xref: /dragonfly/sys/kern/tty.c (revision ab709bfb)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
39  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
40  * $DragonFly: src/sys/kern/tty.c,v 1.46 2008/09/10 09:50:09 y0netan1 Exp $
41  */
42 
43 /*-
44  * TODO:
45  *	o Fix races for sending the start char in ttyflush().
46  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
47  *	  With luck, there will be MIN chars before select() returns().
48  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
49  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
50  *	  FIONREAD.
51  *	o Do the new sio locking stuff here and use it to avoid special
52  *	  case for EXTPROC?
53  *	o Lock PENDIN too?
54  *	o Move EXTPROC and/or PENDIN to t_state?
55  *	o Wrap most of ttioctl in spltty/splx.
56  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
57  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
58  *	o Don't allow certain termios flags to affect disciplines other
59  *	  than TTYDISC.  Cancel their effects before switch disciplines
60  *	  and ignore them if they are set while we are in another
61  *	  discipline.
62  *	o Now that historical speed conversions are handled here, don't
63  *	  do them in drivers.
64  *	o Check for TS_CARR_ON being set while everything is closed and not
65  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
66  *	  so it would live until the next open even if carrier drops.
67  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
68  *	  only when _all_ openers leave open().
69  */
70 
71 #include "opt_compat.h"
72 #include "opt_uconsole.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/filio.h>
77 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
78 #include <sys/ioctl_compat.h>
79 #endif
80 #include <sys/proc.h>
81 #include <sys/priv.h>
82 #define	TTYDEFCHARS
83 #include <sys/tty.h>
84 #include <sys/clist.h>
85 #undef	TTYDEFCHARS
86 #include <sys/fcntl.h>
87 #include <sys/conf.h>
88 #include <sys/dkstat.h>
89 #include <sys/poll.h>
90 #include <sys/kernel.h>
91 #include <sys/vnode.h>
92 #include <sys/signalvar.h>
93 #include <sys/signal2.h>
94 #include <sys/resourcevar.h>
95 #include <sys/malloc.h>
96 #include <sys/filedesc.h>
97 #include <sys/sysctl.h>
98 #include <sys/thread2.h>
99 
100 #include <vm/vm.h>
101 #include <sys/lock.h>
102 #include <vm/pmap.h>
103 #include <vm/vm_map.h>
104 
105 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
106 
107 static int	proc_compare (struct proc *p1, struct proc *p2);
108 static int	ttnread (struct tty *tp);
109 static void	ttyecho (int c, struct tty *tp);
110 static int	ttyoutput (int c, struct tty *tp);
111 static void	ttypend (struct tty *tp);
112 static void	ttyretype (struct tty *tp);
113 static void	ttyrub (int c, struct tty *tp);
114 static void	ttyrubo (struct tty *tp, int cnt);
115 static void	ttyunblock (struct tty *tp);
116 static int	ttywflush (struct tty *tp);
117 static int	filt_ttyread (struct knote *kn, long hint);
118 static void 	filt_ttyrdetach (struct knote *kn);
119 static int	filt_ttywrite (struct knote *kn, long hint);
120 static void 	filt_ttywdetach (struct knote *kn);
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 static u_char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 /* Macros to clear/set/test flags. */
196 #define	SET(t, f)	(t) |= (f)
197 #define	CLR(t, f)	(t) &= ~(f)
198 #define	ISSET(t, f)	((t) & (f))
199 
200 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
201 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
202 
203 uint64_t tk_nin;
204 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
205     "LU", "TTY input statistic");
206 uint64_t tk_nout;
207 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
208     "LU", "TTY output statistic");
209 uint64_t tk_rawcc;
210 
211 /*
212  * list of struct tty where pstat(8) can pick it up with sysctl
213  */
214 static SLIST_HEAD(, tty) tty_list;
215 
216 /*
217  * Initial open of tty, or (re)entry to standard tty line discipline.
218  */
219 int
220 ttyopen(cdev_t device, struct tty *tp)
221 {
222 	crit_enter();
223 	tp->t_dev = device;
224 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
225 		SET(tp->t_state, TS_ISOPEN);
226 		if (ISSET(tp->t_cflag, CLOCAL))
227 			SET(tp->t_state, TS_CONNECTED);
228 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
229 	}
230 	ttsetwater(tp);
231 	crit_exit();
232 	return (0);
233 }
234 
235 /*
236  * Handle close() on a tty line: flush and set to initial state,
237  * bumping generation number so that pending read/write calls
238  * can detect recycling of the tty.
239  *
240  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
241  * and l_close() should have flushed, but we repeat the spltty() and
242  * the flush in case there are buggy callers.
243  */
244 int
245 ttyclose(struct tty *tp)
246 {
247 	funsetown(tp->t_sigio);
248 	crit_enter();
249 	if (constty == tp)
250 		constty = NULL;
251 
252 	ttyflush(tp, FREAD | FWRITE);
253 	clist_free_cblocks(&tp->t_canq);
254 	clist_free_cblocks(&tp->t_outq);
255 	clist_free_cblocks(&tp->t_rawq);
256 
257 	tp->t_gen++;
258 	tp->t_line = TTYDISC;
259 	ttyclearsession(tp);
260 	tp->t_state = 0;
261 	crit_exit();
262 	return (0);
263 }
264 
265 /*
266  * Disassociate the tty from its session.  Traditionally this has only been
267  * a half-close, meaning that the session was still allowed to point at the
268  * tty (resulting in the tty in the ps command showing something like 'p0-'),
269  * even though the tty is no longer pointing at the session.
270  *
271  * The half close seems to be useful only for 'ps' output but there is as
272  * yet no reason to remove the feature.  The full-close code is currently
273  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
274  */
275 void
276 ttyclearsession(struct tty *tp)
277 {
278 	struct session *sp;
279 
280 	tp->t_pgrp = NULL;
281 	if ((sp = tp->t_session) != NULL) {
282 		tp->t_session = NULL;
283 #ifdef TTY_DO_FULL_CLOSE
284 		/* FULL CLOSE (not yet) */
285 		if (sp->s_ttyp == tp) {
286 			sp->s_ttyp = NULL;
287 		} else {
288 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
289 				"%p/%p\n", sp->s_ttyp, tp);
290 		}
291 #endif
292 	}
293 }
294 
295 /*
296  * Release the tty vnode association for a session.  This is the
297  * 'other half' of the close.  Because multiple opens of /dev/tty
298  * only generate a single open to the actual tty, the file modes
299  * are locked to FREAD|FWRITE.
300  *
301  * If dorevoke is non-zero, the session is also revoked.  We have to
302  * close the vnode if VCTTYISOPEN is set.
303  */
304 void
305 ttyclosesession(struct session *sp, int dorevoke)
306 {
307 	struct vnode *vp;
308 
309 retry:
310 	/*
311 	 * There may not be a controlling terminal or it may have been closed
312 	 * out from under us.
313 	 */
314 	if ((vp = sp->s_ttyvp) == NULL)
315 		return;
316 
317 	/*
318 	 * We need a lock if we have to close or revoke.
319 	 */
320 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
321 		vhold(vp);
322 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
323 			vdrop(vp);
324 			goto retry;
325 		}
326 
327 		/*
328 		 * Retry if the vnode was ripped out from under us
329 		 */
330 		if (vp != sp->s_ttyvp) {
331 			vn_unlock(vp);
332 			vdrop(vp);
333 			goto retry;
334 		}
335 
336 		/*
337 		 * Close and revoke as needed
338 		 */
339 		sp->s_ttyvp = NULL;
340 		if (vp->v_flag & VCTTYISOPEN) {
341 			vclrflags(vp, VCTTYISOPEN);
342 			VOP_CLOSE(vp, FREAD|FWRITE);
343 		}
344 		if (dorevoke)
345 			VOP_REVOKE(vp, REVOKEALL);
346 		vn_unlock(vp);
347 		vdrop(vp);
348 	} else {
349 		sp->s_ttyvp = NULL;
350 	}
351 	vrele(vp);
352 }
353 
354 #define	FLUSHQ(q) {							\
355 	if ((q)->c_cc)							\
356 		ndflush(q, (q)->c_cc);					\
357 }
358 
359 /* Is 'c' a line delimiter ("break" character)? */
360 #define	TTBREAKC(c, lflag)							\
361 	((c) == '\n' || (((c) == cc[VEOF] ||				\
362 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
363 	 (c) != _POSIX_VDISABLE))
364 
365 /*
366  * Process input of a single character received on a tty.
367  */
368 int
369 ttyinput(int c, struct tty *tp)
370 {
371 	tcflag_t iflag, lflag;
372 	cc_t *cc;
373 	int i, err;
374 
375 	/*
376 	 * If input is pending take it first.
377 	 */
378 	lflag = tp->t_lflag;
379 	if (ISSET(lflag, PENDIN))
380 		ttypend(tp);
381 	/*
382 	 * Gather stats.
383 	 */
384 	if (ISSET(lflag, ICANON))
385 		++tp->t_cancc;
386 	else
387 		++tp->t_rawcc;
388 	++tk_nin;
389 
390 	/*
391 	 * Block further input iff:
392 	 * current input > threshold AND input is available to user program
393 	 * AND input flow control is enabled and not yet invoked.
394 	 * The 3 is slop for PARMRK.
395 	 */
396 	iflag = tp->t_iflag;
397 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
398 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
399 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
400 	    !ISSET(tp->t_state, TS_TBLOCK))
401 		ttyblock(tp);
402 
403 	/* Handle exceptional conditions (break, parity, framing). */
404 	cc = tp->t_cc;
405 	err = (ISSET(c, TTY_ERRORMASK));
406 	if (err) {
407 		CLR(c, TTY_ERRORMASK);
408 		if (ISSET(err, TTY_BI)) {
409 			if (ISSET(iflag, IGNBRK))
410 				return (0);
411 			if (ISSET(iflag, BRKINT)) {
412 				ttyflush(tp, FREAD | FWRITE);
413 				pgsignal(tp->t_pgrp, SIGINT, 1);
414 				goto endcase;
415 			}
416 			if (ISSET(iflag, PARMRK))
417 				goto parmrk;
418 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
419 			|| ISSET(err, TTY_FE)) {
420 			if (ISSET(iflag, IGNPAR))
421 				return (0);
422 			else if (ISSET(iflag, PARMRK)) {
423 parmrk:
424 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
425 				    MAX_INPUT - 3)
426 					goto input_overflow;
427 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
428 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
429 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
430 				goto endcase;
431 			} else
432 				c = 0;
433 		}
434 	}
435 
436 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
437 		CLR(c, 0x80);
438 	if (!ISSET(lflag, EXTPROC)) {
439 		/*
440 		 * Check for literal nexting very first
441 		 */
442 		if (ISSET(tp->t_state, TS_LNCH)) {
443 			SET(c, TTY_QUOTE);
444 			CLR(tp->t_state, TS_LNCH);
445 		}
446 		/*
447 		 * Scan for special characters.  This code
448 		 * is really just a big case statement with
449 		 * non-constant cases.  The bottom of the
450 		 * case statement is labeled ``endcase'', so goto
451 		 * it after a case match, or similar.
452 		 */
453 
454 		/*
455 		 * Control chars which aren't controlled
456 		 * by ICANON, ISIG, or IXON.
457 		 */
458 		if (ISSET(lflag, IEXTEN)) {
459 			if (CCEQ(cc[VLNEXT], c)) {
460 				if (ISSET(lflag, ECHO)) {
461 					if (ISSET(lflag, ECHOE)) {
462 						(void)ttyoutput('^', tp);
463 						(void)ttyoutput('\b', tp);
464 					} else
465 						ttyecho(c, tp);
466 				}
467 				SET(tp->t_state, TS_LNCH);
468 				goto endcase;
469 			}
470 			if (CCEQ(cc[VDISCARD], c)) {
471 				if (ISSET(lflag, FLUSHO))
472 					CLR(tp->t_lflag, FLUSHO);
473 				else {
474 					ttyflush(tp, FWRITE);
475 					ttyecho(c, tp);
476 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
477 						ttyretype(tp);
478 					SET(tp->t_lflag, FLUSHO);
479 				}
480 				goto startoutput;
481 			}
482 		}
483 		/*
484 		 * Signals.
485 		 */
486 		if (ISSET(lflag, ISIG)) {
487 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
488 				if (!ISSET(lflag, NOFLSH))
489 					ttyflush(tp, FREAD | FWRITE);
490 				ttyecho(c, tp);
491 				pgsignal(tp->t_pgrp,
492 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
493 				goto endcase;
494 			}
495 			if (CCEQ(cc[VSUSP], c)) {
496 				if (!ISSET(lflag, NOFLSH))
497 					ttyflush(tp, FREAD);
498 				ttyecho(c, tp);
499 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
500 				goto endcase;
501 			}
502 		}
503 		/*
504 		 * Handle start/stop characters.
505 		 */
506 		if (ISSET(iflag, IXON)) {
507 			if (CCEQ(cc[VSTOP], c)) {
508 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
509 					SET(tp->t_state, TS_TTSTOP);
510 					(*tp->t_stop)(tp, 0);
511 					return (0);
512 				}
513 				if (!CCEQ(cc[VSTART], c))
514 					return (0);
515 				/*
516 				 * if VSTART == VSTOP then toggle
517 				 */
518 				goto endcase;
519 			}
520 			if (CCEQ(cc[VSTART], c))
521 				goto restartoutput;
522 		}
523 		/*
524 		 * IGNCR, ICRNL, & INLCR
525 		 */
526 		if (c == '\r') {
527 			if (ISSET(iflag, IGNCR))
528 				return (0);
529 			else if (ISSET(iflag, ICRNL))
530 				c = '\n';
531 		} else if (c == '\n' && ISSET(iflag, INLCR))
532 			c = '\r';
533 	}
534 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
535 		/*
536 		 * From here on down canonical mode character
537 		 * processing takes place.
538 		 */
539 		/*
540 		 * erase or erase2 (^H / ^?)
541 		 */
542 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
543 			if (tp->t_rawq.c_cc)
544 				ttyrub(clist_unputc(&tp->t_rawq), tp);
545 			goto endcase;
546 		}
547 		/*
548 		 * kill (^U)
549 		 */
550 		if (CCEQ(cc[VKILL], c)) {
551 			if (ISSET(lflag, ECHOKE) &&
552 			    tp->t_rawq.c_cc == tp->t_rocount &&
553 			    !ISSET(lflag, ECHOPRT))
554 				while (tp->t_rawq.c_cc)
555 					ttyrub(clist_unputc(&tp->t_rawq), tp);
556 			else {
557 				ttyecho(c, tp);
558 				if (ISSET(lflag, ECHOK) ||
559 				    ISSET(lflag, ECHOKE))
560 					ttyecho('\n', tp);
561 				FLUSHQ(&tp->t_rawq);
562 				tp->t_rocount = 0;
563 			}
564 			CLR(tp->t_state, TS_LOCAL);
565 			goto endcase;
566 		}
567 		/*
568 		 * word erase (^W)
569 		 */
570 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
571 			int ctype;
572 
573 			/*
574 			 * erase whitespace
575 			 */
576 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
577 				ttyrub(c, tp);
578 			if (c == -1)
579 				goto endcase;
580 			/*
581 			 * erase last char of word and remember the
582 			 * next chars type (for ALTWERASE)
583 			 */
584 			ttyrub(c, tp);
585 			c = clist_unputc(&tp->t_rawq);
586 			if (c == -1)
587 				goto endcase;
588 			if (c == ' ' || c == '\t') {
589 				clist_putc(c, &tp->t_rawq);
590 				goto endcase;
591 			}
592 			ctype = ISALPHA(c);
593 			/*
594 			 * erase rest of word
595 			 */
596 			do {
597 				ttyrub(c, tp);
598 				c = clist_unputc(&tp->t_rawq);
599 				if (c == -1)
600 					goto endcase;
601 			} while (c != ' ' && c != '\t' &&
602 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
603 			clist_putc(c, &tp->t_rawq);
604 			goto endcase;
605 		}
606 		/*
607 		 * reprint line (^R)
608 		 */
609 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
610 			ttyretype(tp);
611 			goto endcase;
612 		}
613 		/*
614 		 * ^T - kernel info and generate SIGINFO
615 		 */
616 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
617 			if (ISSET(lflag, ISIG))
618 				pgsignal(tp->t_pgrp, SIGINFO, 1);
619 			if (!ISSET(lflag, NOKERNINFO))
620 				ttyinfo(tp);
621 			goto endcase;
622 		}
623 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
624 			if (ISSET(lflag, ISIG))
625 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
626 			goto endcase;
627 		}
628 	}
629 	/*
630 	 * Check for input buffer overflow
631 	 */
632 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
633 input_overflow:
634 		if (ISSET(iflag, IMAXBEL)) {
635 			if (tp->t_outq.c_cc < tp->t_ohiwat)
636 				(void)ttyoutput(CTRL('g'), tp);
637 		}
638 		goto endcase;
639 	}
640 
641 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
642 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
643 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
644 
645 	/*
646 	 * Put data char in q for user and
647 	 * wakeup on seeing a line delimiter.
648 	 */
649 	if (clist_putc(c, &tp->t_rawq) >= 0) {
650 		if (!ISSET(lflag, ICANON)) {
651 			ttwakeup(tp);
652 			ttyecho(c, tp);
653 			goto endcase;
654 		}
655 		if (TTBREAKC(c, lflag)) {
656 			tp->t_rocount = 0;
657 			catq(&tp->t_rawq, &tp->t_canq);
658 			ttwakeup(tp);
659 		} else if (tp->t_rocount++ == 0)
660 			tp->t_rocol = tp->t_column;
661 		if (ISSET(tp->t_state, TS_ERASE)) {
662 			/*
663 			 * end of prterase \.../
664 			 */
665 			CLR(tp->t_state, TS_ERASE);
666 			(void)ttyoutput('/', tp);
667 		}
668 		i = tp->t_column;
669 		ttyecho(c, tp);
670 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
671 			/*
672 			 * Place the cursor over the '^' of the ^D.
673 			 */
674 			i = imin(2, tp->t_column - i);
675 			while (i > 0) {
676 				(void)ttyoutput('\b', tp);
677 				i--;
678 			}
679 		}
680 	}
681 endcase:
682 	/*
683 	 * IXANY means allow any character to restart output.
684 	 */
685 	if (ISSET(tp->t_state, TS_TTSTOP) &&
686 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
687 		return (0);
688 restartoutput:
689 	CLR(tp->t_lflag, FLUSHO);
690 	CLR(tp->t_state, TS_TTSTOP);
691 startoutput:
692 	return (ttstart(tp));
693 }
694 
695 /*
696  * Output a single character on a tty, doing output processing
697  * as needed (expanding tabs, newline processing, etc.).
698  * Returns < 0 if succeeds, otherwise returns char to resend.
699  * Must be recursive.
700  */
701 static int
702 ttyoutput(int c, struct tty *tp)
703 {
704 	tcflag_t oflag;
705 	int col;
706 
707 	oflag = tp->t_oflag;
708 	if (!ISSET(oflag, OPOST)) {
709 		if (ISSET(tp->t_lflag, FLUSHO))
710 			return (-1);
711 		if (clist_putc(c, &tp->t_outq))
712 			return (c);
713 		tk_nout++;
714 		tp->t_outcc++;
715 		return (-1);
716 	}
717 	/*
718 	 * Do tab expansion if OXTABS is set.  Special case if we external
719 	 * processing, we don't do the tab expansion because we'll probably
720 	 * get it wrong.  If tab expansion needs to be done, let it happen
721 	 * externally.
722 	 */
723 	CLR(c, ~TTY_CHARMASK);
724 	if (c == '\t' &&
725 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
726 		c = 8 - (tp->t_column & 7);
727 		if (!ISSET(tp->t_lflag, FLUSHO)) {
728 			crit_enter();		/* Don't interrupt tabs. */
729 			c -= b_to_q("        ", c, &tp->t_outq);
730 			tk_nout += c;
731 			tp->t_outcc += c;
732 			crit_exit();
733 		}
734 		tp->t_column += c;
735 		return (c ? -1 : '\t');
736 	}
737 	if (c == CEOT && ISSET(oflag, ONOEOT))
738 		return (-1);
739 
740 	/*
741 	 * Newline translation: if ONLCR is set,
742 	 * translate newline into "\r\n".
743 	 */
744 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
745 		tk_nout++;
746 		tp->t_outcc++;
747 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq))
748 			return (c);
749 	}
750 	/* If OCRNL is set, translate "\r" into "\n". */
751 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
752 		c = '\n';
753 	/* If ONOCR is set, don't transmit CRs when on column 0. */
754 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
755 		return (-1);
756 
757 	tk_nout++;
758 	tp->t_outcc++;
759 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq))
760 		return (c);
761 
762 	col = tp->t_column;
763 	switch (CCLASS(c)) {
764 	case BACKSPACE:
765 		if (col > 0)
766 			--col;
767 		break;
768 	case CONTROL:
769 		break;
770 	case NEWLINE:
771 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
772 			col = 0;
773 		break;
774 	case RETURN:
775 		col = 0;
776 		break;
777 	case ORDINARY:
778 		++col;
779 		break;
780 	case TAB:
781 		col = (col + 8) & ~7;
782 		break;
783 	}
784 	tp->t_column = col;
785 	return (-1);
786 }
787 
788 /*
789  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
790  * has been called to do discipline-specific functions and/or reject any
791  * of these ioctl commands.
792  */
793 /* ARGSUSED */
794 int
795 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
796 {
797 	struct thread *td = curthread;
798 	struct lwp *lp = td->td_lwp;
799 	struct proc *p = td->td_proc;
800 	int error;
801 
802 	KKASSERT(p);
803 
804 	/* If the ioctl involves modification, hang if in the background. */
805 	switch (cmd) {
806 	case  TIOCCBRK:
807 	case  TIOCCONS:
808 	case  TIOCDRAIN:
809 	case  TIOCEXCL:
810 	case  TIOCFLUSH:
811 #ifdef TIOCHPCL
812 	case  TIOCHPCL:
813 #endif
814 	case  TIOCNXCL:
815 	case  TIOCSBRK:
816 	case  TIOCSCTTY:
817 	case  TIOCSDRAINWAIT:
818 	case  TIOCSETA:
819 	case  TIOCSETAF:
820 	case  TIOCSETAW:
821 	case  TIOCSETD:
822 	case  TIOCSPGRP:
823 	case  TIOCSTART:
824 	case  TIOCSTAT:
825 	case  TIOCSTI:
826 	case  TIOCSTOP:
827 	case  TIOCSWINSZ:
828 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
829 	case  TIOCLBIC:
830 	case  TIOCLBIS:
831 	case  TIOCLSET:
832 	case  TIOCSETC:
833 	case OTIOCSETD:
834 	case  TIOCSETN:
835 	case  TIOCSETP:
836 	case  TIOCSLTC:
837 #endif
838 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
839 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
840 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
841 			if (p->p_pgrp->pg_jobc == 0)
842 				return (EIO);
843 			pgsignal(p->p_pgrp, SIGTTOU, 1);
844 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
845 					 0);
846 			if (error)
847 				return (error);
848 		}
849 		break;
850 	}
851 
852 	switch (cmd) {			/* Process the ioctl. */
853 	case FIOASYNC:			/* set/clear async i/o */
854 		crit_enter();
855 		if (*(int *)data)
856 			SET(tp->t_state, TS_ASYNC);
857 		else
858 			CLR(tp->t_state, TS_ASYNC);
859 		crit_exit();
860 		break;
861 	case FIONREAD:			/* get # bytes to read */
862 		crit_enter();
863 		*(int *)data = ttnread(tp);
864 		crit_exit();
865 		break;
866 
867 	case FIOSETOWN:
868 		/*
869 		 * Policy -- Don't allow FIOSETOWN on someone else's
870 		 *           controlling tty
871 		 */
872 		if (tp->t_session != NULL && !isctty(p, tp))
873 			return (ENOTTY);
874 
875 		error = fsetown(*(int *)data, &tp->t_sigio);
876 		if (error)
877 			return (error);
878 		break;
879 	case FIOGETOWN:
880 		if (tp->t_session != NULL && !isctty(p, tp))
881 			return (ENOTTY);
882 		*(int *)data = fgetown(tp->t_sigio);
883 		break;
884 
885 	case TIOCEXCL:			/* set exclusive use of tty */
886 		crit_enter();
887 		SET(tp->t_state, TS_XCLUDE);
888 		crit_exit();
889 		break;
890 	case TIOCFLUSH: {		/* flush buffers */
891 		int flags = *(int *)data;
892 
893 		if (flags == 0)
894 			flags = FREAD | FWRITE;
895 		else
896 			flags &= FREAD | FWRITE;
897 		ttyflush(tp, flags);
898 		break;
899 	}
900 	case TIOCCONS:			/* become virtual console */
901 		if (*(int *)data) {
902 			if (constty && constty != tp &&
903 			    ISSET(constty->t_state, TS_CONNECTED))
904 				return (EBUSY);
905 #ifndef	UCONSOLE
906 			if ((error = priv_check(td, PRIV_ROOT)) != 0)
907 				return (error);
908 #endif
909 			constty = tp;
910 		} else if (tp == constty)
911 			constty = NULL;
912 		break;
913 	case TIOCDRAIN:			/* wait till output drained */
914 		error = ttywait(tp);
915 		if (error)
916 			return (error);
917 		break;
918 	case TIOCGETA: {		/* get termios struct */
919 		struct termios *t = (struct termios *)data;
920 
921 		bcopy(&tp->t_termios, t, sizeof(struct termios));
922 		break;
923 	}
924 	case TIOCGETD:			/* get line discipline */
925 		*(int *)data = tp->t_line;
926 		break;
927 	case TIOCGWINSZ:		/* get window size */
928 		*(struct winsize *)data = tp->t_winsize;
929 		break;
930 	case TIOCGPGRP:			/* get pgrp of tty */
931 		if (!isctty(p, tp))
932 			return (ENOTTY);
933 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
934 		break;
935 #ifdef TIOCHPCL
936 	case TIOCHPCL:			/* hang up on last close */
937 		crit_enter();
938 		SET(tp->t_cflag, HUPCL);
939 		crit_exit();
940 		break;
941 #endif
942 	case TIOCNXCL:			/* reset exclusive use of tty */
943 		crit_enter();
944 		CLR(tp->t_state, TS_XCLUDE);
945 		crit_exit();
946 		break;
947 	case TIOCOUTQ:			/* output queue size */
948 		*(int *)data = tp->t_outq.c_cc;
949 		break;
950 	case TIOCSETA:			/* set termios struct */
951 	case TIOCSETAW:			/* drain output, set */
952 	case TIOCSETAF: {		/* drn out, fls in, set */
953 		struct termios *t = (struct termios *)data;
954 
955 		if (t->c_ispeed == 0)
956 			t->c_ispeed = t->c_ospeed;
957 		if (t->c_ispeed == 0)
958 			t->c_ispeed = tp->t_ospeed;
959 		if (t->c_ispeed == 0)
960 			return (EINVAL);
961 		crit_enter();
962 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
963 			error = ttywait(tp);
964 			if (error) {
965 				crit_exit();
966 				return (error);
967 			}
968 			if (cmd == TIOCSETAF)
969 				ttyflush(tp, FREAD);
970 		}
971 		if (!ISSET(t->c_cflag, CIGNORE)) {
972 			/*
973 			 * Set device hardware.
974 			 */
975 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
976 				crit_exit();
977 				return (error);
978 			}
979 			if (ISSET(t->c_cflag, CLOCAL) &&
980 			    !ISSET(tp->t_cflag, CLOCAL)) {
981 				/*
982 				 * XXX disconnections would be too hard to
983 				 * get rid of without this kludge.  The only
984 				 * way to get rid of controlling terminals
985 				 * is to exit from the session leader.
986 				 */
987 				CLR(tp->t_state, TS_ZOMBIE);
988 
989 				wakeup(TSA_CARR_ON(tp));
990 				ttwakeup(tp);
991 				ttwwakeup(tp);
992 			}
993 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
994 			     ISSET(t->c_cflag, CLOCAL)) &&
995 			    !ISSET(tp->t_state, TS_ZOMBIE))
996 				SET(tp->t_state, TS_CONNECTED);
997 			else
998 				CLR(tp->t_state, TS_CONNECTED);
999 			tp->t_cflag = t->c_cflag;
1000 			tp->t_ispeed = t->c_ispeed;
1001 			if (t->c_ospeed != 0)
1002 				tp->t_ospeed = t->c_ospeed;
1003 			ttsetwater(tp);
1004 		}
1005 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1006 		    cmd != TIOCSETAF) {
1007 			if (ISSET(t->c_lflag, ICANON))
1008 				SET(tp->t_lflag, PENDIN);
1009 			else {
1010 				/*
1011 				 * XXX we really shouldn't allow toggling
1012 				 * ICANON while we're in a non-termios line
1013 				 * discipline.  Now we have to worry about
1014 				 * panicing for a null queue.
1015 				 */
1016 				if (tp->t_canq.c_cbreserved > 0 &&
1017 				    tp->t_rawq.c_cbreserved > 0) {
1018 					catq(&tp->t_rawq, &tp->t_canq);
1019 					/*
1020 					 * XXX the queue limits may be
1021 					 * different, so the old queue
1022 					 * swapping method no longer works.
1023 					 */
1024 					catq(&tp->t_canq, &tp->t_rawq);
1025 				}
1026 				CLR(tp->t_lflag, PENDIN);
1027 			}
1028 			ttwakeup(tp);
1029 		}
1030 		tp->t_iflag = t->c_iflag;
1031 		tp->t_oflag = t->c_oflag;
1032 		/*
1033 		 * Make the EXTPROC bit read only.
1034 		 */
1035 		if (ISSET(tp->t_lflag, EXTPROC))
1036 			SET(t->c_lflag, EXTPROC);
1037 		else
1038 			CLR(t->c_lflag, EXTPROC);
1039 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1040 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1041 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1042 			ttwakeup(tp);
1043 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1044 		crit_exit();
1045 		break;
1046 	}
1047 	case TIOCSETD: {		/* set line discipline */
1048 		int t = *(int *)data;
1049 		cdev_t device = tp->t_dev;
1050 
1051 		if ((u_int)t >= nlinesw)
1052 			return (ENXIO);
1053 		if (t != tp->t_line) {
1054 			crit_enter();
1055 			(*linesw[tp->t_line].l_close)(tp, flag);
1056 			error = (*linesw[t].l_open)(device, tp);
1057 			if (error) {
1058 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1059 				crit_exit();
1060 				return (error);
1061 			}
1062 			tp->t_line = t;
1063 			crit_exit();
1064 		}
1065 		break;
1066 	}
1067 	case TIOCSTART:			/* start output, like ^Q */
1068 		crit_enter();
1069 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1070 		    ISSET(tp->t_lflag, FLUSHO)) {
1071 			CLR(tp->t_lflag, FLUSHO);
1072 			CLR(tp->t_state, TS_TTSTOP);
1073 			ttstart(tp);
1074 		}
1075 		crit_exit();
1076 		break;
1077 	case TIOCSTI:			/* simulate terminal input */
1078 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT))
1079 			return (EPERM);
1080 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT))
1081 			return (EACCES);
1082 		crit_enter();
1083 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1084 		crit_exit();
1085 		break;
1086 	case TIOCSTOP:			/* stop output, like ^S */
1087 		crit_enter();
1088 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1089 			SET(tp->t_state, TS_TTSTOP);
1090 			(*tp->t_stop)(tp, 0);
1091 		}
1092 		crit_exit();
1093 		break;
1094 	case TIOCSCTTY:			/* become controlling tty */
1095 		/* Session ctty vnode pointer set in vnode layer. */
1096 		if (!SESS_LEADER(p) ||
1097 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1098 		    (tp->t_session != p->p_session)))
1099 			return (EPERM);
1100 		tp->t_session = p->p_session;
1101 		tp->t_pgrp = p->p_pgrp;
1102 		p->p_session->s_ttyp = tp;
1103 		p->p_flag |= P_CONTROLT;
1104 		break;
1105 	case TIOCSPGRP: {		/* set pgrp of tty */
1106 		struct pgrp *pgrp = pgfind(*(int *)data);
1107 
1108 		if (!isctty(p, tp))
1109 			return (ENOTTY);
1110 		else if (pgrp == NULL || pgrp->pg_session != p->p_session)
1111 			return (EPERM);
1112 		tp->t_pgrp = pgrp;
1113 		break;
1114 	}
1115 	case TIOCSTAT:			/* simulate control-T */
1116 		crit_enter();
1117 		ttyinfo(tp);
1118 		crit_exit();
1119 		break;
1120 	case TIOCSWINSZ:		/* set window size */
1121 		if (bcmp((caddr_t)&tp->t_winsize, data,
1122 		    sizeof (struct winsize))) {
1123 			tp->t_winsize = *(struct winsize *)data;
1124 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1125 		}
1126 		break;
1127 	case TIOCSDRAINWAIT:
1128 		error = priv_check(td, PRIV_ROOT);
1129 		if (error)
1130 			return (error);
1131 		tp->t_timeout = *(int *)data * hz;
1132 		wakeup(TSA_OCOMPLETE(tp));
1133 		wakeup(TSA_OLOWAT(tp));
1134 		break;
1135 	case TIOCGDRAINWAIT:
1136 		*(int *)data = tp->t_timeout / hz;
1137 		break;
1138 	default:
1139 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1140 		return (ttcompat(tp, cmd, data, flag));
1141 #else
1142 		return (ENOIOCTL);
1143 #endif
1144 	}
1145 	return (0);
1146 }
1147 
1148 int
1149 ttypoll(struct dev_poll_args *ap)
1150 {
1151 	cdev_t dev = ap->a_head.a_dev;
1152 	int events = ap->a_events;
1153 	int revents = 0;
1154 	struct tty *tp;
1155 
1156 	tp = dev->si_tty;
1157 	/* XXX used to return ENXIO, but that means true! */
1158 	if (tp == NULL) {
1159 		ap->a_events = (events & (POLLIN | POLLOUT | POLLRDNORM |
1160 				POLLWRNORM)) | POLLHUP;
1161 		return(0);
1162 	}
1163 
1164 	crit_enter();
1165 	if (events & (POLLIN | POLLRDNORM)) {
1166 		if (ttnread(tp) > 0 || ISSET(tp->t_state, TS_ZOMBIE))
1167 			revents |= events & (POLLIN | POLLRDNORM);
1168 		else
1169 			selrecord(curthread, &tp->t_rsel);
1170 	}
1171 	if (events & (POLLOUT | POLLWRNORM)) {
1172 		if ((tp->t_outq.c_cc <= tp->t_olowat &&
1173 		     ISSET(tp->t_state, TS_CONNECTED))
1174 		    || ISSET(tp->t_state, TS_ZOMBIE))
1175 			revents |= events & (POLLOUT | POLLWRNORM);
1176 		else
1177 			selrecord(curthread, &tp->t_wsel);
1178 	}
1179 	crit_exit();
1180 	ap->a_events = revents;
1181 	return (0);
1182 }
1183 
1184 static struct filterops ttyread_filtops =
1185 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1186 static struct filterops ttywrite_filtops =
1187 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1188 
1189 int
1190 ttykqfilter(struct dev_kqfilter_args *ap)
1191 {
1192 	cdev_t dev = ap->a_head.a_dev;
1193 	struct knote *kn = ap->a_kn;
1194 	struct tty *tp = dev->si_tty;
1195 	struct klist *klist;
1196 
1197 	ap->a_result = 0;
1198 	switch (kn->kn_filter) {
1199 	case EVFILT_READ:
1200 		klist = &tp->t_rsel.si_note;
1201 		kn->kn_fop = &ttyread_filtops;
1202 		break;
1203 	case EVFILT_WRITE:
1204 		klist = &tp->t_wsel.si_note;
1205 		kn->kn_fop = &ttywrite_filtops;
1206 		break;
1207 	default:
1208 		ap->a_result = 1;
1209 		return (0);
1210 	}
1211 
1212 	kn->kn_hook = (caddr_t)dev;
1213 
1214 	crit_enter();
1215 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1216 	crit_exit();
1217 
1218 	return (0);
1219 }
1220 
1221 static void
1222 filt_ttyrdetach(struct knote *kn)
1223 {
1224 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1225 
1226 	crit_enter();
1227 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
1228 	crit_exit();
1229 }
1230 
1231 static int
1232 filt_ttyread(struct knote *kn, long hint)
1233 {
1234 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1235 
1236 	kn->kn_data = ttnread(tp);
1237 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1238 		kn->kn_flags |= EV_EOF;
1239 		return (1);
1240 	}
1241 	return (kn->kn_data > 0);
1242 }
1243 
1244 static void
1245 filt_ttywdetach(struct knote *kn)
1246 {
1247 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1248 
1249 	crit_enter();
1250 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
1251 	crit_exit();
1252 }
1253 
1254 static int
1255 filt_ttywrite(struct knote *kn, long hint)
1256 {
1257 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1258 
1259 	kn->kn_data = tp->t_outq.c_cc;
1260 	if (ISSET(tp->t_state, TS_ZOMBIE))
1261 		return (1);
1262 	return (kn->kn_data <= tp->t_olowat &&
1263 	    ISSET(tp->t_state, TS_CONNECTED));
1264 }
1265 
1266 /*
1267  * Must be called while in a critical section.
1268  */
1269 static int
1270 ttnread(struct tty *tp)
1271 {
1272 	int nread;
1273 
1274 	if (ISSET(tp->t_lflag, PENDIN))
1275 		ttypend(tp);
1276 	nread = tp->t_canq.c_cc;
1277 	if (!ISSET(tp->t_lflag, ICANON)) {
1278 		nread += tp->t_rawq.c_cc;
1279 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1280 			nread = 0;
1281 	}
1282 	return (nread);
1283 }
1284 
1285 /*
1286  * Wait for output to drain.
1287  */
1288 int
1289 ttywait(struct tty *tp)
1290 {
1291 	int error;
1292 
1293 	error = 0;
1294 	crit_enter();
1295 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1296 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1297 		(*tp->t_oproc)(tp);
1298 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1299 		    ISSET(tp->t_state, TS_CONNECTED)) {
1300 			SET(tp->t_state, TS_SO_OCOMPLETE);
1301 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1302 					 PCATCH, "ttywai",
1303 					 tp->t_timeout);
1304 			if (error) {
1305 				if (error == EWOULDBLOCK)
1306 					error = EIO;
1307 				break;
1308 			}
1309 		} else
1310 			break;
1311 	}
1312 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1313 		error = EIO;
1314 	crit_exit();
1315 	return (error);
1316 }
1317 
1318 /*
1319  * Flush if successfully wait.
1320  */
1321 static int
1322 ttywflush(struct tty *tp)
1323 {
1324 	int error;
1325 
1326 	if ((error = ttywait(tp)) == 0)
1327 		ttyflush(tp, FREAD);
1328 	return (error);
1329 }
1330 
1331 /*
1332  * Flush tty read and/or write queues, notifying anyone waiting.
1333  */
1334 void
1335 ttyflush(struct tty *tp, int rw)
1336 {
1337 	crit_enter();
1338 #if 0
1339 again:
1340 #endif
1341 	if (rw & FWRITE) {
1342 		FLUSHQ(&tp->t_outq);
1343 		CLR(tp->t_state, TS_TTSTOP);
1344 	}
1345 	(*tp->t_stop)(tp, rw);
1346 	if (rw & FREAD) {
1347 		FLUSHQ(&tp->t_canq);
1348 		FLUSHQ(&tp->t_rawq);
1349 		CLR(tp->t_lflag, PENDIN);
1350 		tp->t_rocount = 0;
1351 		tp->t_rocol = 0;
1352 		CLR(tp->t_state, TS_LOCAL);
1353 		ttwakeup(tp);
1354 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1355 			if (rw & FWRITE)
1356 				FLUSHQ(&tp->t_outq);
1357 			ttyunblock(tp);
1358 
1359 			/*
1360 			 * Don't let leave any state that might clobber the
1361 			 * next line discipline (although we should do more
1362 			 * to send the START char).  Not clearing the state
1363 			 * may have caused the "putc to a clist with no
1364 			 * reserved cblocks" panic/kprintf.
1365 			 */
1366 			CLR(tp->t_state, TS_TBLOCK);
1367 
1368 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1369 			if (ISSET(tp->t_iflag, IXOFF)) {
1370 				/*
1371 				 * XXX wait a bit in the hope that the stop
1372 				 * character (if any) will go out.  Waiting
1373 				 * isn't good since it allows races.  This
1374 				 * will be fixed when the stop character is
1375 				 * put in a special queue.  Don't bother with
1376 				 * the checks in ttywait() since the timeout
1377 				 * will save us.
1378 				 */
1379 				SET(tp->t_state, TS_SO_OCOMPLETE);
1380 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1381 					 "ttyfls", hz / 10);
1382 				/*
1383 				 * Don't try sending the stop character again.
1384 				 */
1385 				CLR(tp->t_state, TS_TBLOCK);
1386 				goto again;
1387 			}
1388 #endif
1389 		}
1390 	}
1391 	if (rw & FWRITE) {
1392 		FLUSHQ(&tp->t_outq);
1393 		ttwwakeup(tp);
1394 	}
1395 	crit_exit();
1396 }
1397 
1398 /*
1399  * Copy in the default termios characters.
1400  */
1401 void
1402 termioschars(struct termios *t)
1403 {
1404 
1405 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1406 }
1407 
1408 /*
1409  * Old interface.
1410  */
1411 void
1412 ttychars(struct tty *tp)
1413 {
1414 
1415 	termioschars(&tp->t_termios);
1416 }
1417 
1418 /*
1419  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1420  * on our input flow control bit and propagate the changes to the driver.
1421  * XXX the stop character should be put in a special high priority queue.
1422  */
1423 void
1424 ttyblock(struct tty *tp)
1425 {
1426 
1427 	SET(tp->t_state, TS_TBLOCK);
1428 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1429 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1430 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1431 	ttstart(tp);
1432 }
1433 
1434 /*
1435  * Handle input low water.  Send start character for the IXOFF case.  Turn
1436  * off our input flow control bit and propagate the changes to the driver.
1437  * XXX the start character should be put in a special high priority queue.
1438  */
1439 static void
1440 ttyunblock(struct tty *tp)
1441 {
1442 
1443 	CLR(tp->t_state, TS_TBLOCK);
1444 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1445 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1446 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1447 	ttstart(tp);
1448 }
1449 
1450 #ifdef notyet
1451 /* Not used by any current (i386) drivers. */
1452 /*
1453  * Restart after an inter-char delay.
1454  */
1455 void
1456 ttrstrt(void *tp_arg)
1457 {
1458 	struct tty *tp;
1459 
1460 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1461 
1462 	tp = tp_arg;
1463 	crit_enter();
1464 	CLR(tp->t_state, TS_TIMEOUT);
1465 	ttstart(tp);
1466 	crit_exit();
1467 }
1468 #endif
1469 
1470 int
1471 ttstart(struct tty *tp)
1472 {
1473 
1474 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1475 		(*tp->t_oproc)(tp);
1476 	return (0);
1477 }
1478 
1479 /*
1480  * "close" a line discipline
1481  */
1482 int
1483 ttylclose(struct tty *tp, int flag)
1484 {
1485 
1486 	if (flag & FNONBLOCK || ttywflush(tp))
1487 		ttyflush(tp, FREAD | FWRITE);
1488 	return (0);
1489 }
1490 
1491 /*
1492  * Handle modem control transition on a tty.
1493  * Flag indicates new state of carrier.
1494  * Returns 0 if the line should be turned off, otherwise 1.
1495  */
1496 int
1497 ttymodem(struct tty *tp, int flag)
1498 {
1499 
1500 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1501 		/*
1502 		 * MDMBUF: do flow control according to carrier flag
1503 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1504 		 * works if IXON and IXANY are clear.
1505 		 */
1506 		if (flag) {
1507 			CLR(tp->t_state, TS_CAR_OFLOW);
1508 			CLR(tp->t_state, TS_TTSTOP);
1509 			ttstart(tp);
1510 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1511 			SET(tp->t_state, TS_CAR_OFLOW);
1512 			SET(tp->t_state, TS_TTSTOP);
1513 			(*tp->t_stop)(tp, 0);
1514 		}
1515 	} else if (flag == 0) {
1516 		/*
1517 		 * Lost carrier.
1518 		 */
1519 		CLR(tp->t_state, TS_CARR_ON);
1520 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1521 		    !ISSET(tp->t_cflag, CLOCAL)) {
1522 			SET(tp->t_state, TS_ZOMBIE);
1523 			CLR(tp->t_state, TS_CONNECTED);
1524 			if (tp->t_session && tp->t_session->s_leader)
1525 				ksignal(tp->t_session->s_leader, SIGHUP);
1526 			ttyflush(tp, FREAD | FWRITE);
1527 			return (0);
1528 		}
1529 	} else {
1530 		/*
1531 		 * Carrier now on.
1532 		 */
1533 		SET(tp->t_state, TS_CARR_ON);
1534 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1535 			SET(tp->t_state, TS_CONNECTED);
1536 		wakeup(TSA_CARR_ON(tp));
1537 		ttwakeup(tp);
1538 		ttwwakeup(tp);
1539 	}
1540 	return (1);
1541 }
1542 
1543 /*
1544  * Reinput pending characters after state switch
1545  * call from a critical section.
1546  */
1547 static void
1548 ttypend(struct tty *tp)
1549 {
1550 	struct clist tq;
1551 	int c;
1552 
1553 	CLR(tp->t_lflag, PENDIN);
1554 	SET(tp->t_state, TS_TYPEN);
1555 	/*
1556 	 * XXX this assumes too much about clist internals.  It may even
1557 	 * fail if the cblock slush pool is empty.  We can't allocate more
1558 	 * cblocks here because we are called from an interrupt handler
1559 	 * and clist_alloc_cblocks() can wait.
1560 	 */
1561 	tq = tp->t_rawq;
1562 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1563 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1564 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1565 	while ((c = clist_getc(&tq)) >= 0)
1566 		ttyinput(c, tp);
1567 	CLR(tp->t_state, TS_TYPEN);
1568 }
1569 
1570 /*
1571  * Process a read call on a tty device.
1572  */
1573 int
1574 ttread(struct tty *tp, struct uio *uio, int flag)
1575 {
1576 	struct clist *qp;
1577 	int c;
1578 	tcflag_t lflag;
1579 	cc_t *cc = tp->t_cc;
1580 	struct proc *pp;
1581 	struct lwp *lp;
1582 	int first, error = 0;
1583 	int has_stime = 0, last_cc = 0;
1584 	long slp = 0;		/* XXX this should be renamed `timo'. */
1585 	struct timeval stime;
1586 
1587 	lp = curthread->td_lwp;
1588 
1589 loop:
1590 	crit_enter();
1591 	lflag = tp->t_lflag;
1592 	/*
1593 	 * take pending input first
1594 	 */
1595 	if (ISSET(lflag, PENDIN)) {
1596 		ttypend(tp);
1597 		splz();		/* reduce latency */
1598 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1599 	}
1600 
1601 	/*
1602 	 * Hang process if it's in the background.
1603 	 */
1604 	if ((pp = curproc) && isbackground(pp, tp)) {
1605 		crit_exit();
1606 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1607 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1608 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0)
1609 			return (EIO);
1610 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1611 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1612 		if (error)
1613 			return (error);
1614 		goto loop;
1615 	}
1616 
1617 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1618 		crit_exit();
1619 		return (0);	/* EOF */
1620 	}
1621 
1622 	/*
1623 	 * If canonical, use the canonical queue,
1624 	 * else use the raw queue.
1625 	 *
1626 	 * (should get rid of clists...)
1627 	 */
1628 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1629 
1630 	if (flag & IO_NDELAY) {
1631 		if (qp->c_cc > 0)
1632 			goto read;
1633 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1634 			crit_exit();
1635 			return (0);
1636 		}
1637 		crit_exit();
1638 		return (EWOULDBLOCK);
1639 	}
1640 	if (!ISSET(lflag, ICANON)) {
1641 		int m = cc[VMIN];
1642 		long t = cc[VTIME];
1643 		struct timeval timecopy;
1644 
1645 		/*
1646 		 * Check each of the four combinations.
1647 		 * (m > 0 && t == 0) is the normal read case.
1648 		 * It should be fairly efficient, so we check that and its
1649 		 * companion case (m == 0 && t == 0) first.
1650 		 * For the other two cases, we compute the target sleep time
1651 		 * into slp.
1652 		 */
1653 		if (t == 0) {
1654 			if (qp->c_cc < m)
1655 				goto sleep;
1656 			if (qp->c_cc > 0)
1657 				goto read;
1658 
1659 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1660 			crit_exit();
1661 			return (0);
1662 		}
1663 		t *= 100000;		/* time in us */
1664 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1665 			 ((t1).tv_usec - (t2).tv_usec))
1666 		if (m > 0) {
1667 			if (qp->c_cc <= 0)
1668 				goto sleep;
1669 			if (qp->c_cc >= m)
1670 				goto read;
1671 			getmicrotime(&timecopy);
1672 			if (!has_stime) {
1673 				/* first character, start timer */
1674 				has_stime = 1;
1675 				stime = timecopy;
1676 				slp = t;
1677 			} else if (qp->c_cc > last_cc) {
1678 				/* got a character, restart timer */
1679 				stime = timecopy;
1680 				slp = t;
1681 			} else {
1682 				/* nothing, check expiration */
1683 				slp = t - diff(timecopy, stime);
1684 				if (slp <= 0)
1685 					goto read;
1686 			}
1687 			last_cc = qp->c_cc;
1688 		} else {	/* m == 0 */
1689 			if (qp->c_cc > 0)
1690 				goto read;
1691 			getmicrotime(&timecopy);
1692 			if (!has_stime) {
1693 				has_stime = 1;
1694 				stime = timecopy;
1695 				slp = t;
1696 			} else {
1697 				slp = t - diff(timecopy, stime);
1698 				if (slp <= 0) {
1699 					/* Timed out, but 0 is enough input. */
1700 					crit_exit();
1701 					return (0);
1702 				}
1703 			}
1704 		}
1705 #undef diff
1706 		/*
1707 		 * Rounding down may make us wake up just short
1708 		 * of the target, so we round up.
1709 		 * The formula is ceiling(slp * hz/1000000).
1710 		 * 32-bit arithmetic is enough for hz < 169.
1711 		 * XXX see tvtohz() for how to avoid overflow if hz
1712 		 * is large (divide by `tick' and/or arrange to
1713 		 * use tvtohz() if hz is large).
1714 		 */
1715 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1716 		goto sleep;
1717 	}
1718 	if (qp->c_cc <= 0) {
1719 sleep:
1720 		/*
1721 		 * There is no input, or not enough input and we can block.
1722 		 */
1723 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1724 				 ISSET(tp->t_state, TS_CONNECTED) ?
1725 				 "ttyin" : "ttyhup", (int)slp);
1726 		crit_exit();
1727 		if (error == EWOULDBLOCK)
1728 			error = 0;
1729 		else if (error)
1730 			return (error);
1731 		/*
1732 		 * XXX what happens if another process eats some input
1733 		 * while we are asleep (not just here)?  It would be
1734 		 * safest to detect changes and reset our state variables
1735 		 * (has_stime and last_cc).
1736 		 */
1737 		slp = 0;
1738 		goto loop;
1739 	}
1740 read:
1741 	crit_exit();
1742 	/*
1743 	 * Input present, check for input mapping and processing.
1744 	 */
1745 	first = 1;
1746 	if (ISSET(lflag, ICANON | ISIG))
1747 		goto slowcase;
1748 	for (;;) {
1749 		char ibuf[IBUFSIZ];
1750 		int icc;
1751 
1752 		icc = imin(uio->uio_resid, IBUFSIZ);
1753 		icc = q_to_b(qp, ibuf, icc);
1754 		if (icc <= 0) {
1755 			if (first)
1756 				goto loop;
1757 			break;
1758 		}
1759 		error = uiomove(ibuf, icc, uio);
1760 		/*
1761 		 * XXX if there was an error then we should ungetc() the
1762 		 * unmoved chars and reduce icc here.
1763 		 */
1764 		if (error)
1765 			break;
1766  		if (uio->uio_resid == 0)
1767 			break;
1768 		first = 0;
1769 	}
1770 	goto out;
1771 slowcase:
1772 	for (;;) {
1773 		c = clist_getc(qp);
1774 		if (c < 0) {
1775 			if (first)
1776 				goto loop;
1777 			break;
1778 		}
1779 		/*
1780 		 * delayed suspend (^Y)
1781 		 */
1782 		if (CCEQ(cc[VDSUSP], c) &&
1783 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1784 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1785 			if (first) {
1786 				error = ttysleep(tp, &lbolt, PCATCH,
1787 						 "ttybg3", 0);
1788 				if (error)
1789 					break;
1790 				goto loop;
1791 			}
1792 			break;
1793 		}
1794 		/*
1795 		 * Interpret EOF only in canonical mode.
1796 		 */
1797 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1798 			break;
1799 		/*
1800 		 * Give user character.
1801 		 */
1802  		error = ureadc(c, uio);
1803 		if (error)
1804 			/* XXX should ungetc(c, qp). */
1805 			break;
1806  		if (uio->uio_resid == 0)
1807 			break;
1808 		/*
1809 		 * In canonical mode check for a "break character"
1810 		 * marking the end of a "line of input".
1811 		 */
1812 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1813 			break;
1814 		first = 0;
1815 	}
1816 
1817 out:
1818 	/*
1819 	 * Look to unblock input now that (presumably)
1820 	 * the input queue has gone down.
1821 	 */
1822 	crit_enter();
1823 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1824 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1825 		ttyunblock(tp);
1826 	crit_exit();
1827 
1828 	return (error);
1829 }
1830 
1831 /*
1832  * Check the output queue on tp for space for a kernel message (from uprintf
1833  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1834  * lose messages due to normal flow control, but don't let the tty run amok.
1835  * Sleeps here are not interruptible, but we return prematurely if new signals
1836  * arrive.
1837  */
1838 int
1839 ttycheckoutq(struct tty *tp, int wait)
1840 {
1841 	struct lwp *lp = curthread->td_lwp;
1842 	int hiwat;
1843 	sigset_t oldset, newset;
1844 
1845 	hiwat = tp->t_ohiwat;
1846 	SIGEMPTYSET(oldset);
1847 	SIGEMPTYSET(newset);
1848 	crit_enter();
1849 	if (wait)
1850 		oldset = lwp_sigpend(lp);
1851 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
1852 		while (tp->t_outq.c_cc > hiwat) {
1853 			ttstart(tp);
1854 			if (tp->t_outq.c_cc <= hiwat)
1855 				break;
1856 			if (wait)
1857 				newset = lwp_sigpend(lp);
1858 			if (!wait || SIGSETNEQ(oldset, newset)) {
1859 				crit_exit();
1860 				return (0);
1861 			}
1862 			SET(tp->t_state, TS_SO_OLOWAT);
1863 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
1864 		}
1865 	}
1866 	crit_exit();
1867 	return (1);
1868 }
1869 
1870 /*
1871  * Process a write call on a tty device.
1872  */
1873 int
1874 ttwrite(struct tty *tp, struct uio *uio, int flag)
1875 {
1876 	char *cp = NULL;
1877 	int cc, ce;
1878 	struct proc *pp;
1879 	struct lwp *lp;
1880 	int i, hiwat, cnt, error;
1881 	char obuf[OBUFSIZ];
1882 
1883 	lp = curthread->td_lwp;
1884 	hiwat = tp->t_ohiwat;
1885 	cnt = uio->uio_resid;
1886 	error = 0;
1887 	cc = 0;
1888 loop:
1889 	crit_enter();
1890 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1891 		crit_exit();
1892 		if (uio->uio_resid == cnt)
1893 			error = EIO;
1894 		goto out;
1895 	}
1896 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
1897 		if (flag & IO_NDELAY) {
1898 			crit_exit();
1899 			error = EWOULDBLOCK;
1900 			goto out;
1901 		}
1902 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
1903 		crit_exit();
1904 		if (error)
1905 			goto out;
1906 		goto loop;
1907 	}
1908 	crit_exit();
1909 
1910 	/*
1911 	 * Hang the process if it's in the background.
1912 	 */
1913 	if ((pp = curproc) && isbackground(pp, tp) &&
1914 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
1915 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
1916 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
1917 		if (pp->p_pgrp->pg_jobc == 0) {
1918 			error = EIO;
1919 			goto out;
1920 		}
1921 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
1922 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
1923 		if (error)
1924 			goto out;
1925 		goto loop;
1926 	}
1927 	/*
1928 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1929 	 * output translation.  Keep track of high water mark, sleep on
1930 	 * overflow awaiting device aid in acquiring new space.
1931 	 */
1932 	while (uio->uio_resid > 0 || cc > 0) {
1933 		if (ISSET(tp->t_lflag, FLUSHO)) {
1934 			uio->uio_resid = 0;
1935 			return (0);
1936 		}
1937 		if (tp->t_outq.c_cc > hiwat)
1938 			goto ovhiwat;
1939 		/*
1940 		 * Grab a hunk of data from the user, unless we have some
1941 		 * leftover from last time.
1942 		 */
1943 		if (cc == 0) {
1944 			cc = imin(uio->uio_resid, OBUFSIZ);
1945 			cp = obuf;
1946 			error = uiomove(cp, cc, uio);
1947 			if (error) {
1948 				cc = 0;
1949 				break;
1950 			}
1951 		}
1952 		/*
1953 		 * If nothing fancy need be done, grab those characters we
1954 		 * can handle without any of ttyoutput's processing and
1955 		 * just transfer them to the output q.  For those chars
1956 		 * which require special processing (as indicated by the
1957 		 * bits in char_type), call ttyoutput.  After processing
1958 		 * a hunk of data, look for FLUSHO so ^O's will take effect
1959 		 * immediately.
1960 		 */
1961 		while (cc > 0) {
1962 			if (!ISSET(tp->t_oflag, OPOST))
1963 				ce = cc;
1964 			else {
1965 				ce = cc - scanc((u_int)cc, (u_char *)cp,
1966 						char_type, CCLASSMASK);
1967 				/*
1968 				 * If ce is zero, then we're processing
1969 				 * a special character through ttyoutput.
1970 				 */
1971 				if (ce == 0) {
1972 					tp->t_rocount = 0;
1973 					if (ttyoutput(*cp, tp) >= 0) {
1974 						/* No Clists, wait a bit. */
1975 						ttstart(tp);
1976 						if (flag & IO_NDELAY) {
1977 							error = EWOULDBLOCK;
1978 							goto out;
1979 						}
1980 						error = ttysleep(tp, &lbolt,
1981 								 PCATCH,
1982 								 "ttybf1", 0);
1983 						if (error)
1984 							goto out;
1985 						goto loop;
1986 					}
1987 					cp++;
1988 					cc--;
1989 					if (ISSET(tp->t_lflag, FLUSHO) ||
1990 					    tp->t_outq.c_cc > hiwat)
1991 						goto ovhiwat;
1992 					continue;
1993 				}
1994 			}
1995 			/*
1996 			 * A bunch of normal characters have been found.
1997 			 * Transfer them en masse to the output queue and
1998 			 * continue processing at the top of the loop.
1999 			 * If there are any further characters in this
2000 			 * <= OBUFSIZ chunk, the first should be a character
2001 			 * requiring special handling by ttyoutput.
2002 			 */
2003 			tp->t_rocount = 0;
2004 			i = b_to_q(cp, ce, &tp->t_outq);
2005 			ce -= i;
2006 			tp->t_column += ce;
2007 			cp += ce, cc -= ce, tk_nout += ce;
2008 			tp->t_outcc += ce;
2009 			if (i > 0) {
2010 				/* No Clists, wait a bit. */
2011 				ttstart(tp);
2012 				if (flag & IO_NDELAY) {
2013 					error = EWOULDBLOCK;
2014 					goto out;
2015 				}
2016 				error = ttysleep(tp, &lbolt, PCATCH,
2017 						 "ttybf2", 0);
2018 				if (error)
2019 					goto out;
2020 				goto loop;
2021 			}
2022 			if (ISSET(tp->t_lflag, FLUSHO) ||
2023 			    tp->t_outq.c_cc > hiwat)
2024 				break;
2025 		}
2026 		ttstart(tp);
2027 	}
2028 out:
2029 	/*
2030 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2031 	 * offset and iov pointers have moved forward, but it doesn't matter
2032 	 * (the call will either return short or restart with a new uio).
2033 	 */
2034 	uio->uio_resid += cc;
2035 	return (error);
2036 
2037 ovhiwat:
2038 	ttstart(tp);
2039 	crit_enter();
2040 	/*
2041 	 * This can only occur if FLUSHO is set in t_lflag,
2042 	 * or if ttstart/oproc is synchronous (or very fast).
2043 	 */
2044 	if (tp->t_outq.c_cc <= hiwat) {
2045 		crit_exit();
2046 		goto loop;
2047 	}
2048 	if (flag & IO_NDELAY) {
2049 		crit_exit();
2050 		uio->uio_resid += cc;
2051 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2052 	}
2053 	SET(tp->t_state, TS_SO_OLOWAT);
2054 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2055 	crit_exit();
2056 	if (error == EWOULDBLOCK)
2057 		error = EIO;
2058 	if (error)
2059 		goto out;
2060 	goto loop;
2061 }
2062 
2063 /*
2064  * Rubout one character from the rawq of tp
2065  * as cleanly as possible.
2066  */
2067 static void
2068 ttyrub(int c, struct tty *tp)
2069 {
2070 	char *cp;
2071 	int savecol;
2072 	int tabc;
2073 
2074 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2075 		return;
2076 	CLR(tp->t_lflag, FLUSHO);
2077 	if (ISSET(tp->t_lflag, ECHOE)) {
2078 		if (tp->t_rocount == 0) {
2079 			/*
2080 			 * Screwed by ttwrite; retype
2081 			 */
2082 			ttyretype(tp);
2083 			return;
2084 		}
2085 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2086 			ttyrubo(tp, 2);
2087 		else {
2088 			CLR(c, ~TTY_CHARMASK);
2089 			switch (CCLASS(c)) {
2090 			case ORDINARY:
2091 				ttyrubo(tp, 1);
2092 				break;
2093 			case BACKSPACE:
2094 			case CONTROL:
2095 			case NEWLINE:
2096 			case RETURN:
2097 			case VTAB:
2098 				if (ISSET(tp->t_lflag, ECHOCTL))
2099 					ttyrubo(tp, 2);
2100 				break;
2101 			case TAB:
2102 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2103 					ttyretype(tp);
2104 					return;
2105 				}
2106 				crit_enter();
2107 				savecol = tp->t_column;
2108 				SET(tp->t_state, TS_CNTTB);
2109 				SET(tp->t_lflag, FLUSHO);
2110 				tp->t_column = tp->t_rocol;
2111 				cp = tp->t_rawq.c_cf;
2112 				if (cp)
2113 					tabc = *cp;	/* XXX FIX NEXTC */
2114 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2115 					ttyecho(tabc, tp);
2116 				CLR(tp->t_lflag, FLUSHO);
2117 				CLR(tp->t_state, TS_CNTTB);
2118 				crit_exit();
2119 
2120 				/* savecol will now be length of the tab. */
2121 				savecol -= tp->t_column;
2122 				tp->t_column += savecol;
2123 				if (savecol > 8)
2124 					savecol = 8;	/* overflow screw */
2125 				while (--savecol >= 0)
2126 					(void)ttyoutput('\b', tp);
2127 				break;
2128 			default:			/* XXX */
2129 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2130 				(void)kprintf(PANICSTR, c, CCLASS(c));
2131 #ifdef notdef
2132 				panic(PANICSTR, c, CCLASS(c));
2133 #endif
2134 			}
2135 		}
2136 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2137 		if (!ISSET(tp->t_state, TS_ERASE)) {
2138 			SET(tp->t_state, TS_ERASE);
2139 			(void)ttyoutput('\\', tp);
2140 		}
2141 		ttyecho(c, tp);
2142 	} else {
2143 		ttyecho(tp->t_cc[VERASE], tp);
2144 		/*
2145 		 * This code may be executed not only when an ERASE key
2146 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2147 		 * So, I didn't think it was worthwhile to pass the extra
2148 		 * information (which would need an extra parameter,
2149 		 * changing every call) needed to distinguish the ERASE2
2150 		 * case from the ERASE.
2151 		 */
2152 	}
2153 	--tp->t_rocount;
2154 }
2155 
2156 /*
2157  * Back over cnt characters, erasing them.
2158  */
2159 static void
2160 ttyrubo(struct tty *tp, int cnt)
2161 {
2162 
2163 	while (cnt-- > 0) {
2164 		(void)ttyoutput('\b', tp);
2165 		(void)ttyoutput(' ', tp);
2166 		(void)ttyoutput('\b', tp);
2167 	}
2168 }
2169 
2170 /*
2171  * ttyretype --
2172  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2173  *	been checked.
2174  */
2175 static void
2176 ttyretype(struct tty *tp)
2177 {
2178 	char *cp;
2179 	int c;
2180 
2181 	/* Echo the reprint character. */
2182 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2183 		ttyecho(tp->t_cc[VREPRINT], tp);
2184 
2185 	(void)ttyoutput('\n', tp);
2186 
2187 	/*
2188 	 * XXX
2189 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2190 	 * BIT OF FIRST CHAR.
2191 	 */
2192 	crit_enter();
2193 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2194 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2195 		ttyecho(c, tp);
2196 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2197 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2198 		ttyecho(c, tp);
2199 	CLR(tp->t_state, TS_ERASE);
2200 	crit_exit();
2201 
2202 	tp->t_rocount = tp->t_rawq.c_cc;
2203 	tp->t_rocol = 0;
2204 }
2205 
2206 /*
2207  * Echo a typed character to the terminal.
2208  */
2209 static void
2210 ttyecho(int c, struct tty *tp)
2211 {
2212 
2213 	if (!ISSET(tp->t_state, TS_CNTTB))
2214 		CLR(tp->t_lflag, FLUSHO);
2215 	if ((!ISSET(tp->t_lflag, ECHO) &&
2216 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2217 	    ISSET(tp->t_lflag, EXTPROC))
2218 		return;
2219 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2220 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2221 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2222 		(void)ttyoutput('^', tp);
2223 		CLR(c, ~TTY_CHARMASK);
2224 		if (c == 0177)
2225 			c = '?';
2226 		else
2227 			c += 'A' - 1;
2228 	}
2229 	(void)ttyoutput(c, tp);
2230 }
2231 
2232 /*
2233  * Wake up any readers on a tty.
2234  */
2235 void
2236 ttwakeup(struct tty *tp)
2237 {
2238 
2239 	if (tp->t_rsel.si_pid != 0)
2240 		selwakeup(&tp->t_rsel);
2241 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2242 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2243 	wakeup(TSA_HUP_OR_INPUT(tp));
2244 	KNOTE(&tp->t_rsel.si_note, 0);
2245 }
2246 
2247 /*
2248  * Wake up any writers on a tty.
2249  */
2250 void
2251 ttwwakeup(struct tty *tp)
2252 {
2253 
2254 	if (tp->t_wsel.si_pid != 0 && tp->t_outq.c_cc <= tp->t_olowat)
2255 		selwakeup(&tp->t_wsel);
2256 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2257 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2258 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2259 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2260 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2261 		wakeup(TSA_OCOMPLETE(tp));
2262 	}
2263 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2264 	    tp->t_outq.c_cc <= tp->t_olowat) {
2265 		CLR(tp->t_state, TS_SO_OLOWAT);
2266 		wakeup(TSA_OLOWAT(tp));
2267 	}
2268 	KNOTE(&tp->t_wsel.si_note, 0);
2269 }
2270 
2271 /*
2272  * Look up a code for a specified speed in a conversion table;
2273  * used by drivers to map software speed values to hardware parameters.
2274  */
2275 int
2276 ttspeedtab(int speed, struct speedtab *table)
2277 {
2278 
2279 	for ( ; table->sp_speed != -1; table++)
2280 		if (table->sp_speed == speed)
2281 			return (table->sp_code);
2282 	return (-1);
2283 }
2284 
2285 /*
2286  * Set input and output watermarks and buffer sizes.  For input, the
2287  * high watermark is about one second's worth of input above empty, the
2288  * low watermark is slightly below high water, and the buffer size is a
2289  * driver-dependent amount above high water.  For output, the watermarks
2290  * are near the ends of the buffer, with about 1 second's worth of input
2291  * between them.  All this only applies to the standard line discipline.
2292  */
2293 void
2294 ttsetwater(struct tty *tp)
2295 {
2296 	int cps, ttmaxhiwat, x;
2297 
2298 	/* Input. */
2299 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2300 	switch (tp->t_ispeedwat) {
2301 	case (speed_t)-1:
2302 		cps = tp->t_ispeed / 10;
2303 		break;
2304 	case 0:
2305 		/*
2306 		 * This case is for old drivers that don't know about
2307 		 * t_ispeedwat.  Arrange for them to get the old buffer
2308 		 * sizes and watermarks.
2309 		 */
2310 		cps = TTYHOG - 2 * 256;
2311 		tp->t_ififosize = 2 * 2048;
2312 		break;
2313 	default:
2314 		cps = tp->t_ispeedwat / 10;
2315 		break;
2316 	}
2317 	tp->t_ihiwat = cps;
2318 	tp->t_ilowat = 7 * cps / 8;
2319 	x = cps + tp->t_ififosize;
2320 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2321 
2322 	/* Output. */
2323 	switch (tp->t_ospeedwat) {
2324 	case (speed_t)-1:
2325 		cps = tp->t_ospeed / 10;
2326 		ttmaxhiwat = 2 * TTMAXHIWAT;
2327 		break;
2328 	case 0:
2329 		cps = tp->t_ospeed / 10;
2330 		ttmaxhiwat = TTMAXHIWAT;
2331 		break;
2332 	default:
2333 		cps = tp->t_ospeedwat / 10;
2334 		ttmaxhiwat = 8 * TTMAXHIWAT;
2335 		break;
2336 	}
2337 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2338 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2339 	x += cps;
2340 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2341 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2342 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2343 	x += OBUFSIZ + 100;
2344 	clist_alloc_cblocks(&tp->t_outq, x, x);
2345 #undef	CLAMP
2346 }
2347 
2348 /*
2349  * Report on state of foreground process group.
2350  */
2351 void
2352 ttyinfo(struct tty *tp)
2353 {
2354 	struct proc *p, *pick;
2355 	struct lwp *lp;
2356 	struct rusage ru;
2357 	int tmp;
2358 
2359 	if (ttycheckoutq(tp,0) == 0)
2360 		return;
2361 
2362 	/*
2363 	 * We always print the load average, then figure out what else to
2364 	 * print based on the state of the current process group.
2365 	 */
2366 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2367 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2368 
2369 	if (tp->t_session == NULL) {
2370 		ttyprintf(tp, "not a controlling terminal\n");
2371 	} else if (tp->t_pgrp == NULL) {
2372 		ttyprintf(tp, "no foreground process group\n");
2373 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == 0) {
2374 		ttyprintf(tp, "empty foreground process group\n");
2375 	} else {
2376 		/*
2377 		 * Pick an interesting process.  Note that certain elements,
2378 		 * in particular the wmesg, require a critical section for
2379 		 * safe access (YYY and we are still not MP safe).
2380 		 *
2381 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2382 		 */
2383 		char buf[64];
2384 		const char *str;
2385 		long vmsz;
2386 		int pctcpu;
2387 
2388 		crit_enter();
2389 
2390 		/* XXX lwp should compare lwps */
2391 
2392 		for (pick = NULL; p != 0; p = LIST_NEXT(p, p_pglist)) {
2393 			if (proc_compare(pick, p))
2394 				pick = p;
2395 		}
2396 
2397 		/* XXX lwp */
2398 		lp = FIRST_LWP_IN_PROC(pick);
2399 		if (lp == NULL) {
2400 			ttyprintf(tp, "foreground process without lwp\n");
2401 			tp->t_rocount = 0;
2402 			crit_exit();
2403 			return;
2404 		}
2405 
2406 		/*
2407 		 * Figure out what wait/process-state message, and command
2408 		 * buffer to present
2409 		 */
2410 		/*
2411 		 * XXX lwp This is a horrible mixture.  We need to rework this
2412 		 * as soon as lwps have their own runnable status.
2413 		 */
2414 		if (pick->p_flag & P_WEXIT)
2415 			str = "exiting";
2416 		else if (lp->lwp_stat == LSRUN)
2417 			str = "running";
2418 		else if (pick->p_stat == SIDL)
2419 			str = "spawning";
2420 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2421 			str = lp->lwp_wmesg;
2422 		else
2423 			str = "iowait";
2424 
2425 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2426 			pick->p_comm, pick->p_pid, str);
2427 
2428 		/*
2429 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2430 		 * 'pick' becomes invalid the moment we exit the critical
2431 		 * section.
2432 		 */
2433 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0)
2434 			calcru_proc(pick, &ru);
2435 
2436 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2437 
2438 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2439 		    vmsz = 0;
2440 		else
2441 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2442 
2443 		crit_exit();
2444 
2445 		/*
2446 		 * Dump the output
2447 		 */
2448 		ttyprintf(tp, " %s ", buf);
2449 		ttyprintf(tp, "%ld.%02ldu ",
2450 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2451 		ttyprintf(tp, "%ld.%02lds ",
2452 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2453 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2454 	}
2455 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2456 }
2457 
2458 /*
2459  * Returns 1 if p2 is "better" than p1
2460  *
2461  * The algorithm for picking the "interesting" process is thus:
2462  *
2463  *	1) Only foreground processes are eligible - implied.
2464  *	2) Runnable processes are favored over anything else.  The runner
2465  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2466  *	   broken by picking the highest pid.
2467  *	3) The sleeper with the shortest sleep time is next.  With ties,
2468  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2469  *	4) Further ties are broken by picking the highest pid.
2470  */
2471 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2472 #define TESTAB(a, b)    ((a)<<1 | (b))
2473 #define ONLYA   2
2474 #define ONLYB   1
2475 #define BOTH    3
2476 
2477 static int
2478 proc_compare(struct proc *p1, struct proc *p2)
2479 {
2480 	struct lwp *lp1, *lp2;
2481 	if (p1 == NULL)
2482 		return (1);
2483 
2484 	/*
2485  	 * weed out zombies
2486 	 */
2487 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2488 	case ONLYA:
2489 		return (1);
2490 	case ONLYB:
2491 		return (0);
2492 	case BOTH:
2493 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2494 	}
2495 
2496 	/* XXX lwp */
2497 	lp1 = FIRST_LWP_IN_PROC(p1);
2498 	lp2 = FIRST_LWP_IN_PROC(p2);
2499 
2500 	/*
2501 	 * see if at least one of them is runnable
2502 	 */
2503 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2504 	case ONLYA:
2505 		return (0);
2506 	case ONLYB:
2507 		return (1);
2508 	case BOTH:
2509 		/*
2510 		 * tie - favor one with highest recent cpu utilization
2511 		 */
2512 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2513 			return (1);
2514 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2515 			return (0);
2516 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2517 	}
2518 	/*
2519 	 * pick the one with the smallest sleep time
2520 	 */
2521 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2522 		return (0);
2523 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2524 		return (1);
2525 	/*
2526 	 * favor one sleeping in a non-interruptible sleep
2527 	 */
2528 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2529 		return (1);
2530 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2531 		return (0);
2532 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2533 }
2534 
2535 /*
2536  * Output char to tty; console putchar style.
2537  */
2538 int
2539 tputchar(int c, struct tty *tp)
2540 {
2541 	crit_enter();
2542 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2543 		crit_exit();
2544 		return (-1);
2545 	}
2546 	if (c == '\n')
2547 		(void)ttyoutput('\r', tp);
2548 	(void)ttyoutput(c, tp);
2549 	ttstart(tp);
2550 	crit_exit();
2551 	return (0);
2552 }
2553 
2554 /*
2555  * Sleep on chan, returning ERESTART if tty changed while we napped and
2556  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2557  * the tty is revoked, restarting a pending call will redo validation done
2558  * at the start of the call.
2559  */
2560 int
2561 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2562 {
2563 	int error;
2564 	int gen;
2565 
2566 	gen = tp->t_gen;
2567 	error = tsleep(chan, slpflags, wmesg, timo);
2568 	if (error)
2569 		return (error);
2570 	return (tp->t_gen == gen ? 0 : ERESTART);
2571 }
2572 
2573 /*
2574  * Allocate a tty struct.  Clists in the struct will be allocated by
2575  * ttyopen().
2576  */
2577 struct tty *
2578 ttymalloc(struct tty *tp)
2579 {
2580 
2581 	if (tp)
2582 		return(tp);
2583         tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2584 	ttyregister(tp);
2585         return (tp);
2586 }
2587 
2588 #if 0
2589 /*
2590  * Free a tty struct.  Clists in the struct should have been freed by
2591  * ttyclose().
2592  *
2593  * XXX not yet usable: since we support a half-closed state and do not
2594  * ref count the tty reference from the session, it is possible for a
2595  * session to hold a ref on the tty.  See TTY_DO_FULL_CLOSE.
2596  */
2597 void
2598 ttyfree(struct tty *tp)
2599 {
2600         kfree(tp, M_TTYS);
2601 }
2602 #endif /* 0 */
2603 
2604 void
2605 ttyregister(struct tty *tp)
2606 {
2607 	SLIST_INSERT_HEAD(&tty_list, tp, t_list);
2608 }
2609 
2610 static int
2611 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2612 {
2613 	int error;
2614 	struct tty *tp, t;
2615 	SLIST_FOREACH(tp, &tty_list, t_list) {
2616 		t = *tp;
2617 		if (t.t_dev)
2618 			t.t_dev = (cdev_t)dev2udev(t.t_dev);
2619 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2620 		if (error)
2621 			return (error);
2622 	}
2623 	return (0);
2624 }
2625 
2626 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2627 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2628 
2629 void
2630 nottystop(struct tty *tp, int rw)
2631 {
2632 
2633 	return;
2634 }
2635 
2636 int
2637 ttyread(struct dev_read_args *ap)
2638 {
2639 	struct tty *tp;
2640 
2641 	tp = ap->a_head.a_dev->si_tty;
2642 	if (tp == NULL)
2643 		return (ENODEV);
2644 	return ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2645 }
2646 
2647 int
2648 ttywrite(struct dev_write_args *ap)
2649 {
2650 	struct tty *tp;
2651 
2652 	tp = ap->a_head.a_dev->si_tty;
2653 	if (tp == NULL)
2654 		return (ENODEV);
2655 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2656 }
2657