xref: /dragonfly/sys/kern/tty.c (revision 6693db17)
1 /*-
2  * Copyright (c) 1982, 1986, 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
39  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
40  * $DragonFly: src/sys/kern/tty.c,v 1.46 2008/09/10 09:50:09 y0netan1 Exp $
41  */
42 
43 /*-
44  * TODO:
45  *	o Fix races for sending the start char in ttyflush().
46  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
47  *	  With luck, there will be MIN chars before select() returns().
48  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
49  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
50  *	  FIONREAD.
51  *	o Do the new sio locking stuff here and use it to avoid special
52  *	  case for EXTPROC?
53  *	o Lock PENDIN too?
54  *	o Move EXTPROC and/or PENDIN to t_state?
55  *	o Wrap most of ttioctl in spltty/splx.
56  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
57  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
58  *	o Don't allow certain termios flags to affect disciplines other
59  *	  than TTYDISC.  Cancel their effects before switch disciplines
60  *	  and ignore them if they are set while we are in another
61  *	  discipline.
62  *	o Now that historical speed conversions are handled here, don't
63  *	  do them in drivers.
64  *	o Check for TS_CARR_ON being set while everything is closed and not
65  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
66  *	  so it would live until the next open even if carrier drops.
67  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
68  *	  only when _all_ openers leave open().
69  */
70 
71 #include "opt_compat.h"
72 #include "opt_uconsole.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/filio.h>
77 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
78 #include <sys/ioctl_compat.h>
79 #endif
80 #include <sys/proc.h>
81 #include <sys/priv.h>
82 #define	TTYDEFCHARS
83 #include <sys/tty.h>
84 #include <sys/clist.h>
85 #undef	TTYDEFCHARS
86 #include <sys/fcntl.h>
87 #include <sys/conf.h>
88 #include <sys/dkstat.h>
89 #include <sys/poll.h>
90 #include <sys/kernel.h>
91 #include <sys/vnode.h>
92 #include <sys/signalvar.h>
93 #include <sys/signal2.h>
94 #include <sys/resourcevar.h>
95 #include <sys/malloc.h>
96 #include <sys/filedesc.h>
97 #include <sys/sysctl.h>
98 #include <sys/thread2.h>
99 
100 #include <vm/vm.h>
101 #include <sys/lock.h>
102 #include <vm/pmap.h>
103 #include <vm/vm_map.h>
104 
105 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
106 
107 static int	proc_compare (struct proc *p1, struct proc *p2);
108 static int	ttnread (struct tty *tp);
109 static void	ttyecho (int c, struct tty *tp);
110 static int	ttyoutput (int c, struct tty *tp);
111 static void	ttypend (struct tty *tp);
112 static void	ttyretype (struct tty *tp);
113 static void	ttyrub (int c, struct tty *tp);
114 static void	ttyrubo (struct tty *tp, int cnt);
115 static void	ttyunblock (struct tty *tp);
116 static int	ttywflush (struct tty *tp);
117 static int	filt_ttyread (struct knote *kn, long hint);
118 static void 	filt_ttyrdetach (struct knote *kn);
119 static int	filt_ttywrite (struct knote *kn, long hint);
120 static void 	filt_ttywdetach (struct knote *kn);
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 static u_char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 /* Macros to clear/set/test flags. */
196 #define	SET(t, f)	(t) |= (f)
197 #define	CLR(t, f)	(t) &= ~(f)
198 #define	ISSET(t, f)	((t) & (f))
199 
200 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
201 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
202 
203 uint64_t tk_nin;
204 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
205     "LU", "TTY input statistic");
206 uint64_t tk_nout;
207 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
208     "LU", "TTY output statistic");
209 uint64_t tk_rawcc;
210 
211 /*
212  * list of struct tty where pstat(8) can pick it up with sysctl
213  */
214 static SLIST_HEAD(, tty) tty_list;
215 
216 /*
217  * Initial open of tty, or (re)entry to standard tty line discipline.
218  */
219 int
220 ttyopen(cdev_t device, struct tty *tp)
221 {
222 	crit_enter();
223 	tp->t_dev = device;
224 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
225 		SET(tp->t_state, TS_ISOPEN);
226 		if (ISSET(tp->t_cflag, CLOCAL)) {
227 			SET(tp->t_state, TS_CONNECTED);
228 		}
229 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
230 	}
231 	ttsetwater(tp);
232 	crit_exit();
233 	return (0);
234 }
235 
236 /*
237  * Handle close() on a tty line: flush and set to initial state,
238  * bumping generation number so that pending read/write calls
239  * can detect recycling of the tty.
240  *
241  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
242  * and l_close() should have flushed, but we repeat the spltty() and
243  * the flush in case there are buggy callers.
244  */
245 int
246 ttyclose(struct tty *tp)
247 {
248 	funsetown(tp->t_sigio);
249 	crit_enter();
250 	if (constty == tp)
251 		constty = NULL;
252 
253 	ttyflush(tp, FREAD | FWRITE);
254 	clist_free_cblocks(&tp->t_canq);
255 	clist_free_cblocks(&tp->t_outq);
256 	clist_free_cblocks(&tp->t_rawq);
257 
258 	tp->t_gen++;
259 	tp->t_line = TTYDISC;
260 	ttyclearsession(tp);
261 	tp->t_state = 0;
262 	crit_exit();
263 	return (0);
264 }
265 
266 /*
267  * Disassociate the tty from its session.  Traditionally this has only been
268  * a half-close, meaning that the session was still allowed to point at the
269  * tty (resulting in the tty in the ps command showing something like 'p0-'),
270  * even though the tty is no longer pointing at the session.
271  *
272  * The half close seems to be useful only for 'ps' output but there is as
273  * yet no reason to remove the feature.  The full-close code is currently
274  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
275  */
276 void
277 ttyclearsession(struct tty *tp)
278 {
279 	struct session *sp;
280 
281 	tp->t_pgrp = NULL;
282 	if ((sp = tp->t_session) != NULL) {
283 		tp->t_session = NULL;
284 #ifdef TTY_DO_FULL_CLOSE
285 		/* FULL CLOSE (not yet) */
286 		if (sp->s_ttyp == tp) {
287 			sp->s_ttyp = NULL;
288 		} else {
289 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
290 				"%p/%p\n", sp->s_ttyp, tp);
291 		}
292 #endif
293 	}
294 }
295 
296 /*
297  * Release the tty vnode association for a session.  This is the
298  * 'other half' of the close.  Because multiple opens of /dev/tty
299  * only generate a single open to the actual tty, the file modes
300  * are locked to FREAD|FWRITE.
301  *
302  * If dorevoke is non-zero, the session is also revoked.  We have to
303  * close the vnode if VCTTYISOPEN is set.
304  */
305 void
306 ttyclosesession(struct session *sp, int dorevoke)
307 {
308 	struct vnode *vp;
309 
310 retry:
311 	/*
312 	 * There may not be a controlling terminal or it may have been closed
313 	 * out from under us.
314 	 */
315 	if ((vp = sp->s_ttyvp) == NULL)
316 		return;
317 
318 	/*
319 	 * We need a lock if we have to close or revoke.
320 	 */
321 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
322 		vhold(vp);
323 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
324 			vdrop(vp);
325 			goto retry;
326 		}
327 
328 		/*
329 		 * Retry if the vnode was ripped out from under us
330 		 */
331 		if (vp != sp->s_ttyvp) {
332 			vn_unlock(vp);
333 			vdrop(vp);
334 			goto retry;
335 		}
336 
337 		/*
338 		 * Close and revoke as needed
339 		 */
340 		sp->s_ttyvp = NULL;
341 		if (vp->v_flag & VCTTYISOPEN) {
342 			vclrflags(vp, VCTTYISOPEN);
343 			VOP_CLOSE(vp, FREAD|FWRITE);
344 		}
345 		vn_unlock(vp);
346 		if (dorevoke)
347 			vrevoke(vp, proc0.p_ucred);
348 		vdrop(vp);
349 	} else {
350 		sp->s_ttyvp = NULL;
351 	}
352 	vrele(vp);
353 }
354 
355 #define	FLUSHQ(q) {							\
356 	if ((q)->c_cc)							\
357 		ndflush(q, (q)->c_cc);					\
358 }
359 
360 /* Is 'c' a line delimiter ("break" character)? */
361 #define	TTBREAKC(c, lflag)							\
362 	((c) == '\n' || (((c) == cc[VEOF] ||				\
363 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
364 	 (c) != _POSIX_VDISABLE))
365 
366 /*
367  * Process input of a single character received on a tty.
368  */
369 int
370 ttyinput(int c, struct tty *tp)
371 {
372 	tcflag_t iflag, lflag;
373 	cc_t *cc;
374 	int i, err;
375 
376 	/*
377 	 * If input is pending take it first.
378 	 */
379 	lflag = tp->t_lflag;
380 	if (ISSET(lflag, PENDIN))
381 		ttypend(tp);
382 	/*
383 	 * Gather stats.
384 	 */
385 	if (ISSET(lflag, ICANON))
386 		++tp->t_cancc;
387 	else
388 		++tp->t_rawcc;
389 	++tk_nin;
390 
391 	/*
392 	 * Block further input iff:
393 	 * current input > threshold AND input is available to user program
394 	 * AND input flow control is enabled and not yet invoked.
395 	 * The 3 is slop for PARMRK.
396 	 */
397 	iflag = tp->t_iflag;
398 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
399 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
400 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
401 	    !ISSET(tp->t_state, TS_TBLOCK))
402 		ttyblock(tp);
403 
404 	/* Handle exceptional conditions (break, parity, framing). */
405 	cc = tp->t_cc;
406 	err = (ISSET(c, TTY_ERRORMASK));
407 	if (err) {
408 		CLR(c, TTY_ERRORMASK);
409 		if (ISSET(err, TTY_BI)) {
410 			if (ISSET(iflag, IGNBRK))
411 				return (0);
412 			if (ISSET(iflag, BRKINT)) {
413 				ttyflush(tp, FREAD | FWRITE);
414 				pgsignal(tp->t_pgrp, SIGINT, 1);
415 				goto endcase;
416 			}
417 			if (ISSET(iflag, PARMRK))
418 				goto parmrk;
419 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
420 			|| ISSET(err, TTY_FE)) {
421 			if (ISSET(iflag, IGNPAR))
422 				return (0);
423 			else if (ISSET(iflag, PARMRK)) {
424 parmrk:
425 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
426 				    MAX_INPUT - 3)
427 					goto input_overflow;
428 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
429 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
430 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
431 				goto endcase;
432 			} else
433 				c = 0;
434 		}
435 	}
436 
437 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
438 		CLR(c, 0x80);
439 	if (!ISSET(lflag, EXTPROC)) {
440 		/*
441 		 * Check for literal nexting very first
442 		 */
443 		if (ISSET(tp->t_state, TS_LNCH)) {
444 			SET(c, TTY_QUOTE);
445 			CLR(tp->t_state, TS_LNCH);
446 		}
447 		/*
448 		 * Scan for special characters.  This code
449 		 * is really just a big case statement with
450 		 * non-constant cases.  The bottom of the
451 		 * case statement is labeled ``endcase'', so goto
452 		 * it after a case match, or similar.
453 		 */
454 
455 		/*
456 		 * Control chars which aren't controlled
457 		 * by ICANON, ISIG, or IXON.
458 		 */
459 		if (ISSET(lflag, IEXTEN)) {
460 			if (CCEQ(cc[VLNEXT], c)) {
461 				if (ISSET(lflag, ECHO)) {
462 					if (ISSET(lflag, ECHOE)) {
463 						(void)ttyoutput('^', tp);
464 						(void)ttyoutput('\b', tp);
465 					} else
466 						ttyecho(c, tp);
467 				}
468 				SET(tp->t_state, TS_LNCH);
469 				goto endcase;
470 			}
471 			if (CCEQ(cc[VDISCARD], c)) {
472 				if (ISSET(lflag, FLUSHO))
473 					CLR(tp->t_lflag, FLUSHO);
474 				else {
475 					ttyflush(tp, FWRITE);
476 					ttyecho(c, tp);
477 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
478 						ttyretype(tp);
479 					SET(tp->t_lflag, FLUSHO);
480 				}
481 				goto startoutput;
482 			}
483 		}
484 		/*
485 		 * Signals.
486 		 */
487 		if (ISSET(lflag, ISIG)) {
488 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
489 				if (!ISSET(lflag, NOFLSH))
490 					ttyflush(tp, FREAD | FWRITE);
491 				ttyecho(c, tp);
492 				pgsignal(tp->t_pgrp,
493 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
494 				goto endcase;
495 			}
496 			if (CCEQ(cc[VSUSP], c)) {
497 				if (!ISSET(lflag, NOFLSH))
498 					ttyflush(tp, FREAD);
499 				ttyecho(c, tp);
500 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
501 				goto endcase;
502 			}
503 		}
504 		/*
505 		 * Handle start/stop characters.
506 		 */
507 		if (ISSET(iflag, IXON)) {
508 			if (CCEQ(cc[VSTOP], c)) {
509 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
510 					SET(tp->t_state, TS_TTSTOP);
511 					(*tp->t_stop)(tp, 0);
512 					return (0);
513 				}
514 				if (!CCEQ(cc[VSTART], c))
515 					return (0);
516 				/*
517 				 * if VSTART == VSTOP then toggle
518 				 */
519 				goto endcase;
520 			}
521 			if (CCEQ(cc[VSTART], c))
522 				goto restartoutput;
523 		}
524 		/*
525 		 * IGNCR, ICRNL, & INLCR
526 		 */
527 		if (c == '\r') {
528 			if (ISSET(iflag, IGNCR))
529 				return (0);
530 			else if (ISSET(iflag, ICRNL))
531 				c = '\n';
532 		} else if (c == '\n' && ISSET(iflag, INLCR))
533 			c = '\r';
534 	}
535 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
536 		/*
537 		 * From here on down canonical mode character
538 		 * processing takes place.
539 		 */
540 		/*
541 		 * erase or erase2 (^H / ^?)
542 		 */
543 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
544 			if (tp->t_rawq.c_cc)
545 				ttyrub(clist_unputc(&tp->t_rawq), tp);
546 			goto endcase;
547 		}
548 		/*
549 		 * kill (^U)
550 		 */
551 		if (CCEQ(cc[VKILL], c)) {
552 			if (ISSET(lflag, ECHOKE) &&
553 			    tp->t_rawq.c_cc == tp->t_rocount &&
554 			    !ISSET(lflag, ECHOPRT))
555 				while (tp->t_rawq.c_cc)
556 					ttyrub(clist_unputc(&tp->t_rawq), tp);
557 			else {
558 				ttyecho(c, tp);
559 				if (ISSET(lflag, ECHOK) ||
560 				    ISSET(lflag, ECHOKE))
561 					ttyecho('\n', tp);
562 				FLUSHQ(&tp->t_rawq);
563 				tp->t_rocount = 0;
564 			}
565 			CLR(tp->t_state, TS_LOCAL);
566 			goto endcase;
567 		}
568 		/*
569 		 * word erase (^W)
570 		 */
571 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
572 			int ctype;
573 
574 			/*
575 			 * erase whitespace
576 			 */
577 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
578 				ttyrub(c, tp);
579 			if (c == -1)
580 				goto endcase;
581 			/*
582 			 * erase last char of word and remember the
583 			 * next chars type (for ALTWERASE)
584 			 */
585 			ttyrub(c, tp);
586 			c = clist_unputc(&tp->t_rawq);
587 			if (c == -1)
588 				goto endcase;
589 			if (c == ' ' || c == '\t') {
590 				clist_putc(c, &tp->t_rawq);
591 				goto endcase;
592 			}
593 			ctype = ISALPHA(c);
594 			/*
595 			 * erase rest of word
596 			 */
597 			do {
598 				ttyrub(c, tp);
599 				c = clist_unputc(&tp->t_rawq);
600 				if (c == -1)
601 					goto endcase;
602 			} while (c != ' ' && c != '\t' &&
603 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
604 			clist_putc(c, &tp->t_rawq);
605 			goto endcase;
606 		}
607 		/*
608 		 * reprint line (^R)
609 		 */
610 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
611 			ttyretype(tp);
612 			goto endcase;
613 		}
614 		/*
615 		 * ^T - kernel info and generate SIGINFO
616 		 */
617 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
618 			if (ISSET(lflag, ISIG))
619 				pgsignal(tp->t_pgrp, SIGINFO, 1);
620 			if (!ISSET(lflag, NOKERNINFO))
621 				ttyinfo(tp);
622 			goto endcase;
623 		}
624 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
625 			if (ISSET(lflag, ISIG))
626 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
627 			goto endcase;
628 		}
629 	}
630 	/*
631 	 * Check for input buffer overflow
632 	 */
633 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
634 input_overflow:
635 		if (ISSET(iflag, IMAXBEL)) {
636 			if (tp->t_outq.c_cc < tp->t_ohiwat)
637 				(void)ttyoutput(CTRL('g'), tp);
638 		}
639 		goto endcase;
640 	}
641 
642 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
643 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
644 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
645 
646 	/*
647 	 * Put data char in q for user and
648 	 * wakeup on seeing a line delimiter.
649 	 */
650 	if (clist_putc(c, &tp->t_rawq) >= 0) {
651 		if (!ISSET(lflag, ICANON)) {
652 			ttwakeup(tp);
653 			ttyecho(c, tp);
654 			goto endcase;
655 		}
656 		if (TTBREAKC(c, lflag)) {
657 			tp->t_rocount = 0;
658 			catq(&tp->t_rawq, &tp->t_canq);
659 			ttwakeup(tp);
660 		} else if (tp->t_rocount++ == 0)
661 			tp->t_rocol = tp->t_column;
662 		if (ISSET(tp->t_state, TS_ERASE)) {
663 			/*
664 			 * end of prterase \.../
665 			 */
666 			CLR(tp->t_state, TS_ERASE);
667 			(void)ttyoutput('/', tp);
668 		}
669 		i = tp->t_column;
670 		ttyecho(c, tp);
671 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
672 			/*
673 			 * Place the cursor over the '^' of the ^D.
674 			 */
675 			i = imin(2, tp->t_column - i);
676 			while (i > 0) {
677 				(void)ttyoutput('\b', tp);
678 				i--;
679 			}
680 		}
681 	}
682 endcase:
683 	/*
684 	 * IXANY means allow any character to restart output.
685 	 */
686 	if (ISSET(tp->t_state, TS_TTSTOP) &&
687 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP])
688 		return (0);
689 restartoutput:
690 	CLR(tp->t_lflag, FLUSHO);
691 	CLR(tp->t_state, TS_TTSTOP);
692 startoutput:
693 	return (ttstart(tp));
694 }
695 
696 /*
697  * Output a single character on a tty, doing output processing
698  * as needed (expanding tabs, newline processing, etc.).
699  * Returns < 0 if succeeds, otherwise returns char to resend.
700  * Must be recursive.
701  */
702 static int
703 ttyoutput(int c, struct tty *tp)
704 {
705 	tcflag_t oflag;
706 	int col;
707 
708 	oflag = tp->t_oflag;
709 	if (!ISSET(oflag, OPOST)) {
710 		if (ISSET(tp->t_lflag, FLUSHO))
711 			return (-1);
712 		if (clist_putc(c, &tp->t_outq))
713 			return (c);
714 		tk_nout++;
715 		tp->t_outcc++;
716 		return (-1);
717 	}
718 	/*
719 	 * Do tab expansion if OXTABS is set.  Special case if we external
720 	 * processing, we don't do the tab expansion because we'll probably
721 	 * get it wrong.  If tab expansion needs to be done, let it happen
722 	 * externally.
723 	 */
724 	CLR(c, ~TTY_CHARMASK);
725 	if (c == '\t' &&
726 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
727 		c = 8 - (tp->t_column & 7);
728 		if (!ISSET(tp->t_lflag, FLUSHO)) {
729 			crit_enter();		/* Don't interrupt tabs. */
730 			c -= b_to_q("        ", c, &tp->t_outq);
731 			tk_nout += c;
732 			tp->t_outcc += c;
733 			crit_exit();
734 		}
735 		tp->t_column += c;
736 		return (c ? -1 : '\t');
737 	}
738 	if (c == CEOT && ISSET(oflag, ONOEOT))
739 		return (-1);
740 
741 	/*
742 	 * Newline translation: if ONLCR is set,
743 	 * translate newline into "\r\n".
744 	 */
745 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
746 		tk_nout++;
747 		tp->t_outcc++;
748 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq))
749 			return (c);
750 	}
751 	/* If OCRNL is set, translate "\r" into "\n". */
752 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
753 		c = '\n';
754 	/* If ONOCR is set, don't transmit CRs when on column 0. */
755 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
756 		return (-1);
757 
758 	tk_nout++;
759 	tp->t_outcc++;
760 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq))
761 		return (c);
762 
763 	col = tp->t_column;
764 	switch (CCLASS(c)) {
765 	case BACKSPACE:
766 		if (col > 0)
767 			--col;
768 		break;
769 	case CONTROL:
770 		break;
771 	case NEWLINE:
772 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
773 			col = 0;
774 		break;
775 	case RETURN:
776 		col = 0;
777 		break;
778 	case ORDINARY:
779 		++col;
780 		break;
781 	case TAB:
782 		col = (col + 8) & ~7;
783 		break;
784 	}
785 	tp->t_column = col;
786 	return (-1);
787 }
788 
789 /*
790  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
791  * has been called to do discipline-specific functions and/or reject any
792  * of these ioctl commands.
793  */
794 /* ARGSUSED */
795 int
796 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
797 {
798 	struct thread *td = curthread;
799 	struct lwp *lp = td->td_lwp;
800 	struct proc *p = td->td_proc;
801 	int error;
802 
803 	KKASSERT(p);
804 
805 	/* If the ioctl involves modification, hang if in the background. */
806 	switch (cmd) {
807 	case  TIOCCBRK:
808 	case  TIOCCONS:
809 	case  TIOCDRAIN:
810 	case  TIOCEXCL:
811 	case  TIOCFLUSH:
812 #ifdef TIOCHPCL
813 	case  TIOCHPCL:
814 #endif
815 	case  TIOCNXCL:
816 	case  TIOCSBRK:
817 	case  TIOCSCTTY:
818 	case  TIOCSDRAINWAIT:
819 	case  TIOCSETA:
820 	case  TIOCSETAF:
821 	case  TIOCSETAW:
822 	case  TIOCSETD:
823 	case  TIOCSPGRP:
824 	case  TIOCSTART:
825 	case  TIOCSTAT:
826 	case  TIOCSTI:
827 	case  TIOCSTOP:
828 	case  TIOCSWINSZ:
829 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
830 	case  TIOCLBIC:
831 	case  TIOCLBIS:
832 	case  TIOCLSET:
833 	case  TIOCSETC:
834 	case OTIOCSETD:
835 	case  TIOCSETN:
836 	case  TIOCSETP:
837 	case  TIOCSLTC:
838 #endif
839 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
840 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
841 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
842 			if (p->p_pgrp->pg_jobc == 0)
843 				return (EIO);
844 			pgsignal(p->p_pgrp, SIGTTOU, 1);
845 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
846 					 0);
847 			if (error)
848 				return (error);
849 		}
850 		break;
851 	}
852 
853 	switch (cmd) {			/* Process the ioctl. */
854 	case FIOASYNC:			/* set/clear async i/o */
855 		crit_enter();
856 		if (*(int *)data)
857 			SET(tp->t_state, TS_ASYNC);
858 		else
859 			CLR(tp->t_state, TS_ASYNC);
860 		crit_exit();
861 		break;
862 	case FIONREAD:			/* get # bytes to read */
863 		crit_enter();
864 		*(int *)data = ttnread(tp);
865 		crit_exit();
866 		break;
867 
868 	case FIOSETOWN:
869 		/*
870 		 * Policy -- Don't allow FIOSETOWN on someone else's
871 		 *           controlling tty
872 		 */
873 		if (tp->t_session != NULL && !isctty(p, tp))
874 			return (ENOTTY);
875 
876 		error = fsetown(*(int *)data, &tp->t_sigio);
877 		if (error)
878 			return (error);
879 		break;
880 	case FIOGETOWN:
881 		if (tp->t_session != NULL && !isctty(p, tp))
882 			return (ENOTTY);
883 		*(int *)data = fgetown(tp->t_sigio);
884 		break;
885 
886 	case TIOCEXCL:			/* set exclusive use of tty */
887 		crit_enter();
888 		SET(tp->t_state, TS_XCLUDE);
889 		crit_exit();
890 		break;
891 	case TIOCFLUSH: {		/* flush buffers */
892 		int flags = *(int *)data;
893 
894 		if (flags == 0)
895 			flags = FREAD | FWRITE;
896 		else
897 			flags &= FREAD | FWRITE;
898 		ttyflush(tp, flags);
899 		break;
900 	}
901 	case TIOCCONS:			/* become virtual console */
902 		if (*(int *)data) {
903 			if (constty && constty != tp &&
904 			    ISSET(constty->t_state, TS_CONNECTED))
905 				return (EBUSY);
906 #ifndef	UCONSOLE
907 			if ((error = priv_check(td, PRIV_ROOT)) != 0)
908 				return (error);
909 #endif
910 			constty = tp;
911 		} else if (tp == constty)
912 			constty = NULL;
913 		break;
914 	case TIOCDRAIN:			/* wait till output drained */
915 		error = ttywait(tp);
916 		if (error)
917 			return (error);
918 		break;
919 	case TIOCGETA: {		/* get termios struct */
920 		struct termios *t = (struct termios *)data;
921 
922 		bcopy(&tp->t_termios, t, sizeof(struct termios));
923 		break;
924 	}
925 	case TIOCGETD:			/* get line discipline */
926 		*(int *)data = tp->t_line;
927 		break;
928 	case TIOCGWINSZ:		/* get window size */
929 		*(struct winsize *)data = tp->t_winsize;
930 		break;
931 	case TIOCGPGRP:			/* get pgrp of tty */
932 		if (!isctty(p, tp))
933 			return (ENOTTY);
934 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
935 		break;
936 	case TIOCGSID:                  /* get sid of tty */
937 		if (!isctty(p, tp))
938 			return (ENOTTY);
939 		*(int *)data = tp->t_session->s_sid;
940 		break;
941 #ifdef TIOCHPCL
942 	case TIOCHPCL:			/* hang up on last close */
943 		crit_enter();
944 		SET(tp->t_cflag, HUPCL);
945 		crit_exit();
946 		break;
947 #endif
948 	case TIOCNXCL:			/* reset exclusive use of tty */
949 		crit_enter();
950 		CLR(tp->t_state, TS_XCLUDE);
951 		crit_exit();
952 		break;
953 	case TIOCOUTQ:			/* output queue size */
954 		*(int *)data = tp->t_outq.c_cc;
955 		break;
956 	case TIOCSETA:			/* set termios struct */
957 	case TIOCSETAW:			/* drain output, set */
958 	case TIOCSETAF: {		/* drn out, fls in, set */
959 		struct termios *t = (struct termios *)data;
960 
961 		if (t->c_ispeed == 0)
962 			t->c_ispeed = t->c_ospeed;
963 		if (t->c_ispeed == 0)
964 			t->c_ispeed = tp->t_ospeed;
965 		if (t->c_ispeed == 0)
966 			return (EINVAL);
967 		crit_enter();
968 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
969 			error = ttywait(tp);
970 			if (error) {
971 				crit_exit();
972 				return (error);
973 			}
974 			if (cmd == TIOCSETAF)
975 				ttyflush(tp, FREAD);
976 		}
977 		if (!ISSET(t->c_cflag, CIGNORE)) {
978 			/*
979 			 * Set device hardware.
980 			 */
981 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
982 				crit_exit();
983 				return (error);
984 			}
985 			if (ISSET(t->c_cflag, CLOCAL) &&
986 			    !ISSET(tp->t_cflag, CLOCAL)) {
987 				/*
988 				 * XXX disconnections would be too hard to
989 				 * get rid of without this kludge.  The only
990 				 * way to get rid of controlling terminals
991 				 * is to exit from the session leader.
992 				 */
993 				CLR(tp->t_state, TS_ZOMBIE);
994 
995 				wakeup(TSA_CARR_ON(tp));
996 				ttwakeup(tp);
997 				ttwwakeup(tp);
998 			}
999 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1000 			     ISSET(t->c_cflag, CLOCAL)) &&
1001 			    !ISSET(tp->t_state, TS_ZOMBIE))
1002 				SET(tp->t_state, TS_CONNECTED);
1003 			else
1004 				CLR(tp->t_state, TS_CONNECTED);
1005 			tp->t_cflag = t->c_cflag;
1006 			tp->t_ispeed = t->c_ispeed;
1007 			if (t->c_ospeed != 0)
1008 				tp->t_ospeed = t->c_ospeed;
1009 			ttsetwater(tp);
1010 		}
1011 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1012 		    cmd != TIOCSETAF) {
1013 			if (ISSET(t->c_lflag, ICANON))
1014 				SET(tp->t_lflag, PENDIN);
1015 			else {
1016 				/*
1017 				 * XXX we really shouldn't allow toggling
1018 				 * ICANON while we're in a non-termios line
1019 				 * discipline.  Now we have to worry about
1020 				 * panicing for a null queue.
1021 				 */
1022 				if (tp->t_canq.c_cbreserved > 0 &&
1023 				    tp->t_rawq.c_cbreserved > 0) {
1024 					catq(&tp->t_rawq, &tp->t_canq);
1025 					/*
1026 					 * XXX the queue limits may be
1027 					 * different, so the old queue
1028 					 * swapping method no longer works.
1029 					 */
1030 					catq(&tp->t_canq, &tp->t_rawq);
1031 				}
1032 				CLR(tp->t_lflag, PENDIN);
1033 			}
1034 			ttwakeup(tp);
1035 		}
1036 		tp->t_iflag = t->c_iflag;
1037 		tp->t_oflag = t->c_oflag;
1038 		/*
1039 		 * Make the EXTPROC bit read only.
1040 		 */
1041 		if (ISSET(tp->t_lflag, EXTPROC))
1042 			SET(t->c_lflag, EXTPROC);
1043 		else
1044 			CLR(t->c_lflag, EXTPROC);
1045 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1046 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1047 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1048 			ttwakeup(tp);
1049 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1050 		crit_exit();
1051 		break;
1052 	}
1053 	case TIOCSETD: {		/* set line discipline */
1054 		int t = *(int *)data;
1055 		cdev_t device = tp->t_dev;
1056 
1057 		if ((u_int)t >= nlinesw)
1058 			return (ENXIO);
1059 		if (t != tp->t_line) {
1060 			crit_enter();
1061 			(*linesw[tp->t_line].l_close)(tp, flag);
1062 			error = (*linesw[t].l_open)(device, tp);
1063 			if (error) {
1064 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1065 				crit_exit();
1066 				return (error);
1067 			}
1068 			tp->t_line = t;
1069 			crit_exit();
1070 		}
1071 		break;
1072 	}
1073 	case TIOCSTART:			/* start output, like ^Q */
1074 		crit_enter();
1075 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1076 		    ISSET(tp->t_lflag, FLUSHO)) {
1077 			CLR(tp->t_lflag, FLUSHO);
1078 			CLR(tp->t_state, TS_TTSTOP);
1079 			ttstart(tp);
1080 		}
1081 		crit_exit();
1082 		break;
1083 	case TIOCSTI:			/* simulate terminal input */
1084 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT))
1085 			return (EPERM);
1086 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT))
1087 			return (EACCES);
1088 		crit_enter();
1089 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1090 		crit_exit();
1091 		break;
1092 	case TIOCSTOP:			/* stop output, like ^S */
1093 		crit_enter();
1094 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1095 			SET(tp->t_state, TS_TTSTOP);
1096 			(*tp->t_stop)(tp, 0);
1097 		}
1098 		crit_exit();
1099 		break;
1100 	case TIOCSCTTY:			/* become controlling tty */
1101 		/* Session ctty vnode pointer set in vnode layer. */
1102 		if (!SESS_LEADER(p) ||
1103 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1104 		    (tp->t_session != p->p_session)))
1105 			return (EPERM);
1106 		tp->t_session = p->p_session;
1107 		tp->t_pgrp = p->p_pgrp;
1108 		p->p_session->s_ttyp = tp;
1109 		p->p_flag |= P_CONTROLT;
1110 		break;
1111 	case TIOCSPGRP: {		/* set pgrp of tty */
1112 		pid_t pgid = *(int *)data;
1113 
1114 		if (!isctty(p, tp))
1115 			return (ENOTTY);
1116 		else if (pgid < 1 || pgid > PID_MAX)
1117 			return (EINVAL);
1118 		else {
1119 			struct pgrp *pgrp = pgfind(pgid);
1120 			if (pgrp == NULL || pgrp->pg_session != p->p_session)
1121 				return (EPERM);
1122 
1123 			tp->t_pgrp = pgrp;
1124 		}
1125 		break;
1126 	}
1127 	case TIOCSTAT:			/* simulate control-T */
1128 		crit_enter();
1129 		ttyinfo(tp);
1130 		crit_exit();
1131 		break;
1132 	case TIOCSWINSZ:		/* set window size */
1133 		if (bcmp((caddr_t)&tp->t_winsize, data,
1134 		    sizeof (struct winsize))) {
1135 			tp->t_winsize = *(struct winsize *)data;
1136 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1137 		}
1138 		break;
1139 	case TIOCSDRAINWAIT:
1140 		error = priv_check(td, PRIV_ROOT);
1141 		if (error)
1142 			return (error);
1143 		tp->t_timeout = *(int *)data * hz;
1144 		wakeup(TSA_OCOMPLETE(tp));
1145 		wakeup(TSA_OLOWAT(tp));
1146 		break;
1147 	case TIOCGDRAINWAIT:
1148 		*(int *)data = tp->t_timeout / hz;
1149 		break;
1150 	default:
1151 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1152 		return (ttcompat(tp, cmd, data, flag));
1153 #else
1154 		return (ENOIOCTL);
1155 #endif
1156 	}
1157 	return (0);
1158 }
1159 
1160 int
1161 ttypoll(struct dev_poll_args *ap)
1162 {
1163 	cdev_t dev = ap->a_head.a_dev;
1164 	int events = ap->a_events;
1165 	int revents = 0;
1166 	struct tty *tp;
1167 
1168 	tp = dev->si_tty;
1169 	/* XXX used to return ENXIO, but that means true! */
1170 	if (tp == NULL) {
1171 		ap->a_events = (events & (POLLIN | POLLOUT | POLLRDNORM |
1172 				POLLWRNORM)) | POLLHUP;
1173 		return(0);
1174 	}
1175 
1176 	crit_enter();
1177 	if (events & (POLLIN | POLLRDNORM)) {
1178 		if (ttnread(tp) > 0 || ISSET(tp->t_state, TS_ZOMBIE))
1179 			revents |= events & (POLLIN | POLLRDNORM);
1180 		else
1181 			selrecord(curthread, &tp->t_rsel);
1182 	}
1183 	if (events & (POLLOUT | POLLWRNORM)) {
1184 		if ((tp->t_outq.c_cc <= tp->t_olowat &&
1185 		     ISSET(tp->t_state, TS_CONNECTED))
1186 		    || ISSET(tp->t_state, TS_ZOMBIE))
1187 			revents |= events & (POLLOUT | POLLWRNORM);
1188 		else
1189 			selrecord(curthread, &tp->t_wsel);
1190 	}
1191 	crit_exit();
1192 	ap->a_events = revents;
1193 	return (0);
1194 }
1195 
1196 static struct filterops ttyread_filtops =
1197 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1198 static struct filterops ttywrite_filtops =
1199 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1200 
1201 int
1202 ttykqfilter(struct dev_kqfilter_args *ap)
1203 {
1204 	cdev_t dev = ap->a_head.a_dev;
1205 	struct knote *kn = ap->a_kn;
1206 	struct tty *tp = dev->si_tty;
1207 	struct klist *klist;
1208 
1209 	ap->a_result = 0;
1210 	switch (kn->kn_filter) {
1211 	case EVFILT_READ:
1212 		klist = &tp->t_rsel.si_note;
1213 		kn->kn_fop = &ttyread_filtops;
1214 		break;
1215 	case EVFILT_WRITE:
1216 		klist = &tp->t_wsel.si_note;
1217 		kn->kn_fop = &ttywrite_filtops;
1218 		break;
1219 	default:
1220 		ap->a_result = 1;
1221 		return (0);
1222 	}
1223 
1224 	kn->kn_hook = (caddr_t)dev;
1225 
1226 	crit_enter();
1227 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1228 	crit_exit();
1229 
1230 	return (0);
1231 }
1232 
1233 static void
1234 filt_ttyrdetach(struct knote *kn)
1235 {
1236 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1237 
1238 	crit_enter();
1239 	SLIST_REMOVE(&tp->t_rsel.si_note, kn, knote, kn_selnext);
1240 	crit_exit();
1241 }
1242 
1243 static int
1244 filt_ttyread(struct knote *kn, long hint)
1245 {
1246 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1247 
1248 	kn->kn_data = ttnread(tp);
1249 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1250 		kn->kn_flags |= EV_EOF;
1251 		return (1);
1252 	}
1253 	return (kn->kn_data > 0);
1254 }
1255 
1256 static void
1257 filt_ttywdetach(struct knote *kn)
1258 {
1259 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1260 
1261 	crit_enter();
1262 	SLIST_REMOVE(&tp->t_wsel.si_note, kn, knote, kn_selnext);
1263 	crit_exit();
1264 }
1265 
1266 static int
1267 filt_ttywrite(struct knote *kn, long hint)
1268 {
1269 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1270 
1271 	kn->kn_data = tp->t_outq.c_cc;
1272 	if (ISSET(tp->t_state, TS_ZOMBIE))
1273 		return (1);
1274 	return (kn->kn_data <= tp->t_olowat &&
1275 	    ISSET(tp->t_state, TS_CONNECTED));
1276 }
1277 
1278 /*
1279  * Must be called while in a critical section.
1280  */
1281 static int
1282 ttnread(struct tty *tp)
1283 {
1284 	int nread;
1285 
1286 	if (ISSET(tp->t_lflag, PENDIN))
1287 		ttypend(tp);
1288 	nread = tp->t_canq.c_cc;
1289 	if (!ISSET(tp->t_lflag, ICANON)) {
1290 		nread += tp->t_rawq.c_cc;
1291 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1292 			nread = 0;
1293 	}
1294 	return (nread);
1295 }
1296 
1297 /*
1298  * Wait for output to drain.
1299  */
1300 int
1301 ttywait(struct tty *tp)
1302 {
1303 	int error;
1304 
1305 	error = 0;
1306 	crit_enter();
1307 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1308 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1309 		(*tp->t_oproc)(tp);
1310 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1311 		    ISSET(tp->t_state, TS_CONNECTED)) {
1312 			SET(tp->t_state, TS_SO_OCOMPLETE);
1313 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1314 					 PCATCH, "ttywai",
1315 					 tp->t_timeout);
1316 			if (error) {
1317 				if (error == EWOULDBLOCK)
1318 					error = EIO;
1319 				break;
1320 			}
1321 		} else
1322 			break;
1323 	}
1324 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1325 		error = EIO;
1326 	crit_exit();
1327 	return (error);
1328 }
1329 
1330 /*
1331  * Flush if successfully wait.
1332  */
1333 static int
1334 ttywflush(struct tty *tp)
1335 {
1336 	int error;
1337 
1338 	if ((error = ttywait(tp)) == 0)
1339 		ttyflush(tp, FREAD);
1340 	return (error);
1341 }
1342 
1343 /*
1344  * Flush tty read and/or write queues, notifying anyone waiting.
1345  */
1346 void
1347 ttyflush(struct tty *tp, int rw)
1348 {
1349 	crit_enter();
1350 #if 0
1351 again:
1352 #endif
1353 	if (rw & FWRITE) {
1354 		FLUSHQ(&tp->t_outq);
1355 		CLR(tp->t_state, TS_TTSTOP);
1356 	}
1357 	(*tp->t_stop)(tp, rw);
1358 	if (rw & FREAD) {
1359 		FLUSHQ(&tp->t_canq);
1360 		FLUSHQ(&tp->t_rawq);
1361 		CLR(tp->t_lflag, PENDIN);
1362 		tp->t_rocount = 0;
1363 		tp->t_rocol = 0;
1364 		CLR(tp->t_state, TS_LOCAL);
1365 		ttwakeup(tp);
1366 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1367 			if (rw & FWRITE)
1368 				FLUSHQ(&tp->t_outq);
1369 			ttyunblock(tp);
1370 
1371 			/*
1372 			 * Don't let leave any state that might clobber the
1373 			 * next line discipline (although we should do more
1374 			 * to send the START char).  Not clearing the state
1375 			 * may have caused the "putc to a clist with no
1376 			 * reserved cblocks" panic/kprintf.
1377 			 */
1378 			CLR(tp->t_state, TS_TBLOCK);
1379 
1380 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1381 			if (ISSET(tp->t_iflag, IXOFF)) {
1382 				/*
1383 				 * XXX wait a bit in the hope that the stop
1384 				 * character (if any) will go out.  Waiting
1385 				 * isn't good since it allows races.  This
1386 				 * will be fixed when the stop character is
1387 				 * put in a special queue.  Don't bother with
1388 				 * the checks in ttywait() since the timeout
1389 				 * will save us.
1390 				 */
1391 				SET(tp->t_state, TS_SO_OCOMPLETE);
1392 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1393 					 "ttyfls", hz / 10);
1394 				/*
1395 				 * Don't try sending the stop character again.
1396 				 */
1397 				CLR(tp->t_state, TS_TBLOCK);
1398 				goto again;
1399 			}
1400 #endif
1401 		}
1402 	}
1403 	if (rw & FWRITE) {
1404 		FLUSHQ(&tp->t_outq);
1405 		ttwwakeup(tp);
1406 	}
1407 	crit_exit();
1408 }
1409 
1410 /*
1411  * Copy in the default termios characters.
1412  */
1413 void
1414 termioschars(struct termios *t)
1415 {
1416 
1417 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1418 }
1419 
1420 /*
1421  * Old interface.
1422  */
1423 void
1424 ttychars(struct tty *tp)
1425 {
1426 
1427 	termioschars(&tp->t_termios);
1428 }
1429 
1430 /*
1431  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1432  * on our input flow control bit and propagate the changes to the driver.
1433  * XXX the stop character should be put in a special high priority queue.
1434  */
1435 void
1436 ttyblock(struct tty *tp)
1437 {
1438 
1439 	SET(tp->t_state, TS_TBLOCK);
1440 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1441 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1442 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1443 	ttstart(tp);
1444 }
1445 
1446 /*
1447  * Handle input low water.  Send start character for the IXOFF case.  Turn
1448  * off our input flow control bit and propagate the changes to the driver.
1449  * XXX the start character should be put in a special high priority queue.
1450  */
1451 static void
1452 ttyunblock(struct tty *tp)
1453 {
1454 
1455 	CLR(tp->t_state, TS_TBLOCK);
1456 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1457 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1458 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1459 	ttstart(tp);
1460 }
1461 
1462 #ifdef notyet
1463 /* Not used by any current (i386) drivers. */
1464 /*
1465  * Restart after an inter-char delay.
1466  */
1467 void
1468 ttrstrt(void *tp_arg)
1469 {
1470 	struct tty *tp;
1471 
1472 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1473 
1474 	tp = tp_arg;
1475 	crit_enter();
1476 	CLR(tp->t_state, TS_TIMEOUT);
1477 	ttstart(tp);
1478 	crit_exit();
1479 }
1480 #endif
1481 
1482 int
1483 ttstart(struct tty *tp)
1484 {
1485 
1486 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1487 		(*tp->t_oproc)(tp);
1488 	return (0);
1489 }
1490 
1491 /*
1492  * "close" a line discipline
1493  */
1494 int
1495 ttylclose(struct tty *tp, int flag)
1496 {
1497 
1498 	if (flag & FNONBLOCK || ttywflush(tp))
1499 		ttyflush(tp, FREAD | FWRITE);
1500 	return (0);
1501 }
1502 
1503 /*
1504  * Handle modem control transition on a tty.
1505  * Flag indicates new state of carrier.
1506  * Returns 0 if the line should be turned off, otherwise 1.
1507  */
1508 int
1509 ttymodem(struct tty *tp, int flag)
1510 {
1511 
1512 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1513 		/*
1514 		 * MDMBUF: do flow control according to carrier flag
1515 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1516 		 * works if IXON and IXANY are clear.
1517 		 */
1518 		if (flag) {
1519 			CLR(tp->t_state, TS_CAR_OFLOW);
1520 			CLR(tp->t_state, TS_TTSTOP);
1521 			ttstart(tp);
1522 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1523 			SET(tp->t_state, TS_CAR_OFLOW);
1524 			SET(tp->t_state, TS_TTSTOP);
1525 			(*tp->t_stop)(tp, 0);
1526 		}
1527 	} else if (flag == 0) {
1528 		/*
1529 		 * Lost carrier.
1530 		 */
1531 		CLR(tp->t_state, TS_CARR_ON);
1532 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1533 		    !ISSET(tp->t_cflag, CLOCAL)) {
1534 			SET(tp->t_state, TS_ZOMBIE);
1535 			CLR(tp->t_state, TS_CONNECTED);
1536 			if (tp->t_session && tp->t_session->s_leader)
1537 				ksignal(tp->t_session->s_leader, SIGHUP);
1538 			ttyflush(tp, FREAD | FWRITE);
1539 			return (0);
1540 		}
1541 	} else {
1542 		/*
1543 		 * Carrier now on.
1544 		 */
1545 		SET(tp->t_state, TS_CARR_ON);
1546 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1547 			SET(tp->t_state, TS_CONNECTED);
1548 		wakeup(TSA_CARR_ON(tp));
1549 		ttwakeup(tp);
1550 		ttwwakeup(tp);
1551 	}
1552 	return (1);
1553 }
1554 
1555 /*
1556  * Reinput pending characters after state switch
1557  * call from a critical section.
1558  */
1559 static void
1560 ttypend(struct tty *tp)
1561 {
1562 	struct clist tq;
1563 	int c;
1564 
1565 	CLR(tp->t_lflag, PENDIN);
1566 	SET(tp->t_state, TS_TYPEN);
1567 	/*
1568 	 * XXX this assumes too much about clist internals.  It may even
1569 	 * fail if the cblock slush pool is empty.  We can't allocate more
1570 	 * cblocks here because we are called from an interrupt handler
1571 	 * and clist_alloc_cblocks() can wait.
1572 	 */
1573 	tq = tp->t_rawq;
1574 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1575 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1576 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1577 	while ((c = clist_getc(&tq)) >= 0)
1578 		ttyinput(c, tp);
1579 	CLR(tp->t_state, TS_TYPEN);
1580 }
1581 
1582 /*
1583  * Process a read call on a tty device.
1584  */
1585 int
1586 ttread(struct tty *tp, struct uio *uio, int flag)
1587 {
1588 	struct clist *qp;
1589 	int c;
1590 	tcflag_t lflag;
1591 	cc_t *cc = tp->t_cc;
1592 	struct proc *pp;
1593 	struct lwp *lp;
1594 	int first, error = 0;
1595 	int has_stime = 0, last_cc = 0;
1596 	long slp = 0;		/* XXX this should be renamed `timo'. */
1597 	struct timeval stime;
1598 
1599 	lp = curthread->td_lwp;
1600 	stime.tv_sec = 0;	/* fix compiler warnings */
1601 	stime.tv_usec = 0;
1602 
1603 loop:
1604 	crit_enter();
1605 	lflag = tp->t_lflag;
1606 	/*
1607 	 * take pending input first
1608 	 */
1609 	if (ISSET(lflag, PENDIN)) {
1610 		ttypend(tp);
1611 		splz();		/* reduce latency */
1612 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1613 	}
1614 
1615 	/*
1616 	 * Hang process if it's in the background.
1617 	 */
1618 	if ((pp = curproc) && isbackground(pp, tp)) {
1619 		crit_exit();
1620 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1621 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1622 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0)
1623 			return (EIO);
1624 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1625 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1626 		if (error)
1627 			return (error);
1628 		goto loop;
1629 	}
1630 
1631 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1632 		crit_exit();
1633 		return (0);	/* EOF */
1634 	}
1635 
1636 	/*
1637 	 * If canonical, use the canonical queue,
1638 	 * else use the raw queue.
1639 	 *
1640 	 * (should get rid of clists...)
1641 	 */
1642 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1643 
1644 	if (flag & IO_NDELAY) {
1645 		if (qp->c_cc > 0)
1646 			goto read;
1647 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1648 			crit_exit();
1649 			return (0);
1650 		}
1651 		crit_exit();
1652 		return (EWOULDBLOCK);
1653 	}
1654 	if (!ISSET(lflag, ICANON)) {
1655 		int m = cc[VMIN];
1656 		long t = cc[VTIME];
1657 		struct timeval timecopy;
1658 
1659 		/*
1660 		 * Check each of the four combinations.
1661 		 * (m > 0 && t == 0) is the normal read case.
1662 		 * It should be fairly efficient, so we check that and its
1663 		 * companion case (m == 0 && t == 0) first.
1664 		 * For the other two cases, we compute the target sleep time
1665 		 * into slp.
1666 		 */
1667 		if (t == 0) {
1668 			if (qp->c_cc < m)
1669 				goto sleep;
1670 			if (qp->c_cc > 0)
1671 				goto read;
1672 
1673 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1674 			crit_exit();
1675 			return (0);
1676 		}
1677 		t *= 100000;		/* time in us */
1678 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1679 			 ((t1).tv_usec - (t2).tv_usec))
1680 		if (m > 0) {
1681 			if (qp->c_cc <= 0)
1682 				goto sleep;
1683 			if (qp->c_cc >= m)
1684 				goto read;
1685 			getmicrotime(&timecopy);
1686 			if (has_stime == 0) {
1687 				/* first character, start timer */
1688 				has_stime = 1;
1689 				stime = timecopy;
1690 				slp = t;
1691 			} else if (qp->c_cc > last_cc) {
1692 				/* got a character, restart timer */
1693 				stime = timecopy;
1694 				slp = t;
1695 			} else {
1696 				/* nothing, check expiration */
1697 				slp = t - diff(timecopy, stime);
1698 				if (slp <= 0)
1699 					goto read;
1700 			}
1701 			last_cc = qp->c_cc;
1702 		} else {	/* m == 0 */
1703 			if (qp->c_cc > 0)
1704 				goto read;
1705 			getmicrotime(&timecopy);
1706 			if (has_stime == 0) {
1707 				has_stime = 1;
1708 				stime = timecopy;
1709 				slp = t;
1710 			} else {
1711 				slp = t - diff(timecopy, stime);
1712 				if (slp <= 0) {
1713 					/* Timed out, but 0 is enough input. */
1714 					crit_exit();
1715 					return (0);
1716 				}
1717 			}
1718 		}
1719 #undef diff
1720 		/*
1721 		 * Rounding down may make us wake up just short
1722 		 * of the target, so we round up.
1723 		 * The formula is ceiling(slp * hz/1000000).
1724 		 * 32-bit arithmetic is enough for hz < 169.
1725 		 * XXX see tvtohz() for how to avoid overflow if hz
1726 		 * is large (divide by `tick' and/or arrange to
1727 		 * use tvtohz() if hz is large).
1728 		 */
1729 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1730 		goto sleep;
1731 	}
1732 	if (qp->c_cc <= 0) {
1733 sleep:
1734 		/*
1735 		 * There is no input, or not enough input and we can block.
1736 		 */
1737 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1738 				 ISSET(tp->t_state, TS_CONNECTED) ?
1739 				 "ttyin" : "ttyhup", (int)slp);
1740 		crit_exit();
1741 		if (error == EWOULDBLOCK)
1742 			error = 0;
1743 		else if (error)
1744 			return (error);
1745 		/*
1746 		 * XXX what happens if another process eats some input
1747 		 * while we are asleep (not just here)?  It would be
1748 		 * safest to detect changes and reset our state variables
1749 		 * (has_stime and last_cc).
1750 		 */
1751 		slp = 0;
1752 		goto loop;
1753 	}
1754 read:
1755 	crit_exit();
1756 	/*
1757 	 * Input present, check for input mapping and processing.
1758 	 */
1759 	first = 1;
1760 	if (ISSET(lflag, ICANON | ISIG))
1761 		goto slowcase;
1762 	for (;;) {
1763 		char ibuf[IBUFSIZ];
1764 		int icc;
1765 
1766 		icc = (int)szmin(uio->uio_resid, IBUFSIZ);
1767 		icc = q_to_b(qp, ibuf, icc);
1768 		if (icc <= 0) {
1769 			if (first)
1770 				goto loop;
1771 			break;
1772 		}
1773 		error = uiomove(ibuf, (size_t)icc, uio);
1774 		/*
1775 		 * XXX if there was an error then we should ungetc() the
1776 		 * unmoved chars and reduce icc here.
1777 		 */
1778 		if (error)
1779 			break;
1780  		if (uio->uio_resid == 0)
1781 			break;
1782 		first = 0;
1783 	}
1784 	goto out;
1785 slowcase:
1786 	for (;;) {
1787 		c = clist_getc(qp);
1788 		if (c < 0) {
1789 			if (first)
1790 				goto loop;
1791 			break;
1792 		}
1793 		/*
1794 		 * delayed suspend (^Y)
1795 		 */
1796 		if (CCEQ(cc[VDSUSP], c) &&
1797 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1798 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1799 			if (first) {
1800 				error = ttysleep(tp, &lbolt, PCATCH,
1801 						 "ttybg3", 0);
1802 				if (error)
1803 					break;
1804 				goto loop;
1805 			}
1806 			break;
1807 		}
1808 		/*
1809 		 * Interpret EOF only in canonical mode.
1810 		 */
1811 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1812 			break;
1813 		/*
1814 		 * Give user character.
1815 		 */
1816  		error = ureadc(c, uio);
1817 		if (error)
1818 			/* XXX should ungetc(c, qp). */
1819 			break;
1820  		if (uio->uio_resid == 0)
1821 			break;
1822 		/*
1823 		 * In canonical mode check for a "break character"
1824 		 * marking the end of a "line of input".
1825 		 */
1826 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1827 			break;
1828 		first = 0;
1829 	}
1830 
1831 out:
1832 	/*
1833 	 * Look to unblock input now that (presumably)
1834 	 * the input queue has gone down.
1835 	 */
1836 	crit_enter();
1837 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1838 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1839 		ttyunblock(tp);
1840 	crit_exit();
1841 
1842 	return (error);
1843 }
1844 
1845 /*
1846  * Check the output queue on tp for space for a kernel message (from uprintf
1847  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1848  * lose messages due to normal flow control, but don't let the tty run amok.
1849  * Sleeps here are not interruptible, but we return prematurely if new signals
1850  * arrive.
1851  */
1852 int
1853 ttycheckoutq(struct tty *tp, int wait)
1854 {
1855 	struct lwp *lp = curthread->td_lwp;
1856 	int hiwat;
1857 	sigset_t oldset, newset;
1858 
1859 	hiwat = tp->t_ohiwat;
1860 	SIGEMPTYSET(oldset);
1861 	SIGEMPTYSET(newset);
1862 	crit_enter();
1863 	if (wait)
1864 		oldset = lwp_sigpend(lp);
1865 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
1866 		while (tp->t_outq.c_cc > hiwat) {
1867 			ttstart(tp);
1868 			if (tp->t_outq.c_cc <= hiwat)
1869 				break;
1870 			if (wait)
1871 				newset = lwp_sigpend(lp);
1872 			if (!wait || SIGSETNEQ(oldset, newset)) {
1873 				crit_exit();
1874 				return (0);
1875 			}
1876 			SET(tp->t_state, TS_SO_OLOWAT);
1877 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
1878 		}
1879 	}
1880 	crit_exit();
1881 	return (1);
1882 }
1883 
1884 /*
1885  * Process a write call on a tty device.
1886  */
1887 int
1888 ttwrite(struct tty *tp, struct uio *uio, int flag)
1889 {
1890 	char *cp = NULL;
1891 	int cc, ce;
1892 	struct proc *pp;
1893 	struct lwp *lp;
1894 	int i, hiwat, error;
1895 	size_t cnt;
1896 
1897 	char obuf[OBUFSIZ];
1898 
1899 	lp = curthread->td_lwp;
1900 	hiwat = tp->t_ohiwat;
1901 	cnt = uio->uio_resid;
1902 	error = 0;
1903 	cc = 0;
1904 loop:
1905 	crit_enter();
1906 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1907 		crit_exit();
1908 		if (uio->uio_resid == cnt)
1909 			error = EIO;
1910 		goto out;
1911 	}
1912 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
1913 		if (flag & IO_NDELAY) {
1914 			crit_exit();
1915 			error = EWOULDBLOCK;
1916 			goto out;
1917 		}
1918 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
1919 		crit_exit();
1920 		if (error)
1921 			goto out;
1922 		goto loop;
1923 	}
1924 	crit_exit();
1925 
1926 	/*
1927 	 * Hang the process if it's in the background.
1928 	 */
1929 	if ((pp = curproc) && isbackground(pp, tp) &&
1930 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
1931 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
1932 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
1933 		if (pp->p_pgrp->pg_jobc == 0) {
1934 			error = EIO;
1935 			goto out;
1936 		}
1937 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
1938 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
1939 		if (error)
1940 			goto out;
1941 		goto loop;
1942 	}
1943 	/*
1944 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1945 	 * output translation.  Keep track of high water mark, sleep on
1946 	 * overflow awaiting device aid in acquiring new space.
1947 	 */
1948 	while (uio->uio_resid > 0 || cc > 0) {
1949 		if (ISSET(tp->t_lflag, FLUSHO)) {
1950 			uio->uio_resid = 0;
1951 			return (0);
1952 		}
1953 		if (tp->t_outq.c_cc > hiwat)
1954 			goto ovhiwat;
1955 		/*
1956 		 * Grab a hunk of data from the user, unless we have some
1957 		 * leftover from last time.
1958 		 */
1959 		if (cc == 0) {
1960 			cc = szmin(uio->uio_resid, OBUFSIZ);
1961 			cp = obuf;
1962 			error = uiomove(cp, (size_t)cc, uio);
1963 			if (error) {
1964 				cc = 0;
1965 				break;
1966 			}
1967 		}
1968 		/*
1969 		 * If nothing fancy need be done, grab those characters we
1970 		 * can handle without any of ttyoutput's processing and
1971 		 * just transfer them to the output q.  For those chars
1972 		 * which require special processing (as indicated by the
1973 		 * bits in char_type), call ttyoutput.  After processing
1974 		 * a hunk of data, look for FLUSHO so ^O's will take effect
1975 		 * immediately.
1976 		 */
1977 		while (cc > 0) {
1978 			if (!ISSET(tp->t_oflag, OPOST))
1979 				ce = cc;
1980 			else {
1981 				ce = cc - scanc((u_int)cc, (u_char *)cp,
1982 						char_type, CCLASSMASK);
1983 				/*
1984 				 * If ce is zero, then we're processing
1985 				 * a special character through ttyoutput.
1986 				 */
1987 				if (ce == 0) {
1988 					tp->t_rocount = 0;
1989 					if (ttyoutput(*cp, tp) >= 0) {
1990 						/* No Clists, wait a bit. */
1991 						ttstart(tp);
1992 						if (flag & IO_NDELAY) {
1993 							error = EWOULDBLOCK;
1994 							goto out;
1995 						}
1996 						error = ttysleep(tp, &lbolt,
1997 								 PCATCH,
1998 								 "ttybf1", 0);
1999 						if (error)
2000 							goto out;
2001 						goto loop;
2002 					}
2003 					cp++;
2004 					cc--;
2005 					if (ISSET(tp->t_lflag, FLUSHO) ||
2006 					    tp->t_outq.c_cc > hiwat)
2007 						goto ovhiwat;
2008 					continue;
2009 				}
2010 			}
2011 			/*
2012 			 * A bunch of normal characters have been found.
2013 			 * Transfer them en masse to the output queue and
2014 			 * continue processing at the top of the loop.
2015 			 * If there are any further characters in this
2016 			 * <= OBUFSIZ chunk, the first should be a character
2017 			 * requiring special handling by ttyoutput.
2018 			 */
2019 			tp->t_rocount = 0;
2020 			i = b_to_q(cp, ce, &tp->t_outq);
2021 			ce -= i;
2022 			tp->t_column += ce;
2023 			cp += ce, cc -= ce, tk_nout += ce;
2024 			tp->t_outcc += ce;
2025 			if (i > 0) {
2026 				/* No Clists, wait a bit. */
2027 				ttstart(tp);
2028 				if (flag & IO_NDELAY) {
2029 					error = EWOULDBLOCK;
2030 					goto out;
2031 				}
2032 				error = ttysleep(tp, &lbolt, PCATCH,
2033 						 "ttybf2", 0);
2034 				if (error)
2035 					goto out;
2036 				goto loop;
2037 			}
2038 			if (ISSET(tp->t_lflag, FLUSHO) ||
2039 			    tp->t_outq.c_cc > hiwat)
2040 				break;
2041 		}
2042 		ttstart(tp);
2043 	}
2044 out:
2045 	/*
2046 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2047 	 * offset and iov pointers have moved forward, but it doesn't matter
2048 	 * (the call will either return short or restart with a new uio).
2049 	 */
2050 	uio->uio_resid += cc;
2051 	return (error);
2052 
2053 ovhiwat:
2054 	ttstart(tp);
2055 	crit_enter();
2056 	/*
2057 	 * This can only occur if FLUSHO is set in t_lflag,
2058 	 * or if ttstart/oproc is synchronous (or very fast).
2059 	 */
2060 	if (tp->t_outq.c_cc <= hiwat) {
2061 		crit_exit();
2062 		goto loop;
2063 	}
2064 	if (flag & IO_NDELAY) {
2065 		crit_exit();
2066 		uio->uio_resid += cc;
2067 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2068 	}
2069 	SET(tp->t_state, TS_SO_OLOWAT);
2070 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2071 	crit_exit();
2072 	if (error == EWOULDBLOCK)
2073 		error = EIO;
2074 	if (error)
2075 		goto out;
2076 	goto loop;
2077 }
2078 
2079 /*
2080  * Rubout one character from the rawq of tp
2081  * as cleanly as possible.
2082  */
2083 static void
2084 ttyrub(int c, struct tty *tp)
2085 {
2086 	char *cp;
2087 	int savecol;
2088 	int tabc;
2089 
2090 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2091 		return;
2092 	CLR(tp->t_lflag, FLUSHO);
2093 	if (ISSET(tp->t_lflag, ECHOE)) {
2094 		if (tp->t_rocount == 0) {
2095 			/*
2096 			 * Screwed by ttwrite; retype
2097 			 */
2098 			ttyretype(tp);
2099 			return;
2100 		}
2101 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2102 			ttyrubo(tp, 2);
2103 		else {
2104 			CLR(c, ~TTY_CHARMASK);
2105 			switch (CCLASS(c)) {
2106 			case ORDINARY:
2107 				ttyrubo(tp, 1);
2108 				break;
2109 			case BACKSPACE:
2110 			case CONTROL:
2111 			case NEWLINE:
2112 			case RETURN:
2113 			case VTAB:
2114 				if (ISSET(tp->t_lflag, ECHOCTL))
2115 					ttyrubo(tp, 2);
2116 				break;
2117 			case TAB:
2118 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2119 					ttyretype(tp);
2120 					return;
2121 				}
2122 				crit_enter();
2123 				savecol = tp->t_column;
2124 				SET(tp->t_state, TS_CNTTB);
2125 				SET(tp->t_lflag, FLUSHO);
2126 				tp->t_column = tp->t_rocol;
2127 				cp = tp->t_rawq.c_cf;
2128 				if (cp)
2129 					tabc = *cp;	/* XXX FIX NEXTC */
2130 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2131 					ttyecho(tabc, tp);
2132 				CLR(tp->t_lflag, FLUSHO);
2133 				CLR(tp->t_state, TS_CNTTB);
2134 				crit_exit();
2135 
2136 				/* savecol will now be length of the tab. */
2137 				savecol -= tp->t_column;
2138 				tp->t_column += savecol;
2139 				if (savecol > 8)
2140 					savecol = 8;	/* overflow screw */
2141 				while (--savecol >= 0)
2142 					(void)ttyoutput('\b', tp);
2143 				break;
2144 			default:			/* XXX */
2145 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2146 				(void)kprintf(PANICSTR, c, CCLASS(c));
2147 #ifdef notdef
2148 				panic(PANICSTR, c, CCLASS(c));
2149 #endif
2150 			}
2151 		}
2152 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2153 		if (!ISSET(tp->t_state, TS_ERASE)) {
2154 			SET(tp->t_state, TS_ERASE);
2155 			(void)ttyoutput('\\', tp);
2156 		}
2157 		ttyecho(c, tp);
2158 	} else {
2159 		ttyecho(tp->t_cc[VERASE], tp);
2160 		/*
2161 		 * This code may be executed not only when an ERASE key
2162 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2163 		 * So, I didn't think it was worthwhile to pass the extra
2164 		 * information (which would need an extra parameter,
2165 		 * changing every call) needed to distinguish the ERASE2
2166 		 * case from the ERASE.
2167 		 */
2168 	}
2169 	--tp->t_rocount;
2170 }
2171 
2172 /*
2173  * Back over cnt characters, erasing them.
2174  */
2175 static void
2176 ttyrubo(struct tty *tp, int cnt)
2177 {
2178 
2179 	while (cnt-- > 0) {
2180 		(void)ttyoutput('\b', tp);
2181 		(void)ttyoutput(' ', tp);
2182 		(void)ttyoutput('\b', tp);
2183 	}
2184 }
2185 
2186 /*
2187  * ttyretype --
2188  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2189  *	been checked.
2190  */
2191 static void
2192 ttyretype(struct tty *tp)
2193 {
2194 	char *cp;
2195 	int c;
2196 
2197 	/* Echo the reprint character. */
2198 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2199 		ttyecho(tp->t_cc[VREPRINT], tp);
2200 
2201 	(void)ttyoutput('\n', tp);
2202 
2203 	/*
2204 	 * XXX
2205 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2206 	 * BIT OF FIRST CHAR.
2207 	 */
2208 	crit_enter();
2209 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2210 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2211 		ttyecho(c, tp);
2212 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2213 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2214 		ttyecho(c, tp);
2215 	CLR(tp->t_state, TS_ERASE);
2216 	crit_exit();
2217 
2218 	tp->t_rocount = tp->t_rawq.c_cc;
2219 	tp->t_rocol = 0;
2220 }
2221 
2222 /*
2223  * Echo a typed character to the terminal.
2224  */
2225 static void
2226 ttyecho(int c, struct tty *tp)
2227 {
2228 
2229 	if (!ISSET(tp->t_state, TS_CNTTB))
2230 		CLR(tp->t_lflag, FLUSHO);
2231 	if ((!ISSET(tp->t_lflag, ECHO) &&
2232 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2233 	    ISSET(tp->t_lflag, EXTPROC))
2234 		return;
2235 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2236 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2237 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2238 		(void)ttyoutput('^', tp);
2239 		CLR(c, ~TTY_CHARMASK);
2240 		if (c == 0177)
2241 			c = '?';
2242 		else
2243 			c += 'A' - 1;
2244 	}
2245 	(void)ttyoutput(c, tp);
2246 }
2247 
2248 /*
2249  * Wake up any readers on a tty.
2250  */
2251 void
2252 ttwakeup(struct tty *tp)
2253 {
2254 
2255 	if (tp->t_rsel.si_pid != 0)
2256 		selwakeup(&tp->t_rsel);
2257 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2258 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2259 	wakeup(TSA_HUP_OR_INPUT(tp));
2260 	KNOTE(&tp->t_rsel.si_note, 0);
2261 }
2262 
2263 /*
2264  * Wake up any writers on a tty.
2265  */
2266 void
2267 ttwwakeup(struct tty *tp)
2268 {
2269 
2270 	if (tp->t_wsel.si_pid != 0 && tp->t_outq.c_cc <= tp->t_olowat)
2271 		selwakeup(&tp->t_wsel);
2272 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2273 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2274 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2275 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2276 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2277 		wakeup(TSA_OCOMPLETE(tp));
2278 	}
2279 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2280 	    tp->t_outq.c_cc <= tp->t_olowat) {
2281 		CLR(tp->t_state, TS_SO_OLOWAT);
2282 		wakeup(TSA_OLOWAT(tp));
2283 	}
2284 	KNOTE(&tp->t_wsel.si_note, 0);
2285 }
2286 
2287 /*
2288  * Look up a code for a specified speed in a conversion table;
2289  * used by drivers to map software speed values to hardware parameters.
2290  */
2291 int
2292 ttspeedtab(int speed, struct speedtab *table)
2293 {
2294 
2295 	for ( ; table->sp_speed != -1; table++)
2296 		if (table->sp_speed == speed)
2297 			return (table->sp_code);
2298 	return (-1);
2299 }
2300 
2301 /*
2302  * Set input and output watermarks and buffer sizes.  For input, the
2303  * high watermark is about one second's worth of input above empty, the
2304  * low watermark is slightly below high water, and the buffer size is a
2305  * driver-dependent amount above high water.  For output, the watermarks
2306  * are near the ends of the buffer, with about 1 second's worth of input
2307  * between them.  All this only applies to the standard line discipline.
2308  */
2309 void
2310 ttsetwater(struct tty *tp)
2311 {
2312 	int cps, ttmaxhiwat, x;
2313 
2314 	/* Input. */
2315 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2316 	switch (tp->t_ispeedwat) {
2317 	case (speed_t)-1:
2318 		cps = tp->t_ispeed / 10;
2319 		break;
2320 	case 0:
2321 		/*
2322 		 * This case is for old drivers that don't know about
2323 		 * t_ispeedwat.  Arrange for them to get the old buffer
2324 		 * sizes and watermarks.
2325 		 */
2326 		cps = TTYHOG - 2 * 256;
2327 		tp->t_ififosize = 2 * 2048;
2328 		break;
2329 	default:
2330 		cps = tp->t_ispeedwat / 10;
2331 		break;
2332 	}
2333 	tp->t_ihiwat = cps;
2334 	tp->t_ilowat = 7 * cps / 8;
2335 	x = cps + tp->t_ififosize;
2336 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2337 
2338 	/* Output. */
2339 	switch (tp->t_ospeedwat) {
2340 	case (speed_t)-1:
2341 		cps = tp->t_ospeed / 10;
2342 		ttmaxhiwat = 2 * TTMAXHIWAT;
2343 		break;
2344 	case 0:
2345 		cps = tp->t_ospeed / 10;
2346 		ttmaxhiwat = TTMAXHIWAT;
2347 		break;
2348 	default:
2349 		cps = tp->t_ospeedwat / 10;
2350 		ttmaxhiwat = 8 * TTMAXHIWAT;
2351 		break;
2352 	}
2353 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2354 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2355 	x += cps;
2356 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2357 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2358 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2359 	x += OBUFSIZ + 100;
2360 	clist_alloc_cblocks(&tp->t_outq, x, x);
2361 #undef	CLAMP
2362 }
2363 
2364 /*
2365  * Report on state of foreground process group.
2366  */
2367 void
2368 ttyinfo(struct tty *tp)
2369 {
2370 	struct proc *p, *pick;
2371 	struct lwp *lp;
2372 	struct rusage ru;
2373 	int tmp;
2374 
2375 	if (ttycheckoutq(tp,0) == 0)
2376 		return;
2377 
2378 	/*
2379 	 * We always print the load average, then figure out what else to
2380 	 * print based on the state of the current process group.
2381 	 */
2382 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2383 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2384 
2385 	if (tp->t_session == NULL) {
2386 		ttyprintf(tp, "not a controlling terminal\n");
2387 	} else if (tp->t_pgrp == NULL) {
2388 		ttyprintf(tp, "no foreground process group\n");
2389 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == 0) {
2390 		ttyprintf(tp, "empty foreground process group\n");
2391 	} else {
2392 		/*
2393 		 * Pick an interesting process.  Note that certain elements,
2394 		 * in particular the wmesg, require a critical section for
2395 		 * safe access (YYY and we are still not MP safe).
2396 		 *
2397 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2398 		 */
2399 		char buf[64];
2400 		const char *str;
2401 		long vmsz;
2402 		int pctcpu;
2403 
2404 		crit_enter();
2405 
2406 		/* XXX lwp should compare lwps */
2407 
2408 		for (pick = NULL; p != 0; p = LIST_NEXT(p, p_pglist)) {
2409 			if (proc_compare(pick, p))
2410 				pick = p;
2411 		}
2412 
2413 		/* XXX lwp */
2414 		lp = FIRST_LWP_IN_PROC(pick);
2415 		if (lp == NULL) {
2416 			ttyprintf(tp, "foreground process without lwp\n");
2417 			tp->t_rocount = 0;
2418 			crit_exit();
2419 			return;
2420 		}
2421 
2422 		/*
2423 		 * Figure out what wait/process-state message, and command
2424 		 * buffer to present
2425 		 */
2426 		/*
2427 		 * XXX lwp This is a horrible mixture.  We need to rework this
2428 		 * as soon as lwps have their own runnable status.
2429 		 */
2430 		if (pick->p_flag & P_WEXIT)
2431 			str = "exiting";
2432 		else if (lp->lwp_stat == LSRUN)
2433 			str = "running";
2434 		else if (pick->p_stat == SIDL)
2435 			str = "spawning";
2436 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2437 			str = lp->lwp_wmesg;
2438 		else
2439 			str = "iowait";
2440 
2441 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2442 			pick->p_comm, pick->p_pid, str);
2443 
2444 		/*
2445 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2446 		 * 'pick' becomes invalid the moment we exit the critical
2447 		 * section.
2448 		 */
2449 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0)
2450 			calcru_proc(pick, &ru);
2451 
2452 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2453 
2454 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2455 		    vmsz = 0;
2456 		else
2457 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2458 
2459 		crit_exit();
2460 
2461 		/*
2462 		 * Dump the output
2463 		 */
2464 		ttyprintf(tp, " %s ", buf);
2465 		ttyprintf(tp, "%ld.%02ldu ",
2466 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2467 		ttyprintf(tp, "%ld.%02lds ",
2468 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2469 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2470 	}
2471 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2472 }
2473 
2474 /*
2475  * Returns 1 if p2 is "better" than p1
2476  *
2477  * The algorithm for picking the "interesting" process is thus:
2478  *
2479  *	1) Only foreground processes are eligible - implied.
2480  *	2) Runnable processes are favored over anything else.  The runner
2481  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2482  *	   broken by picking the highest pid.
2483  *	3) The sleeper with the shortest sleep time is next.  With ties,
2484  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2485  *	4) Further ties are broken by picking the highest pid.
2486  */
2487 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2488 #define TESTAB(a, b)    ((a)<<1 | (b))
2489 #define ONLYA   2
2490 #define ONLYB   1
2491 #define BOTH    3
2492 
2493 static int
2494 proc_compare(struct proc *p1, struct proc *p2)
2495 {
2496 	struct lwp *lp1, *lp2;
2497 	if (p1 == NULL)
2498 		return (1);
2499 
2500 	/*
2501  	 * weed out zombies
2502 	 */
2503 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2504 	case ONLYA:
2505 		return (1);
2506 	case ONLYB:
2507 		return (0);
2508 	case BOTH:
2509 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2510 	}
2511 
2512 	/* XXX lwp */
2513 	lp1 = FIRST_LWP_IN_PROC(p1);
2514 	lp2 = FIRST_LWP_IN_PROC(p2);
2515 
2516 	/*
2517 	 * see if at least one of them is runnable
2518 	 */
2519 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2520 	case ONLYA:
2521 		return (0);
2522 	case ONLYB:
2523 		return (1);
2524 	case BOTH:
2525 		/*
2526 		 * tie - favor one with highest recent cpu utilization
2527 		 */
2528 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2529 			return (1);
2530 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2531 			return (0);
2532 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2533 	}
2534 	/*
2535 	 * pick the one with the smallest sleep time
2536 	 */
2537 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2538 		return (0);
2539 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2540 		return (1);
2541 	/*
2542 	 * favor one sleeping in a non-interruptible sleep
2543 	 */
2544 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2545 		return (1);
2546 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2547 		return (0);
2548 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2549 }
2550 
2551 /*
2552  * Output char to tty; console putchar style.
2553  */
2554 int
2555 tputchar(int c, struct tty *tp)
2556 {
2557 	crit_enter();
2558 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2559 		crit_exit();
2560 		return (-1);
2561 	}
2562 	if (c == '\n')
2563 		(void)ttyoutput('\r', tp);
2564 	(void)ttyoutput(c, tp);
2565 	ttstart(tp);
2566 	crit_exit();
2567 	return (0);
2568 }
2569 
2570 /*
2571  * Sleep on chan, returning ERESTART if tty changed while we napped and
2572  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2573  * the tty is revoked, restarting a pending call will redo validation done
2574  * at the start of the call.
2575  */
2576 int
2577 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2578 {
2579 	int error;
2580 	int gen;
2581 
2582 	gen = tp->t_gen;
2583 	error = tsleep(chan, slpflags, wmesg, timo);
2584 	if (error)
2585 		return (error);
2586 	return (tp->t_gen == gen ? 0 : ERESTART);
2587 }
2588 
2589 /*
2590  * Revoke a tty.
2591  *
2592  * We bump the gen to force any ttysleep()'s to return with ERESTART
2593  * and flush the tty.  The related fp's should already have been
2594  * replaced so the tty will close when the last references on the
2595  * original fp's go away.
2596  */
2597 int
2598 ttyrevoke(struct dev_revoke_args *ap)
2599 {
2600 	struct tty *tp;
2601 
2602 	tp = ap->a_head.a_dev->si_tty;
2603 	tp->t_gen++;
2604 	ttyflush(tp, FREAD | FWRITE);
2605 	wakeup(TSA_CARR_ON(tp));
2606 	ttwakeup(tp);
2607 	ttwwakeup(tp);
2608 	return (0);
2609 }
2610 
2611 /*
2612  * Allocate a tty struct.  Clists in the struct will be allocated by
2613  * ttyopen().
2614  */
2615 struct tty *
2616 ttymalloc(struct tty *tp)
2617 {
2618 
2619 	if (tp) {
2620 		return(tp);
2621 	}
2622 	tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2623 	ttyregister(tp);
2624         return (tp);
2625 }
2626 
2627 #if 0
2628 /*
2629  * Free a tty struct.  Clists in the struct should have been freed by
2630  * ttyclose().
2631  *
2632  * XXX not yet usable: since we support a half-closed state and do not
2633  * ref count the tty reference from the session, it is possible for a
2634  * session to hold a ref on the tty.  See TTY_DO_FULL_CLOSE.
2635  */
2636 void
2637 ttyfree(struct tty *tp)
2638 {
2639         kfree(tp, M_TTYS);
2640 }
2641 #endif /* 0 */
2642 
2643 void
2644 ttyregister(struct tty *tp)
2645 {
2646 	SLIST_INSERT_HEAD(&tty_list, tp, t_list);
2647 }
2648 
2649 static int
2650 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2651 {
2652 	int error;
2653 	struct tty *tp, t;
2654 	SLIST_FOREACH(tp, &tty_list, t_list) {
2655 		t = *tp;
2656 		if (t.t_dev)
2657 			t.t_dev = (cdev_t)(uintptr_t)dev2udev(t.t_dev);
2658 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2659 		if (error)
2660 			return (error);
2661 	}
2662 	return (0);
2663 }
2664 
2665 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2666 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2667 
2668 void
2669 nottystop(struct tty *tp, int rw)
2670 {
2671 
2672 	return;
2673 }
2674 
2675 int
2676 ttyread(struct dev_read_args *ap)
2677 {
2678 	struct tty *tp;
2679 
2680 	tp = ap->a_head.a_dev->si_tty;
2681 	if (tp == NULL)
2682 		return (ENODEV);
2683 	return ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2684 }
2685 
2686 int
2687 ttywrite(struct dev_write_args *ap)
2688 {
2689 	struct tty *tp;
2690 
2691 	tp = ap->a_head.a_dev->si_tty;
2692 	if (tp == NULL)
2693 		return (ENODEV);
2694 	return ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2695 }
2696