xref: /dflybsd-src/sys/kern/tty.c (revision cd29885abfb8f68adb0c082e313b891156d66964)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
39  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
40  * $DragonFly: src/sys/kern/tty.c,v 1.46 2008/09/10 09:50:09 y0netan1 Exp $
41  */
42 
43 /*-
44  * TODO:
45  *	o Fix races for sending the start char in ttyflush().
46  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
47  *	  With luck, there will be MIN chars before select() returns().
48  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
49  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
50  *	  FIONREAD.
51  *	o Do the new sio locking stuff here and use it to avoid special
52  *	  case for EXTPROC?
53  *	o Lock PENDIN too?
54  *	o Move EXTPROC and/or PENDIN to t_state?
55  *	o Wrap most of ttioctl in spltty/splx.
56  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
57  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
58  *	o Don't allow certain termios flags to affect disciplines other
59  *	  than TTYDISC.  Cancel their effects before switch disciplines
60  *	  and ignore them if they are set while we are in another
61  *	  discipline.
62  *	o Now that historical speed conversions are handled here, don't
63  *	  do them in drivers.
64  *	o Check for TS_CARR_ON being set while everything is closed and not
65  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
66  *	  so it would live until the next open even if carrier drops.
67  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
68  *	  only when _all_ openers leave open().
69  */
70 
71 #include "opt_compat.h"
72 #include "opt_uconsole.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/filio.h>
77 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
78 #include <sys/ioctl_compat.h>
79 #endif
80 #include <sys/proc.h>
81 #include <sys/priv.h>
82 #define	TTYDEFCHARS
83 #include <sys/tty.h>
84 #include <sys/clist.h>
85 #undef	TTYDEFCHARS
86 #include <sys/fcntl.h>
87 #include <sys/conf.h>
88 #include <sys/dkstat.h>
89 #include <sys/poll.h>
90 #include <sys/kernel.h>
91 #include <sys/vnode.h>
92 #include <sys/signalvar.h>
93 #include <sys/signal2.h>
94 #include <sys/resourcevar.h>
95 #include <sys/malloc.h>
96 #include <sys/filedesc.h>
97 #include <sys/sysctl.h>
98 #include <sys/thread2.h>
99 
100 #include <vm/vm.h>
101 #include <sys/lock.h>
102 #include <vm/pmap.h>
103 #include <vm/vm_map.h>
104 
105 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
106 
107 static int	proc_compare (struct proc *p1, struct proc *p2);
108 static int	ttnread (struct tty *tp);
109 static void	ttyecho (int c, struct tty *tp);
110 static int	ttyoutput (int c, struct tty *tp);
111 static void	ttypend (struct tty *tp);
112 static void	ttyretype (struct tty *tp);
113 static void	ttyrub (int c, struct tty *tp);
114 static void	ttyrubo (struct tty *tp, int cnt);
115 static void	ttyunblock (struct tty *tp);
116 static int	ttywflush (struct tty *tp);
117 static int	filt_ttyread (struct knote *kn, long hint);
118 static void 	filt_ttyrdetach (struct knote *kn);
119 static int	filt_ttywrite (struct knote *kn, long hint);
120 static void 	filt_ttywdetach (struct knote *kn);
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 static u_char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 /* Macros to clear/set/test flags. */
196 #define	SET(t, f)	(t) |= (f)
197 #define	CLR(t, f)	(t) &= ~(f)
198 #define	ISSET(t, f)	((t) & (f))
199 
200 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
201 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
202 
203 uint64_t tk_nin;
204 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
205     "LU", "TTY input statistic");
206 uint64_t tk_nout;
207 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
208     "LU", "TTY output statistic");
209 uint64_t tk_rawcc;
210 
211 /*
212  * list of struct tty where pstat(8) can pick it up with sysctl
213  */
214 static SLIST_HEAD(, tty) tty_list;
215 
216 /*
217  * Initial open of tty, or (re)entry to standard tty line discipline.
218  */
219 int
220 ttyopen(cdev_t device, struct tty *tp)
221 {
222 	crit_enter();
223 	tp->t_dev = device;
224 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
225 		SET(tp->t_state, TS_ISOPEN);
226 		if (ISSET(tp->t_cflag, CLOCAL)) {
227 			SET(tp->t_state, TS_CONNECTED);
228 		}
229 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
230 	}
231 	ttsetwater(tp);
232 	crit_exit();
233 	return (0);
234 }
235 
236 /*
237  * Handle close() on a tty line: flush and set to initial state,
238  * bumping generation number so that pending read/write calls
239  * can detect recycling of the tty.
240  *
241  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
242  * and l_close() should have flushed, but we repeat the spltty() and
243  * the flush in case there are buggy callers.
244  */
245 int
246 ttyclose(struct tty *tp)
247 {
248 	funsetown(tp->t_sigio);
249 	crit_enter();
250 	if (constty == tp)
251 		constty = NULL;
252 
253 	ttyflush(tp, FREAD | FWRITE);
254 	clist_free_cblocks(&tp->t_canq);
255 	clist_free_cblocks(&tp->t_outq);
256 	clist_free_cblocks(&tp->t_rawq);
257 
258 	tp->t_gen++;
259 	tp->t_line = TTYDISC;
260 	ttyclearsession(tp);
261 	tp->t_state = 0;
262 	crit_exit();
263 	return (0);
264 }
265 
266 /*
267  * Disassociate the tty from its session.  Traditionally this has only been
268  * a half-close, meaning that the session was still allowed to point at the
269  * tty (resulting in the tty in the ps command showing something like 'p0-'),
270  * even though the tty is no longer pointing at the session.
271  *
272  * The half close seems to be useful only for 'ps' output but there is as
273  * yet no reason to remove the feature.  The full-close code is currently
274  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
275  */
276 void
277 ttyclearsession(struct tty *tp)
278 {
279 	struct session *sp;
280 
281 	tp->t_pgrp = NULL;
282 	if ((sp = tp->t_session) != NULL) {
283 		tp->t_session = NULL;
284 #ifdef TTY_DO_FULL_CLOSE
285 		/* FULL CLOSE (not yet) */
286 		if (sp->s_ttyp == tp) {
287 			sp->s_ttyp = NULL;
288 		} else {
289 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
290 				"%p/%p\n", sp->s_ttyp, tp);
291 		}
292 #endif
293 	}
294 }
295 
296 /*
297  * Release the tty vnode association for a session.  This is the
298  * 'other half' of the close.  Because multiple opens of /dev/tty
299  * only generate a single open to the actual tty, the file modes
300  * are locked to FREAD|FWRITE.
301  *
302  * If dorevoke is non-zero, the session is also revoked.  We have to
303  * close the vnode if VCTTYISOPEN is set.
304  */
305 void
306 ttyclosesession(struct session *sp, int dorevoke)
307 {
308 	struct vnode *vp;
309 
310 retry:
311 	/*
312 	 * There may not be a controlling terminal or it may have been closed
313 	 * out from under us.
314 	 */
315 	if ((vp = sp->s_ttyvp) == NULL)
316 		return;
317 
318 	/*
319 	 * We need a lock if we have to close or revoke.
320 	 */
321 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
322 		vhold(vp);
323 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
324 			vdrop(vp);
325 			goto retry;
326 		}
327 
328 		/*
329 		 * Retry if the vnode was ripped out from under us
330 		 */
331 		if (vp != sp->s_ttyvp) {
332 			vn_unlock(vp);
333 			vdrop(vp);
334 			goto retry;
335 		}
336 
337 		/*
338 		 * Close and revoke as needed
339 		 */
340 		sp->s_ttyvp = NULL;
341 		if (vp->v_flag & VCTTYISOPEN) {
342 			vclrflags(vp, VCTTYISOPEN);
343 			VOP_CLOSE(vp, FREAD|FWRITE);
344 		}
345 		vn_unlock(vp);
346 		if (dorevoke)
347 			vrevoke(vp, proc0.p_ucred);
348 		vdrop(vp);
349 	} else {
350 		sp->s_ttyvp = NULL;
351 	}
352 	vrele(vp);
353 }
354 
355 #define	FLUSHQ(q) {							\
356 	if ((q)->c_cc)							\
357 		ndflush(q, (q)->c_cc);					\
358 }
359 
360 /* Is 'c' a line delimiter ("break" character)? */
361 #define	TTBREAKC(c, lflag)							\
362 	((c) == '\n' || (((c) == cc[VEOF] ||				\
363 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
364 	 (c) != _POSIX_VDISABLE))
365 
366 /*
367  * Process input of a single character received on a tty.
368  */
369 int
370 ttyinput(int c, struct tty *tp)
371 {
372 	tcflag_t iflag, lflag;
373 	cc_t *cc;
374 	int i, err;
375 
376 	/*
377 	 * If input is pending take it first.
378 	 */
379 	lflag = tp->t_lflag;
380 	if (ISSET(lflag, PENDIN))
381 		ttypend(tp);
382 	/*
383 	 * Gather stats.
384 	 */
385 	if (ISSET(lflag, ICANON))
386 		++tp->t_cancc;
387 	else
388 		++tp->t_rawcc;
389 	++tk_nin;
390 
391 	/*
392 	 * Block further input iff:
393 	 * current input > threshold AND input is available to user program
394 	 * AND input flow control is enabled and not yet invoked.
395 	 * The 3 is slop for PARMRK.
396 	 */
397 	iflag = tp->t_iflag;
398 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
399 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
400 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
401 	    !ISSET(tp->t_state, TS_TBLOCK))
402 		ttyblock(tp);
403 
404 	/* Handle exceptional conditions (break, parity, framing). */
405 	cc = tp->t_cc;
406 	err = (ISSET(c, TTY_ERRORMASK));
407 	if (err) {
408 		CLR(c, TTY_ERRORMASK);
409 		if (ISSET(err, TTY_BI)) {
410 			if (ISSET(iflag, IGNBRK))
411 				return (0);
412 			if (ISSET(iflag, BRKINT)) {
413 				ttyflush(tp, FREAD | FWRITE);
414 				pgsignal(tp->t_pgrp, SIGINT, 1);
415 				goto endcase;
416 			}
417 			if (ISSET(iflag, PARMRK))
418 				goto parmrk;
419 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
420 			|| ISSET(err, TTY_FE)) {
421 			if (ISSET(iflag, IGNPAR))
422 				return (0);
423 			else if (ISSET(iflag, PARMRK)) {
424 parmrk:
425 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
426 				    MAX_INPUT - 3)
427 					goto input_overflow;
428 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
429 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
430 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
431 				goto endcase;
432 			} else
433 				c = 0;
434 		}
435 	}
436 
437 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
438 		CLR(c, 0x80);
439 	if (!ISSET(lflag, EXTPROC)) {
440 		/*
441 		 * Check for literal nexting very first
442 		 */
443 		if (ISSET(tp->t_state, TS_LNCH)) {
444 			SET(c, TTY_QUOTE);
445 			CLR(tp->t_state, TS_LNCH);
446 		}
447 		/*
448 		 * Scan for special characters.  This code
449 		 * is really just a big case statement with
450 		 * non-constant cases.  The bottom of the
451 		 * case statement is labeled ``endcase'', so goto
452 		 * it after a case match, or similar.
453 		 */
454 
455 		/*
456 		 * Control chars which aren't controlled
457 		 * by ICANON, ISIG, or IXON.
458 		 */
459 		if (ISSET(lflag, IEXTEN)) {
460 			if (CCEQ(cc[VLNEXT], c)) {
461 				if (ISSET(lflag, ECHO)) {
462 					if (ISSET(lflag, ECHOE)) {
463 						(void)ttyoutput('^', tp);
464 						(void)ttyoutput('\b', tp);
465 					} else
466 						ttyecho(c, tp);
467 				}
468 				SET(tp->t_state, TS_LNCH);
469 				goto endcase;
470 			}
471 			if (CCEQ(cc[VDISCARD], c)) {
472 				if (ISSET(lflag, FLUSHO))
473 					CLR(tp->t_lflag, FLUSHO);
474 				else {
475 					ttyflush(tp, FWRITE);
476 					ttyecho(c, tp);
477 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
478 						ttyretype(tp);
479 					SET(tp->t_lflag, FLUSHO);
480 				}
481 				goto startoutput;
482 			}
483 		}
484 		/*
485 		 * Signals.
486 		 */
487 		if (ISSET(lflag, ISIG)) {
488 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
489 				if (!ISSET(lflag, NOFLSH))
490 					ttyflush(tp, FREAD | FWRITE);
491 				ttyecho(c, tp);
492 				pgsignal(tp->t_pgrp,
493 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
494 				goto endcase;
495 			}
496 			if (CCEQ(cc[VSUSP], c)) {
497 				if (!ISSET(lflag, NOFLSH))
498 					ttyflush(tp, FREAD);
499 				ttyecho(c, tp);
500 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
501 				goto endcase;
502 			}
503 		}
504 		/*
505 		 * Handle start/stop characters.
506 		 */
507 		if (ISSET(iflag, IXON)) {
508 			if (CCEQ(cc[VSTOP], c)) {
509 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
510 					SET(tp->t_state, TS_TTSTOP);
511 					(*tp->t_stop)(tp, 0);
512 					return (0);
513 				}
514 				if (!CCEQ(cc[VSTART], c))
515 					return (0);
516 				/*
517 				 * if VSTART == VSTOP then toggle
518 				 */
519 				goto endcase;
520 			}
521 			if (CCEQ(cc[VSTART], c))
522 				goto restartoutput;
523 		}
524 		/*
525 		 * IGNCR, ICRNL, & INLCR
526 		 */
527 		if (c == '\r') {
528 			if (ISSET(iflag, IGNCR))
529 				return (0);
530 			else if (ISSET(iflag, ICRNL))
531 				c = '\n';
532 		} else if (c == '\n' && ISSET(iflag, INLCR))
533 			c = '\r';
534 	}
535 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
536 		/*
537 		 * From here on down canonical mode character
538 		 * processing takes place.
539 		 */
540 		/*
541 		 * erase or erase2 (^H / ^?)
542 		 */
543 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
544 			if (tp->t_rawq.c_cc)
545 				ttyrub(clist_unputc(&tp->t_rawq), tp);
546 			goto endcase;
547 		}
548 		/*
549 		 * kill (^U)
550 		 */
551 		if (CCEQ(cc[VKILL], c)) {
552 			if (ISSET(lflag, ECHOKE) &&
553 			    tp->t_rawq.c_cc == tp->t_rocount &&
554 			    !ISSET(lflag, ECHOPRT))
555 				while (tp->t_rawq.c_cc)
556 					ttyrub(clist_unputc(&tp->t_rawq), tp);
557 			else {
558 				ttyecho(c, tp);
559 				if (ISSET(lflag, ECHOK) ||
560 				    ISSET(lflag, ECHOKE))
561 					ttyecho('\n', tp);
562 				FLUSHQ(&tp->t_rawq);
563 				tp->t_rocount = 0;
564 			}
565 			CLR(tp->t_state, TS_LOCAL);
566 			goto endcase;
567 		}
568 		/*
569 		 * word erase (^W)
570 		 */
571 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
572 			int ctype;
573 
574 			/*
575 			 * erase whitespace
576 			 */
577 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
578 				ttyrub(c, tp);
579 			if (c == -1)
580 				goto endcase;
581 			/*
582 			 * erase last char of word and remember the
583 			 * next chars type (for ALTWERASE)
584 			 */
585 			ttyrub(c, tp);
586 			c = clist_unputc(&tp->t_rawq);
587 			if (c == -1)
588 				goto endcase;
589 			if (c == ' ' || c == '\t') {
590 				clist_putc(c, &tp->t_rawq);
591 				goto endcase;
592 			}
593 			ctype = ISALPHA(c);
594 			/*
595 			 * erase rest of word
596 			 */
597 			do {
598 				ttyrub(c, tp);
599 				c = clist_unputc(&tp->t_rawq);
600 				if (c == -1)
601 					goto endcase;
602 			} while (c != ' ' && c != '\t' &&
603 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
604 			clist_putc(c, &tp->t_rawq);
605 			goto endcase;
606 		}
607 		/*
608 		 * reprint line (^R)
609 		 */
610 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
611 			ttyretype(tp);
612 			goto endcase;
613 		}
614 		/*
615 		 * ^T - kernel info and generate SIGINFO
616 		 */
617 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
618 			if (ISSET(lflag, ISIG))
619 				pgsignal(tp->t_pgrp, SIGINFO, 1);
620 			if (!ISSET(lflag, NOKERNINFO))
621 				ttyinfo(tp);
622 			goto endcase;
623 		}
624 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
625 			if (ISSET(lflag, ISIG))
626 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
627 			goto endcase;
628 		}
629 	}
630 	/*
631 	 * Check for input buffer overflow
632 	 */
633 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
634 input_overflow:
635 		if (ISSET(iflag, IMAXBEL)) {
636 			if (tp->t_outq.c_cc < tp->t_ohiwat)
637 				(void)ttyoutput(CTRL('g'), tp);
638 		}
639 		goto endcase;
640 	}
641 
642 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
643 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
644 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
645 
646 	/*
647 	 * Put data char in q for user and
648 	 * wakeup on seeing a line delimiter.
649 	 */
650 	if (clist_putc(c, &tp->t_rawq) >= 0) {
651 		if (!ISSET(lflag, ICANON)) {
652 			ttwakeup(tp);
653 			ttyecho(c, tp);
654 			goto endcase;
655 		}
656 		if (TTBREAKC(c, lflag)) {
657 			tp->t_rocount = 0;
658 			catq(&tp->t_rawq, &tp->t_canq);
659 			ttwakeup(tp);
660 		} else if (tp->t_rocount++ == 0)
661 			tp->t_rocol = tp->t_column;
662 		if (ISSET(tp->t_state, TS_ERASE)) {
663 			/*
664 			 * end of prterase \.../
665 			 */
666 			CLR(tp->t_state, TS_ERASE);
667 			(void)ttyoutput('/', tp);
668 		}
669 		i = tp->t_column;
670 		ttyecho(c, tp);
671 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
672 			/*
673 			 * Place the cursor over the '^' of the ^D.
674 			 */
675 			i = imin(2, tp->t_column - i);
676 			while (i > 0) {
677 				(void)ttyoutput('\b', tp);
678 				i--;
679 			}
680 		}
681 	}
682 endcase:
683 	/*
684 	 * IXANY means allow any character to restart output.
685 	 */
686 	if (ISSET(tp->t_state, TS_TTSTOP) &&
687 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
688 		return (0);
689 restartoutput:
690 	CLR(tp->t_lflag, FLUSHO);
691 	CLR(tp->t_state, TS_TTSTOP);
692 startoutput:
693 	return (ttstart(tp));
694 }
695 
696 /*
697  * Output a single character on a tty, doing output processing
698  * as needed (expanding tabs, newline processing, etc.).
699  * Returns < 0 if succeeds, otherwise returns char to resend.
700  * Must be recursive.
701  */
702 static int
703 ttyoutput(int c, struct tty *tp)
704 {
705 	tcflag_t oflag;
706 	int col;
707 
708 	oflag = tp->t_oflag;
709 	if (!ISSET(oflag, OPOST)) {
710 		if (ISSET(tp->t_lflag, FLUSHO))
711 			return (-1);
712 		if (clist_putc(c, &tp->t_outq))
713 			return (c);
714 		tk_nout++;
715 		tp->t_outcc++;
716 		return (-1);
717 	}
718 	/*
719 	 * Do tab expansion if OXTABS is set.  Special case if we external
720 	 * processing, we don't do the tab expansion because we'll probably
721 	 * get it wrong.  If tab expansion needs to be done, let it happen
722 	 * externally.
723 	 */
724 	CLR(c, ~TTY_CHARMASK);
725 	if (c == '\t' &&
726 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
727 		c = 8 - (tp->t_column & 7);
728 		if (!ISSET(tp->t_lflag, FLUSHO)) {
729 			crit_enter();		/* Don't interrupt tabs. */
730 			c -= b_to_q("        ", c, &tp->t_outq);
731 			tk_nout += c;
732 			tp->t_outcc += c;
733 			crit_exit();
734 		}
735 		tp->t_column += c;
736 		return (c ? -1 : '\t');
737 	}
738 	if (c == CEOT && ISSET(oflag, ONOEOT))
739 		return (-1);
740 
741 	/*
742 	 * Newline translation: if ONLCR is set,
743 	 * translate newline into "\r\n".
744 	 */
745 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
746 		tk_nout++;
747 		tp->t_outcc++;
748 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq))
749 			return (c);
750 	}
751 	/* If OCRNL is set, translate "\r" into "\n". */
752 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
753 		c = '\n';
754 	/* If ONOCR is set, don't transmit CRs when on column 0. */
755 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
756 		return (-1);
757 
758 	tk_nout++;
759 	tp->t_outcc++;
760 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq))
761 		return (c);
762 
763 	col = tp->t_column;
764 	switch (CCLASS(c)) {
765 	case BACKSPACE:
766 		if (col > 0)
767 			--col;
768 		break;
769 	case CONTROL:
770 		break;
771 	case NEWLINE:
772 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
773 			col = 0;
774 		break;
775 	case RETURN:
776 		col = 0;
777 		break;
778 	case ORDINARY:
779 		++col;
780 		break;
781 	case TAB:
782 		col = (col + 8) & ~7;
783 		break;
784 	}
785 	tp->t_column = col;
786 	return (-1);
787 }
788 
789 /*
790  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
791  * has been called to do discipline-specific functions and/or reject any
792  * of these ioctl commands.
793  */
794 /* ARGSUSED */
795 int
796 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
797 {
798 	struct thread *td = curthread;
799 	struct lwp *lp = td->td_lwp;
800 	struct proc *p = td->td_proc;
801 	int error;
802 
803 	KKASSERT(p);
804 
805 	/* If the ioctl involves modification, hang if in the background. */
806 	switch (cmd) {
807 	case  TIOCCBRK:
808 	case  TIOCCONS:
809 	case  TIOCDRAIN:
810 	case  TIOCEXCL:
811 	case  TIOCFLUSH:
812 #ifdef TIOCHPCL
813 	case  TIOCHPCL:
814 #endif
815 	case  TIOCNXCL:
816 	case  TIOCSBRK:
817 	case  TIOCSCTTY:
818 	case  TIOCSDRAINWAIT:
819 	case  TIOCSETA:
820 	case  TIOCSETAF:
821 	case  TIOCSETAW:
822 	case  TIOCSETD:
823 	case  TIOCSPGRP:
824 	case  TIOCSTART:
825 	case  TIOCSTAT:
826 	case  TIOCSTI:
827 	case  TIOCSTOP:
828 	case  TIOCSWINSZ:
829 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
830 	case  TIOCLBIC:
831 	case  TIOCLBIS:
832 	case  TIOCLSET:
833 	case  TIOCSETC:
834 	case OTIOCSETD:
835 	case  TIOCSETN:
836 	case  TIOCSETP:
837 	case  TIOCSLTC:
838 #endif
839 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
840 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
841 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
842 			if (p->p_pgrp->pg_jobc == 0)
843 				return (EIO);
844 			pgsignal(p->p_pgrp, SIGTTOU, 1);
845 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
846 					 0);
847 			if (error)
848 				return (error);
849 		}
850 		break;
851 	}
852 
853 	switch (cmd) {			/* Process the ioctl. */
854 	case FIOASYNC:			/* set/clear async i/o */
855 		crit_enter();
856 		if (*(int *)data)
857 			SET(tp->t_state, TS_ASYNC);
858 		else
859 			CLR(tp->t_state, TS_ASYNC);
860 		crit_exit();
861 		break;
862 	case FIONREAD:			/* get # bytes to read */
863 		crit_enter();
864 		*(int *)data = ttnread(tp);
865 		crit_exit();
866 		break;
867 
868 	case FIOSETOWN:
869 		/*
870 		 * Policy -- Don't allow FIOSETOWN on someone else's
871 		 *           controlling tty
872 		 */
873 		if (tp->t_session != NULL && !isctty(p, tp))
874 			return (ENOTTY);
875 
876 		error = fsetown(*(int *)data, &tp->t_sigio);
877 		if (error)
878 			return (error);
879 		break;
880 	case FIOGETOWN:
881 		if (tp->t_session != NULL && !isctty(p, tp))
882 			return (ENOTTY);
883 		*(int *)data = fgetown(tp->t_sigio);
884 		break;
885 
886 	case TIOCEXCL:			/* set exclusive use of tty */
887 		crit_enter();
888 		SET(tp->t_state, TS_XCLUDE);
889 		crit_exit();
890 		break;
891 	case TIOCFLUSH: {		/* flush buffers */
892 		int flags = *(int *)data;
893 
894 		if (flags == 0)
895 			flags = FREAD | FWRITE;
896 		else
897 			flags &= FREAD | FWRITE;
898 		ttyflush(tp, flags);
899 		break;
900 	}
901 	case TIOCCONS:			/* become virtual console */
902 		if (*(int *)data) {
903 			if (constty && constty != tp &&
904 			    ISSET(constty->t_state, TS_CONNECTED))
905 				return (EBUSY);
906 #ifndef	UCONSOLE
907 			if ((error = priv_check(td, PRIV_ROOT)) != 0)
908 				return (error);
909 #endif
910 			constty = tp;
911 		} else if (tp == constty)
912 			constty = NULL;
913 		break;
914 	case TIOCDRAIN:			/* wait till output drained */
915 		error = ttywait(tp);
916 		if (error)
917 			return (error);
918 		break;
919 	case TIOCGETA: {		/* get termios struct */
920 		struct termios *t = (struct termios *)data;
921 
922 		bcopy(&tp->t_termios, t, sizeof(struct termios));
923 		break;
924 	}
925 	case TIOCGETD:			/* get line discipline */
926 		*(int *)data = tp->t_line;
927 		break;
928 	case TIOCGWINSZ:		/* get window size */
929 		*(struct winsize *)data = tp->t_winsize;
930 		break;
931 	case TIOCGPGRP:			/* get pgrp of tty */
932 		if (!isctty(p, tp))
933 			return (ENOTTY);
934 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
935 		break;
936 	case TIOCGSID:                  /* get sid of tty */
937 		if (!isctty(p, tp))
938 			return (ENOTTY);
939 		*(int *)data = tp->t_session->s_sid;
940 		break;
941 #ifdef TIOCHPCL
942 	case TIOCHPCL:			/* hang up on last close */
943 		crit_enter();
944 		SET(tp->t_cflag, HUPCL);
945 		crit_exit();
946 		break;
947 #endif
948 	case TIOCNXCL:			/* reset exclusive use of tty */
949 		crit_enter();
950 		CLR(tp->t_state, TS_XCLUDE);
951 		crit_exit();
952 		break;
953 	case TIOCOUTQ:			/* output queue size */
954 		*(int *)data = tp->t_outq.c_cc;
955 		break;
956 	case TIOCSETA:			/* set termios struct */
957 	case TIOCSETAW:			/* drain output, set */
958 	case TIOCSETAF: {		/* drn out, fls in, set */
959 		struct termios *t = (struct termios *)data;
960 
961 		if (t->c_ispeed == 0)
962 			t->c_ispeed = t->c_ospeed;
963 		if (t->c_ispeed == 0)
964 			t->c_ispeed = tp->t_ospeed;
965 		if (t->c_ispeed == 0)
966 			return (EINVAL);
967 		crit_enter();
968 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
969 			error = ttywait(tp);
970 			if (error) {
971 				crit_exit();
972 				return (error);
973 			}
974 			if (cmd == TIOCSETAF)
975 				ttyflush(tp, FREAD);
976 		}
977 		if (!ISSET(t->c_cflag, CIGNORE)) {
978 			/*
979 			 * Set device hardware.
980 			 */
981 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
982 				crit_exit();
983 				return (error);
984 			}
985 			if (ISSET(t->c_cflag, CLOCAL) &&
986 			    !ISSET(tp->t_cflag, CLOCAL)) {
987 				/*
988 				 * XXX disconnections would be too hard to
989 				 * get rid of without this kludge.  The only
990 				 * way to get rid of controlling terminals
991 				 * is to exit from the session leader.
992 				 */
993 				CLR(tp->t_state, TS_ZOMBIE);
994 
995 				wakeup(TSA_CARR_ON(tp));
996 				ttwakeup(tp);
997 				ttwwakeup(tp);
998 			}
999 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1000 			     ISSET(t->c_cflag, CLOCAL)) &&
1001 			    !ISSET(tp->t_state, TS_ZOMBIE))
1002 				SET(tp->t_state, TS_CONNECTED);
1003 			else
1004 				CLR(tp->t_state, TS_CONNECTED);
1005 			tp->t_cflag = t->c_cflag;
1006 			tp->t_ispeed = t->c_ispeed;
1007 			if (t->c_ospeed != 0)
1008 				tp->t_ospeed = t->c_ospeed;
1009 			ttsetwater(tp);
1010 		}
1011 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1012 		    cmd != TIOCSETAF) {
1013 			if (ISSET(t->c_lflag, ICANON))
1014 				SET(tp->t_lflag, PENDIN);
1015 			else {
1016 				/*
1017 				 * XXX we really shouldn't allow toggling
1018 				 * ICANON while we're in a non-termios line
1019 				 * discipline.  Now we have to worry about
1020 				 * panicing for a null queue.
1021 				 */
1022 				if (tp->t_canq.c_cbreserved > 0 &&
1023 				    tp->t_rawq.c_cbreserved > 0) {
1024 					catq(&tp->t_rawq, &tp->t_canq);
1025 					/*
1026 					 * XXX the queue limits may be
1027 					 * different, so the old queue
1028 					 * swapping method no longer works.
1029 					 */
1030 					catq(&tp->t_canq, &tp->t_rawq);
1031 				}
1032 				CLR(tp->t_lflag, PENDIN);
1033 			}
1034 			ttwakeup(tp);
1035 		}
1036 		tp->t_iflag = t->c_iflag;
1037 		tp->t_oflag = t->c_oflag;
1038 		/*
1039 		 * Make the EXTPROC bit read only.
1040 		 */
1041 		if (ISSET(tp->t_lflag, EXTPROC))
1042 			SET(t->c_lflag, EXTPROC);
1043 		else
1044 			CLR(t->c_lflag, EXTPROC);
1045 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1046 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1047 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1048 			ttwakeup(tp);
1049 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1050 		crit_exit();
1051 		break;
1052 	}
1053 	case TIOCSETD: {		/* set line discipline */
1054 		int t = *(int *)data;
1055 		cdev_t device = tp->t_dev;
1056 
1057 		if ((u_int)t >= nlinesw)
1058 			return (ENXIO);
1059 		if (t != tp->t_line) {
1060 			crit_enter();
1061 			(*linesw[tp->t_line].l_close)(tp, flag);
1062 			error = (*linesw[t].l_open)(device, tp);
1063 			if (error) {
1064 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1065 				crit_exit();
1066 				return (error);
1067 			}
1068 			tp->t_line = t;
1069 			crit_exit();
1070 		}
1071 		break;
1072 	}
1073 	case TIOCSTART:			/* start output, like ^Q */
1074 		crit_enter();
1075 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1076 		    ISSET(tp->t_lflag, FLUSHO)) {
1077 			CLR(tp->t_lflag, FLUSHO);
1078 			CLR(tp->t_state, TS_TTSTOP);
1079 			ttstart(tp);
1080 		}
1081 		crit_exit();
1082 		break;
1083 	case TIOCSTI:			/* simulate terminal input */
1084 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT))
1085 			return (EPERM);
1086 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT))
1087 			return (EACCES);
1088 		crit_enter();
1089 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1090 		crit_exit();
1091 		break;
1092 	case TIOCSTOP:			/* stop output, like ^S */
1093 		crit_enter();
1094 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1095 			SET(tp->t_state, TS_TTSTOP);
1096 			(*tp->t_stop)(tp, 0);
1097 		}
1098 		crit_exit();
1099 		break;
1100 	case TIOCSCTTY:			/* become controlling tty */
1101 		/* Session ctty vnode pointer set in vnode layer. */
1102 		if (!SESS_LEADER(p) ||
1103 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1104 		    (tp->t_session != p->p_session)))
1105 			return (EPERM);
1106 		tp->t_session = p->p_session;
1107 		tp->t_pgrp = p->p_pgrp;
1108 		p->p_session->s_ttyp = tp;
1109 		p->p_flag |= P_CONTROLT;
1110 		break;
1111 	case TIOCSPGRP: {		/* set pgrp of tty */
1112 		pid_t pgid = *(int *)data;
1113 
1114 		if (!isctty(p, tp))
1115 			return (ENOTTY);
1116 		else if (pgid < 1 || pgid > PID_MAX)
1117 			return (EINVAL);
1118 		else {
1119 			struct pgrp *pgrp = pgfind(pgid);
1120 			if (pgrp == NULL || pgrp->pg_session != p->p_session)
1121 				return (EPERM);
1122 
1123 			tp->t_pgrp = pgrp;
1124 		}
1125 		break;
1126 	}
1127 	case TIOCSTAT:			/* simulate control-T */
1128 		crit_enter();
1129 		ttyinfo(tp);
1130 		crit_exit();
1131 		break;
1132 	case TIOCSWINSZ:		/* set window size */
1133 		if (bcmp((caddr_t)&tp->t_winsize, data,
1134 		    sizeof (struct winsize))) {
1135 			tp->t_winsize = *(struct winsize *)data;
1136 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1137 		}
1138 		break;
1139 	case TIOCSDRAINWAIT:
1140 		error = priv_check(td, PRIV_ROOT);
1141 		if (error)
1142 			return (error);
1143 		tp->t_timeout = *(int *)data * hz;
1144 		wakeup(TSA_OCOMPLETE(tp));
1145 		wakeup(TSA_OLOWAT(tp));
1146 		break;
1147 	case TIOCGDRAINWAIT:
1148 		*(int *)data = tp->t_timeout / hz;
1149 		break;
1150 	default:
1151 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1152 		return (ttcompat(tp, cmd, data, flag));
1153 #else
1154 		return (ENOIOCTL);
1155 #endif
1156 	}
1157 	return (0);
1158 }
1159 
1160 int
1161 ttypoll(struct dev_poll_args *ap)
1162 {
1163 	cdev_t dev = ap->a_head.a_dev;
1164 	int events = ap->a_events;
1165 	int revents = 0;
1166 	struct tty *tp;
1167 
1168 	tp = dev->si_tty;
1169 	/* XXX used to return ENXIO, but that means true! */
1170 	if (tp == NULL) {
1171 		ap->a_events = (events & (POLLIN | POLLOUT | POLLRDNORM |
1172 				POLLWRNORM)) | POLLHUP;
1173 		return(0);
1174 	}
1175 
1176 	crit_enter();
1177 	if (events & (POLLIN | POLLRDNORM)) {
1178 		if (ttnread(tp) > 0 || ISSET(tp->t_state, TS_ZOMBIE))
1179 			revents |= events & (POLLIN | POLLRDNORM);
1180 		else
1181 			selrecord(curthread, &tp->t_rsel);
1182 	}
1183 	if (events & (POLLOUT | POLLWRNORM)) {
1184 		if ((tp->t_outq.c_cc <= tp->t_olowat &&
1185 		     ISSET(tp->t_state, TS_CONNECTED))
1186 		    || ISSET(tp->t_state, TS_ZOMBIE))
1187 			revents |= events & (POLLOUT | POLLWRNORM);
1188 		else
1189 			selrecord(curthread, &tp->t_wsel);
1190 	}
1191 	crit_exit();
1192 	ap->a_events = revents;
1193 	return (0);
1194 }
1195 
1196 static struct filterops ttyread_filtops =
1197 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1198 static struct filterops ttywrite_filtops =
1199 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1200 
1201 int
1202 ttykqfilter(struct dev_kqfilter_args *ap)
1203 {
1204 	cdev_t dev = ap->a_head.a_dev;
1205 	struct knote *kn = ap->a_kn;
1206 	struct tty *tp = dev->si_tty;
1207 	struct klist *klist;
1208 
1209 	ap->a_result = 0;
1210 	switch (kn->kn_filter) {
1211 	case EVFILT_READ:
1212 		klist = &tp->t_rsel.si_note;
1213 		kn->kn_fop = &ttyread_filtops;
1214 		break;
1215 	case EVFILT_WRITE:
1216 		klist = &tp->t_wsel.si_note;
1217 		kn->kn_fop = &ttywrite_filtops;
1218 		break;
1219 	default:
1220 		ap->a_result = 1;
1221 		return (0);
1222 	}
1223 
1224 	kn->kn_hook = (caddr_t)dev;
1225 
1226 	crit_enter();
1227 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1228 	crit_exit();
1229 
1230 	return (0);
1231 }
1232 
1233 static void
1234 filt_ttyrdetach(struct knote *kn)
1235 {
1236 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1237 
1238 	crit_enter();
1239 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
1240 	crit_exit();
1241 }
1242 
1243 static int
1244 filt_ttyread(struct knote *kn, long hint)
1245 {
1246 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1247 
1248 	kn->kn_data = ttnread(tp);
1249 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1250 		kn->kn_flags |= EV_EOF;
1251 		return (1);
1252 	}
1253 	return (kn->kn_data > 0);
1254 }
1255 
1256 static void
1257 filt_ttywdetach(struct knote *kn)
1258 {
1259 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1260 
1261 	crit_enter();
1262 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
1263 	crit_exit();
1264 }
1265 
1266 static int
1267 filt_ttywrite(struct knote *kn, long hint)
1268 {
1269 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1270 
1271 	kn->kn_data = tp->t_outq.c_cc;
1272 	if (ISSET(tp->t_state, TS_ZOMBIE))
1273 		return (1);
1274 	return (kn->kn_data <= tp->t_olowat &&
1275 	    ISSET(tp->t_state, TS_CONNECTED));
1276 }
1277 
1278 /*
1279  * Must be called while in a critical section.
1280  */
1281 static int
1282 ttnread(struct tty *tp)
1283 {
1284 	int nread;
1285 
1286 	if (ISSET(tp->t_lflag, PENDIN))
1287 		ttypend(tp);
1288 	nread = tp->t_canq.c_cc;
1289 	if (!ISSET(tp->t_lflag, ICANON)) {
1290 		nread += tp->t_rawq.c_cc;
1291 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1292 			nread = 0;
1293 	}
1294 	return (nread);
1295 }
1296 
1297 /*
1298  * Wait for output to drain.
1299  */
1300 int
1301 ttywait(struct tty *tp)
1302 {
1303 	int error;
1304 
1305 	error = 0;
1306 	crit_enter();
1307 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1308 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1309 		(*tp->t_oproc)(tp);
1310 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1311 		    ISSET(tp->t_state, TS_CONNECTED)) {
1312 			SET(tp->t_state, TS_SO_OCOMPLETE);
1313 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1314 					 PCATCH, "ttywai",
1315 					 tp->t_timeout);
1316 			if (error) {
1317 				if (error == EWOULDBLOCK)
1318 					error = EIO;
1319 				break;
1320 			}
1321 		} else
1322 			break;
1323 	}
1324 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1325 		error = EIO;
1326 	crit_exit();
1327 	return (error);
1328 }
1329 
1330 /*
1331  * Flush if successfully wait.
1332  */
1333 static int
1334 ttywflush(struct tty *tp)
1335 {
1336 	int error;
1337 
1338 	if ((error = ttywait(tp)) == 0)
1339 		ttyflush(tp, FREAD);
1340 	return (error);
1341 }
1342 
1343 /*
1344  * Flush tty read and/or write queues, notifying anyone waiting.
1345  */
1346 void
1347 ttyflush(struct tty *tp, int rw)
1348 {
1349 	crit_enter();
1350 #if 0
1351 again:
1352 #endif
1353 	if (rw & FWRITE) {
1354 		FLUSHQ(&tp->t_outq);
1355 		CLR(tp->t_state, TS_TTSTOP);
1356 	}
1357 	(*tp->t_stop)(tp, rw);
1358 	if (rw & FREAD) {
1359 		FLUSHQ(&tp->t_canq);
1360 		FLUSHQ(&tp->t_rawq);
1361 		CLR(tp->t_lflag, PENDIN);
1362 		tp->t_rocount = 0;
1363 		tp->t_rocol = 0;
1364 		CLR(tp->t_state, TS_LOCAL);
1365 		ttwakeup(tp);
1366 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1367 			if (rw & FWRITE)
1368 				FLUSHQ(&tp->t_outq);
1369 			ttyunblock(tp);
1370 
1371 			/*
1372 			 * Don't let leave any state that might clobber the
1373 			 * next line discipline (although we should do more
1374 			 * to send the START char).  Not clearing the state
1375 			 * may have caused the "putc to a clist with no
1376 			 * reserved cblocks" panic/kprintf.
1377 			 */
1378 			CLR(tp->t_state, TS_TBLOCK);
1379 
1380 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1381 			if (ISSET(tp->t_iflag, IXOFF)) {
1382 				/*
1383 				 * XXX wait a bit in the hope that the stop
1384 				 * character (if any) will go out.  Waiting
1385 				 * isn't good since it allows races.  This
1386 				 * will be fixed when the stop character is
1387 				 * put in a special queue.  Don't bother with
1388 				 * the checks in ttywait() since the timeout
1389 				 * will save us.
1390 				 */
1391 				SET(tp->t_state, TS_SO_OCOMPLETE);
1392 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1393 					 "ttyfls", hz / 10);
1394 				/*
1395 				 * Don't try sending the stop character again.
1396 				 */
1397 				CLR(tp->t_state, TS_TBLOCK);
1398 				goto again;
1399 			}
1400 #endif
1401 		}
1402 	}
1403 	if (rw & FWRITE) {
1404 		FLUSHQ(&tp->t_outq);
1405 		ttwwakeup(tp);
1406 	}
1407 	crit_exit();
1408 }
1409 
1410 /*
1411  * Copy in the default termios characters.
1412  */
1413 void
1414 termioschars(struct termios *t)
1415 {
1416 
1417 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1418 }
1419 
1420 /*
1421  * Old interface.
1422  */
1423 void
1424 ttychars(struct tty *tp)
1425 {
1426 
1427 	termioschars(&tp->t_termios);
1428 }
1429 
1430 /*
1431  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1432  * on our input flow control bit and propagate the changes to the driver.
1433  * XXX the stop character should be put in a special high priority queue.
1434  */
1435 void
1436 ttyblock(struct tty *tp)
1437 {
1438 
1439 	SET(tp->t_state, TS_TBLOCK);
1440 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1441 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1442 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1443 	ttstart(tp);
1444 }
1445 
1446 /*
1447  * Handle input low water.  Send start character for the IXOFF case.  Turn
1448  * off our input flow control bit and propagate the changes to the driver.
1449  * XXX the start character should be put in a special high priority queue.
1450  */
1451 static void
1452 ttyunblock(struct tty *tp)
1453 {
1454 
1455 	CLR(tp->t_state, TS_TBLOCK);
1456 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1457 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1458 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1459 	ttstart(tp);
1460 }
1461 
1462 #ifdef notyet
1463 /* Not used by any current (i386) drivers. */
1464 /*
1465  * Restart after an inter-char delay.
1466  */
1467 void
1468 ttrstrt(void *tp_arg)
1469 {
1470 	struct tty *tp;
1471 
1472 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1473 
1474 	tp = tp_arg;
1475 	crit_enter();
1476 	CLR(tp->t_state, TS_TIMEOUT);
1477 	ttstart(tp);
1478 	crit_exit();
1479 }
1480 #endif
1481 
1482 int
1483 ttstart(struct tty *tp)
1484 {
1485 
1486 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1487 		(*tp->t_oproc)(tp);
1488 	return (0);
1489 }
1490 
1491 /*
1492  * "close" a line discipline
1493  */
1494 int
1495 ttylclose(struct tty *tp, int flag)
1496 {
1497 
1498 	if (flag & FNONBLOCK || ttywflush(tp))
1499 		ttyflush(tp, FREAD | FWRITE);
1500 	return (0);
1501 }
1502 
1503 /*
1504  * Handle modem control transition on a tty.
1505  * Flag indicates new state of carrier.
1506  * Returns 0 if the line should be turned off, otherwise 1.
1507  */
1508 int
1509 ttymodem(struct tty *tp, int flag)
1510 {
1511 
1512 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1513 		/*
1514 		 * MDMBUF: do flow control according to carrier flag
1515 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1516 		 * works if IXON and IXANY are clear.
1517 		 */
1518 		if (flag) {
1519 			CLR(tp->t_state, TS_CAR_OFLOW);
1520 			CLR(tp->t_state, TS_TTSTOP);
1521 			ttstart(tp);
1522 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1523 			SET(tp->t_state, TS_CAR_OFLOW);
1524 			SET(tp->t_state, TS_TTSTOP);
1525 			(*tp->t_stop)(tp, 0);
1526 		}
1527 	} else if (flag == 0) {
1528 		/*
1529 		 * Lost carrier.
1530 		 */
1531 		CLR(tp->t_state, TS_CARR_ON);
1532 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1533 		    !ISSET(tp->t_cflag, CLOCAL)) {
1534 			SET(tp->t_state, TS_ZOMBIE);
1535 			CLR(tp->t_state, TS_CONNECTED);
1536 			if (tp->t_session && tp->t_session->s_leader)
1537 				ksignal(tp->t_session->s_leader, SIGHUP);
1538 			ttyflush(tp, FREAD | FWRITE);
1539 			return (0);
1540 		}
1541 	} else {
1542 		/*
1543 		 * Carrier now on.
1544 		 */
1545 		SET(tp->t_state, TS_CARR_ON);
1546 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1547 			SET(tp->t_state, TS_CONNECTED);
1548 		wakeup(TSA_CARR_ON(tp));
1549 		ttwakeup(tp);
1550 		ttwwakeup(tp);
1551 	}
1552 	return (1);
1553 }
1554 
1555 /*
1556  * Reinput pending characters after state switch
1557  * call from a critical section.
1558  */
1559 static void
1560 ttypend(struct tty *tp)
1561 {
1562 	struct clist tq;
1563 	int c;
1564 
1565 	CLR(tp->t_lflag, PENDIN);
1566 	SET(tp->t_state, TS_TYPEN);
1567 	/*
1568 	 * XXX this assumes too much about clist internals.  It may even
1569 	 * fail if the cblock slush pool is empty.  We can't allocate more
1570 	 * cblocks here because we are called from an interrupt handler
1571 	 * and clist_alloc_cblocks() can wait.
1572 	 */
1573 	tq = tp->t_rawq;
1574 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1575 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1576 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1577 	while ((c = clist_getc(&tq)) >= 0)
1578 		ttyinput(c, tp);
1579 	CLR(tp->t_state, TS_TYPEN);
1580 }
1581 
1582 /*
1583  * Process a read call on a tty device.
1584  */
1585 int
1586 ttread(struct tty *tp, struct uio *uio, int flag)
1587 {
1588 	struct clist *qp;
1589 	int c;
1590 	tcflag_t lflag;
1591 	cc_t *cc = tp->t_cc;
1592 	struct proc *pp;
1593 	struct lwp *lp;
1594 	int first, error = 0;
1595 	int has_stime = 0, last_cc = 0;
1596 	long slp = 0;		/* XXX this should be renamed `timo'. */
1597 	struct timeval stime;
1598 
1599 	lp = curthread->td_lwp;
1600 
1601 loop:
1602 	crit_enter();
1603 	lflag = tp->t_lflag;
1604 	/*
1605 	 * take pending input first
1606 	 */
1607 	if (ISSET(lflag, PENDIN)) {
1608 		ttypend(tp);
1609 		splz();		/* reduce latency */
1610 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1611 	}
1612 
1613 	/*
1614 	 * Hang process if it's in the background.
1615 	 */
1616 	if ((pp = curproc) && isbackground(pp, tp)) {
1617 		crit_exit();
1618 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1619 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1620 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0)
1621 			return (EIO);
1622 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1623 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1624 		if (error)
1625 			return (error);
1626 		goto loop;
1627 	}
1628 
1629 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1630 		crit_exit();
1631 		return (0);	/* EOF */
1632 	}
1633 
1634 	/*
1635 	 * If canonical, use the canonical queue,
1636 	 * else use the raw queue.
1637 	 *
1638 	 * (should get rid of clists...)
1639 	 */
1640 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1641 
1642 	if (flag & IO_NDELAY) {
1643 		if (qp->c_cc > 0)
1644 			goto read;
1645 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1646 			crit_exit();
1647 			return (0);
1648 		}
1649 		crit_exit();
1650 		return (EWOULDBLOCK);
1651 	}
1652 	if (!ISSET(lflag, ICANON)) {
1653 		int m = cc[VMIN];
1654 		long t = cc[VTIME];
1655 		struct timeval timecopy;
1656 
1657 		/*
1658 		 * Check each of the four combinations.
1659 		 * (m > 0 && t == 0) is the normal read case.
1660 		 * It should be fairly efficient, so we check that and its
1661 		 * companion case (m == 0 && t == 0) first.
1662 		 * For the other two cases, we compute the target sleep time
1663 		 * into slp.
1664 		 */
1665 		if (t == 0) {
1666 			if (qp->c_cc < m)
1667 				goto sleep;
1668 			if (qp->c_cc > 0)
1669 				goto read;
1670 
1671 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1672 			crit_exit();
1673 			return (0);
1674 		}
1675 		t *= 100000;		/* time in us */
1676 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1677 			 ((t1).tv_usec - (t2).tv_usec))
1678 		if (m > 0) {
1679 			if (qp->c_cc <= 0)
1680 				goto sleep;
1681 			if (qp->c_cc >= m)
1682 				goto read;
1683 			getmicrotime(&timecopy);
1684 			if (!has_stime) {
1685 				/* first character, start timer */
1686 				has_stime = 1;
1687 				stime = timecopy;
1688 				slp = t;
1689 			} else if (qp->c_cc > last_cc) {
1690 				/* got a character, restart timer */
1691 				stime = timecopy;
1692 				slp = t;
1693 			} else {
1694 				/* nothing, check expiration */
1695 				slp = t - diff(timecopy, stime);
1696 				if (slp <= 0)
1697 					goto read;
1698 			}
1699 			last_cc = qp->c_cc;
1700 		} else {	/* m == 0 */
1701 			if (qp->c_cc > 0)
1702 				goto read;
1703 			getmicrotime(&timecopy);
1704 			if (!has_stime) {
1705 				has_stime = 1;
1706 				stime = timecopy;
1707 				slp = t;
1708 			} else {
1709 				slp = t - diff(timecopy, stime);
1710 				if (slp <= 0) {
1711 					/* Timed out, but 0 is enough input. */
1712 					crit_exit();
1713 					return (0);
1714 				}
1715 			}
1716 		}
1717 #undef diff
1718 		/*
1719 		 * Rounding down may make us wake up just short
1720 		 * of the target, so we round up.
1721 		 * The formula is ceiling(slp * hz/1000000).
1722 		 * 32-bit arithmetic is enough for hz < 169.
1723 		 * XXX see tvtohz() for how to avoid overflow if hz
1724 		 * is large (divide by `tick' and/or arrange to
1725 		 * use tvtohz() if hz is large).
1726 		 */
1727 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1728 		goto sleep;
1729 	}
1730 	if (qp->c_cc <= 0) {
1731 sleep:
1732 		/*
1733 		 * There is no input, or not enough input and we can block.
1734 		 */
1735 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1736 				 ISSET(tp->t_state, TS_CONNECTED) ?
1737 				 "ttyin" : "ttyhup", (int)slp);
1738 		crit_exit();
1739 		if (error == EWOULDBLOCK)
1740 			error = 0;
1741 		else if (error)
1742 			return (error);
1743 		/*
1744 		 * XXX what happens if another process eats some input
1745 		 * while we are asleep (not just here)?  It would be
1746 		 * safest to detect changes and reset our state variables
1747 		 * (has_stime and last_cc).
1748 		 */
1749 		slp = 0;
1750 		goto loop;
1751 	}
1752 read:
1753 	crit_exit();
1754 	/*
1755 	 * Input present, check for input mapping and processing.
1756 	 */
1757 	first = 1;
1758 	if (ISSET(lflag, ICANON | ISIG))
1759 		goto slowcase;
1760 	for (;;) {
1761 		char ibuf[IBUFSIZ];
1762 		int icc;
1763 
1764 		icc = imin(uio->uio_resid, IBUFSIZ);
1765 		icc = q_to_b(qp, ibuf, icc);
1766 		if (icc <= 0) {
1767 			if (first)
1768 				goto loop;
1769 			break;
1770 		}
1771 		error = uiomove(ibuf, icc, uio);
1772 		/*
1773 		 * XXX if there was an error then we should ungetc() the
1774 		 * unmoved chars and reduce icc here.
1775 		 */
1776 		if (error)
1777 			break;
1778  		if (uio->uio_resid == 0)
1779 			break;
1780 		first = 0;
1781 	}
1782 	goto out;
1783 slowcase:
1784 	for (;;) {
1785 		c = clist_getc(qp);
1786 		if (c < 0) {
1787 			if (first)
1788 				goto loop;
1789 			break;
1790 		}
1791 		/*
1792 		 * delayed suspend (^Y)
1793 		 */
1794 		if (CCEQ(cc[VDSUSP], c) &&
1795 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1796 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1797 			if (first) {
1798 				error = ttysleep(tp, &lbolt, PCATCH,
1799 						 "ttybg3", 0);
1800 				if (error)
1801 					break;
1802 				goto loop;
1803 			}
1804 			break;
1805 		}
1806 		/*
1807 		 * Interpret EOF only in canonical mode.
1808 		 */
1809 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1810 			break;
1811 		/*
1812 		 * Give user character.
1813 		 */
1814  		error = ureadc(c, uio);
1815 		if (error)
1816 			/* XXX should ungetc(c, qp). */
1817 			break;
1818  		if (uio->uio_resid == 0)
1819 			break;
1820 		/*
1821 		 * In canonical mode check for a "break character"
1822 		 * marking the end of a "line of input".
1823 		 */
1824 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1825 			break;
1826 		first = 0;
1827 	}
1828 
1829 out:
1830 	/*
1831 	 * Look to unblock input now that (presumably)
1832 	 * the input queue has gone down.
1833 	 */
1834 	crit_enter();
1835 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1836 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1837 		ttyunblock(tp);
1838 	crit_exit();
1839 
1840 	return (error);
1841 }
1842 
1843 /*
1844  * Check the output queue on tp for space for a kernel message (from uprintf
1845  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1846  * lose messages due to normal flow control, but don't let the tty run amok.
1847  * Sleeps here are not interruptible, but we return prematurely if new signals
1848  * arrive.
1849  */
1850 int
1851 ttycheckoutq(struct tty *tp, int wait)
1852 {
1853 	struct lwp *lp = curthread->td_lwp;
1854 	int hiwat;
1855 	sigset_t oldset, newset;
1856 
1857 	hiwat = tp->t_ohiwat;
1858 	SIGEMPTYSET(oldset);
1859 	SIGEMPTYSET(newset);
1860 	crit_enter();
1861 	if (wait)
1862 		oldset = lwp_sigpend(lp);
1863 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
1864 		while (tp->t_outq.c_cc > hiwat) {
1865 			ttstart(tp);
1866 			if (tp->t_outq.c_cc <= hiwat)
1867 				break;
1868 			if (wait)
1869 				newset = lwp_sigpend(lp);
1870 			if (!wait || SIGSETNEQ(oldset, newset)) {
1871 				crit_exit();
1872 				return (0);
1873 			}
1874 			SET(tp->t_state, TS_SO_OLOWAT);
1875 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
1876 		}
1877 	}
1878 	crit_exit();
1879 	return (1);
1880 }
1881 
1882 /*
1883  * Process a write call on a tty device.
1884  */
1885 int
1886 ttwrite(struct tty *tp, struct uio *uio, int flag)
1887 {
1888 	char *cp = NULL;
1889 	int cc, ce;
1890 	struct proc *pp;
1891 	struct lwp *lp;
1892 	int i, hiwat, cnt, error;
1893 	char obuf[OBUFSIZ];
1894 
1895 	lp = curthread->td_lwp;
1896 	hiwat = tp->t_ohiwat;
1897 	cnt = uio->uio_resid;
1898 	error = 0;
1899 	cc = 0;
1900 loop:
1901 	crit_enter();
1902 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1903 		crit_exit();
1904 		if (uio->uio_resid == cnt)
1905 			error = EIO;
1906 		goto out;
1907 	}
1908 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
1909 		if (flag & IO_NDELAY) {
1910 			crit_exit();
1911 			error = EWOULDBLOCK;
1912 			goto out;
1913 		}
1914 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
1915 		crit_exit();
1916 		if (error)
1917 			goto out;
1918 		goto loop;
1919 	}
1920 	crit_exit();
1921 
1922 	/*
1923 	 * Hang the process if it's in the background.
1924 	 */
1925 	if ((pp = curproc) && isbackground(pp, tp) &&
1926 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
1927 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
1928 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
1929 		if (pp->p_pgrp->pg_jobc == 0) {
1930 			error = EIO;
1931 			goto out;
1932 		}
1933 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
1934 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
1935 		if (error)
1936 			goto out;
1937 		goto loop;
1938 	}
1939 	/*
1940 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1941 	 * output translation.  Keep track of high water mark, sleep on
1942 	 * overflow awaiting device aid in acquiring new space.
1943 	 */
1944 	while (uio->uio_resid > 0 || cc > 0) {
1945 		if (ISSET(tp->t_lflag, FLUSHO)) {
1946 			uio->uio_resid = 0;
1947 			return (0);
1948 		}
1949 		if (tp->t_outq.c_cc > hiwat)
1950 			goto ovhiwat;
1951 		/*
1952 		 * Grab a hunk of data from the user, unless we have some
1953 		 * leftover from last time.
1954 		 */
1955 		if (cc == 0) {
1956 			cc = imin(uio->uio_resid, OBUFSIZ);
1957 			cp = obuf;
1958 			error = uiomove(cp, cc, uio);
1959 			if (error) {
1960 				cc = 0;
1961 				break;
1962 			}
1963 		}
1964 		/*
1965 		 * If nothing fancy need be done, grab those characters we
1966 		 * can handle without any of ttyoutput's processing and
1967 		 * just transfer them to the output q.  For those chars
1968 		 * which require special processing (as indicated by the
1969 		 * bits in char_type), call ttyoutput.  After processing
1970 		 * a hunk of data, look for FLUSHO so ^O's will take effect
1971 		 * immediately.
1972 		 */
1973 		while (cc > 0) {
1974 			if (!ISSET(tp->t_oflag, OPOST))
1975 				ce = cc;
1976 			else {
1977 				ce = cc - scanc((u_int)cc, (u_char *)cp,
1978 						char_type, CCLASSMASK);
1979 				/*
1980 				 * If ce is zero, then we're processing
1981 				 * a special character through ttyoutput.
1982 				 */
1983 				if (ce == 0) {
1984 					tp->t_rocount = 0;
1985 					if (ttyoutput(*cp, tp) >= 0) {
1986 						/* No Clists, wait a bit. */
1987 						ttstart(tp);
1988 						if (flag & IO_NDELAY) {
1989 							error = EWOULDBLOCK;
1990 							goto out;
1991 						}
1992 						error = ttysleep(tp, &lbolt,
1993 								 PCATCH,
1994 								 "ttybf1", 0);
1995 						if (error)
1996 							goto out;
1997 						goto loop;
1998 					}
1999 					cp++;
2000 					cc--;
2001 					if (ISSET(tp->t_lflag, FLUSHO) ||
2002 					    tp->t_outq.c_cc > hiwat)
2003 						goto ovhiwat;
2004 					continue;
2005 				}
2006 			}
2007 			/*
2008 			 * A bunch of normal characters have been found.
2009 			 * Transfer them en masse to the output queue and
2010 			 * continue processing at the top of the loop.
2011 			 * If there are any further characters in this
2012 			 * <= OBUFSIZ chunk, the first should be a character
2013 			 * requiring special handling by ttyoutput.
2014 			 */
2015 			tp->t_rocount = 0;
2016 			i = b_to_q(cp, ce, &tp->t_outq);
2017 			ce -= i;
2018 			tp->t_column += ce;
2019 			cp += ce, cc -= ce, tk_nout += ce;
2020 			tp->t_outcc += ce;
2021 			if (i > 0) {
2022 				/* No Clists, wait a bit. */
2023 				ttstart(tp);
2024 				if (flag & IO_NDELAY) {
2025 					error = EWOULDBLOCK;
2026 					goto out;
2027 				}
2028 				error = ttysleep(tp, &lbolt, PCATCH,
2029 						 "ttybf2", 0);
2030 				if (error)
2031 					goto out;
2032 				goto loop;
2033 			}
2034 			if (ISSET(tp->t_lflag, FLUSHO) ||
2035 			    tp->t_outq.c_cc > hiwat)
2036 				break;
2037 		}
2038 		ttstart(tp);
2039 	}
2040 out:
2041 	/*
2042 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2043 	 * offset and iov pointers have moved forward, but it doesn't matter
2044 	 * (the call will either return short or restart with a new uio).
2045 	 */
2046 	uio->uio_resid += cc;
2047 	return (error);
2048 
2049 ovhiwat:
2050 	ttstart(tp);
2051 	crit_enter();
2052 	/*
2053 	 * This can only occur if FLUSHO is set in t_lflag,
2054 	 * or if ttstart/oproc is synchronous (or very fast).
2055 	 */
2056 	if (tp->t_outq.c_cc <= hiwat) {
2057 		crit_exit();
2058 		goto loop;
2059 	}
2060 	if (flag & IO_NDELAY) {
2061 		crit_exit();
2062 		uio->uio_resid += cc;
2063 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2064 	}
2065 	SET(tp->t_state, TS_SO_OLOWAT);
2066 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2067 	crit_exit();
2068 	if (error == EWOULDBLOCK)
2069 		error = EIO;
2070 	if (error)
2071 		goto out;
2072 	goto loop;
2073 }
2074 
2075 /*
2076  * Rubout one character from the rawq of tp
2077  * as cleanly as possible.
2078  */
2079 static void
2080 ttyrub(int c, struct tty *tp)
2081 {
2082 	char *cp;
2083 	int savecol;
2084 	int tabc;
2085 
2086 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2087 		return;
2088 	CLR(tp->t_lflag, FLUSHO);
2089 	if (ISSET(tp->t_lflag, ECHOE)) {
2090 		if (tp->t_rocount == 0) {
2091 			/*
2092 			 * Screwed by ttwrite; retype
2093 			 */
2094 			ttyretype(tp);
2095 			return;
2096 		}
2097 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2098 			ttyrubo(tp, 2);
2099 		else {
2100 			CLR(c, ~TTY_CHARMASK);
2101 			switch (CCLASS(c)) {
2102 			case ORDINARY:
2103 				ttyrubo(tp, 1);
2104 				break;
2105 			case BACKSPACE:
2106 			case CONTROL:
2107 			case NEWLINE:
2108 			case RETURN:
2109 			case VTAB:
2110 				if (ISSET(tp->t_lflag, ECHOCTL))
2111 					ttyrubo(tp, 2);
2112 				break;
2113 			case TAB:
2114 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2115 					ttyretype(tp);
2116 					return;
2117 				}
2118 				crit_enter();
2119 				savecol = tp->t_column;
2120 				SET(tp->t_state, TS_CNTTB);
2121 				SET(tp->t_lflag, FLUSHO);
2122 				tp->t_column = tp->t_rocol;
2123 				cp = tp->t_rawq.c_cf;
2124 				if (cp)
2125 					tabc = *cp;	/* XXX FIX NEXTC */
2126 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2127 					ttyecho(tabc, tp);
2128 				CLR(tp->t_lflag, FLUSHO);
2129 				CLR(tp->t_state, TS_CNTTB);
2130 				crit_exit();
2131 
2132 				/* savecol will now be length of the tab. */
2133 				savecol -= tp->t_column;
2134 				tp->t_column += savecol;
2135 				if (savecol > 8)
2136 					savecol = 8;	/* overflow screw */
2137 				while (--savecol >= 0)
2138 					(void)ttyoutput('\b', tp);
2139 				break;
2140 			default:			/* XXX */
2141 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2142 				(void)kprintf(PANICSTR, c, CCLASS(c));
2143 #ifdef notdef
2144 				panic(PANICSTR, c, CCLASS(c));
2145 #endif
2146 			}
2147 		}
2148 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2149 		if (!ISSET(tp->t_state, TS_ERASE)) {
2150 			SET(tp->t_state, TS_ERASE);
2151 			(void)ttyoutput('\\', tp);
2152 		}
2153 		ttyecho(c, tp);
2154 	} else {
2155 		ttyecho(tp->t_cc[VERASE], tp);
2156 		/*
2157 		 * This code may be executed not only when an ERASE key
2158 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2159 		 * So, I didn't think it was worthwhile to pass the extra
2160 		 * information (which would need an extra parameter,
2161 		 * changing every call) needed to distinguish the ERASE2
2162 		 * case from the ERASE.
2163 		 */
2164 	}
2165 	--tp->t_rocount;
2166 }
2167 
2168 /*
2169  * Back over cnt characters, erasing them.
2170  */
2171 static void
2172 ttyrubo(struct tty *tp, int cnt)
2173 {
2174 
2175 	while (cnt-- > 0) {
2176 		(void)ttyoutput('\b', tp);
2177 		(void)ttyoutput(' ', tp);
2178 		(void)ttyoutput('\b', tp);
2179 	}
2180 }
2181 
2182 /*
2183  * ttyretype --
2184  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2185  *	been checked.
2186  */
2187 static void
2188 ttyretype(struct tty *tp)
2189 {
2190 	char *cp;
2191 	int c;
2192 
2193 	/* Echo the reprint character. */
2194 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2195 		ttyecho(tp->t_cc[VREPRINT], tp);
2196 
2197 	(void)ttyoutput('\n', tp);
2198 
2199 	/*
2200 	 * XXX
2201 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2202 	 * BIT OF FIRST CHAR.
2203 	 */
2204 	crit_enter();
2205 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2206 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2207 		ttyecho(c, tp);
2208 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2209 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2210 		ttyecho(c, tp);
2211 	CLR(tp->t_state, TS_ERASE);
2212 	crit_exit();
2213 
2214 	tp->t_rocount = tp->t_rawq.c_cc;
2215 	tp->t_rocol = 0;
2216 }
2217 
2218 /*
2219  * Echo a typed character to the terminal.
2220  */
2221 static void
2222 ttyecho(int c, struct tty *tp)
2223 {
2224 
2225 	if (!ISSET(tp->t_state, TS_CNTTB))
2226 		CLR(tp->t_lflag, FLUSHO);
2227 	if ((!ISSET(tp->t_lflag, ECHO) &&
2228 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2229 	    ISSET(tp->t_lflag, EXTPROC))
2230 		return;
2231 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2232 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2233 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2234 		(void)ttyoutput('^', tp);
2235 		CLR(c, ~TTY_CHARMASK);
2236 		if (c == 0177)
2237 			c = '?';
2238 		else
2239 			c += 'A' - 1;
2240 	}
2241 	(void)ttyoutput(c, tp);
2242 }
2243 
2244 /*
2245  * Wake up any readers on a tty.
2246  */
2247 void
2248 ttwakeup(struct tty *tp)
2249 {
2250 
2251 	if (tp->t_rsel.si_pid != 0)
2252 		selwakeup(&tp->t_rsel);
2253 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2254 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2255 	wakeup(TSA_HUP_OR_INPUT(tp));
2256 	KNOTE(&tp->t_rsel.si_note, 0);
2257 }
2258 
2259 /*
2260  * Wake up any writers on a tty.
2261  */
2262 void
2263 ttwwakeup(struct tty *tp)
2264 {
2265 
2266 	if (tp->t_wsel.si_pid != 0 && tp->t_outq.c_cc <= tp->t_olowat)
2267 		selwakeup(&tp->t_wsel);
2268 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2269 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2270 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2271 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2272 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2273 		wakeup(TSA_OCOMPLETE(tp));
2274 	}
2275 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2276 	    tp->t_outq.c_cc <= tp->t_olowat) {
2277 		CLR(tp->t_state, TS_SO_OLOWAT);
2278 		wakeup(TSA_OLOWAT(tp));
2279 	}
2280 	KNOTE(&tp->t_wsel.si_note, 0);
2281 }
2282 
2283 /*
2284  * Look up a code for a specified speed in a conversion table;
2285  * used by drivers to map software speed values to hardware parameters.
2286  */
2287 int
2288 ttspeedtab(int speed, struct speedtab *table)
2289 {
2290 
2291 	for ( ; table->sp_speed != -1; table++)
2292 		if (table->sp_speed == speed)
2293 			return (table->sp_code);
2294 	return (-1);
2295 }
2296 
2297 /*
2298  * Set input and output watermarks and buffer sizes.  For input, the
2299  * high watermark is about one second's worth of input above empty, the
2300  * low watermark is slightly below high water, and the buffer size is a
2301  * driver-dependent amount above high water.  For output, the watermarks
2302  * are near the ends of the buffer, with about 1 second's worth of input
2303  * between them.  All this only applies to the standard line discipline.
2304  */
2305 void
2306 ttsetwater(struct tty *tp)
2307 {
2308 	int cps, ttmaxhiwat, x;
2309 
2310 	/* Input. */
2311 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2312 	switch (tp->t_ispeedwat) {
2313 	case (speed_t)-1:
2314 		cps = tp->t_ispeed / 10;
2315 		break;
2316 	case 0:
2317 		/*
2318 		 * This case is for old drivers that don't know about
2319 		 * t_ispeedwat.  Arrange for them to get the old buffer
2320 		 * sizes and watermarks.
2321 		 */
2322 		cps = TTYHOG - 2 * 256;
2323 		tp->t_ififosize = 2 * 2048;
2324 		break;
2325 	default:
2326 		cps = tp->t_ispeedwat / 10;
2327 		break;
2328 	}
2329 	tp->t_ihiwat = cps;
2330 	tp->t_ilowat = 7 * cps / 8;
2331 	x = cps + tp->t_ififosize;
2332 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2333 
2334 	/* Output. */
2335 	switch (tp->t_ospeedwat) {
2336 	case (speed_t)-1:
2337 		cps = tp->t_ospeed / 10;
2338 		ttmaxhiwat = 2 * TTMAXHIWAT;
2339 		break;
2340 	case 0:
2341 		cps = tp->t_ospeed / 10;
2342 		ttmaxhiwat = TTMAXHIWAT;
2343 		break;
2344 	default:
2345 		cps = tp->t_ospeedwat / 10;
2346 		ttmaxhiwat = 8 * TTMAXHIWAT;
2347 		break;
2348 	}
2349 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2350 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2351 	x += cps;
2352 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2353 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2354 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2355 	x += OBUFSIZ + 100;
2356 	clist_alloc_cblocks(&tp->t_outq, x, x);
2357 #undef	CLAMP
2358 }
2359 
2360 /*
2361  * Report on state of foreground process group.
2362  */
2363 void
2364 ttyinfo(struct tty *tp)
2365 {
2366 	struct proc *p, *pick;
2367 	struct lwp *lp;
2368 	struct rusage ru;
2369 	int tmp;
2370 
2371 	if (ttycheckoutq(tp,0) == 0)
2372 		return;
2373 
2374 	/*
2375 	 * We always print the load average, then figure out what else to
2376 	 * print based on the state of the current process group.
2377 	 */
2378 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2379 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2380 
2381 	if (tp->t_session == NULL) {
2382 		ttyprintf(tp, "not a controlling terminal\n");
2383 	} else if (tp->t_pgrp == NULL) {
2384 		ttyprintf(tp, "no foreground process group\n");
2385 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == 0) {
2386 		ttyprintf(tp, "empty foreground process group\n");
2387 	} else {
2388 		/*
2389 		 * Pick an interesting process.  Note that certain elements,
2390 		 * in particular the wmesg, require a critical section for
2391 		 * safe access (YYY and we are still not MP safe).
2392 		 *
2393 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2394 		 */
2395 		char buf[64];
2396 		const char *str;
2397 		long vmsz;
2398 		int pctcpu;
2399 
2400 		crit_enter();
2401 
2402 		/* XXX lwp should compare lwps */
2403 
2404 		for (pick = NULL; p != 0; p = LIST_NEXT(p, p_pglist)) {
2405 			if (proc_compare(pick, p))
2406 				pick = p;
2407 		}
2408 
2409 		/* XXX lwp */
2410 		lp = FIRST_LWP_IN_PROC(pick);
2411 		if (lp == NULL) {
2412 			ttyprintf(tp, "foreground process without lwp\n");
2413 			tp->t_rocount = 0;
2414 			crit_exit();
2415 			return;
2416 		}
2417 
2418 		/*
2419 		 * Figure out what wait/process-state message, and command
2420 		 * buffer to present
2421 		 */
2422 		/*
2423 		 * XXX lwp This is a horrible mixture.  We need to rework this
2424 		 * as soon as lwps have their own runnable status.
2425 		 */
2426 		if (pick->p_flag & P_WEXIT)
2427 			str = "exiting";
2428 		else if (lp->lwp_stat == LSRUN)
2429 			str = "running";
2430 		else if (pick->p_stat == SIDL)
2431 			str = "spawning";
2432 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2433 			str = lp->lwp_wmesg;
2434 		else
2435 			str = "iowait";
2436 
2437 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2438 			pick->p_comm, pick->p_pid, str);
2439 
2440 		/*
2441 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2442 		 * 'pick' becomes invalid the moment we exit the critical
2443 		 * section.
2444 		 */
2445 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0)
2446 			calcru_proc(pick, &ru);
2447 
2448 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2449 
2450 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2451 		    vmsz = 0;
2452 		else
2453 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2454 
2455 		crit_exit();
2456 
2457 		/*
2458 		 * Dump the output
2459 		 */
2460 		ttyprintf(tp, " %s ", buf);
2461 		ttyprintf(tp, "%ld.%02ldu ",
2462 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2463 		ttyprintf(tp, "%ld.%02lds ",
2464 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2465 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2466 	}
2467 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2468 }
2469 
2470 /*
2471  * Returns 1 if p2 is "better" than p1
2472  *
2473  * The algorithm for picking the "interesting" process is thus:
2474  *
2475  *	1) Only foreground processes are eligible - implied.
2476  *	2) Runnable processes are favored over anything else.  The runner
2477  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2478  *	   broken by picking the highest pid.
2479  *	3) The sleeper with the shortest sleep time is next.  With ties,
2480  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2481  *	4) Further ties are broken by picking the highest pid.
2482  */
2483 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2484 #define TESTAB(a, b)    ((a)<<1 | (b))
2485 #define ONLYA   2
2486 #define ONLYB   1
2487 #define BOTH    3
2488 
2489 static int
2490 proc_compare(struct proc *p1, struct proc *p2)
2491 {
2492 	struct lwp *lp1, *lp2;
2493 	if (p1 == NULL)
2494 		return (1);
2495 
2496 	/*
2497  	 * weed out zombies
2498 	 */
2499 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2500 	case ONLYA:
2501 		return (1);
2502 	case ONLYB:
2503 		return (0);
2504 	case BOTH:
2505 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2506 	}
2507 
2508 	/* XXX lwp */
2509 	lp1 = FIRST_LWP_IN_PROC(p1);
2510 	lp2 = FIRST_LWP_IN_PROC(p2);
2511 
2512 	/*
2513 	 * see if at least one of them is runnable
2514 	 */
2515 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2516 	case ONLYA:
2517 		return (0);
2518 	case ONLYB:
2519 		return (1);
2520 	case BOTH:
2521 		/*
2522 		 * tie - favor one with highest recent cpu utilization
2523 		 */
2524 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2525 			return (1);
2526 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2527 			return (0);
2528 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2529 	}
2530 	/*
2531 	 * pick the one with the smallest sleep time
2532 	 */
2533 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2534 		return (0);
2535 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2536 		return (1);
2537 	/*
2538 	 * favor one sleeping in a non-interruptible sleep
2539 	 */
2540 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2541 		return (1);
2542 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2543 		return (0);
2544 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2545 }
2546 
2547 /*
2548  * Output char to tty; console putchar style.
2549  */
2550 int
2551 tputchar(int c, struct tty *tp)
2552 {
2553 	crit_enter();
2554 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2555 		crit_exit();
2556 		return (-1);
2557 	}
2558 	if (c == '\n')
2559 		(void)ttyoutput('\r', tp);
2560 	(void)ttyoutput(c, tp);
2561 	ttstart(tp);
2562 	crit_exit();
2563 	return (0);
2564 }
2565 
2566 /*
2567  * Sleep on chan, returning ERESTART if tty changed while we napped and
2568  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2569  * the tty is revoked, restarting a pending call will redo validation done
2570  * at the start of the call.
2571  */
2572 int
2573 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2574 {
2575 	int error;
2576 	int gen;
2577 
2578 	gen = tp->t_gen;
2579 	error = tsleep(chan, slpflags, wmesg, timo);
2580 	if (error)
2581 		return (error);
2582 	return (tp->t_gen == gen ? 0 : ERESTART);
2583 }
2584 
2585 /*
2586  * Revoke a tty.
2587  *
2588  * We bump the gen to force any ttysleep()'s to return with ERESTART
2589  * and flush the tty.  The related fp's should already have been
2590  * replaced so the tty will close when the last references on the
2591  * original fp's go away.
2592  */
2593 int
2594 ttyrevoke(struct dev_revoke_args *ap)
2595 {
2596 	struct tty *tp;
2597 
2598 	tp = ap->a_head.a_dev->si_tty;
2599 	tp->t_gen++;
2600 	ttyflush(tp, FREAD | FWRITE);
2601 	wakeup(TSA_CARR_ON(tp));
2602 	ttwakeup(tp);
2603 	ttwwakeup(tp);
2604 	return (0);
2605 }
2606 
2607 /*
2608  * Allocate a tty struct.  Clists in the struct will be allocated by
2609  * ttyopen().
2610  */
2611 struct tty *
2612 ttymalloc(struct tty *tp)
2613 {
2614 
2615 	if (tp) {
2616 		return(tp);
2617 	}
2618 	tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2619 	ttyregister(tp);
2620         return (tp);
2621 }
2622 
2623 #if 0
2624 /*
2625  * Free a tty struct.  Clists in the struct should have been freed by
2626  * ttyclose().
2627  *
2628  * XXX not yet usable: since we support a half-closed state and do not
2629  * ref count the tty reference from the session, it is possible for a
2630  * session to hold a ref on the tty.  See TTY_DO_FULL_CLOSE.
2631  */
2632 void
2633 ttyfree(struct tty *tp)
2634 {
2635         kfree(tp, M_TTYS);
2636 }
2637 #endif /* 0 */
2638 
2639 void
2640 ttyregister(struct tty *tp)
2641 {
2642 	SLIST_INSERT_HEAD(&tty_list, tp, t_list);
2643 }
2644 
2645 static int
2646 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2647 {
2648 	int error;
2649 	struct tty *tp, t;
2650 	SLIST_FOREACH(tp, &tty_list, t_list) {
2651 		t = *tp;
2652 		if (t.t_dev)
2653 			t.t_dev = (cdev_t)(uintptr_t)dev2udev(t.t_dev);
2654 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2655 		if (error)
2656 			return (error);
2657 	}
2658 	return (0);
2659 }
2660 
2661 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2662 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2663 
2664 void
2665 nottystop(struct tty *tp, int rw)
2666 {
2667 
2668 	return;
2669 }
2670 
2671 int
2672 ttyread(struct dev_read_args *ap)
2673 {
2674 	struct tty *tp;
2675 
2676 	tp = ap->a_head.a_dev->si_tty;
2677 	if (tp == NULL)
2678 		return (ENODEV);
2679 	return ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2680 }
2681 
2682 int
2683 ttywrite(struct dev_write_args *ap)
2684 {
2685 	struct tty *tp;
2686 
2687 	tp = ap->a_head.a_dev->si_tty;
2688 	if (tp == NULL)
2689 		return (ENODEV);
2690 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2691 }
2692