xref: /netbsd-src/sys/kern/tty.c (revision deb6f0161a9109e7de9b519dc8dfb9478668dcdd)
1 /*	$NetBSD: tty.c,v 1.277 2018/09/03 16:29:35 riastradh Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 1982, 1986, 1990, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63  */
64 
65 #include <sys/cdefs.h>
66 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.277 2018/09/03 16:29:35 riastradh Exp $");
67 
68 #ifdef _KERNEL_OPT
69 #include "opt_compat_netbsd.h"
70 #endif
71 
72 #define TTY_ALLOW_PRIVATE
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/ioctl.h>
77 #include <sys/proc.h>
78 #define	TTYDEFCHARS
79 #include <sys/tty.h>
80 #undef	TTYDEFCHARS
81 #include <sys/file.h>
82 #include <sys/conf.h>
83 #include <sys/cpu.h>
84 #include <sys/dkstat.h>
85 #include <sys/uio.h>
86 #include <sys/kernel.h>
87 #include <sys/vnode.h>
88 #include <sys/syslog.h>
89 #include <sys/kmem.h>
90 #include <sys/signalvar.h>
91 #include <sys/resourcevar.h>
92 #include <sys/poll.h>
93 #include <sys/kprintf.h>
94 #include <sys/namei.h>
95 #include <sys/sysctl.h>
96 #include <sys/kauth.h>
97 #include <sys/intr.h>
98 #include <sys/ioctl_compat.h>
99 #include <sys/module.h>
100 #include <sys/bitops.h>
101 
102 #ifdef COMPAT_60
103 #include <compat/sys/ttycom.h>
104 #endif /* COMPAT_60 */
105 
106 static int	ttnread(struct tty *);
107 static void	ttyblock(struct tty *);
108 static void	ttyecho(int, struct tty *);
109 static void	ttyrubo(struct tty *, int);
110 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
111     __printflike(2, 3);
112 static int	proc_compare_wrapper(struct proc *, struct proc *);
113 static void	ttysigintr(void *);
114 
115 /* Symbolic sleep message strings. */
116 const char	ttclos[] = "ttycls";
117 const char	ttopen[] = "ttyopn";
118 const char	ttybg[] = "ttybg";
119 const char	ttyin[] = "ttyin";
120 const char	ttyout[] = "ttyout";
121 
122 /*
123  * Used to determine whether we still have a connection.  This is true in
124  * one of 3 cases:
125  * 1) We have carrier.
126  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
127  * 3) We're using a flow control mechanism that overloads the carrier signal.
128  */
129 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
130 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
131 
132 /*
133  * Table with character classes and parity. The 8th bit indicates parity,
134  * the 7th bit indicates the character is an alphameric or underscore (for
135  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
136  * are 0 then the character needs no special processing on output; classes
137  * other than 0 might be translated or (not currently) require delays.
138  */
139 #define	E	0x00	/* Even parity. */
140 #define	O	0x80	/* Odd parity. */
141 #define	PARITY(c)	(char_type[c] & O)
142 
143 #define	ALPHA	0x40	/* Alpha or underscore. */
144 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
145 
146 #define	CCLASSMASK	0x3f
147 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
148 
149 #define	BS	BACKSPACE
150 #define	CC	CONTROL
151 #define	CR	RETURN
152 #define	NA	ORDINARY | ALPHA
153 #define	NL	NEWLINE
154 #define	NO	ORDINARY
155 #define	TB	TAB
156 #define	VT	VTAB
157 
158 unsigned char const char_type[] = {
159 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
160 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
161 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
162 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
163 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
164 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
165 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
166 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
167 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
168 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
169 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
170 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
171 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
172 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
173 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
174 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
175 	/*
176 	 * Meta chars; should be settable per character set;
177 	 * for now, treat them all as normal characters.
178 	 */
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
186 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
187 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
188 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
189 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
190 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
191 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
192 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
193 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
194 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
195 };
196 #undef	BS
197 #undef	CC
198 #undef	CR
199 #undef	NA
200 #undef	NL
201 #undef	NO
202 #undef	TB
203 #undef	VT
204 
205 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
206 static void *tty_sigsih;
207 
208 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
209 int tty_count;
210 kmutex_t tty_lock;
211 krwlock_t ttcompat_lock;
212 int (*ttcompatvec)(struct tty *, u_long, void *, int, struct lwp *);
213 
214 uint64_t tk_cancc;
215 uint64_t tk_nin;
216 uint64_t tk_nout;
217 uint64_t tk_rawcc;
218 
219 static kauth_listener_t tty_listener;
220 
221 #define	TTY_MINQSIZE	0x00400
222 #define	TTY_MAXQSIZE	0x10000
223 int tty_qsize = TTY_MINQSIZE;
224 
225 static int
226 tty_get_qsize(int *qsize, int newsize)
227 {
228 	newsize = 1 << ilog2(newsize);	/* Make it a power of two */
229 
230 	if (newsize < TTY_MINQSIZE || newsize > TTY_MAXQSIZE)
231 		return EINVAL;
232 
233 	*qsize = newsize;
234 	return 0;
235 }
236 
237 static int
238 tty_set_qsize(struct tty *tp, int newsize)
239 {
240 	struct clist rawq, canq, outq;
241 	struct clist orawq, ocanq, ooutq;
242 
243 	clalloc(&rawq, newsize, 1);
244 	clalloc(&canq, newsize, 1);
245 	clalloc(&outq, newsize, 0);
246 
247 	mutex_spin_enter(&tty_lock);
248 
249 	if (tp->t_outq.c_cc != 0) {
250 		mutex_spin_exit(&tty_lock);
251 		clfree(&rawq);
252 		clfree(&canq);
253 		clfree(&outq);
254 		return EBUSY;
255 	}
256 
257 	orawq = tp->t_rawq;
258 	ocanq = tp->t_canq;
259 	ooutq = tp->t_outq;
260 
261 	tp->t_qsize = newsize;
262 	tp->t_rawq = rawq;
263 	tp->t_canq = canq;
264 	tp->t_outq = outq;
265 
266 	ttsetwater(tp);
267 
268 	mutex_spin_exit(&tty_lock);
269 
270 	clfree(&orawq);
271 	clfree(&ocanq);
272 	clfree(&ooutq);
273 
274 	return 0;
275 }
276 
277 static int
278 sysctl_kern_tty_qsize(SYSCTLFN_ARGS)
279 {
280 	int newsize;
281 	int error;
282 	struct sysctlnode node;
283 	node = *rnode;
284 	node.sysctl_data = &newsize;
285 
286 	newsize = tty_qsize;
287 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
288 	if (error || newp == NULL)
289 		return error;
290 
291 
292 	return tty_get_qsize(&tty_qsize, newsize);
293 }
294 
295 static void
296 sysctl_kern_tty_setup(void)
297 {
298 	const struct sysctlnode *rnode, *cnode;
299 	struct sysctllog *kern_tkstat_sysctllog, *kern_tty_sysctllog;
300 
301 	kern_tkstat_sysctllog = NULL;
302 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
303 		       CTLFLAG_PERMANENT,
304 		       CTLTYPE_NODE, "tkstat",
305 		       SYSCTL_DESCR("Number of characters sent and received "
306 				    "on ttys"),
307 		       NULL, 0, NULL, 0,
308 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
309 
310 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
311 		       CTLFLAG_PERMANENT,
312 		       CTLTYPE_QUAD, "nin",
313 		       SYSCTL_DESCR("Total number of tty input characters"),
314 		       NULL, 0, &tk_nin, 0,
315 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
316 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
317 		       CTLFLAG_PERMANENT,
318 		       CTLTYPE_QUAD, "nout",
319 		       SYSCTL_DESCR("Total number of tty output characters"),
320 		       NULL, 0, &tk_nout, 0,
321 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
322 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
323 		       CTLFLAG_PERMANENT,
324 		       CTLTYPE_QUAD, "cancc",
325 		       SYSCTL_DESCR("Number of canonical tty input characters"),
326 		       NULL, 0, &tk_cancc, 0,
327 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
328 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
329 		       CTLFLAG_PERMANENT,
330 		       CTLTYPE_QUAD, "rawcc",
331 		       SYSCTL_DESCR("Number of raw tty input characters"),
332 		       NULL, 0, &tk_rawcc, 0,
333 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
334 
335 	kern_tty_sysctllog = NULL;
336 	sysctl_createv(&kern_tty_sysctllog, 0, NULL, &rnode,
337 		       CTLFLAG_PERMANENT,
338 		       CTLTYPE_NODE, "tty", NULL,
339 		       NULL, 0, NULL, 0,
340 		       CTL_KERN, CTL_CREATE, CTL_EOL);
341 	sysctl_createv(&kern_tty_sysctllog, 0, &rnode, &cnode,
342 		       CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
343 		       CTLTYPE_INT, "qsize",
344 		       SYSCTL_DESCR("TTY input and output queue size"),
345 		       sysctl_kern_tty_qsize, 0, &tty_qsize, 0,
346 		       CTL_CREATE, CTL_EOL);
347 }
348 
349 int
350 ttyopen(struct tty *tp, int dialout, int nonblock)
351 {
352 	int	error;
353 
354 	error = 0;
355 
356 	mutex_spin_enter(&tty_lock);
357 
358 	if (dialout) {
359 		/*
360 		 * If the device is already open for non-dialout, fail.
361 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
362 		 * opens.
363 		 */
364 		if (ISSET(tp->t_state, TS_ISOPEN) &&
365 		    !ISSET(tp->t_state, TS_DIALOUT)) {
366 			error = EBUSY;
367 			goto out;
368 		}
369 		SET(tp->t_state, TS_DIALOUT);
370 	} else {
371 		if (!nonblock) {
372 			/*
373 			 * Wait for carrier.  Also wait for any dialout
374 			 * processes to close the tty first.
375 			 */
376 			while (ISSET(tp->t_state, TS_DIALOUT) ||
377 			       !CONNECTED(tp)) {
378 				tp->t_wopen++;
379 				error = ttysleep(tp, &tp->t_rawcv, true, 0);
380 				tp->t_wopen--;
381 				if (error)
382 					goto out;
383 			}
384 		} else {
385 			/*
386 			 * Don't allow a non-blocking non-dialout open if the
387 			 * device is already open for dialout.
388 			 */
389 			if (ISSET(tp->t_state, TS_DIALOUT)) {
390 				error = EBUSY;
391 				goto out;
392 			}
393 		}
394 	}
395 
396 out:
397 	mutex_spin_exit(&tty_lock);
398 	return (error);
399 }
400 
401 /*
402  * Initial open of tty, or (re)entry to standard tty line discipline.
403  */
404 int
405 ttylopen(dev_t device, struct tty *tp)
406 {
407 
408 	mutex_spin_enter(&tty_lock);
409 	tp->t_dev = device;
410 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
411 		SET(tp->t_state, TS_ISOPEN);
412 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
413 		tp->t_flags = 0;
414 	}
415 	mutex_spin_exit(&tty_lock);
416 	if (tp->t_qsize != tty_qsize)
417 		tty_set_qsize(tp, tty_qsize);
418 	return (0);
419 }
420 
421 /*
422  * Handle close() on a tty line: flush and set to initial state,
423  * bumping generation number so that pending read/write calls
424  * can detect recycling of the tty.
425  */
426 int
427 ttyclose(struct tty *tp)
428 {
429 	extern struct tty *constty;	/* Temporary virtual console. */
430 	struct session *sess;
431 
432 	mutex_spin_enter(&tty_lock);
433 
434 	if (constty == tp)
435 		constty = NULL;
436 
437 	ttyflush(tp, FREAD | FWRITE);
438 
439 	tp->t_gen++;
440 	tp->t_pgrp = NULL;
441 	tp->t_state = 0;
442 	sess = tp->t_session;
443 	tp->t_session = NULL;
444 
445 	mutex_spin_exit(&tty_lock);
446 
447 	if (sess != NULL) {
448 		mutex_enter(proc_lock);
449 		/* Releases proc_lock. */
450 		proc_sessrele(sess);
451 	}
452 	return (0);
453 }
454 
455 #define	FLUSHQ(q) {							\
456 	if ((q)->c_cc)							\
457 		ndflush(q, (q)->c_cc);					\
458 }
459 
460 /*
461  * This macro is used in canonical mode input processing, where a read
462  * request shall not return unless a 'line delimiter' ('\n') or 'break'
463  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
464  * is an extension to the POSIX.1 defined set of special characters,
465  * recognize it only if IEXTEN is set in the set of local flags.
466  */
467 #define	TTBREAKC(c, lflg)						\
468 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
469 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
470 
471 
472 
473 /*
474  * ttyinput() helper.
475  * Call with the tty lock held.
476  */
477 /* XXX static */ int
478 ttyinput_wlock(int c, struct tty *tp)
479 {
480 	int	iflag, lflag, i, error;
481 	u_char	*cc;
482 
483 	KASSERT(mutex_owned(&tty_lock));
484 
485 	/*
486 	 * If input is pending take it first.
487 	 */
488 	lflag = tp->t_lflag;
489 	if (ISSET(lflag, PENDIN))
490 		ttypend(tp);
491 	/*
492 	 * Gather stats.
493 	 */
494 	if (ISSET(lflag, ICANON)) {
495 		++tk_cancc;
496 		++tp->t_cancc;
497 	} else {
498 		++tk_rawcc;
499 		++tp->t_rawcc;
500 	}
501 	++tk_nin;
502 
503 	cc = tp->t_cc;
504 
505 	/*
506 	 * Handle exceptional conditions (break, parity, framing).
507 	 */
508 	iflag = tp->t_iflag;
509 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
510 		CLR(c, TTY_ERRORMASK);
511 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
512 			if (ISSET(iflag, IGNBRK))
513 				return (0);
514 			else if (ISSET(iflag, BRKINT)) {
515 				ttyflush(tp, FREAD | FWRITE);
516 				ttysig(tp, TTYSIG_PG1, SIGINT);
517 				return (0);
518 			} else if (ISSET(iflag, PARMRK))
519 				goto parmrk;
520 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
521 		    ISSET(error, TTY_FE)) {
522 			if (ISSET(iflag, IGNPAR))
523 				return (0);
524 			else if (ISSET(iflag, PARMRK)) {
525  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
526 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
527 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
528 				return (0);
529 			} else
530 				c = 0;
531 		}
532 	} else if (c == 0377 &&
533 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
534 		/* "Escape" a valid character of '\377'. */
535 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
536 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
537 		goto endcase;
538 	}
539 
540 	/*
541 	 * In tandem mode, check high water mark.
542 	 */
543 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
544 		ttyblock(tp);
545 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
546 		CLR(c, 0x80);
547 	if (!ISSET(lflag, EXTPROC)) {
548 		/*
549 		 * Check for literal nexting very first
550 		 */
551 		if (ISSET(tp->t_state, TS_LNCH)) {
552 			SET(c, TTY_QUOTE);
553 			CLR(tp->t_state, TS_LNCH);
554 		}
555 		/*
556 		 * Scan for special characters.  This code
557 		 * is really just a big case statement with
558 		 * non-constant cases.  The bottom of the
559 		 * case statement is labeled ``endcase'', so goto
560 		 * it after a case match, or similar.
561 		 */
562 
563 		/*
564 		 * Control chars which aren't controlled
565 		 * by ICANON, ISIG, or IXON.
566 		 */
567 		if (ISSET(lflag, IEXTEN)) {
568 			if (CCEQ(cc[VLNEXT], c)) {
569 				if (ISSET(lflag, ECHO)) {
570 					if (ISSET(lflag, ECHOE)) {
571 						(void)ttyoutput('^', tp);
572 						(void)ttyoutput('\b', tp);
573 					} else
574 						ttyecho(c, tp);
575 				}
576 				SET(tp->t_state, TS_LNCH);
577 				goto endcase;
578 			}
579 			if (CCEQ(cc[VDISCARD], c)) {
580 				if (ISSET(lflag, FLUSHO))
581 					CLR(tp->t_lflag, FLUSHO);
582 				else {
583 					ttyflush(tp, FWRITE);
584 					ttyecho(c, tp);
585 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
586 						ttyretype(tp);
587 					SET(tp->t_lflag, FLUSHO);
588 				}
589 				goto startoutput;
590 			}
591 		}
592 		/*
593 		 * Signals.
594 		 */
595 		if (ISSET(lflag, ISIG)) {
596 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
597 				if (!ISSET(lflag, NOFLSH))
598 					ttyflush(tp, FREAD | FWRITE);
599 				ttyecho(c, tp);
600 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
601 				    SIGINT : SIGQUIT);
602 				goto endcase;
603 			}
604 			if (CCEQ(cc[VSUSP], c)) {
605 				if (!ISSET(lflag, NOFLSH))
606 					ttyflush(tp, FREAD);
607 				ttyecho(c, tp);
608 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
609 				goto endcase;
610 			}
611 		}
612 		/*
613 		 * Handle start/stop characters.
614 		 */
615 		if (ISSET(iflag, IXON)) {
616 			if (CCEQ(cc[VSTOP], c)) {
617 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
618 					SET(tp->t_state, TS_TTSTOP);
619 					cdev_stop(tp, 0);
620 					return (0);
621 				}
622 				if (!CCEQ(cc[VSTART], c))
623 					return (0);
624 				/*
625 				 * if VSTART == VSTOP then toggle
626 				 */
627 				goto endcase;
628 			}
629 			if (CCEQ(cc[VSTART], c))
630 				goto restartoutput;
631 		}
632 		/*
633 		 * IGNCR, ICRNL, & INLCR
634 		 */
635 		if (c == '\r') {
636 			if (ISSET(iflag, IGNCR))
637 				goto endcase;
638 			else if (ISSET(iflag, ICRNL))
639 				c = '\n';
640 		} else if (c == '\n' && ISSET(iflag, INLCR))
641 			c = '\r';
642 	}
643 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
644 		/*
645 		 * From here on down canonical mode character
646 		 * processing takes place.
647 		 */
648 		/*
649 		 * erase (^H / ^?)
650 		 */
651 		if (CCEQ(cc[VERASE], c)) {
652 			if (tp->t_rawq.c_cc)
653 				ttyrub(unputc(&tp->t_rawq), tp);
654 			goto endcase;
655 		}
656 		/*
657 		 * kill (^U)
658 		 */
659 		if (CCEQ(cc[VKILL], c)) {
660 			if (ISSET(lflag, ECHOKE) &&
661 			    tp->t_rawq.c_cc == tp->t_rocount &&
662 			    !ISSET(lflag, ECHOPRT))
663 				while (tp->t_rawq.c_cc)
664 					ttyrub(unputc(&tp->t_rawq), tp);
665 			else {
666 				ttyecho(c, tp);
667 				if (ISSET(lflag, ECHOK) ||
668 				    ISSET(lflag, ECHOKE))
669 					ttyecho('\n', tp);
670 				FLUSHQ(&tp->t_rawq);
671 				tp->t_rocount = 0;
672 			}
673 			CLR(tp->t_state, TS_LOCAL);
674 			goto endcase;
675 		}
676 		/*
677 		 * Extensions to the POSIX.1 GTI set of functions.
678 		 */
679 		if (ISSET(lflag, IEXTEN)) {
680 			/*
681 			 * word erase (^W)
682 			 */
683 			if (CCEQ(cc[VWERASE], c)) {
684 				int alt = ISSET(lflag, ALTWERASE);
685 				int ctype;
686 
687 				/*
688 				 * erase whitespace
689 				 */
690 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
691 				    c == '\t')
692 					ttyrub(c, tp);
693 				if (c == -1)
694 					goto endcase;
695 				/*
696 				 * erase last char of word and remember the
697 				 * next chars type (for ALTWERASE)
698 				 */
699 				ttyrub(c, tp);
700 				c = unputc(&tp->t_rawq);
701 				if (c == -1)
702 					goto endcase;
703 				if (c == ' ' || c == '\t') {
704 					(void)putc(c, &tp->t_rawq);
705 					goto endcase;
706 				}
707 				ctype = ISALPHA(c);
708 				/*
709 				 * erase rest of word
710 				 */
711 				do {
712 					ttyrub(c, tp);
713 					c = unputc(&tp->t_rawq);
714 					if (c == -1)
715 						goto endcase;
716 				} while (c != ' ' && c != '\t' &&
717 				    (alt == 0 || ISALPHA(c) == ctype));
718 				(void)putc(c, &tp->t_rawq);
719 				goto endcase;
720 			}
721 			/*
722 			 * reprint line (^R)
723 			 */
724 			if (CCEQ(cc[VREPRINT], c)) {
725 				ttyretype(tp);
726 				goto endcase;
727 			}
728 			/*
729 			 * ^T - kernel info and generate SIGINFO
730 			 */
731 			if (CCEQ(cc[VSTATUS], c)) {
732 				ttysig(tp, TTYSIG_PG1, SIGINFO);
733 				goto endcase;
734 			}
735 		}
736 	}
737 	/*
738 	 * Check for input buffer overflow
739 	 */
740 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
741 		if (ISSET(iflag, IMAXBEL)) {
742 			if (tp->t_outq.c_cc < tp->t_hiwat)
743 				(void)ttyoutput(CTRL('g'), tp);
744 		} else
745 			ttyflush(tp, FREAD | FWRITE);
746 		goto endcase;
747 	}
748 	/*
749 	 * Put data char in q for user and
750 	 * wakeup on seeing a line delimiter.
751 	 */
752 	if (putc(c, &tp->t_rawq) >= 0) {
753 		if (!ISSET(lflag, ICANON)) {
754 			ttwakeup(tp);
755 			ttyecho(c, tp);
756 			goto endcase;
757 		}
758 		if (TTBREAKC(c, lflag)) {
759 			tp->t_rocount = 0;
760 			catq(&tp->t_rawq, &tp->t_canq);
761 			ttwakeup(tp);
762 		} else if (tp->t_rocount++ == 0)
763 			tp->t_rocol = tp->t_column;
764 		if (ISSET(tp->t_state, TS_ERASE)) {
765 			/*
766 			 * end of prterase \.../
767 			 */
768 			CLR(tp->t_state, TS_ERASE);
769 			(void)ttyoutput('/', tp);
770 		}
771 		i = tp->t_column;
772 		ttyecho(c, tp);
773 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
774 			/*
775 			 * Place the cursor over the '^' of the ^D.
776 			 */
777 			i = uimin(2, tp->t_column - i);
778 			while (i > 0) {
779 				(void)ttyoutput('\b', tp);
780 				i--;
781 			}
782 		}
783 	}
784  endcase:
785 	/*
786 	 * IXANY means allow any character to restart output.
787 	 */
788 	if (ISSET(tp->t_state, TS_TTSTOP) &&
789 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
790 		return (0);
791 	}
792  restartoutput:
793 	CLR(tp->t_lflag, FLUSHO);
794 	CLR(tp->t_state, TS_TTSTOP);
795  startoutput:
796 	return (ttstart(tp));
797 }
798 
799 /*
800  * Process input of a single character received on a tty.
801  *
802  * XXX - this is a hack, all drivers must changed to acquire the
803  *	 lock before calling linesw->l_rint()
804  */
805 int
806 ttyinput(int c, struct tty *tp)
807 {
808 	int error;
809 
810 	/*
811 	 * Unless the receiver is enabled, drop incoming data.
812 	 */
813 	if (!ISSET(tp->t_cflag, CREAD))
814 		return (0);
815 
816 	mutex_spin_enter(&tty_lock);
817 	error = ttyinput_wlock(c, tp);
818 	mutex_spin_exit(&tty_lock);
819 
820 	return (error);
821 }
822 
823 /*
824  * Output a single character on a tty, doing output processing
825  * as needed (expanding tabs, newline processing, etc.).
826  * Returns < 0 if succeeds, otherwise returns char to resend.
827  * Must be recursive.
828  *
829  * Call with tty lock held.
830  */
831 int
832 ttyoutput(int c, struct tty *tp)
833 {
834 	long	oflag;
835 	int	col, notout;
836 
837 	KASSERT(mutex_owned(&tty_lock));
838 
839 	oflag = tp->t_oflag;
840 	if (!ISSET(oflag, OPOST)) {
841 		tk_nout++;
842 		tp->t_outcc++;
843 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
844 			return (c);
845 		return (-1);
846 	}
847 	/*
848 	 * Do tab expansion if OXTABS is set.  Special case if we do external
849 	 * processing, we don't do the tab expansion because we'll probably
850 	 * get it wrong.  If tab expansion needs to be done, let it happen
851 	 * externally.
852 	 */
853 	CLR(c, ~TTY_CHARMASK);
854 	if (c == '\t' &&
855 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
856 		c = 8 - (tp->t_column & 7);
857 		if (ISSET(tp->t_lflag, FLUSHO)) {
858 			notout = 0;
859 		} else {
860 			notout = b_to_q("        ", c, &tp->t_outq);
861 			c -= notout;
862 			tk_nout += c;
863 			tp->t_outcc += c;
864 		}
865 		tp->t_column += c;
866 		return (notout ? '\t' : -1);
867 	}
868 	if (c == CEOT && ISSET(oflag, ONOEOT))
869 		return (-1);
870 
871 	/*
872 	 * Newline translation: if ONLCR is set,
873 	 * translate newline into "\r\n".
874 	 */
875 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
876 		tk_nout++;
877 		tp->t_outcc++;
878 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
879 			return (c);
880 	}
881 	/* If OCRNL is set, translate "\r" into "\n". */
882 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
883 		c = '\n';
884 	/* If ONOCR is set, don't transmit CRs when on column 0. */
885 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
886 		return (-1);
887 
888 	tk_nout++;
889 	tp->t_outcc++;
890 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
891 		return (c);
892 
893 	col = tp->t_column;
894 	switch (CCLASS(c)) {
895 	case BACKSPACE:
896 		if (col > 0)
897 			--col;
898 		break;
899 	case CONTROL:
900 		break;
901 	case NEWLINE:
902 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
903 			col = 0;
904 		break;
905 	case RETURN:
906 		col = 0;
907 		break;
908 	case ORDINARY:
909 		++col;
910 		break;
911 	case TAB:
912 		col = (col + 8) & ~7;
913 		break;
914 	}
915 	tp->t_column = col;
916 	return (-1);
917 }
918 
919 /*
920  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
921  * has been called to do discipline-specific functions and/or reject any
922  * of these ioctl commands.
923  */
924 /* ARGSUSED */
925 int
926 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
927 {
928 	extern struct tty *constty;	/* Temporary virtual console. */
929 	struct proc *p;
930 	struct linesw	*lp;
931 	int		s, error;
932 	struct pathbuf *pb;
933 	struct nameidata nd;
934 	char		infobuf[200];
935 
936 	KASSERT(l != NULL);
937 	p = l->l_proc;
938 
939 	/* If the ioctl involves modification, hang if in the background. */
940 	switch (cmd) {
941 	case  TIOCFLUSH:
942 	case  TIOCDRAIN:
943 	case  TIOCSBRK:
944 	case  TIOCCBRK:
945 	case  TIOCSTART:
946 	case  TIOCSETA:
947 	case  TIOCSETD:
948 	case  TIOCSLINED:
949 	case  TIOCSETAF:
950 	case  TIOCSETAW:
951 #ifdef notdef
952 	case  TIOCSPGRP:
953 	case  FIOSETOWN:
954 #endif
955 	case  TIOCSTAT:
956 	case  TIOCSTI:
957 	case  TIOCSWINSZ:
958 	case  TIOCSQSIZE:
959 	case  TIOCLBIC:
960 	case  TIOCLBIS:
961 	case  TIOCLSET:
962 	case  TIOCSETC:
963 	case OTIOCSETD:
964 	case  TIOCSETN:
965 	case  TIOCSETP:
966 	case  TIOCSLTC:
967 		mutex_spin_enter(&tty_lock);
968 		while (isbackground(curproc, tp) &&
969 		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
970 		    !sigismasked(l, SIGTTOU)) {
971 			mutex_spin_exit(&tty_lock);
972 
973 			mutex_enter(proc_lock);
974 			pgsignal(p->p_pgrp, SIGTTOU, 1);
975 			mutex_exit(proc_lock);
976 
977 			mutex_spin_enter(&tty_lock);
978 			error = ttypause(tp, hz);
979 			if (error) {
980 				mutex_spin_exit(&tty_lock);
981 				return (error);
982 			}
983 		}
984 		mutex_spin_exit(&tty_lock);
985 		break;
986 	}
987 
988 	switch (cmd) {			/* Process the ioctl. */
989 	case FIOASYNC:			/* set/clear async i/o */
990 		mutex_spin_enter(&tty_lock);
991 		if (*(int *)data)
992 			SET(tp->t_state, TS_ASYNC);
993 		else
994 			CLR(tp->t_state, TS_ASYNC);
995 		mutex_spin_exit(&tty_lock);
996 		break;
997 	case FIONBIO:			/* set/clear non-blocking i/o */
998 		break;			/* XXX: delete. */
999 	case FIONREAD:			/* get # bytes to read */
1000 		mutex_spin_enter(&tty_lock);
1001 		*(int *)data = ttnread(tp);
1002 		mutex_spin_exit(&tty_lock);
1003 		break;
1004 	case FIONWRITE:			/* get # bytes to written & unsent */
1005 		mutex_spin_enter(&tty_lock);
1006 		*(int *)data = tp->t_outq.c_cc;
1007 		mutex_spin_exit(&tty_lock);
1008 		break;
1009 	case FIONSPACE:			/* get # bytes to written & unsent */
1010 		mutex_spin_enter(&tty_lock);
1011 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1012 		mutex_spin_exit(&tty_lock);
1013 		break;
1014 	case TIOCEXCL:			/* set exclusive use of tty */
1015 		mutex_spin_enter(&tty_lock);
1016 		SET(tp->t_state, TS_XCLUDE);
1017 		mutex_spin_exit(&tty_lock);
1018 		break;
1019 	case TIOCFLUSH: {		/* flush buffers */
1020 		int flags = *(int *)data;
1021 
1022 		if (flags == 0)
1023 			flags = FREAD | FWRITE;
1024 		else
1025 			flags &= FREAD | FWRITE;
1026 		mutex_spin_enter(&tty_lock);
1027 		ttyflush(tp, flags);
1028 		mutex_spin_exit(&tty_lock);
1029 		break;
1030 	}
1031 	case TIOCCONS:			/* become virtual console */
1032 		if (*(int *)data) {
1033 			if (constty && constty != tp &&
1034 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
1035 			    (TS_CARR_ON | TS_ISOPEN))
1036 				return EBUSY;
1037 
1038 			pb = pathbuf_create("/dev/console");
1039 			if (pb == NULL) {
1040 				return ENOMEM;
1041 			}
1042 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, pb);
1043 			if ((error = namei(&nd)) != 0) {
1044 				pathbuf_destroy(pb);
1045 				return error;
1046 			}
1047 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
1048 			vput(nd.ni_vp);
1049 			pathbuf_destroy(pb);
1050 			if (error)
1051 				return error;
1052 
1053 			constty = tp;
1054 		} else if (tp == constty)
1055 			constty = NULL;
1056 		break;
1057 	case TIOCDRAIN:			/* wait till output drained */
1058 		if ((error = ttywait(tp)) != 0)
1059 			return (error);
1060 		break;
1061 	case TIOCGETA: {		/* get termios struct */
1062 		struct termios *t = (struct termios *)data;
1063 
1064 		memcpy(t, &tp->t_termios, sizeof(struct termios));
1065 		break;
1066 	}
1067 	case TIOCGETD:			/* get line discipline (old) */
1068 		*(int *)data = tp->t_linesw->l_no;
1069 		break;
1070 	case TIOCGLINED:		/* get line discipline (new) */
1071 		(void)strncpy((char *)data, tp->t_linesw->l_name,
1072 		    TTLINEDNAMELEN - 1);
1073 		break;
1074 	case TIOCGWINSZ:		/* get window size */
1075 		*(struct winsize *)data = tp->t_winsize;
1076 		break;
1077 	case TIOCGQSIZE:
1078 		*(int *)data = tp->t_qsize;
1079 		break;
1080 	case FIOGETOWN:
1081 		mutex_enter(proc_lock);
1082 		if (tp->t_session != NULL && !isctty(p, tp)) {
1083 			mutex_exit(proc_lock);
1084 			return (ENOTTY);
1085 		}
1086 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
1087 		mutex_exit(proc_lock);
1088 		break;
1089 	case TIOCGPGRP:			/* get pgrp of tty */
1090 		mutex_enter(proc_lock);
1091 		if (!isctty(p, tp)) {
1092 			mutex_exit(proc_lock);
1093 			return (ENOTTY);
1094 		}
1095 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
1096 		mutex_exit(proc_lock);
1097 		break;
1098 	case TIOCGSID:			/* get sid of tty */
1099 		mutex_enter(proc_lock);
1100 		if (!isctty(p, tp)) {
1101 			mutex_exit(proc_lock);
1102 			return (ENOTTY);
1103 		}
1104 		*(int *)data = tp->t_session->s_sid;
1105 		mutex_exit(proc_lock);
1106 		break;
1107 #ifdef TIOCHPCL
1108 	case TIOCHPCL:			/* hang up on last close */
1109 		mutex_spin_enter(&tty_lock);
1110 		SET(tp->t_cflag, HUPCL);
1111 		mutex_spin_exit(&tty_lock);
1112 		break;
1113 #endif
1114 	case TIOCNXCL:			/* reset exclusive use of tty */
1115 		mutex_spin_enter(&tty_lock);
1116 		CLR(tp->t_state, TS_XCLUDE);
1117 		mutex_spin_exit(&tty_lock);
1118 		break;
1119 	case TIOCOUTQ:			/* output queue size */
1120 		*(int *)data = tp->t_outq.c_cc;
1121 		break;
1122 	case TIOCSETA:			/* set termios struct */
1123 	case TIOCSETAW:			/* drain output, set */
1124 	case TIOCSETAF: {		/* drn out, fls in, set */
1125 		struct termios *t = (struct termios *)data;
1126 
1127 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1128 			if ((error = ttywait(tp)) != 0)
1129 				return (error);
1130 
1131 			if (cmd == TIOCSETAF) {
1132 				mutex_spin_enter(&tty_lock);
1133 				ttyflush(tp, FREAD);
1134 				mutex_spin_exit(&tty_lock);
1135 			}
1136 		}
1137 
1138 		s = spltty();
1139 		/*
1140 		 * XXXSMP - some drivers call back on us from t_param(), so
1141 		 *	    don't take the tty spin lock here.
1142 		 *	    require t_param() to unlock upon callback?
1143 		 */
1144 		/* wanted here: mutex_spin_enter(&tty_lock); */
1145 		if (!ISSET(t->c_cflag, CIGNORE)) {
1146 			/*
1147 			 * Set device hardware.
1148 			 */
1149 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1150 				/* wanted here: mutex_spin_exit(&tty_lock); */
1151 				splx(s);
1152 				return (error);
1153 			} else {
1154 				tp->t_cflag = t->c_cflag;
1155 				tp->t_ispeed = t->c_ispeed;
1156 				tp->t_ospeed = t->c_ospeed;
1157 				if (t->c_ospeed == 0)
1158 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1159 			}
1160 			ttsetwater(tp);
1161 		}
1162 
1163 		/* delayed lock acquiring */
1164 		mutex_spin_enter(&tty_lock);
1165 		if (cmd != TIOCSETAF) {
1166 			if (ISSET(t->c_lflag, ICANON) !=
1167 			    ISSET(tp->t_lflag, ICANON)) {
1168 				if (ISSET(t->c_lflag, ICANON)) {
1169 					SET(tp->t_lflag, PENDIN);
1170 					ttwakeup(tp);
1171 				} else {
1172 					struct clist tq;
1173 
1174 					catq(&tp->t_rawq, &tp->t_canq);
1175 					tq = tp->t_rawq;
1176 					tp->t_rawq = tp->t_canq;
1177 					tp->t_canq = tq;
1178 					CLR(tp->t_lflag, PENDIN);
1179 				}
1180 			}
1181 		}
1182 		tp->t_iflag = t->c_iflag;
1183 		tp->t_oflag = t->c_oflag;
1184 		/*
1185 		 * Make the EXTPROC bit read only.
1186 		 */
1187 		if (ISSET(tp->t_lflag, EXTPROC))
1188 			SET(t->c_lflag, EXTPROC);
1189 		else
1190 			CLR(t->c_lflag, EXTPROC);
1191 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1192 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1193 		mutex_spin_exit(&tty_lock);
1194 		splx(s);
1195 		break;
1196 	}
1197 	case TIOCSETD:			/* set line discipline (old) */
1198 		lp = ttyldisc_lookup_bynum(*(int *)data);
1199 		goto setldisc;
1200 
1201 	case TIOCSLINED: {		/* set line discipline (new) */
1202 		char *name = (char *)data;
1203 		dev_t device;
1204 
1205 		/* Null terminate to prevent buffer overflow */
1206 		name[TTLINEDNAMELEN - 1] = '\0';
1207 		lp = ttyldisc_lookup(name);
1208  setldisc:
1209 		if (lp == NULL)
1210 			return (ENXIO);
1211 
1212 		if (lp != tp->t_linesw) {
1213 			device = tp->t_dev;
1214 			s = spltty();
1215 			(*tp->t_linesw->l_close)(tp, flag);
1216 			error = (*lp->l_open)(device, tp);
1217 			if (error) {
1218 				(void)(*tp->t_linesw->l_open)(device, tp);
1219 				splx(s);
1220 				ttyldisc_release(lp);
1221 				return (error);
1222 			}
1223 			ttyldisc_release(tp->t_linesw);
1224 			tp->t_linesw = lp;
1225 			splx(s);
1226 		} else {
1227 			/* Drop extra reference. */
1228 			ttyldisc_release(lp);
1229 		}
1230 		break;
1231 	}
1232 	case TIOCSTART:			/* start output, like ^Q */
1233 		mutex_spin_enter(&tty_lock);
1234 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1235 		    ISSET(tp->t_lflag, FLUSHO)) {
1236 			CLR(tp->t_lflag, FLUSHO);
1237 			CLR(tp->t_state, TS_TTSTOP);
1238 			ttstart(tp);
1239 		}
1240 		mutex_spin_exit(&tty_lock);
1241 		break;
1242 	case TIOCSTI:			/* simulate terminal input */
1243 		if ((error = kauth_authorize_device_tty(l->l_cred,
1244 		    KAUTH_DEVICE_TTY_STI, tp)) != 0) {
1245 			if (!ISSET(flag, FREAD))
1246 				return EPERM;
1247 			if (!isctty(p, tp))
1248 				return EACCES;
1249 			if (tp->t_session->s_leader->p_cred != p->p_cred)
1250 				return error;
1251 		}
1252 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1253 		break;
1254 	case TIOCSTOP:			/* stop output, like ^S */
1255 	{
1256 		mutex_spin_enter(&tty_lock);
1257 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1258 			SET(tp->t_state, TS_TTSTOP);
1259 			cdev_stop(tp, 0);
1260 		}
1261 		mutex_spin_exit(&tty_lock);
1262 		break;
1263 	}
1264 	case TIOCSCTTY:			/* become controlling tty */
1265 		mutex_enter(proc_lock);
1266 		mutex_spin_enter(&tty_lock);
1267 
1268 		/* Session ctty vnode pointer set in vnode layer. */
1269 		if (!SESS_LEADER(p) ||
1270 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1271 		    (tp->t_session != p->p_session))) {
1272 			mutex_spin_exit(&tty_lock);
1273 			mutex_exit(proc_lock);
1274 			return (EPERM);
1275 		}
1276 
1277 		/*
1278 		 * `p_session' acquires a reference.
1279 		 * But note that if `t_session' is set at this point,
1280 		 * it must equal `p_session', in which case the session
1281 		 * already has the correct reference count.
1282 		 */
1283 		if (tp->t_session == NULL) {
1284 			proc_sesshold(p->p_session);
1285 		}
1286 		tp->t_session = p->p_session;
1287 		tp->t_pgrp = p->p_pgrp;
1288 		p->p_session->s_ttyp = tp;
1289 		p->p_lflag |= PL_CONTROLT;
1290 		mutex_spin_exit(&tty_lock);
1291 		mutex_exit(proc_lock);
1292 		break;
1293 	case FIOSETOWN: {		/* set pgrp of tty */
1294 		pid_t pgid = *(pid_t *)data;
1295 		struct pgrp *pgrp;
1296 
1297 		mutex_enter(proc_lock);
1298 		if (tp->t_session != NULL && !isctty(p, tp)) {
1299 			mutex_exit(proc_lock);
1300 			return (ENOTTY);
1301 		}
1302 
1303 		if (pgid < 0) {
1304 			pgrp = pgrp_find(-pgid);
1305 			if (pgrp == NULL) {
1306 				mutex_exit(proc_lock);
1307 				return (EINVAL);
1308 			}
1309 		} else {
1310 			struct proc *p1;
1311 			p1 = proc_find(pgid);
1312 			if (!p1) {
1313 				mutex_exit(proc_lock);
1314 				return (ESRCH);
1315 			}
1316 			pgrp = p1->p_pgrp;
1317 		}
1318 
1319 		if (pgrp->pg_session != p->p_session) {
1320 			mutex_exit(proc_lock);
1321 			return (EPERM);
1322 		}
1323 		mutex_spin_enter(&tty_lock);
1324 		tp->t_pgrp = pgrp;
1325 		mutex_spin_exit(&tty_lock);
1326 		mutex_exit(proc_lock);
1327 		break;
1328 	}
1329 	case TIOCSPGRP: {		/* set pgrp of tty */
1330 		struct pgrp *pgrp;
1331 		pid_t pgid = *(pid_t *)data;
1332 
1333 		if (pgid == NO_PGID)
1334 			return EINVAL;
1335 
1336 		mutex_enter(proc_lock);
1337 		if (!isctty(p, tp)) {
1338 			mutex_exit(proc_lock);
1339 			return (ENOTTY);
1340 		}
1341 		pgrp = pgrp_find(pgid);
1342 		if (pgrp == NULL || pgrp->pg_session != p->p_session) {
1343 			mutex_exit(proc_lock);
1344 			return (EPERM);
1345 		}
1346 		mutex_spin_enter(&tty_lock);
1347 		tp->t_pgrp = pgrp;
1348 		mutex_spin_exit(&tty_lock);
1349 		mutex_exit(proc_lock);
1350 		break;
1351 	}
1352 	case TIOCSTAT:			/* get load avg stats */
1353 		mutex_enter(proc_lock);
1354 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1355 		mutex_exit(proc_lock);
1356 
1357 		mutex_spin_enter(&tty_lock);
1358 		ttyputinfo(tp, infobuf);
1359 		mutex_spin_exit(&tty_lock);
1360 		break;
1361 	case TIOCSWINSZ:		/* set window size */
1362 		mutex_spin_enter(&tty_lock);
1363 		if (memcmp((void *)&tp->t_winsize, data,
1364 		    sizeof(struct winsize))) {
1365 			tp->t_winsize = *(struct winsize *)data;
1366 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1367 		}
1368 		mutex_spin_exit(&tty_lock);
1369 		break;
1370 	case TIOCSQSIZE:
1371 		if ((error = tty_get_qsize(&s, *(int *)data)) == 0 &&
1372 		    s != tp->t_qsize)
1373 			error = tty_set_qsize(tp, s);
1374 		return error;
1375 
1376 	case TIOCSBRK:
1377 	case TIOCCBRK:
1378 	case TIOCSDTR:
1379 	case TIOCCDTR:
1380 	case TIOCSFLAGS:
1381 	case TIOCGFLAGS:
1382 	case TIOCMSET:
1383 	case TIOCMGET:
1384 	case TIOCMBIS:
1385 	case TIOCMBIC:
1386 		/* Handled by the driver layer */
1387 		return EPASSTHROUGH;
1388 
1389 	case TIOCEXT:
1390 	case TIOCPTSNAME:
1391 	case TIOCGRANTPT:
1392 	case TIOCPKT:
1393 	case TIOCUCNTL:
1394 	case TIOCREMOTE:
1395 	case TIOCSIG:
1396 		/* for ptys */
1397 		return EPASSTHROUGH;
1398 
1399 	default:
1400 		/* Pass through various console ioctls */
1401 		switch (IOCGROUP(cmd)) {
1402 		case 'c':	/* syscons console */
1403 		case 'v':	/* usl console, video - where one letter */
1404 		case 'K':	/* usl console, keyboard - aint enough */
1405 		case 'V':	/* pcvt compat */
1406 		case 'W':	/* wscons console */
1407 			return EPASSTHROUGH;
1408 		default:
1409 			break;
1410 		}
1411 #ifdef COMPAT_60
1412 		error = compat_60_ttioctl(tp, cmd, data, flag, l);
1413 		if (error != EPASSTHROUGH)
1414 			return error;
1415 #endif /* COMPAT_60 */
1416 		/* We may have to load the compat module for this. */
1417 		for (;;) {
1418 			rw_enter(&ttcompat_lock, RW_READER);
1419 			if (ttcompatvec != NULL) {
1420 				break;
1421 			}
1422 			rw_exit(&ttcompat_lock);
1423 			(void)module_autoload("compat", MODULE_CLASS_ANY);
1424 			if (ttcompatvec == NULL) {
1425 				return EPASSTHROUGH;
1426 			}
1427 		}
1428 		error = (*ttcompatvec)(tp, cmd, data, flag, l);
1429 		rw_exit(&ttcompat_lock);
1430 		return error;
1431 	}
1432 	return (0);
1433 }
1434 
1435 int
1436 ttpoll(struct tty *tp, int events, struct lwp *l)
1437 {
1438 	int	revents;
1439 
1440 	revents = 0;
1441 	mutex_spin_enter(&tty_lock);
1442 	if (events & (POLLIN | POLLRDNORM))
1443 		if (ttnread(tp) > 0)
1444 			revents |= events & (POLLIN | POLLRDNORM);
1445 
1446 	if (events & (POLLOUT | POLLWRNORM))
1447 		if (tp->t_outq.c_cc <= tp->t_lowat)
1448 			revents |= events & (POLLOUT | POLLWRNORM);
1449 
1450 	if (events & POLLHUP)
1451 		if (!CONNECTED(tp))
1452 			revents |= POLLHUP;
1453 
1454 	if (revents == 0) {
1455 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1456 			selrecord(l, &tp->t_rsel);
1457 
1458 		if (events & (POLLOUT | POLLWRNORM))
1459 			selrecord(l, &tp->t_wsel);
1460 	}
1461 
1462 	mutex_spin_exit(&tty_lock);
1463 
1464 	return (revents);
1465 }
1466 
1467 static void
1468 filt_ttyrdetach(struct knote *kn)
1469 {
1470 	struct tty	*tp;
1471 
1472 	tp = kn->kn_hook;
1473 	mutex_spin_enter(&tty_lock);
1474 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1475 	mutex_spin_exit(&tty_lock);
1476 }
1477 
1478 static int
1479 filt_ttyread(struct knote *kn, long hint)
1480 {
1481 	struct tty	*tp;
1482 
1483 	tp = kn->kn_hook;
1484 	if ((hint & NOTE_SUBMIT) == 0)
1485 		mutex_spin_enter(&tty_lock);
1486 	kn->kn_data = ttnread(tp);
1487 	if ((hint & NOTE_SUBMIT) == 0)
1488 		mutex_spin_exit(&tty_lock);
1489 	return (kn->kn_data > 0);
1490 }
1491 
1492 static void
1493 filt_ttywdetach(struct knote *kn)
1494 {
1495 	struct tty	*tp;
1496 
1497 	tp = kn->kn_hook;
1498 	mutex_spin_enter(&tty_lock);
1499 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1500 	mutex_spin_exit(&tty_lock);
1501 }
1502 
1503 static int
1504 filt_ttywrite(struct knote *kn, long hint)
1505 {
1506 	struct tty	*tp;
1507 	int		canwrite;
1508 
1509 	tp = kn->kn_hook;
1510 	if ((hint & NOTE_SUBMIT) == 0)
1511 		mutex_spin_enter(&tty_lock);
1512 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1513 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1514 	if ((hint & NOTE_SUBMIT) == 0)
1515 		mutex_spin_exit(&tty_lock);
1516 	return (canwrite);
1517 }
1518 
1519 static const struct filterops ttyread_filtops = {
1520 	.f_isfd = 1,
1521 	.f_attach = NULL,
1522 	.f_detach = filt_ttyrdetach,
1523 	.f_event = filt_ttyread,
1524 };
1525 
1526 static const struct filterops ttywrite_filtops = {
1527 	.f_isfd = 1,
1528 	.f_attach = NULL,
1529 	.f_detach = filt_ttywdetach,
1530 	.f_event = filt_ttywrite,
1531 };
1532 
1533 int
1534 ttykqfilter(dev_t dev, struct knote *kn)
1535 {
1536 	struct tty	*tp;
1537 	struct klist	*klist;
1538 
1539 	if ((tp = cdev_tty(dev)) == NULL)
1540 		return (ENXIO);
1541 
1542 	switch (kn->kn_filter) {
1543 	case EVFILT_READ:
1544 		klist = &tp->t_rsel.sel_klist;
1545 		kn->kn_fop = &ttyread_filtops;
1546 		break;
1547 	case EVFILT_WRITE:
1548 		klist = &tp->t_wsel.sel_klist;
1549 		kn->kn_fop = &ttywrite_filtops;
1550 		break;
1551 	default:
1552 		return EINVAL;
1553 	}
1554 
1555 	kn->kn_hook = tp;
1556 
1557 	mutex_spin_enter(&tty_lock);
1558 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1559 	mutex_spin_exit(&tty_lock);
1560 
1561 	return (0);
1562 }
1563 
1564 /*
1565  * Find the number of chars ready to be read from this tty.
1566  * Call with the tty lock held.
1567  */
1568 static int
1569 ttnread(struct tty *tp)
1570 {
1571 	int	nread;
1572 
1573 	KASSERT(mutex_owned(&tty_lock));
1574 
1575 	if (ISSET(tp->t_lflag, PENDIN))
1576 		ttypend(tp);
1577 	nread = tp->t_canq.c_cc;
1578 	if (!ISSET(tp->t_lflag, ICANON)) {
1579 		nread += tp->t_rawq.c_cc;
1580 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1581 			nread = 0;
1582 	}
1583 	return (nread);
1584 }
1585 
1586 /*
1587  * Wait for output to drain, or if this times out, flush it.
1588  */
1589 static int
1590 ttywait_timo(struct tty *tp, int timo)
1591 {
1592 	int	error;
1593 
1594 	error = 0;
1595 
1596 	mutex_spin_enter(&tty_lock);
1597 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1598 	    CONNECTED(tp) && tp->t_oproc) {
1599 		(*tp->t_oproc)(tp);
1600 		error = ttysleep(tp, &tp->t_outcv, true, timo);
1601 		if (error == EWOULDBLOCK)
1602 			ttyflush(tp, FWRITE);
1603 		if (error)
1604 			break;
1605 	}
1606 	mutex_spin_exit(&tty_lock);
1607 
1608 	return (error);
1609 }
1610 
1611 /*
1612  * Wait for output to drain.
1613  */
1614 int
1615 ttywait(struct tty *tp)
1616 {
1617 	return ttywait_timo(tp, 0);
1618 }
1619 
1620 /*
1621  * Flush if successfully wait.
1622  */
1623 int
1624 ttywflush(struct tty *tp)
1625 {
1626 	int	error;
1627 
1628 	error = ttywait_timo(tp, 5 * hz);
1629 	if (error == 0 || error == EWOULDBLOCK) {
1630 		mutex_spin_enter(&tty_lock);
1631 		ttyflush(tp, FREAD);
1632 		mutex_spin_exit(&tty_lock);
1633 	}
1634 	return (error);
1635 }
1636 
1637 /*
1638  * Flush tty read and/or write queues, notifying anyone waiting.
1639  * Call with the tty lock held.
1640  */
1641 void
1642 ttyflush(struct tty *tp, int rw)
1643 {
1644 
1645 	KASSERT(mutex_owned(&tty_lock));
1646 
1647 	if (rw & FREAD) {
1648 		FLUSHQ(&tp->t_canq);
1649 		FLUSHQ(&tp->t_rawq);
1650 		tp->t_rocount = 0;
1651 		tp->t_rocol = 0;
1652 		CLR(tp->t_state, TS_LOCAL);
1653 		ttwakeup(tp);
1654 	}
1655 	if (rw & FWRITE) {
1656 		CLR(tp->t_state, TS_TTSTOP);
1657 		cdev_stop(tp, rw);
1658 		FLUSHQ(&tp->t_outq);
1659 		cv_broadcast(&tp->t_outcv);
1660 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1661 	}
1662 }
1663 
1664 /*
1665  * Copy in the default termios characters.
1666  */
1667 void
1668 ttychars(struct tty *tp)
1669 {
1670 
1671 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1672 }
1673 
1674 /*
1675  * Send stop character on input overflow.
1676  * Call with the tty lock held.
1677  */
1678 static void
1679 ttyblock(struct tty *tp)
1680 {
1681 	int	total;
1682 
1683 	KASSERT(mutex_owned(&tty_lock));
1684 
1685 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1686 	if (tp->t_rawq.c_cc > TTYHOG) {
1687 		ttyflush(tp, FREAD | FWRITE);
1688 		CLR(tp->t_state, TS_TBLOCK);
1689 	}
1690 	/*
1691 	 * Block further input iff: current input > threshold
1692 	 * AND input is available to user program.
1693 	 */
1694 	if (total >= TTYHOG / 2 &&
1695 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1696 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1697 		if (ISSET(tp->t_iflag, IXOFF) &&
1698 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1699 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1700 			SET(tp->t_state, TS_TBLOCK);
1701 			ttstart(tp);
1702 		}
1703 		/* Try to block remote output via hardware flow control. */
1704 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1705 		    (*tp->t_hwiflow)(tp, 1) != 0)
1706 			SET(tp->t_state, TS_TBLOCK);
1707 	}
1708 }
1709 
1710 /*
1711  * Delayed line discipline output
1712  */
1713 void
1714 ttrstrt(void *tp_arg)
1715 {
1716 	struct tty	*tp;
1717 
1718 #ifdef DIAGNOSTIC
1719 	if (tp_arg == NULL)
1720 		panic("ttrstrt");
1721 #endif
1722 	tp = tp_arg;
1723 	mutex_spin_enter(&tty_lock);
1724 
1725 	CLR(tp->t_state, TS_TIMEOUT);
1726 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1727 
1728 	mutex_spin_exit(&tty_lock);
1729 }
1730 
1731 /*
1732  * start a line discipline
1733  * Always call with tty lock held?
1734  */
1735 int
1736 ttstart(struct tty *tp)
1737 {
1738 
1739 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1740 		(*tp->t_oproc)(tp);
1741 	return (0);
1742 }
1743 
1744 /*
1745  * "close" a line discipline
1746  */
1747 int
1748 ttylclose(struct tty *tp, int flag)
1749 {
1750 
1751 	if (flag & FNONBLOCK) {
1752 		mutex_spin_enter(&tty_lock);
1753 		ttyflush(tp, FREAD | FWRITE);
1754 		mutex_spin_exit(&tty_lock);
1755 	} else
1756 		ttywflush(tp);
1757 	return (0);
1758 }
1759 
1760 /*
1761  * Handle modem control transition on a tty.
1762  * Flag indicates new state of carrier.
1763  * Returns 0 if the line should be turned off, otherwise 1.
1764  */
1765 int
1766 ttymodem(struct tty *tp, int flag)
1767 {
1768 
1769 	mutex_spin_enter(&tty_lock);
1770 	if (flag == 0) {
1771 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1772 			/*
1773 			 * Lost carrier.
1774 			 */
1775 			CLR(tp->t_state, TS_CARR_ON);
1776 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1777 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1778 				ttyflush(tp, FREAD | FWRITE);
1779 				mutex_spin_exit(&tty_lock);
1780 				return (0);
1781 			}
1782 		}
1783 	} else {
1784 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1785 			/*
1786 			 * Carrier now on.
1787 			 */
1788 			SET(tp->t_state, TS_CARR_ON);
1789 			ttwakeup(tp);
1790 		}
1791 	}
1792 	mutex_spin_exit(&tty_lock);
1793 
1794 	return (1);
1795 }
1796 
1797 /*
1798  * Default modem control routine (for other line disciplines).
1799  * Return argument flag, to turn off device on carrier drop.
1800  */
1801 int
1802 nullmodem(struct tty *tp, int flag)
1803 {
1804 
1805 	mutex_spin_enter(&tty_lock);
1806 	if (flag)
1807 		SET(tp->t_state, TS_CARR_ON);
1808 	else {
1809 		CLR(tp->t_state, TS_CARR_ON);
1810 		if (!CONNECTED(tp)) {
1811 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1812 			mutex_spin_exit(&tty_lock);
1813 			return (0);
1814 		}
1815 	}
1816 	mutex_spin_exit(&tty_lock);
1817 
1818 	return (1);
1819 }
1820 
1821 /*
1822  * Reinput pending characters after state switch.
1823  */
1824 void
1825 ttypend(struct tty *tp)
1826 {
1827 	struct clist	tq;
1828 	int		c;
1829 
1830 	KASSERT(mutex_owned(&tty_lock));
1831 
1832 	CLR(tp->t_lflag, PENDIN);
1833 	SET(tp->t_state, TS_TYPEN);
1834 	tq = tp->t_rawq;
1835 	tp->t_rawq.c_cc = 0;
1836 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1837 	while ((c = getc(&tq)) >= 0)
1838 		ttyinput_wlock(c, tp);
1839 	CLR(tp->t_state, TS_TYPEN);
1840 }
1841 
1842 /*
1843  * Process a read call on a tty device.
1844  */
1845 int
1846 ttread(struct tty *tp, struct uio *uio, int flag)
1847 {
1848 	struct clist	*qp;
1849 	u_char		*cc;
1850 	struct proc	*p;
1851 	int		c, first, error, has_stime, last_cc;
1852 	long		lflag, slp;
1853 	struct timeval	now, stime;
1854 
1855 	if (uio->uio_resid == 0)
1856 		return 0;
1857 
1858 	stime.tv_usec = 0;	/* XXX gcc */
1859 	stime.tv_sec = 0;	/* XXX gcc */
1860 
1861 	cc = tp->t_cc;
1862 	p = curproc;
1863 	error = 0;
1864 	has_stime = 0;
1865 	last_cc = 0;
1866 	slp = 0;
1867 
1868  loop:
1869 	mutex_spin_enter(&tty_lock);
1870 	lflag = tp->t_lflag;
1871 	/*
1872 	 * take pending input first
1873 	 */
1874 	if (ISSET(lflag, PENDIN))
1875 		ttypend(tp);
1876 
1877 	/*
1878 	 * Hang process if it's in the background.
1879 	 */
1880 	if (isbackground(p, tp)) {
1881 		if (sigismasked(curlwp, SIGTTIN) ||
1882 		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1883 			mutex_spin_exit(&tty_lock);
1884 			return (EIO);
1885 		}
1886 		mutex_spin_exit(&tty_lock);
1887 
1888 		mutex_enter(proc_lock);
1889 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1890 		mutex_exit(proc_lock);
1891 
1892 		mutex_spin_enter(&tty_lock);
1893 		error = ttypause(tp, hz);
1894 		mutex_spin_exit(&tty_lock);
1895 		if (error)
1896 			return (error);
1897 		goto loop;
1898 	}
1899 
1900 	if (!ISSET(lflag, ICANON)) {
1901 		int m = cc[VMIN];
1902 		long t = cc[VTIME];
1903 
1904 		qp = &tp->t_rawq;
1905 		/*
1906 		 * Check each of the four combinations.
1907 		 * (m > 0 && t == 0) is the normal read case.
1908 		 * It should be fairly efficient, so we check that and its
1909 		 * companion case (m == 0 && t == 0) first.
1910 		 * For the other two cases, we compute the target sleep time
1911 		 * into slp.
1912 		 */
1913 		if (t == 0) {
1914 			if (qp->c_cc < m)
1915 				goto sleep;
1916 			goto read;
1917 		}
1918 		t *= hz;		/* time in deca-ticks */
1919 /*
1920  * Time difference in deca-ticks, split division to avoid numeric overflow.
1921  * Ok for hz < ~200kHz
1922  */
1923 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1924 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1925 		if (m > 0) {
1926 			if (qp->c_cc <= 0)
1927 				goto sleep;
1928 			if (qp->c_cc >= m)
1929 				goto read;
1930 			if (!has_stime) {
1931 				/* first character, start timer */
1932 				has_stime = 1;
1933 				getmicrotime(&stime);
1934 				slp = t;
1935 			} else if (qp->c_cc > last_cc) {
1936 				/* got a character, restart timer */
1937 				getmicrotime(&stime);
1938 				slp = t;
1939 			} else {
1940 				/* nothing, check expiration */
1941 				getmicrotime(&now);
1942 				slp = t - diff(now, stime);
1943 			}
1944 		} else {	/* m == 0 */
1945 			if (qp->c_cc > 0)
1946 				goto read;
1947 			if (!has_stime) {
1948 				has_stime = 1;
1949 				getmicrotime(&stime);
1950 				slp = t;
1951 			} else {
1952 				getmicrotime(&now);
1953 				slp = t - diff(now, stime);
1954 			}
1955 		}
1956 		last_cc = qp->c_cc;
1957 #undef diff
1958 		if (slp > 0) {
1959 			/*
1960 			 * Convert deca-ticks back to ticks.
1961 			 * Rounding down may make us wake up just short
1962 			 * of the target, so we round up.
1963 			 * Maybe we should do 'slp/10 + 1' because the
1964 			 * first tick maybe almost immediate.
1965 			 * However it is more useful for a program that sets
1966 			 * VTIME=10 to wakeup every second not every 1.01
1967 			 * seconds (if hz=100).
1968 			 */
1969 			slp = (slp + 9)/ 10;
1970 			goto sleep;
1971 		}
1972 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1973 		int	carrier;
1974 
1975  sleep:
1976 		/*
1977 		 * If there is no input, sleep on rawq
1978 		 * awaiting hardware receipt and notification.
1979 		 * If we have data, we don't need to check for carrier.
1980 		 */
1981 		carrier = CONNECTED(tp);
1982 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1983 			mutex_spin_exit(&tty_lock);
1984 			return (0);	/* EOF */
1985 		}
1986 		if (!has_stime || slp <= 0) {
1987 			if (flag & IO_NDELAY) {
1988 				mutex_spin_exit(&tty_lock);
1989 				return (EWOULDBLOCK);
1990 			}
1991 		}
1992 		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1993 		mutex_spin_exit(&tty_lock);
1994 		/* VMIN == 0: any quantity read satisfies */
1995 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1996 			return (0);
1997 		if (error && error != EWOULDBLOCK)
1998 			return (error);
1999 		goto loop;
2000 	}
2001  read:
2002 
2003 	/*
2004 	 * Input present, check for input mapping and processing.
2005 	 */
2006 	first = 1;
2007 	while ((c = getc(qp)) >= 0) {
2008 		/*
2009 		 * delayed suspend (^Y)
2010 		 */
2011 		if (CCEQ(cc[VDSUSP], c) &&
2012 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
2013 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
2014 			if (first) {
2015 				error = ttypause(tp, hz);
2016 				if (error)
2017 					break;
2018 				mutex_spin_exit(&tty_lock);
2019 				goto loop;
2020 			}
2021 			break;
2022 		}
2023 		/*
2024 		 * Interpret EOF only in canonical mode.
2025 		 */
2026 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
2027 			break;
2028 		/*
2029 		 * Give user character.
2030 		 */
2031 		mutex_spin_exit(&tty_lock);
2032  		error = ureadc(c, uio);
2033 		mutex_spin_enter(&tty_lock);
2034 		if (error)
2035 			break;
2036  		if (uio->uio_resid == 0)
2037 			break;
2038 		/*
2039 		 * In canonical mode check for a "break character"
2040 		 * marking the end of a "line of input".
2041 		 */
2042 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
2043 			break;
2044 		first = 0;
2045 	}
2046 
2047 	/*
2048 	 * Look to unblock output now that (presumably)
2049 	 * the input queue has gone down.
2050 	 */
2051 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
2052 		if (ISSET(tp->t_iflag, IXOFF) &&
2053 		    cc[VSTART] != _POSIX_VDISABLE &&
2054 		    putc(cc[VSTART], &tp->t_outq) == 0) {
2055 			CLR(tp->t_state, TS_TBLOCK);
2056 			ttstart(tp);
2057 		}
2058 		/* Try to unblock remote output via hardware flow control. */
2059 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
2060 		    (*tp->t_hwiflow)(tp, 0) != 0)
2061 			CLR(tp->t_state, TS_TBLOCK);
2062 	}
2063 	mutex_spin_exit(&tty_lock);
2064 
2065 	return (error);
2066 }
2067 
2068 /*
2069  * Check the output queue on tp for space for a kernel message (from uprintf
2070  * or tprintf).  Allow some space over the normal hiwater mark so we don't
2071  * lose messages due to normal flow control, but don't let the tty run amok.
2072  * Sleeps here are not interruptible, but we return prematurely if new signals
2073  * arrive.
2074  * Call with tty lock held.
2075  */
2076 static int
2077 ttycheckoutq_wlock(struct tty *tp, int wait)
2078 {
2079 	int	hiwat, error;
2080 
2081 	KASSERT(mutex_owned(&tty_lock));
2082 
2083 	hiwat = tp->t_hiwat;
2084 	if (tp->t_outq.c_cc > hiwat + 200)
2085 		while (tp->t_outq.c_cc > hiwat) {
2086 			ttstart(tp);
2087 			if (wait == 0)
2088 				return (0);
2089 			error = ttysleep(tp, &tp->t_outcv, true, hz);
2090 			if (error == EINTR)
2091 				wait = 0;
2092 		}
2093 
2094 	return (1);
2095 }
2096 
2097 int
2098 ttycheckoutq(struct tty *tp, int wait)
2099 {
2100 	int	r;
2101 
2102 	mutex_spin_enter(&tty_lock);
2103 	r = ttycheckoutq_wlock(tp, wait);
2104 	mutex_spin_exit(&tty_lock);
2105 
2106 	return (r);
2107 }
2108 
2109 /*
2110  * Process a write call on a tty device.
2111  */
2112 int
2113 ttwrite(struct tty *tp, struct uio *uio, int flag)
2114 {
2115 	u_char		*cp;
2116 	struct proc	*p;
2117 	int		cc, ce, i, hiwat, error;
2118 	u_char		obuf[OBUFSIZ];
2119 
2120 	cp = NULL;
2121 	hiwat = tp->t_hiwat;
2122 	error = 0;
2123 	cc = 0;
2124  loop:
2125 	mutex_spin_enter(&tty_lock);
2126 	if (!CONNECTED(tp)) {
2127 		if (ISSET(tp->t_state, TS_ISOPEN)) {
2128 			mutex_spin_exit(&tty_lock);
2129 			return (EIO);
2130 		} else if (flag & IO_NDELAY) {
2131 			mutex_spin_exit(&tty_lock);
2132 			error = EWOULDBLOCK;
2133 			goto out;
2134 		} else {
2135 			/* Sleep awaiting carrier. */
2136 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
2137 			mutex_spin_exit(&tty_lock);
2138 			if (error)
2139 				goto out;
2140 			goto loop;
2141 		}
2142 	}
2143 
2144 	/*
2145 	 * Hang the process if it's in the background.
2146 	 */
2147 	p = curproc;
2148 	if (isbackground(p, tp) &&
2149 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
2150 	    !sigismasked(curlwp, SIGTTOU)) {
2151 		if (p->p_pgrp->pg_jobc == 0) {
2152 			error = EIO;
2153 			mutex_spin_exit(&tty_lock);
2154 			goto out;
2155 		}
2156 		mutex_spin_exit(&tty_lock);
2157 
2158 		mutex_enter(proc_lock);
2159 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2160 		mutex_exit(proc_lock);
2161 
2162 		mutex_spin_enter(&tty_lock);
2163 		error = ttypause(tp, hz);
2164 		mutex_spin_exit(&tty_lock);
2165 		if (error)
2166 			goto out;
2167 		goto loop;
2168 	}
2169 	mutex_spin_exit(&tty_lock);
2170 
2171 	/*
2172 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2173 	 * output translation.  Keep track of high water mark, sleep on
2174 	 * overflow awaiting device aid in acquiring new space.
2175 	 */
2176 	while (uio->uio_resid > 0 || cc > 0) {
2177 		if (ISSET(tp->t_lflag, FLUSHO)) {
2178 			uio->uio_resid = 0;
2179 			return (0);
2180 		}
2181 		if (tp->t_outq.c_cc > hiwat)
2182 			goto ovhiwat;
2183 		/*
2184 		 * Grab a hunk of data from the user, unless we have some
2185 		 * leftover from last time.
2186 		 */
2187 		if (cc == 0) {
2188 			cc = uimin(uio->uio_resid, OBUFSIZ);
2189 			cp = obuf;
2190 			error = uiomove(cp, cc, uio);
2191 			if (error) {
2192 				cc = 0;
2193 				goto out;
2194 			}
2195 		}
2196 		/*
2197 		 * If nothing fancy need be done, grab those characters we
2198 		 * can handle without any of ttyoutput's processing and
2199 		 * just transfer them to the output q.  For those chars
2200 		 * which require special processing (as indicated by the
2201 		 * bits in char_type), call ttyoutput.  After processing
2202 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2203 		 * immediately.
2204 		 */
2205 		mutex_spin_enter(&tty_lock);
2206 		while (cc > 0) {
2207 			if (!ISSET(tp->t_oflag, OPOST))
2208 				ce = cc;
2209 			else {
2210 				ce = cc - scanc((u_int)cc, cp, char_type,
2211 				    CCLASSMASK);
2212 				/*
2213 				 * If ce is zero, then we're processing
2214 				 * a special character through ttyoutput.
2215 				 */
2216 				if (ce == 0) {
2217 					tp->t_rocount = 0;
2218 					if (ttyoutput(*cp, tp) >= 0) {
2219 						/* out of space */
2220 						mutex_spin_exit(&tty_lock);
2221 						goto overfull;
2222 					}
2223 					cp++;
2224 					cc--;
2225 					if (ISSET(tp->t_lflag, FLUSHO) ||
2226 					    tp->t_outq.c_cc > hiwat) {
2227 						mutex_spin_exit(&tty_lock);
2228 						goto ovhiwat;
2229 					}
2230 					continue;
2231 				}
2232 			}
2233 			/*
2234 			 * A bunch of normal characters have been found.
2235 			 * Transfer them en masse to the output queue and
2236 			 * continue processing at the top of the loop.
2237 			 * If there are any further characters in this
2238 			 * <= OBUFSIZ chunk, the first should be a character
2239 			 * requiring special handling by ttyoutput.
2240 			 */
2241 			tp->t_rocount = 0;
2242 			i = b_to_q(cp, ce, &tp->t_outq);
2243 			ce -= i;
2244 			tp->t_column += ce;
2245 			cp += ce, cc -= ce, tk_nout += ce;
2246 			tp->t_outcc += ce;
2247 			if (i > 0) {
2248 				/* out of space */
2249 				mutex_spin_exit(&tty_lock);
2250 				goto overfull;
2251 			}
2252 			if (ISSET(tp->t_lflag, FLUSHO) ||
2253 			    tp->t_outq.c_cc > hiwat)
2254 				break;
2255 		}
2256 		ttstart(tp);
2257 		mutex_spin_exit(&tty_lock);
2258 	}
2259 
2260  out:
2261 	/*
2262 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2263 	 * offset and iov pointers have moved forward, but it doesn't matter
2264 	 * (the call will either return short or restart with a new uio).
2265 	 */
2266 	uio->uio_resid += cc;
2267 	return (error);
2268 
2269  overfull:
2270 	/*
2271 	 * Since we are using ring buffers, if we can't insert any more into
2272 	 * the output queue, we can assume the ring is full and that someone
2273 	 * forgot to set the high water mark correctly.  We set it and then
2274 	 * proceed as normal.
2275 	 */
2276 	hiwat = tp->t_outq.c_cc - 1;
2277 
2278  ovhiwat:
2279 	mutex_spin_enter(&tty_lock);
2280 	ttstart(tp);
2281 	/*
2282 	 * This can only occur if FLUSHO is set in t_lflag,
2283 	 * or if ttstart/oproc is synchronous (or very fast).
2284 	 */
2285 	if (tp->t_outq.c_cc <= hiwat) {
2286 		mutex_spin_exit(&tty_lock);
2287 		goto loop;
2288 	}
2289 	if (flag & IO_NDELAY) {
2290 		mutex_spin_exit(&tty_lock);
2291 		error = EWOULDBLOCK;
2292 		goto out;
2293 	}
2294 	error = ttysleep(tp, &tp->t_outcv, true, 0);
2295 	mutex_spin_exit(&tty_lock);
2296 	if (error)
2297 		goto out;
2298 	goto loop;
2299 }
2300 
2301 /*
2302  * Try to pull more output from the producer.  Return non-zero if
2303  * there is output ready to be sent.
2304  */
2305 bool
2306 ttypull(struct tty *tp)
2307 {
2308 
2309 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2310 
2311 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2312 		cv_broadcast(&tp->t_outcv);
2313 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2314 	}
2315 	return tp->t_outq.c_cc != 0;
2316 }
2317 
2318 /*
2319  * Rubout one character from the rawq of tp
2320  * as cleanly as possible.
2321  * Called with tty lock held.
2322  */
2323 void
2324 ttyrub(int c, struct tty *tp)
2325 {
2326 	u_char	*cp;
2327 	int	savecol, tabc;
2328 
2329 	KASSERT(mutex_owned(&tty_lock));
2330 
2331 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2332 		return;
2333 	CLR(tp->t_lflag, FLUSHO);
2334 	if (ISSET(tp->t_lflag, ECHOE)) {
2335 		if (tp->t_rocount == 0) {
2336 			/*
2337 			 * Screwed by ttwrite; retype
2338 			 */
2339 			ttyretype(tp);
2340 			return;
2341 		}
2342 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2343 			ttyrubo(tp, 2);
2344 		else {
2345 			CLR(c, ~TTY_CHARMASK);
2346 			switch (CCLASS(c)) {
2347 			case ORDINARY:
2348 				ttyrubo(tp, 1);
2349 				break;
2350 			case BACKSPACE:
2351 			case CONTROL:
2352 			case NEWLINE:
2353 			case RETURN:
2354 			case VTAB:
2355 				if (ISSET(tp->t_lflag, ECHOCTL))
2356 					ttyrubo(tp, 2);
2357 				break;
2358 			case TAB:
2359 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2360 					ttyretype(tp);
2361 					return;
2362 				}
2363 				savecol = tp->t_column;
2364 				SET(tp->t_state, TS_CNTTB);
2365 				SET(tp->t_lflag, FLUSHO);
2366 				tp->t_column = tp->t_rocol;
2367 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2368 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2369 					ttyecho(tabc, tp);
2370 				CLR(tp->t_lflag, FLUSHO);
2371 				CLR(tp->t_state, TS_CNTTB);
2372 
2373 				/* savecol will now be length of the tab. */
2374 				savecol -= tp->t_column;
2375 				tp->t_column += savecol;
2376 				if (savecol > 8)
2377 					savecol = 8;	/* overflow screw */
2378 				while (--savecol >= 0)
2379 					(void)ttyoutput('\b', tp);
2380 				break;
2381 			default:			/* XXX */
2382 				(void)printf("ttyrub: would panic c = %d, "
2383 				    "val = %d\n", c, CCLASS(c));
2384 			}
2385 		}
2386 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2387 		if (!ISSET(tp->t_state, TS_ERASE)) {
2388 			SET(tp->t_state, TS_ERASE);
2389 			(void)ttyoutput('\\', tp);
2390 		}
2391 		ttyecho(c, tp);
2392 	} else
2393 		ttyecho(tp->t_cc[VERASE], tp);
2394 	--tp->t_rocount;
2395 }
2396 
2397 /*
2398  * Back over cnt characters, erasing them.
2399  * Called with tty lock held.
2400  */
2401 static void
2402 ttyrubo(struct tty *tp, int cnt)
2403 {
2404 
2405 	KASSERT(mutex_owned(&tty_lock));
2406 
2407 	while (cnt-- > 0) {
2408 		(void)ttyoutput('\b', tp);
2409 		(void)ttyoutput(' ', tp);
2410 		(void)ttyoutput('\b', tp);
2411 	}
2412 }
2413 
2414 /*
2415  * ttyretype --
2416  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2417  *	been checked.
2418  *
2419  * Called with tty lock held.
2420  */
2421 void
2422 ttyretype(struct tty *tp)
2423 {
2424 	u_char	*cp;
2425 	int	c;
2426 
2427 	KASSERT(mutex_owned(&tty_lock));
2428 
2429 	/* Echo the reprint character. */
2430 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2431 		ttyecho(tp->t_cc[VREPRINT], tp);
2432 
2433 	(void)ttyoutput('\n', tp);
2434 
2435 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2436 		ttyecho(c, tp);
2437 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2438 		ttyecho(c, tp);
2439 	CLR(tp->t_state, TS_ERASE);
2440 
2441 	tp->t_rocount = tp->t_rawq.c_cc;
2442 	tp->t_rocol = 0;
2443 }
2444 
2445 /*
2446  * Echo a typed character to the terminal.
2447  * Called with tty lock held.
2448  */
2449 static void
2450 ttyecho(int c, struct tty *tp)
2451 {
2452 
2453 	KASSERT(mutex_owned(&tty_lock));
2454 
2455 	if (!ISSET(tp->t_state, TS_CNTTB))
2456 		CLR(tp->t_lflag, FLUSHO);
2457 	if ((!ISSET(tp->t_lflag, ECHO) &&
2458 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2459 	    ISSET(tp->t_lflag, EXTPROC))
2460 		return;
2461 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2462 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2463 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2464 		(void)ttyoutput('^', tp);
2465 		CLR(c, ~TTY_CHARMASK);
2466 		if (c == 0177)
2467 			c = '?';
2468 		else
2469 			c += 'A' - 1;
2470 	}
2471 	(void)ttyoutput(c, tp);
2472 }
2473 
2474 /*
2475  * Wake up any readers on a tty.
2476  * Called with tty lock held.
2477  */
2478 void
2479 ttwakeup(struct tty *tp)
2480 {
2481 
2482 	KASSERT(mutex_owned(&tty_lock));
2483 
2484 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2485 	if (ISSET(tp->t_state, TS_ASYNC))
2486 		ttysig(tp, TTYSIG_PG2, SIGIO);
2487 	cv_broadcast(&tp->t_rawcv);
2488 }
2489 
2490 /*
2491  * Look up a code for a specified speed in a conversion table;
2492  * used by drivers to map software speed values to hardware parameters.
2493  */
2494 int
2495 ttspeedtab(int speed, const struct speedtab *table)
2496 {
2497 
2498 	for (; table->sp_speed != -1; table++)
2499 		if (table->sp_speed == speed)
2500 			return (table->sp_code);
2501 	return (-1);
2502 }
2503 
2504 /*
2505  * Set tty hi and low water marks.
2506  *
2507  * Try to arrange the dynamics so there's about one second
2508  * from hi to low water.
2509  */
2510 void
2511 ttsetwater(struct tty *tp)
2512 {
2513 	int	cps, x;
2514 
2515 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2516 
2517 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2518 
2519 	cps = tp->t_ospeed / 10;
2520 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2521 	x += cps;
2522 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2523 	tp->t_hiwat = roundup(x, TTROUND);
2524 #undef	CLAMP
2525 }
2526 
2527 /*
2528  * Prepare report on state of foreground process group.
2529  * Call with proc_lock held.
2530  */
2531 void
2532 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2533 {
2534 	struct lwp	*l;
2535 	struct proc	*p, *pick = NULL;
2536 	struct timeval	utime, stime;
2537 	int		tmp;
2538 	fixpt_t		pctcpu = 0;
2539 	const char	*msg;
2540 	char		lmsg[100];
2541 	long		rss;
2542 
2543 	KASSERT(mutex_owned(proc_lock));
2544 
2545 	*buf = '\0';
2546 
2547 	if (tp->t_session == NULL)
2548 		msg = "not a controlling terminal\n";
2549 	else if (tp->t_pgrp == NULL)
2550 		msg = "no foreground process group\n";
2551 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2552 		msg = "empty foreground process group\n";
2553 	else {
2554 		/* Pick interesting process. */
2555 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2556 			struct proc *oldpick;
2557 
2558 			if (pick == NULL) {
2559 				pick = p;
2560 				continue;
2561 			}
2562 			if (pick->p_lock < p->p_lock) {
2563 				mutex_enter(pick->p_lock);
2564 				mutex_enter(p->p_lock);
2565 			} else if (pick->p_lock > p->p_lock) {
2566 				mutex_enter(p->p_lock);
2567 				mutex_enter(pick->p_lock);
2568 			} else
2569 				mutex_enter(p->p_lock);
2570 			oldpick = pick;
2571 			if (proc_compare_wrapper(pick, p))
2572 				pick = p;
2573 			mutex_exit(p->p_lock);
2574 			if (p->p_lock != oldpick->p_lock)
2575 				mutex_exit(oldpick->p_lock);
2576 		}
2577 		if (fromsig &&
2578 		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2579 		    SA_NOKERNINFO))
2580 			return;
2581 		msg = NULL;
2582 	}
2583 
2584 	/* Print load average. */
2585 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2586 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2587 	strlcat(buf, lmsg, bufsz);
2588 
2589 	if (pick == NULL) {
2590 		strlcat(buf, msg, bufsz);
2591 		return;
2592 	}
2593 
2594 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2595 	    pick->p_pid);
2596 	strlcat(buf, lmsg, bufsz);
2597 
2598 	mutex_enter(pick->p_lock);
2599 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2600 		const char *lp;
2601 		lwp_lock(l);
2602 #ifdef LWP_PC
2603 #define FMT_RUN "%#"PRIxVADDR
2604 #define VAL_RUNNING (vaddr_t)LWP_PC(l)
2605 #define VAL_RUNABLE (vaddr_t)LWP_PC(l)
2606 #else
2607 #define FMT_RUN "%s"
2608 #define VAL_RUNNING "running"
2609 #define VAL_RUNABLE "runnable"
2610 #endif
2611 		switch (l->l_stat) {
2612 		case LSONPROC:
2613 			snprintf(lmsg, sizeof(lmsg), FMT_RUN"/%d", VAL_RUNNING,
2614 			    cpu_index(l->l_cpu));
2615 			lp = lmsg;
2616 			break;
2617 		case LSRUN:
2618 			snprintf(lmsg, sizeof(lmsg), FMT_RUN, VAL_RUNABLE);
2619 			lp = lmsg;
2620 			break;
2621 		default:
2622 			lp = l->l_wchan ? l->l_wmesg : "iowait";
2623 			break;
2624 		}
2625 		strlcat(buf, lp, bufsz);
2626 		strlcat(buf, LIST_NEXT(l, l_sibling) != NULL ? " " : "] ",
2627 		    bufsz);
2628 		pctcpu += l->l_pctcpu;
2629 		lwp_unlock(l);
2630 	}
2631 	pctcpu += pick->p_pctcpu;
2632 	calcru(pick, &utime, &stime, NULL, NULL);
2633 	mutex_exit(pick->p_lock);
2634 
2635 	/* Round up and print user+system time, %CPU and RSS. */
2636 	utime.tv_usec += 5000;
2637 	if (utime.tv_usec >= 1000000) {
2638 		utime.tv_sec += 1;
2639 		utime.tv_usec -= 1000000;
2640 	}
2641 	stime.tv_usec += 5000;
2642 	if (stime.tv_usec >= 1000000) {
2643 		stime.tv_sec += 1;
2644 		stime.tv_usec -= 1000000;
2645 	}
2646 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2647 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2648 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2649 		rss = 0;
2650 	else
2651 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2652 
2653 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2654 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2655 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2656 	    tmp / 100, rss);
2657 	strlcat(buf, lmsg, bufsz);
2658 }
2659 
2660 /*
2661  * Print report on state of foreground process group.
2662  * Call with tty_lock held.
2663  */
2664 void
2665 ttyputinfo(struct tty *tp, char *buf)
2666 {
2667 
2668 	KASSERT(mutex_owned(&tty_lock));
2669 
2670 	if (ttycheckoutq_wlock(tp, 0) == 0)
2671 		return;
2672 	ttyprintf_nolock(tp, "%s\n", buf);
2673 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2674 }
2675 
2676 /*
2677  * Returns 1 if p2 has a better chance being the active foreground process
2678  * in a terminal instead of p1.
2679  */
2680 static int
2681 proc_compare_wrapper(struct proc *p1, struct proc *p2)
2682 {
2683 	lwp_t *l1, *l2;
2684 
2685 	KASSERT(mutex_owned(p1->p_lock));
2686 	KASSERT(mutex_owned(p2->p_lock));
2687 
2688 	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2689 		return 1;
2690 
2691 	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2692 		return 0;
2693 
2694 	return proc_compare(p1, l1, p2, l2);
2695 }
2696 
2697 /*
2698  * Output char to tty; console putchar style.
2699  * Can be called with tty lock held through kprintf() machinery..
2700  */
2701 int
2702 tputchar(int c, int flags, struct tty *tp)
2703 {
2704 	int r = 0;
2705 
2706 	if ((flags & NOLOCK) == 0)
2707 		mutex_spin_enter(&tty_lock);
2708 	if (!CONNECTED(tp)) {
2709 		r = -1;
2710 		goto out;
2711 	}
2712 	if (c == '\n')
2713 		(void)ttyoutput('\r', tp);
2714 	(void)ttyoutput(c, tp);
2715 	ttstart(tp);
2716 out:
2717 	if ((flags & NOLOCK) == 0)
2718 		mutex_spin_exit(&tty_lock);
2719 	return (r);
2720 }
2721 
2722 /*
2723  * Sleep on chan, returning ERESTART if tty changed while we napped and
2724  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by
2725  * cv_timedwait(_sig).
2726  * If the tty is revoked, restarting a pending call will redo validation done
2727  * at the start of the call.
2728  *
2729  * Must be called with the tty lock held.
2730  */
2731 int
2732 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch_p, int timo)
2733 {
2734 	int	error;
2735 	short	gen;
2736 
2737 	KASSERT(mutex_owned(&tty_lock));
2738 
2739 	gen = tp->t_gen;
2740 	if (cv == NULL)
2741 		error = kpause("ttypause", catch_p, timo, &tty_lock);
2742 	else if (catch_p)
2743 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2744 	else
2745 		error = cv_timedwait(cv, &tty_lock, timo);
2746 	if (error != 0)
2747 		return (error);
2748 	return (tp->t_gen == gen ? 0 : ERESTART);
2749 }
2750 
2751 int
2752 ttypause(struct tty *tp, int timo)
2753 {
2754 	int error;
2755 
2756 	error = ttysleep(tp, NULL, true, timo);
2757 	if (error == EWOULDBLOCK)
2758 		error = 0;
2759 	return error;
2760 }
2761 
2762 /*
2763  * Attach a tty to the tty list.
2764  *
2765  * This should be called ONLY once per real tty (including pty's).
2766  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2767  * distinctly NOT usable as tty's, and thus should not be attached to
2768  * the ttylist.  This is why this call is not done from tty_alloc().
2769  *
2770  * Device drivers should attach tty's at a similar time that they are
2771  * allocated, or, for the case of statically allocated struct tty's
2772  * either in the attach or (first) open routine.
2773  */
2774 void
2775 tty_attach(struct tty *tp)
2776 {
2777 
2778 	mutex_spin_enter(&tty_lock);
2779 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2780 	++tty_count;
2781 	mutex_spin_exit(&tty_lock);
2782 }
2783 
2784 /*
2785  * Remove a tty from the tty list.
2786  */
2787 void
2788 tty_detach(struct tty *tp)
2789 {
2790 
2791 	mutex_spin_enter(&tty_lock);
2792 	--tty_count;
2793 #ifdef DIAGNOSTIC
2794 	if (tty_count < 0)
2795 		panic("tty_detach: tty_count < 0");
2796 #endif
2797 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2798 	mutex_spin_exit(&tty_lock);
2799 }
2800 
2801 /*
2802  * Allocate a tty structure and its associated buffers.
2803  */
2804 struct tty *
2805 tty_alloc(void)
2806 {
2807 	struct tty *tp;
2808 	int i;
2809 
2810 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2811 	callout_init(&tp->t_rstrt_ch, 0);
2812 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2813 	tp->t_qsize = tty_qsize;
2814 	clalloc(&tp->t_rawq, tp->t_qsize, 1);
2815 	cv_init(&tp->t_rawcv, "ttyraw");
2816 	cv_init(&tp->t_rawcvf, "ttyrawf");
2817 	clalloc(&tp->t_canq, tp->t_qsize, 1);
2818 	cv_init(&tp->t_cancv, "ttycan");
2819 	cv_init(&tp->t_cancvf, "ttycanf");
2820 	/* output queue doesn't need quoting */
2821 	clalloc(&tp->t_outq, tp->t_qsize, 0);
2822 	cv_init(&tp->t_outcv, "ttyout");
2823 	cv_init(&tp->t_outcvf, "ttyoutf");
2824 	/* Set default line discipline. */
2825 	tp->t_linesw = ttyldisc_default();
2826 	tp->t_dev = NODEV;
2827 	selinit(&tp->t_rsel);
2828 	selinit(&tp->t_wsel);
2829 	for (i = 0; i < TTYSIG_COUNT; i++)  {
2830 		sigemptyset(&tp->t_sigs[i]);
2831 	}
2832 
2833 	return tp;
2834 }
2835 
2836 /*
2837  * Free a tty structure and its buffers.
2838  *
2839  * Be sure to call tty_detach() for any tty that has been
2840  * tty_attach()ed.
2841  */
2842 void
2843 tty_free(struct tty *tp)
2844 {
2845 	int i;
2846 
2847 	mutex_enter(proc_lock);
2848 	mutex_enter(&tty_lock);
2849 	for (i = 0; i < TTYSIG_COUNT; i++)
2850 		sigemptyset(&tp->t_sigs[i]);
2851 	if (tp->t_sigcount != 0)
2852 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2853 	mutex_exit(&tty_lock);
2854 	mutex_exit(proc_lock);
2855 
2856 	callout_halt(&tp->t_rstrt_ch, NULL);
2857 	callout_destroy(&tp->t_rstrt_ch);
2858 	ttyldisc_release(tp->t_linesw);
2859 	clfree(&tp->t_rawq);
2860 	clfree(&tp->t_canq);
2861 	clfree(&tp->t_outq);
2862 	cv_destroy(&tp->t_rawcv);
2863 	cv_destroy(&tp->t_rawcvf);
2864 	cv_destroy(&tp->t_cancv);
2865 	cv_destroy(&tp->t_cancvf);
2866 	cv_destroy(&tp->t_outcv);
2867 	cv_destroy(&tp->t_outcvf);
2868 	seldestroy(&tp->t_rsel);
2869 	seldestroy(&tp->t_wsel);
2870 	kmem_free(tp, sizeof(*tp));
2871 }
2872 
2873 /*
2874  * ttyprintf_nolock: send a message to a specific tty, without locking.
2875  *
2876  * => should be used only by tty driver or anything that knows the
2877  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2878  *    use tprintf]
2879  */
2880 static void
2881 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2882 {
2883 	va_list ap;
2884 
2885 	/* No mutex needed; going to process TTY. */
2886 	va_start(ap, fmt);
2887 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2888 	va_end(ap);
2889 }
2890 
2891 static int
2892 tty_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
2893     void *arg0, void *arg1, void *arg2, void *arg3)
2894 {
2895 	struct tty *tty;
2896 	int result;
2897 
2898 	result = KAUTH_RESULT_DEFER;
2899 
2900 	if (action != KAUTH_DEVICE_TTY_OPEN)
2901 		return result;
2902 
2903 	tty = arg0;
2904 
2905 	/* If it's not opened, we allow. */
2906 	if ((tty->t_state & TS_ISOPEN) == 0)
2907 		result = KAUTH_RESULT_ALLOW;
2908 	else {
2909 		/*
2910 		 * If it's opened, we can only allow if it's not exclusively
2911 		 * opened; otherwise, that's a privileged operation and we
2912 		 * let the secmodel handle it.
2913 		 */
2914 		if ((tty->t_state & TS_XCLUDE) == 0)
2915 			result = KAUTH_RESULT_ALLOW;
2916 	}
2917 
2918 	return result;
2919 }
2920 
2921 /*
2922  * Initialize the tty subsystem.
2923  */
2924 void
2925 tty_init(void)
2926 {
2927 
2928 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2929 	rw_init(&ttcompat_lock);
2930 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2931 	KASSERT(tty_sigsih != NULL);
2932 
2933 	tty_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
2934 	    tty_listener_cb, NULL);
2935 
2936 	sysctl_kern_tty_setup();
2937 }
2938 
2939 /*
2940  * Send a signal from a tty to its process group or session leader.
2941  * Handoff to the target is deferred to a soft interrupt.
2942  */
2943 void
2944 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2945 {
2946 	sigset_t *sp;
2947 
2948 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2949 
2950 	sp = &tp->t_sigs[st];
2951 	if (sigismember(sp, sig))
2952 		return;
2953 	sigaddset(sp, sig);
2954 	if (tp->t_sigcount++ == 0)
2955 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2956 	softint_schedule(tty_sigsih);
2957 }
2958 
2959 /*
2960  * Deliver deferred signals from ttys.  Note that the process groups
2961  * and sessions associated with the ttys may have changed from when
2962  * the signal was originally sent, but in practice it should not matter.
2963  * For signals produced as a result of a syscall, the soft interrupt
2964  * will fire before the syscall returns to the user.
2965  */
2966 static void
2967 ttysigintr(void *cookie)
2968 {
2969 	struct tty *tp;
2970 	enum ttysigtype st;
2971 	struct pgrp *pgrp;
2972 	struct session *sess;
2973 	int sig, lflag;
2974 	char infobuf[200];
2975 
2976 	mutex_enter(proc_lock);
2977 	mutex_spin_enter(&tty_lock);
2978 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2979 		KASSERT(tp->t_sigcount > 0);
2980 		for (st = TTYSIG_PG1; st < TTYSIG_COUNT; st++) {
2981 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2982 				break;
2983 		}
2984 		KASSERT(st < TTYSIG_COUNT);
2985 		sigdelset(&tp->t_sigs[st], sig);
2986 		if (--tp->t_sigcount == 0)
2987 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2988 		pgrp = tp->t_pgrp;
2989 		sess = tp->t_session;
2990 		lflag = tp->t_lflag;
2991 		if  (sig == SIGINFO) {
2992 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2993 				/* Via ioctl: ignore tty option. */
2994 				tp->t_state &= ~TS_SIGINFO;
2995 				lflag |= ISIG;
2996 			}
2997 			if (!ISSET(lflag, NOKERNINFO)) {
2998 				mutex_spin_exit(&tty_lock);
2999 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
3000 				mutex_spin_enter(&tty_lock);
3001 				ttyputinfo(tp, infobuf);
3002 			}
3003 			if (!ISSET(lflag, ISIG))
3004 				continue;
3005 		}
3006 		mutex_spin_exit(&tty_lock);
3007 		KASSERT(sig != 0);
3008 		switch (st) {
3009 		case TTYSIG_PG1:
3010 			if (pgrp != NULL)
3011 				pgsignal(pgrp, sig, 1);
3012 			break;
3013 		case TTYSIG_PG2:
3014 			if (pgrp != NULL)
3015 				pgsignal(pgrp, sig, sess != NULL);
3016 			break;
3017 		case TTYSIG_LEADER:
3018 			if (sess != NULL && sess->s_leader != NULL)
3019 				psignal(sess->s_leader, sig);
3020 			break;
3021 		default:
3022 			/* NOTREACHED */
3023 			break;
3024 		}
3025 		mutex_spin_enter(&tty_lock);
3026 	}
3027 	mutex_spin_exit(&tty_lock);
3028 	mutex_exit(proc_lock);
3029 }
3030 
3031 unsigned char
3032 tty_getctrlchar(struct tty *tp, unsigned which)
3033 {
3034 	KASSERT(which < NCCS);
3035 	return tp->t_cc[which];
3036 }
3037 
3038 void
3039 tty_setctrlchar(struct tty *tp, unsigned which, unsigned char val)
3040 {
3041 	KASSERT(which < NCCS);
3042 	tp->t_cc[which] = val;
3043 }
3044 
3045 int
3046 tty_try_xonxoff(struct tty *tp, unsigned char c)
3047 {
3048     const struct cdevsw *cdev;
3049 
3050     if (tp->t_iflag & IXON) {
3051 	if (c == tp->t_cc[VSTOP] && tp->t_cc[VSTOP] != _POSIX_VDISABLE) {
3052 	    if ((tp->t_state & TS_TTSTOP) == 0) {
3053 		tp->t_state |= TS_TTSTOP;
3054 		cdev = cdevsw_lookup(tp->t_dev);
3055 		if (cdev != NULL)
3056 			(*cdev->d_stop)(tp, 0);
3057 	    }
3058 	    return 0;
3059 	}
3060 	if (c == tp->t_cc[VSTART] && tp->t_cc[VSTART] != _POSIX_VDISABLE) {
3061 	    tp->t_state &= ~TS_TTSTOP;
3062 	    if (tp->t_oproc != NULL) {
3063 	        mutex_spin_enter(&tty_lock);	/* XXX */
3064 		(*tp->t_oproc)(tp);
3065 	        mutex_spin_exit(&tty_lock);	/* XXX */
3066 	    }
3067 	    return 0;
3068 	}
3069     }
3070     return EAGAIN;
3071 }
3072