xref: /dragonfly/sys/kern/tty.c (revision 2038fb68)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
39  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
40  * $DragonFly: src/sys/kern/tty.c,v 1.46 2008/09/10 09:50:09 y0netan1 Exp $
41  */
42 
43 /*-
44  * TODO:
45  *	o Fix races for sending the start char in ttyflush().
46  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
47  *	  With luck, there will be MIN chars before select() returns().
48  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
49  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
50  *	  FIONREAD.
51  *	o Do the new sio locking stuff here and use it to avoid special
52  *	  case for EXTPROC?
53  *	o Lock PENDIN too?
54  *	o Move EXTPROC and/or PENDIN to t_state?
55  *	o Wrap most of ttioctl in spltty/splx.
56  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
57  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
58  *	o Don't allow certain termios flags to affect disciplines other
59  *	  than TTYDISC.  Cancel their effects before switch disciplines
60  *	  and ignore them if they are set while we are in another
61  *	  discipline.
62  *	o Now that historical speed conversions are handled here, don't
63  *	  do them in drivers.
64  *	o Check for TS_CARR_ON being set while everything is closed and not
65  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
66  *	  so it would live until the next open even if carrier drops.
67  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
68  *	  only when _all_ openers leave open().
69  */
70 
71 #include "opt_compat.h"
72 #include "opt_uconsole.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/filio.h>
77 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
78 #include <sys/ioctl_compat.h>
79 #endif
80 #include <sys/proc.h>
81 #include <sys/priv.h>
82 #define	TTYDEFCHARS
83 #include <sys/tty.h>
84 #include <sys/clist.h>
85 #undef	TTYDEFCHARS
86 #include <sys/fcntl.h>
87 #include <sys/conf.h>
88 #include <sys/dkstat.h>
89 #include <sys/poll.h>
90 #include <sys/kernel.h>
91 #include <sys/vnode.h>
92 #include <sys/signalvar.h>
93 #include <sys/signal2.h>
94 #include <sys/resourcevar.h>
95 #include <sys/malloc.h>
96 #include <sys/filedesc.h>
97 #include <sys/sysctl.h>
98 #include <sys/thread2.h>
99 
100 #include <vm/vm.h>
101 #include <sys/lock.h>
102 #include <vm/pmap.h>
103 #include <vm/vm_map.h>
104 
105 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
106 
107 static int	proc_compare (struct proc *p1, struct proc *p2);
108 static int	ttnread (struct tty *tp);
109 static void	ttyecho (int c, struct tty *tp);
110 static int	ttyoutput (int c, struct tty *tp);
111 static void	ttypend (struct tty *tp);
112 static void	ttyretype (struct tty *tp);
113 static void	ttyrub (int c, struct tty *tp);
114 static void	ttyrubo (struct tty *tp, int cnt);
115 static void	ttyunblock (struct tty *tp);
116 static int	ttywflush (struct tty *tp);
117 static int	filt_ttyread (struct knote *kn, long hint);
118 static void 	filt_ttyrdetach (struct knote *kn);
119 static int	filt_ttywrite (struct knote *kn, long hint);
120 static void 	filt_ttywdetach (struct knote *kn);
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 static u_char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 /* Macros to clear/set/test flags. */
196 #define	SET(t, f)	(t) |= (f)
197 #define	CLR(t, f)	(t) &= ~(f)
198 #define	ISSET(t, f)	((t) & (f))
199 
200 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
201 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
202 
203 uint64_t tk_nin;
204 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
205     "LU", "TTY input statistic");
206 uint64_t tk_nout;
207 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
208     "LU", "TTY output statistic");
209 uint64_t tk_rawcc;
210 
211 /*
212  * list of struct tty where pstat(8) can pick it up with sysctl
213  */
214 static SLIST_HEAD(, tty) tty_list;
215 
216 /*
217  * Initial open of tty, or (re)entry to standard tty line discipline.
218  */
219 int
220 ttyopen(cdev_t device, struct tty *tp)
221 {
222 	crit_enter();
223 	tp->t_dev = device;
224 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
225 		SET(tp->t_state, TS_ISOPEN);
226 		if (ISSET(tp->t_cflag, CLOCAL))
227 			SET(tp->t_state, TS_CONNECTED);
228 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
229 	}
230 	ttsetwater(tp);
231 	crit_exit();
232 	return (0);
233 }
234 
235 /*
236  * Handle close() on a tty line: flush and set to initial state,
237  * bumping generation number so that pending read/write calls
238  * can detect recycling of the tty.
239  *
240  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
241  * and l_close() should have flushed, but we repeat the spltty() and
242  * the flush in case there are buggy callers.
243  */
244 int
245 ttyclose(struct tty *tp)
246 {
247 	funsetown(tp->t_sigio);
248 	crit_enter();
249 	if (constty == tp)
250 		constty = NULL;
251 
252 	ttyflush(tp, FREAD | FWRITE);
253 	clist_free_cblocks(&tp->t_canq);
254 	clist_free_cblocks(&tp->t_outq);
255 	clist_free_cblocks(&tp->t_rawq);
256 
257 	tp->t_gen++;
258 	tp->t_line = TTYDISC;
259 	ttyclearsession(tp);
260 	tp->t_state = 0;
261 	crit_exit();
262 	return (0);
263 }
264 
265 /*
266  * Disassociate the tty from its session.  Traditionally this has only been
267  * a half-close, meaning that the session was still allowed to point at the
268  * tty (resulting in the tty in the ps command showing something like 'p0-'),
269  * even though the tty is no longer pointing at the session.
270  *
271  * The half close seems to be useful only for 'ps' output but there is as
272  * yet no reason to remove the feature.  The full-close code is currently
273  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
274  */
275 void
276 ttyclearsession(struct tty *tp)
277 {
278 	struct session *sp;
279 
280 	tp->t_pgrp = NULL;
281 	if ((sp = tp->t_session) != NULL) {
282 		tp->t_session = NULL;
283 #ifdef TTY_DO_FULL_CLOSE
284 		/* FULL CLOSE (not yet) */
285 		if (sp->s_ttyp == tp) {
286 			sp->s_ttyp = NULL;
287 		} else {
288 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
289 				"%p/%p\n", sp->s_ttyp, tp);
290 		}
291 #endif
292 	}
293 }
294 
295 /*
296  * Release the tty vnode association for a session.  This is the
297  * 'other half' of the close.  Because multiple opens of /dev/tty
298  * only generate a single open to the actual tty, the file modes
299  * are locked to FREAD|FWRITE.
300  *
301  * If dorevoke is non-zero, the session is also revoked.  We have to
302  * close the vnode if VCTTYISOPEN is set.
303  */
304 void
305 ttyclosesession(struct session *sp, int dorevoke)
306 {
307 	struct vnode *vp;
308 
309 retry:
310 	/*
311 	 * There may not be a controlling terminal or it may have been closed
312 	 * out from under us.
313 	 */
314 	if ((vp = sp->s_ttyvp) == NULL)
315 		return;
316 
317 	/*
318 	 * We need a lock if we have to close or revoke.
319 	 */
320 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
321 		vhold(vp);
322 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
323 			vdrop(vp);
324 			goto retry;
325 		}
326 
327 		/*
328 		 * Retry if the vnode was ripped out from under us
329 		 */
330 		if (vp != sp->s_ttyvp) {
331 			vn_unlock(vp);
332 			vdrop(vp);
333 			goto retry;
334 		}
335 
336 		/*
337 		 * Close and revoke as needed
338 		 */
339 		sp->s_ttyvp = NULL;
340 		if (vp->v_flag & VCTTYISOPEN) {
341 			vclrflags(vp, VCTTYISOPEN);
342 			VOP_CLOSE(vp, FREAD|FWRITE);
343 		}
344 		vn_unlock(vp);
345 		if (dorevoke)
346 			vrevoke(vp, proc0.p_ucred);
347 		vdrop(vp);
348 	} else {
349 		sp->s_ttyvp = NULL;
350 	}
351 	vrele(vp);
352 }
353 
354 #define	FLUSHQ(q) {							\
355 	if ((q)->c_cc)							\
356 		ndflush(q, (q)->c_cc);					\
357 }
358 
359 /* Is 'c' a line delimiter ("break" character)? */
360 #define	TTBREAKC(c, lflag)							\
361 	((c) == '\n' || (((c) == cc[VEOF] ||				\
362 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
363 	 (c) != _POSIX_VDISABLE))
364 
365 /*
366  * Process input of a single character received on a tty.
367  */
368 int
369 ttyinput(int c, struct tty *tp)
370 {
371 	tcflag_t iflag, lflag;
372 	cc_t *cc;
373 	int i, err;
374 
375 	/*
376 	 * If input is pending take it first.
377 	 */
378 	lflag = tp->t_lflag;
379 	if (ISSET(lflag, PENDIN))
380 		ttypend(tp);
381 	/*
382 	 * Gather stats.
383 	 */
384 	if (ISSET(lflag, ICANON))
385 		++tp->t_cancc;
386 	else
387 		++tp->t_rawcc;
388 	++tk_nin;
389 
390 	/*
391 	 * Block further input iff:
392 	 * current input > threshold AND input is available to user program
393 	 * AND input flow control is enabled and not yet invoked.
394 	 * The 3 is slop for PARMRK.
395 	 */
396 	iflag = tp->t_iflag;
397 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
398 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
399 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
400 	    !ISSET(tp->t_state, TS_TBLOCK))
401 		ttyblock(tp);
402 
403 	/* Handle exceptional conditions (break, parity, framing). */
404 	cc = tp->t_cc;
405 	err = (ISSET(c, TTY_ERRORMASK));
406 	if (err) {
407 		CLR(c, TTY_ERRORMASK);
408 		if (ISSET(err, TTY_BI)) {
409 			if (ISSET(iflag, IGNBRK))
410 				return (0);
411 			if (ISSET(iflag, BRKINT)) {
412 				ttyflush(tp, FREAD | FWRITE);
413 				pgsignal(tp->t_pgrp, SIGINT, 1);
414 				goto endcase;
415 			}
416 			if (ISSET(iflag, PARMRK))
417 				goto parmrk;
418 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
419 			|| ISSET(err, TTY_FE)) {
420 			if (ISSET(iflag, IGNPAR))
421 				return (0);
422 			else if (ISSET(iflag, PARMRK)) {
423 parmrk:
424 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
425 				    MAX_INPUT - 3)
426 					goto input_overflow;
427 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
428 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
429 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
430 				goto endcase;
431 			} else
432 				c = 0;
433 		}
434 	}
435 
436 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
437 		CLR(c, 0x80);
438 	if (!ISSET(lflag, EXTPROC)) {
439 		/*
440 		 * Check for literal nexting very first
441 		 */
442 		if (ISSET(tp->t_state, TS_LNCH)) {
443 			SET(c, TTY_QUOTE);
444 			CLR(tp->t_state, TS_LNCH);
445 		}
446 		/*
447 		 * Scan for special characters.  This code
448 		 * is really just a big case statement with
449 		 * non-constant cases.  The bottom of the
450 		 * case statement is labeled ``endcase'', so goto
451 		 * it after a case match, or similar.
452 		 */
453 
454 		/*
455 		 * Control chars which aren't controlled
456 		 * by ICANON, ISIG, or IXON.
457 		 */
458 		if (ISSET(lflag, IEXTEN)) {
459 			if (CCEQ(cc[VLNEXT], c)) {
460 				if (ISSET(lflag, ECHO)) {
461 					if (ISSET(lflag, ECHOE)) {
462 						(void)ttyoutput('^', tp);
463 						(void)ttyoutput('\b', tp);
464 					} else
465 						ttyecho(c, tp);
466 				}
467 				SET(tp->t_state, TS_LNCH);
468 				goto endcase;
469 			}
470 			if (CCEQ(cc[VDISCARD], c)) {
471 				if (ISSET(lflag, FLUSHO))
472 					CLR(tp->t_lflag, FLUSHO);
473 				else {
474 					ttyflush(tp, FWRITE);
475 					ttyecho(c, tp);
476 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
477 						ttyretype(tp);
478 					SET(tp->t_lflag, FLUSHO);
479 				}
480 				goto startoutput;
481 			}
482 		}
483 		/*
484 		 * Signals.
485 		 */
486 		if (ISSET(lflag, ISIG)) {
487 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
488 				if (!ISSET(lflag, NOFLSH))
489 					ttyflush(tp, FREAD | FWRITE);
490 				ttyecho(c, tp);
491 				pgsignal(tp->t_pgrp,
492 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
493 				goto endcase;
494 			}
495 			if (CCEQ(cc[VSUSP], c)) {
496 				if (!ISSET(lflag, NOFLSH))
497 					ttyflush(tp, FREAD);
498 				ttyecho(c, tp);
499 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
500 				goto endcase;
501 			}
502 		}
503 		/*
504 		 * Handle start/stop characters.
505 		 */
506 		if (ISSET(iflag, IXON)) {
507 			if (CCEQ(cc[VSTOP], c)) {
508 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
509 					SET(tp->t_state, TS_TTSTOP);
510 					(*tp->t_stop)(tp, 0);
511 					return (0);
512 				}
513 				if (!CCEQ(cc[VSTART], c))
514 					return (0);
515 				/*
516 				 * if VSTART == VSTOP then toggle
517 				 */
518 				goto endcase;
519 			}
520 			if (CCEQ(cc[VSTART], c))
521 				goto restartoutput;
522 		}
523 		/*
524 		 * IGNCR, ICRNL, & INLCR
525 		 */
526 		if (c == '\r') {
527 			if (ISSET(iflag, IGNCR))
528 				return (0);
529 			else if (ISSET(iflag, ICRNL))
530 				c = '\n';
531 		} else if (c == '\n' && ISSET(iflag, INLCR))
532 			c = '\r';
533 	}
534 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
535 		/*
536 		 * From here on down canonical mode character
537 		 * processing takes place.
538 		 */
539 		/*
540 		 * erase or erase2 (^H / ^?)
541 		 */
542 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
543 			if (tp->t_rawq.c_cc)
544 				ttyrub(clist_unputc(&tp->t_rawq), tp);
545 			goto endcase;
546 		}
547 		/*
548 		 * kill (^U)
549 		 */
550 		if (CCEQ(cc[VKILL], c)) {
551 			if (ISSET(lflag, ECHOKE) &&
552 			    tp->t_rawq.c_cc == tp->t_rocount &&
553 			    !ISSET(lflag, ECHOPRT))
554 				while (tp->t_rawq.c_cc)
555 					ttyrub(clist_unputc(&tp->t_rawq), tp);
556 			else {
557 				ttyecho(c, tp);
558 				if (ISSET(lflag, ECHOK) ||
559 				    ISSET(lflag, ECHOKE))
560 					ttyecho('\n', tp);
561 				FLUSHQ(&tp->t_rawq);
562 				tp->t_rocount = 0;
563 			}
564 			CLR(tp->t_state, TS_LOCAL);
565 			goto endcase;
566 		}
567 		/*
568 		 * word erase (^W)
569 		 */
570 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
571 			int ctype;
572 
573 			/*
574 			 * erase whitespace
575 			 */
576 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
577 				ttyrub(c, tp);
578 			if (c == -1)
579 				goto endcase;
580 			/*
581 			 * erase last char of word and remember the
582 			 * next chars type (for ALTWERASE)
583 			 */
584 			ttyrub(c, tp);
585 			c = clist_unputc(&tp->t_rawq);
586 			if (c == -1)
587 				goto endcase;
588 			if (c == ' ' || c == '\t') {
589 				clist_putc(c, &tp->t_rawq);
590 				goto endcase;
591 			}
592 			ctype = ISALPHA(c);
593 			/*
594 			 * erase rest of word
595 			 */
596 			do {
597 				ttyrub(c, tp);
598 				c = clist_unputc(&tp->t_rawq);
599 				if (c == -1)
600 					goto endcase;
601 			} while (c != ' ' && c != '\t' &&
602 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
603 			clist_putc(c, &tp->t_rawq);
604 			goto endcase;
605 		}
606 		/*
607 		 * reprint line (^R)
608 		 */
609 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
610 			ttyretype(tp);
611 			goto endcase;
612 		}
613 		/*
614 		 * ^T - kernel info and generate SIGINFO
615 		 */
616 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
617 			if (ISSET(lflag, ISIG))
618 				pgsignal(tp->t_pgrp, SIGINFO, 1);
619 			if (!ISSET(lflag, NOKERNINFO))
620 				ttyinfo(tp);
621 			goto endcase;
622 		}
623 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
624 			if (ISSET(lflag, ISIG))
625 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
626 			goto endcase;
627 		}
628 	}
629 	/*
630 	 * Check for input buffer overflow
631 	 */
632 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
633 input_overflow:
634 		if (ISSET(iflag, IMAXBEL)) {
635 			if (tp->t_outq.c_cc < tp->t_ohiwat)
636 				(void)ttyoutput(CTRL('g'), tp);
637 		}
638 		goto endcase;
639 	}
640 
641 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
642 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
643 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
644 
645 	/*
646 	 * Put data char in q for user and
647 	 * wakeup on seeing a line delimiter.
648 	 */
649 	if (clist_putc(c, &tp->t_rawq) >= 0) {
650 		if (!ISSET(lflag, ICANON)) {
651 			ttwakeup(tp);
652 			ttyecho(c, tp);
653 			goto endcase;
654 		}
655 		if (TTBREAKC(c, lflag)) {
656 			tp->t_rocount = 0;
657 			catq(&tp->t_rawq, &tp->t_canq);
658 			ttwakeup(tp);
659 		} else if (tp->t_rocount++ == 0)
660 			tp->t_rocol = tp->t_column;
661 		if (ISSET(tp->t_state, TS_ERASE)) {
662 			/*
663 			 * end of prterase \.../
664 			 */
665 			CLR(tp->t_state, TS_ERASE);
666 			(void)ttyoutput('/', tp);
667 		}
668 		i = tp->t_column;
669 		ttyecho(c, tp);
670 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
671 			/*
672 			 * Place the cursor over the '^' of the ^D.
673 			 */
674 			i = imin(2, tp->t_column - i);
675 			while (i > 0) {
676 				(void)ttyoutput('\b', tp);
677 				i--;
678 			}
679 		}
680 	}
681 endcase:
682 	/*
683 	 * IXANY means allow any character to restart output.
684 	 */
685 	if (ISSET(tp->t_state, TS_TTSTOP) &&
686 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
687 		return (0);
688 restartoutput:
689 	CLR(tp->t_lflag, FLUSHO);
690 	CLR(tp->t_state, TS_TTSTOP);
691 startoutput:
692 	return (ttstart(tp));
693 }
694 
695 /*
696  * Output a single character on a tty, doing output processing
697  * as needed (expanding tabs, newline processing, etc.).
698  * Returns < 0 if succeeds, otherwise returns char to resend.
699  * Must be recursive.
700  */
701 static int
702 ttyoutput(int c, struct tty *tp)
703 {
704 	tcflag_t oflag;
705 	int col;
706 
707 	oflag = tp->t_oflag;
708 	if (!ISSET(oflag, OPOST)) {
709 		if (ISSET(tp->t_lflag, FLUSHO))
710 			return (-1);
711 		if (clist_putc(c, &tp->t_outq))
712 			return (c);
713 		tk_nout++;
714 		tp->t_outcc++;
715 		return (-1);
716 	}
717 	/*
718 	 * Do tab expansion if OXTABS is set.  Special case if we external
719 	 * processing, we don't do the tab expansion because we'll probably
720 	 * get it wrong.  If tab expansion needs to be done, let it happen
721 	 * externally.
722 	 */
723 	CLR(c, ~TTY_CHARMASK);
724 	if (c == '\t' &&
725 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
726 		c = 8 - (tp->t_column & 7);
727 		if (!ISSET(tp->t_lflag, FLUSHO)) {
728 			crit_enter();		/* Don't interrupt tabs. */
729 			c -= b_to_q("        ", c, &tp->t_outq);
730 			tk_nout += c;
731 			tp->t_outcc += c;
732 			crit_exit();
733 		}
734 		tp->t_column += c;
735 		return (c ? -1 : '\t');
736 	}
737 	if (c == CEOT && ISSET(oflag, ONOEOT))
738 		return (-1);
739 
740 	/*
741 	 * Newline translation: if ONLCR is set,
742 	 * translate newline into "\r\n".
743 	 */
744 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
745 		tk_nout++;
746 		tp->t_outcc++;
747 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq))
748 			return (c);
749 	}
750 	/* If OCRNL is set, translate "\r" into "\n". */
751 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
752 		c = '\n';
753 	/* If ONOCR is set, don't transmit CRs when on column 0. */
754 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
755 		return (-1);
756 
757 	tk_nout++;
758 	tp->t_outcc++;
759 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq))
760 		return (c);
761 
762 	col = tp->t_column;
763 	switch (CCLASS(c)) {
764 	case BACKSPACE:
765 		if (col > 0)
766 			--col;
767 		break;
768 	case CONTROL:
769 		break;
770 	case NEWLINE:
771 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
772 			col = 0;
773 		break;
774 	case RETURN:
775 		col = 0;
776 		break;
777 	case ORDINARY:
778 		++col;
779 		break;
780 	case TAB:
781 		col = (col + 8) & ~7;
782 		break;
783 	}
784 	tp->t_column = col;
785 	return (-1);
786 }
787 
788 /*
789  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
790  * has been called to do discipline-specific functions and/or reject any
791  * of these ioctl commands.
792  */
793 /* ARGSUSED */
794 int
795 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
796 {
797 	struct thread *td = curthread;
798 	struct lwp *lp = td->td_lwp;
799 	struct proc *p = td->td_proc;
800 	int error;
801 
802 	KKASSERT(p);
803 
804 	/* If the ioctl involves modification, hang if in the background. */
805 	switch (cmd) {
806 	case  TIOCCBRK:
807 	case  TIOCCONS:
808 	case  TIOCDRAIN:
809 	case  TIOCEXCL:
810 	case  TIOCFLUSH:
811 #ifdef TIOCHPCL
812 	case  TIOCHPCL:
813 #endif
814 	case  TIOCNXCL:
815 	case  TIOCSBRK:
816 	case  TIOCSCTTY:
817 	case  TIOCSDRAINWAIT:
818 	case  TIOCSETA:
819 	case  TIOCSETAF:
820 	case  TIOCSETAW:
821 	case  TIOCSETD:
822 	case  TIOCSPGRP:
823 	case  TIOCSTART:
824 	case  TIOCSTAT:
825 	case  TIOCSTI:
826 	case  TIOCSTOP:
827 	case  TIOCSWINSZ:
828 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
829 	case  TIOCLBIC:
830 	case  TIOCLBIS:
831 	case  TIOCLSET:
832 	case  TIOCSETC:
833 	case OTIOCSETD:
834 	case  TIOCSETN:
835 	case  TIOCSETP:
836 	case  TIOCSLTC:
837 #endif
838 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
839 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
840 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
841 			if (p->p_pgrp->pg_jobc == 0)
842 				return (EIO);
843 			pgsignal(p->p_pgrp, SIGTTOU, 1);
844 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
845 					 0);
846 			if (error)
847 				return (error);
848 		}
849 		break;
850 	}
851 
852 	switch (cmd) {			/* Process the ioctl. */
853 	case FIOASYNC:			/* set/clear async i/o */
854 		crit_enter();
855 		if (*(int *)data)
856 			SET(tp->t_state, TS_ASYNC);
857 		else
858 			CLR(tp->t_state, TS_ASYNC);
859 		crit_exit();
860 		break;
861 	case FIONREAD:			/* get # bytes to read */
862 		crit_enter();
863 		*(int *)data = ttnread(tp);
864 		crit_exit();
865 		break;
866 
867 	case FIOSETOWN:
868 		/*
869 		 * Policy -- Don't allow FIOSETOWN on someone else's
870 		 *           controlling tty
871 		 */
872 		if (tp->t_session != NULL && !isctty(p, tp))
873 			return (ENOTTY);
874 
875 		error = fsetown(*(int *)data, &tp->t_sigio);
876 		if (error)
877 			return (error);
878 		break;
879 	case FIOGETOWN:
880 		if (tp->t_session != NULL && !isctty(p, tp))
881 			return (ENOTTY);
882 		*(int *)data = fgetown(tp->t_sigio);
883 		break;
884 
885 	case TIOCEXCL:			/* set exclusive use of tty */
886 		crit_enter();
887 		SET(tp->t_state, TS_XCLUDE);
888 		crit_exit();
889 		break;
890 	case TIOCFLUSH: {		/* flush buffers */
891 		int flags = *(int *)data;
892 
893 		if (flags == 0)
894 			flags = FREAD | FWRITE;
895 		else
896 			flags &= FREAD | FWRITE;
897 		ttyflush(tp, flags);
898 		break;
899 	}
900 	case TIOCCONS:			/* become virtual console */
901 		if (*(int *)data) {
902 			if (constty && constty != tp &&
903 			    ISSET(constty->t_state, TS_CONNECTED))
904 				return (EBUSY);
905 #ifndef	UCONSOLE
906 			if ((error = priv_check(td, PRIV_ROOT)) != 0)
907 				return (error);
908 #endif
909 			constty = tp;
910 		} else if (tp == constty)
911 			constty = NULL;
912 		break;
913 	case TIOCDRAIN:			/* wait till output drained */
914 		error = ttywait(tp);
915 		if (error)
916 			return (error);
917 		break;
918 	case TIOCGETA: {		/* get termios struct */
919 		struct termios *t = (struct termios *)data;
920 
921 		bcopy(&tp->t_termios, t, sizeof(struct termios));
922 		break;
923 	}
924 	case TIOCGETD:			/* get line discipline */
925 		*(int *)data = tp->t_line;
926 		break;
927 	case TIOCGWINSZ:		/* get window size */
928 		*(struct winsize *)data = tp->t_winsize;
929 		break;
930 	case TIOCGPGRP:			/* get pgrp of tty */
931 		if (!isctty(p, tp))
932 			return (ENOTTY);
933 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
934 		break;
935 	case TIOCGSID:                  /* get sid of tty */
936 		if (!isctty(p, tp))
937 			return (ENOTTY);
938 		*(int *)data = tp->t_session->s_sid;
939 		break;
940 #ifdef TIOCHPCL
941 	case TIOCHPCL:			/* hang up on last close */
942 		crit_enter();
943 		SET(tp->t_cflag, HUPCL);
944 		crit_exit();
945 		break;
946 #endif
947 	case TIOCNXCL:			/* reset exclusive use of tty */
948 		crit_enter();
949 		CLR(tp->t_state, TS_XCLUDE);
950 		crit_exit();
951 		break;
952 	case TIOCOUTQ:			/* output queue size */
953 		*(int *)data = tp->t_outq.c_cc;
954 		break;
955 	case TIOCSETA:			/* set termios struct */
956 	case TIOCSETAW:			/* drain output, set */
957 	case TIOCSETAF: {		/* drn out, fls in, set */
958 		struct termios *t = (struct termios *)data;
959 
960 		if (t->c_ispeed == 0)
961 			t->c_ispeed = t->c_ospeed;
962 		if (t->c_ispeed == 0)
963 			t->c_ispeed = tp->t_ospeed;
964 		if (t->c_ispeed == 0)
965 			return (EINVAL);
966 		crit_enter();
967 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
968 			error = ttywait(tp);
969 			if (error) {
970 				crit_exit();
971 				return (error);
972 			}
973 			if (cmd == TIOCSETAF)
974 				ttyflush(tp, FREAD);
975 		}
976 		if (!ISSET(t->c_cflag, CIGNORE)) {
977 			/*
978 			 * Set device hardware.
979 			 */
980 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
981 				crit_exit();
982 				return (error);
983 			}
984 			if (ISSET(t->c_cflag, CLOCAL) &&
985 			    !ISSET(tp->t_cflag, CLOCAL)) {
986 				/*
987 				 * XXX disconnections would be too hard to
988 				 * get rid of without this kludge.  The only
989 				 * way to get rid of controlling terminals
990 				 * is to exit from the session leader.
991 				 */
992 				CLR(tp->t_state, TS_ZOMBIE);
993 
994 				wakeup(TSA_CARR_ON(tp));
995 				ttwakeup(tp);
996 				ttwwakeup(tp);
997 			}
998 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
999 			     ISSET(t->c_cflag, CLOCAL)) &&
1000 			    !ISSET(tp->t_state, TS_ZOMBIE))
1001 				SET(tp->t_state, TS_CONNECTED);
1002 			else
1003 				CLR(tp->t_state, TS_CONNECTED);
1004 			tp->t_cflag = t->c_cflag;
1005 			tp->t_ispeed = t->c_ispeed;
1006 			if (t->c_ospeed != 0)
1007 				tp->t_ospeed = t->c_ospeed;
1008 			ttsetwater(tp);
1009 		}
1010 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1011 		    cmd != TIOCSETAF) {
1012 			if (ISSET(t->c_lflag, ICANON))
1013 				SET(tp->t_lflag, PENDIN);
1014 			else {
1015 				/*
1016 				 * XXX we really shouldn't allow toggling
1017 				 * ICANON while we're in a non-termios line
1018 				 * discipline.  Now we have to worry about
1019 				 * panicing for a null queue.
1020 				 */
1021 				if (tp->t_canq.c_cbreserved > 0 &&
1022 				    tp->t_rawq.c_cbreserved > 0) {
1023 					catq(&tp->t_rawq, &tp->t_canq);
1024 					/*
1025 					 * XXX the queue limits may be
1026 					 * different, so the old queue
1027 					 * swapping method no longer works.
1028 					 */
1029 					catq(&tp->t_canq, &tp->t_rawq);
1030 				}
1031 				CLR(tp->t_lflag, PENDIN);
1032 			}
1033 			ttwakeup(tp);
1034 		}
1035 		tp->t_iflag = t->c_iflag;
1036 		tp->t_oflag = t->c_oflag;
1037 		/*
1038 		 * Make the EXTPROC bit read only.
1039 		 */
1040 		if (ISSET(tp->t_lflag, EXTPROC))
1041 			SET(t->c_lflag, EXTPROC);
1042 		else
1043 			CLR(t->c_lflag, EXTPROC);
1044 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1045 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1046 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1047 			ttwakeup(tp);
1048 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1049 		crit_exit();
1050 		break;
1051 	}
1052 	case TIOCSETD: {		/* set line discipline */
1053 		int t = *(int *)data;
1054 		cdev_t device = tp->t_dev;
1055 
1056 		if ((u_int)t >= nlinesw)
1057 			return (ENXIO);
1058 		if (t != tp->t_line) {
1059 			crit_enter();
1060 			(*linesw[tp->t_line].l_close)(tp, flag);
1061 			error = (*linesw[t].l_open)(device, tp);
1062 			if (error) {
1063 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1064 				crit_exit();
1065 				return (error);
1066 			}
1067 			tp->t_line = t;
1068 			crit_exit();
1069 		}
1070 		break;
1071 	}
1072 	case TIOCSTART:			/* start output, like ^Q */
1073 		crit_enter();
1074 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1075 		    ISSET(tp->t_lflag, FLUSHO)) {
1076 			CLR(tp->t_lflag, FLUSHO);
1077 			CLR(tp->t_state, TS_TTSTOP);
1078 			ttstart(tp);
1079 		}
1080 		crit_exit();
1081 		break;
1082 	case TIOCSTI:			/* simulate terminal input */
1083 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT))
1084 			return (EPERM);
1085 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT))
1086 			return (EACCES);
1087 		crit_enter();
1088 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1089 		crit_exit();
1090 		break;
1091 	case TIOCSTOP:			/* stop output, like ^S */
1092 		crit_enter();
1093 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1094 			SET(tp->t_state, TS_TTSTOP);
1095 			(*tp->t_stop)(tp, 0);
1096 		}
1097 		crit_exit();
1098 		break;
1099 	case TIOCSCTTY:			/* become controlling tty */
1100 		/* Session ctty vnode pointer set in vnode layer. */
1101 		if (!SESS_LEADER(p) ||
1102 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1103 		    (tp->t_session != p->p_session)))
1104 			return (EPERM);
1105 		tp->t_session = p->p_session;
1106 		tp->t_pgrp = p->p_pgrp;
1107 		p->p_session->s_ttyp = tp;
1108 		p->p_flag |= P_CONTROLT;
1109 		break;
1110 	case TIOCSPGRP: {		/* set pgrp of tty */
1111 		struct pgrp *pgrp = pgfind(*(int *)data);
1112 
1113 		if (!isctty(p, tp))
1114 			return (ENOTTY);
1115 		else if (pgrp == NULL || pgrp->pg_session != p->p_session)
1116 			return (EPERM);
1117 		tp->t_pgrp = pgrp;
1118 		break;
1119 	}
1120 	case TIOCSTAT:			/* simulate control-T */
1121 		crit_enter();
1122 		ttyinfo(tp);
1123 		crit_exit();
1124 		break;
1125 	case TIOCSWINSZ:		/* set window size */
1126 		if (bcmp((caddr_t)&tp->t_winsize, data,
1127 		    sizeof (struct winsize))) {
1128 			tp->t_winsize = *(struct winsize *)data;
1129 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1130 		}
1131 		break;
1132 	case TIOCSDRAINWAIT:
1133 		error = priv_check(td, PRIV_ROOT);
1134 		if (error)
1135 			return (error);
1136 		tp->t_timeout = *(int *)data * hz;
1137 		wakeup(TSA_OCOMPLETE(tp));
1138 		wakeup(TSA_OLOWAT(tp));
1139 		break;
1140 	case TIOCGDRAINWAIT:
1141 		*(int *)data = tp->t_timeout / hz;
1142 		break;
1143 	default:
1144 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1145 		return (ttcompat(tp, cmd, data, flag));
1146 #else
1147 		return (ENOIOCTL);
1148 #endif
1149 	}
1150 	return (0);
1151 }
1152 
1153 int
1154 ttypoll(struct dev_poll_args *ap)
1155 {
1156 	cdev_t dev = ap->a_head.a_dev;
1157 	int events = ap->a_events;
1158 	int revents = 0;
1159 	struct tty *tp;
1160 
1161 	tp = dev->si_tty;
1162 	/* XXX used to return ENXIO, but that means true! */
1163 	if (tp == NULL) {
1164 		ap->a_events = (events & (POLLIN | POLLOUT | POLLRDNORM |
1165 				POLLWRNORM)) | POLLHUP;
1166 		return(0);
1167 	}
1168 
1169 	crit_enter();
1170 	if (events & (POLLIN | POLLRDNORM)) {
1171 		if (ttnread(tp) > 0 || ISSET(tp->t_state, TS_ZOMBIE))
1172 			revents |= events & (POLLIN | POLLRDNORM);
1173 		else
1174 			selrecord(curthread, &tp->t_rsel);
1175 	}
1176 	if (events & (POLLOUT | POLLWRNORM)) {
1177 		if ((tp->t_outq.c_cc <= tp->t_olowat &&
1178 		     ISSET(tp->t_state, TS_CONNECTED))
1179 		    || ISSET(tp->t_state, TS_ZOMBIE))
1180 			revents |= events & (POLLOUT | POLLWRNORM);
1181 		else
1182 			selrecord(curthread, &tp->t_wsel);
1183 	}
1184 	crit_exit();
1185 	ap->a_events = revents;
1186 	return (0);
1187 }
1188 
1189 static struct filterops ttyread_filtops =
1190 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1191 static struct filterops ttywrite_filtops =
1192 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1193 
1194 int
1195 ttykqfilter(struct dev_kqfilter_args *ap)
1196 {
1197 	cdev_t dev = ap->a_head.a_dev;
1198 	struct knote *kn = ap->a_kn;
1199 	struct tty *tp = dev->si_tty;
1200 	struct klist *klist;
1201 
1202 	ap->a_result = 0;
1203 	switch (kn->kn_filter) {
1204 	case EVFILT_READ:
1205 		klist = &tp->t_rsel.si_note;
1206 		kn->kn_fop = &ttyread_filtops;
1207 		break;
1208 	case EVFILT_WRITE:
1209 		klist = &tp->t_wsel.si_note;
1210 		kn->kn_fop = &ttywrite_filtops;
1211 		break;
1212 	default:
1213 		ap->a_result = 1;
1214 		return (0);
1215 	}
1216 
1217 	kn->kn_hook = (caddr_t)dev;
1218 
1219 	crit_enter();
1220 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1221 	crit_exit();
1222 
1223 	return (0);
1224 }
1225 
1226 static void
1227 filt_ttyrdetach(struct knote *kn)
1228 {
1229 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1230 
1231 	crit_enter();
1232 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
1233 	crit_exit();
1234 }
1235 
1236 static int
1237 filt_ttyread(struct knote *kn, long hint)
1238 {
1239 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1240 
1241 	kn->kn_data = ttnread(tp);
1242 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1243 		kn->kn_flags |= EV_EOF;
1244 		return (1);
1245 	}
1246 	return (kn->kn_data > 0);
1247 }
1248 
1249 static void
1250 filt_ttywdetach(struct knote *kn)
1251 {
1252 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1253 
1254 	crit_enter();
1255 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
1256 	crit_exit();
1257 }
1258 
1259 static int
1260 filt_ttywrite(struct knote *kn, long hint)
1261 {
1262 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1263 
1264 	kn->kn_data = tp->t_outq.c_cc;
1265 	if (ISSET(tp->t_state, TS_ZOMBIE))
1266 		return (1);
1267 	return (kn->kn_data <= tp->t_olowat &&
1268 	    ISSET(tp->t_state, TS_CONNECTED));
1269 }
1270 
1271 /*
1272  * Must be called while in a critical section.
1273  */
1274 static int
1275 ttnread(struct tty *tp)
1276 {
1277 	int nread;
1278 
1279 	if (ISSET(tp->t_lflag, PENDIN))
1280 		ttypend(tp);
1281 	nread = tp->t_canq.c_cc;
1282 	if (!ISSET(tp->t_lflag, ICANON)) {
1283 		nread += tp->t_rawq.c_cc;
1284 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1285 			nread = 0;
1286 	}
1287 	return (nread);
1288 }
1289 
1290 /*
1291  * Wait for output to drain.
1292  */
1293 int
1294 ttywait(struct tty *tp)
1295 {
1296 	int error;
1297 
1298 	error = 0;
1299 	crit_enter();
1300 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1301 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1302 		(*tp->t_oproc)(tp);
1303 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1304 		    ISSET(tp->t_state, TS_CONNECTED)) {
1305 			SET(tp->t_state, TS_SO_OCOMPLETE);
1306 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1307 					 PCATCH, "ttywai",
1308 					 tp->t_timeout);
1309 			if (error) {
1310 				if (error == EWOULDBLOCK)
1311 					error = EIO;
1312 				break;
1313 			}
1314 		} else
1315 			break;
1316 	}
1317 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1318 		error = EIO;
1319 	crit_exit();
1320 	return (error);
1321 }
1322 
1323 /*
1324  * Flush if successfully wait.
1325  */
1326 static int
1327 ttywflush(struct tty *tp)
1328 {
1329 	int error;
1330 
1331 	if ((error = ttywait(tp)) == 0)
1332 		ttyflush(tp, FREAD);
1333 	return (error);
1334 }
1335 
1336 /*
1337  * Flush tty read and/or write queues, notifying anyone waiting.
1338  */
1339 void
1340 ttyflush(struct tty *tp, int rw)
1341 {
1342 	crit_enter();
1343 #if 0
1344 again:
1345 #endif
1346 	if (rw & FWRITE) {
1347 		FLUSHQ(&tp->t_outq);
1348 		CLR(tp->t_state, TS_TTSTOP);
1349 	}
1350 	(*tp->t_stop)(tp, rw);
1351 	if (rw & FREAD) {
1352 		FLUSHQ(&tp->t_canq);
1353 		FLUSHQ(&tp->t_rawq);
1354 		CLR(tp->t_lflag, PENDIN);
1355 		tp->t_rocount = 0;
1356 		tp->t_rocol = 0;
1357 		CLR(tp->t_state, TS_LOCAL);
1358 		ttwakeup(tp);
1359 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1360 			if (rw & FWRITE)
1361 				FLUSHQ(&tp->t_outq);
1362 			ttyunblock(tp);
1363 
1364 			/*
1365 			 * Don't let leave any state that might clobber the
1366 			 * next line discipline (although we should do more
1367 			 * to send the START char).  Not clearing the state
1368 			 * may have caused the "putc to a clist with no
1369 			 * reserved cblocks" panic/kprintf.
1370 			 */
1371 			CLR(tp->t_state, TS_TBLOCK);
1372 
1373 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1374 			if (ISSET(tp->t_iflag, IXOFF)) {
1375 				/*
1376 				 * XXX wait a bit in the hope that the stop
1377 				 * character (if any) will go out.  Waiting
1378 				 * isn't good since it allows races.  This
1379 				 * will be fixed when the stop character is
1380 				 * put in a special queue.  Don't bother with
1381 				 * the checks in ttywait() since the timeout
1382 				 * will save us.
1383 				 */
1384 				SET(tp->t_state, TS_SO_OCOMPLETE);
1385 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1386 					 "ttyfls", hz / 10);
1387 				/*
1388 				 * Don't try sending the stop character again.
1389 				 */
1390 				CLR(tp->t_state, TS_TBLOCK);
1391 				goto again;
1392 			}
1393 #endif
1394 		}
1395 	}
1396 	if (rw & FWRITE) {
1397 		FLUSHQ(&tp->t_outq);
1398 		ttwwakeup(tp);
1399 	}
1400 	crit_exit();
1401 }
1402 
1403 /*
1404  * Copy in the default termios characters.
1405  */
1406 void
1407 termioschars(struct termios *t)
1408 {
1409 
1410 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1411 }
1412 
1413 /*
1414  * Old interface.
1415  */
1416 void
1417 ttychars(struct tty *tp)
1418 {
1419 
1420 	termioschars(&tp->t_termios);
1421 }
1422 
1423 /*
1424  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1425  * on our input flow control bit and propagate the changes to the driver.
1426  * XXX the stop character should be put in a special high priority queue.
1427  */
1428 void
1429 ttyblock(struct tty *tp)
1430 {
1431 
1432 	SET(tp->t_state, TS_TBLOCK);
1433 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1434 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1435 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1436 	ttstart(tp);
1437 }
1438 
1439 /*
1440  * Handle input low water.  Send start character for the IXOFF case.  Turn
1441  * off our input flow control bit and propagate the changes to the driver.
1442  * XXX the start character should be put in a special high priority queue.
1443  */
1444 static void
1445 ttyunblock(struct tty *tp)
1446 {
1447 
1448 	CLR(tp->t_state, TS_TBLOCK);
1449 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1450 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1451 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1452 	ttstart(tp);
1453 }
1454 
1455 #ifdef notyet
1456 /* Not used by any current (i386) drivers. */
1457 /*
1458  * Restart after an inter-char delay.
1459  */
1460 void
1461 ttrstrt(void *tp_arg)
1462 {
1463 	struct tty *tp;
1464 
1465 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1466 
1467 	tp = tp_arg;
1468 	crit_enter();
1469 	CLR(tp->t_state, TS_TIMEOUT);
1470 	ttstart(tp);
1471 	crit_exit();
1472 }
1473 #endif
1474 
1475 int
1476 ttstart(struct tty *tp)
1477 {
1478 
1479 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1480 		(*tp->t_oproc)(tp);
1481 	return (0);
1482 }
1483 
1484 /*
1485  * "close" a line discipline
1486  */
1487 int
1488 ttylclose(struct tty *tp, int flag)
1489 {
1490 
1491 	if (flag & FNONBLOCK || ttywflush(tp))
1492 		ttyflush(tp, FREAD | FWRITE);
1493 	return (0);
1494 }
1495 
1496 /*
1497  * Handle modem control transition on a tty.
1498  * Flag indicates new state of carrier.
1499  * Returns 0 if the line should be turned off, otherwise 1.
1500  */
1501 int
1502 ttymodem(struct tty *tp, int flag)
1503 {
1504 
1505 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1506 		/*
1507 		 * MDMBUF: do flow control according to carrier flag
1508 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1509 		 * works if IXON and IXANY are clear.
1510 		 */
1511 		if (flag) {
1512 			CLR(tp->t_state, TS_CAR_OFLOW);
1513 			CLR(tp->t_state, TS_TTSTOP);
1514 			ttstart(tp);
1515 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1516 			SET(tp->t_state, TS_CAR_OFLOW);
1517 			SET(tp->t_state, TS_TTSTOP);
1518 			(*tp->t_stop)(tp, 0);
1519 		}
1520 	} else if (flag == 0) {
1521 		/*
1522 		 * Lost carrier.
1523 		 */
1524 		CLR(tp->t_state, TS_CARR_ON);
1525 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1526 		    !ISSET(tp->t_cflag, CLOCAL)) {
1527 			SET(tp->t_state, TS_ZOMBIE);
1528 			CLR(tp->t_state, TS_CONNECTED);
1529 			if (tp->t_session && tp->t_session->s_leader)
1530 				ksignal(tp->t_session->s_leader, SIGHUP);
1531 			ttyflush(tp, FREAD | FWRITE);
1532 			return (0);
1533 		}
1534 	} else {
1535 		/*
1536 		 * Carrier now on.
1537 		 */
1538 		SET(tp->t_state, TS_CARR_ON);
1539 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1540 			SET(tp->t_state, TS_CONNECTED);
1541 		wakeup(TSA_CARR_ON(tp));
1542 		ttwakeup(tp);
1543 		ttwwakeup(tp);
1544 	}
1545 	return (1);
1546 }
1547 
1548 /*
1549  * Reinput pending characters after state switch
1550  * call from a critical section.
1551  */
1552 static void
1553 ttypend(struct tty *tp)
1554 {
1555 	struct clist tq;
1556 	int c;
1557 
1558 	CLR(tp->t_lflag, PENDIN);
1559 	SET(tp->t_state, TS_TYPEN);
1560 	/*
1561 	 * XXX this assumes too much about clist internals.  It may even
1562 	 * fail if the cblock slush pool is empty.  We can't allocate more
1563 	 * cblocks here because we are called from an interrupt handler
1564 	 * and clist_alloc_cblocks() can wait.
1565 	 */
1566 	tq = tp->t_rawq;
1567 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1568 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1569 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1570 	while ((c = clist_getc(&tq)) >= 0)
1571 		ttyinput(c, tp);
1572 	CLR(tp->t_state, TS_TYPEN);
1573 }
1574 
1575 /*
1576  * Process a read call on a tty device.
1577  */
1578 int
1579 ttread(struct tty *tp, struct uio *uio, int flag)
1580 {
1581 	struct clist *qp;
1582 	int c;
1583 	tcflag_t lflag;
1584 	cc_t *cc = tp->t_cc;
1585 	struct proc *pp;
1586 	struct lwp *lp;
1587 	int first, error = 0;
1588 	int has_stime = 0, last_cc = 0;
1589 	long slp = 0;		/* XXX this should be renamed `timo'. */
1590 	struct timeval stime;
1591 
1592 	lp = curthread->td_lwp;
1593 
1594 loop:
1595 	crit_enter();
1596 	lflag = tp->t_lflag;
1597 	/*
1598 	 * take pending input first
1599 	 */
1600 	if (ISSET(lflag, PENDIN)) {
1601 		ttypend(tp);
1602 		splz();		/* reduce latency */
1603 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1604 	}
1605 
1606 	/*
1607 	 * Hang process if it's in the background.
1608 	 */
1609 	if ((pp = curproc) && isbackground(pp, tp)) {
1610 		crit_exit();
1611 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1612 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1613 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0)
1614 			return (EIO);
1615 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1616 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1617 		if (error)
1618 			return (error);
1619 		goto loop;
1620 	}
1621 
1622 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1623 		crit_exit();
1624 		return (0);	/* EOF */
1625 	}
1626 
1627 	/*
1628 	 * If canonical, use the canonical queue,
1629 	 * else use the raw queue.
1630 	 *
1631 	 * (should get rid of clists...)
1632 	 */
1633 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1634 
1635 	if (flag & IO_NDELAY) {
1636 		if (qp->c_cc > 0)
1637 			goto read;
1638 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1639 			crit_exit();
1640 			return (0);
1641 		}
1642 		crit_exit();
1643 		return (EWOULDBLOCK);
1644 	}
1645 	if (!ISSET(lflag, ICANON)) {
1646 		int m = cc[VMIN];
1647 		long t = cc[VTIME];
1648 		struct timeval timecopy;
1649 
1650 		/*
1651 		 * Check each of the four combinations.
1652 		 * (m > 0 && t == 0) is the normal read case.
1653 		 * It should be fairly efficient, so we check that and its
1654 		 * companion case (m == 0 && t == 0) first.
1655 		 * For the other two cases, we compute the target sleep time
1656 		 * into slp.
1657 		 */
1658 		if (t == 0) {
1659 			if (qp->c_cc < m)
1660 				goto sleep;
1661 			if (qp->c_cc > 0)
1662 				goto read;
1663 
1664 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1665 			crit_exit();
1666 			return (0);
1667 		}
1668 		t *= 100000;		/* time in us */
1669 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1670 			 ((t1).tv_usec - (t2).tv_usec))
1671 		if (m > 0) {
1672 			if (qp->c_cc <= 0)
1673 				goto sleep;
1674 			if (qp->c_cc >= m)
1675 				goto read;
1676 			getmicrotime(&timecopy);
1677 			if (!has_stime) {
1678 				/* first character, start timer */
1679 				has_stime = 1;
1680 				stime = timecopy;
1681 				slp = t;
1682 			} else if (qp->c_cc > last_cc) {
1683 				/* got a character, restart timer */
1684 				stime = timecopy;
1685 				slp = t;
1686 			} else {
1687 				/* nothing, check expiration */
1688 				slp = t - diff(timecopy, stime);
1689 				if (slp <= 0)
1690 					goto read;
1691 			}
1692 			last_cc = qp->c_cc;
1693 		} else {	/* m == 0 */
1694 			if (qp->c_cc > 0)
1695 				goto read;
1696 			getmicrotime(&timecopy);
1697 			if (!has_stime) {
1698 				has_stime = 1;
1699 				stime = timecopy;
1700 				slp = t;
1701 			} else {
1702 				slp = t - diff(timecopy, stime);
1703 				if (slp <= 0) {
1704 					/* Timed out, but 0 is enough input. */
1705 					crit_exit();
1706 					return (0);
1707 				}
1708 			}
1709 		}
1710 #undef diff
1711 		/*
1712 		 * Rounding down may make us wake up just short
1713 		 * of the target, so we round up.
1714 		 * The formula is ceiling(slp * hz/1000000).
1715 		 * 32-bit arithmetic is enough for hz < 169.
1716 		 * XXX see tvtohz() for how to avoid overflow if hz
1717 		 * is large (divide by `tick' and/or arrange to
1718 		 * use tvtohz() if hz is large).
1719 		 */
1720 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1721 		goto sleep;
1722 	}
1723 	if (qp->c_cc <= 0) {
1724 sleep:
1725 		/*
1726 		 * There is no input, or not enough input and we can block.
1727 		 */
1728 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1729 				 ISSET(tp->t_state, TS_CONNECTED) ?
1730 				 "ttyin" : "ttyhup", (int)slp);
1731 		crit_exit();
1732 		if (error == EWOULDBLOCK)
1733 			error = 0;
1734 		else if (error)
1735 			return (error);
1736 		/*
1737 		 * XXX what happens if another process eats some input
1738 		 * while we are asleep (not just here)?  It would be
1739 		 * safest to detect changes and reset our state variables
1740 		 * (has_stime and last_cc).
1741 		 */
1742 		slp = 0;
1743 		goto loop;
1744 	}
1745 read:
1746 	crit_exit();
1747 	/*
1748 	 * Input present, check for input mapping and processing.
1749 	 */
1750 	first = 1;
1751 	if (ISSET(lflag, ICANON | ISIG))
1752 		goto slowcase;
1753 	for (;;) {
1754 		char ibuf[IBUFSIZ];
1755 		int icc;
1756 
1757 		icc = imin(uio->uio_resid, IBUFSIZ);
1758 		icc = q_to_b(qp, ibuf, icc);
1759 		if (icc <= 0) {
1760 			if (first)
1761 				goto loop;
1762 			break;
1763 		}
1764 		error = uiomove(ibuf, icc, uio);
1765 		/*
1766 		 * XXX if there was an error then we should ungetc() the
1767 		 * unmoved chars and reduce icc here.
1768 		 */
1769 		if (error)
1770 			break;
1771  		if (uio->uio_resid == 0)
1772 			break;
1773 		first = 0;
1774 	}
1775 	goto out;
1776 slowcase:
1777 	for (;;) {
1778 		c = clist_getc(qp);
1779 		if (c < 0) {
1780 			if (first)
1781 				goto loop;
1782 			break;
1783 		}
1784 		/*
1785 		 * delayed suspend (^Y)
1786 		 */
1787 		if (CCEQ(cc[VDSUSP], c) &&
1788 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1789 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1790 			if (first) {
1791 				error = ttysleep(tp, &lbolt, PCATCH,
1792 						 "ttybg3", 0);
1793 				if (error)
1794 					break;
1795 				goto loop;
1796 			}
1797 			break;
1798 		}
1799 		/*
1800 		 * Interpret EOF only in canonical mode.
1801 		 */
1802 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1803 			break;
1804 		/*
1805 		 * Give user character.
1806 		 */
1807  		error = ureadc(c, uio);
1808 		if (error)
1809 			/* XXX should ungetc(c, qp). */
1810 			break;
1811  		if (uio->uio_resid == 0)
1812 			break;
1813 		/*
1814 		 * In canonical mode check for a "break character"
1815 		 * marking the end of a "line of input".
1816 		 */
1817 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1818 			break;
1819 		first = 0;
1820 	}
1821 
1822 out:
1823 	/*
1824 	 * Look to unblock input now that (presumably)
1825 	 * the input queue has gone down.
1826 	 */
1827 	crit_enter();
1828 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1829 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1830 		ttyunblock(tp);
1831 	crit_exit();
1832 
1833 	return (error);
1834 }
1835 
1836 /*
1837  * Check the output queue on tp for space for a kernel message (from uprintf
1838  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1839  * lose messages due to normal flow control, but don't let the tty run amok.
1840  * Sleeps here are not interruptible, but we return prematurely if new signals
1841  * arrive.
1842  */
1843 int
1844 ttycheckoutq(struct tty *tp, int wait)
1845 {
1846 	struct lwp *lp = curthread->td_lwp;
1847 	int hiwat;
1848 	sigset_t oldset, newset;
1849 
1850 	hiwat = tp->t_ohiwat;
1851 	SIGEMPTYSET(oldset);
1852 	SIGEMPTYSET(newset);
1853 	crit_enter();
1854 	if (wait)
1855 		oldset = lwp_sigpend(lp);
1856 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
1857 		while (tp->t_outq.c_cc > hiwat) {
1858 			ttstart(tp);
1859 			if (tp->t_outq.c_cc <= hiwat)
1860 				break;
1861 			if (wait)
1862 				newset = lwp_sigpend(lp);
1863 			if (!wait || SIGSETNEQ(oldset, newset)) {
1864 				crit_exit();
1865 				return (0);
1866 			}
1867 			SET(tp->t_state, TS_SO_OLOWAT);
1868 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
1869 		}
1870 	}
1871 	crit_exit();
1872 	return (1);
1873 }
1874 
1875 /*
1876  * Process a write call on a tty device.
1877  */
1878 int
1879 ttwrite(struct tty *tp, struct uio *uio, int flag)
1880 {
1881 	char *cp = NULL;
1882 	int cc, ce;
1883 	struct proc *pp;
1884 	struct lwp *lp;
1885 	int i, hiwat, cnt, error;
1886 	char obuf[OBUFSIZ];
1887 
1888 	lp = curthread->td_lwp;
1889 	hiwat = tp->t_ohiwat;
1890 	cnt = uio->uio_resid;
1891 	error = 0;
1892 	cc = 0;
1893 loop:
1894 	crit_enter();
1895 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1896 		crit_exit();
1897 		if (uio->uio_resid == cnt)
1898 			error = EIO;
1899 		goto out;
1900 	}
1901 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
1902 		if (flag & IO_NDELAY) {
1903 			crit_exit();
1904 			error = EWOULDBLOCK;
1905 			goto out;
1906 		}
1907 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
1908 		crit_exit();
1909 		if (error)
1910 			goto out;
1911 		goto loop;
1912 	}
1913 	crit_exit();
1914 
1915 	/*
1916 	 * Hang the process if it's in the background.
1917 	 */
1918 	if ((pp = curproc) && isbackground(pp, tp) &&
1919 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
1920 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
1921 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
1922 		if (pp->p_pgrp->pg_jobc == 0) {
1923 			error = EIO;
1924 			goto out;
1925 		}
1926 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
1927 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
1928 		if (error)
1929 			goto out;
1930 		goto loop;
1931 	}
1932 	/*
1933 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1934 	 * output translation.  Keep track of high water mark, sleep on
1935 	 * overflow awaiting device aid in acquiring new space.
1936 	 */
1937 	while (uio->uio_resid > 0 || cc > 0) {
1938 		if (ISSET(tp->t_lflag, FLUSHO)) {
1939 			uio->uio_resid = 0;
1940 			return (0);
1941 		}
1942 		if (tp->t_outq.c_cc > hiwat)
1943 			goto ovhiwat;
1944 		/*
1945 		 * Grab a hunk of data from the user, unless we have some
1946 		 * leftover from last time.
1947 		 */
1948 		if (cc == 0) {
1949 			cc = imin(uio->uio_resid, OBUFSIZ);
1950 			cp = obuf;
1951 			error = uiomove(cp, cc, uio);
1952 			if (error) {
1953 				cc = 0;
1954 				break;
1955 			}
1956 		}
1957 		/*
1958 		 * If nothing fancy need be done, grab those characters we
1959 		 * can handle without any of ttyoutput's processing and
1960 		 * just transfer them to the output q.  For those chars
1961 		 * which require special processing (as indicated by the
1962 		 * bits in char_type), call ttyoutput.  After processing
1963 		 * a hunk of data, look for FLUSHO so ^O's will take effect
1964 		 * immediately.
1965 		 */
1966 		while (cc > 0) {
1967 			if (!ISSET(tp->t_oflag, OPOST))
1968 				ce = cc;
1969 			else {
1970 				ce = cc - scanc((u_int)cc, (u_char *)cp,
1971 						char_type, CCLASSMASK);
1972 				/*
1973 				 * If ce is zero, then we're processing
1974 				 * a special character through ttyoutput.
1975 				 */
1976 				if (ce == 0) {
1977 					tp->t_rocount = 0;
1978 					if (ttyoutput(*cp, tp) >= 0) {
1979 						/* No Clists, wait a bit. */
1980 						ttstart(tp);
1981 						if (flag & IO_NDELAY) {
1982 							error = EWOULDBLOCK;
1983 							goto out;
1984 						}
1985 						error = ttysleep(tp, &lbolt,
1986 								 PCATCH,
1987 								 "ttybf1", 0);
1988 						if (error)
1989 							goto out;
1990 						goto loop;
1991 					}
1992 					cp++;
1993 					cc--;
1994 					if (ISSET(tp->t_lflag, FLUSHO) ||
1995 					    tp->t_outq.c_cc > hiwat)
1996 						goto ovhiwat;
1997 					continue;
1998 				}
1999 			}
2000 			/*
2001 			 * A bunch of normal characters have been found.
2002 			 * Transfer them en masse to the output queue and
2003 			 * continue processing at the top of the loop.
2004 			 * If there are any further characters in this
2005 			 * <= OBUFSIZ chunk, the first should be a character
2006 			 * requiring special handling by ttyoutput.
2007 			 */
2008 			tp->t_rocount = 0;
2009 			i = b_to_q(cp, ce, &tp->t_outq);
2010 			ce -= i;
2011 			tp->t_column += ce;
2012 			cp += ce, cc -= ce, tk_nout += ce;
2013 			tp->t_outcc += ce;
2014 			if (i > 0) {
2015 				/* No Clists, wait a bit. */
2016 				ttstart(tp);
2017 				if (flag & IO_NDELAY) {
2018 					error = EWOULDBLOCK;
2019 					goto out;
2020 				}
2021 				error = ttysleep(tp, &lbolt, PCATCH,
2022 						 "ttybf2", 0);
2023 				if (error)
2024 					goto out;
2025 				goto loop;
2026 			}
2027 			if (ISSET(tp->t_lflag, FLUSHO) ||
2028 			    tp->t_outq.c_cc > hiwat)
2029 				break;
2030 		}
2031 		ttstart(tp);
2032 	}
2033 out:
2034 	/*
2035 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2036 	 * offset and iov pointers have moved forward, but it doesn't matter
2037 	 * (the call will either return short or restart with a new uio).
2038 	 */
2039 	uio->uio_resid += cc;
2040 	return (error);
2041 
2042 ovhiwat:
2043 	ttstart(tp);
2044 	crit_enter();
2045 	/*
2046 	 * This can only occur if FLUSHO is set in t_lflag,
2047 	 * or if ttstart/oproc is synchronous (or very fast).
2048 	 */
2049 	if (tp->t_outq.c_cc <= hiwat) {
2050 		crit_exit();
2051 		goto loop;
2052 	}
2053 	if (flag & IO_NDELAY) {
2054 		crit_exit();
2055 		uio->uio_resid += cc;
2056 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2057 	}
2058 	SET(tp->t_state, TS_SO_OLOWAT);
2059 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2060 	crit_exit();
2061 	if (error == EWOULDBLOCK)
2062 		error = EIO;
2063 	if (error)
2064 		goto out;
2065 	goto loop;
2066 }
2067 
2068 /*
2069  * Rubout one character from the rawq of tp
2070  * as cleanly as possible.
2071  */
2072 static void
2073 ttyrub(int c, struct tty *tp)
2074 {
2075 	char *cp;
2076 	int savecol;
2077 	int tabc;
2078 
2079 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2080 		return;
2081 	CLR(tp->t_lflag, FLUSHO);
2082 	if (ISSET(tp->t_lflag, ECHOE)) {
2083 		if (tp->t_rocount == 0) {
2084 			/*
2085 			 * Screwed by ttwrite; retype
2086 			 */
2087 			ttyretype(tp);
2088 			return;
2089 		}
2090 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2091 			ttyrubo(tp, 2);
2092 		else {
2093 			CLR(c, ~TTY_CHARMASK);
2094 			switch (CCLASS(c)) {
2095 			case ORDINARY:
2096 				ttyrubo(tp, 1);
2097 				break;
2098 			case BACKSPACE:
2099 			case CONTROL:
2100 			case NEWLINE:
2101 			case RETURN:
2102 			case VTAB:
2103 				if (ISSET(tp->t_lflag, ECHOCTL))
2104 					ttyrubo(tp, 2);
2105 				break;
2106 			case TAB:
2107 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2108 					ttyretype(tp);
2109 					return;
2110 				}
2111 				crit_enter();
2112 				savecol = tp->t_column;
2113 				SET(tp->t_state, TS_CNTTB);
2114 				SET(tp->t_lflag, FLUSHO);
2115 				tp->t_column = tp->t_rocol;
2116 				cp = tp->t_rawq.c_cf;
2117 				if (cp)
2118 					tabc = *cp;	/* XXX FIX NEXTC */
2119 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2120 					ttyecho(tabc, tp);
2121 				CLR(tp->t_lflag, FLUSHO);
2122 				CLR(tp->t_state, TS_CNTTB);
2123 				crit_exit();
2124 
2125 				/* savecol will now be length of the tab. */
2126 				savecol -= tp->t_column;
2127 				tp->t_column += savecol;
2128 				if (savecol > 8)
2129 					savecol = 8;	/* overflow screw */
2130 				while (--savecol >= 0)
2131 					(void)ttyoutput('\b', tp);
2132 				break;
2133 			default:			/* XXX */
2134 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2135 				(void)kprintf(PANICSTR, c, CCLASS(c));
2136 #ifdef notdef
2137 				panic(PANICSTR, c, CCLASS(c));
2138 #endif
2139 			}
2140 		}
2141 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2142 		if (!ISSET(tp->t_state, TS_ERASE)) {
2143 			SET(tp->t_state, TS_ERASE);
2144 			(void)ttyoutput('\\', tp);
2145 		}
2146 		ttyecho(c, tp);
2147 	} else {
2148 		ttyecho(tp->t_cc[VERASE], tp);
2149 		/*
2150 		 * This code may be executed not only when an ERASE key
2151 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2152 		 * So, I didn't think it was worthwhile to pass the extra
2153 		 * information (which would need an extra parameter,
2154 		 * changing every call) needed to distinguish the ERASE2
2155 		 * case from the ERASE.
2156 		 */
2157 	}
2158 	--tp->t_rocount;
2159 }
2160 
2161 /*
2162  * Back over cnt characters, erasing them.
2163  */
2164 static void
2165 ttyrubo(struct tty *tp, int cnt)
2166 {
2167 
2168 	while (cnt-- > 0) {
2169 		(void)ttyoutput('\b', tp);
2170 		(void)ttyoutput(' ', tp);
2171 		(void)ttyoutput('\b', tp);
2172 	}
2173 }
2174 
2175 /*
2176  * ttyretype --
2177  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2178  *	been checked.
2179  */
2180 static void
2181 ttyretype(struct tty *tp)
2182 {
2183 	char *cp;
2184 	int c;
2185 
2186 	/* Echo the reprint character. */
2187 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2188 		ttyecho(tp->t_cc[VREPRINT], tp);
2189 
2190 	(void)ttyoutput('\n', tp);
2191 
2192 	/*
2193 	 * XXX
2194 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2195 	 * BIT OF FIRST CHAR.
2196 	 */
2197 	crit_enter();
2198 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2199 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2200 		ttyecho(c, tp);
2201 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2202 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2203 		ttyecho(c, tp);
2204 	CLR(tp->t_state, TS_ERASE);
2205 	crit_exit();
2206 
2207 	tp->t_rocount = tp->t_rawq.c_cc;
2208 	tp->t_rocol = 0;
2209 }
2210 
2211 /*
2212  * Echo a typed character to the terminal.
2213  */
2214 static void
2215 ttyecho(int c, struct tty *tp)
2216 {
2217 
2218 	if (!ISSET(tp->t_state, TS_CNTTB))
2219 		CLR(tp->t_lflag, FLUSHO);
2220 	if ((!ISSET(tp->t_lflag, ECHO) &&
2221 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2222 	    ISSET(tp->t_lflag, EXTPROC))
2223 		return;
2224 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2225 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2226 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2227 		(void)ttyoutput('^', tp);
2228 		CLR(c, ~TTY_CHARMASK);
2229 		if (c == 0177)
2230 			c = '?';
2231 		else
2232 			c += 'A' - 1;
2233 	}
2234 	(void)ttyoutput(c, tp);
2235 }
2236 
2237 /*
2238  * Wake up any readers on a tty.
2239  */
2240 void
2241 ttwakeup(struct tty *tp)
2242 {
2243 
2244 	if (tp->t_rsel.si_pid != 0)
2245 		selwakeup(&tp->t_rsel);
2246 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2247 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2248 	wakeup(TSA_HUP_OR_INPUT(tp));
2249 	KNOTE(&tp->t_rsel.si_note, 0);
2250 }
2251 
2252 /*
2253  * Wake up any writers on a tty.
2254  */
2255 void
2256 ttwwakeup(struct tty *tp)
2257 {
2258 
2259 	if (tp->t_wsel.si_pid != 0 && tp->t_outq.c_cc <= tp->t_olowat)
2260 		selwakeup(&tp->t_wsel);
2261 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2262 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2263 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2264 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2265 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2266 		wakeup(TSA_OCOMPLETE(tp));
2267 	}
2268 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2269 	    tp->t_outq.c_cc <= tp->t_olowat) {
2270 		CLR(tp->t_state, TS_SO_OLOWAT);
2271 		wakeup(TSA_OLOWAT(tp));
2272 	}
2273 	KNOTE(&tp->t_wsel.si_note, 0);
2274 }
2275 
2276 /*
2277  * Look up a code for a specified speed in a conversion table;
2278  * used by drivers to map software speed values to hardware parameters.
2279  */
2280 int
2281 ttspeedtab(int speed, struct speedtab *table)
2282 {
2283 
2284 	for ( ; table->sp_speed != -1; table++)
2285 		if (table->sp_speed == speed)
2286 			return (table->sp_code);
2287 	return (-1);
2288 }
2289 
2290 /*
2291  * Set input and output watermarks and buffer sizes.  For input, the
2292  * high watermark is about one second's worth of input above empty, the
2293  * low watermark is slightly below high water, and the buffer size is a
2294  * driver-dependent amount above high water.  For output, the watermarks
2295  * are near the ends of the buffer, with about 1 second's worth of input
2296  * between them.  All this only applies to the standard line discipline.
2297  */
2298 void
2299 ttsetwater(struct tty *tp)
2300 {
2301 	int cps, ttmaxhiwat, x;
2302 
2303 	/* Input. */
2304 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2305 	switch (tp->t_ispeedwat) {
2306 	case (speed_t)-1:
2307 		cps = tp->t_ispeed / 10;
2308 		break;
2309 	case 0:
2310 		/*
2311 		 * This case is for old drivers that don't know about
2312 		 * t_ispeedwat.  Arrange for them to get the old buffer
2313 		 * sizes and watermarks.
2314 		 */
2315 		cps = TTYHOG - 2 * 256;
2316 		tp->t_ififosize = 2 * 2048;
2317 		break;
2318 	default:
2319 		cps = tp->t_ispeedwat / 10;
2320 		break;
2321 	}
2322 	tp->t_ihiwat = cps;
2323 	tp->t_ilowat = 7 * cps / 8;
2324 	x = cps + tp->t_ififosize;
2325 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2326 
2327 	/* Output. */
2328 	switch (tp->t_ospeedwat) {
2329 	case (speed_t)-1:
2330 		cps = tp->t_ospeed / 10;
2331 		ttmaxhiwat = 2 * TTMAXHIWAT;
2332 		break;
2333 	case 0:
2334 		cps = tp->t_ospeed / 10;
2335 		ttmaxhiwat = TTMAXHIWAT;
2336 		break;
2337 	default:
2338 		cps = tp->t_ospeedwat / 10;
2339 		ttmaxhiwat = 8 * TTMAXHIWAT;
2340 		break;
2341 	}
2342 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2343 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2344 	x += cps;
2345 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2346 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2347 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2348 	x += OBUFSIZ + 100;
2349 	clist_alloc_cblocks(&tp->t_outq, x, x);
2350 #undef	CLAMP
2351 }
2352 
2353 /*
2354  * Report on state of foreground process group.
2355  */
2356 void
2357 ttyinfo(struct tty *tp)
2358 {
2359 	struct proc *p, *pick;
2360 	struct lwp *lp;
2361 	struct rusage ru;
2362 	int tmp;
2363 
2364 	if (ttycheckoutq(tp,0) == 0)
2365 		return;
2366 
2367 	/*
2368 	 * We always print the load average, then figure out what else to
2369 	 * print based on the state of the current process group.
2370 	 */
2371 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2372 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2373 
2374 	if (tp->t_session == NULL) {
2375 		ttyprintf(tp, "not a controlling terminal\n");
2376 	} else if (tp->t_pgrp == NULL) {
2377 		ttyprintf(tp, "no foreground process group\n");
2378 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == 0) {
2379 		ttyprintf(tp, "empty foreground process group\n");
2380 	} else {
2381 		/*
2382 		 * Pick an interesting process.  Note that certain elements,
2383 		 * in particular the wmesg, require a critical section for
2384 		 * safe access (YYY and we are still not MP safe).
2385 		 *
2386 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2387 		 */
2388 		char buf[64];
2389 		const char *str;
2390 		long vmsz;
2391 		int pctcpu;
2392 
2393 		crit_enter();
2394 
2395 		/* XXX lwp should compare lwps */
2396 
2397 		for (pick = NULL; p != 0; p = LIST_NEXT(p, p_pglist)) {
2398 			if (proc_compare(pick, p))
2399 				pick = p;
2400 		}
2401 
2402 		/* XXX lwp */
2403 		lp = FIRST_LWP_IN_PROC(pick);
2404 		if (lp == NULL) {
2405 			ttyprintf(tp, "foreground process without lwp\n");
2406 			tp->t_rocount = 0;
2407 			crit_exit();
2408 			return;
2409 		}
2410 
2411 		/*
2412 		 * Figure out what wait/process-state message, and command
2413 		 * buffer to present
2414 		 */
2415 		/*
2416 		 * XXX lwp This is a horrible mixture.  We need to rework this
2417 		 * as soon as lwps have their own runnable status.
2418 		 */
2419 		if (pick->p_flag & P_WEXIT)
2420 			str = "exiting";
2421 		else if (lp->lwp_stat == LSRUN)
2422 			str = "running";
2423 		else if (pick->p_stat == SIDL)
2424 			str = "spawning";
2425 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2426 			str = lp->lwp_wmesg;
2427 		else
2428 			str = "iowait";
2429 
2430 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2431 			pick->p_comm, pick->p_pid, str);
2432 
2433 		/*
2434 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2435 		 * 'pick' becomes invalid the moment we exit the critical
2436 		 * section.
2437 		 */
2438 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0)
2439 			calcru_proc(pick, &ru);
2440 
2441 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2442 
2443 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2444 		    vmsz = 0;
2445 		else
2446 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2447 
2448 		crit_exit();
2449 
2450 		/*
2451 		 * Dump the output
2452 		 */
2453 		ttyprintf(tp, " %s ", buf);
2454 		ttyprintf(tp, "%ld.%02ldu ",
2455 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2456 		ttyprintf(tp, "%ld.%02lds ",
2457 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2458 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2459 	}
2460 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2461 }
2462 
2463 /*
2464  * Returns 1 if p2 is "better" than p1
2465  *
2466  * The algorithm for picking the "interesting" process is thus:
2467  *
2468  *	1) Only foreground processes are eligible - implied.
2469  *	2) Runnable processes are favored over anything else.  The runner
2470  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2471  *	   broken by picking the highest pid.
2472  *	3) The sleeper with the shortest sleep time is next.  With ties,
2473  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2474  *	4) Further ties are broken by picking the highest pid.
2475  */
2476 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2477 #define TESTAB(a, b)    ((a)<<1 | (b))
2478 #define ONLYA   2
2479 #define ONLYB   1
2480 #define BOTH    3
2481 
2482 static int
2483 proc_compare(struct proc *p1, struct proc *p2)
2484 {
2485 	struct lwp *lp1, *lp2;
2486 	if (p1 == NULL)
2487 		return (1);
2488 
2489 	/*
2490  	 * weed out zombies
2491 	 */
2492 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2493 	case ONLYA:
2494 		return (1);
2495 	case ONLYB:
2496 		return (0);
2497 	case BOTH:
2498 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2499 	}
2500 
2501 	/* XXX lwp */
2502 	lp1 = FIRST_LWP_IN_PROC(p1);
2503 	lp2 = FIRST_LWP_IN_PROC(p2);
2504 
2505 	/*
2506 	 * see if at least one of them is runnable
2507 	 */
2508 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2509 	case ONLYA:
2510 		return (0);
2511 	case ONLYB:
2512 		return (1);
2513 	case BOTH:
2514 		/*
2515 		 * tie - favor one with highest recent cpu utilization
2516 		 */
2517 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2518 			return (1);
2519 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2520 			return (0);
2521 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2522 	}
2523 	/*
2524 	 * pick the one with the smallest sleep time
2525 	 */
2526 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2527 		return (0);
2528 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2529 		return (1);
2530 	/*
2531 	 * favor one sleeping in a non-interruptible sleep
2532 	 */
2533 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2534 		return (1);
2535 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2536 		return (0);
2537 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2538 }
2539 
2540 /*
2541  * Output char to tty; console putchar style.
2542  */
2543 int
2544 tputchar(int c, struct tty *tp)
2545 {
2546 	crit_enter();
2547 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2548 		crit_exit();
2549 		return (-1);
2550 	}
2551 	if (c == '\n')
2552 		(void)ttyoutput('\r', tp);
2553 	(void)ttyoutput(c, tp);
2554 	ttstart(tp);
2555 	crit_exit();
2556 	return (0);
2557 }
2558 
2559 /*
2560  * Sleep on chan, returning ERESTART if tty changed while we napped and
2561  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2562  * the tty is revoked, restarting a pending call will redo validation done
2563  * at the start of the call.
2564  */
2565 int
2566 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2567 {
2568 	int error;
2569 	int gen;
2570 
2571 	gen = tp->t_gen;
2572 	error = tsleep(chan, slpflags, wmesg, timo);
2573 	if (error)
2574 		return (error);
2575 	return (tp->t_gen == gen ? 0 : ERESTART);
2576 }
2577 
2578 /*
2579  * Allocate a tty struct.  Clists in the struct will be allocated by
2580  * ttyopen().
2581  */
2582 struct tty *
2583 ttymalloc(struct tty *tp)
2584 {
2585 
2586 	if (tp)
2587 		return(tp);
2588         tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2589 	ttyregister(tp);
2590         return (tp);
2591 }
2592 
2593 #if 0
2594 /*
2595  * Free a tty struct.  Clists in the struct should have been freed by
2596  * ttyclose().
2597  *
2598  * XXX not yet usable: since we support a half-closed state and do not
2599  * ref count the tty reference from the session, it is possible for a
2600  * session to hold a ref on the tty.  See TTY_DO_FULL_CLOSE.
2601  */
2602 void
2603 ttyfree(struct tty *tp)
2604 {
2605         kfree(tp, M_TTYS);
2606 }
2607 #endif /* 0 */
2608 
2609 void
2610 ttyregister(struct tty *tp)
2611 {
2612 	SLIST_INSERT_HEAD(&tty_list, tp, t_list);
2613 }
2614 
2615 static int
2616 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2617 {
2618 	int error;
2619 	struct tty *tp, t;
2620 	SLIST_FOREACH(tp, &tty_list, t_list) {
2621 		t = *tp;
2622 		if (t.t_dev)
2623 			t.t_dev = (cdev_t)dev2udev(t.t_dev);
2624 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2625 		if (error)
2626 			return (error);
2627 	}
2628 	return (0);
2629 }
2630 
2631 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2632 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2633 
2634 void
2635 nottystop(struct tty *tp, int rw)
2636 {
2637 
2638 	return;
2639 }
2640 
2641 int
2642 ttyread(struct dev_read_args *ap)
2643 {
2644 	struct tty *tp;
2645 
2646 	tp = ap->a_head.a_dev->si_tty;
2647 	if (tp == NULL)
2648 		return (ENODEV);
2649 	return ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2650 }
2651 
2652 int
2653 ttywrite(struct dev_write_args *ap)
2654 {
2655 	struct tty *tp;
2656 
2657 	tp = ap->a_head.a_dev->si_tty;
2658 	if (tp == NULL)
2659 		return (ENODEV);
2660 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2661 }
2662