xref: /dragonfly/sys/kern/tty.c (revision cc93b0eb)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
39  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
40  * $DragonFly: src/sys/kern/tty.c,v 1.44 2008/01/15 14:19:11 hasso Exp $
41  */
42 
43 /*-
44  * TODO:
45  *	o Fix races for sending the start char in ttyflush().
46  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
47  *	  With luck, there will be MIN chars before select() returns().
48  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
49  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
50  *	  FIONREAD.
51  *	o Do the new sio locking stuff here and use it to avoid special
52  *	  case for EXTPROC?
53  *	o Lock PENDIN too?
54  *	o Move EXTPROC and/or PENDIN to t_state?
55  *	o Wrap most of ttioctl in spltty/splx.
56  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
57  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
58  *	o Don't allow certain termios flags to affect disciplines other
59  *	  than TTYDISC.  Cancel their effects before switch disciplines
60  *	  and ignore them if they are set while we are in another
61  *	  discipline.
62  *	o Now that historical speed conversions are handled here, don't
63  *	  do them in drivers.
64  *	o Check for TS_CARR_ON being set while everything is closed and not
65  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
66  *	  so it would live until the next open even if carrier drops.
67  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
68  *	  only when _all_ openers leave open().
69  */
70 
71 #include "opt_compat.h"
72 #include "opt_uconsole.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/filio.h>
77 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
78 #include <sys/ioctl_compat.h>
79 #endif
80 #include <sys/proc.h>
81 #define	TTYDEFCHARS
82 #include <sys/tty.h>
83 #include <sys/clist.h>
84 #undef	TTYDEFCHARS
85 #include <sys/fcntl.h>
86 #include <sys/conf.h>
87 #include <sys/dkstat.h>
88 #include <sys/poll.h>
89 #include <sys/kernel.h>
90 #include <sys/vnode.h>
91 #include <sys/signalvar.h>
92 #include <sys/signal2.h>
93 #include <sys/resourcevar.h>
94 #include <sys/malloc.h>
95 #include <sys/filedesc.h>
96 #include <sys/sysctl.h>
97 #include <sys/thread2.h>
98 
99 #include <vm/vm.h>
100 #include <sys/lock.h>
101 #include <vm/pmap.h>
102 #include <vm/vm_map.h>
103 
104 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
105 
106 static int	proc_compare (struct proc *p1, struct proc *p2);
107 static int	ttnread (struct tty *tp);
108 static void	ttyecho (int c, struct tty *tp);
109 static int	ttyoutput (int c, struct tty *tp);
110 static void	ttypend (struct tty *tp);
111 static void	ttyretype (struct tty *tp);
112 static void	ttyrub (int c, struct tty *tp);
113 static void	ttyrubo (struct tty *tp, int cnt);
114 static void	ttyunblock (struct tty *tp);
115 static int	ttywflush (struct tty *tp);
116 static int	filt_ttyread (struct knote *kn, long hint);
117 static void 	filt_ttyrdetach (struct knote *kn);
118 static int	filt_ttywrite (struct knote *kn, long hint);
119 static void 	filt_ttywdetach (struct knote *kn);
120 
121 /*
122  * Table with character classes and parity. The 8th bit indicates parity,
123  * the 7th bit indicates the character is an alphameric or underscore (for
124  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
125  * are 0 then the character needs no special processing on output; classes
126  * other than 0 might be translated or (not currently) require delays.
127  */
128 #define	E	0x00	/* Even parity. */
129 #define	O	0x80	/* Odd parity. */
130 #define	PARITY(c)	(char_type[c] & O)
131 
132 #define	ALPHA	0x40	/* Alpha or underscore. */
133 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
134 
135 #define	CCLASSMASK	0x3f
136 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
137 
138 #define	BS	BACKSPACE
139 #define	CC	CONTROL
140 #define	CR	RETURN
141 #define	NA	ORDINARY | ALPHA
142 #define	NL	NEWLINE
143 #define	NO	ORDINARY
144 #define	TB	TAB
145 #define	VT	VTAB
146 
147 static u_char const char_type[] = {
148 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
149 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
150 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
151 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
152 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
153 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
154 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
155 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
156 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
157 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
159 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
160 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
161 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
163 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
164 	/*
165 	 * Meta chars; should be settable per character set;
166 	 * for now, treat them all as normal characters.
167 	 */
168 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 };
185 #undef	BS
186 #undef	CC
187 #undef	CR
188 #undef	NA
189 #undef	NL
190 #undef	NO
191 #undef	TB
192 #undef	VT
193 
194 /* Macros to clear/set/test flags. */
195 #define	SET(t, f)	(t) |= (f)
196 #define	CLR(t, f)	(t) &= ~(f)
197 #define	ISSET(t, f)	((t) & (f))
198 
199 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
200 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
201 
202 uint64_t tk_nin;
203 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
204     "LU", "TTY input statistic");
205 uint64_t tk_nout;
206 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
207     "LU", "TTY output statistic");
208 uint64_t tk_rawcc;
209 
210 /*
211  * list of struct tty where pstat(8) can pick it up with sysctl
212  */
213 static SLIST_HEAD(, tty) tty_list;
214 
215 /*
216  * Initial open of tty, or (re)entry to standard tty line discipline.
217  */
218 int
219 ttyopen(cdev_t device, struct tty *tp)
220 {
221 	crit_enter();
222 	tp->t_dev = device;
223 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
224 		SET(tp->t_state, TS_ISOPEN);
225 		if (ISSET(tp->t_cflag, CLOCAL))
226 			SET(tp->t_state, TS_CONNECTED);
227 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
228 	}
229 	ttsetwater(tp);
230 	crit_exit();
231 	return (0);
232 }
233 
234 /*
235  * Handle close() on a tty line: flush and set to initial state,
236  * bumping generation number so that pending read/write calls
237  * can detect recycling of the tty.
238  *
239  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
240  * and l_close() should have flushed, but we repeat the spltty() and
241  * the flush in case there are buggy callers.
242  */
243 int
244 ttyclose(struct tty *tp)
245 {
246 	funsetown(tp->t_sigio);
247 	crit_enter();
248 	if (constty == tp)
249 		constty = NULL;
250 
251 	ttyflush(tp, FREAD | FWRITE);
252 	clist_free_cblocks(&tp->t_canq);
253 	clist_free_cblocks(&tp->t_outq);
254 	clist_free_cblocks(&tp->t_rawq);
255 
256 	tp->t_gen++;
257 	tp->t_line = TTYDISC;
258 	ttyclearsession(tp);
259 	tp->t_state = 0;
260 	crit_exit();
261 	return (0);
262 }
263 
264 /*
265  * Disassociate the tty from its session.  Traditionally this has only been
266  * a half-close, meaning that the session was still allowed to point at the
267  * tty (resulting in the tty in the ps command showing something like 'p0-'),
268  * even though the tty is no longer pointing at the session.
269  *
270  * The half close seems to be useful only for 'ps' output but there is as
271  * yet no reason to remove the feature.  The full-close code is currently
272  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
273  */
274 void
275 ttyclearsession(struct tty *tp)
276 {
277 	struct session *sp;
278 
279 	tp->t_pgrp = NULL;
280 	if ((sp = tp->t_session) != NULL) {
281 		tp->t_session = NULL;
282 #ifdef TTY_DO_FULL_CLOSE
283 		/* FULL CLOSE (not yet) */
284 		if (sp->s_ttyp == tp) {
285 			sp->s_ttyp = NULL;
286 		} else {
287 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
288 				"%p/%p\n", sp->s_ttyp, tp);
289 		}
290 #endif
291 	}
292 }
293 
294 /*
295  * Release the tty vnode association for a session.  This is the
296  * 'other half' of the close.  Because multiple opens of /dev/tty
297  * only generate a single open to the actual tty, the file modes
298  * are locked to FREAD|FWRITE.
299  *
300  * If dorevoke is non-zero, the session is also revoked.  We have to
301  * close the vnode if VCTTYISOPEN is set.
302  */
303 void
304 ttyclosesession(struct session *sp, int dorevoke)
305 {
306 	struct vnode *vp;
307 
308 retry:
309 	/*
310 	 * There may not be a controlling terminal or it may have been closed
311 	 * out from under us.
312 	 */
313 	if ((vp = sp->s_ttyvp) == NULL)
314 		return;
315 
316 	/*
317 	 * We need a lock if we have to close or revoke.
318 	 */
319 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
320 		vhold(vp);
321 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
322 			vdrop(vp);
323 			goto retry;
324 		}
325 
326 		/*
327 		 * Retry if the vnode was ripped out from under us
328 		 */
329 		if (vp != sp->s_ttyvp) {
330 			vn_unlock(vp);
331 			vdrop(vp);
332 			goto retry;
333 		}
334 
335 		/*
336 		 * Close and revoke as needed
337 		 */
338 		sp->s_ttyvp = NULL;
339 		if (vp->v_flag & VCTTYISOPEN) {
340 			vclrflags(vp, VCTTYISOPEN);
341 			VOP_CLOSE(vp, FREAD|FWRITE);
342 		}
343 		if (dorevoke)
344 			VOP_REVOKE(vp, REVOKEALL);
345 		vn_unlock(vp);
346 		vdrop(vp);
347 	} else {
348 		sp->s_ttyvp = NULL;
349 	}
350 	vrele(vp);
351 }
352 
353 #define	FLUSHQ(q) {							\
354 	if ((q)->c_cc)							\
355 		ndflush(q, (q)->c_cc);					\
356 }
357 
358 /* Is 'c' a line delimiter ("break" character)? */
359 #define	TTBREAKC(c, lflag)							\
360 	((c) == '\n' || (((c) == cc[VEOF] ||				\
361 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
362 	 (c) != _POSIX_VDISABLE))
363 
364 /*
365  * Process input of a single character received on a tty.
366  */
367 int
368 ttyinput(int c, struct tty *tp)
369 {
370 	tcflag_t iflag, lflag;
371 	cc_t *cc;
372 	int i, err;
373 
374 	/*
375 	 * If input is pending take it first.
376 	 */
377 	lflag = tp->t_lflag;
378 	if (ISSET(lflag, PENDIN))
379 		ttypend(tp);
380 	/*
381 	 * Gather stats.
382 	 */
383 	if (ISSET(lflag, ICANON))
384 		++tp->t_cancc;
385 	else
386 		++tp->t_rawcc;
387 	++tk_nin;
388 
389 	/*
390 	 * Block further input iff:
391 	 * current input > threshold AND input is available to user program
392 	 * AND input flow control is enabled and not yet invoked.
393 	 * The 3 is slop for PARMRK.
394 	 */
395 	iflag = tp->t_iflag;
396 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
397 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
398 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
399 	    !ISSET(tp->t_state, TS_TBLOCK))
400 		ttyblock(tp);
401 
402 	/* Handle exceptional conditions (break, parity, framing). */
403 	cc = tp->t_cc;
404 	err = (ISSET(c, TTY_ERRORMASK));
405 	if (err) {
406 		CLR(c, TTY_ERRORMASK);
407 		if (ISSET(err, TTY_BI)) {
408 			if (ISSET(iflag, IGNBRK))
409 				return (0);
410 			if (ISSET(iflag, BRKINT)) {
411 				ttyflush(tp, FREAD | FWRITE);
412 				pgsignal(tp->t_pgrp, SIGINT, 1);
413 				goto endcase;
414 			}
415 			if (ISSET(iflag, PARMRK))
416 				goto parmrk;
417 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
418 			|| ISSET(err, TTY_FE)) {
419 			if (ISSET(iflag, IGNPAR))
420 				return (0);
421 			else if (ISSET(iflag, PARMRK)) {
422 parmrk:
423 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
424 				    MAX_INPUT - 3)
425 					goto input_overflow;
426 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
427 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
428 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
429 				goto endcase;
430 			} else
431 				c = 0;
432 		}
433 	}
434 
435 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
436 		CLR(c, 0x80);
437 	if (!ISSET(lflag, EXTPROC)) {
438 		/*
439 		 * Check for literal nexting very first
440 		 */
441 		if (ISSET(tp->t_state, TS_LNCH)) {
442 			SET(c, TTY_QUOTE);
443 			CLR(tp->t_state, TS_LNCH);
444 		}
445 		/*
446 		 * Scan for special characters.  This code
447 		 * is really just a big case statement with
448 		 * non-constant cases.  The bottom of the
449 		 * case statement is labeled ``endcase'', so goto
450 		 * it after a case match, or similar.
451 		 */
452 
453 		/*
454 		 * Control chars which aren't controlled
455 		 * by ICANON, ISIG, or IXON.
456 		 */
457 		if (ISSET(lflag, IEXTEN)) {
458 			if (CCEQ(cc[VLNEXT], c)) {
459 				if (ISSET(lflag, ECHO)) {
460 					if (ISSET(lflag, ECHOE)) {
461 						(void)ttyoutput('^', tp);
462 						(void)ttyoutput('\b', tp);
463 					} else
464 						ttyecho(c, tp);
465 				}
466 				SET(tp->t_state, TS_LNCH);
467 				goto endcase;
468 			}
469 			if (CCEQ(cc[VDISCARD], c)) {
470 				if (ISSET(lflag, FLUSHO))
471 					CLR(tp->t_lflag, FLUSHO);
472 				else {
473 					ttyflush(tp, FWRITE);
474 					ttyecho(c, tp);
475 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
476 						ttyretype(tp);
477 					SET(tp->t_lflag, FLUSHO);
478 				}
479 				goto startoutput;
480 			}
481 		}
482 		/*
483 		 * Signals.
484 		 */
485 		if (ISSET(lflag, ISIG)) {
486 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
487 				if (!ISSET(lflag, NOFLSH))
488 					ttyflush(tp, FREAD | FWRITE);
489 				ttyecho(c, tp);
490 				pgsignal(tp->t_pgrp,
491 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
492 				goto endcase;
493 			}
494 			if (CCEQ(cc[VSUSP], c)) {
495 				if (!ISSET(lflag, NOFLSH))
496 					ttyflush(tp, FREAD);
497 				ttyecho(c, tp);
498 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
499 				goto endcase;
500 			}
501 		}
502 		/*
503 		 * Handle start/stop characters.
504 		 */
505 		if (ISSET(iflag, IXON)) {
506 			if (CCEQ(cc[VSTOP], c)) {
507 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
508 					SET(tp->t_state, TS_TTSTOP);
509 					(*tp->t_stop)(tp, 0);
510 					return (0);
511 				}
512 				if (!CCEQ(cc[VSTART], c))
513 					return (0);
514 				/*
515 				 * if VSTART == VSTOP then toggle
516 				 */
517 				goto endcase;
518 			}
519 			if (CCEQ(cc[VSTART], c))
520 				goto restartoutput;
521 		}
522 		/*
523 		 * IGNCR, ICRNL, & INLCR
524 		 */
525 		if (c == '\r') {
526 			if (ISSET(iflag, IGNCR))
527 				return (0);
528 			else if (ISSET(iflag, ICRNL))
529 				c = '\n';
530 		} else if (c == '\n' && ISSET(iflag, INLCR))
531 			c = '\r';
532 	}
533 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
534 		/*
535 		 * From here on down canonical mode character
536 		 * processing takes place.
537 		 */
538 		/*
539 		 * erase or erase2 (^H / ^?)
540 		 */
541 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
542 			if (tp->t_rawq.c_cc)
543 				ttyrub(clist_unputc(&tp->t_rawq), tp);
544 			goto endcase;
545 		}
546 		/*
547 		 * kill (^U)
548 		 */
549 		if (CCEQ(cc[VKILL], c)) {
550 			if (ISSET(lflag, ECHOKE) &&
551 			    tp->t_rawq.c_cc == tp->t_rocount &&
552 			    !ISSET(lflag, ECHOPRT))
553 				while (tp->t_rawq.c_cc)
554 					ttyrub(clist_unputc(&tp->t_rawq), tp);
555 			else {
556 				ttyecho(c, tp);
557 				if (ISSET(lflag, ECHOK) ||
558 				    ISSET(lflag, ECHOKE))
559 					ttyecho('\n', tp);
560 				FLUSHQ(&tp->t_rawq);
561 				tp->t_rocount = 0;
562 			}
563 			CLR(tp->t_state, TS_LOCAL);
564 			goto endcase;
565 		}
566 		/*
567 		 * word erase (^W)
568 		 */
569 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
570 			int ctype;
571 
572 			/*
573 			 * erase whitespace
574 			 */
575 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
576 				ttyrub(c, tp);
577 			if (c == -1)
578 				goto endcase;
579 			/*
580 			 * erase last char of word and remember the
581 			 * next chars type (for ALTWERASE)
582 			 */
583 			ttyrub(c, tp);
584 			c = clist_unputc(&tp->t_rawq);
585 			if (c == -1)
586 				goto endcase;
587 			if (c == ' ' || c == '\t') {
588 				clist_putc(c, &tp->t_rawq);
589 				goto endcase;
590 			}
591 			ctype = ISALPHA(c);
592 			/*
593 			 * erase rest of word
594 			 */
595 			do {
596 				ttyrub(c, tp);
597 				c = clist_unputc(&tp->t_rawq);
598 				if (c == -1)
599 					goto endcase;
600 			} while (c != ' ' && c != '\t' &&
601 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
602 			clist_putc(c, &tp->t_rawq);
603 			goto endcase;
604 		}
605 		/*
606 		 * reprint line (^R)
607 		 */
608 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
609 			ttyretype(tp);
610 			goto endcase;
611 		}
612 		/*
613 		 * ^T - kernel info and generate SIGINFO
614 		 */
615 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
616 			if (ISSET(lflag, ISIG))
617 				pgsignal(tp->t_pgrp, SIGINFO, 1);
618 			if (!ISSET(lflag, NOKERNINFO))
619 				ttyinfo(tp);
620 			goto endcase;
621 		}
622 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
623 			if (ISSET(lflag, ISIG))
624 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
625 			goto endcase;
626 		}
627 	}
628 	/*
629 	 * Check for input buffer overflow
630 	 */
631 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
632 input_overflow:
633 		if (ISSET(iflag, IMAXBEL)) {
634 			if (tp->t_outq.c_cc < tp->t_ohiwat)
635 				(void)ttyoutput(CTRL('g'), tp);
636 		}
637 		goto endcase;
638 	}
639 
640 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
641 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
642 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
643 
644 	/*
645 	 * Put data char in q for user and
646 	 * wakeup on seeing a line delimiter.
647 	 */
648 	if (clist_putc(c, &tp->t_rawq) >= 0) {
649 		if (!ISSET(lflag, ICANON)) {
650 			ttwakeup(tp);
651 			ttyecho(c, tp);
652 			goto endcase;
653 		}
654 		if (TTBREAKC(c, lflag)) {
655 			tp->t_rocount = 0;
656 			catq(&tp->t_rawq, &tp->t_canq);
657 			ttwakeup(tp);
658 		} else if (tp->t_rocount++ == 0)
659 			tp->t_rocol = tp->t_column;
660 		if (ISSET(tp->t_state, TS_ERASE)) {
661 			/*
662 			 * end of prterase \.../
663 			 */
664 			CLR(tp->t_state, TS_ERASE);
665 			(void)ttyoutput('/', tp);
666 		}
667 		i = tp->t_column;
668 		ttyecho(c, tp);
669 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
670 			/*
671 			 * Place the cursor over the '^' of the ^D.
672 			 */
673 			i = imin(2, tp->t_column - i);
674 			while (i > 0) {
675 				(void)ttyoutput('\b', tp);
676 				i--;
677 			}
678 		}
679 	}
680 endcase:
681 	/*
682 	 * IXANY means allow any character to restart output.
683 	 */
684 	if (ISSET(tp->t_state, TS_TTSTOP) &&
685 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
686 		return (0);
687 restartoutput:
688 	CLR(tp->t_lflag, FLUSHO);
689 	CLR(tp->t_state, TS_TTSTOP);
690 startoutput:
691 	return (ttstart(tp));
692 }
693 
694 /*
695  * Output a single character on a tty, doing output processing
696  * as needed (expanding tabs, newline processing, etc.).
697  * Returns < 0 if succeeds, otherwise returns char to resend.
698  * Must be recursive.
699  */
700 static int
701 ttyoutput(int c, struct tty *tp)
702 {
703 	tcflag_t oflag;
704 	int col;
705 
706 	oflag = tp->t_oflag;
707 	if (!ISSET(oflag, OPOST)) {
708 		if (ISSET(tp->t_lflag, FLUSHO))
709 			return (-1);
710 		if (clist_putc(c, &tp->t_outq))
711 			return (c);
712 		tk_nout++;
713 		tp->t_outcc++;
714 		return (-1);
715 	}
716 	/*
717 	 * Do tab expansion if OXTABS is set.  Special case if we external
718 	 * processing, we don't do the tab expansion because we'll probably
719 	 * get it wrong.  If tab expansion needs to be done, let it happen
720 	 * externally.
721 	 */
722 	CLR(c, ~TTY_CHARMASK);
723 	if (c == '\t' &&
724 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
725 		c = 8 - (tp->t_column & 7);
726 		if (!ISSET(tp->t_lflag, FLUSHO)) {
727 			crit_enter();		/* Don't interrupt tabs. */
728 			c -= b_to_q("        ", c, &tp->t_outq);
729 			tk_nout += c;
730 			tp->t_outcc += c;
731 			crit_exit();
732 		}
733 		tp->t_column += c;
734 		return (c ? -1 : '\t');
735 	}
736 	if (c == CEOT && ISSET(oflag, ONOEOT))
737 		return (-1);
738 
739 	/*
740 	 * Newline translation: if ONLCR is set,
741 	 * translate newline into "\r\n".
742 	 */
743 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
744 		tk_nout++;
745 		tp->t_outcc++;
746 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq))
747 			return (c);
748 	}
749 	/* If OCRNL is set, translate "\r" into "\n". */
750 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
751 		c = '\n';
752 	/* If ONOCR is set, don't transmit CRs when on column 0. */
753 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
754 		return (-1);
755 
756 	tk_nout++;
757 	tp->t_outcc++;
758 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq))
759 		return (c);
760 
761 	col = tp->t_column;
762 	switch (CCLASS(c)) {
763 	case BACKSPACE:
764 		if (col > 0)
765 			--col;
766 		break;
767 	case CONTROL:
768 		break;
769 	case NEWLINE:
770 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
771 			col = 0;
772 		break;
773 	case RETURN:
774 		col = 0;
775 		break;
776 	case ORDINARY:
777 		++col;
778 		break;
779 	case TAB:
780 		col = (col + 8) & ~7;
781 		break;
782 	}
783 	tp->t_column = col;
784 	return (-1);
785 }
786 
787 /*
788  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
789  * has been called to do discipline-specific functions and/or reject any
790  * of these ioctl commands.
791  */
792 /* ARGSUSED */
793 int
794 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
795 {
796 	struct thread *td = curthread;
797 	struct lwp *lp = td->td_lwp;
798 	struct proc *p = td->td_proc;
799 	int error;
800 
801 	KKASSERT(p);
802 
803 	/* If the ioctl involves modification, hang if in the background. */
804 	switch (cmd) {
805 	case  TIOCCBRK:
806 	case  TIOCCONS:
807 	case  TIOCDRAIN:
808 	case  TIOCEXCL:
809 	case  TIOCFLUSH:
810 #ifdef TIOCHPCL
811 	case  TIOCHPCL:
812 #endif
813 	case  TIOCNXCL:
814 	case  TIOCSBRK:
815 	case  TIOCSCTTY:
816 	case  TIOCSDRAINWAIT:
817 	case  TIOCSETA:
818 	case  TIOCSETAF:
819 	case  TIOCSETAW:
820 	case  TIOCSETD:
821 	case  TIOCSPGRP:
822 	case  TIOCSTART:
823 	case  TIOCSTAT:
824 	case  TIOCSTI:
825 	case  TIOCSTOP:
826 	case  TIOCSWINSZ:
827 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
828 	case  TIOCLBIC:
829 	case  TIOCLBIS:
830 	case  TIOCLSET:
831 	case  TIOCSETC:
832 	case OTIOCSETD:
833 	case  TIOCSETN:
834 	case  TIOCSETP:
835 	case  TIOCSLTC:
836 #endif
837 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
838 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
839 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
840 			if (p->p_pgrp->pg_jobc == 0)
841 				return (EIO);
842 			pgsignal(p->p_pgrp, SIGTTOU, 1);
843 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
844 					 0);
845 			if (error)
846 				return (error);
847 		}
848 		break;
849 	}
850 
851 	switch (cmd) {			/* Process the ioctl. */
852 	case FIOASYNC:			/* set/clear async i/o */
853 		crit_enter();
854 		if (*(int *)data)
855 			SET(tp->t_state, TS_ASYNC);
856 		else
857 			CLR(tp->t_state, TS_ASYNC);
858 		crit_exit();
859 		break;
860 	case FIONREAD:			/* get # bytes to read */
861 		crit_enter();
862 		*(int *)data = ttnread(tp);
863 		crit_exit();
864 		break;
865 
866 	case FIOSETOWN:
867 		/*
868 		 * Policy -- Don't allow FIOSETOWN on someone else's
869 		 *           controlling tty
870 		 */
871 		if (tp->t_session != NULL && !isctty(p, tp))
872 			return (ENOTTY);
873 
874 		error = fsetown(*(int *)data, &tp->t_sigio);
875 		if (error)
876 			return (error);
877 		break;
878 	case FIOGETOWN:
879 		if (tp->t_session != NULL && !isctty(p, tp))
880 			return (ENOTTY);
881 		*(int *)data = fgetown(tp->t_sigio);
882 		break;
883 
884 	case TIOCEXCL:			/* set exclusive use of tty */
885 		crit_enter();
886 		SET(tp->t_state, TS_XCLUDE);
887 		crit_exit();
888 		break;
889 	case TIOCFLUSH: {		/* flush buffers */
890 		int flags = *(int *)data;
891 
892 		if (flags == 0)
893 			flags = FREAD | FWRITE;
894 		else
895 			flags &= FREAD | FWRITE;
896 		ttyflush(tp, flags);
897 		break;
898 	}
899 	case TIOCCONS:			/* become virtual console */
900 		if (*(int *)data) {
901 			if (constty && constty != tp &&
902 			    ISSET(constty->t_state, TS_CONNECTED))
903 				return (EBUSY);
904 #ifndef	UCONSOLE
905 			if ((error = suser(td)) != 0)
906 				return (error);
907 #endif
908 			constty = tp;
909 		} else if (tp == constty)
910 			constty = NULL;
911 		break;
912 	case TIOCDRAIN:			/* wait till output drained */
913 		error = ttywait(tp);
914 		if (error)
915 			return (error);
916 		break;
917 	case TIOCGETA: {		/* get termios struct */
918 		struct termios *t = (struct termios *)data;
919 
920 		bcopy(&tp->t_termios, t, sizeof(struct termios));
921 		break;
922 	}
923 	case TIOCGETD:			/* get line discipline */
924 		*(int *)data = tp->t_line;
925 		break;
926 	case TIOCGWINSZ:		/* get window size */
927 		*(struct winsize *)data = tp->t_winsize;
928 		break;
929 	case TIOCGPGRP:			/* get pgrp of tty */
930 		if (!isctty(p, tp))
931 			return (ENOTTY);
932 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
933 		break;
934 #ifdef TIOCHPCL
935 	case TIOCHPCL:			/* hang up on last close */
936 		crit_enter();
937 		SET(tp->t_cflag, HUPCL);
938 		crit_exit();
939 		break;
940 #endif
941 	case TIOCNXCL:			/* reset exclusive use of tty */
942 		crit_enter();
943 		CLR(tp->t_state, TS_XCLUDE);
944 		crit_exit();
945 		break;
946 	case TIOCOUTQ:			/* output queue size */
947 		*(int *)data = tp->t_outq.c_cc;
948 		break;
949 	case TIOCSETA:			/* set termios struct */
950 	case TIOCSETAW:			/* drain output, set */
951 	case TIOCSETAF: {		/* drn out, fls in, set */
952 		struct termios *t = (struct termios *)data;
953 
954 		if (t->c_ispeed == 0)
955 			t->c_ispeed = t->c_ospeed;
956 		if (t->c_ispeed == 0)
957 			t->c_ispeed = tp->t_ospeed;
958 		if (t->c_ispeed == 0)
959 			return (EINVAL);
960 		crit_enter();
961 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
962 			error = ttywait(tp);
963 			if (error) {
964 				crit_exit();
965 				return (error);
966 			}
967 			if (cmd == TIOCSETAF)
968 				ttyflush(tp, FREAD);
969 		}
970 		if (!ISSET(t->c_cflag, CIGNORE)) {
971 			/*
972 			 * Set device hardware.
973 			 */
974 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
975 				crit_exit();
976 				return (error);
977 			}
978 			if (ISSET(t->c_cflag, CLOCAL) &&
979 			    !ISSET(tp->t_cflag, CLOCAL)) {
980 				/*
981 				 * XXX disconnections would be too hard to
982 				 * get rid of without this kludge.  The only
983 				 * way to get rid of controlling terminals
984 				 * is to exit from the session leader.
985 				 */
986 				CLR(tp->t_state, TS_ZOMBIE);
987 
988 				wakeup(TSA_CARR_ON(tp));
989 				ttwakeup(tp);
990 				ttwwakeup(tp);
991 			}
992 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
993 			     ISSET(t->c_cflag, CLOCAL)) &&
994 			    !ISSET(tp->t_state, TS_ZOMBIE))
995 				SET(tp->t_state, TS_CONNECTED);
996 			else
997 				CLR(tp->t_state, TS_CONNECTED);
998 			tp->t_cflag = t->c_cflag;
999 			tp->t_ispeed = t->c_ispeed;
1000 			if (t->c_ospeed != 0)
1001 				tp->t_ospeed = t->c_ospeed;
1002 			ttsetwater(tp);
1003 		}
1004 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1005 		    cmd != TIOCSETAF) {
1006 			if (ISSET(t->c_lflag, ICANON))
1007 				SET(tp->t_lflag, PENDIN);
1008 			else {
1009 				/*
1010 				 * XXX we really shouldn't allow toggling
1011 				 * ICANON while we're in a non-termios line
1012 				 * discipline.  Now we have to worry about
1013 				 * panicing for a null queue.
1014 				 */
1015 				if (tp->t_canq.c_cbreserved > 0 &&
1016 				    tp->t_rawq.c_cbreserved > 0) {
1017 					catq(&tp->t_rawq, &tp->t_canq);
1018 					/*
1019 					 * XXX the queue limits may be
1020 					 * different, so the old queue
1021 					 * swapping method no longer works.
1022 					 */
1023 					catq(&tp->t_canq, &tp->t_rawq);
1024 				}
1025 				CLR(tp->t_lflag, PENDIN);
1026 			}
1027 			ttwakeup(tp);
1028 		}
1029 		tp->t_iflag = t->c_iflag;
1030 		tp->t_oflag = t->c_oflag;
1031 		/*
1032 		 * Make the EXTPROC bit read only.
1033 		 */
1034 		if (ISSET(tp->t_lflag, EXTPROC))
1035 			SET(t->c_lflag, EXTPROC);
1036 		else
1037 			CLR(t->c_lflag, EXTPROC);
1038 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1039 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1040 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1041 			ttwakeup(tp);
1042 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1043 		crit_exit();
1044 		break;
1045 	}
1046 	case TIOCSETD: {		/* set line discipline */
1047 		int t = *(int *)data;
1048 		cdev_t device = tp->t_dev;
1049 
1050 		if ((u_int)t >= nlinesw)
1051 			return (ENXIO);
1052 		if (t != tp->t_line) {
1053 			crit_enter();
1054 			(*linesw[tp->t_line].l_close)(tp, flag);
1055 			error = (*linesw[t].l_open)(device, tp);
1056 			if (error) {
1057 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1058 				crit_exit();
1059 				return (error);
1060 			}
1061 			tp->t_line = t;
1062 			crit_exit();
1063 		}
1064 		break;
1065 	}
1066 	case TIOCSTART:			/* start output, like ^Q */
1067 		crit_enter();
1068 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1069 		    ISSET(tp->t_lflag, FLUSHO)) {
1070 			CLR(tp->t_lflag, FLUSHO);
1071 			CLR(tp->t_state, TS_TTSTOP);
1072 			ttstart(tp);
1073 		}
1074 		crit_exit();
1075 		break;
1076 	case TIOCSTI:			/* simulate terminal input */
1077 		if ((flag & FREAD) == 0 && suser(td))
1078 			return (EPERM);
1079 		if (!isctty(p, tp) && suser(td))
1080 			return (EACCES);
1081 		crit_enter();
1082 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1083 		crit_exit();
1084 		break;
1085 	case TIOCSTOP:			/* stop output, like ^S */
1086 		crit_enter();
1087 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1088 			SET(tp->t_state, TS_TTSTOP);
1089 			(*tp->t_stop)(tp, 0);
1090 		}
1091 		crit_exit();
1092 		break;
1093 	case TIOCSCTTY:			/* become controlling tty */
1094 		/* Session ctty vnode pointer set in vnode layer. */
1095 		if (!SESS_LEADER(p) ||
1096 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1097 		    (tp->t_session != p->p_session)))
1098 			return (EPERM);
1099 		tp->t_session = p->p_session;
1100 		tp->t_pgrp = p->p_pgrp;
1101 		p->p_session->s_ttyp = tp;
1102 		p->p_flag |= P_CONTROLT;
1103 		break;
1104 	case TIOCSPGRP: {		/* set pgrp of tty */
1105 		struct pgrp *pgrp = pgfind(*(int *)data);
1106 
1107 		if (!isctty(p, tp))
1108 			return (ENOTTY);
1109 		else if (pgrp == NULL || pgrp->pg_session != p->p_session)
1110 			return (EPERM);
1111 		tp->t_pgrp = pgrp;
1112 		break;
1113 	}
1114 	case TIOCSTAT:			/* simulate control-T */
1115 		crit_enter();
1116 		ttyinfo(tp);
1117 		crit_exit();
1118 		break;
1119 	case TIOCSWINSZ:		/* set window size */
1120 		if (bcmp((caddr_t)&tp->t_winsize, data,
1121 		    sizeof (struct winsize))) {
1122 			tp->t_winsize = *(struct winsize *)data;
1123 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1124 		}
1125 		break;
1126 	case TIOCSDRAINWAIT:
1127 		error = suser(td);
1128 		if (error)
1129 			return (error);
1130 		tp->t_timeout = *(int *)data * hz;
1131 		wakeup(TSA_OCOMPLETE(tp));
1132 		wakeup(TSA_OLOWAT(tp));
1133 		break;
1134 	case TIOCGDRAINWAIT:
1135 		*(int *)data = tp->t_timeout / hz;
1136 		break;
1137 	default:
1138 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1139 		return (ttcompat(tp, cmd, data, flag));
1140 #else
1141 		return (ENOIOCTL);
1142 #endif
1143 	}
1144 	return (0);
1145 }
1146 
1147 int
1148 ttypoll(struct dev_poll_args *ap)
1149 {
1150 	cdev_t dev = ap->a_head.a_dev;
1151 	int events = ap->a_events;
1152 	int revents = 0;
1153 	struct tty *tp;
1154 
1155 	tp = dev->si_tty;
1156 	/* XXX used to return ENXIO, but that means true! */
1157 	if (tp == NULL) {
1158 		ap->a_events = (events & (POLLIN | POLLOUT | POLLRDNORM |
1159 				POLLWRNORM)) | POLLHUP;
1160 		return(0);
1161 	}
1162 
1163 	crit_enter();
1164 	if (events & (POLLIN | POLLRDNORM)) {
1165 		if (ttnread(tp) > 0 || ISSET(tp->t_state, TS_ZOMBIE))
1166 			revents |= events & (POLLIN | POLLRDNORM);
1167 		else
1168 			selrecord(curthread, &tp->t_rsel);
1169 	}
1170 	if (events & (POLLOUT | POLLWRNORM)) {
1171 		if ((tp->t_outq.c_cc <= tp->t_olowat &&
1172 		     ISSET(tp->t_state, TS_CONNECTED))
1173 		    || ISSET(tp->t_state, TS_ZOMBIE))
1174 			revents |= events & (POLLOUT | POLLWRNORM);
1175 		else
1176 			selrecord(curthread, &tp->t_wsel);
1177 	}
1178 	crit_exit();
1179 	ap->a_events = revents;
1180 	return (0);
1181 }
1182 
1183 static struct filterops ttyread_filtops =
1184 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1185 static struct filterops ttywrite_filtops =
1186 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1187 
1188 int
1189 ttykqfilter(struct dev_kqfilter_args *ap)
1190 {
1191 	cdev_t dev = ap->a_head.a_dev;
1192 	struct knote *kn = ap->a_kn;
1193 	struct tty *tp = dev->si_tty;
1194 	struct klist *klist;
1195 
1196 	ap->a_result = 0;
1197 	switch (kn->kn_filter) {
1198 	case EVFILT_READ:
1199 		klist = &tp->t_rsel.si_note;
1200 		kn->kn_fop = &ttyread_filtops;
1201 		break;
1202 	case EVFILT_WRITE:
1203 		klist = &tp->t_wsel.si_note;
1204 		kn->kn_fop = &ttywrite_filtops;
1205 		break;
1206 	default:
1207 		ap->a_result = 1;
1208 		return (0);
1209 	}
1210 
1211 	kn->kn_hook = (caddr_t)dev;
1212 
1213 	crit_enter();
1214 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1215 	crit_exit();
1216 
1217 	return (0);
1218 }
1219 
1220 static void
1221 filt_ttyrdetach(struct knote *kn)
1222 {
1223 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1224 
1225 	crit_enter();
1226 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
1227 	crit_exit();
1228 }
1229 
1230 static int
1231 filt_ttyread(struct knote *kn, long hint)
1232 {
1233 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1234 
1235 	kn->kn_data = ttnread(tp);
1236 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1237 		kn->kn_flags |= EV_EOF;
1238 		return (1);
1239 	}
1240 	return (kn->kn_data > 0);
1241 }
1242 
1243 static void
1244 filt_ttywdetach(struct knote *kn)
1245 {
1246 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1247 
1248 	crit_enter();
1249 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
1250 	crit_exit();
1251 }
1252 
1253 static int
1254 filt_ttywrite(struct knote *kn, long hint)
1255 {
1256 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1257 
1258 	kn->kn_data = tp->t_outq.c_cc;
1259 	if (ISSET(tp->t_state, TS_ZOMBIE))
1260 		return (1);
1261 	return (kn->kn_data <= tp->t_olowat &&
1262 	    ISSET(tp->t_state, TS_CONNECTED));
1263 }
1264 
1265 /*
1266  * Must be called while in a critical section.
1267  */
1268 static int
1269 ttnread(struct tty *tp)
1270 {
1271 	int nread;
1272 
1273 	if (ISSET(tp->t_lflag, PENDIN))
1274 		ttypend(tp);
1275 	nread = tp->t_canq.c_cc;
1276 	if (!ISSET(tp->t_lflag, ICANON)) {
1277 		nread += tp->t_rawq.c_cc;
1278 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1279 			nread = 0;
1280 	}
1281 	return (nread);
1282 }
1283 
1284 /*
1285  * Wait for output to drain.
1286  */
1287 int
1288 ttywait(struct tty *tp)
1289 {
1290 	int error;
1291 
1292 	error = 0;
1293 	crit_enter();
1294 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1295 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1296 		(*tp->t_oproc)(tp);
1297 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1298 		    ISSET(tp->t_state, TS_CONNECTED)) {
1299 			SET(tp->t_state, TS_SO_OCOMPLETE);
1300 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1301 					 PCATCH, "ttywai",
1302 					 tp->t_timeout);
1303 			if (error) {
1304 				if (error == EWOULDBLOCK)
1305 					error = EIO;
1306 				break;
1307 			}
1308 		} else
1309 			break;
1310 	}
1311 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1312 		error = EIO;
1313 	crit_exit();
1314 	return (error);
1315 }
1316 
1317 /*
1318  * Flush if successfully wait.
1319  */
1320 static int
1321 ttywflush(struct tty *tp)
1322 {
1323 	int error;
1324 
1325 	if ((error = ttywait(tp)) == 0)
1326 		ttyflush(tp, FREAD);
1327 	return (error);
1328 }
1329 
1330 /*
1331  * Flush tty read and/or write queues, notifying anyone waiting.
1332  */
1333 void
1334 ttyflush(struct tty *tp, int rw)
1335 {
1336 	crit_enter();
1337 #if 0
1338 again:
1339 #endif
1340 	if (rw & FWRITE) {
1341 		FLUSHQ(&tp->t_outq);
1342 		CLR(tp->t_state, TS_TTSTOP);
1343 	}
1344 	(*tp->t_stop)(tp, rw);
1345 	if (rw & FREAD) {
1346 		FLUSHQ(&tp->t_canq);
1347 		FLUSHQ(&tp->t_rawq);
1348 		CLR(tp->t_lflag, PENDIN);
1349 		tp->t_rocount = 0;
1350 		tp->t_rocol = 0;
1351 		CLR(tp->t_state, TS_LOCAL);
1352 		ttwakeup(tp);
1353 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1354 			if (rw & FWRITE)
1355 				FLUSHQ(&tp->t_outq);
1356 			ttyunblock(tp);
1357 
1358 			/*
1359 			 * Don't let leave any state that might clobber the
1360 			 * next line discipline (although we should do more
1361 			 * to send the START char).  Not clearing the state
1362 			 * may have caused the "putc to a clist with no
1363 			 * reserved cblocks" panic/kprintf.
1364 			 */
1365 			CLR(tp->t_state, TS_TBLOCK);
1366 
1367 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1368 			if (ISSET(tp->t_iflag, IXOFF)) {
1369 				/*
1370 				 * XXX wait a bit in the hope that the stop
1371 				 * character (if any) will go out.  Waiting
1372 				 * isn't good since it allows races.  This
1373 				 * will be fixed when the stop character is
1374 				 * put in a special queue.  Don't bother with
1375 				 * the checks in ttywait() since the timeout
1376 				 * will save us.
1377 				 */
1378 				SET(tp->t_state, TS_SO_OCOMPLETE);
1379 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1380 					 "ttyfls", hz / 10);
1381 				/*
1382 				 * Don't try sending the stop character again.
1383 				 */
1384 				CLR(tp->t_state, TS_TBLOCK);
1385 				goto again;
1386 			}
1387 #endif
1388 		}
1389 	}
1390 	if (rw & FWRITE) {
1391 		FLUSHQ(&tp->t_outq);
1392 		ttwwakeup(tp);
1393 	}
1394 	crit_exit();
1395 }
1396 
1397 /*
1398  * Copy in the default termios characters.
1399  */
1400 void
1401 termioschars(struct termios *t)
1402 {
1403 
1404 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1405 }
1406 
1407 /*
1408  * Old interface.
1409  */
1410 void
1411 ttychars(struct tty *tp)
1412 {
1413 
1414 	termioschars(&tp->t_termios);
1415 }
1416 
1417 /*
1418  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1419  * on our input flow control bit and propagate the changes to the driver.
1420  * XXX the stop character should be put in a special high priority queue.
1421  */
1422 void
1423 ttyblock(struct tty *tp)
1424 {
1425 
1426 	SET(tp->t_state, TS_TBLOCK);
1427 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1428 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1429 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1430 	ttstart(tp);
1431 }
1432 
1433 /*
1434  * Handle input low water.  Send start character for the IXOFF case.  Turn
1435  * off our input flow control bit and propagate the changes to the driver.
1436  * XXX the start character should be put in a special high priority queue.
1437  */
1438 static void
1439 ttyunblock(struct tty *tp)
1440 {
1441 
1442 	CLR(tp->t_state, TS_TBLOCK);
1443 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1444 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1445 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1446 	ttstart(tp);
1447 }
1448 
1449 #ifdef notyet
1450 /* Not used by any current (i386) drivers. */
1451 /*
1452  * Restart after an inter-char delay.
1453  */
1454 void
1455 ttrstrt(void *tp_arg)
1456 {
1457 	struct tty *tp;
1458 
1459 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1460 
1461 	tp = tp_arg;
1462 	crit_enter();
1463 	CLR(tp->t_state, TS_TIMEOUT);
1464 	ttstart(tp);
1465 	crit_exit();
1466 }
1467 #endif
1468 
1469 int
1470 ttstart(struct tty *tp)
1471 {
1472 
1473 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1474 		(*tp->t_oproc)(tp);
1475 	return (0);
1476 }
1477 
1478 /*
1479  * "close" a line discipline
1480  */
1481 int
1482 ttylclose(struct tty *tp, int flag)
1483 {
1484 
1485 	if (flag & FNONBLOCK || ttywflush(tp))
1486 		ttyflush(tp, FREAD | FWRITE);
1487 	return (0);
1488 }
1489 
1490 /*
1491  * Handle modem control transition on a tty.
1492  * Flag indicates new state of carrier.
1493  * Returns 0 if the line should be turned off, otherwise 1.
1494  */
1495 int
1496 ttymodem(struct tty *tp, int flag)
1497 {
1498 
1499 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1500 		/*
1501 		 * MDMBUF: do flow control according to carrier flag
1502 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1503 		 * works if IXON and IXANY are clear.
1504 		 */
1505 		if (flag) {
1506 			CLR(tp->t_state, TS_CAR_OFLOW);
1507 			CLR(tp->t_state, TS_TTSTOP);
1508 			ttstart(tp);
1509 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1510 			SET(tp->t_state, TS_CAR_OFLOW);
1511 			SET(tp->t_state, TS_TTSTOP);
1512 			(*tp->t_stop)(tp, 0);
1513 		}
1514 	} else if (flag == 0) {
1515 		/*
1516 		 * Lost carrier.
1517 		 */
1518 		CLR(tp->t_state, TS_CARR_ON);
1519 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1520 		    !ISSET(tp->t_cflag, CLOCAL)) {
1521 			SET(tp->t_state, TS_ZOMBIE);
1522 			CLR(tp->t_state, TS_CONNECTED);
1523 			if (tp->t_session && tp->t_session->s_leader)
1524 				ksignal(tp->t_session->s_leader, SIGHUP);
1525 			ttyflush(tp, FREAD | FWRITE);
1526 			return (0);
1527 		}
1528 	} else {
1529 		/*
1530 		 * Carrier now on.
1531 		 */
1532 		SET(tp->t_state, TS_CARR_ON);
1533 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1534 			SET(tp->t_state, TS_CONNECTED);
1535 		wakeup(TSA_CARR_ON(tp));
1536 		ttwakeup(tp);
1537 		ttwwakeup(tp);
1538 	}
1539 	return (1);
1540 }
1541 
1542 /*
1543  * Reinput pending characters after state switch
1544  * call from a critical section.
1545  */
1546 static void
1547 ttypend(struct tty *tp)
1548 {
1549 	struct clist tq;
1550 	int c;
1551 
1552 	CLR(tp->t_lflag, PENDIN);
1553 	SET(tp->t_state, TS_TYPEN);
1554 	/*
1555 	 * XXX this assumes too much about clist internals.  It may even
1556 	 * fail if the cblock slush pool is empty.  We can't allocate more
1557 	 * cblocks here because we are called from an interrupt handler
1558 	 * and clist_alloc_cblocks() can wait.
1559 	 */
1560 	tq = tp->t_rawq;
1561 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1562 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1563 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1564 	while ((c = clist_getc(&tq)) >= 0)
1565 		ttyinput(c, tp);
1566 	CLR(tp->t_state, TS_TYPEN);
1567 }
1568 
1569 /*
1570  * Process a read call on a tty device.
1571  */
1572 int
1573 ttread(struct tty *tp, struct uio *uio, int flag)
1574 {
1575 	struct clist *qp;
1576 	int c;
1577 	tcflag_t lflag;
1578 	cc_t *cc = tp->t_cc;
1579 	struct proc *pp;
1580 	struct lwp *lp;
1581 	int first, error = 0;
1582 	int has_stime = 0, last_cc = 0;
1583 	long slp = 0;		/* XXX this should be renamed `timo'. */
1584 	struct timeval stime;
1585 
1586 	lp = curthread->td_lwp;
1587 
1588 loop:
1589 	crit_enter();
1590 	lflag = tp->t_lflag;
1591 	/*
1592 	 * take pending input first
1593 	 */
1594 	if (ISSET(lflag, PENDIN)) {
1595 		ttypend(tp);
1596 		splz();		/* reduce latency */
1597 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1598 	}
1599 
1600 	/*
1601 	 * Hang process if it's in the background.
1602 	 */
1603 	if ((pp = curproc) && isbackground(pp, tp)) {
1604 		crit_exit();
1605 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1606 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1607 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0)
1608 			return (EIO);
1609 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1610 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1611 		if (error)
1612 			return (error);
1613 		goto loop;
1614 	}
1615 
1616 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1617 		crit_exit();
1618 		return (0);	/* EOF */
1619 	}
1620 
1621 	/*
1622 	 * If canonical, use the canonical queue,
1623 	 * else use the raw queue.
1624 	 *
1625 	 * (should get rid of clists...)
1626 	 */
1627 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1628 
1629 	if (flag & IO_NDELAY) {
1630 		if (qp->c_cc > 0)
1631 			goto read;
1632 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1633 			crit_exit();
1634 			return (0);
1635 		}
1636 		crit_exit();
1637 		return (EWOULDBLOCK);
1638 	}
1639 	if (!ISSET(lflag, ICANON)) {
1640 		int m = cc[VMIN];
1641 		long t = cc[VTIME];
1642 		struct timeval timecopy;
1643 
1644 		/*
1645 		 * Check each of the four combinations.
1646 		 * (m > 0 && t == 0) is the normal read case.
1647 		 * It should be fairly efficient, so we check that and its
1648 		 * companion case (m == 0 && t == 0) first.
1649 		 * For the other two cases, we compute the target sleep time
1650 		 * into slp.
1651 		 */
1652 		if (t == 0) {
1653 			if (qp->c_cc < m)
1654 				goto sleep;
1655 			if (qp->c_cc > 0)
1656 				goto read;
1657 
1658 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1659 			crit_exit();
1660 			return (0);
1661 		}
1662 		t *= 100000;		/* time in us */
1663 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1664 			 ((t1).tv_usec - (t2).tv_usec))
1665 		if (m > 0) {
1666 			if (qp->c_cc <= 0)
1667 				goto sleep;
1668 			if (qp->c_cc >= m)
1669 				goto read;
1670 			getmicrotime(&timecopy);
1671 			if (!has_stime) {
1672 				/* first character, start timer */
1673 				has_stime = 1;
1674 				stime = timecopy;
1675 				slp = t;
1676 			} else if (qp->c_cc > last_cc) {
1677 				/* got a character, restart timer */
1678 				stime = timecopy;
1679 				slp = t;
1680 			} else {
1681 				/* nothing, check expiration */
1682 				slp = t - diff(timecopy, stime);
1683 				if (slp <= 0)
1684 					goto read;
1685 			}
1686 			last_cc = qp->c_cc;
1687 		} else {	/* m == 0 */
1688 			if (qp->c_cc > 0)
1689 				goto read;
1690 			getmicrotime(&timecopy);
1691 			if (!has_stime) {
1692 				has_stime = 1;
1693 				stime = timecopy;
1694 				slp = t;
1695 			} else {
1696 				slp = t - diff(timecopy, stime);
1697 				if (slp <= 0) {
1698 					/* Timed out, but 0 is enough input. */
1699 					crit_exit();
1700 					return (0);
1701 				}
1702 			}
1703 		}
1704 #undef diff
1705 		/*
1706 		 * Rounding down may make us wake up just short
1707 		 * of the target, so we round up.
1708 		 * The formula is ceiling(slp * hz/1000000).
1709 		 * 32-bit arithmetic is enough for hz < 169.
1710 		 * XXX see tvtohz() for how to avoid overflow if hz
1711 		 * is large (divide by `tick' and/or arrange to
1712 		 * use tvtohz() if hz is large).
1713 		 */
1714 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1715 		goto sleep;
1716 	}
1717 	if (qp->c_cc <= 0) {
1718 sleep:
1719 		/*
1720 		 * There is no input, or not enough input and we can block.
1721 		 */
1722 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1723 				 ISSET(tp->t_state, TS_CONNECTED) ?
1724 				 "ttyin" : "ttyhup", (int)slp);
1725 		crit_exit();
1726 		if (error == EWOULDBLOCK)
1727 			error = 0;
1728 		else if (error)
1729 			return (error);
1730 		/*
1731 		 * XXX what happens if another process eats some input
1732 		 * while we are asleep (not just here)?  It would be
1733 		 * safest to detect changes and reset our state variables
1734 		 * (has_stime and last_cc).
1735 		 */
1736 		slp = 0;
1737 		goto loop;
1738 	}
1739 read:
1740 	crit_exit();
1741 	/*
1742 	 * Input present, check for input mapping and processing.
1743 	 */
1744 	first = 1;
1745 	if (ISSET(lflag, ICANON | ISIG))
1746 		goto slowcase;
1747 	for (;;) {
1748 		char ibuf[IBUFSIZ];
1749 		int icc;
1750 
1751 		icc = imin(uio->uio_resid, IBUFSIZ);
1752 		icc = q_to_b(qp, ibuf, icc);
1753 		if (icc <= 0) {
1754 			if (first)
1755 				goto loop;
1756 			break;
1757 		}
1758 		error = uiomove(ibuf, icc, uio);
1759 		/*
1760 		 * XXX if there was an error then we should ungetc() the
1761 		 * unmoved chars and reduce icc here.
1762 		 */
1763 		if (error)
1764 			break;
1765  		if (uio->uio_resid == 0)
1766 			break;
1767 		first = 0;
1768 	}
1769 	goto out;
1770 slowcase:
1771 	for (;;) {
1772 		c = clist_getc(qp);
1773 		if (c < 0) {
1774 			if (first)
1775 				goto loop;
1776 			break;
1777 		}
1778 		/*
1779 		 * delayed suspend (^Y)
1780 		 */
1781 		if (CCEQ(cc[VDSUSP], c) &&
1782 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1783 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1784 			if (first) {
1785 				error = ttysleep(tp, &lbolt, PCATCH,
1786 						 "ttybg3", 0);
1787 				if (error)
1788 					break;
1789 				goto loop;
1790 			}
1791 			break;
1792 		}
1793 		/*
1794 		 * Interpret EOF only in canonical mode.
1795 		 */
1796 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1797 			break;
1798 		/*
1799 		 * Give user character.
1800 		 */
1801  		error = ureadc(c, uio);
1802 		if (error)
1803 			/* XXX should ungetc(c, qp). */
1804 			break;
1805  		if (uio->uio_resid == 0)
1806 			break;
1807 		/*
1808 		 * In canonical mode check for a "break character"
1809 		 * marking the end of a "line of input".
1810 		 */
1811 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1812 			break;
1813 		first = 0;
1814 	}
1815 
1816 out:
1817 	/*
1818 	 * Look to unblock input now that (presumably)
1819 	 * the input queue has gone down.
1820 	 */
1821 	crit_enter();
1822 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1823 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1824 		ttyunblock(tp);
1825 	crit_exit();
1826 
1827 	return (error);
1828 }
1829 
1830 /*
1831  * Check the output queue on tp for space for a kernel message (from uprintf
1832  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1833  * lose messages due to normal flow control, but don't let the tty run amok.
1834  * Sleeps here are not interruptible, but we return prematurely if new signals
1835  * arrive.
1836  */
1837 int
1838 ttycheckoutq(struct tty *tp, int wait)
1839 {
1840 	struct lwp *lp = curthread->td_lwp;
1841 	int hiwat;
1842 	sigset_t oldset, newset;
1843 
1844 	hiwat = tp->t_ohiwat;
1845 	SIGEMPTYSET(oldset);
1846 	SIGEMPTYSET(newset);
1847 	crit_enter();
1848 	if (wait)
1849 		oldset = lwp_sigpend(lp);
1850 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
1851 		while (tp->t_outq.c_cc > hiwat) {
1852 			ttstart(tp);
1853 			if (tp->t_outq.c_cc <= hiwat)
1854 				break;
1855 			if (wait)
1856 				newset = lwp_sigpend(lp);
1857 			if (!wait || SIGSETNEQ(oldset, newset)) {
1858 				crit_exit();
1859 				return (0);
1860 			}
1861 			SET(tp->t_state, TS_SO_OLOWAT);
1862 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
1863 		}
1864 	}
1865 	crit_exit();
1866 	return (1);
1867 }
1868 
1869 /*
1870  * Process a write call on a tty device.
1871  */
1872 int
1873 ttwrite(struct tty *tp, struct uio *uio, int flag)
1874 {
1875 	char *cp = NULL;
1876 	int cc, ce;
1877 	struct proc *pp;
1878 	struct lwp *lp;
1879 	int i, hiwat, cnt, error;
1880 	char obuf[OBUFSIZ];
1881 
1882 	lp = curthread->td_lwp;
1883 	hiwat = tp->t_ohiwat;
1884 	cnt = uio->uio_resid;
1885 	error = 0;
1886 	cc = 0;
1887 loop:
1888 	crit_enter();
1889 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1890 		crit_exit();
1891 		if (uio->uio_resid == cnt)
1892 			error = EIO;
1893 		goto out;
1894 	}
1895 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
1896 		if (flag & IO_NDELAY) {
1897 			crit_exit();
1898 			error = EWOULDBLOCK;
1899 			goto out;
1900 		}
1901 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
1902 		crit_exit();
1903 		if (error)
1904 			goto out;
1905 		goto loop;
1906 	}
1907 	crit_exit();
1908 
1909 	/*
1910 	 * Hang the process if it's in the background.
1911 	 */
1912 	if ((pp = curproc) && isbackground(pp, tp) &&
1913 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
1914 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
1915 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
1916 		if (pp->p_pgrp->pg_jobc == 0) {
1917 			error = EIO;
1918 			goto out;
1919 		}
1920 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
1921 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
1922 		if (error)
1923 			goto out;
1924 		goto loop;
1925 	}
1926 	/*
1927 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1928 	 * output translation.  Keep track of high water mark, sleep on
1929 	 * overflow awaiting device aid in acquiring new space.
1930 	 */
1931 	while (uio->uio_resid > 0 || cc > 0) {
1932 		if (ISSET(tp->t_lflag, FLUSHO)) {
1933 			uio->uio_resid = 0;
1934 			return (0);
1935 		}
1936 		if (tp->t_outq.c_cc > hiwat)
1937 			goto ovhiwat;
1938 		/*
1939 		 * Grab a hunk of data from the user, unless we have some
1940 		 * leftover from last time.
1941 		 */
1942 		if (cc == 0) {
1943 			cc = imin(uio->uio_resid, OBUFSIZ);
1944 			cp = obuf;
1945 			error = uiomove(cp, cc, uio);
1946 			if (error) {
1947 				cc = 0;
1948 				break;
1949 			}
1950 		}
1951 		/*
1952 		 * If nothing fancy need be done, grab those characters we
1953 		 * can handle without any of ttyoutput's processing and
1954 		 * just transfer them to the output q.  For those chars
1955 		 * which require special processing (as indicated by the
1956 		 * bits in char_type), call ttyoutput.  After processing
1957 		 * a hunk of data, look for FLUSHO so ^O's will take effect
1958 		 * immediately.
1959 		 */
1960 		while (cc > 0) {
1961 			if (!ISSET(tp->t_oflag, OPOST))
1962 				ce = cc;
1963 			else {
1964 				ce = cc - scanc((u_int)cc, (u_char *)cp,
1965 						char_type, CCLASSMASK);
1966 				/*
1967 				 * If ce is zero, then we're processing
1968 				 * a special character through ttyoutput.
1969 				 */
1970 				if (ce == 0) {
1971 					tp->t_rocount = 0;
1972 					if (ttyoutput(*cp, tp) >= 0) {
1973 						/* No Clists, wait a bit. */
1974 						ttstart(tp);
1975 						if (flag & IO_NDELAY) {
1976 							error = EWOULDBLOCK;
1977 							goto out;
1978 						}
1979 						error = ttysleep(tp, &lbolt,
1980 								 PCATCH,
1981 								 "ttybf1", 0);
1982 						if (error)
1983 							goto out;
1984 						goto loop;
1985 					}
1986 					cp++;
1987 					cc--;
1988 					if (ISSET(tp->t_lflag, FLUSHO) ||
1989 					    tp->t_outq.c_cc > hiwat)
1990 						goto ovhiwat;
1991 					continue;
1992 				}
1993 			}
1994 			/*
1995 			 * A bunch of normal characters have been found.
1996 			 * Transfer them en masse to the output queue and
1997 			 * continue processing at the top of the loop.
1998 			 * If there are any further characters in this
1999 			 * <= OBUFSIZ chunk, the first should be a character
2000 			 * requiring special handling by ttyoutput.
2001 			 */
2002 			tp->t_rocount = 0;
2003 			i = b_to_q(cp, ce, &tp->t_outq);
2004 			ce -= i;
2005 			tp->t_column += ce;
2006 			cp += ce, cc -= ce, tk_nout += ce;
2007 			tp->t_outcc += ce;
2008 			if (i > 0) {
2009 				/* No Clists, wait a bit. */
2010 				ttstart(tp);
2011 				if (flag & IO_NDELAY) {
2012 					error = EWOULDBLOCK;
2013 					goto out;
2014 				}
2015 				error = ttysleep(tp, &lbolt, PCATCH,
2016 						 "ttybf2", 0);
2017 				if (error)
2018 					goto out;
2019 				goto loop;
2020 			}
2021 			if (ISSET(tp->t_lflag, FLUSHO) ||
2022 			    tp->t_outq.c_cc > hiwat)
2023 				break;
2024 		}
2025 		ttstart(tp);
2026 	}
2027 out:
2028 	/*
2029 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2030 	 * offset and iov pointers have moved forward, but it doesn't matter
2031 	 * (the call will either return short or restart with a new uio).
2032 	 */
2033 	uio->uio_resid += cc;
2034 	return (error);
2035 
2036 ovhiwat:
2037 	ttstart(tp);
2038 	crit_enter();
2039 	/*
2040 	 * This can only occur if FLUSHO is set in t_lflag,
2041 	 * or if ttstart/oproc is synchronous (or very fast).
2042 	 */
2043 	if (tp->t_outq.c_cc <= hiwat) {
2044 		crit_exit();
2045 		goto loop;
2046 	}
2047 	if (flag & IO_NDELAY) {
2048 		crit_exit();
2049 		uio->uio_resid += cc;
2050 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2051 	}
2052 	SET(tp->t_state, TS_SO_OLOWAT);
2053 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2054 	crit_exit();
2055 	if (error == EWOULDBLOCK)
2056 		error = EIO;
2057 	if (error)
2058 		goto out;
2059 	goto loop;
2060 }
2061 
2062 /*
2063  * Rubout one character from the rawq of tp
2064  * as cleanly as possible.
2065  */
2066 static void
2067 ttyrub(int c, struct tty *tp)
2068 {
2069 	char *cp;
2070 	int savecol;
2071 	int tabc;
2072 
2073 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2074 		return;
2075 	CLR(tp->t_lflag, FLUSHO);
2076 	if (ISSET(tp->t_lflag, ECHOE)) {
2077 		if (tp->t_rocount == 0) {
2078 			/*
2079 			 * Screwed by ttwrite; retype
2080 			 */
2081 			ttyretype(tp);
2082 			return;
2083 		}
2084 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2085 			ttyrubo(tp, 2);
2086 		else {
2087 			CLR(c, ~TTY_CHARMASK);
2088 			switch (CCLASS(c)) {
2089 			case ORDINARY:
2090 				ttyrubo(tp, 1);
2091 				break;
2092 			case BACKSPACE:
2093 			case CONTROL:
2094 			case NEWLINE:
2095 			case RETURN:
2096 			case VTAB:
2097 				if (ISSET(tp->t_lflag, ECHOCTL))
2098 					ttyrubo(tp, 2);
2099 				break;
2100 			case TAB:
2101 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2102 					ttyretype(tp);
2103 					return;
2104 				}
2105 				crit_enter();
2106 				savecol = tp->t_column;
2107 				SET(tp->t_state, TS_CNTTB);
2108 				SET(tp->t_lflag, FLUSHO);
2109 				tp->t_column = tp->t_rocol;
2110 				cp = tp->t_rawq.c_cf;
2111 				if (cp)
2112 					tabc = *cp;	/* XXX FIX NEXTC */
2113 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2114 					ttyecho(tabc, tp);
2115 				CLR(tp->t_lflag, FLUSHO);
2116 				CLR(tp->t_state, TS_CNTTB);
2117 				crit_exit();
2118 
2119 				/* savecol will now be length of the tab. */
2120 				savecol -= tp->t_column;
2121 				tp->t_column += savecol;
2122 				if (savecol > 8)
2123 					savecol = 8;	/* overflow screw */
2124 				while (--savecol >= 0)
2125 					(void)ttyoutput('\b', tp);
2126 				break;
2127 			default:			/* XXX */
2128 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2129 				(void)kprintf(PANICSTR, c, CCLASS(c));
2130 #ifdef notdef
2131 				panic(PANICSTR, c, CCLASS(c));
2132 #endif
2133 			}
2134 		}
2135 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2136 		if (!ISSET(tp->t_state, TS_ERASE)) {
2137 			SET(tp->t_state, TS_ERASE);
2138 			(void)ttyoutput('\\', tp);
2139 		}
2140 		ttyecho(c, tp);
2141 	} else {
2142 		ttyecho(tp->t_cc[VERASE], tp);
2143 		/*
2144 		 * This code may be executed not only when an ERASE key
2145 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2146 		 * So, I didn't think it was worthwhile to pass the extra
2147 		 * information (which would need an extra parameter,
2148 		 * changing every call) needed to distinguish the ERASE2
2149 		 * case from the ERASE.
2150 		 */
2151 	}
2152 	--tp->t_rocount;
2153 }
2154 
2155 /*
2156  * Back over cnt characters, erasing them.
2157  */
2158 static void
2159 ttyrubo(struct tty *tp, int cnt)
2160 {
2161 
2162 	while (cnt-- > 0) {
2163 		(void)ttyoutput('\b', tp);
2164 		(void)ttyoutput(' ', tp);
2165 		(void)ttyoutput('\b', tp);
2166 	}
2167 }
2168 
2169 /*
2170  * ttyretype --
2171  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2172  *	been checked.
2173  */
2174 static void
2175 ttyretype(struct tty *tp)
2176 {
2177 	char *cp;
2178 	int c;
2179 
2180 	/* Echo the reprint character. */
2181 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2182 		ttyecho(tp->t_cc[VREPRINT], tp);
2183 
2184 	(void)ttyoutput('\n', tp);
2185 
2186 	/*
2187 	 * XXX
2188 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2189 	 * BIT OF FIRST CHAR.
2190 	 */
2191 	crit_enter();
2192 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2193 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2194 		ttyecho(c, tp);
2195 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2196 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2197 		ttyecho(c, tp);
2198 	CLR(tp->t_state, TS_ERASE);
2199 	crit_exit();
2200 
2201 	tp->t_rocount = tp->t_rawq.c_cc;
2202 	tp->t_rocol = 0;
2203 }
2204 
2205 /*
2206  * Echo a typed character to the terminal.
2207  */
2208 static void
2209 ttyecho(int c, struct tty *tp)
2210 {
2211 
2212 	if (!ISSET(tp->t_state, TS_CNTTB))
2213 		CLR(tp->t_lflag, FLUSHO);
2214 	if ((!ISSET(tp->t_lflag, ECHO) &&
2215 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2216 	    ISSET(tp->t_lflag, EXTPROC))
2217 		return;
2218 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2219 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2220 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2221 		(void)ttyoutput('^', tp);
2222 		CLR(c, ~TTY_CHARMASK);
2223 		if (c == 0177)
2224 			c = '?';
2225 		else
2226 			c += 'A' - 1;
2227 	}
2228 	(void)ttyoutput(c, tp);
2229 }
2230 
2231 /*
2232  * Wake up any readers on a tty.
2233  */
2234 void
2235 ttwakeup(struct tty *tp)
2236 {
2237 
2238 	if (tp->t_rsel.si_pid != 0)
2239 		selwakeup(&tp->t_rsel);
2240 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2241 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2242 	wakeup(TSA_HUP_OR_INPUT(tp));
2243 	KNOTE(&tp->t_rsel.si_note, 0);
2244 }
2245 
2246 /*
2247  * Wake up any writers on a tty.
2248  */
2249 void
2250 ttwwakeup(struct tty *tp)
2251 {
2252 
2253 	if (tp->t_wsel.si_pid != 0 && tp->t_outq.c_cc <= tp->t_olowat)
2254 		selwakeup(&tp->t_wsel);
2255 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2256 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2257 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2258 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2259 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2260 		wakeup(TSA_OCOMPLETE(tp));
2261 	}
2262 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2263 	    tp->t_outq.c_cc <= tp->t_olowat) {
2264 		CLR(tp->t_state, TS_SO_OLOWAT);
2265 		wakeup(TSA_OLOWAT(tp));
2266 	}
2267 	KNOTE(&tp->t_wsel.si_note, 0);
2268 }
2269 
2270 /*
2271  * Look up a code for a specified speed in a conversion table;
2272  * used by drivers to map software speed values to hardware parameters.
2273  */
2274 int
2275 ttspeedtab(int speed, struct speedtab *table)
2276 {
2277 
2278 	for ( ; table->sp_speed != -1; table++)
2279 		if (table->sp_speed == speed)
2280 			return (table->sp_code);
2281 	return (-1);
2282 }
2283 
2284 /*
2285  * Set input and output watermarks and buffer sizes.  For input, the
2286  * high watermark is about one second's worth of input above empty, the
2287  * low watermark is slightly below high water, and the buffer size is a
2288  * driver-dependent amount above high water.  For output, the watermarks
2289  * are near the ends of the buffer, with about 1 second's worth of input
2290  * between them.  All this only applies to the standard line discipline.
2291  */
2292 void
2293 ttsetwater(struct tty *tp)
2294 {
2295 	int cps, ttmaxhiwat, x;
2296 
2297 	/* Input. */
2298 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2299 	switch (tp->t_ispeedwat) {
2300 	case (speed_t)-1:
2301 		cps = tp->t_ispeed / 10;
2302 		break;
2303 	case 0:
2304 		/*
2305 		 * This case is for old drivers that don't know about
2306 		 * t_ispeedwat.  Arrange for them to get the old buffer
2307 		 * sizes and watermarks.
2308 		 */
2309 		cps = TTYHOG - 2 * 256;
2310 		tp->t_ififosize = 2 * 2048;
2311 		break;
2312 	default:
2313 		cps = tp->t_ispeedwat / 10;
2314 		break;
2315 	}
2316 	tp->t_ihiwat = cps;
2317 	tp->t_ilowat = 7 * cps / 8;
2318 	x = cps + tp->t_ififosize;
2319 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2320 
2321 	/* Output. */
2322 	switch (tp->t_ospeedwat) {
2323 	case (speed_t)-1:
2324 		cps = tp->t_ospeed / 10;
2325 		ttmaxhiwat = 2 * TTMAXHIWAT;
2326 		break;
2327 	case 0:
2328 		cps = tp->t_ospeed / 10;
2329 		ttmaxhiwat = TTMAXHIWAT;
2330 		break;
2331 	default:
2332 		cps = tp->t_ospeedwat / 10;
2333 		ttmaxhiwat = 8 * TTMAXHIWAT;
2334 		break;
2335 	}
2336 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2337 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2338 	x += cps;
2339 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2340 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2341 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2342 	x += OBUFSIZ + 100;
2343 	clist_alloc_cblocks(&tp->t_outq, x, x);
2344 #undef	CLAMP
2345 }
2346 
2347 /*
2348  * Report on state of foreground process group.
2349  */
2350 void
2351 ttyinfo(struct tty *tp)
2352 {
2353 	struct proc *p, *pick;
2354 	struct lwp *lp;
2355 	struct rusage ru;
2356 	int tmp;
2357 
2358 	if (ttycheckoutq(tp,0) == 0)
2359 		return;
2360 
2361 	/*
2362 	 * We always print the load average, then figure out what else to
2363 	 * print based on the state of the current process group.
2364 	 */
2365 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2366 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2367 
2368 	if (tp->t_session == NULL) {
2369 		ttyprintf(tp, "not a controlling terminal\n");
2370 	} else if (tp->t_pgrp == NULL) {
2371 		ttyprintf(tp, "no foreground process group\n");
2372 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == 0) {
2373 		ttyprintf(tp, "empty foreground process group\n");
2374 	} else {
2375 		/*
2376 		 * Pick an interesting process.  Note that certain elements,
2377 		 * in particular the wmesg, require a critical section for
2378 		 * safe access (YYY and we are still not MP safe).
2379 		 *
2380 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2381 		 */
2382 		char buf[64];
2383 		const char *str;
2384 		int isinmem;
2385 		long vmsz;
2386 		int pctcpu;
2387 
2388 		crit_enter();
2389 
2390 		/* XXX lwp should compare lwps */
2391 
2392 		for (pick = NULL; p != 0; p = LIST_NEXT(p, p_pglist)) {
2393 			if (proc_compare(pick, p))
2394 				pick = p;
2395 		}
2396 
2397 		/* XXX lwp */
2398 		lp = FIRST_LWP_IN_PROC(pick);
2399 		if (lp == NULL) {
2400 			ttyprintf(tp, "foreground process without lwp\n");
2401 			tp->t_rocount = 0;
2402 			return;
2403 		}
2404 
2405 		/*
2406 		 * Figure out what wait/process-state message, and command
2407 		 * buffer to present
2408 		 */
2409 		/*
2410 		 * XXX lwp This is a horrible mixture.  We need to rework this
2411 		 * as soon as lwps have their own runnable status.
2412 		 */
2413 		if (pick->p_flag & P_WEXIT)
2414 			str = "exiting";
2415 		else if (lp->lwp_stat == LSRUN)
2416 			str = "running";
2417 		else if (pick->p_stat == SIDL)
2418 			str = "spawning";
2419 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2420 			str = lp->lwp_wmesg;
2421 		else
2422 			str = "iowait";
2423 
2424 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2425 			pick->p_comm, pick->p_pid, str);
2426 
2427 		/*
2428 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2429 		 * 'pick' becomes invalid the moment we exit the critical
2430 		 * section.
2431 		 */
2432 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0) {
2433 			calcru_proc(pick, &ru);
2434 			isinmem = 1;
2435 		} else {
2436 			isinmem = 0;
2437 		}
2438 
2439 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2440 
2441 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2442 		    vmsz = 0;
2443 		else
2444 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2445 
2446 		crit_exit();
2447 
2448 		/*
2449 		 * Dump the output
2450 		 */
2451 		ttyprintf(tp, " %s ", buf);
2452 		ttyprintf(tp, "%ld.%02ldu ",
2453 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2454 		ttyprintf(tp, "%ld.%02lds ",
2455 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2456 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2457 	}
2458 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2459 }
2460 
2461 /*
2462  * Returns 1 if p2 is "better" than p1
2463  *
2464  * The algorithm for picking the "interesting" process is thus:
2465  *
2466  *	1) Only foreground processes are eligible - implied.
2467  *	2) Runnable processes are favored over anything else.  The runner
2468  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2469  *	   broken by picking the highest pid.
2470  *	3) The sleeper with the shortest sleep time is next.  With ties,
2471  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2472  *	4) Further ties are broken by picking the highest pid.
2473  */
2474 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2475 #define TESTAB(a, b)    ((a)<<1 | (b))
2476 #define ONLYA   2
2477 #define ONLYB   1
2478 #define BOTH    3
2479 
2480 static int
2481 proc_compare(struct proc *p1, struct proc *p2)
2482 {
2483 	struct lwp *lp1, *lp2;
2484 	if (p1 == NULL)
2485 		return (1);
2486 
2487 	/*
2488  	 * weed out zombies
2489 	 */
2490 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2491 	case ONLYA:
2492 		return (1);
2493 	case ONLYB:
2494 		return (0);
2495 	case BOTH:
2496 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2497 	}
2498 
2499 	/* XXX lwp */
2500 	lp1 = FIRST_LWP_IN_PROC(p1);
2501 	lp2 = FIRST_LWP_IN_PROC(p2);
2502 
2503 	/*
2504 	 * see if at least one of them is runnable
2505 	 */
2506 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2507 	case ONLYA:
2508 		return (0);
2509 	case ONLYB:
2510 		return (1);
2511 	case BOTH:
2512 		/*
2513 		 * tie - favor one with highest recent cpu utilization
2514 		 */
2515 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2516 			return (1);
2517 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2518 			return (0);
2519 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2520 	}
2521 	/*
2522 	 * pick the one with the smallest sleep time
2523 	 */
2524 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2525 		return (0);
2526 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2527 		return (1);
2528 	/*
2529 	 * favor one sleeping in a non-interruptible sleep
2530 	 */
2531 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2532 		return (1);
2533 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2534 		return (0);
2535 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2536 }
2537 
2538 /*
2539  * Output char to tty; console putchar style.
2540  */
2541 int
2542 tputchar(int c, struct tty *tp)
2543 {
2544 	crit_enter();
2545 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2546 		crit_exit();
2547 		return (-1);
2548 	}
2549 	if (c == '\n')
2550 		(void)ttyoutput('\r', tp);
2551 	(void)ttyoutput(c, tp);
2552 	ttstart(tp);
2553 	crit_exit();
2554 	return (0);
2555 }
2556 
2557 /*
2558  * Sleep on chan, returning ERESTART if tty changed while we napped and
2559  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2560  * the tty is revoked, restarting a pending call will redo validation done
2561  * at the start of the call.
2562  */
2563 int
2564 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2565 {
2566 	int error;
2567 	int gen;
2568 
2569 	gen = tp->t_gen;
2570 	error = tsleep(chan, slpflags, wmesg, timo);
2571 	if (error)
2572 		return (error);
2573 	return (tp->t_gen == gen ? 0 : ERESTART);
2574 }
2575 
2576 /*
2577  * Allocate a tty struct.  Clists in the struct will be allocated by
2578  * ttyopen().
2579  */
2580 struct tty *
2581 ttymalloc(struct tty *tp)
2582 {
2583 
2584 	if (tp)
2585 		return(tp);
2586         tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2587 	ttyregister(tp);
2588         return (tp);
2589 }
2590 
2591 #if 0
2592 /*
2593  * Free a tty struct.  Clists in the struct should have been freed by
2594  * ttyclose().
2595  *
2596  * XXX not yet usable: since we support a half-closed state and do not
2597  * ref count the tty reference from the session, it is possible for a
2598  * session to hold a ref on the tty.  See TTY_DO_FULL_CLOSE.
2599  */
2600 void
2601 ttyfree(struct tty *tp)
2602 {
2603         kfree(tp, M_TTYS);
2604 }
2605 #endif /* 0 */
2606 
2607 void
2608 ttyregister(struct tty *tp)
2609 {
2610 	SLIST_INSERT_HEAD(&tty_list, tp, t_list);
2611 }
2612 
2613 static int
2614 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2615 {
2616 	int error;
2617 	struct tty *tp, t;
2618 	SLIST_FOREACH(tp, &tty_list, t_list) {
2619 		t = *tp;
2620 		if (t.t_dev)
2621 			t.t_dev = (cdev_t)dev2udev(t.t_dev);
2622 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2623 		if (error)
2624 			return (error);
2625 	}
2626 	return (0);
2627 }
2628 
2629 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2630 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2631 
2632 void
2633 nottystop(struct tty *tp, int rw)
2634 {
2635 
2636 	return;
2637 }
2638 
2639 int
2640 ttyread(struct dev_read_args *ap)
2641 {
2642 	struct tty *tp;
2643 
2644 	tp = ap->a_head.a_dev->si_tty;
2645 	if (tp == NULL)
2646 		return (ENODEV);
2647 	return ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2648 }
2649 
2650 int
2651 ttywrite(struct dev_write_args *ap)
2652 {
2653 	struct tty *tp;
2654 
2655 	tp = ap->a_head.a_dev->si_tty;
2656 	if (tp == NULL)
2657 		return (ENODEV);
2658 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2659 }
2660