xref: /dflybsd-src/sys/kern/tty.c (revision e54488bbec5c9f80e95cedd395b0e3d31fde253d)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
39  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
40  * $DragonFly: src/sys/kern/tty.c,v 1.46 2008/09/10 09:50:09 y0netan1 Exp $
41  */
42 
43 /*-
44  * TODO:
45  *	o Fix races for sending the start char in ttyflush().
46  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
47  *	  With luck, there will be MIN chars before select() returns().
48  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
49  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
50  *	  FIONREAD.
51  *	o Do the new sio locking stuff here and use it to avoid special
52  *	  case for EXTPROC?
53  *	o Lock PENDIN too?
54  *	o Move EXTPROC and/or PENDIN to t_state?
55  *	o Wrap most of ttioctl in spltty/splx.
56  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
57  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
58  *	o Don't allow certain termios flags to affect disciplines other
59  *	  than TTYDISC.  Cancel their effects before switch disciplines
60  *	  and ignore them if they are set while we are in another
61  *	  discipline.
62  *	o Now that historical speed conversions are handled here, don't
63  *	  do them in drivers.
64  *	o Check for TS_CARR_ON being set while everything is closed and not
65  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
66  *	  so it would live until the next open even if carrier drops.
67  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
68  *	  only when _all_ openers leave open().
69  */
70 
71 #include "opt_compat.h"
72 #include "opt_uconsole.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/filio.h>
77 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
78 #include <sys/ioctl_compat.h>
79 #endif
80 #include <sys/proc.h>
81 #include <sys/priv.h>
82 #define	TTYDEFCHARS
83 #include <sys/tty.h>
84 #include <sys/clist.h>
85 #undef	TTYDEFCHARS
86 #include <sys/fcntl.h>
87 #include <sys/conf.h>
88 #include <sys/dkstat.h>
89 #include <sys/poll.h>
90 #include <sys/kernel.h>
91 #include <sys/vnode.h>
92 #include <sys/signalvar.h>
93 #include <sys/signal2.h>
94 #include <sys/resourcevar.h>
95 #include <sys/malloc.h>
96 #include <sys/filedesc.h>
97 #include <sys/sysctl.h>
98 #include <sys/thread2.h>
99 
100 #include <vm/vm.h>
101 #include <sys/lock.h>
102 #include <vm/pmap.h>
103 #include <vm/vm_map.h>
104 
105 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
106 
107 static int	proc_compare (struct proc *p1, struct proc *p2);
108 static int	ttnread (struct tty *tp);
109 static void	ttyecho (int c, struct tty *tp);
110 static int	ttyoutput (int c, struct tty *tp);
111 static void	ttypend (struct tty *tp);
112 static void	ttyretype (struct tty *tp);
113 static void	ttyrub (int c, struct tty *tp);
114 static void	ttyrubo (struct tty *tp, int cnt);
115 static void	ttyunblock (struct tty *tp);
116 static int	ttywflush (struct tty *tp);
117 static int	filt_ttyread (struct knote *kn, long hint);
118 static void 	filt_ttyrdetach (struct knote *kn);
119 static int	filt_ttywrite (struct knote *kn, long hint);
120 static void 	filt_ttywdetach (struct knote *kn);
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 static u_char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 /* Macros to clear/set/test flags. */
196 #define	SET(t, f)	(t) |= (f)
197 #define	CLR(t, f)	(t) &= ~(f)
198 #define	ISSET(t, f)	((t) & (f))
199 
200 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
201 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
202 
203 uint64_t tk_nin;
204 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
205     "LU", "TTY input statistic");
206 uint64_t tk_nout;
207 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
208     "LU", "TTY output statistic");
209 uint64_t tk_rawcc;
210 
211 /*
212  * list of struct tty where pstat(8) can pick it up with sysctl
213  */
214 static SLIST_HEAD(, tty) tty_list;
215 
216 /*
217  * Initial open of tty, or (re)entry to standard tty line discipline.
218  */
219 int
220 ttyopen(cdev_t device, struct tty *tp)
221 {
222 	crit_enter();
223 	tp->t_dev = device;
224 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
225 		SET(tp->t_state, TS_ISOPEN);
226 		if (ISSET(tp->t_cflag, CLOCAL)) {
227 			SET(tp->t_state, TS_CONNECTED);
228 		}
229 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
230 	}
231 	ttsetwater(tp);
232 	crit_exit();
233 	return (0);
234 }
235 
236 /*
237  * Handle close() on a tty line: flush and set to initial state,
238  * bumping generation number so that pending read/write calls
239  * can detect recycling of the tty.
240  *
241  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
242  * and l_close() should have flushed, but we repeat the spltty() and
243  * the flush in case there are buggy callers.
244  */
245 int
246 ttyclose(struct tty *tp)
247 {
248 	funsetown(tp->t_sigio);
249 	crit_enter();
250 	if (constty == tp)
251 		constty = NULL;
252 
253 	ttyflush(tp, FREAD | FWRITE);
254 	clist_free_cblocks(&tp->t_canq);
255 	clist_free_cblocks(&tp->t_outq);
256 	clist_free_cblocks(&tp->t_rawq);
257 
258 	tp->t_gen++;
259 	tp->t_line = TTYDISC;
260 	ttyclearsession(tp);
261 	tp->t_state = 0;
262 	crit_exit();
263 	return (0);
264 }
265 
266 /*
267  * Disassociate the tty from its session.  Traditionally this has only been
268  * a half-close, meaning that the session was still allowed to point at the
269  * tty (resulting in the tty in the ps command showing something like 'p0-'),
270  * even though the tty is no longer pointing at the session.
271  *
272  * The half close seems to be useful only for 'ps' output but there is as
273  * yet no reason to remove the feature.  The full-close code is currently
274  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
275  */
276 void
277 ttyclearsession(struct tty *tp)
278 {
279 	struct session *sp;
280 
281 	tp->t_pgrp = NULL;
282 	if ((sp = tp->t_session) != NULL) {
283 		tp->t_session = NULL;
284 #ifdef TTY_DO_FULL_CLOSE
285 		/* FULL CLOSE (not yet) */
286 		if (sp->s_ttyp == tp) {
287 			sp->s_ttyp = NULL;
288 		} else {
289 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
290 				"%p/%p\n", sp->s_ttyp, tp);
291 		}
292 #endif
293 	}
294 }
295 
296 /*
297  * Release the tty vnode association for a session.  This is the
298  * 'other half' of the close.  Because multiple opens of /dev/tty
299  * only generate a single open to the actual tty, the file modes
300  * are locked to FREAD|FWRITE.
301  *
302  * If dorevoke is non-zero, the session is also revoked.  We have to
303  * close the vnode if VCTTYISOPEN is set.
304  */
305 void
306 ttyclosesession(struct session *sp, int dorevoke)
307 {
308 	struct vnode *vp;
309 
310 retry:
311 	/*
312 	 * There may not be a controlling terminal or it may have been closed
313 	 * out from under us.
314 	 */
315 	if ((vp = sp->s_ttyvp) == NULL)
316 		return;
317 
318 	/*
319 	 * We need a lock if we have to close or revoke.
320 	 */
321 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
322 		vhold(vp);
323 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
324 			vdrop(vp);
325 			goto retry;
326 		}
327 
328 		/*
329 		 * Retry if the vnode was ripped out from under us
330 		 */
331 		if (vp != sp->s_ttyvp) {
332 			vn_unlock(vp);
333 			vdrop(vp);
334 			goto retry;
335 		}
336 
337 		/*
338 		 * Close and revoke as needed
339 		 */
340 		sp->s_ttyvp = NULL;
341 		if (vp->v_flag & VCTTYISOPEN) {
342 			vclrflags(vp, VCTTYISOPEN);
343 			VOP_CLOSE(vp, FREAD|FWRITE);
344 		}
345 		vn_unlock(vp);
346 		if (dorevoke)
347 			vrevoke(vp, proc0.p_ucred);
348 		vdrop(vp);
349 	} else {
350 		sp->s_ttyvp = NULL;
351 	}
352 	vrele(vp);
353 }
354 
355 #define	FLUSHQ(q) {							\
356 	if ((q)->c_cc)							\
357 		ndflush(q, (q)->c_cc);					\
358 }
359 
360 /* Is 'c' a line delimiter ("break" character)? */
361 #define	TTBREAKC(c, lflag)							\
362 	((c) == '\n' || (((c) == cc[VEOF] ||				\
363 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
364 	 (c) != _POSIX_VDISABLE))
365 
366 /*
367  * Process input of a single character received on a tty.
368  */
369 int
370 ttyinput(int c, struct tty *tp)
371 {
372 	tcflag_t iflag, lflag;
373 	cc_t *cc;
374 	int i, err;
375 
376 	/*
377 	 * If input is pending take it first.
378 	 */
379 	lflag = tp->t_lflag;
380 	if (ISSET(lflag, PENDIN))
381 		ttypend(tp);
382 	/*
383 	 * Gather stats.
384 	 */
385 	if (ISSET(lflag, ICANON))
386 		++tp->t_cancc;
387 	else
388 		++tp->t_rawcc;
389 	++tk_nin;
390 
391 	/*
392 	 * Block further input iff:
393 	 * current input > threshold AND input is available to user program
394 	 * AND input flow control is enabled and not yet invoked.
395 	 * The 3 is slop for PARMRK.
396 	 */
397 	iflag = tp->t_iflag;
398 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
399 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
400 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
401 	    !ISSET(tp->t_state, TS_TBLOCK))
402 		ttyblock(tp);
403 
404 	/* Handle exceptional conditions (break, parity, framing). */
405 	cc = tp->t_cc;
406 	err = (ISSET(c, TTY_ERRORMASK));
407 	if (err) {
408 		CLR(c, TTY_ERRORMASK);
409 		if (ISSET(err, TTY_BI)) {
410 			if (ISSET(iflag, IGNBRK))
411 				return (0);
412 			if (ISSET(iflag, BRKINT)) {
413 				ttyflush(tp, FREAD | FWRITE);
414 				pgsignal(tp->t_pgrp, SIGINT, 1);
415 				goto endcase;
416 			}
417 			if (ISSET(iflag, PARMRK))
418 				goto parmrk;
419 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
420 			|| ISSET(err, TTY_FE)) {
421 			if (ISSET(iflag, IGNPAR))
422 				return (0);
423 			else if (ISSET(iflag, PARMRK)) {
424 parmrk:
425 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
426 				    MAX_INPUT - 3)
427 					goto input_overflow;
428 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
429 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
430 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
431 				goto endcase;
432 			} else
433 				c = 0;
434 		}
435 	}
436 
437 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
438 		CLR(c, 0x80);
439 	if (!ISSET(lflag, EXTPROC)) {
440 		/*
441 		 * Check for literal nexting very first
442 		 */
443 		if (ISSET(tp->t_state, TS_LNCH)) {
444 			SET(c, TTY_QUOTE);
445 			CLR(tp->t_state, TS_LNCH);
446 		}
447 		/*
448 		 * Scan for special characters.  This code
449 		 * is really just a big case statement with
450 		 * non-constant cases.  The bottom of the
451 		 * case statement is labeled ``endcase'', so goto
452 		 * it after a case match, or similar.
453 		 */
454 
455 		/*
456 		 * Control chars which aren't controlled
457 		 * by ICANON, ISIG, or IXON.
458 		 */
459 		if (ISSET(lflag, IEXTEN)) {
460 			if (CCEQ(cc[VLNEXT], c)) {
461 				if (ISSET(lflag, ECHO)) {
462 					if (ISSET(lflag, ECHOE)) {
463 						(void)ttyoutput('^', tp);
464 						(void)ttyoutput('\b', tp);
465 					} else
466 						ttyecho(c, tp);
467 				}
468 				SET(tp->t_state, TS_LNCH);
469 				goto endcase;
470 			}
471 			if (CCEQ(cc[VDISCARD], c)) {
472 				if (ISSET(lflag, FLUSHO))
473 					CLR(tp->t_lflag, FLUSHO);
474 				else {
475 					ttyflush(tp, FWRITE);
476 					ttyecho(c, tp);
477 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
478 						ttyretype(tp);
479 					SET(tp->t_lflag, FLUSHO);
480 				}
481 				goto startoutput;
482 			}
483 		}
484 		/*
485 		 * Signals.
486 		 */
487 		if (ISSET(lflag, ISIG)) {
488 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
489 				if (!ISSET(lflag, NOFLSH))
490 					ttyflush(tp, FREAD | FWRITE);
491 				ttyecho(c, tp);
492 				pgsignal(tp->t_pgrp,
493 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
494 				goto endcase;
495 			}
496 			if (CCEQ(cc[VSUSP], c)) {
497 				if (!ISSET(lflag, NOFLSH))
498 					ttyflush(tp, FREAD);
499 				ttyecho(c, tp);
500 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
501 				goto endcase;
502 			}
503 		}
504 		/*
505 		 * Handle start/stop characters.
506 		 */
507 		if (ISSET(iflag, IXON)) {
508 			if (CCEQ(cc[VSTOP], c)) {
509 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
510 					SET(tp->t_state, TS_TTSTOP);
511 					(*tp->t_stop)(tp, 0);
512 					return (0);
513 				}
514 				if (!CCEQ(cc[VSTART], c))
515 					return (0);
516 				/*
517 				 * if VSTART == VSTOP then toggle
518 				 */
519 				goto endcase;
520 			}
521 			if (CCEQ(cc[VSTART], c))
522 				goto restartoutput;
523 		}
524 		/*
525 		 * IGNCR, ICRNL, & INLCR
526 		 */
527 		if (c == '\r') {
528 			if (ISSET(iflag, IGNCR))
529 				return (0);
530 			else if (ISSET(iflag, ICRNL))
531 				c = '\n';
532 		} else if (c == '\n' && ISSET(iflag, INLCR))
533 			c = '\r';
534 	}
535 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
536 		/*
537 		 * From here on down canonical mode character
538 		 * processing takes place.
539 		 */
540 		/*
541 		 * erase or erase2 (^H / ^?)
542 		 */
543 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
544 			if (tp->t_rawq.c_cc)
545 				ttyrub(clist_unputc(&tp->t_rawq), tp);
546 			goto endcase;
547 		}
548 		/*
549 		 * kill (^U)
550 		 */
551 		if (CCEQ(cc[VKILL], c)) {
552 			if (ISSET(lflag, ECHOKE) &&
553 			    tp->t_rawq.c_cc == tp->t_rocount &&
554 			    !ISSET(lflag, ECHOPRT))
555 				while (tp->t_rawq.c_cc)
556 					ttyrub(clist_unputc(&tp->t_rawq), tp);
557 			else {
558 				ttyecho(c, tp);
559 				if (ISSET(lflag, ECHOK) ||
560 				    ISSET(lflag, ECHOKE))
561 					ttyecho('\n', tp);
562 				FLUSHQ(&tp->t_rawq);
563 				tp->t_rocount = 0;
564 			}
565 			CLR(tp->t_state, TS_LOCAL);
566 			goto endcase;
567 		}
568 		/*
569 		 * word erase (^W)
570 		 */
571 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
572 			int ctype;
573 
574 			/*
575 			 * erase whitespace
576 			 */
577 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
578 				ttyrub(c, tp);
579 			if (c == -1)
580 				goto endcase;
581 			/*
582 			 * erase last char of word and remember the
583 			 * next chars type (for ALTWERASE)
584 			 */
585 			ttyrub(c, tp);
586 			c = clist_unputc(&tp->t_rawq);
587 			if (c == -1)
588 				goto endcase;
589 			if (c == ' ' || c == '\t') {
590 				clist_putc(c, &tp->t_rawq);
591 				goto endcase;
592 			}
593 			ctype = ISALPHA(c);
594 			/*
595 			 * erase rest of word
596 			 */
597 			do {
598 				ttyrub(c, tp);
599 				c = clist_unputc(&tp->t_rawq);
600 				if (c == -1)
601 					goto endcase;
602 			} while (c != ' ' && c != '\t' &&
603 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
604 			clist_putc(c, &tp->t_rawq);
605 			goto endcase;
606 		}
607 		/*
608 		 * reprint line (^R)
609 		 */
610 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
611 			ttyretype(tp);
612 			goto endcase;
613 		}
614 		/*
615 		 * ^T - kernel info and generate SIGINFO
616 		 */
617 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
618 			if (ISSET(lflag, ISIG))
619 				pgsignal(tp->t_pgrp, SIGINFO, 1);
620 			if (!ISSET(lflag, NOKERNINFO))
621 				ttyinfo(tp);
622 			goto endcase;
623 		}
624 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
625 			if (ISSET(lflag, ISIG))
626 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
627 			goto endcase;
628 		}
629 	}
630 	/*
631 	 * Check for input buffer overflow
632 	 */
633 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
634 input_overflow:
635 		if (ISSET(iflag, IMAXBEL)) {
636 			if (tp->t_outq.c_cc < tp->t_ohiwat)
637 				(void)ttyoutput(CTRL('g'), tp);
638 		}
639 		goto endcase;
640 	}
641 
642 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
643 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
644 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
645 
646 	/*
647 	 * Put data char in q for user and
648 	 * wakeup on seeing a line delimiter.
649 	 */
650 	if (clist_putc(c, &tp->t_rawq) >= 0) {
651 		if (!ISSET(lflag, ICANON)) {
652 			ttwakeup(tp);
653 			ttyecho(c, tp);
654 			goto endcase;
655 		}
656 		if (TTBREAKC(c, lflag)) {
657 			tp->t_rocount = 0;
658 			catq(&tp->t_rawq, &tp->t_canq);
659 			ttwakeup(tp);
660 		} else if (tp->t_rocount++ == 0)
661 			tp->t_rocol = tp->t_column;
662 		if (ISSET(tp->t_state, TS_ERASE)) {
663 			/*
664 			 * end of prterase \.../
665 			 */
666 			CLR(tp->t_state, TS_ERASE);
667 			(void)ttyoutput('/', tp);
668 		}
669 		i = tp->t_column;
670 		ttyecho(c, tp);
671 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
672 			/*
673 			 * Place the cursor over the '^' of the ^D.
674 			 */
675 			i = imin(2, tp->t_column - i);
676 			while (i > 0) {
677 				(void)ttyoutput('\b', tp);
678 				i--;
679 			}
680 		}
681 	}
682 endcase:
683 	/*
684 	 * IXANY means allow any character to restart output.
685 	 */
686 	if (ISSET(tp->t_state, TS_TTSTOP) &&
687 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
688 		return (0);
689 restartoutput:
690 	CLR(tp->t_lflag, FLUSHO);
691 	CLR(tp->t_state, TS_TTSTOP);
692 startoutput:
693 	return (ttstart(tp));
694 }
695 
696 /*
697  * Output a single character on a tty, doing output processing
698  * as needed (expanding tabs, newline processing, etc.).
699  * Returns < 0 if succeeds, otherwise returns char to resend.
700  * Must be recursive.
701  */
702 static int
703 ttyoutput(int c, struct tty *tp)
704 {
705 	tcflag_t oflag;
706 	int col;
707 
708 	oflag = tp->t_oflag;
709 	if (!ISSET(oflag, OPOST)) {
710 		if (ISSET(tp->t_lflag, FLUSHO))
711 			return (-1);
712 		if (clist_putc(c, &tp->t_outq))
713 			return (c);
714 		tk_nout++;
715 		tp->t_outcc++;
716 		return (-1);
717 	}
718 	/*
719 	 * Do tab expansion if OXTABS is set.  Special case if we external
720 	 * processing, we don't do the tab expansion because we'll probably
721 	 * get it wrong.  If tab expansion needs to be done, let it happen
722 	 * externally.
723 	 */
724 	CLR(c, ~TTY_CHARMASK);
725 	if (c == '\t' &&
726 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
727 		c = 8 - (tp->t_column & 7);
728 		if (!ISSET(tp->t_lflag, FLUSHO)) {
729 			crit_enter();		/* Don't interrupt tabs. */
730 			c -= b_to_q("        ", c, &tp->t_outq);
731 			tk_nout += c;
732 			tp->t_outcc += c;
733 			crit_exit();
734 		}
735 		tp->t_column += c;
736 		return (c ? -1 : '\t');
737 	}
738 	if (c == CEOT && ISSET(oflag, ONOEOT))
739 		return (-1);
740 
741 	/*
742 	 * Newline translation: if ONLCR is set,
743 	 * translate newline into "\r\n".
744 	 */
745 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
746 		tk_nout++;
747 		tp->t_outcc++;
748 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq))
749 			return (c);
750 	}
751 	/* If OCRNL is set, translate "\r" into "\n". */
752 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
753 		c = '\n';
754 	/* If ONOCR is set, don't transmit CRs when on column 0. */
755 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
756 		return (-1);
757 
758 	tk_nout++;
759 	tp->t_outcc++;
760 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq))
761 		return (c);
762 
763 	col = tp->t_column;
764 	switch (CCLASS(c)) {
765 	case BACKSPACE:
766 		if (col > 0)
767 			--col;
768 		break;
769 	case CONTROL:
770 		break;
771 	case NEWLINE:
772 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
773 			col = 0;
774 		break;
775 	case RETURN:
776 		col = 0;
777 		break;
778 	case ORDINARY:
779 		++col;
780 		break;
781 	case TAB:
782 		col = (col + 8) & ~7;
783 		break;
784 	}
785 	tp->t_column = col;
786 	return (-1);
787 }
788 
789 /*
790  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
791  * has been called to do discipline-specific functions and/or reject any
792  * of these ioctl commands.
793  */
794 /* ARGSUSED */
795 int
796 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
797 {
798 	struct thread *td = curthread;
799 	struct lwp *lp = td->td_lwp;
800 	struct proc *p = td->td_proc;
801 	int error;
802 
803 	KKASSERT(p);
804 
805 	/* If the ioctl involves modification, hang if in the background. */
806 	switch (cmd) {
807 	case  TIOCCBRK:
808 	case  TIOCCONS:
809 	case  TIOCDRAIN:
810 	case  TIOCEXCL:
811 	case  TIOCFLUSH:
812 #ifdef TIOCHPCL
813 	case  TIOCHPCL:
814 #endif
815 	case  TIOCNXCL:
816 	case  TIOCSBRK:
817 	case  TIOCSCTTY:
818 	case  TIOCSDRAINWAIT:
819 	case  TIOCSETA:
820 	case  TIOCSETAF:
821 	case  TIOCSETAW:
822 	case  TIOCSETD:
823 	case  TIOCSPGRP:
824 	case  TIOCSTART:
825 	case  TIOCSTAT:
826 	case  TIOCSTI:
827 	case  TIOCSTOP:
828 	case  TIOCSWINSZ:
829 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
830 	case  TIOCLBIC:
831 	case  TIOCLBIS:
832 	case  TIOCLSET:
833 	case  TIOCSETC:
834 	case OTIOCSETD:
835 	case  TIOCSETN:
836 	case  TIOCSETP:
837 	case  TIOCSLTC:
838 #endif
839 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
840 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
841 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
842 			if (p->p_pgrp->pg_jobc == 0)
843 				return (EIO);
844 			pgsignal(p->p_pgrp, SIGTTOU, 1);
845 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
846 					 0);
847 			if (error)
848 				return (error);
849 		}
850 		break;
851 	}
852 
853 	switch (cmd) {			/* Process the ioctl. */
854 	case FIOASYNC:			/* set/clear async i/o */
855 		crit_enter();
856 		if (*(int *)data)
857 			SET(tp->t_state, TS_ASYNC);
858 		else
859 			CLR(tp->t_state, TS_ASYNC);
860 		crit_exit();
861 		break;
862 	case FIONREAD:			/* get # bytes to read */
863 		crit_enter();
864 		*(int *)data = ttnread(tp);
865 		crit_exit();
866 		break;
867 
868 	case FIOSETOWN:
869 		/*
870 		 * Policy -- Don't allow FIOSETOWN on someone else's
871 		 *           controlling tty
872 		 */
873 		if (tp->t_session != NULL && !isctty(p, tp))
874 			return (ENOTTY);
875 
876 		error = fsetown(*(int *)data, &tp->t_sigio);
877 		if (error)
878 			return (error);
879 		break;
880 	case FIOGETOWN:
881 		if (tp->t_session != NULL && !isctty(p, tp))
882 			return (ENOTTY);
883 		*(int *)data = fgetown(tp->t_sigio);
884 		break;
885 
886 	case TIOCEXCL:			/* set exclusive use of tty */
887 		crit_enter();
888 		SET(tp->t_state, TS_XCLUDE);
889 		crit_exit();
890 		break;
891 	case TIOCFLUSH: {		/* flush buffers */
892 		int flags = *(int *)data;
893 
894 		if (flags == 0)
895 			flags = FREAD | FWRITE;
896 		else
897 			flags &= FREAD | FWRITE;
898 		ttyflush(tp, flags);
899 		break;
900 	}
901 	case TIOCCONS:			/* become virtual console */
902 		if (*(int *)data) {
903 			if (constty && constty != tp &&
904 			    ISSET(constty->t_state, TS_CONNECTED))
905 				return (EBUSY);
906 #ifndef	UCONSOLE
907 			if ((error = priv_check(td, PRIV_ROOT)) != 0)
908 				return (error);
909 #endif
910 			constty = tp;
911 		} else if (tp == constty)
912 			constty = NULL;
913 		break;
914 	case TIOCDRAIN:			/* wait till output drained */
915 		error = ttywait(tp);
916 		if (error)
917 			return (error);
918 		break;
919 	case TIOCGETA: {		/* get termios struct */
920 		struct termios *t = (struct termios *)data;
921 
922 		bcopy(&tp->t_termios, t, sizeof(struct termios));
923 		break;
924 	}
925 	case TIOCGETD:			/* get line discipline */
926 		*(int *)data = tp->t_line;
927 		break;
928 	case TIOCGWINSZ:		/* get window size */
929 		*(struct winsize *)data = tp->t_winsize;
930 		break;
931 	case TIOCGPGRP:			/* get pgrp of tty */
932 		if (!isctty(p, tp))
933 			return (ENOTTY);
934 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
935 		break;
936 	case TIOCGSID:                  /* get sid of tty */
937 		if (!isctty(p, tp))
938 			return (ENOTTY);
939 		*(int *)data = tp->t_session->s_sid;
940 		break;
941 #ifdef TIOCHPCL
942 	case TIOCHPCL:			/* hang up on last close */
943 		crit_enter();
944 		SET(tp->t_cflag, HUPCL);
945 		crit_exit();
946 		break;
947 #endif
948 	case TIOCNXCL:			/* reset exclusive use of tty */
949 		crit_enter();
950 		CLR(tp->t_state, TS_XCLUDE);
951 		crit_exit();
952 		break;
953 	case TIOCOUTQ:			/* output queue size */
954 		*(int *)data = tp->t_outq.c_cc;
955 		break;
956 	case TIOCSETA:			/* set termios struct */
957 	case TIOCSETAW:			/* drain output, set */
958 	case TIOCSETAF: {		/* drn out, fls in, set */
959 		struct termios *t = (struct termios *)data;
960 
961 		if (t->c_ispeed == 0)
962 			t->c_ispeed = t->c_ospeed;
963 		if (t->c_ispeed == 0)
964 			t->c_ispeed = tp->t_ospeed;
965 		if (t->c_ispeed == 0)
966 			return (EINVAL);
967 		crit_enter();
968 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
969 			error = ttywait(tp);
970 			if (error) {
971 				crit_exit();
972 				return (error);
973 			}
974 			if (cmd == TIOCSETAF)
975 				ttyflush(tp, FREAD);
976 		}
977 		if (!ISSET(t->c_cflag, CIGNORE)) {
978 			/*
979 			 * Set device hardware.
980 			 */
981 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
982 				crit_exit();
983 				return (error);
984 			}
985 			if (ISSET(t->c_cflag, CLOCAL) &&
986 			    !ISSET(tp->t_cflag, CLOCAL)) {
987 				/*
988 				 * XXX disconnections would be too hard to
989 				 * get rid of without this kludge.  The only
990 				 * way to get rid of controlling terminals
991 				 * is to exit from the session leader.
992 				 */
993 				CLR(tp->t_state, TS_ZOMBIE);
994 
995 				wakeup(TSA_CARR_ON(tp));
996 				ttwakeup(tp);
997 				ttwwakeup(tp);
998 			}
999 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1000 			     ISSET(t->c_cflag, CLOCAL)) &&
1001 			    !ISSET(tp->t_state, TS_ZOMBIE))
1002 				SET(tp->t_state, TS_CONNECTED);
1003 			else
1004 				CLR(tp->t_state, TS_CONNECTED);
1005 			tp->t_cflag = t->c_cflag;
1006 			tp->t_ispeed = t->c_ispeed;
1007 			if (t->c_ospeed != 0)
1008 				tp->t_ospeed = t->c_ospeed;
1009 			ttsetwater(tp);
1010 		}
1011 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1012 		    cmd != TIOCSETAF) {
1013 			if (ISSET(t->c_lflag, ICANON))
1014 				SET(tp->t_lflag, PENDIN);
1015 			else {
1016 				/*
1017 				 * XXX we really shouldn't allow toggling
1018 				 * ICANON while we're in a non-termios line
1019 				 * discipline.  Now we have to worry about
1020 				 * panicing for a null queue.
1021 				 */
1022 				if (tp->t_canq.c_cbreserved > 0 &&
1023 				    tp->t_rawq.c_cbreserved > 0) {
1024 					catq(&tp->t_rawq, &tp->t_canq);
1025 					/*
1026 					 * XXX the queue limits may be
1027 					 * different, so the old queue
1028 					 * swapping method no longer works.
1029 					 */
1030 					catq(&tp->t_canq, &tp->t_rawq);
1031 				}
1032 				CLR(tp->t_lflag, PENDIN);
1033 			}
1034 			ttwakeup(tp);
1035 		}
1036 		tp->t_iflag = t->c_iflag;
1037 		tp->t_oflag = t->c_oflag;
1038 		/*
1039 		 * Make the EXTPROC bit read only.
1040 		 */
1041 		if (ISSET(tp->t_lflag, EXTPROC))
1042 			SET(t->c_lflag, EXTPROC);
1043 		else
1044 			CLR(t->c_lflag, EXTPROC);
1045 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1046 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1047 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1048 			ttwakeup(tp);
1049 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1050 		crit_exit();
1051 		break;
1052 	}
1053 	case TIOCSETD: {		/* set line discipline */
1054 		int t = *(int *)data;
1055 		cdev_t device = tp->t_dev;
1056 
1057 		if ((u_int)t >= nlinesw)
1058 			return (ENXIO);
1059 		if (t != tp->t_line) {
1060 			crit_enter();
1061 			(*linesw[tp->t_line].l_close)(tp, flag);
1062 			error = (*linesw[t].l_open)(device, tp);
1063 			if (error) {
1064 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1065 				crit_exit();
1066 				return (error);
1067 			}
1068 			tp->t_line = t;
1069 			crit_exit();
1070 		}
1071 		break;
1072 	}
1073 	case TIOCSTART:			/* start output, like ^Q */
1074 		crit_enter();
1075 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1076 		    ISSET(tp->t_lflag, FLUSHO)) {
1077 			CLR(tp->t_lflag, FLUSHO);
1078 			CLR(tp->t_state, TS_TTSTOP);
1079 			ttstart(tp);
1080 		}
1081 		crit_exit();
1082 		break;
1083 	case TIOCSTI:			/* simulate terminal input */
1084 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT))
1085 			return (EPERM);
1086 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT))
1087 			return (EACCES);
1088 		crit_enter();
1089 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1090 		crit_exit();
1091 		break;
1092 	case TIOCSTOP:			/* stop output, like ^S */
1093 		crit_enter();
1094 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1095 			SET(tp->t_state, TS_TTSTOP);
1096 			(*tp->t_stop)(tp, 0);
1097 		}
1098 		crit_exit();
1099 		break;
1100 	case TIOCSCTTY:			/* become controlling tty */
1101 		/* Session ctty vnode pointer set in vnode layer. */
1102 		if (!SESS_LEADER(p) ||
1103 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1104 		    (tp->t_session != p->p_session)))
1105 			return (EPERM);
1106 		tp->t_session = p->p_session;
1107 		tp->t_pgrp = p->p_pgrp;
1108 		p->p_session->s_ttyp = tp;
1109 		p->p_flag |= P_CONTROLT;
1110 		break;
1111 	case TIOCSPGRP: {		/* set pgrp of tty */
1112 		pid_t pgid = *(int *)data;
1113 
1114 		if (!isctty(p, tp))
1115 			return (ENOTTY);
1116 		else if (pgid < 1 || pgid > PID_MAX)
1117 			return (EINVAL);
1118 		else {
1119 			struct pgrp *pgrp = pgfind(pgid);
1120 			if (pgrp == NULL || pgrp->pg_session != p->p_session)
1121 				return (EPERM);
1122 
1123 			tp->t_pgrp = pgrp;
1124 		}
1125 		break;
1126 	}
1127 	case TIOCSTAT:			/* simulate control-T */
1128 		crit_enter();
1129 		ttyinfo(tp);
1130 		crit_exit();
1131 		break;
1132 	case TIOCSWINSZ:		/* set window size */
1133 		if (bcmp((caddr_t)&tp->t_winsize, data,
1134 		    sizeof (struct winsize))) {
1135 			tp->t_winsize = *(struct winsize *)data;
1136 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1137 		}
1138 		break;
1139 	case TIOCSDRAINWAIT:
1140 		error = priv_check(td, PRIV_ROOT);
1141 		if (error)
1142 			return (error);
1143 		tp->t_timeout = *(int *)data * hz;
1144 		wakeup(TSA_OCOMPLETE(tp));
1145 		wakeup(TSA_OLOWAT(tp));
1146 		break;
1147 	case TIOCGDRAINWAIT:
1148 		*(int *)data = tp->t_timeout / hz;
1149 		break;
1150 	default:
1151 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1152 		return (ttcompat(tp, cmd, data, flag));
1153 #else
1154 		return (ENOIOCTL);
1155 #endif
1156 	}
1157 	return (0);
1158 }
1159 
1160 int
1161 ttypoll(struct dev_poll_args *ap)
1162 {
1163 	cdev_t dev = ap->a_head.a_dev;
1164 	int events = ap->a_events;
1165 	int revents = 0;
1166 	struct tty *tp;
1167 
1168 	tp = dev->si_tty;
1169 	/* XXX used to return ENXIO, but that means true! */
1170 	if (tp == NULL) {
1171 		ap->a_events = (events & (POLLIN | POLLOUT | POLLRDNORM |
1172 				POLLWRNORM)) | POLLHUP;
1173 		return(0);
1174 	}
1175 
1176 	crit_enter();
1177 	if (events & (POLLIN | POLLRDNORM)) {
1178 		if (ttnread(tp) > 0 || ISSET(tp->t_state, TS_ZOMBIE))
1179 			revents |= events & (POLLIN | POLLRDNORM);
1180 		else
1181 			selrecord(curthread, &tp->t_rsel);
1182 	}
1183 	if (events & (POLLOUT | POLLWRNORM)) {
1184 		if ((tp->t_outq.c_cc <= tp->t_olowat &&
1185 		     ISSET(tp->t_state, TS_CONNECTED))
1186 		    || ISSET(tp->t_state, TS_ZOMBIE))
1187 			revents |= events & (POLLOUT | POLLWRNORM);
1188 		else
1189 			selrecord(curthread, &tp->t_wsel);
1190 	}
1191 	crit_exit();
1192 	ap->a_events = revents;
1193 	return (0);
1194 }
1195 
1196 static struct filterops ttyread_filtops =
1197 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1198 static struct filterops ttywrite_filtops =
1199 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1200 
1201 int
1202 ttykqfilter(struct dev_kqfilter_args *ap)
1203 {
1204 	cdev_t dev = ap->a_head.a_dev;
1205 	struct knote *kn = ap->a_kn;
1206 	struct tty *tp = dev->si_tty;
1207 	struct klist *klist;
1208 
1209 	ap->a_result = 0;
1210 	switch (kn->kn_filter) {
1211 	case EVFILT_READ:
1212 		klist = &tp->t_rsel.si_note;
1213 		kn->kn_fop = &ttyread_filtops;
1214 		break;
1215 	case EVFILT_WRITE:
1216 		klist = &tp->t_wsel.si_note;
1217 		kn->kn_fop = &ttywrite_filtops;
1218 		break;
1219 	default:
1220 		ap->a_result = 1;
1221 		return (0);
1222 	}
1223 
1224 	kn->kn_hook = (caddr_t)dev;
1225 
1226 	crit_enter();
1227 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1228 	crit_exit();
1229 
1230 	return (0);
1231 }
1232 
1233 static void
1234 filt_ttyrdetach(struct knote *kn)
1235 {
1236 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1237 
1238 	crit_enter();
1239 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
1240 	crit_exit();
1241 }
1242 
1243 static int
1244 filt_ttyread(struct knote *kn, long hint)
1245 {
1246 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1247 
1248 	kn->kn_data = ttnread(tp);
1249 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1250 		kn->kn_flags |= EV_EOF;
1251 		return (1);
1252 	}
1253 	return (kn->kn_data > 0);
1254 }
1255 
1256 static void
1257 filt_ttywdetach(struct knote *kn)
1258 {
1259 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1260 
1261 	crit_enter();
1262 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
1263 	crit_exit();
1264 }
1265 
1266 static int
1267 filt_ttywrite(struct knote *kn, long hint)
1268 {
1269 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1270 
1271 	kn->kn_data = tp->t_outq.c_cc;
1272 	if (ISSET(tp->t_state, TS_ZOMBIE))
1273 		return (1);
1274 	return (kn->kn_data <= tp->t_olowat &&
1275 	    ISSET(tp->t_state, TS_CONNECTED));
1276 }
1277 
1278 /*
1279  * Must be called while in a critical section.
1280  */
1281 static int
1282 ttnread(struct tty *tp)
1283 {
1284 	int nread;
1285 
1286 	if (ISSET(tp->t_lflag, PENDIN))
1287 		ttypend(tp);
1288 	nread = tp->t_canq.c_cc;
1289 	if (!ISSET(tp->t_lflag, ICANON)) {
1290 		nread += tp->t_rawq.c_cc;
1291 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1292 			nread = 0;
1293 	}
1294 	return (nread);
1295 }
1296 
1297 /*
1298  * Wait for output to drain.
1299  */
1300 int
1301 ttywait(struct tty *tp)
1302 {
1303 	int error;
1304 
1305 	error = 0;
1306 	crit_enter();
1307 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1308 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1309 		(*tp->t_oproc)(tp);
1310 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1311 		    ISSET(tp->t_state, TS_CONNECTED)) {
1312 			SET(tp->t_state, TS_SO_OCOMPLETE);
1313 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1314 					 PCATCH, "ttywai",
1315 					 tp->t_timeout);
1316 			if (error) {
1317 				if (error == EWOULDBLOCK)
1318 					error = EIO;
1319 				break;
1320 			}
1321 		} else
1322 			break;
1323 	}
1324 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1325 		error = EIO;
1326 	crit_exit();
1327 	return (error);
1328 }
1329 
1330 /*
1331  * Flush if successfully wait.
1332  */
1333 static int
1334 ttywflush(struct tty *tp)
1335 {
1336 	int error;
1337 
1338 	if ((error = ttywait(tp)) == 0)
1339 		ttyflush(tp, FREAD);
1340 	return (error);
1341 }
1342 
1343 /*
1344  * Flush tty read and/or write queues, notifying anyone waiting.
1345  */
1346 void
1347 ttyflush(struct tty *tp, int rw)
1348 {
1349 	crit_enter();
1350 #if 0
1351 again:
1352 #endif
1353 	if (rw & FWRITE) {
1354 		FLUSHQ(&tp->t_outq);
1355 		CLR(tp->t_state, TS_TTSTOP);
1356 	}
1357 	(*tp->t_stop)(tp, rw);
1358 	if (rw & FREAD) {
1359 		FLUSHQ(&tp->t_canq);
1360 		FLUSHQ(&tp->t_rawq);
1361 		CLR(tp->t_lflag, PENDIN);
1362 		tp->t_rocount = 0;
1363 		tp->t_rocol = 0;
1364 		CLR(tp->t_state, TS_LOCAL);
1365 		ttwakeup(tp);
1366 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1367 			if (rw & FWRITE)
1368 				FLUSHQ(&tp->t_outq);
1369 			ttyunblock(tp);
1370 
1371 			/*
1372 			 * Don't let leave any state that might clobber the
1373 			 * next line discipline (although we should do more
1374 			 * to send the START char).  Not clearing the state
1375 			 * may have caused the "putc to a clist with no
1376 			 * reserved cblocks" panic/kprintf.
1377 			 */
1378 			CLR(tp->t_state, TS_TBLOCK);
1379 
1380 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1381 			if (ISSET(tp->t_iflag, IXOFF)) {
1382 				/*
1383 				 * XXX wait a bit in the hope that the stop
1384 				 * character (if any) will go out.  Waiting
1385 				 * isn't good since it allows races.  This
1386 				 * will be fixed when the stop character is
1387 				 * put in a special queue.  Don't bother with
1388 				 * the checks in ttywait() since the timeout
1389 				 * will save us.
1390 				 */
1391 				SET(tp->t_state, TS_SO_OCOMPLETE);
1392 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1393 					 "ttyfls", hz / 10);
1394 				/*
1395 				 * Don't try sending the stop character again.
1396 				 */
1397 				CLR(tp->t_state, TS_TBLOCK);
1398 				goto again;
1399 			}
1400 #endif
1401 		}
1402 	}
1403 	if (rw & FWRITE) {
1404 		FLUSHQ(&tp->t_outq);
1405 		ttwwakeup(tp);
1406 	}
1407 	crit_exit();
1408 }
1409 
1410 /*
1411  * Copy in the default termios characters.
1412  */
1413 void
1414 termioschars(struct termios *t)
1415 {
1416 
1417 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1418 }
1419 
1420 /*
1421  * Old interface.
1422  */
1423 void
1424 ttychars(struct tty *tp)
1425 {
1426 
1427 	termioschars(&tp->t_termios);
1428 }
1429 
1430 /*
1431  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1432  * on our input flow control bit and propagate the changes to the driver.
1433  * XXX the stop character should be put in a special high priority queue.
1434  */
1435 void
1436 ttyblock(struct tty *tp)
1437 {
1438 
1439 	SET(tp->t_state, TS_TBLOCK);
1440 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1441 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1442 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1443 	ttstart(tp);
1444 }
1445 
1446 /*
1447  * Handle input low water.  Send start character for the IXOFF case.  Turn
1448  * off our input flow control bit and propagate the changes to the driver.
1449  * XXX the start character should be put in a special high priority queue.
1450  */
1451 static void
1452 ttyunblock(struct tty *tp)
1453 {
1454 
1455 	CLR(tp->t_state, TS_TBLOCK);
1456 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1457 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1458 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1459 	ttstart(tp);
1460 }
1461 
1462 #ifdef notyet
1463 /* Not used by any current (i386) drivers. */
1464 /*
1465  * Restart after an inter-char delay.
1466  */
1467 void
1468 ttrstrt(void *tp_arg)
1469 {
1470 	struct tty *tp;
1471 
1472 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1473 
1474 	tp = tp_arg;
1475 	crit_enter();
1476 	CLR(tp->t_state, TS_TIMEOUT);
1477 	ttstart(tp);
1478 	crit_exit();
1479 }
1480 #endif
1481 
1482 int
1483 ttstart(struct tty *tp)
1484 {
1485 
1486 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1487 		(*tp->t_oproc)(tp);
1488 	return (0);
1489 }
1490 
1491 /*
1492  * "close" a line discipline
1493  */
1494 int
1495 ttylclose(struct tty *tp, int flag)
1496 {
1497 
1498 	if (flag & FNONBLOCK || ttywflush(tp))
1499 		ttyflush(tp, FREAD | FWRITE);
1500 	return (0);
1501 }
1502 
1503 /*
1504  * Handle modem control transition on a tty.
1505  * Flag indicates new state of carrier.
1506  * Returns 0 if the line should be turned off, otherwise 1.
1507  */
1508 int
1509 ttymodem(struct tty *tp, int flag)
1510 {
1511 
1512 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1513 		/*
1514 		 * MDMBUF: do flow control according to carrier flag
1515 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1516 		 * works if IXON and IXANY are clear.
1517 		 */
1518 		if (flag) {
1519 			CLR(tp->t_state, TS_CAR_OFLOW);
1520 			CLR(tp->t_state, TS_TTSTOP);
1521 			ttstart(tp);
1522 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1523 			SET(tp->t_state, TS_CAR_OFLOW);
1524 			SET(tp->t_state, TS_TTSTOP);
1525 			(*tp->t_stop)(tp, 0);
1526 		}
1527 	} else if (flag == 0) {
1528 		/*
1529 		 * Lost carrier.
1530 		 */
1531 		CLR(tp->t_state, TS_CARR_ON);
1532 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1533 		    !ISSET(tp->t_cflag, CLOCAL)) {
1534 			SET(tp->t_state, TS_ZOMBIE);
1535 			CLR(tp->t_state, TS_CONNECTED);
1536 			if (tp->t_session && tp->t_session->s_leader)
1537 				ksignal(tp->t_session->s_leader, SIGHUP);
1538 			ttyflush(tp, FREAD | FWRITE);
1539 			return (0);
1540 		}
1541 	} else {
1542 		/*
1543 		 * Carrier now on.
1544 		 */
1545 		SET(tp->t_state, TS_CARR_ON);
1546 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1547 			SET(tp->t_state, TS_CONNECTED);
1548 		wakeup(TSA_CARR_ON(tp));
1549 		ttwakeup(tp);
1550 		ttwwakeup(tp);
1551 	}
1552 	return (1);
1553 }
1554 
1555 /*
1556  * Reinput pending characters after state switch
1557  * call from a critical section.
1558  */
1559 static void
1560 ttypend(struct tty *tp)
1561 {
1562 	struct clist tq;
1563 	int c;
1564 
1565 	CLR(tp->t_lflag, PENDIN);
1566 	SET(tp->t_state, TS_TYPEN);
1567 	/*
1568 	 * XXX this assumes too much about clist internals.  It may even
1569 	 * fail if the cblock slush pool is empty.  We can't allocate more
1570 	 * cblocks here because we are called from an interrupt handler
1571 	 * and clist_alloc_cblocks() can wait.
1572 	 */
1573 	tq = tp->t_rawq;
1574 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1575 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1576 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1577 	while ((c = clist_getc(&tq)) >= 0)
1578 		ttyinput(c, tp);
1579 	CLR(tp->t_state, TS_TYPEN);
1580 }
1581 
1582 /*
1583  * Process a read call on a tty device.
1584  */
1585 int
1586 ttread(struct tty *tp, struct uio *uio, int flag)
1587 {
1588 	struct clist *qp;
1589 	int c;
1590 	tcflag_t lflag;
1591 	cc_t *cc = tp->t_cc;
1592 	struct proc *pp;
1593 	struct lwp *lp;
1594 	int first, error = 0;
1595 	int has_stime = 0, last_cc = 0;
1596 	long slp = 0;		/* XXX this should be renamed `timo'. */
1597 	struct timeval stime;
1598 
1599 	lp = curthread->td_lwp;
1600 
1601 loop:
1602 	crit_enter();
1603 	lflag = tp->t_lflag;
1604 	/*
1605 	 * take pending input first
1606 	 */
1607 	if (ISSET(lflag, PENDIN)) {
1608 		ttypend(tp);
1609 		splz();		/* reduce latency */
1610 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1611 	}
1612 
1613 	/*
1614 	 * Hang process if it's in the background.
1615 	 */
1616 	if ((pp = curproc) && isbackground(pp, tp)) {
1617 		crit_exit();
1618 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1619 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1620 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0)
1621 			return (EIO);
1622 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1623 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1624 		if (error)
1625 			return (error);
1626 		goto loop;
1627 	}
1628 
1629 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1630 		crit_exit();
1631 		return (0);	/* EOF */
1632 	}
1633 
1634 	/*
1635 	 * If canonical, use the canonical queue,
1636 	 * else use the raw queue.
1637 	 *
1638 	 * (should get rid of clists...)
1639 	 */
1640 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1641 
1642 	if (flag & IO_NDELAY) {
1643 		if (qp->c_cc > 0)
1644 			goto read;
1645 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1646 			crit_exit();
1647 			return (0);
1648 		}
1649 		crit_exit();
1650 		return (EWOULDBLOCK);
1651 	}
1652 	if (!ISSET(lflag, ICANON)) {
1653 		int m = cc[VMIN];
1654 		long t = cc[VTIME];
1655 		struct timeval timecopy;
1656 
1657 		/*
1658 		 * Check each of the four combinations.
1659 		 * (m > 0 && t == 0) is the normal read case.
1660 		 * It should be fairly efficient, so we check that and its
1661 		 * companion case (m == 0 && t == 0) first.
1662 		 * For the other two cases, we compute the target sleep time
1663 		 * into slp.
1664 		 */
1665 		if (t == 0) {
1666 			if (qp->c_cc < m)
1667 				goto sleep;
1668 			if (qp->c_cc > 0)
1669 				goto read;
1670 
1671 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1672 			crit_exit();
1673 			return (0);
1674 		}
1675 		t *= 100000;		/* time in us */
1676 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1677 			 ((t1).tv_usec - (t2).tv_usec))
1678 		if (m > 0) {
1679 			if (qp->c_cc <= 0)
1680 				goto sleep;
1681 			if (qp->c_cc >= m)
1682 				goto read;
1683 			getmicrotime(&timecopy);
1684 			if (!has_stime) {
1685 				/* first character, start timer */
1686 				has_stime = 1;
1687 				stime = timecopy;
1688 				slp = t;
1689 			} else if (qp->c_cc > last_cc) {
1690 				/* got a character, restart timer */
1691 				stime = timecopy;
1692 				slp = t;
1693 			} else {
1694 				/* nothing, check expiration */
1695 				slp = t - diff(timecopy, stime);
1696 				if (slp <= 0)
1697 					goto read;
1698 			}
1699 			last_cc = qp->c_cc;
1700 		} else {	/* m == 0 */
1701 			if (qp->c_cc > 0)
1702 				goto read;
1703 			getmicrotime(&timecopy);
1704 			if (!has_stime) {
1705 				has_stime = 1;
1706 				stime = timecopy;
1707 				slp = t;
1708 			} else {
1709 				slp = t - diff(timecopy, stime);
1710 				if (slp <= 0) {
1711 					/* Timed out, but 0 is enough input. */
1712 					crit_exit();
1713 					return (0);
1714 				}
1715 			}
1716 		}
1717 #undef diff
1718 		/*
1719 		 * Rounding down may make us wake up just short
1720 		 * of the target, so we round up.
1721 		 * The formula is ceiling(slp * hz/1000000).
1722 		 * 32-bit arithmetic is enough for hz < 169.
1723 		 * XXX see tvtohz() for how to avoid overflow if hz
1724 		 * is large (divide by `tick' and/or arrange to
1725 		 * use tvtohz() if hz is large).
1726 		 */
1727 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1728 		goto sleep;
1729 	}
1730 	if (qp->c_cc <= 0) {
1731 sleep:
1732 		/*
1733 		 * There is no input, or not enough input and we can block.
1734 		 */
1735 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1736 				 ISSET(tp->t_state, TS_CONNECTED) ?
1737 				 "ttyin" : "ttyhup", (int)slp);
1738 		crit_exit();
1739 		if (error == EWOULDBLOCK)
1740 			error = 0;
1741 		else if (error)
1742 			return (error);
1743 		/*
1744 		 * XXX what happens if another process eats some input
1745 		 * while we are asleep (not just here)?  It would be
1746 		 * safest to detect changes and reset our state variables
1747 		 * (has_stime and last_cc).
1748 		 */
1749 		slp = 0;
1750 		goto loop;
1751 	}
1752 read:
1753 	crit_exit();
1754 	/*
1755 	 * Input present, check for input mapping and processing.
1756 	 */
1757 	first = 1;
1758 	if (ISSET(lflag, ICANON | ISIG))
1759 		goto slowcase;
1760 	for (;;) {
1761 		char ibuf[IBUFSIZ];
1762 		int icc;
1763 
1764 		icc = (int)szmin(uio->uio_resid, IBUFSIZ);
1765 		icc = q_to_b(qp, ibuf, icc);
1766 		if (icc <= 0) {
1767 			if (first)
1768 				goto loop;
1769 			break;
1770 		}
1771 		error = uiomove(ibuf, (size_t)icc, uio);
1772 		/*
1773 		 * XXX if there was an error then we should ungetc() the
1774 		 * unmoved chars and reduce icc here.
1775 		 */
1776 		if (error)
1777 			break;
1778  		if (uio->uio_resid == 0)
1779 			break;
1780 		first = 0;
1781 	}
1782 	goto out;
1783 slowcase:
1784 	for (;;) {
1785 		c = clist_getc(qp);
1786 		if (c < 0) {
1787 			if (first)
1788 				goto loop;
1789 			break;
1790 		}
1791 		/*
1792 		 * delayed suspend (^Y)
1793 		 */
1794 		if (CCEQ(cc[VDSUSP], c) &&
1795 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1796 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1797 			if (first) {
1798 				error = ttysleep(tp, &lbolt, PCATCH,
1799 						 "ttybg3", 0);
1800 				if (error)
1801 					break;
1802 				goto loop;
1803 			}
1804 			break;
1805 		}
1806 		/*
1807 		 * Interpret EOF only in canonical mode.
1808 		 */
1809 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1810 			break;
1811 		/*
1812 		 * Give user character.
1813 		 */
1814  		error = ureadc(c, uio);
1815 		if (error)
1816 			/* XXX should ungetc(c, qp). */
1817 			break;
1818  		if (uio->uio_resid == 0)
1819 			break;
1820 		/*
1821 		 * In canonical mode check for a "break character"
1822 		 * marking the end of a "line of input".
1823 		 */
1824 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1825 			break;
1826 		first = 0;
1827 	}
1828 
1829 out:
1830 	/*
1831 	 * Look to unblock input now that (presumably)
1832 	 * the input queue has gone down.
1833 	 */
1834 	crit_enter();
1835 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1836 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1837 		ttyunblock(tp);
1838 	crit_exit();
1839 
1840 	return (error);
1841 }
1842 
1843 /*
1844  * Check the output queue on tp for space for a kernel message (from uprintf
1845  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1846  * lose messages due to normal flow control, but don't let the tty run amok.
1847  * Sleeps here are not interruptible, but we return prematurely if new signals
1848  * arrive.
1849  */
1850 int
1851 ttycheckoutq(struct tty *tp, int wait)
1852 {
1853 	struct lwp *lp = curthread->td_lwp;
1854 	int hiwat;
1855 	sigset_t oldset, newset;
1856 
1857 	hiwat = tp->t_ohiwat;
1858 	SIGEMPTYSET(oldset);
1859 	SIGEMPTYSET(newset);
1860 	crit_enter();
1861 	if (wait)
1862 		oldset = lwp_sigpend(lp);
1863 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
1864 		while (tp->t_outq.c_cc > hiwat) {
1865 			ttstart(tp);
1866 			if (tp->t_outq.c_cc <= hiwat)
1867 				break;
1868 			if (wait)
1869 				newset = lwp_sigpend(lp);
1870 			if (!wait || SIGSETNEQ(oldset, newset)) {
1871 				crit_exit();
1872 				return (0);
1873 			}
1874 			SET(tp->t_state, TS_SO_OLOWAT);
1875 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
1876 		}
1877 	}
1878 	crit_exit();
1879 	return (1);
1880 }
1881 
1882 /*
1883  * Process a write call on a tty device.
1884  */
1885 int
1886 ttwrite(struct tty *tp, struct uio *uio, int flag)
1887 {
1888 	char *cp = NULL;
1889 	int cc, ce;
1890 	struct proc *pp;
1891 	struct lwp *lp;
1892 	int i, hiwat, error;
1893 	size_t cnt;
1894 
1895 	char obuf[OBUFSIZ];
1896 
1897 	lp = curthread->td_lwp;
1898 	hiwat = tp->t_ohiwat;
1899 	cnt = uio->uio_resid;
1900 	error = 0;
1901 	cc = 0;
1902 loop:
1903 	crit_enter();
1904 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1905 		crit_exit();
1906 		if (uio->uio_resid == cnt)
1907 			error = EIO;
1908 		goto out;
1909 	}
1910 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
1911 		if (flag & IO_NDELAY) {
1912 			crit_exit();
1913 			error = EWOULDBLOCK;
1914 			goto out;
1915 		}
1916 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
1917 		crit_exit();
1918 		if (error)
1919 			goto out;
1920 		goto loop;
1921 	}
1922 	crit_exit();
1923 
1924 	/*
1925 	 * Hang the process if it's in the background.
1926 	 */
1927 	if ((pp = curproc) && isbackground(pp, tp) &&
1928 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
1929 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
1930 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
1931 		if (pp->p_pgrp->pg_jobc == 0) {
1932 			error = EIO;
1933 			goto out;
1934 		}
1935 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
1936 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
1937 		if (error)
1938 			goto out;
1939 		goto loop;
1940 	}
1941 	/*
1942 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1943 	 * output translation.  Keep track of high water mark, sleep on
1944 	 * overflow awaiting device aid in acquiring new space.
1945 	 */
1946 	while (uio->uio_resid > 0 || cc > 0) {
1947 		if (ISSET(tp->t_lflag, FLUSHO)) {
1948 			uio->uio_resid = 0;
1949 			return (0);
1950 		}
1951 		if (tp->t_outq.c_cc > hiwat)
1952 			goto ovhiwat;
1953 		/*
1954 		 * Grab a hunk of data from the user, unless we have some
1955 		 * leftover from last time.
1956 		 */
1957 		if (cc == 0) {
1958 			cc = szmin(uio->uio_resid, OBUFSIZ);
1959 			cp = obuf;
1960 			error = uiomove(cp, (size_t)cc, uio);
1961 			if (error) {
1962 				cc = 0;
1963 				break;
1964 			}
1965 		}
1966 		/*
1967 		 * If nothing fancy need be done, grab those characters we
1968 		 * can handle without any of ttyoutput's processing and
1969 		 * just transfer them to the output q.  For those chars
1970 		 * which require special processing (as indicated by the
1971 		 * bits in char_type), call ttyoutput.  After processing
1972 		 * a hunk of data, look for FLUSHO so ^O's will take effect
1973 		 * immediately.
1974 		 */
1975 		while (cc > 0) {
1976 			if (!ISSET(tp->t_oflag, OPOST))
1977 				ce = cc;
1978 			else {
1979 				ce = cc - scanc((u_int)cc, (u_char *)cp,
1980 						char_type, CCLASSMASK);
1981 				/*
1982 				 * If ce is zero, then we're processing
1983 				 * a special character through ttyoutput.
1984 				 */
1985 				if (ce == 0) {
1986 					tp->t_rocount = 0;
1987 					if (ttyoutput(*cp, tp) >= 0) {
1988 						/* No Clists, wait a bit. */
1989 						ttstart(tp);
1990 						if (flag & IO_NDELAY) {
1991 							error = EWOULDBLOCK;
1992 							goto out;
1993 						}
1994 						error = ttysleep(tp, &lbolt,
1995 								 PCATCH,
1996 								 "ttybf1", 0);
1997 						if (error)
1998 							goto out;
1999 						goto loop;
2000 					}
2001 					cp++;
2002 					cc--;
2003 					if (ISSET(tp->t_lflag, FLUSHO) ||
2004 					    tp->t_outq.c_cc > hiwat)
2005 						goto ovhiwat;
2006 					continue;
2007 				}
2008 			}
2009 			/*
2010 			 * A bunch of normal characters have been found.
2011 			 * Transfer them en masse to the output queue and
2012 			 * continue processing at the top of the loop.
2013 			 * If there are any further characters in this
2014 			 * <= OBUFSIZ chunk, the first should be a character
2015 			 * requiring special handling by ttyoutput.
2016 			 */
2017 			tp->t_rocount = 0;
2018 			i = b_to_q(cp, ce, &tp->t_outq);
2019 			ce -= i;
2020 			tp->t_column += ce;
2021 			cp += ce, cc -= ce, tk_nout += ce;
2022 			tp->t_outcc += ce;
2023 			if (i > 0) {
2024 				/* No Clists, wait a bit. */
2025 				ttstart(tp);
2026 				if (flag & IO_NDELAY) {
2027 					error = EWOULDBLOCK;
2028 					goto out;
2029 				}
2030 				error = ttysleep(tp, &lbolt, PCATCH,
2031 						 "ttybf2", 0);
2032 				if (error)
2033 					goto out;
2034 				goto loop;
2035 			}
2036 			if (ISSET(tp->t_lflag, FLUSHO) ||
2037 			    tp->t_outq.c_cc > hiwat)
2038 				break;
2039 		}
2040 		ttstart(tp);
2041 	}
2042 out:
2043 	/*
2044 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2045 	 * offset and iov pointers have moved forward, but it doesn't matter
2046 	 * (the call will either return short or restart with a new uio).
2047 	 */
2048 	uio->uio_resid += cc;
2049 	return (error);
2050 
2051 ovhiwat:
2052 	ttstart(tp);
2053 	crit_enter();
2054 	/*
2055 	 * This can only occur if FLUSHO is set in t_lflag,
2056 	 * or if ttstart/oproc is synchronous (or very fast).
2057 	 */
2058 	if (tp->t_outq.c_cc <= hiwat) {
2059 		crit_exit();
2060 		goto loop;
2061 	}
2062 	if (flag & IO_NDELAY) {
2063 		crit_exit();
2064 		uio->uio_resid += cc;
2065 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2066 	}
2067 	SET(tp->t_state, TS_SO_OLOWAT);
2068 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2069 	crit_exit();
2070 	if (error == EWOULDBLOCK)
2071 		error = EIO;
2072 	if (error)
2073 		goto out;
2074 	goto loop;
2075 }
2076 
2077 /*
2078  * Rubout one character from the rawq of tp
2079  * as cleanly as possible.
2080  */
2081 static void
2082 ttyrub(int c, struct tty *tp)
2083 {
2084 	char *cp;
2085 	int savecol;
2086 	int tabc;
2087 
2088 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2089 		return;
2090 	CLR(tp->t_lflag, FLUSHO);
2091 	if (ISSET(tp->t_lflag, ECHOE)) {
2092 		if (tp->t_rocount == 0) {
2093 			/*
2094 			 * Screwed by ttwrite; retype
2095 			 */
2096 			ttyretype(tp);
2097 			return;
2098 		}
2099 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2100 			ttyrubo(tp, 2);
2101 		else {
2102 			CLR(c, ~TTY_CHARMASK);
2103 			switch (CCLASS(c)) {
2104 			case ORDINARY:
2105 				ttyrubo(tp, 1);
2106 				break;
2107 			case BACKSPACE:
2108 			case CONTROL:
2109 			case NEWLINE:
2110 			case RETURN:
2111 			case VTAB:
2112 				if (ISSET(tp->t_lflag, ECHOCTL))
2113 					ttyrubo(tp, 2);
2114 				break;
2115 			case TAB:
2116 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2117 					ttyretype(tp);
2118 					return;
2119 				}
2120 				crit_enter();
2121 				savecol = tp->t_column;
2122 				SET(tp->t_state, TS_CNTTB);
2123 				SET(tp->t_lflag, FLUSHO);
2124 				tp->t_column = tp->t_rocol;
2125 				cp = tp->t_rawq.c_cf;
2126 				if (cp)
2127 					tabc = *cp;	/* XXX FIX NEXTC */
2128 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2129 					ttyecho(tabc, tp);
2130 				CLR(tp->t_lflag, FLUSHO);
2131 				CLR(tp->t_state, TS_CNTTB);
2132 				crit_exit();
2133 
2134 				/* savecol will now be length of the tab. */
2135 				savecol -= tp->t_column;
2136 				tp->t_column += savecol;
2137 				if (savecol > 8)
2138 					savecol = 8;	/* overflow screw */
2139 				while (--savecol >= 0)
2140 					(void)ttyoutput('\b', tp);
2141 				break;
2142 			default:			/* XXX */
2143 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2144 				(void)kprintf(PANICSTR, c, CCLASS(c));
2145 #ifdef notdef
2146 				panic(PANICSTR, c, CCLASS(c));
2147 #endif
2148 			}
2149 		}
2150 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2151 		if (!ISSET(tp->t_state, TS_ERASE)) {
2152 			SET(tp->t_state, TS_ERASE);
2153 			(void)ttyoutput('\\', tp);
2154 		}
2155 		ttyecho(c, tp);
2156 	} else {
2157 		ttyecho(tp->t_cc[VERASE], tp);
2158 		/*
2159 		 * This code may be executed not only when an ERASE key
2160 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2161 		 * So, I didn't think it was worthwhile to pass the extra
2162 		 * information (which would need an extra parameter,
2163 		 * changing every call) needed to distinguish the ERASE2
2164 		 * case from the ERASE.
2165 		 */
2166 	}
2167 	--tp->t_rocount;
2168 }
2169 
2170 /*
2171  * Back over cnt characters, erasing them.
2172  */
2173 static void
2174 ttyrubo(struct tty *tp, int cnt)
2175 {
2176 
2177 	while (cnt-- > 0) {
2178 		(void)ttyoutput('\b', tp);
2179 		(void)ttyoutput(' ', tp);
2180 		(void)ttyoutput('\b', tp);
2181 	}
2182 }
2183 
2184 /*
2185  * ttyretype --
2186  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2187  *	been checked.
2188  */
2189 static void
2190 ttyretype(struct tty *tp)
2191 {
2192 	char *cp;
2193 	int c;
2194 
2195 	/* Echo the reprint character. */
2196 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2197 		ttyecho(tp->t_cc[VREPRINT], tp);
2198 
2199 	(void)ttyoutput('\n', tp);
2200 
2201 	/*
2202 	 * XXX
2203 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2204 	 * BIT OF FIRST CHAR.
2205 	 */
2206 	crit_enter();
2207 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2208 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2209 		ttyecho(c, tp);
2210 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2211 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2212 		ttyecho(c, tp);
2213 	CLR(tp->t_state, TS_ERASE);
2214 	crit_exit();
2215 
2216 	tp->t_rocount = tp->t_rawq.c_cc;
2217 	tp->t_rocol = 0;
2218 }
2219 
2220 /*
2221  * Echo a typed character to the terminal.
2222  */
2223 static void
2224 ttyecho(int c, struct tty *tp)
2225 {
2226 
2227 	if (!ISSET(tp->t_state, TS_CNTTB))
2228 		CLR(tp->t_lflag, FLUSHO);
2229 	if ((!ISSET(tp->t_lflag, ECHO) &&
2230 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2231 	    ISSET(tp->t_lflag, EXTPROC))
2232 		return;
2233 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2234 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2235 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2236 		(void)ttyoutput('^', tp);
2237 		CLR(c, ~TTY_CHARMASK);
2238 		if (c == 0177)
2239 			c = '?';
2240 		else
2241 			c += 'A' - 1;
2242 	}
2243 	(void)ttyoutput(c, tp);
2244 }
2245 
2246 /*
2247  * Wake up any readers on a tty.
2248  */
2249 void
2250 ttwakeup(struct tty *tp)
2251 {
2252 
2253 	if (tp->t_rsel.si_pid != 0)
2254 		selwakeup(&tp->t_rsel);
2255 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2256 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2257 	wakeup(TSA_HUP_OR_INPUT(tp));
2258 	KNOTE(&tp->t_rsel.si_note, 0);
2259 }
2260 
2261 /*
2262  * Wake up any writers on a tty.
2263  */
2264 void
2265 ttwwakeup(struct tty *tp)
2266 {
2267 
2268 	if (tp->t_wsel.si_pid != 0 && tp->t_outq.c_cc <= tp->t_olowat)
2269 		selwakeup(&tp->t_wsel);
2270 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2271 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2272 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2273 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2274 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2275 		wakeup(TSA_OCOMPLETE(tp));
2276 	}
2277 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2278 	    tp->t_outq.c_cc <= tp->t_olowat) {
2279 		CLR(tp->t_state, TS_SO_OLOWAT);
2280 		wakeup(TSA_OLOWAT(tp));
2281 	}
2282 	KNOTE(&tp->t_wsel.si_note, 0);
2283 }
2284 
2285 /*
2286  * Look up a code for a specified speed in a conversion table;
2287  * used by drivers to map software speed values to hardware parameters.
2288  */
2289 int
2290 ttspeedtab(int speed, struct speedtab *table)
2291 {
2292 
2293 	for ( ; table->sp_speed != -1; table++)
2294 		if (table->sp_speed == speed)
2295 			return (table->sp_code);
2296 	return (-1);
2297 }
2298 
2299 /*
2300  * Set input and output watermarks and buffer sizes.  For input, the
2301  * high watermark is about one second's worth of input above empty, the
2302  * low watermark is slightly below high water, and the buffer size is a
2303  * driver-dependent amount above high water.  For output, the watermarks
2304  * are near the ends of the buffer, with about 1 second's worth of input
2305  * between them.  All this only applies to the standard line discipline.
2306  */
2307 void
2308 ttsetwater(struct tty *tp)
2309 {
2310 	int cps, ttmaxhiwat, x;
2311 
2312 	/* Input. */
2313 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2314 	switch (tp->t_ispeedwat) {
2315 	case (speed_t)-1:
2316 		cps = tp->t_ispeed / 10;
2317 		break;
2318 	case 0:
2319 		/*
2320 		 * This case is for old drivers that don't know about
2321 		 * t_ispeedwat.  Arrange for them to get the old buffer
2322 		 * sizes and watermarks.
2323 		 */
2324 		cps = TTYHOG - 2 * 256;
2325 		tp->t_ififosize = 2 * 2048;
2326 		break;
2327 	default:
2328 		cps = tp->t_ispeedwat / 10;
2329 		break;
2330 	}
2331 	tp->t_ihiwat = cps;
2332 	tp->t_ilowat = 7 * cps / 8;
2333 	x = cps + tp->t_ififosize;
2334 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2335 
2336 	/* Output. */
2337 	switch (tp->t_ospeedwat) {
2338 	case (speed_t)-1:
2339 		cps = tp->t_ospeed / 10;
2340 		ttmaxhiwat = 2 * TTMAXHIWAT;
2341 		break;
2342 	case 0:
2343 		cps = tp->t_ospeed / 10;
2344 		ttmaxhiwat = TTMAXHIWAT;
2345 		break;
2346 	default:
2347 		cps = tp->t_ospeedwat / 10;
2348 		ttmaxhiwat = 8 * TTMAXHIWAT;
2349 		break;
2350 	}
2351 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2352 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2353 	x += cps;
2354 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2355 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2356 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2357 	x += OBUFSIZ + 100;
2358 	clist_alloc_cblocks(&tp->t_outq, x, x);
2359 #undef	CLAMP
2360 }
2361 
2362 /*
2363  * Report on state of foreground process group.
2364  */
2365 void
2366 ttyinfo(struct tty *tp)
2367 {
2368 	struct proc *p, *pick;
2369 	struct lwp *lp;
2370 	struct rusage ru;
2371 	int tmp;
2372 
2373 	if (ttycheckoutq(tp,0) == 0)
2374 		return;
2375 
2376 	/*
2377 	 * We always print the load average, then figure out what else to
2378 	 * print based on the state of the current process group.
2379 	 */
2380 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2381 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2382 
2383 	if (tp->t_session == NULL) {
2384 		ttyprintf(tp, "not a controlling terminal\n");
2385 	} else if (tp->t_pgrp == NULL) {
2386 		ttyprintf(tp, "no foreground process group\n");
2387 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == 0) {
2388 		ttyprintf(tp, "empty foreground process group\n");
2389 	} else {
2390 		/*
2391 		 * Pick an interesting process.  Note that certain elements,
2392 		 * in particular the wmesg, require a critical section for
2393 		 * safe access (YYY and we are still not MP safe).
2394 		 *
2395 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2396 		 */
2397 		char buf[64];
2398 		const char *str;
2399 		long vmsz;
2400 		int pctcpu;
2401 
2402 		crit_enter();
2403 
2404 		/* XXX lwp should compare lwps */
2405 
2406 		for (pick = NULL; p != 0; p = LIST_NEXT(p, p_pglist)) {
2407 			if (proc_compare(pick, p))
2408 				pick = p;
2409 		}
2410 
2411 		/* XXX lwp */
2412 		lp = FIRST_LWP_IN_PROC(pick);
2413 		if (lp == NULL) {
2414 			ttyprintf(tp, "foreground process without lwp\n");
2415 			tp->t_rocount = 0;
2416 			crit_exit();
2417 			return;
2418 		}
2419 
2420 		/*
2421 		 * Figure out what wait/process-state message, and command
2422 		 * buffer to present
2423 		 */
2424 		/*
2425 		 * XXX lwp This is a horrible mixture.  We need to rework this
2426 		 * as soon as lwps have their own runnable status.
2427 		 */
2428 		if (pick->p_flag & P_WEXIT)
2429 			str = "exiting";
2430 		else if (lp->lwp_stat == LSRUN)
2431 			str = "running";
2432 		else if (pick->p_stat == SIDL)
2433 			str = "spawning";
2434 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2435 			str = lp->lwp_wmesg;
2436 		else
2437 			str = "iowait";
2438 
2439 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2440 			pick->p_comm, pick->p_pid, str);
2441 
2442 		/*
2443 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2444 		 * 'pick' becomes invalid the moment we exit the critical
2445 		 * section.
2446 		 */
2447 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0)
2448 			calcru_proc(pick, &ru);
2449 
2450 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2451 
2452 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2453 		    vmsz = 0;
2454 		else
2455 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2456 
2457 		crit_exit();
2458 
2459 		/*
2460 		 * Dump the output
2461 		 */
2462 		ttyprintf(tp, " %s ", buf);
2463 		ttyprintf(tp, "%ld.%02ldu ",
2464 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2465 		ttyprintf(tp, "%ld.%02lds ",
2466 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2467 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2468 	}
2469 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2470 }
2471 
2472 /*
2473  * Returns 1 if p2 is "better" than p1
2474  *
2475  * The algorithm for picking the "interesting" process is thus:
2476  *
2477  *	1) Only foreground processes are eligible - implied.
2478  *	2) Runnable processes are favored over anything else.  The runner
2479  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2480  *	   broken by picking the highest pid.
2481  *	3) The sleeper with the shortest sleep time is next.  With ties,
2482  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2483  *	4) Further ties are broken by picking the highest pid.
2484  */
2485 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2486 #define TESTAB(a, b)    ((a)<<1 | (b))
2487 #define ONLYA   2
2488 #define ONLYB   1
2489 #define BOTH    3
2490 
2491 static int
2492 proc_compare(struct proc *p1, struct proc *p2)
2493 {
2494 	struct lwp *lp1, *lp2;
2495 	if (p1 == NULL)
2496 		return (1);
2497 
2498 	/*
2499  	 * weed out zombies
2500 	 */
2501 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2502 	case ONLYA:
2503 		return (1);
2504 	case ONLYB:
2505 		return (0);
2506 	case BOTH:
2507 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2508 	}
2509 
2510 	/* XXX lwp */
2511 	lp1 = FIRST_LWP_IN_PROC(p1);
2512 	lp2 = FIRST_LWP_IN_PROC(p2);
2513 
2514 	/*
2515 	 * see if at least one of them is runnable
2516 	 */
2517 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2518 	case ONLYA:
2519 		return (0);
2520 	case ONLYB:
2521 		return (1);
2522 	case BOTH:
2523 		/*
2524 		 * tie - favor one with highest recent cpu utilization
2525 		 */
2526 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2527 			return (1);
2528 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2529 			return (0);
2530 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2531 	}
2532 	/*
2533 	 * pick the one with the smallest sleep time
2534 	 */
2535 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2536 		return (0);
2537 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2538 		return (1);
2539 	/*
2540 	 * favor one sleeping in a non-interruptible sleep
2541 	 */
2542 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2543 		return (1);
2544 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2545 		return (0);
2546 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2547 }
2548 
2549 /*
2550  * Output char to tty; console putchar style.
2551  */
2552 int
2553 tputchar(int c, struct tty *tp)
2554 {
2555 	crit_enter();
2556 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2557 		crit_exit();
2558 		return (-1);
2559 	}
2560 	if (c == '\n')
2561 		(void)ttyoutput('\r', tp);
2562 	(void)ttyoutput(c, tp);
2563 	ttstart(tp);
2564 	crit_exit();
2565 	return (0);
2566 }
2567 
2568 /*
2569  * Sleep on chan, returning ERESTART if tty changed while we napped and
2570  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2571  * the tty is revoked, restarting a pending call will redo validation done
2572  * at the start of the call.
2573  */
2574 int
2575 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2576 {
2577 	int error;
2578 	int gen;
2579 
2580 	gen = tp->t_gen;
2581 	error = tsleep(chan, slpflags, wmesg, timo);
2582 	if (error)
2583 		return (error);
2584 	return (tp->t_gen == gen ? 0 : ERESTART);
2585 }
2586 
2587 /*
2588  * Revoke a tty.
2589  *
2590  * We bump the gen to force any ttysleep()'s to return with ERESTART
2591  * and flush the tty.  The related fp's should already have been
2592  * replaced so the tty will close when the last references on the
2593  * original fp's go away.
2594  */
2595 int
2596 ttyrevoke(struct dev_revoke_args *ap)
2597 {
2598 	struct tty *tp;
2599 
2600 	tp = ap->a_head.a_dev->si_tty;
2601 	tp->t_gen++;
2602 	ttyflush(tp, FREAD | FWRITE);
2603 	wakeup(TSA_CARR_ON(tp));
2604 	ttwakeup(tp);
2605 	ttwwakeup(tp);
2606 	return (0);
2607 }
2608 
2609 /*
2610  * Allocate a tty struct.  Clists in the struct will be allocated by
2611  * ttyopen().
2612  */
2613 struct tty *
2614 ttymalloc(struct tty *tp)
2615 {
2616 
2617 	if (tp) {
2618 		return(tp);
2619 	}
2620 	tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2621 	ttyregister(tp);
2622         return (tp);
2623 }
2624 
2625 #if 0
2626 /*
2627  * Free a tty struct.  Clists in the struct should have been freed by
2628  * ttyclose().
2629  *
2630  * XXX not yet usable: since we support a half-closed state and do not
2631  * ref count the tty reference from the session, it is possible for a
2632  * session to hold a ref on the tty.  See TTY_DO_FULL_CLOSE.
2633  */
2634 void
2635 ttyfree(struct tty *tp)
2636 {
2637         kfree(tp, M_TTYS);
2638 }
2639 #endif /* 0 */
2640 
2641 void
2642 ttyregister(struct tty *tp)
2643 {
2644 	SLIST_INSERT_HEAD(&tty_list, tp, t_list);
2645 }
2646 
2647 static int
2648 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2649 {
2650 	int error;
2651 	struct tty *tp, t;
2652 	SLIST_FOREACH(tp, &tty_list, t_list) {
2653 		t = *tp;
2654 		if (t.t_dev)
2655 			t.t_dev = (cdev_t)(uintptr_t)dev2udev(t.t_dev);
2656 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2657 		if (error)
2658 			return (error);
2659 	}
2660 	return (0);
2661 }
2662 
2663 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2664 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2665 
2666 void
2667 nottystop(struct tty *tp, int rw)
2668 {
2669 
2670 	return;
2671 }
2672 
2673 int
2674 ttyread(struct dev_read_args *ap)
2675 {
2676 	struct tty *tp;
2677 
2678 	tp = ap->a_head.a_dev->si_tty;
2679 	if (tp == NULL)
2680 		return (ENODEV);
2681 	return ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2682 }
2683 
2684 int
2685 ttywrite(struct dev_write_args *ap)
2686 {
2687 	struct tty *tp;
2688 
2689 	tp = ap->a_head.a_dev->si_tty;
2690 	if (tp == NULL)
2691 		return (ENODEV);
2692 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2693 }
2694