1143 		wakeup(TSA_OCOMPLETE(tp));
1144 		wakeup(TSA_OLOWAT(tp));
1145 		break;
1146 	case TIOCGDRAINWAIT:
1147 		*(int *)data = tp->t_timeout / hz;
1148 		break;
1149 	default:
1150 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1151 		return (ttcompat(tp, cmd, data, flag));
1152 #else
1153 		return (ENOIOCTL);
1154 #endif
1155 	}
1156 	return (0);
1157 }
1158 
1159 static struct filterops ttyread_filtops =
1160 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1161 static struct filterops ttywrite_filtops =
1162 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1163 
1164 int
1165 ttykqfilter(struct dev_kqfilter_args *ap)
1166 {
1167 	cdev_t dev = ap->a_head.a_dev;
1168 	struct knote *kn = ap->a_kn;
1169 	struct tty *tp = dev->si_tty;
1170 	struct klist *klist;
1171 
1172 	ap->a_result = 0;
1173 	switch (kn->kn_filter) {
1174 	case EVFILT_READ:
1175 		klist = &tp->t_rsel.si_note;
1176 		kn->kn_fop = &ttyread_filtops;
1177 		break;
1178 	case EVFILT_WRITE:
1179 		klist = &tp->t_wsel.si_note;
1180 		kn->kn_fop = &ttywrite_filtops;
1181 		break;
1182 	default:
1183 		ap->a_result = EOPNOTSUPP;
1184 		return (0);
1185 	}
1186 
1187 	kn->kn_hook = (caddr_t)dev;
1188 
1189 	crit_enter();
1190 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1191 	crit_exit();
1192 
1193 	return (0);
1194 }
1195 
1196 static void
1197 filt_ttyrdetach(struct knote *kn)
1198 {
1199 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1200 
1201 	crit_enter();
1202 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
1203 	crit_exit();
1204 }
1205 
1206 static int
1207 filt_ttyread(struct knote *kn, long hint)
1208 {
1209 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1210 
1211 	kn->kn_data = ttnread(tp);
1212 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1213 		kn->kn_flags |= EV_EOF;
1214 		return (1);
1215 	}
1216 	return (kn->kn_data > 0);
1217 }
1218 
1219 static void
1220 filt_ttywdetach(struct knote *kn)
1221 {
1222 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1223 
1224 	crit_enter();
1225 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
1226 	crit_exit();
1227 }
1228 
1229 static int
1230 filt_ttywrite(struct knote *kn, long hint)
1231 {
1232 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1233 
1234 	kn->kn_data = tp->t_outq.c_cc;
1235 	if (ISSET(tp->t_state, TS_ZOMBIE))
1236 		return (1);
1237 	return (kn->kn_data <= tp->t_olowat &&
1238 	    ISSET(tp->t_state, TS_CONNECTED));
1239 }
1240 
1241 /*
1242  * Must be called while in a critical section.
1243  */
1244 static int
1245 ttnread(struct tty *tp)
1246 {
1247 	int nread;
1248 
1249 	if (ISSET(tp->t_lflag, PENDIN))
1250 		ttypend(tp);
1251 	nread = tp->t_canq.c_cc;
1252 	if (!ISSET(tp->t_lflag, ICANON)) {
1253 		nread += tp->t_rawq.c_cc;
1254 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1255 			nread = 0;
1256 	}
1257 	return (nread);
1258 }
1259 
1260 /*
1261  * Wait for output to drain.
1262  */
1263 int
1264 ttywait(struct tty *tp)
1265 {
1266 	int error;
1267 
1268 	error = 0;
1269 	crit_enter();
1270 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1271 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1272 		(*tp->t_oproc)(tp);
1273 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1274 		    ISSET(tp->t_state, TS_CONNECTED)) {
1275 			SET(tp->t_state, TS_SO_OCOMPLETE);
1276 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1277 					 PCATCH, "ttywai",
1278 					 tp->t_timeout);
1279 			if (error) {
1280 				if (error == EWOULDBLOCK)
1281 					error = EIO;
1282 				break;
1283 			}
1284 		} else
1285 			break;
1286 	}
1287 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1288 		error = EIO;
1289 	crit_exit();
1290 	return (error);
1291 }
1292 
1293 /*
1294  * Flush if successfully wait.
1295  */
1296 static int
1297 ttywflush(struct tty *tp)
1298 {
1299 	int error;
1300 
1301 	if ((error = ttywait(tp)) == 0)
1302 		ttyflush(tp, FREAD);
1303 	return (error);
1304 }
1305 
1306 /*
1307  * Flush tty read and/or write queues, notifying anyone waiting.
1308  */
1309 void
1310 ttyflush(struct tty *tp, int rw)
1311 {
1312 	crit_enter();
1313 #if 0
1314 again:
1315 #endif
1316 	if (rw & FWRITE) {
1317 		FLUSHQ(&tp->t_outq);
1318 		CLR(tp->t_state, TS_TTSTOP);
1319 	}
1320 	(*tp->t_stop)(tp, rw);
1321 	if (rw & FREAD) {
1322 		FLUSHQ(&tp->t_canq);
1323 		FLUSHQ(&tp->t_rawq);
1324 		CLR(tp->t_lflag, PENDIN);
1325 		tp->t_rocount = 0;
1326 		tp->t_rocol = 0;
1327 		CLR(tp->t_state, TS_LOCAL);
1328 		ttwakeup(tp);
1329 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1330 			if (rw & FWRITE)
1331 				FLUSHQ(&tp->t_outq);
1332 			ttyunblock(tp);
1333 
1334 			/*
1335 			 * Don't let leave any state that might clobber the
1336 			 * next line discipline (although we should do more
1337 			 * to send the START char).  Not clearing the state
1338 			 * may have caused the "putc to a clist with no
1339 			 * reserved cblocks" panic/kprintf.
1340 			 */
1341 			CLR(tp->t_state, TS_TBLOCK);
1342 
1343 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1344 			if (ISSET(tp->t_iflag, IXOFF)) {
1345 				/*
1346 				 * XXX wait a bit in the hope that the stop
1347 				 * character (if any) will go out.  Waiting
1348 				 * isn't good since it allows races.  This
1349 				 * will be fixed when the stop character is
1350 				 * put in a special queue.  Don't bother with
1351 				 * the checks in ttywait() since the timeout
1352 				 * will save us.
1353 				 */
1354 				SET(tp->t_state, TS_SO_OCOMPLETE);
1355 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1356 					 "ttyfls", hz / 10);
1357 				/*
1358 				 * Don't try sending the stop character again.
1359 				 */
1360 				CLR(tp->t_state, TS_TBLOCK);
1361 				goto again;
1362 			}
1363 #endif
1364 		}
1365 	}
1366 	if (rw & FWRITE) {
1367 		FLUSHQ(&tp->t_outq);
1368 		ttwwakeup(tp);
1369 	}
1370 	crit_exit();
1371 }
1372 
1373 /*
1374  * Copy in the default termios characters.
1375  */
1376 void
1377 termioschars(struct termios *t)
1378 {
1379 
1380 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1381 }
1382 
1383 /*
1384  * Old interface.
1385  */
1386 void
1387 ttychars(struct tty *tp)
1388 {
1389 
1390 	termioschars(&tp->t_termios);
1391 }
1392 
1393 /*
1394  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1395  * on our input flow control bit and propagate the changes to the driver.
1396  * XXX the stop character should be put in a special high priority queue.
1397  */
1398 void
1399 ttyblock(struct tty *tp)
1400 {
1401 
1402 	SET(tp->t_state, TS_TBLOCK);
1403 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1404 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1405 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1406 	ttstart(tp);
1407 }
1408 
1409 /*
1410  * Handle input low water.  Send start character for the IXOFF case.  Turn
1411  * off our input flow control bit and propagate the changes to the driver.
1412  * XXX the start character should be put in a special high priority queue.
1413  */
1414 static void
1415 ttyunblock(struct tty *tp)
1416 {
1417 
1418 	CLR(tp->t_state, TS_TBLOCK);
1419 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1420 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1421 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1422 	ttstart(tp);
1423 }
1424 
1425 #ifdef notyet
1426 /* Not used by any current (i386) drivers. */
1427 /*
1428  * Restart after an inter-char delay.
1429  */
1430 void
1431 ttrstrt(void *tp_arg)
1432 {
1433 	struct tty *tp;
1434 
1435 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1436 
1437 	tp = tp_arg;
1438 	crit_enter();
1439 	CLR(tp->t_state, TS_TIMEOUT);
1440 	ttstart(tp);
1441 	crit_exit();
1442 }
1443 #endif
1444 
1445 int
1446 ttstart(struct tty *tp)
1447 {
1448 
1449 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1450 		(*tp->t_oproc)(tp);
1451 	return (0);
1452 }
1453 
1454 /*
1455  * "close" a line discipline
1456  */
1457 int
1458 ttylclose(struct tty *tp, int flag)
1459 {
1460 
1461 	if (flag & FNONBLOCK || ttywflush(tp))
1462 		ttyflush(tp, FREAD | FWRITE);
1463 	return (0);
1464 }
1465 
1466 /*
1467  * Handle modem control transition on a tty.
1468  * Flag indicates new state of carrier.
1469  * Returns 0 if the line should be turned off, otherwise 1.
1470  */
1471 int
1472 ttymodem(struct tty *tp, int flag)
1473 {
1474 
1475 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1476 		/*
1477 		 * MDMBUF: do flow control according to carrier flag
1478 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1479 		 * works if IXON and IXANY are clear.
1480 		 */
1481 		if (flag) {
1482 			CLR(tp->t_state, TS_CAR_OFLOW);
1483 			CLR(tp->t_state, TS_TTSTOP);
1484 			ttstart(tp);
1485 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1486 			SET(tp->t_state, TS_CAR_OFLOW);
1487 			SET(tp->t_state, TS_TTSTOP);
1488 			(*tp->t_stop)(tp, 0);
1489 		}
1490 	} else if (flag == 0) {
1491 		/*
1492 		 * Lost carrier.
1493 		 */
1494 		CLR(tp->t_state, TS_CARR_ON);
1495 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1496 		    !ISSET(tp->t_cflag, CLOCAL)) {
1497 			SET(tp->t_state, TS_ZOMBIE);
1498 			CLR(tp->t_state, TS_CONNECTED);
1499 			if (tp->t_session && tp->t_session->s_leader)
1500 				ksignal(tp->t_session->s_leader, SIGHUP);
1501 			ttyflush(tp, FREAD | FWRITE);
1502 			return (0);
1503 		}
1504 	} else {
1505 		/*
1506 		 * Carrier now on.
1507 		 */
1508 		SET(tp->t_state, TS_CARR_ON);
1509 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1510 			SET(tp->t_state, TS_CONNECTED);
1511 		wakeup(TSA_CARR_ON(tp));
1512 		ttwakeup(tp);
1513 		ttwwakeup(tp);
1514 	}
1515 	return (1);
1516 }
1517 
1518 /*
1519  * Reinput pending characters after state switch
1520  * call from a critical section.
1521  */
1522 static void
1523 ttypend(struct tty *tp)
1524 {
1525 	struct clist tq;
1526 	int c;
1527 
1528 	CLR(tp->t_lflag, PENDIN);
1529 	SET(tp->t_state, TS_TYPEN);
1530 	/*
1531 	 * XXX this assumes too much about clist internals.  It may even
1532 	 * fail if the cblock slush pool is empty.  We can't allocate more
1533 	 * cblocks here because we are called from an interrupt handler
1534 	 * and clist_alloc_cblocks() can wait.
1535 	 */
1536 	tq = tp->t_rawq;
1537 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1538 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1539 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1540 	while ((c = clist_getc(&tq)) >= 0)
1541 		ttyinput(c, tp);
1542 	CLR(tp->t_state, TS_TYPEN);
1543 }
1544 
1545 /*
1546  * Process a read call on a tty device.
1547  */
1548 int
1549 ttread(struct tty *tp, struct uio *uio, int flag)
1550 {
1551 	struct clist *qp;
1552 	int c;
1553 	tcflag_t lflag;
1554 	cc_t *cc = tp->t_cc;
1555 	struct proc *pp;
1556 	struct lwp *lp;
1557 	int first, error = 0;
1558 	int has_stime = 0, last_cc = 0;
1559 	long slp = 0;		/* XXX this should be renamed `timo'. */
1560 	struct timeval stime;
1561 
1562 	lp = curthread->td_lwp;
1563 	stime.tv_sec = 0;	/* fix compiler warnings */
1564 	stime.tv_usec = 0;
1565 
1566 loop:
1567 	crit_enter();
1568 	lflag = tp->t_lflag;
1569 	/*
1570 	 * take pending input first
1571 	 */
1572 	if (ISSET(lflag, PENDIN)) {
1573 		ttypend(tp);
1574 		splz();		/* reduce latency */
1575 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1576 	}
1577 
1578 	/*
1579 	 * Hang process if it's in the background.
1580 	 */
1581 	if ((pp = curproc) && isbackground(pp, tp)) {
1582 		crit_exit();
1583 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1584 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1585 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0)
1586 			return (EIO);
1587 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1588 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1589 		if (error)
1590 			return (error);
1591 		goto loop;
1592 	}
1593 
1594 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1595 		crit_exit();
1596 		return (0);	/* EOF */
1597 	}
1598 
1599 	/*
1600 	 * If canonical, use the canonical queue,
1601 	 * else use the raw queue.
1602 	 *
1603 	 * (should get rid of clists...)
1604 	 */
1605 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1606 
1607 	if (flag & IO_NDELAY) {
1608 		if (qp->c_cc > 0)
1609 			goto read;
1610 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1611 			crit_exit();
1612 			return (0);
1613 		}
1614 		crit_exit();
1615 		return (EWOULDBLOCK);
1616 	}
1617 	if (!ISSET(lflag, ICANON)) {
1618 		int m = cc[VMIN];
1619 		long t = cc[VTIME];
1620 		struct timeval timecopy;
1621 
1622 		/*
1623 		 * Check each of the four combinations.
1624 		 * (m > 0 && t == 0) is the normal read case.
1625 		 * It should be fairly efficient, so we check that and its
1626 		 * companion case (m == 0 && t == 0) first.
1627 		 * For the other two cases, we compute the target sleep time
1628 		 * into slp.
1629 		 */
1630 		if (t == 0) {
1631 			if (qp->c_cc < m)
1632 				goto sleep;
1633 			if (qp->c_cc > 0)
1634 				goto read;
1635 
1636 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1637 			crit_exit();
1638 			return (0);
1639 		}
1640 		t *= 100000;		/* time in us */
1641 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1642 			 ((t1).tv_usec - (t2).tv_usec))
1643 		if (m > 0) {
1644 			if (qp->c_cc <= 0)
1645 				goto sleep;
1646 			if (qp->c_cc >= m)
1647 				goto read;
1648 			getmicrotime(&timecopy);
1649 			if (has_stime == 0) {
1650 				/* first character, start timer */
1651 				has_stime = 1;
1652 				stime = timecopy;
1653 				slp = t;
1654 			} else if (qp->c_cc > last_cc) {
1655 				/* got a character, restart timer */
1656 				stime = timecopy;
1657 				slp = t;
1658 			} else {
1659 				/* nothing, check expiration */
1660 				slp = t - diff(timecopy, stime);
1661 				if (slp <= 0)
1662 					goto read;
1663 			}
1664 			last_cc = qp->c_cc;
1665 		} else {	/* m == 0 */
1666 			if (qp->c_cc > 0)
1667 				goto read;
1668 			getmicrotime(&timecopy);
1669 			if (has_stime == 0) {
1670 				has_stime = 1;
1671 				stime = timecopy;
1672 				slp = t;
1673 			} else {
1674 				slp = t - diff(timecopy, stime);
1675 				if (slp <= 0) {
1676 					/* Timed out, but 0 is enough input. */
1677 					crit_exit();
1678 					return (0);
1679 				}
1680 			}
1681 		}
1682 #undef diff
1683 		/*
1684 		 * Rounding down may make us wake up just short
1685 		 * of the target, so we round up.
1686 		 * The formula is ceiling(slp * hz/1000000).
1687 		 * 32-bit arithmetic is enough for hz < 169.
1688 		 * XXX see tvtohz() for how to avoid overflow if hz
1689 		 * is large (divide by `tick' and/or arrange to
1690 		 * use tvtohz() if hz is large).
1691 		 */
1692 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1693 		goto sleep;
1694 	}
1695 	if (qp->c_cc <= 0) {
1696 sleep:
1697 		/*
1698 		 * There is no input, or not enough input and we can block.
1699 		 */
1700 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1701 				 ISSET(tp->t_state, TS_CONNECTED) ?
1702 				 "ttyin" : "ttyhup", (int)slp);
1703 		crit_exit();
1704 		if (error == EWOULDBLOCK)
1705 			error = 0;
1706 		else if (error)
1707 			return (error);
1708 		/*
1709 		 * XXX what happens if another process eats some input
1710 		 * while we are asleep (not just here)?  It would be
1711 		 * safest to detect changes and reset our state variables
1712 		 * (has_stime and last_cc).
1713 		 */
1714 		slp = 0;
1715 		goto loop;
1716 	}
1717 read:
1718 	crit_exit();
1719 	/*
1720 	 * Input present, check for input mapping and processing.
1721 	 */
1722 	first = 1;
1723 	if (ISSET(lflag, ICANON | ISIG))
1724 		goto slowcase;
1725 	for (;;) {
1726 		char ibuf[IBUFSIZ];
1727 		int icc;
1728 
1729 		icc = (int)szmin(uio->uio_resid, IBUFSIZ);
1730 		icc = q_to_b(qp, ibuf, icc);
1731 		if (icc <= 0) {
1732 			if (first)
1733 				goto loop;
1734 			break;
1735 		}
1736 		error = uiomove(ibuf, (size_t)icc, uio);
1737 		/*
1738 		 * XXX if there was an error then we should ungetc() the
1739 		 * unmoved chars and reduce icc here.
1740 		 */
1741 		if (error)
1742 			break;
1743  		if (uio->uio_resid == 0)
1744 			break;
1745 		first = 0;
1746 	}
1747 	goto out;
1748 slowcase:
1749 	for (;;) {
1750 		c = clist_getc(qp);
1751 		if (c < 0) {
1752 			if (first)
1753 				goto loop;
1754 			break;
1755 		}
1756 		/*
1757 		 * delayed suspend (^Y)
1758 		 */
1759 		if (CCEQ(cc[VDSUSP], c) &&
1760 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1761 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1762 			if (first) {
1763 				error = ttysleep(tp, &lbolt, PCATCH,
1764 						 "ttybg3", 0);
1765 				if (error)
1766 					break;
1767 				goto loop;
1768 			}
1769 			break;
1770 		}
1771 		/*
1772 		 * Interpret EOF only in canonical mode.
1773 		 */
1774 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1775 			break;
1776 		/*
1777 		 * Give user character.
1778 		 */
1779  		error = ureadc(c, uio);
1780 		if (error)
1781 			/* XXX should ungetc(c, qp). */
1782 			break;
1783  		if (uio->uio_resid == 0)
1784 			break;
1785 		/*
1786 		 * In canonical mode check for a "break character"
1787 		 * marking the end of a "line of input".
1788 		 */
1789 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1790 			break;
1791 		first = 0;
1792 	}
1793 
1794 out:
1795 	/*
1796 	 * Look to unblock input now that (presumably)
1797 	 * the input queue has gone down.
1798 	 */
1799 	crit_enter();
1800 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1801 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1802 		ttyunblock(tp);
1803 	crit_exit();
1804 
1805 	return (error);
1806 }
1807 
1808 /*
1809  * Check the output queue on tp for space for a kernel message (from uprintf
1810  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1811  * lose messages due to normal flow control, but don't let the tty run amok.
1812  * Sleeps here are not interruptible, but we return prematurely if new signals
1813  * arrive.
1814  */
1815 int
1816 ttycheckoutq(struct tty *tp, int wait)
1817 {
1818 	struct lwp *lp = curthread->td_lwp;
1819 	int hiwat;
1820 	sigset_t oldset, newset;
1821 
1822 	hiwat = tp->t_ohiwat;
1823 	SIGEMPTYSET(oldset);
1824 	SIGEMPTYSET(newset);
1825 	crit_enter();
1826 	if (wait)
1827 		oldset = lwp_sigpend(lp);
1828 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
1829 		while (tp->t_outq.c_cc > hiwat) {
1830 			ttstart(tp);
1831 			if (tp->t_outq.c_cc <= hiwat)
1832 				break;
1833 			if (wait)
1834 				newset = lwp_sigpend(lp);
1835 			if (!wait || SIGSETNEQ(oldset, newset)) {
1836 				crit_exit();
1837 				return (0);
1838 			}
1839 			SET(tp->t_state, TS_SO_OLOWAT);
1840 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
1841 		}
1842 	}
1843 	crit_exit();
1844 	return (1);
1845 }
1846 
1847 /*
1848  * Process a write call on a tty device.
1849  */
1850 int
1851 ttwrite(struct tty *tp, struct uio *uio, int flag)
1852 {
1853 	char *cp = NULL;
1854 	int cc, ce;
1855 	struct proc *pp;
1856 	struct lwp *lp;
1857 	int i, hiwat, error;
1858 	size_t cnt;
1859 
1860 	char obuf[OBUFSIZ];
1861 
1862 	lp = curthread->td_lwp;
1863 	hiwat = tp->t_ohiwat;
1864 	cnt = uio->uio_resid;
1865 	error = 0;
1866 	cc = 0;
1867 loop:
1868 	crit_enter();
1869 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1870 		crit_exit();
1871 		if (uio->uio_resid == cnt)
1872 			error = EIO;
1873 		goto out;
1874 	}
1875 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
1876 		if (flag & IO_NDELAY) {
1877 			crit_exit();
1878 			error = EWOULDBLOCK;
1879 			goto out;
1880 		}
1881 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
1882 		crit_exit();
1883 		if (error)
1884 			goto out;
1885 		goto loop;
1886 	}
1887 	crit_exit();
1888 
1889 	/*
1890 	 * Hang the process if it's in the background.
1891 	 */
1892 	if ((pp = curproc) && isbackground(pp, tp) &&
1893 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
1894 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
1895 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
1896 		if (pp->p_pgrp->pg_jobc == 0) {
1897 			error = EIO;
1898 			goto out;
1899 		}
1900 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
1901 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
1902 		if (error)
1903 			goto out;
1904 		goto loop;
1905 	}
1906 	/*
1907 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1908 	 * output translation.  Keep track of high water mark, sleep on
1909 	 * overflow awaiting device aid in acquiring new space.
1910 	 */
1911 	while (uio->uio_resid > 0 || cc > 0) {
1912 		if (ISSET(tp->t_lflag, FLUSHO)) {
1913 			uio->uio_resid = 0;
1914 			return (0);
1915 		}
1916 		if (tp->t_outq.c_cc > hiwat)
1917 			goto ovhiwat;
1918 		/*
1919 		 * Grab a hunk of data from the user, unless we have some
1920 		 * leftover from last time.
1921 		 */
1922 		if (cc == 0) {
1923 			cc = szmin(uio->uio_resid, OBUFSIZ);
1924 			cp = obuf;
1925 			error = uiomove(cp, (size_t)cc, uio);
1926 			if (error) {
1927 				cc = 0;
1928 				break;
1929 			}
1930 		}
1931 		/*
1932 		 * If nothing fancy need be done, grab those characters we
1933 		 * can handle without any of ttyoutput's processing and
1934 		 * just transfer them to the output q.  For those chars
1935 		 * which require special processing (as indicated by the
1936 		 * bits in char_type), call ttyoutput.  After processing
1937 		 * a hunk of data, look for FLUSHO so ^O's will take effect
1938 		 * immediately.
1939 		 */
1940 		while (cc > 0) {
1941 			if (!ISSET(tp->t_oflag, OPOST))
1942 				ce = cc;
1943 			else {
1944 				ce = cc - scanc((u_int)cc, (u_char *)cp,
1945 						char_type, CCLASSMASK);
1946 				/*
1947 				 * If ce is zero, then we're processing
1948 				 * a special character through ttyoutput.
1949 				 */
1950 				if (ce == 0) {
1951 					tp->t_rocount = 0;
1952 					if (ttyoutput(*cp, tp) >= 0) {
1953 						/* No Clists, wait a bit. */
1954 						ttstart(tp);
1955 						if (flag & IO_NDELAY) {
1956 							error = EWOULDBLOCK;
1957 							goto out;
1958 						}
1959 						error = ttysleep(tp, &lbolt,
1960 								 PCATCH,
1961 								 "ttybf1", 0);
1962 						if (error)
1963 							goto out;
1964 						goto loop;
1965 					}
1966 					cp++;
1967 					cc--;
1968 					if (ISSET(tp->t_lflag, FLUSHO) ||
1969 					    tp->t_outq.c_cc > hiwat)
1970 						goto ovhiwat;
1971 					continue;
1972 				}
1973 			}
1974 			/*
1975 			 * A bunch of normal characters have been found.
1976 			 * Transfer them en masse to the output queue and
1977 			 * continue processing at the top of the loop.
1978 			 * If there are any further characters in this
1979 			 * <= OBUFSIZ chunk, the first should be a character
1980 			 * requiring special handling by ttyoutput.
1981 			 */
1982 			tp->t_rocount = 0;
1983 			i = b_to_q(cp, ce, &tp->t_outq);
1984 			ce -= i;
1985 			tp->t_column += ce;
1986 			cp += ce, cc -= ce, tk_nout += ce;
1987 			tp->t_outcc += ce;
1988 			if (i > 0) {
1989 				/* No Clists, wait a bit. */
1990 				ttstart(tp);
1991 				if (flag & IO_NDELAY) {
1992 					error = EWOULDBLOCK;
1993 					goto out;
1994 				}
1995 				error = ttysleep(tp, &lbolt, PCATCH,
1996 						 "ttybf2", 0);
1997 				if (error)
1998 					goto out;
1999 				goto loop;
2000 			}
2001 			if (ISSET(tp->t_lflag, FLUSHO) ||
2002 			    tp->t_outq.c_cc > hiwat)
2003 				break;
2004 		}
2005 		ttstart(tp);
2006 	}
2007 out:
2008 	/*
2009 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2010 	 * offset and iov pointers have moved forward, but it doesn't matter
2011 	 * (the call will either return short or restart with a new uio).
2012 	 */
2013 	uio->uio_resid += cc;
2014 	return (error);
2015 
2016 ovhiwat:
2017 	ttstart(tp);
2018 	crit_enter();
2019 	/*
2020 	 * This can only occur if FLUSHO is set in t_lflag,
2021 	 * or if ttstart/oproc is synchronous (or very fast).
2022 	 */
2023 	if (tp->t_outq.c_cc <= hiwat) {
2024 		crit_exit();
2025 		goto loop;
2026 	}
2027 	if (flag & IO_NDELAY) {
2028 		crit_exit();
2029 		uio->uio_resid += cc;
2030 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2031 	}
2032 	SET(tp->t_state, TS_SO_OLOWAT);
2033 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2034 	crit_exit();
2035 	if (error == EWOULDBLOCK)
2036 		error = EIO;
2037 	if (error)
2038 		goto out;
2039 	goto loop;
2040 }
2041 
2042 /*
2043  * Rubout one character from the rawq of tp
2044  * as cleanly as possible.
2045  */
2046 static void
2047 ttyrub(int c, struct tty *tp)
2048 {
2049 	char *cp;
2050 	int savecol;
2051 	int tabc;
2052 
2053 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2054 		return;
2055 	CLR(tp->t_lflag, FLUSHO);
2056 	if (ISSET(tp->t_lflag, ECHOE)) {
2057 		if (tp->t_rocount == 0) {
2058 			/*
2059 			 * Screwed by ttwrite; retype
2060 			 */
2061 			ttyretype(tp);
2062 			return;
2063 		}
2064 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2065 			ttyrubo(tp, 2);
2066 		else {
2067 			CLR(c, ~TTY_CHARMASK);
2068 			switch (CCLASS(c)) {
2069 			case ORDINARY:
2070 				ttyrubo(tp, 1);
2071 				break;
2072 			case BACKSPACE:
2073 			case CONTROL:
2074 			case NEWLINE:
2075 			case RETURN:
2076 			case VTAB:
2077 				if (ISSET(tp->t_lflag, ECHOCTL))
2078 					ttyrubo(tp, 2);
2079 				break;
2080 			case TAB:
2081 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2082 					ttyretype(tp);
2083 					return;
2084 				}
2085 				crit_enter();
2086 				savecol = tp->t_column;
2087 				SET(tp->t_state, TS_CNTTB);
2088 				SET(tp->t_lflag, FLUSHO);
2089 				tp->t_column = tp->t_rocol;
2090 				cp = tp->t_rawq.c_cf;
2091 				if (cp)
2092 					tabc = *cp;	/* XXX FIX NEXTC */
2093 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2094 					ttyecho(tabc, tp);
2095 				CLR(tp->t_lflag, FLUSHO);
2096 				CLR(tp->t_state, TS_CNTTB);
2097 				crit_exit();
2098 
2099 				/* savecol will now be length of the tab. */
2100 				savecol -= tp->t_column;
2101 				tp->t_column += savecol;
2102 				if (savecol > 8)
2103 					savecol = 8;	/* overflow screw */
2104 				while (--savecol >= 0)
2105 					(void)ttyoutput('\b', tp);
2106 				break;
2107 			default:			/* XXX */
2108 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2109 				(void)kprintf(PANICSTR, c, CCLASS(c));
2110 #ifdef notdef
2111 				panic(PANICSTR, c, CCLASS(c));
2112 #endif
2113 			}
2114 		}
2115 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2116 		if (!ISSET(tp->t_state, TS_ERASE)) {
2117 			SET(tp->t_state, TS_ERASE);
2118 			(void)ttyoutput('\\', tp);
2119 		}
2120 		ttyecho(c, tp);
2121 	} else {
2122 		ttyecho(tp->t_cc[VERASE], tp);
2123 		/*
2124 		 * This code may be executed not only when an ERASE key
2125 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2126 		 * So, I didn't think it was worthwhile to pass the extra
2127 		 * information (which would need an extra parameter,
2128 		 * changing every call) needed to distinguish the ERASE2
2129 		 * case from the ERASE.
2130 		 */
2131 	}
2132 	--tp->t_rocount;
2133 }
2134 
2135 /*
2136  * Back over cnt characters, erasing them.
2137  */
2138 static void
2139 ttyrubo(struct tty *tp, int cnt)
2140 {
2141 
2142 	while (cnt-- > 0) {
2143 		(void)ttyoutput('\b', tp);
2144 		(void)ttyoutput(' ', tp);
2145 		(void)ttyoutput('\b', tp);
2146 	}
2147 }
2148 
2149 /*
2150  * ttyretype --
2151  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2152  *	been checked.
2153  */
2154 static void
2155 ttyretype(struct tty *tp)
2156 {
2157 	char *cp;
2158 	int c;
2159 
2160 	/* Echo the reprint character. */
2161 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2162 		ttyecho(tp->t_cc[VREPRINT], tp);
2163 
2164 	(void)ttyoutput('\n', tp);
2165 
2166 	/*
2167 	 * XXX
2168 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2169 	 * BIT OF FIRST CHAR.
2170 	 */
2171 	crit_enter();
2172 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2173 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2174 		ttyecho(c, tp);
2175 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2176 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2177 		ttyecho(c, tp);
2178 	CLR(tp->t_state, TS_ERASE);
2179 	crit_exit();
2180 
2181 	tp->t_rocount = tp->t_rawq.c_cc;
2182 	tp->t_rocol = 0;
2183 }
2184 
2185 /*
2186  * Echo a typed character to the terminal.
2187  */
2188 static void
2189 ttyecho(int c, struct tty *tp)
2190 {
2191 
2192 	if (!ISSET(tp->t_state, TS_CNTTB))
2193 		CLR(tp->t_lflag, FLUSHO);
2194 	if ((!ISSET(tp->t_lflag, ECHO) &&
2195 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2196 	    ISSET(tp->t_lflag, EXTPROC))
2197 		return;
2198 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2199 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2200 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2201 		(void)ttyoutput('^', tp);
2202 		CLR(c, ~TTY_CHARMASK);
2203 		if (c == 0177)
2204 			c = '?';
2205 		else
2206 			c += 'A' - 1;
2207 	}
2208 	(void)ttyoutput(c, tp);
2209 }
2210 
2211 /*
2212  * Wake up any readers on a tty.
2213  */
2214 void
2215 ttwakeup(struct tty *tp)
2216 {
2217 
2218 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2219 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2220 	wakeup(TSA_HUP_OR_INPUT(tp));
2221 	KNOTE(&tp->t_rsel.si_note, 0);
2222 }
2223 
2224 /*
2225  * Wake up any writers on a tty.
2226  */
2227 void
2228 ttwwakeup(struct tty *tp)
2229 {
2230 
2231 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2232 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2233 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2234 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2235 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2236 		wakeup(TSA_OCOMPLETE(tp));
2237 	}
2238 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2239 	    tp->t_outq.c_cc <= tp->t_olowat) {
2240 		CLR(tp->t_state, TS_SO_OLOWAT);
2241 		wakeup(TSA_OLOWAT(tp));
2242 	}
2243 	KNOTE(&tp->t_wsel.si_note, 0);
2244 }
2245 
2246 /*
2247  * Look up a code for a specified speed in a conversion table;
2248  * used by drivers to map software speed values to hardware parameters.
2249  */
2250 int
2251 ttspeedtab(int speed, struct speedtab *table)
2252 {
2253 
2254 	for ( ; table->sp_speed != -1; table++)
2255 		if (table->sp_speed == speed)
2256 			return (table->sp_code);
2257 	return (-1);
2258 }
2259 
2260 /*
2261  * Set input and output watermarks and buffer sizes.  For input, the
2262  * high watermark is about one second's worth of input above empty, the
2263  * low watermark is slightly below high water, and the buffer size is a
2264  * driver-dependent amount above high water.  For output, the watermarks
2265  * are near the ends of the buffer, with about 1 second's worth of input
2266  * between them.  All this only applies to the standard line discipline.
2267  */
2268 void
2269 ttsetwater(struct tty *tp)
2270 {
2271 	int cps, ttmaxhiwat, x;
2272 
2273 	/* Input. */
2274 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2275 	switch (tp->t_ispeedwat) {
2276 	case (speed_t)-1:
2277 		cps = tp->t_ispeed / 10;
2278 		break;
2279 	case 0:
2280 		/*
2281 		 * This case is for old drivers that don't know about
2282 		 * t_ispeedwat.  Arrange for them to get the old buffer
2283 		 * sizes and watermarks.
2284 		 */
2285 		cps = TTYHOG - 2 * 256;
2286 		tp->t_ififosize = 2 * 2048;
2287 		break;
2288 	default:
2289 		cps = tp->t_ispeedwat / 10;
2290 		break;
2291 	}
2292 	tp->t_ihiwat = cps;
2293 	tp->t_ilowat = 7 * cps / 8;
2294 	x = cps + tp->t_ififosize;
2295 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2296 
2297 	/* Output. */
2298 	switch (tp->t_ospeedwat) {
2299 	case (speed_t)-1:
2300 		cps = tp->t_ospeed / 10;
2301 		ttmaxhiwat = 2 * TTMAXHIWAT;
2302 		break;
2303 	case 0:
2304 		cps = tp->t_ospeed / 10;
2305 		ttmaxhiwat = TTMAXHIWAT;
2306 		break;
2307 	default:
2308 		cps = tp->t_ospeedwat / 10;
2309 		ttmaxhiwat = 8 * TTMAXHIWAT;
2310 		break;
2311 	}
2312 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2313 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2314 	x += cps;
2315 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2316 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2317 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2318 	x += OBUFSIZ + 100;
2319 	clist_alloc_cblocks(&tp->t_outq, x, x);
2320 #undef	CLAMP
2321 }
2322 
2323 /*
2324  * Report on state of foreground process group.
2325  */
2326 void
2327 ttyinfo(struct tty *tp)
2328 {
2329 	struct proc *p, *pick;
2330 	struct lwp *lp;
2331 	struct rusage ru;
2332 	int tmp;
2333 
2334 	if (ttycheckoutq(tp,0) == 0)
2335 		return;
2336 
2337 	/*
2338 	 * We always print the load average, then figure out what else to
2339 	 * print based on the state of the current process group.
2340 	 */
2341 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2342 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2343 
2344 	if (tp->t_session == NULL) {
2345 		ttyprintf(tp, "not a controlling terminal\n");
2346 	} else if (tp->t_pgrp == NULL) {
2347 		ttyprintf(tp, "no foreground process group\n");
2348 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == 0) {
2349 		ttyprintf(tp, "empty foreground process group\n");
2350 	} else {
2351 		/*
2352 		 * Pick an interesting process.  Note that certain elements,
2353 		 * in particular the wmesg, require a critical section for
2354 		 * safe access (YYY and we are still not MP safe).
2355 		 *
2356 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2357 		 */
2358 		char buf[64];
2359 		const char *str;
2360 		long vmsz;
2361 		int pctcpu;
2362 
2363 		crit_enter();
2364 
2365 		/* XXX lwp should compare lwps */
2366 
2367 		for (pick = NULL; p != 0; p = LIST_NEXT(p, p_pglist)) {
2368 			if (proc_compare(pick, p))
2369 				pick = p;
2370 		}
2371 
2372 		/* XXX lwp */
2373 		lp = FIRST_LWP_IN_PROC(pick);
2374 		if (lp == NULL) {
2375 			ttyprintf(tp, "foreground process without lwp\n");
2376 			tp->t_rocount = 0;
2377 			crit_exit();
2378 			return;
2379 		}
2380 
2381 		/*
2382 		 * Figure out what wait/process-state message, and command
2383 		 * buffer to present
2384 		 */
2385 		/*
2386 		 * XXX lwp This is a horrible mixture.  We need to rework this
2387 		 * as soon as lwps have their own runnable status.
2388 		 */
2389 		if (pick->p_flag & P_WEXIT)
2390 			str = "exiting";
2391 		else if (lp->lwp_stat == LSRUN)
2392 			str = "running";
2393 		else if (pick->p_stat == SIDL)
2394 			str = "spawning";
2395 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2396 			str = lp->lwp_wmesg;
2397 		else
2398 			str = "iowait";
2399 
2400 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2401 			pick->p_comm, pick->p_pid, str);
2402 
2403 		/*
2404 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2405 		 * 'pick' becomes invalid the moment we exit the critical
2406 		 * section.
2407 		 */
2408 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0)
2409 			calcru_proc(pick, &ru);
2410 
2411 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2412 
2413 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2414 		    vmsz = 0;
2415 		else
2416 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2417 
2418 		crit_exit();
2419 
2420 		/*
2421 		 * Dump the output
2422 		 */
2423 		ttyprintf(tp, " %s ", buf);
2424 		ttyprintf(tp, "%ld.%02ldu ",
2425 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2426 		ttyprintf(tp, "%ld.%02lds ",
2427 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2428 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2429 	}
2430 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2431 }
2432 
2433 /*
2434  * Returns 1 if p2 is "better" than p1
2435  *
2436  * The algorithm for picking the "interesting" process is thus:
2437  *
2438  *	1) Only foreground processes are eligible - implied.
2439  *	2) Runnable processes are favored over anything else.  The runner
2440  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2441  *	   broken by picking the highest pid.
2442  *	3) The sleeper with the shortest sleep time is next.  With ties,
2443  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2444  *	4) Further ties are broken by picking the highest pid.
2445  */
2446 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2447 #define TESTAB(a, b)    ((a)<<1 | (b))
2448 #define ONLYA   2
2449 #define ONLYB   1
2450 #define BOTH    3
2451 
2452 static int
2453 proc_compare(struct proc *p1, struct proc *p2)
2454 {
2455 	struct lwp *lp1, *lp2;
2456 	if (p1 == NULL)
2457 		return (1);
2458 
2459 	/*
2460  	 * weed out zombies
2461 	 */
2462 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2463 	case ONLYA:
2464 		return (1);
2465 	case ONLYB:
2466 		return (0);
2467 	case BOTH:
2468 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2469 	}
2470 
2471 	/* XXX lwp */
2472 	lp1 = FIRST_LWP_IN_PROC(p1);
2473 	lp2 = FIRST_LWP_IN_PROC(p2);
2474 
2475 	/*
2476 	 * see if at least one of them is runnable
2477 	 */
2478 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2479 	case ONLYA:
2480 		return (0);
2481 	case ONLYB:
2482 		return (1);
2483 	case BOTH:
2484 		/*
2485 		 * tie - favor one with highest recent cpu utilization
2486 		 */
2487 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2488 			return (1);
2489 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2490 			return (0);
2491 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2492 	}
2493 	/*
2494 	 * pick the one with the smallest sleep time
2495 	 */
2496 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2497 		return (0);
2498 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2499 		return (1);
2500 	/*
2501 	 * favor one sleeping in a non-interruptible sleep
2502 	 */
2503 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2504 		return (1);
2505 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2506 		return (0);
2507 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2508 }
2509 
2510 /*
2511  * Output char to tty; console putchar style.
2512  */
2513 int
2514 tputchar(int c, struct tty *tp)
2515 {
2516 	crit_enter();
2517 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2518 		crit_exit();
2519 		return (-1);
2520 	}
2521 	if (c == '\n')
2522 		(void)ttyoutput('\r', tp);
2523 	(void)ttyoutput(c, tp);
2524 	ttstart(tp);
2525 	crit_exit();
2526 	return (0);
2527 }
2528 
2529 /*
2530  * Sleep on chan, returning ERESTART if tty changed while we napped and
2531  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2532  * the tty is revoked, restarting a pending call will redo validation done
2533  * at the start of the call.
2534  */
2535 int
2536 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2537 {
2538 	int error;
2539 	int gen;
2540 
2541 	gen = tp->t_gen;
2542 	error = tsleep(chan, slpflags, wmesg, timo);
2543 	if (error)
2544 		return (error);
2545 	return (tp->t_gen == gen ? 0 : ERESTART);
2546 }
2547 
2548 /*
2549  * Revoke a tty.
2550  *
2551  * We bump the gen to force any ttysleep()'s to return with ERESTART
2552  * and flush the tty.  The related fp's should already have been
2553  * replaced so the tty will close when the last references on the
2554  * original fp's go away.
2555  */
2556 int
2557 ttyrevoke(struct dev_revoke_args *ap)
2558 {
2559 	struct tty *tp;
2560 
2561 	tp = ap->a_head.a_dev->si_tty;
2562 	tp->t_gen++;
2563 	ttyflush(tp, FREAD | FWRITE);
2564 	wakeup(TSA_CARR_ON(tp));
2565 	ttwakeup(tp);
2566 	ttwwakeup(tp);
2567 	return (0);
2568 }
2569 
2570 /*
2571  * Allocate a tty struct.  Clists in the struct will be allocated by
2572  * ttyopen().
2573  */
2574 struct tty *
2575 ttymalloc(struct tty *tp)
2576 {
2577 
2578 	if (tp) {
2579 		return(tp);
2580 	}
2581 	tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2582 	ttyregister(tp);
2583         return (tp);
2584 }
2585 
2586 #if 0
2587 /*
2588  * Free a tty struct.  Clists in the struct should have been freed by
2589  * ttyclose().
2590  *
2591  * XXX not yet usable: since we support a half-closed state and do not
2592  * ref count the tty reference from the session, it is possible for a
2593  * session to hold a ref on the tty.  See TTY_DO_FULL_CLOSE.
2594  */
2595 void
2596 ttyfree(struct tty *tp)
2597 {
2598         kfree(tp, M_TTYS);
2599 }
2600 #endif /* 0 */
2601 
2602 void
2603 ttyregister(struct tty *tp)
2604 {
2605 	SLIST_INSERT_HEAD(&tty_list, tp, t_list);
2606 }
2607 
2608 static int
2609 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2610 {
2611 	int error;
2612 	struct tty *tp, t;
2613 	SLIST_FOREACH(tp, &tty_list, t_list) {
2614 		t = *tp;
2615 		if (t.t_dev)
2616 			t.t_dev = (cdev_t)(uintptr_t)dev2udev(t.t_dev);
2617 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2618 		if (error)
2619 			return (error);
2620 	}
2621 	return (0);
2622 }
2623 
2624 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2625 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2626 
2627 void
2628 nottystop(struct tty *tp, int rw)
2629 {
2630 
2631 	return;
2632 }
2633 
2634 int
2635 ttyread(struct dev_read_args *ap)
2636 {
2637 	struct tty *tp;
2638 
2639 	tp = ap->a_head.a_dev->si_tty;
2640 	if (tp == NULL)
2641 		return (ENODEV);
2642 	return ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2643 }
2644 
2645 int
2646 ttywrite(struct dev_write_args *ap)
2647 {
2648 	struct tty *tp;
2649 
2650 	tp = ap->a_head.a_dev->si_tty;
2651 	if (tp == NULL)
2652 		return (ENODEV);
2653 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2654 }
2655