xref: /dflybsd-src/sys/kern/tty.c (revision 22ff886e5769d1e8d4bf7faa7bdb9f608ede1714)
1 /*-
2  * (MPSAFE)
3  *
4  * Copyright (c) 1982, 1986, 1990, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by the University of
23  *	California, Berkeley and its contributors.
24  * 4. Neither the name of the University nor the names of its contributors
25  *    may be used to endorse or promote products derived from this software
26  *    without specific prior written permission.
27  *
28  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
29  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
32  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38  * SUCH DAMAGE.
39  *
40  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
41  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
42  * $DragonFly: src/sys/kern/tty.c,v 1.46 2008/09/10 09:50:09 y0netan1 Exp $
43  */
44 
45 /*
46  * MPSAFE NOTE:
47  * Almost all functions in this file are acquiring the tty token due to their
48  * access and modifications of the 'tp' (struct tty) objects.
49  */
50 
51 /*-
52  * TODO:
53  *	o Fix races for sending the start char in ttyflush().
54  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
55  *	  With luck, there will be MIN chars before select() returns().
56  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
57  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
58  *	  FIONREAD.
59  *	o Do the new sio locking stuff here and use it to avoid special
60  *	  case for EXTPROC?
61  *	o Lock PENDIN too?
62  *	o Move EXTPROC and/or PENDIN to t_state?
63  *	o Wrap most of ttioctl in spltty/splx.
64  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
65  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
66  *	o Don't allow certain termios flags to affect disciplines other
67  *	  than TTYDISC.  Cancel their effects before switch disciplines
68  *	  and ignore them if they are set while we are in another
69  *	  discipline.
70  *	o Now that historical speed conversions are handled here, don't
71  *	  do them in drivers.
72  *	o Check for TS_CARR_ON being set while everything is closed and not
73  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
74  *	  so it would live until the next open even if carrier drops.
75  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
76  *	  only when _all_ openers leave open().
77  */
78 
79 #include "opt_compat.h"
80 #include "opt_uconsole.h"
81 
82 #include <sys/param.h>
83 #include <sys/systm.h>
84 #include <sys/filio.h>
85 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
86 #include <sys/ioctl_compat.h>
87 #endif
88 #include <sys/proc.h>
89 #include <sys/priv.h>
90 #define	TTYDEFCHARS
91 #include <sys/tty.h>
92 #include <sys/clist.h>
93 #undef	TTYDEFCHARS
94 #include <sys/fcntl.h>
95 #include <sys/conf.h>
96 #include <sys/dkstat.h>
97 #include <sys/kernel.h>
98 #include <sys/vnode.h>
99 #include <sys/signalvar.h>
100 #include <sys/signal2.h>
101 #include <sys/resourcevar.h>
102 #include <sys/malloc.h>
103 #include <sys/filedesc.h>
104 #include <sys/sysctl.h>
105 #include <sys/thread2.h>
106 
107 #include <vm/vm.h>
108 #include <sys/lock.h>
109 #include <vm/pmap.h>
110 #include <vm/vm_map.h>
111 
112 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
113 
114 static int	proc_compare (struct proc *p1, struct proc *p2);
115 static int	ttnread (struct tty *tp);
116 static void	ttyecho (int c, struct tty *tp);
117 static int	ttyoutput (int c, struct tty *tp);
118 static void	ttypend (struct tty *tp);
119 static void	ttyretype (struct tty *tp);
120 static void	ttyrub (int c, struct tty *tp);
121 static void	ttyrubo (struct tty *tp, int cnt);
122 static void	ttyunblock (struct tty *tp);
123 static int	ttywflush (struct tty *tp);
124 static int	filt_ttyread (struct knote *kn, long hint);
125 static void 	filt_ttyrdetach (struct knote *kn);
126 static int	filt_ttywrite (struct knote *kn, long hint);
127 static void 	filt_ttywdetach (struct knote *kn);
128 
129 /*
130  * Table with character classes and parity. The 8th bit indicates parity,
131  * the 7th bit indicates the character is an alphameric or underscore (for
132  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
133  * are 0 then the character needs no special processing on output; classes
134  * other than 0 might be translated or (not currently) require delays.
135  */
136 #define	E	0x00	/* Even parity. */
137 #define	O	0x80	/* Odd parity. */
138 #define	PARITY(c)	(char_type[c] & O)
139 
140 #define	ALPHA	0x40	/* Alpha or underscore. */
141 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
142 
143 #define	CCLASSMASK	0x3f
144 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
145 
146 #define	BS	BACKSPACE
147 #define	CC	CONTROL
148 #define	CR	RETURN
149 #define	NA	ORDINARY | ALPHA
150 #define	NL	NEWLINE
151 #define	NO	ORDINARY
152 #define	TB	TAB
153 #define	VT	VTAB
154 
155 static u_char const char_type[] = {
156 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
157 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
158 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
159 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
160 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
161 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
162 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
163 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
164 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
165 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
166 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
167 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
168 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
169 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
170 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
171 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
172 	/*
173 	 * Meta chars; should be settable per character set;
174 	 * for now, treat them all as normal characters.
175 	 */
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
186 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
187 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
188 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
189 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
190 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
191 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
192 };
193 #undef	BS
194 #undef	CC
195 #undef	CR
196 #undef	NA
197 #undef	NL
198 #undef	NO
199 #undef	TB
200 #undef	VT
201 
202 /* Macros to clear/set/test flags. */
203 #define	SET(t, f)	(t) |= (f)
204 #define	CLR(t, f)	(t) &= ~(f)
205 #define	ISSET(t, f)	((t) & (f))
206 
207 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
208 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
209 
210 uint64_t tk_nin;
211 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
212     "LU", "TTY input statistic");
213 uint64_t tk_nout;
214 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
215     "LU", "TTY output statistic");
216 uint64_t tk_rawcc;
217 
218 /*
219  * list of struct tty where pstat(8) can pick it up with sysctl
220  */
221 static TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
222 
223 /*
224  * Initial open of tty, or (re)entry to standard tty line discipline.
225  */
226 int
227 ttyopen(cdev_t device, struct tty *tp)
228 {
229 	crit_enter();
230 	lwkt_gettoken(&tty_token);
231 	tp->t_dev = device;
232 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
233 		SET(tp->t_state, TS_ISOPEN);
234 		if (ISSET(tp->t_cflag, CLOCAL)) {
235 			SET(tp->t_state, TS_CONNECTED);
236 		}
237 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
238 	}
239 	ttsetwater(tp);
240 	lwkt_reltoken(&tty_token);
241 	crit_exit();
242 	return (0);
243 }
244 
245 /*
246  * Handle close() on a tty line: flush and set to initial state,
247  * bumping generation number so that pending read/write calls
248  * can detect recycling of the tty.
249  *
250  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
251  * and l_close() should have flushed, but we repeat the spltty() and
252  * the flush in case there are buggy callers.
253  */
254 int
255 ttyclose(struct tty *tp)
256 {
257 	crit_enter();
258 	lwkt_gettoken(&tty_token);
259 	funsetown(tp->t_sigio);
260 	if (constty == tp)
261 		constty = NULL;
262 
263 	ttyflush(tp, FREAD | FWRITE);
264 	clist_free_cblocks(&tp->t_canq);
265 	clist_free_cblocks(&tp->t_outq);
266 	clist_free_cblocks(&tp->t_rawq);
267 
268 	tp->t_gen++;
269 	tp->t_line = TTYDISC;
270 	ttyclearsession(tp);
271 	tp->t_state &= TS_REGISTERED;	/* clear all bits except */
272 	lwkt_reltoken(&tty_token);
273 	crit_exit();
274 	return (0);
275 }
276 
277 /*
278  * Disassociate the tty from its session.  Traditionally this has only been
279  * a half-close, meaning that the session was still allowed to point at the
280  * tty (resulting in the tty in the ps command showing something like 'p0-'),
281  * even though the tty is no longer pointing at the session.
282  *
283  * The half close seems to be useful only for 'ps' output but there is as
284  * yet no reason to remove the feature.  The full-close code is currently
285  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
286  */
287 void
288 ttyclearsession(struct tty *tp)
289 {
290 	struct session *sp;
291 
292 	lwkt_gettoken(&tty_token);
293 	tp->t_pgrp = NULL;
294 	if ((sp = tp->t_session) != NULL) {
295 		tp->t_session = NULL;
296 #ifdef TTY_DO_FULL_CLOSE
297 		/* FULL CLOSE (not yet) */
298 		if (sp->s_ttyp == tp) {
299 			sp->s_ttyp = NULL;
300 			ttyunhold(tp);
301 		} else {
302 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
303 				"%p/%p\n", sp->s_ttyp, tp);
304 		}
305 #endif
306 	}
307 	lwkt_reltoken(&tty_token);
308 }
309 
310 /*
311  * Release the tty vnode association for a session.  This is the
312  * 'other half' of the close.  Because multiple opens of /dev/tty
313  * only generate a single open to the actual tty, the file modes
314  * are locked to FREAD|FWRITE.
315  *
316  * If dorevoke is non-zero, the session is also revoked.  We have to
317  * close the vnode if VCTTYISOPEN is set.
318  */
319 void
320 ttyclosesession(struct session *sp, int dorevoke)
321 {
322 	struct vnode *vp;
323 
324 	lwkt_gettoken(&tty_token);
325 retry:
326 	/*
327 	 * There may not be a controlling terminal or it may have been closed
328 	 * out from under us.
329 	 */
330 	if ((vp = sp->s_ttyvp) == NULL) {
331 		lwkt_reltoken(&tty_token);
332 		return;
333 	}
334 
335 	/*
336 	 * We need a lock if we have to close or revoke.
337 	 */
338 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
339 		vhold(vp);
340 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
341 			vdrop(vp);
342 			goto retry;
343 		}
344 
345 		/*
346 		 * Retry if the vnode was ripped out from under us
347 		 */
348 		if (vp != sp->s_ttyvp) {
349 			vn_unlock(vp);
350 			vdrop(vp);
351 			goto retry;
352 		}
353 
354 		/*
355 		 * Close and revoke as needed
356 		 */
357 		sp->s_ttyvp = NULL;
358 		if (vp->v_flag & VCTTYISOPEN) {
359 			vclrflags(vp, VCTTYISOPEN);
360 			VOP_CLOSE(vp, FREAD|FWRITE);
361 		}
362 		vn_unlock(vp);
363 		if (dorevoke)
364 			vrevoke(vp, proc0.p_ucred);
365 		vdrop(vp);
366 	} else {
367 		sp->s_ttyvp = NULL;
368 	}
369 	vrele(vp);
370 	lwkt_reltoken(&tty_token);
371 }
372 
373 #define	FLUSHQ(q) {							\
374 	if ((q)->c_cc)							\
375 		ndflush(q, (q)->c_cc);					\
376 }
377 
378 /* Is 'c' a line delimiter ("break" character)? */
379 #define	TTBREAKC(c, lflag)							\
380 	((c) == '\n' || (((c) == cc[VEOF] ||				\
381 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
382 	 (c) != _POSIX_VDISABLE))
383 
384 /*
385  * Process input of a single character received on a tty.
386  */
387 int
388 ttyinput(int c, struct tty *tp)
389 {
390 	tcflag_t iflag, lflag;
391 	cc_t *cc;
392 	int i, err;
393 
394 	lwkt_gettoken(&tty_token);
395 	/*
396 	 * If input is pending take it first.
397 	 */
398 	lflag = tp->t_lflag;
399 	if (ISSET(lflag, PENDIN))
400 		ttypend(tp);
401 	/*
402 	 * Gather stats.
403 	 */
404 	if (ISSET(lflag, ICANON))
405 		++tp->t_cancc;
406 	else
407 		++tp->t_rawcc;
408 	++tk_nin;
409 
410 	/*
411 	 * Block further input iff:
412 	 * current input > threshold AND input is available to user program
413 	 * AND input flow control is enabled and not yet invoked.
414 	 * The 3 is slop for PARMRK.
415 	 */
416 	iflag = tp->t_iflag;
417 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
418 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
419 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
420 	    !ISSET(tp->t_state, TS_TBLOCK))
421 		ttyblock(tp);
422 
423 	/* Handle exceptional conditions (break, parity, framing). */
424 	cc = tp->t_cc;
425 	err = (ISSET(c, TTY_ERRORMASK));
426 	if (err) {
427 		CLR(c, TTY_ERRORMASK);
428 		if (ISSET(err, TTY_BI)) {
429 			if (ISSET(iflag, IGNBRK)) {
430 				lwkt_reltoken(&tty_token);
431 				return (0);
432 			}
433 			if (ISSET(iflag, BRKINT)) {
434 				ttyflush(tp, FREAD | FWRITE);
435 				pgsignal(tp->t_pgrp, SIGINT, 1);
436 				goto endcase;
437 			}
438 			if (ISSET(iflag, PARMRK))
439 				goto parmrk;
440 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
441 			|| ISSET(err, TTY_FE)) {
442 			if (ISSET(iflag, IGNPAR)) {
443 				lwkt_reltoken(&tty_token);
444 				return (0);
445 			}
446 			else if (ISSET(iflag, PARMRK)) {
447 parmrk:
448 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
449 				    MAX_INPUT - 3)
450 					goto input_overflow;
451 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
452 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
453 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
454 				goto endcase;
455 			} else
456 				c = 0;
457 		}
458 	}
459 
460 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
461 		CLR(c, 0x80);
462 	if (!ISSET(lflag, EXTPROC)) {
463 		/*
464 		 * Check for literal nexting very first
465 		 */
466 		if (ISSET(tp->t_state, TS_LNCH)) {
467 			SET(c, TTY_QUOTE);
468 			CLR(tp->t_state, TS_LNCH);
469 		}
470 		/*
471 		 * Scan for special characters.  This code
472 		 * is really just a big case statement with
473 		 * non-constant cases.  The bottom of the
474 		 * case statement is labeled ``endcase'', so goto
475 		 * it after a case match, or similar.
476 		 */
477 
478 		/*
479 		 * Control chars which aren't controlled
480 		 * by ICANON, ISIG, or IXON.
481 		 */
482 		if (ISSET(lflag, IEXTEN)) {
483 			if (CCEQ(cc[VLNEXT], c)) {
484 				if (ISSET(lflag, ECHO)) {
485 					if (ISSET(lflag, ECHOE)) {
486 						(void)ttyoutput('^', tp);
487 						(void)ttyoutput('\b', tp);
488 					} else
489 						ttyecho(c, tp);
490 				}
491 				SET(tp->t_state, TS_LNCH);
492 				goto endcase;
493 			}
494 			if (CCEQ(cc[VDISCARD], c)) {
495 				if (ISSET(lflag, FLUSHO))
496 					CLR(tp->t_lflag, FLUSHO);
497 				else {
498 					ttyflush(tp, FWRITE);
499 					ttyecho(c, tp);
500 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
501 						ttyretype(tp);
502 					SET(tp->t_lflag, FLUSHO);
503 				}
504 				goto startoutput;
505 			}
506 		}
507 		/*
508 		 * Signals.
509 		 */
510 		if (ISSET(lflag, ISIG)) {
511 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
512 				if (!ISSET(lflag, NOFLSH))
513 					ttyflush(tp, FREAD | FWRITE);
514 				ttyecho(c, tp);
515 				pgsignal(tp->t_pgrp,
516 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
517 				goto endcase;
518 			}
519 			if (CCEQ(cc[VSUSP], c)) {
520 				if (!ISSET(lflag, NOFLSH))
521 					ttyflush(tp, FREAD);
522 				ttyecho(c, tp);
523 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
524 				goto endcase;
525 			}
526 		}
527 		/*
528 		 * Handle start/stop characters.
529 		 */
530 		if (ISSET(iflag, IXON)) {
531 			if (CCEQ(cc[VSTOP], c)) {
532 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
533 					SET(tp->t_state, TS_TTSTOP);
534 					(*tp->t_stop)(tp, 0);
535 					lwkt_reltoken(&tty_token);
536 					return (0);
537 				}
538 				if (!CCEQ(cc[VSTART], c)) {
539 					lwkt_reltoken(&tty_token);
540 					return (0);
541 				}
542 				/*
543 				 * if VSTART == VSTOP then toggle
544 				 */
545 				goto endcase;
546 			}
547 			if (CCEQ(cc[VSTART], c))
548 				goto restartoutput;
549 		}
550 		/*
551 		 * IGNCR, ICRNL, & INLCR
552 		 */
553 		if (c == '\r') {
554 			if (ISSET(iflag, IGNCR)) {
555 				lwkt_reltoken(&tty_token);
556 				return (0);
557 			}
558 			else if (ISSET(iflag, ICRNL))
559 				c = '\n';
560 		} else if (c == '\n' && ISSET(iflag, INLCR))
561 			c = '\r';
562 	}
563 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
564 		/*
565 		 * From here on down canonical mode character
566 		 * processing takes place.
567 		 */
568 		/*
569 		 * erase or erase2 (^H / ^?)
570 		 */
571 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
572 			if (tp->t_rawq.c_cc)
573 				ttyrub(clist_unputc(&tp->t_rawq), tp);
574 			goto endcase;
575 		}
576 		/*
577 		 * kill (^U)
578 		 */
579 		if (CCEQ(cc[VKILL], c)) {
580 			if (ISSET(lflag, ECHOKE) &&
581 			    tp->t_rawq.c_cc == tp->t_rocount &&
582 			    !ISSET(lflag, ECHOPRT))
583 				while (tp->t_rawq.c_cc)
584 					ttyrub(clist_unputc(&tp->t_rawq), tp);
585 			else {
586 				ttyecho(c, tp);
587 				if (ISSET(lflag, ECHOK) ||
588 				    ISSET(lflag, ECHOKE))
589 					ttyecho('\n', tp);
590 				FLUSHQ(&tp->t_rawq);
591 				tp->t_rocount = 0;
592 			}
593 			CLR(tp->t_state, TS_LOCAL);
594 			goto endcase;
595 		}
596 		/*
597 		 * word erase (^W)
598 		 */
599 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
600 			int ctype;
601 
602 			/*
603 			 * erase whitespace
604 			 */
605 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
606 				ttyrub(c, tp);
607 			if (c == -1)
608 				goto endcase;
609 			/*
610 			 * erase last char of word and remember the
611 			 * next chars type (for ALTWERASE)
612 			 */
613 			ttyrub(c, tp);
614 			c = clist_unputc(&tp->t_rawq);
615 			if (c == -1)
616 				goto endcase;
617 			if (c == ' ' || c == '\t') {
618 				clist_putc(c, &tp->t_rawq);
619 				goto endcase;
620 			}
621 			ctype = ISALPHA(c);
622 			/*
623 			 * erase rest of word
624 			 */
625 			do {
626 				ttyrub(c, tp);
627 				c = clist_unputc(&tp->t_rawq);
628 				if (c == -1)
629 					goto endcase;
630 			} while (c != ' ' && c != '\t' &&
631 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
632 			clist_putc(c, &tp->t_rawq);
633 			goto endcase;
634 		}
635 		/*
636 		 * reprint line (^R)
637 		 */
638 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
639 			ttyretype(tp);
640 			goto endcase;
641 		}
642 		/*
643 		 * ^T - kernel info and generate SIGINFO
644 		 */
645 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
646 			if (ISSET(lflag, ISIG))
647 				pgsignal(tp->t_pgrp, SIGINFO, 1);
648 			if (!ISSET(lflag, NOKERNINFO))
649 				ttyinfo(tp);
650 			goto endcase;
651 		}
652 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
653 			if (ISSET(lflag, ISIG))
654 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
655 			goto endcase;
656 		}
657 	}
658 	/*
659 	 * Check for input buffer overflow
660 	 */
661 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
662 input_overflow:
663 		if (ISSET(iflag, IMAXBEL)) {
664 			if (tp->t_outq.c_cc < tp->t_ohiwat)
665 				(void)ttyoutput(CTRL('g'), tp);
666 		}
667 		goto endcase;
668 	}
669 
670 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
671 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
672 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
673 
674 	/*
675 	 * Put data char in q for user and
676 	 * wakeup on seeing a line delimiter.
677 	 */
678 	if (clist_putc(c, &tp->t_rawq) >= 0) {
679 		if (!ISSET(lflag, ICANON)) {
680 			ttwakeup(tp);
681 			ttyecho(c, tp);
682 			goto endcase;
683 		}
684 		if (TTBREAKC(c, lflag)) {
685 			tp->t_rocount = 0;
686 			catq(&tp->t_rawq, &tp->t_canq);
687 			ttwakeup(tp);
688 		} else if (tp->t_rocount++ == 0)
689 			tp->t_rocol = tp->t_column;
690 		if (ISSET(tp->t_state, TS_ERASE)) {
691 			/*
692 			 * end of prterase \.../
693 			 */
694 			CLR(tp->t_state, TS_ERASE);
695 			(void)ttyoutput('/', tp);
696 		}
697 		i = tp->t_column;
698 		ttyecho(c, tp);
699 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
700 			/*
701 			 * Place the cursor over the '^' of the ^D.
702 			 */
703 			i = imin(2, tp->t_column - i);
704 			while (i > 0) {
705 				(void)ttyoutput('\b', tp);
706 				i--;
707 			}
708 		}
709 	}
710 endcase:
711 	/*
712 	 * IXANY means allow any character to restart output.
713 	 */
714 	if (ISSET(tp->t_state, TS_TTSTOP) &&
715 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
716 		lwkt_reltoken(&tty_token);
717 		return (0);
718 	}
719 restartoutput:
720 	CLR(tp->t_lflag, FLUSHO);
721 	CLR(tp->t_state, TS_TTSTOP);
722 startoutput:
723 	lwkt_reltoken(&tty_token);
724 	return (ttstart(tp));
725 }
726 
727 /*
728  * Output a single character on a tty, doing output processing
729  * as needed (expanding tabs, newline processing, etc.).
730  * Returns < 0 if succeeds, otherwise returns char to resend.
731  * Must be recursive.
732  */
733 static int
734 ttyoutput(int c, struct tty *tp)
735 {
736 	tcflag_t oflag;
737 	int col;
738 
739 	lwkt_gettoken(&tty_token);
740 	oflag = tp->t_oflag;
741 	if (!ISSET(oflag, OPOST)) {
742 		if (ISSET(tp->t_lflag, FLUSHO)) {
743 			lwkt_reltoken(&tty_token);
744 			return (-1);
745 		}
746 		if (clist_putc(c, &tp->t_outq)) {
747 			lwkt_reltoken(&tty_token);
748 			return (c);
749 		}
750 		tk_nout++;
751 		tp->t_outcc++;
752 		lwkt_reltoken(&tty_token);
753 		return (-1);
754 	}
755 	/*
756 	 * Do tab expansion if OXTABS is set.  Special case if we external
757 	 * processing, we don't do the tab expansion because we'll probably
758 	 * get it wrong.  If tab expansion needs to be done, let it happen
759 	 * externally.
760 	 */
761 	CLR(c, ~TTY_CHARMASK);
762 	if (c == '\t' &&
763 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
764 		c = 8 - (tp->t_column & 7);
765 		if (!ISSET(tp->t_lflag, FLUSHO)) {
766 			crit_enter();		/* Don't interrupt tabs. */
767 			c -= b_to_q("        ", c, &tp->t_outq);
768 			tk_nout += c;
769 			tp->t_outcc += c;
770 			crit_exit();
771 		}
772 		tp->t_column += c;
773 		lwkt_reltoken(&tty_token);
774 		return (c ? -1 : '\t');
775 	}
776 	if (c == CEOT && ISSET(oflag, ONOEOT)) {
777 		lwkt_reltoken(&tty_token);
778 		return (-1);
779 	}
780 
781 	/*
782 	 * Newline translation: if ONLCR is set,
783 	 * translate newline into "\r\n".
784 	 */
785 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
786 		tk_nout++;
787 		tp->t_outcc++;
788 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq)) {
789 			lwkt_reltoken(&tty_token);
790 			return (c);
791 		}
792 	}
793 	/* If OCRNL is set, translate "\r" into "\n". */
794 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
795 		c = '\n';
796 	/* If ONOCR is set, don't transmit CRs when on column 0. */
797 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0) {
798 		lwkt_reltoken(&tty_token);
799 		return (-1);
800 	}
801 
802 	tk_nout++;
803 	tp->t_outcc++;
804 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq)) {
805 		lwkt_reltoken(&tty_token);
806 		return (c);
807 	}
808 
809 	col = tp->t_column;
810 	switch (CCLASS(c)) {
811 	case BACKSPACE:
812 		if (col > 0)
813 			--col;
814 		break;
815 	case CONTROL:
816 		break;
817 	case NEWLINE:
818 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
819 			col = 0;
820 		break;
821 	case RETURN:
822 		col = 0;
823 		break;
824 	case ORDINARY:
825 		++col;
826 		break;
827 	case TAB:
828 		col = (col + 8) & ~7;
829 		break;
830 	}
831 	tp->t_column = col;
832 	lwkt_reltoken(&tty_token);
833 	return (-1);
834 }
835 
836 /*
837  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
838  * has been called to do discipline-specific functions and/or reject any
839  * of these ioctl commands.
840  */
841 /* ARGSUSED */
842 int
843 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
844 {
845 	struct thread *td = curthread;
846 	struct lwp *lp = td->td_lwp;
847 	struct proc *p = td->td_proc;
848 	struct tty *otp;
849 	int error;
850 
851 	KKASSERT(p);
852 	lwkt_gettoken(&tty_token);
853 	lwkt_gettoken(&proc_token);
854 
855 	/* If the ioctl involves modification, hang if in the background. */
856 	switch (cmd) {
857 	case  TIOCCBRK:
858 	case  TIOCCONS:
859 	case  TIOCDRAIN:
860 	case  TIOCEXCL:
861 	case  TIOCFLUSH:
862 #ifdef TIOCHPCL
863 	case  TIOCHPCL:
864 #endif
865 	case  TIOCNXCL:
866 	case  TIOCSBRK:
867 	case  TIOCSCTTY:
868 	case  TIOCSDRAINWAIT:
869 	case  TIOCSETA:
870 	case  TIOCSETAF:
871 	case  TIOCSETAW:
872 	case  TIOCSETD:
873 	case  TIOCSPGRP:
874 	case  TIOCSTART:
875 	case  TIOCSTAT:
876 	case  TIOCSTI:
877 	case  TIOCSTOP:
878 	case  TIOCSWINSZ:
879 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
880 	case  TIOCLBIC:
881 	case  TIOCLBIS:
882 	case  TIOCLSET:
883 	case  TIOCSETC:
884 	case OTIOCSETD:
885 	case  TIOCSETN:
886 	case  TIOCSETP:
887 	case  TIOCSLTC:
888 #endif
889 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
890 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
891 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
892 			if (p->p_pgrp->pg_jobc == 0) {
893 				lwkt_reltoken(&proc_token);
894 				lwkt_reltoken(&tty_token);
895 				return (EIO);
896 			}
897 			pgsignal(p->p_pgrp, SIGTTOU, 1);
898 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
899 					 0);
900 			if (error) {
901 				lwkt_reltoken(&proc_token);
902 				lwkt_reltoken(&tty_token);
903 				return (error);
904 			}
905 		}
906 		break;
907 	}
908 
909 	switch (cmd) {			/* Process the ioctl. */
910 	case FIOASYNC:			/* set/clear async i/o */
911 		crit_enter();
912 		if (*(int *)data)
913 			SET(tp->t_state, TS_ASYNC);
914 		else
915 			CLR(tp->t_state, TS_ASYNC);
916 		crit_exit();
917 		break;
918 	case FIONREAD:			/* get # bytes to read */
919 		crit_enter();
920 		*(int *)data = ttnread(tp);
921 		crit_exit();
922 		break;
923 
924 	case FIOSETOWN:
925 		/*
926 		 * Policy -- Don't allow FIOSETOWN on someone else's
927 		 *           controlling tty
928 		 */
929 		if (tp->t_session != NULL && !isctty(p, tp)) {
930 			lwkt_reltoken(&proc_token);
931 			lwkt_reltoken(&tty_token);
932 			return (ENOTTY);
933 		}
934 
935 		error = fsetown(*(int *)data, &tp->t_sigio);
936 		if (error) {
937 			lwkt_reltoken(&proc_token);
938 			lwkt_reltoken(&tty_token);
939 			return (error);
940 		}
941 		break;
942 	case FIOGETOWN:
943 		if (tp->t_session != NULL && !isctty(p, tp)) {
944 			lwkt_reltoken(&proc_token);
945 			lwkt_reltoken(&tty_token);
946 			return (ENOTTY);
947 		}
948 		*(int *)data = fgetown(tp->t_sigio);
949 		break;
950 
951 	case TIOCEXCL:			/* set exclusive use of tty */
952 		crit_enter();
953 		SET(tp->t_state, TS_XCLUDE);
954 		crit_exit();
955 		break;
956 	case TIOCFLUSH: {		/* flush buffers */
957 		int flags = *(int *)data;
958 
959 		if (flags == 0)
960 			flags = FREAD | FWRITE;
961 		else
962 			flags &= FREAD | FWRITE;
963 		ttyflush(tp, flags);
964 		break;
965 	}
966 	case TIOCCONS:			/* become virtual console */
967 		if (*(int *)data) {
968 			if (constty && constty != tp &&
969 			    ISSET(constty->t_state, TS_CONNECTED)) {
970 				lwkt_reltoken(&proc_token);
971 				lwkt_reltoken(&tty_token);
972 				return (EBUSY);
973 			}
974 #ifndef	UCONSOLE
975 			if ((error = priv_check(td, PRIV_ROOT)) != 0) {
976 				lwkt_reltoken(&proc_token);
977 				lwkt_reltoken(&tty_token);
978 				return (error);
979 			}
980 #endif
981 			constty = tp;
982 		} else if (tp == constty)
983 			constty = NULL;
984 		break;
985 	case TIOCDRAIN:			/* wait till output drained */
986 		error = ttywait(tp);
987 		if (error) {
988 			lwkt_reltoken(&proc_token);
989 			lwkt_reltoken(&tty_token);
990 			return (error);
991 		}
992 		break;
993 	case TIOCGETA: {		/* get termios struct */
994 		struct termios *t = (struct termios *)data;
995 
996 		bcopy(&tp->t_termios, t, sizeof(struct termios));
997 		break;
998 	}
999 	case TIOCGETD:			/* get line discipline */
1000 		*(int *)data = tp->t_line;
1001 		break;
1002 	case TIOCGWINSZ:		/* get window size */
1003 		*(struct winsize *)data = tp->t_winsize;
1004 		break;
1005 	case TIOCGPGRP:			/* get pgrp of tty */
1006 		if (!isctty(p, tp)) {
1007 			lwkt_reltoken(&proc_token);
1008 			lwkt_reltoken(&tty_token);
1009 			return (ENOTTY);
1010 		}
1011 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1012 		break;
1013 	case TIOCGSID:                  /* get sid of tty */
1014 		if (!isctty(p, tp)) {
1015 			lwkt_reltoken(&proc_token);
1016 			lwkt_reltoken(&tty_token);
1017 			return (ENOTTY);
1018 		}
1019 		*(int *)data = tp->t_session->s_sid;
1020 		break;
1021 #ifdef TIOCHPCL
1022 	case TIOCHPCL:			/* hang up on last close */
1023 		crit_enter();
1024 		SET(tp->t_cflag, HUPCL);
1025 		crit_exit();
1026 		break;
1027 #endif
1028 	case TIOCNXCL:			/* reset exclusive use of tty */
1029 		crit_enter();
1030 		CLR(tp->t_state, TS_XCLUDE);
1031 		crit_exit();
1032 		break;
1033 	case TIOCOUTQ:			/* output queue size */
1034 		*(int *)data = tp->t_outq.c_cc;
1035 		break;
1036 	case TIOCSETA:			/* set termios struct */
1037 	case TIOCSETAW:			/* drain output, set */
1038 	case TIOCSETAF: {		/* drn out, fls in, set */
1039 		struct termios *t = (struct termios *)data;
1040 
1041 		if (t->c_ispeed == 0)
1042 			t->c_ispeed = t->c_ospeed;
1043 		if (t->c_ispeed == 0)
1044 			t->c_ispeed = tp->t_ospeed;
1045 		if (t->c_ispeed == 0) {
1046 			lwkt_reltoken(&proc_token);
1047 			lwkt_reltoken(&tty_token);
1048 			return (EINVAL);
1049 		}
1050 		crit_enter();
1051 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1052 			error = ttywait(tp);
1053 			if (error) {
1054 				crit_exit();
1055 				lwkt_reltoken(&proc_token);
1056 				lwkt_reltoken(&tty_token);
1057 				return (error);
1058 			}
1059 			if (cmd == TIOCSETAF)
1060 				ttyflush(tp, FREAD);
1061 		}
1062 		if (!ISSET(t->c_cflag, CIGNORE)) {
1063 			/*
1064 			 * Set device hardware.
1065 			 */
1066 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1067 				crit_exit();
1068 				lwkt_reltoken(&proc_token);
1069 				lwkt_reltoken(&tty_token);
1070 				return (error);
1071 			}
1072 			if (ISSET(t->c_cflag, CLOCAL) &&
1073 			    !ISSET(tp->t_cflag, CLOCAL)) {
1074 				/*
1075 				 * XXX disconnections would be too hard to
1076 				 * get rid of without this kludge.  The only
1077 				 * way to get rid of controlling terminals
1078 				 * is to exit from the session leader.
1079 				 */
1080 				CLR(tp->t_state, TS_ZOMBIE);
1081 
1082 				wakeup(TSA_CARR_ON(tp));
1083 				ttwakeup(tp);
1084 				ttwwakeup(tp);
1085 			}
1086 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1087 			     ISSET(t->c_cflag, CLOCAL)) &&
1088 			    !ISSET(tp->t_state, TS_ZOMBIE))
1089 				SET(tp->t_state, TS_CONNECTED);
1090 			else
1091 				CLR(tp->t_state, TS_CONNECTED);
1092 			tp->t_cflag = t->c_cflag;
1093 			tp->t_ispeed = t->c_ispeed;
1094 			if (t->c_ospeed != 0)
1095 				tp->t_ospeed = t->c_ospeed;
1096 			ttsetwater(tp);
1097 		}
1098 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1099 		    cmd != TIOCSETAF) {
1100 			if (ISSET(t->c_lflag, ICANON))
1101 				SET(tp->t_lflag, PENDIN);
1102 			else {
1103 				/*
1104 				 * XXX we really shouldn't allow toggling
1105 				 * ICANON while we're in a non-termios line
1106 				 * discipline.  Now we have to worry about
1107 				 * panicing for a null queue.
1108 				 */
1109 				if (tp->t_canq.c_cbreserved > 0 &&
1110 				    tp->t_rawq.c_cbreserved > 0) {
1111 					catq(&tp->t_rawq, &tp->t_canq);
1112 					/*
1113 					 * XXX the queue limits may be
1114 					 * different, so the old queue
1115 					 * swapping method no longer works.
1116 					 */
1117 					catq(&tp->t_canq, &tp->t_rawq);
1118 				}
1119 				CLR(tp->t_lflag, PENDIN);
1120 			}
1121 			ttwakeup(tp);
1122 		}
1123 		tp->t_iflag = t->c_iflag;
1124 		tp->t_oflag = t->c_oflag;
1125 		/*
1126 		 * Make the EXTPROC bit read only.
1127 		 */
1128 		if (ISSET(tp->t_lflag, EXTPROC))
1129 			SET(t->c_lflag, EXTPROC);
1130 		else
1131 			CLR(t->c_lflag, EXTPROC);
1132 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1133 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1134 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1135 			ttwakeup(tp);
1136 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1137 		crit_exit();
1138 		break;
1139 	}
1140 	case TIOCSETD: {		/* set line discipline */
1141 		int t = *(int *)data;
1142 		cdev_t device = tp->t_dev;
1143 
1144 		if ((u_int)t >= nlinesw) {
1145 			lwkt_reltoken(&proc_token);
1146 			lwkt_reltoken(&tty_token);
1147 			return (ENXIO);
1148 		}
1149 		if (t != tp->t_line) {
1150 			crit_enter();
1151 			(*linesw[tp->t_line].l_close)(tp, flag);
1152 			error = (*linesw[t].l_open)(device, tp);
1153 			if (error) {
1154 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1155 				crit_exit();
1156 				lwkt_reltoken(&proc_token);
1157 				lwkt_reltoken(&tty_token);
1158 				return (error);
1159 			}
1160 			tp->t_line = t;
1161 			crit_exit();
1162 		}
1163 		break;
1164 	}
1165 	case TIOCSTART:			/* start output, like ^Q */
1166 		crit_enter();
1167 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1168 		    ISSET(tp->t_lflag, FLUSHO)) {
1169 			CLR(tp->t_lflag, FLUSHO);
1170 			CLR(tp->t_state, TS_TTSTOP);
1171 			ttstart(tp);
1172 		}
1173 		crit_exit();
1174 		break;
1175 	case TIOCSTI:			/* simulate terminal input */
1176 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT)) {
1177 			lwkt_reltoken(&proc_token);
1178 			lwkt_reltoken(&tty_token);
1179 			return (EPERM);
1180 		}
1181 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT)) {
1182 			lwkt_reltoken(&proc_token);
1183 			lwkt_reltoken(&tty_token);
1184 			return (EACCES);
1185 		}
1186 		crit_enter();
1187 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1188 		crit_exit();
1189 		break;
1190 	case TIOCSTOP:			/* stop output, like ^S */
1191 		crit_enter();
1192 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1193 			SET(tp->t_state, TS_TTSTOP);
1194 			(*tp->t_stop)(tp, 0);
1195 		}
1196 		crit_exit();
1197 		break;
1198 	case TIOCSCTTY:			/* become controlling tty */
1199 		/* Session ctty vnode pointer set in vnode layer. */
1200 		if (!SESS_LEADER(p) ||
1201 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1202 		    (tp->t_session != p->p_session))) {
1203 			lwkt_reltoken(&proc_token);
1204 			lwkt_reltoken(&tty_token);
1205 			return (EPERM);
1206 		}
1207 		ttyhold(tp);
1208 		tp->t_session = p->p_session;
1209 		tp->t_pgrp = p->p_pgrp;
1210 		otp = p->p_session->s_ttyp;
1211 		p->p_session->s_ttyp = tp;
1212 		if (otp)
1213 			ttyunhold(otp);
1214 		p->p_flag |= P_CONTROLT;
1215 		break;
1216 	case TIOCSPGRP: {		/* set pgrp of tty */
1217 		pid_t pgid = *(int *)data;
1218 
1219 		if (!isctty(p, tp)) {
1220 			lwkt_reltoken(&proc_token);
1221 			lwkt_reltoken(&tty_token);
1222 			return (ENOTTY);
1223 		}
1224 		else if (pgid < 1 || pgid > PID_MAX) {
1225 			lwkt_reltoken(&proc_token);
1226 			lwkt_reltoken(&tty_token);
1227 			return (EINVAL);
1228 		} else {
1229 			struct pgrp *pgrp = pgfind(pgid);
1230 			if (pgrp == NULL || pgrp->pg_session != p->p_session) {
1231 				lwkt_reltoken(&proc_token);
1232 				lwkt_reltoken(&tty_token);
1233 				return (EPERM);
1234 			}
1235 
1236 			tp->t_pgrp = pgrp;
1237 		}
1238 		break;
1239 	}
1240 	case TIOCSTAT:			/* simulate control-T */
1241 		crit_enter();
1242 		ttyinfo(tp);
1243 		crit_exit();
1244 		break;
1245 	case TIOCSWINSZ:		/* set window size */
1246 		if (bcmp((caddr_t)&tp->t_winsize, data,
1247 		    sizeof (struct winsize))) {
1248 			tp->t_winsize = *(struct winsize *)data;
1249 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1250 		}
1251 		break;
1252 	case TIOCSDRAINWAIT:
1253 		error = priv_check(td, PRIV_ROOT);
1254 		if (error) {
1255 			lwkt_reltoken(&proc_token);
1256 			lwkt_reltoken(&tty_token);
1257 			return (error);
1258 		}
1259 		tp->t_timeout = *(int *)data * hz;
1260 		wakeup(TSA_OCOMPLETE(tp));
1261 		wakeup(TSA_OLOWAT(tp));
1262 		break;
1263 	case TIOCGDRAINWAIT:
1264 		*(int *)data = tp->t_timeout / hz;
1265 		break;
1266 	default:
1267 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1268 		lwkt_reltoken(&proc_token);
1269 		lwkt_reltoken(&tty_token);
1270 		return (ttcompat(tp, cmd, data, flag));
1271 #else
1272 		lwkt_reltoken(&proc_token);
1273 		lwkt_reltoken(&tty_token);
1274 		return (ENOIOCTL);
1275 #endif
1276 	}
1277 	lwkt_reltoken(&proc_token);
1278 	lwkt_reltoken(&tty_token);
1279 	return (0);
1280 }
1281 
1282 static struct filterops ttyread_filtops =
1283 	{ FILTEROP_ISFD, NULL, filt_ttyrdetach, filt_ttyread };
1284 static struct filterops ttywrite_filtops =
1285 	{ FILTEROP_ISFD, NULL, filt_ttywdetach, filt_ttywrite };
1286 
1287 int
1288 ttykqfilter(struct dev_kqfilter_args *ap)
1289 {
1290 	cdev_t dev = ap->a_head.a_dev;
1291 	struct knote *kn = ap->a_kn;
1292 	struct tty *tp = dev->si_tty;
1293 	struct klist *klist;
1294 
1295 	ap->a_result = 0;
1296 
1297 	lwkt_gettoken(&tty_token);
1298 	switch (kn->kn_filter) {
1299 	case EVFILT_READ:
1300 		klist = &tp->t_rkq.ki_note;
1301 		kn->kn_fop = &ttyread_filtops;
1302 		break;
1303 	case EVFILT_WRITE:
1304 		klist = &tp->t_wkq.ki_note;
1305 		kn->kn_fop = &ttywrite_filtops;
1306 		break;
1307 	default:
1308 		ap->a_result = EOPNOTSUPP;
1309 		lwkt_reltoken(&tty_token);
1310 		return (0);
1311 	}
1312 	lwkt_reltoken(&tty_token);
1313 	kn->kn_hook = (caddr_t)dev;
1314 	knote_insert(klist, kn);
1315 
1316 	return (0);
1317 }
1318 
1319 static void
1320 filt_ttyrdetach(struct knote *kn)
1321 {
1322 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1323 
1324 	lwkt_gettoken(&tty_token);
1325 	knote_remove(&tp->t_rkq.ki_note, kn);
1326 	lwkt_reltoken(&tty_token);
1327 }
1328 
1329 static int
1330 filt_ttyread(struct knote *kn, long hint)
1331 {
1332 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1333 
1334 	lwkt_gettoken(&tty_token);
1335 	kn->kn_data = ttnread(tp);
1336 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1337 		kn->kn_flags |= EV_EOF;
1338 		lwkt_reltoken(&tty_token);
1339 		return (1);
1340 	}
1341 	lwkt_reltoken(&tty_token);
1342 	return (kn->kn_data > 0);
1343 }
1344 
1345 static void
1346 filt_ttywdetach(struct knote *kn)
1347 {
1348 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1349 
1350 	lwkt_gettoken(&tty_token);
1351 	knote_remove(&tp->t_wkq.ki_note, kn);
1352 	lwkt_reltoken(&tty_token);
1353 }
1354 
1355 static int
1356 filt_ttywrite(struct knote *kn, long hint)
1357 {
1358 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1359 	int ret;
1360 
1361 	lwkt_gettoken(&tty_token);
1362 	kn->kn_data = tp->t_outq.c_cc;
1363 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1364 		lwkt_reltoken(&tty_token);
1365 		return (1);
1366 	}
1367 	ret = (kn->kn_data <= tp->t_olowat &&
1368 	    ISSET(tp->t_state, TS_CONNECTED));
1369 	lwkt_reltoken(&tty_token);
1370 	return ret;
1371 }
1372 
1373 /*
1374  * Must be called while in a critical section.
1375  * NOTE: tty_token must be held.
1376  */
1377 static int
1378 ttnread(struct tty *tp)
1379 {
1380 	int nread;
1381 
1382 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
1383 	if (ISSET(tp->t_lflag, PENDIN))
1384 		ttypend(tp);
1385 	nread = tp->t_canq.c_cc;
1386 	if (!ISSET(tp->t_lflag, ICANON)) {
1387 		nread += tp->t_rawq.c_cc;
1388 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1389 			nread = 0;
1390 	}
1391 	return (nread);
1392 }
1393 
1394 /*
1395  * Wait for output to drain.
1396  */
1397 int
1398 ttywait(struct tty *tp)
1399 {
1400 	int error;
1401 
1402 	error = 0;
1403 	crit_enter();
1404 	lwkt_gettoken(&tty_token);
1405 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1406 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1407 		(*tp->t_oproc)(tp);
1408 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1409 		    ISSET(tp->t_state, TS_CONNECTED)) {
1410 			SET(tp->t_state, TS_SO_OCOMPLETE);
1411 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1412 					 PCATCH, "ttywai",
1413 					 tp->t_timeout);
1414 			if (error) {
1415 				if (error == EWOULDBLOCK)
1416 					error = EIO;
1417 				break;
1418 			}
1419 		} else
1420 			break;
1421 	}
1422 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1423 		error = EIO;
1424 	lwkt_reltoken(&tty_token);
1425 	crit_exit();
1426 	return (error);
1427 }
1428 
1429 /*
1430  * Flush if successfully wait.
1431  */
1432 static int
1433 ttywflush(struct tty *tp)
1434 {
1435 	int error;
1436 
1437 	if ((error = ttywait(tp)) == 0)
1438 		ttyflush(tp, FREAD);
1439 	return (error);
1440 }
1441 
1442 /*
1443  * Flush tty read and/or write queues, notifying anyone waiting.
1444  */
1445 void
1446 ttyflush(struct tty *tp, int rw)
1447 {
1448 	crit_enter();
1449 	lwkt_gettoken(&tty_token);
1450 #if 0
1451 again:
1452 #endif
1453 	if (rw & FWRITE) {
1454 		FLUSHQ(&tp->t_outq);
1455 		CLR(tp->t_state, TS_TTSTOP);
1456 	}
1457 	(*tp->t_stop)(tp, rw);
1458 	if (rw & FREAD) {
1459 		FLUSHQ(&tp->t_canq);
1460 		FLUSHQ(&tp->t_rawq);
1461 		CLR(tp->t_lflag, PENDIN);
1462 		tp->t_rocount = 0;
1463 		tp->t_rocol = 0;
1464 		CLR(tp->t_state, TS_LOCAL);
1465 		ttwakeup(tp);
1466 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1467 			if (rw & FWRITE)
1468 				FLUSHQ(&tp->t_outq);
1469 			ttyunblock(tp);
1470 
1471 			/*
1472 			 * Don't let leave any state that might clobber the
1473 			 * next line discipline (although we should do more
1474 			 * to send the START char).  Not clearing the state
1475 			 * may have caused the "putc to a clist with no
1476 			 * reserved cblocks" panic/kprintf.
1477 			 */
1478 			CLR(tp->t_state, TS_TBLOCK);
1479 
1480 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1481 			if (ISSET(tp->t_iflag, IXOFF)) {
1482 				/*
1483 				 * XXX wait a bit in the hope that the stop
1484 				 * character (if any) will go out.  Waiting
1485 				 * isn't good since it allows races.  This
1486 				 * will be fixed when the stop character is
1487 				 * put in a special queue.  Don't bother with
1488 				 * the checks in ttywait() since the timeout
1489 				 * will save us.
1490 				 */
1491 				SET(tp->t_state, TS_SO_OCOMPLETE);
1492 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1493 					 "ttyfls", hz / 10);
1494 				/*
1495 				 * Don't try sending the stop character again.
1496 				 */
1497 				CLR(tp->t_state, TS_TBLOCK);
1498 				goto again;
1499 			}
1500 #endif
1501 		}
1502 	}
1503 	if (rw & FWRITE) {
1504 		FLUSHQ(&tp->t_outq);
1505 		ttwwakeup(tp);
1506 	}
1507 	lwkt_reltoken(&tty_token);
1508 	crit_exit();
1509 }
1510 
1511 /*
1512  * Copy in the default termios characters.
1513  */
1514 void
1515 termioschars(struct termios *t)
1516 {
1517 	lwkt_gettoken(&tty_token);
1518 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1519 	lwkt_reltoken(&tty_token);
1520 }
1521 
1522 /*
1523  * Old interface.
1524  */
1525 void
1526 ttychars(struct tty *tp)
1527 {
1528 	lwkt_gettoken(&tty_token);
1529 	termioschars(&tp->t_termios);
1530 	lwkt_reltoken(&tty_token);
1531 }
1532 
1533 /*
1534  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1535  * on our input flow control bit and propagate the changes to the driver.
1536  * XXX the stop character should be put in a special high priority queue.
1537  */
1538 void
1539 ttyblock(struct tty *tp)
1540 {
1541 	lwkt_gettoken(&tty_token);
1542 	SET(tp->t_state, TS_TBLOCK);
1543 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1544 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1545 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1546 	ttstart(tp);
1547 	lwkt_reltoken(&tty_token);
1548 }
1549 
1550 /*
1551  * Handle input low water.  Send start character for the IXOFF case.  Turn
1552  * off our input flow control bit and propagate the changes to the driver.
1553  * XXX the start character should be put in a special high priority queue.
1554  */
1555 static void
1556 ttyunblock(struct tty *tp)
1557 {
1558 	lwkt_gettoken(&tty_token);
1559 	CLR(tp->t_state, TS_TBLOCK);
1560 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1561 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1562 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1563 	ttstart(tp);
1564 	lwkt_reltoken(&tty_token);
1565 }
1566 
1567 #ifdef notyet
1568 /* Not used by any current (i386) drivers. */
1569 /*
1570  * Restart after an inter-char delay.
1571  */
1572 void
1573 ttrstrt(void *tp_arg)
1574 {
1575 	struct tty *tp;
1576 
1577 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1578 
1579 	tp = tp_arg;
1580 	crit_enter();
1581 	lwkt_gettoken(&tty_token);
1582 	CLR(tp->t_state, TS_TIMEOUT);
1583 	ttstart(tp);
1584 	lwkt_reltoken(&tty_token);
1585 	crit_exit();
1586 }
1587 #endif
1588 
1589 int
1590 ttstart(struct tty *tp)
1591 {
1592 	lwkt_gettoken(&tty_token);
1593 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1594 		(*tp->t_oproc)(tp);
1595 	lwkt_reltoken(&tty_token);
1596 	return (0);
1597 }
1598 
1599 /*
1600  * "close" a line discipline
1601  */
1602 int
1603 ttylclose(struct tty *tp, int flag)
1604 {
1605 	lwkt_gettoken(&tty_token);
1606 	if (flag & FNONBLOCK || ttywflush(tp))
1607 		ttyflush(tp, FREAD | FWRITE);
1608 	lwkt_reltoken(&tty_token);
1609 	return (0);
1610 }
1611 
1612 void
1613 ttyhold(struct tty *tp)
1614 {
1615 	++tp->t_refs;
1616 }
1617 
1618 void
1619 ttyunhold(struct tty *tp)
1620 {
1621 	--tp->t_refs;
1622 }
1623 
1624 /*
1625  * Handle modem control transition on a tty.
1626  * Flag indicates new state of carrier.
1627  * Returns 0 if the line should be turned off, otherwise 1.
1628  */
1629 int
1630 ttymodem(struct tty *tp, int flag)
1631 {
1632 	lwkt_gettoken(&tty_token);
1633 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1634 		/*
1635 		 * MDMBUF: do flow control according to carrier flag
1636 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1637 		 * works if IXON and IXANY are clear.
1638 		 */
1639 		if (flag) {
1640 			CLR(tp->t_state, TS_CAR_OFLOW);
1641 			CLR(tp->t_state, TS_TTSTOP);
1642 			ttstart(tp);
1643 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1644 			SET(tp->t_state, TS_CAR_OFLOW);
1645 			SET(tp->t_state, TS_TTSTOP);
1646 			(*tp->t_stop)(tp, 0);
1647 		}
1648 	} else if (flag == 0) {
1649 		/*
1650 		 * Lost carrier.
1651 		 */
1652 		CLR(tp->t_state, TS_CARR_ON);
1653 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1654 		    !ISSET(tp->t_cflag, CLOCAL)) {
1655 			SET(tp->t_state, TS_ZOMBIE);
1656 			CLR(tp->t_state, TS_CONNECTED);
1657 			if (tp->t_session && tp->t_session->s_leader)
1658 				ksignal(tp->t_session->s_leader, SIGHUP);
1659 			ttyflush(tp, FREAD | FWRITE);
1660 			lwkt_reltoken(&tty_token);
1661 			return (0);
1662 		}
1663 	} else {
1664 		/*
1665 		 * Carrier now on.
1666 		 */
1667 		SET(tp->t_state, TS_CARR_ON);
1668 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1669 			SET(tp->t_state, TS_CONNECTED);
1670 		wakeup(TSA_CARR_ON(tp));
1671 		ttwakeup(tp);
1672 		ttwwakeup(tp);
1673 	}
1674 	lwkt_reltoken(&tty_token);
1675 	return (1);
1676 }
1677 
1678 /*
1679  * Reinput pending characters after state switch
1680  * call from a critical section.
1681  */
1682 static void
1683 ttypend(struct tty *tp)
1684 {
1685 	struct clist tq;
1686 	int c;
1687 
1688 	lwkt_gettoken(&tty_token);
1689 	CLR(tp->t_lflag, PENDIN);
1690 	SET(tp->t_state, TS_TYPEN);
1691 	/*
1692 	 * XXX this assumes too much about clist internals.  It may even
1693 	 * fail if the cblock slush pool is empty.  We can't allocate more
1694 	 * cblocks here because we are called from an interrupt handler
1695 	 * and clist_alloc_cblocks() can wait.
1696 	 */
1697 	tq = tp->t_rawq;
1698 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1699 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1700 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1701 	while ((c = clist_getc(&tq)) >= 0)
1702 		ttyinput(c, tp);
1703 	CLR(tp->t_state, TS_TYPEN);
1704 	lwkt_reltoken(&tty_token);
1705 }
1706 
1707 /*
1708  * Process a read call on a tty device.
1709  */
1710 int
1711 ttread(struct tty *tp, struct uio *uio, int flag)
1712 {
1713 	struct clist *qp;
1714 	int c;
1715 	tcflag_t lflag;
1716 	cc_t *cc = tp->t_cc;
1717 	struct proc *pp;
1718 	struct lwp *lp;
1719 	int first, error = 0;
1720 	int has_stime = 0, last_cc = 0;
1721 	long slp = 0;		/* XXX this should be renamed `timo'. */
1722 	struct timeval stime;
1723 
1724 	lp = curthread->td_lwp;
1725 	stime.tv_sec = 0;	/* fix compiler warnings */
1726 	stime.tv_usec = 0;
1727 
1728 	lwkt_gettoken(&tty_token);
1729 loop:
1730 	crit_enter();
1731 	lflag = tp->t_lflag;
1732 	/*
1733 	 * take pending input first
1734 	 */
1735 	if (ISSET(lflag, PENDIN)) {
1736 		ttypend(tp);
1737 		splz();		/* reduce latency */
1738 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1739 	}
1740 
1741 	/*
1742 	 * Hang process if it's in the background.
1743 	 */
1744 	lwkt_gettoken(&proc_token);
1745 	if ((pp = curproc) && isbackground(pp, tp)) {
1746 		crit_exit();
1747 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1748 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1749 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0) {
1750 			lwkt_reltoken(&proc_token);
1751 			lwkt_reltoken(&tty_token);
1752 			return (EIO);
1753 		}
1754 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1755 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1756 		if (error) {
1757 			lwkt_reltoken(&proc_token);
1758 			lwkt_reltoken(&tty_token);
1759 			return (error);
1760 		}
1761 		lwkt_reltoken(&proc_token);
1762 		goto loop;
1763 	}
1764 	lwkt_reltoken(&proc_token);
1765 
1766 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1767 		crit_exit();
1768 		lwkt_reltoken(&tty_token);
1769 		return (0);	/* EOF */
1770 	}
1771 
1772 	/*
1773 	 * If canonical, use the canonical queue,
1774 	 * else use the raw queue.
1775 	 *
1776 	 * (should get rid of clists...)
1777 	 */
1778 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1779 
1780 	if (flag & IO_NDELAY) {
1781 		if (qp->c_cc > 0)
1782 			goto read;
1783 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1784 			crit_exit();
1785 			lwkt_reltoken(&tty_token);
1786 			return (0);
1787 		}
1788 		crit_exit();
1789 		lwkt_reltoken(&tty_token);
1790 		return (EWOULDBLOCK);
1791 	}
1792 	if (!ISSET(lflag, ICANON)) {
1793 		int m = cc[VMIN];
1794 		long t = cc[VTIME];
1795 		struct timeval timecopy;
1796 
1797 		/*
1798 		 * Check each of the four combinations.
1799 		 * (m > 0 && t == 0) is the normal read case.
1800 		 * It should be fairly efficient, so we check that and its
1801 		 * companion case (m == 0 && t == 0) first.
1802 		 * For the other two cases, we compute the target sleep time
1803 		 * into slp.
1804 		 */
1805 		if (t == 0) {
1806 			if (qp->c_cc < m)
1807 				goto sleep;
1808 			if (qp->c_cc > 0)
1809 				goto read;
1810 
1811 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1812 			crit_exit();
1813 			lwkt_reltoken(&tty_token);
1814 			return (0);
1815 		}
1816 		t *= 100000;		/* time in us */
1817 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1818 			 ((t1).tv_usec - (t2).tv_usec))
1819 		if (m > 0) {
1820 			if (qp->c_cc <= 0)
1821 				goto sleep;
1822 			if (qp->c_cc >= m)
1823 				goto read;
1824 			getmicrotime(&timecopy);
1825 			if (has_stime == 0) {
1826 				/* first character, start timer */
1827 				has_stime = 1;
1828 				stime = timecopy;
1829 				slp = t;
1830 			} else if (qp->c_cc > last_cc) {
1831 				/* got a character, restart timer */
1832 				stime = timecopy;
1833 				slp = t;
1834 			} else {
1835 				/* nothing, check expiration */
1836 				slp = t - diff(timecopy, stime);
1837 				if (slp <= 0)
1838 					goto read;
1839 			}
1840 			last_cc = qp->c_cc;
1841 		} else {	/* m == 0 */
1842 			if (qp->c_cc > 0)
1843 				goto read;
1844 			getmicrotime(&timecopy);
1845 			if (has_stime == 0) {
1846 				has_stime = 1;
1847 				stime = timecopy;
1848 				slp = t;
1849 			} else {
1850 				slp = t - diff(timecopy, stime);
1851 				if (slp <= 0) {
1852 					/* Timed out, but 0 is enough input. */
1853 					crit_exit();
1854 					lwkt_reltoken(&tty_token);
1855 					return (0);
1856 				}
1857 			}
1858 		}
1859 #undef diff
1860 		/*
1861 		 * Rounding down may make us wake up just short
1862 		 * of the target, so we round up.
1863 		 * The formula is ceiling(slp * hz/1000000).
1864 		 * 32-bit arithmetic is enough for hz < 169.
1865 		 * XXX see tvtohz() for how to avoid overflow if hz
1866 		 * is large (divide by `tick' and/or arrange to
1867 		 * use tvtohz() if hz is large).
1868 		 */
1869 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1870 		goto sleep;
1871 	}
1872 	if (qp->c_cc <= 0) {
1873 sleep:
1874 		/*
1875 		 * There is no input, or not enough input and we can block.
1876 		 */
1877 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1878 				 ISSET(tp->t_state, TS_CONNECTED) ?
1879 				 "ttyin" : "ttyhup", (int)slp);
1880 		crit_exit();
1881 		if (error == EWOULDBLOCK)
1882 			error = 0;
1883 		else if (error) {
1884 			lwkt_reltoken(&tty_token);
1885 			return (error);
1886 		}
1887 		/*
1888 		 * XXX what happens if another process eats some input
1889 		 * while we are asleep (not just here)?  It would be
1890 		 * safest to detect changes and reset our state variables
1891 		 * (has_stime and last_cc).
1892 		 */
1893 		slp = 0;
1894 		goto loop;
1895 	}
1896 read:
1897 	crit_exit();
1898 	/*
1899 	 * Input present, check for input mapping and processing.
1900 	 */
1901 	first = 1;
1902 	if (ISSET(lflag, ICANON | ISIG))
1903 		goto slowcase;
1904 	for (;;) {
1905 		char ibuf[IBUFSIZ];
1906 		int icc;
1907 
1908 		icc = (int)szmin(uio->uio_resid, IBUFSIZ);
1909 		icc = q_to_b(qp, ibuf, icc);
1910 		if (icc <= 0) {
1911 			if (first)
1912 				goto loop;
1913 			break;
1914 		}
1915 		error = uiomove(ibuf, (size_t)icc, uio);
1916 		/*
1917 		 * XXX if there was an error then we should ungetc() the
1918 		 * unmoved chars and reduce icc here.
1919 		 */
1920 		if (error)
1921 			break;
1922  		if (uio->uio_resid == 0)
1923 			break;
1924 		first = 0;
1925 	}
1926 	goto out;
1927 slowcase:
1928 	for (;;) {
1929 		c = clist_getc(qp);
1930 		if (c < 0) {
1931 			if (first)
1932 				goto loop;
1933 			break;
1934 		}
1935 		/*
1936 		 * delayed suspend (^Y)
1937 		 */
1938 		if (CCEQ(cc[VDSUSP], c) &&
1939 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1940 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1941 			if (first) {
1942 				error = ttysleep(tp, &lbolt, PCATCH,
1943 						 "ttybg3", 0);
1944 				if (error)
1945 					break;
1946 				goto loop;
1947 			}
1948 			break;
1949 		}
1950 		/*
1951 		 * Interpret EOF only in canonical mode.
1952 		 */
1953 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1954 			break;
1955 		/*
1956 		 * Give user character.
1957 		 */
1958  		error = ureadc(c, uio);
1959 		if (error)
1960 			/* XXX should ungetc(c, qp). */
1961 			break;
1962  		if (uio->uio_resid == 0)
1963 			break;
1964 		/*
1965 		 * In canonical mode check for a "break character"
1966 		 * marking the end of a "line of input".
1967 		 */
1968 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1969 			break;
1970 		first = 0;
1971 	}
1972 
1973 out:
1974 	/*
1975 	 * Look to unblock input now that (presumably)
1976 	 * the input queue has gone down.
1977 	 */
1978 	crit_enter();
1979 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1980 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
1981 		ttyunblock(tp);
1982 	crit_exit();
1983 
1984 	lwkt_reltoken(&tty_token);
1985 	return (error);
1986 }
1987 
1988 /*
1989  * Check the output queue on tp for space for a kernel message (from uprintf
1990  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1991  * lose messages due to normal flow control, but don't let the tty run amok.
1992  * Sleeps here are not interruptible, but we return prematurely if new signals
1993  * arrive.
1994  */
1995 int
1996 ttycheckoutq(struct tty *tp, int wait)
1997 {
1998 	struct lwp *lp = curthread->td_lwp;
1999 	int hiwat;
2000 	sigset_t oldset, newset;
2001 
2002 	lwkt_gettoken(&tty_token);
2003 	hiwat = tp->t_ohiwat;
2004 	SIGEMPTYSET(oldset);
2005 	SIGEMPTYSET(newset);
2006 	crit_enter();
2007 	if (wait)
2008 		oldset = lwp_sigpend(lp);
2009 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
2010 		while (tp->t_outq.c_cc > hiwat) {
2011 			ttstart(tp);
2012 			if (tp->t_outq.c_cc <= hiwat)
2013 				break;
2014 			if (wait)
2015 				newset = lwp_sigpend(lp);
2016 			if (!wait || SIGSETNEQ(oldset, newset)) {
2017 				crit_exit();
2018 				lwkt_reltoken(&tty_token);
2019 				return (0);
2020 			}
2021 			SET(tp->t_state, TS_SO_OLOWAT);
2022 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
2023 		}
2024 	}
2025 	crit_exit();
2026 	lwkt_reltoken(&tty_token);
2027 	return (1);
2028 }
2029 
2030 /*
2031  * Process a write call on a tty device.
2032  */
2033 int
2034 ttwrite(struct tty *tp, struct uio *uio, int flag)
2035 {
2036 	char *cp = NULL;
2037 	int cc, ce;
2038 	struct proc *pp;
2039 	struct lwp *lp;
2040 	int i, hiwat, error;
2041 	size_t cnt;
2042 
2043 	char obuf[OBUFSIZ];
2044 
2045 	lwkt_gettoken(&tty_token);
2046 	lp = curthread->td_lwp;
2047 	hiwat = tp->t_ohiwat;
2048 	cnt = uio->uio_resid;
2049 	error = 0;
2050 	cc = 0;
2051 loop:
2052 	crit_enter();
2053 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2054 		crit_exit();
2055 		if (uio->uio_resid == cnt)
2056 			error = EIO;
2057 		goto out;
2058 	}
2059 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2060 		if (flag & IO_NDELAY) {
2061 			crit_exit();
2062 			error = EWOULDBLOCK;
2063 			goto out;
2064 		}
2065 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
2066 		crit_exit();
2067 		if (error)
2068 			goto out;
2069 		goto loop;
2070 	}
2071 	crit_exit();
2072 
2073 	/*
2074 	 * Hang the process if it's in the background.
2075 	 */
2076 	lwkt_gettoken(&proc_token);
2077 	if ((pp = curproc) && isbackground(pp, tp) &&
2078 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
2079 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
2080 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
2081 		if (pp->p_pgrp->pg_jobc == 0) {
2082 			error = EIO;
2083 			lwkt_reltoken(&proc_token);
2084 			goto out;
2085 		}
2086 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
2087 		lwkt_reltoken(&proc_token);
2088 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
2089 		if (error)
2090 			goto out;
2091 		goto loop;
2092 	}
2093 	lwkt_reltoken(&proc_token);
2094 	/*
2095 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2096 	 * output translation.  Keep track of high water mark, sleep on
2097 	 * overflow awaiting device aid in acquiring new space.
2098 	 */
2099 	while (uio->uio_resid > 0 || cc > 0) {
2100 		if (ISSET(tp->t_lflag, FLUSHO)) {
2101 			uio->uio_resid = 0;
2102 			lwkt_reltoken(&tty_token);
2103 			return (0);
2104 		}
2105 		if (tp->t_outq.c_cc > hiwat)
2106 			goto ovhiwat;
2107 		/*
2108 		 * Grab a hunk of data from the user, unless we have some
2109 		 * leftover from last time.
2110 		 */
2111 		if (cc == 0) {
2112 			cc = szmin(uio->uio_resid, OBUFSIZ);
2113 			cp = obuf;
2114 			error = uiomove(cp, (size_t)cc, uio);
2115 			if (error) {
2116 				cc = 0;
2117 				break;
2118 			}
2119 		}
2120 		/*
2121 		 * If nothing fancy need be done, grab those characters we
2122 		 * can handle without any of ttyoutput's processing and
2123 		 * just transfer them to the output q.  For those chars
2124 		 * which require special processing (as indicated by the
2125 		 * bits in char_type), call ttyoutput.  After processing
2126 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2127 		 * immediately.
2128 		 */
2129 		while (cc > 0) {
2130 			if (!ISSET(tp->t_oflag, OPOST))
2131 				ce = cc;
2132 			else {
2133 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2134 						char_type, CCLASSMASK);
2135 				/*
2136 				 * If ce is zero, then we're processing
2137 				 * a special character through ttyoutput.
2138 				 */
2139 				if (ce == 0) {
2140 					tp->t_rocount = 0;
2141 					if (ttyoutput(*cp, tp) >= 0) {
2142 						/* No Clists, wait a bit. */
2143 						ttstart(tp);
2144 						if (flag & IO_NDELAY) {
2145 							error = EWOULDBLOCK;
2146 							goto out;
2147 						}
2148 						error = ttysleep(tp, &lbolt,
2149 								 PCATCH,
2150 								 "ttybf1", 0);
2151 						if (error)
2152 							goto out;
2153 						goto loop;
2154 					}
2155 					cp++;
2156 					cc--;
2157 					if (ISSET(tp->t_lflag, FLUSHO) ||
2158 					    tp->t_outq.c_cc > hiwat)
2159 						goto ovhiwat;
2160 					continue;
2161 				}
2162 			}
2163 			/*
2164 			 * A bunch of normal characters have been found.
2165 			 * Transfer them en masse to the output queue and
2166 			 * continue processing at the top of the loop.
2167 			 * If there are any further characters in this
2168 			 * <= OBUFSIZ chunk, the first should be a character
2169 			 * requiring special handling by ttyoutput.
2170 			 */
2171 			tp->t_rocount = 0;
2172 			i = b_to_q(cp, ce, &tp->t_outq);
2173 			ce -= i;
2174 			tp->t_column += ce;
2175 			cp += ce, cc -= ce, tk_nout += ce;
2176 			tp->t_outcc += ce;
2177 			if (i > 0) {
2178 				/* No Clists, wait a bit. */
2179 				ttstart(tp);
2180 				if (flag & IO_NDELAY) {
2181 					error = EWOULDBLOCK;
2182 					goto out;
2183 				}
2184 				error = ttysleep(tp, &lbolt, PCATCH,
2185 						 "ttybf2", 0);
2186 				if (error)
2187 					goto out;
2188 				goto loop;
2189 			}
2190 			if (ISSET(tp->t_lflag, FLUSHO) ||
2191 			    tp->t_outq.c_cc > hiwat)
2192 				break;
2193 		}
2194 		ttstart(tp);
2195 	}
2196 out:
2197 	/*
2198 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2199 	 * offset and iov pointers have moved forward, but it doesn't matter
2200 	 * (the call will either return short or restart with a new uio).
2201 	 */
2202 	uio->uio_resid += cc;
2203 	lwkt_reltoken(&tty_token);
2204 	return (error);
2205 
2206 ovhiwat:
2207 	ttstart(tp);
2208 	crit_enter();
2209 	/*
2210 	 * This can only occur if FLUSHO is set in t_lflag,
2211 	 * or if ttstart/oproc is synchronous (or very fast).
2212 	 */
2213 	if (tp->t_outq.c_cc <= hiwat) {
2214 		crit_exit();
2215 		goto loop;
2216 	}
2217 	if (flag & IO_NDELAY) {
2218 		crit_exit();
2219 		uio->uio_resid += cc;
2220 		lwkt_reltoken(&tty_token);
2221 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2222 	}
2223 	SET(tp->t_state, TS_SO_OLOWAT);
2224 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2225 	crit_exit();
2226 	if (error == EWOULDBLOCK)
2227 		error = EIO;
2228 	if (error)
2229 		goto out;
2230 	goto loop;
2231 }
2232 
2233 /*
2234  * Rubout one character from the rawq of tp
2235  * as cleanly as possible.
2236  * NOTE: Must be called with tty_token held
2237  */
2238 static void
2239 ttyrub(int c, struct tty *tp)
2240 {
2241 	char *cp;
2242 	int savecol;
2243 	int tabc;
2244 
2245 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
2246 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2247 		return;
2248 	CLR(tp->t_lflag, FLUSHO);
2249 	if (ISSET(tp->t_lflag, ECHOE)) {
2250 		if (tp->t_rocount == 0) {
2251 			/*
2252 			 * Screwed by ttwrite; retype
2253 			 */
2254 			ttyretype(tp);
2255 			return;
2256 		}
2257 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2258 			ttyrubo(tp, 2);
2259 		else {
2260 			CLR(c, ~TTY_CHARMASK);
2261 			switch (CCLASS(c)) {
2262 			case ORDINARY:
2263 				ttyrubo(tp, 1);
2264 				break;
2265 			case BACKSPACE:
2266 			case CONTROL:
2267 			case NEWLINE:
2268 			case RETURN:
2269 			case VTAB:
2270 				if (ISSET(tp->t_lflag, ECHOCTL))
2271 					ttyrubo(tp, 2);
2272 				break;
2273 			case TAB:
2274 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2275 					ttyretype(tp);
2276 					return;
2277 				}
2278 				crit_enter();
2279 				savecol = tp->t_column;
2280 				SET(tp->t_state, TS_CNTTB);
2281 				SET(tp->t_lflag, FLUSHO);
2282 				tp->t_column = tp->t_rocol;
2283 				cp = tp->t_rawq.c_cf;
2284 				if (cp)
2285 					tabc = *cp;	/* XXX FIX NEXTC */
2286 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2287 					ttyecho(tabc, tp);
2288 				CLR(tp->t_lflag, FLUSHO);
2289 				CLR(tp->t_state, TS_CNTTB);
2290 				crit_exit();
2291 
2292 				/* savecol will now be length of the tab. */
2293 				savecol -= tp->t_column;
2294 				tp->t_column += savecol;
2295 				if (savecol > 8)
2296 					savecol = 8;	/* overflow screw */
2297 				while (--savecol >= 0)
2298 					(void)ttyoutput('\b', tp);
2299 				break;
2300 			default:			/* XXX */
2301 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2302 				(void)kprintf(PANICSTR, c, CCLASS(c));
2303 #ifdef notdef
2304 				panic(PANICSTR, c, CCLASS(c));
2305 #endif
2306 			}
2307 		}
2308 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2309 		if (!ISSET(tp->t_state, TS_ERASE)) {
2310 			SET(tp->t_state, TS_ERASE);
2311 			(void)ttyoutput('\\', tp);
2312 		}
2313 		ttyecho(c, tp);
2314 	} else {
2315 		ttyecho(tp->t_cc[VERASE], tp);
2316 		/*
2317 		 * This code may be executed not only when an ERASE key
2318 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2319 		 * So, I didn't think it was worthwhile to pass the extra
2320 		 * information (which would need an extra parameter,
2321 		 * changing every call) needed to distinguish the ERASE2
2322 		 * case from the ERASE.
2323 		 */
2324 	}
2325 	--tp->t_rocount;
2326 }
2327 
2328 /*
2329  * Back over cnt characters, erasing them.
2330  * NOTE: Must be called with tty_token held
2331  */
2332 static void
2333 ttyrubo(struct tty *tp, int cnt)
2334 {
2335 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
2336 	while (cnt-- > 0) {
2337 		(void)ttyoutput('\b', tp);
2338 		(void)ttyoutput(' ', tp);
2339 		(void)ttyoutput('\b', tp);
2340 	}
2341 }
2342 
2343 /*
2344  * ttyretype --
2345  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2346  *	been checked.
2347  * NOTE: Must be called with tty_token held
2348  */
2349 static void
2350 ttyretype(struct tty *tp)
2351 {
2352 	char *cp;
2353 	int c;
2354 
2355 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
2356 	/* Echo the reprint character. */
2357 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2358 		ttyecho(tp->t_cc[VREPRINT], tp);
2359 
2360 	(void)ttyoutput('\n', tp);
2361 
2362 	/*
2363 	 * XXX
2364 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2365 	 * BIT OF FIRST CHAR.
2366 	 */
2367 	crit_enter();
2368 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2369 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2370 		ttyecho(c, tp);
2371 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2372 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2373 		ttyecho(c, tp);
2374 	CLR(tp->t_state, TS_ERASE);
2375 	crit_exit();
2376 
2377 	tp->t_rocount = tp->t_rawq.c_cc;
2378 	tp->t_rocol = 0;
2379 }
2380 
2381 /*
2382  * Echo a typed character to the terminal.
2383  * NOTE: Must be called with tty_token held
2384  */
2385 static void
2386 ttyecho(int c, struct tty *tp)
2387 {
2388 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
2389 
2390 	if (!ISSET(tp->t_state, TS_CNTTB))
2391 		CLR(tp->t_lflag, FLUSHO);
2392 	if ((!ISSET(tp->t_lflag, ECHO) &&
2393 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2394 	    ISSET(tp->t_lflag, EXTPROC))
2395 		return;
2396 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2397 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2398 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2399 		(void)ttyoutput('^', tp);
2400 		CLR(c, ~TTY_CHARMASK);
2401 		if (c == 0177)
2402 			c = '?';
2403 		else
2404 			c += 'A' - 1;
2405 	}
2406 	(void)ttyoutput(c, tp);
2407 }
2408 
2409 /*
2410  * Wake up any readers on a tty.
2411  */
2412 void
2413 ttwakeup(struct tty *tp)
2414 {
2415 	lwkt_gettoken(&tty_token);
2416 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2417 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2418 	wakeup(TSA_HUP_OR_INPUT(tp));
2419 	KNOTE(&tp->t_rkq.ki_note, 0);
2420 	lwkt_reltoken(&tty_token);
2421 }
2422 
2423 /*
2424  * Wake up any writers on a tty.
2425  */
2426 void
2427 ttwwakeup(struct tty *tp)
2428 {
2429 	lwkt_gettoken(&tty_token);
2430 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2431 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2432 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2433 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2434 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2435 		wakeup(TSA_OCOMPLETE(tp));
2436 	}
2437 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2438 	    tp->t_outq.c_cc <= tp->t_olowat) {
2439 		CLR(tp->t_state, TS_SO_OLOWAT);
2440 		wakeup(TSA_OLOWAT(tp));
2441 	}
2442 	KNOTE(&tp->t_wkq.ki_note, 0);
2443 	lwkt_reltoken(&tty_token);
2444 }
2445 
2446 /*
2447  * Look up a code for a specified speed in a conversion table;
2448  * used by drivers to map software speed values to hardware parameters.
2449  * No requirements
2450  */
2451 int
2452 ttspeedtab(int speed, struct speedtab *table)
2453 {
2454 
2455 	for ( ; table->sp_speed != -1; table++)
2456 		if (table->sp_speed == speed)
2457 			return (table->sp_code);
2458 	return (-1);
2459 }
2460 
2461 /*
2462  * Set input and output watermarks and buffer sizes.  For input, the
2463  * high watermark is about one second's worth of input above empty, the
2464  * low watermark is slightly below high water, and the buffer size is a
2465  * driver-dependent amount above high water.  For output, the watermarks
2466  * are near the ends of the buffer, with about 1 second's worth of input
2467  * between them.  All this only applies to the standard line discipline.
2468  */
2469 void
2470 ttsetwater(struct tty *tp)
2471 {
2472 	int cps, ttmaxhiwat, x;
2473 
2474 	lwkt_gettoken(&tty_token);
2475 	/* Input. */
2476 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2477 	switch (tp->t_ispeedwat) {
2478 	case (speed_t)-1:
2479 		cps = tp->t_ispeed / 10;
2480 		break;
2481 	case 0:
2482 		/*
2483 		 * This case is for old drivers that don't know about
2484 		 * t_ispeedwat.  Arrange for them to get the old buffer
2485 		 * sizes and watermarks.
2486 		 */
2487 		cps = TTYHOG - 2 * 256;
2488 		tp->t_ififosize = 2 * 2048;
2489 		break;
2490 	default:
2491 		cps = tp->t_ispeedwat / 10;
2492 		break;
2493 	}
2494 	tp->t_ihiwat = cps;
2495 	tp->t_ilowat = 7 * cps / 8;
2496 	x = cps + tp->t_ififosize;
2497 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2498 
2499 	/* Output. */
2500 	switch (tp->t_ospeedwat) {
2501 	case (speed_t)-1:
2502 		cps = tp->t_ospeed / 10;
2503 		ttmaxhiwat = 2 * TTMAXHIWAT;
2504 		break;
2505 	case 0:
2506 		cps = tp->t_ospeed / 10;
2507 		ttmaxhiwat = TTMAXHIWAT;
2508 		break;
2509 	default:
2510 		cps = tp->t_ospeedwat / 10;
2511 		ttmaxhiwat = 8 * TTMAXHIWAT;
2512 		break;
2513 	}
2514 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2515 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2516 	x += cps;
2517 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2518 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2519 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2520 	x += OBUFSIZ + 100;
2521 	clist_alloc_cblocks(&tp->t_outq, x, x);
2522 #undef	CLAMP
2523 	lwkt_reltoken(&tty_token);
2524 }
2525 
2526 /*
2527  * Report on state of foreground process group.
2528  */
2529 void
2530 ttyinfo(struct tty *tp)
2531 {
2532 	struct proc *p, *pick;
2533 	struct lwp *lp;
2534 	struct rusage ru;
2535 	int tmp;
2536 
2537 	if (ttycheckoutq(tp,0) == 0)
2538 		return;
2539 
2540 	lwkt_gettoken(&tty_token);
2541 	lwkt_gettoken(&proc_token);
2542 	/*
2543 	 * We always print the load average, then figure out what else to
2544 	 * print based on the state of the current process group.
2545 	 */
2546 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2547 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2548 
2549 	if (tp->t_session == NULL) {
2550 		ttyprintf(tp, "not a controlling terminal\n");
2551 	} else if (tp->t_pgrp == NULL) {
2552 		ttyprintf(tp, "no foreground process group\n");
2553 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == 0) {
2554 		ttyprintf(tp, "empty foreground process group\n");
2555 	} else {
2556 		/*
2557 		 * Pick an interesting process.  Note that certain elements,
2558 		 * in particular the wmesg, require a critical section for
2559 		 * safe access (YYY and we are still not MP safe).
2560 		 *
2561 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2562 		 */
2563 		char buf[64];
2564 		const char *str;
2565 		long vmsz;
2566 		int pctcpu;
2567 
2568 		crit_enter();
2569 
2570 		/* XXX lwp should compare lwps */
2571 
2572 		for (pick = NULL; p != 0; p = LIST_NEXT(p, p_pglist)) {
2573 			if (proc_compare(pick, p))
2574 				pick = p;
2575 		}
2576 
2577 		/* XXX lwp */
2578 		lp = FIRST_LWP_IN_PROC(pick);
2579 		if (lp == NULL) {
2580 			ttyprintf(tp, "foreground process without lwp\n");
2581 			tp->t_rocount = 0;
2582 			crit_exit();
2583 			lwkt_reltoken(&proc_token);
2584 			lwkt_reltoken(&tty_token);
2585 			return;
2586 		}
2587 
2588 		/*
2589 		 * Figure out what wait/process-state message, and command
2590 		 * buffer to present
2591 		 */
2592 		/*
2593 		 * XXX lwp This is a horrible mixture.  We need to rework this
2594 		 * as soon as lwps have their own runnable status.
2595 		 */
2596 		if (pick->p_flag & P_WEXIT)
2597 			str = "exiting";
2598 		else if (lp->lwp_stat == LSRUN)
2599 			str = "running";
2600 		else if (pick->p_stat == SIDL)
2601 			str = "spawning";
2602 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2603 			str = lp->lwp_wmesg;
2604 		else
2605 			str = "iowait";
2606 
2607 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2608 			pick->p_comm, pick->p_pid, str);
2609 
2610 		/*
2611 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2612 		 * 'pick' becomes invalid the moment we exit the critical
2613 		 * section.
2614 		 */
2615 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0)
2616 			calcru_proc(pick, &ru);
2617 
2618 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2619 
2620 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2621 		    vmsz = 0;
2622 		else
2623 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2624 
2625 		crit_exit();
2626 
2627 		/*
2628 		 * Dump the output
2629 		 */
2630 		ttyprintf(tp, " %s ", buf);
2631 		ttyprintf(tp, "%ld.%02ldu ",
2632 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2633 		ttyprintf(tp, "%ld.%02lds ",
2634 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2635 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2636 	}
2637 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2638 	lwkt_reltoken(&proc_token);
2639 	lwkt_reltoken(&tty_token);
2640 }
2641 
2642 /*
2643  * Returns 1 if p2 is "better" than p1
2644  *
2645  * The algorithm for picking the "interesting" process is thus:
2646  *
2647  *	1) Only foreground processes are eligible - implied.
2648  *	2) Runnable processes are favored over anything else.  The runner
2649  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2650  *	   broken by picking the highest pid.
2651  *	3) The sleeper with the shortest sleep time is next.  With ties,
2652  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2653  *	4) Further ties are broken by picking the highest pid.
2654  *
2655  * NOTE: must be called with proc_token held.
2656  */
2657 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2658 #define TESTAB(a, b)    ((a)<<1 | (b))
2659 #define ONLYA   2
2660 #define ONLYB   1
2661 #define BOTH    3
2662 
2663 static int
2664 proc_compare(struct proc *p1, struct proc *p2)
2665 {
2666 	struct lwp *lp1, *lp2;
2667 
2668 	ASSERT_LWKT_TOKEN_HELD(&proc_token);
2669 
2670 	if (p1 == NULL)
2671 		return (1);
2672 
2673 	/*
2674  	 * weed out zombies
2675 	 */
2676 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2677 	case ONLYA:
2678 		return (1);
2679 	case ONLYB:
2680 		return (0);
2681 	case BOTH:
2682 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2683 	}
2684 
2685 	/* XXX lwp */
2686 	lp1 = FIRST_LWP_IN_PROC(p1);
2687 	lp2 = FIRST_LWP_IN_PROC(p2);
2688 
2689 	/*
2690 	 * see if at least one of them is runnable
2691 	 */
2692 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2693 	case ONLYA:
2694 		return (0);
2695 	case ONLYB:
2696 		return (1);
2697 	case BOTH:
2698 		/*
2699 		 * tie - favor one with highest recent cpu utilization
2700 		 */
2701 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2702 			return (1);
2703 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2704 			return (0);
2705 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2706 	}
2707 	/*
2708 	 * pick the one with the smallest sleep time
2709 	 */
2710 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2711 		return (0);
2712 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2713 		return (1);
2714 	/*
2715 	 * favor one sleeping in a non-interruptible sleep
2716 	 */
2717 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2718 		return (1);
2719 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2720 		return (0);
2721 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2722 }
2723 
2724 /*
2725  * Output char to tty; console putchar style.
2726  */
2727 int
2728 tputchar(int c, struct tty *tp)
2729 {
2730 	crit_enter();
2731 	lwkt_gettoken(&tty_token);
2732 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2733 		lwkt_reltoken(&tty_token);
2734 		crit_exit();
2735 		return (-1);
2736 	}
2737 	if (c == '\n')
2738 		(void)ttyoutput('\r', tp);
2739 	(void)ttyoutput(c, tp);
2740 	ttstart(tp);
2741 	lwkt_reltoken(&tty_token);
2742 	crit_exit();
2743 	return (0);
2744 }
2745 
2746 /*
2747  * Sleep on chan, returning ERESTART if tty changed while we napped and
2748  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2749  * the tty is revoked, restarting a pending call will redo validation done
2750  * at the start of the call.
2751  */
2752 int
2753 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2754 {
2755 	int error;
2756 	int gen;
2757 
2758 	gen = tp->t_gen;
2759 	error = tsleep(chan, slpflags, wmesg, timo);
2760 	if (error)
2761 		return (error);
2762 	return (tp->t_gen == gen ? 0 : ERESTART);
2763 }
2764 
2765 /*
2766  * Revoke a tty.
2767  *
2768  * We bump the gen to force any ttysleep()'s to return with ERESTART
2769  * and flush the tty.  The related fp's should already have been
2770  * replaced so the tty will close when the last references on the
2771  * original fp's go away.
2772  */
2773 int
2774 ttyrevoke(struct dev_revoke_args *ap)
2775 {
2776 	struct tty *tp;
2777 
2778 	lwkt_gettoken(&tty_token);
2779 	tp = ap->a_head.a_dev->si_tty;
2780 	tp->t_gen++;
2781 	ttyflush(tp, FREAD | FWRITE);
2782 	wakeup(TSA_CARR_ON(tp));
2783 	ttwakeup(tp);
2784 	ttwwakeup(tp);
2785 	lwkt_reltoken(&tty_token);
2786 	return (0);
2787 }
2788 
2789 /*
2790  * Allocate a tty struct.  Clists in the struct will be allocated by
2791  * ttyopen().
2792  */
2793 struct tty *
2794 ttymalloc(struct tty *tp)
2795 {
2796 
2797 	if (tp) {
2798 		return(tp);
2799 	}
2800 	tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2801 	ttyregister(tp);
2802         return (tp);
2803 }
2804 
2805 void
2806 ttyunregister(struct tty *tp)
2807 {
2808 	lwkt_gettoken(&tty_token);
2809 	KKASSERT(ISSET(tp->t_state, TS_REGISTERED));
2810 	CLR(tp->t_state, TS_REGISTERED);
2811 	TAILQ_REMOVE(&tty_list, tp, t_list);
2812 	lwkt_reltoken(&tty_token);
2813 }
2814 
2815 void
2816 ttyregister(struct tty *tp)
2817 {
2818 	lwkt_gettoken(&tty_token);
2819 	KKASSERT(!ISSET(tp->t_state, TS_REGISTERED));
2820 	SET(tp->t_state, TS_REGISTERED);
2821 	TAILQ_INSERT_HEAD(&tty_list, tp, t_list);
2822 	lwkt_reltoken(&tty_token);
2823 }
2824 
2825 static int
2826 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2827 {
2828 	int error;
2829 	struct tty *tp;
2830 	struct tty t;
2831 	struct tty marker;
2832 
2833 	bzero(&marker, sizeof(marker));
2834 	marker.t_state = TS_MARKER;
2835 	error = 0;
2836 
2837 	lwkt_gettoken(&tty_token);
2838 
2839 	TAILQ_INSERT_HEAD(&tty_list, &marker, t_list);
2840 	while ((tp = TAILQ_NEXT(&marker, t_list)) != NULL) {
2841 		TAILQ_REMOVE(&tty_list, &marker, t_list);
2842 		TAILQ_INSERT_AFTER(&tty_list, tp, &marker, t_list);
2843 		if (tp->t_state & TS_MARKER)
2844 			continue;
2845 		t = *tp;
2846 		if (t.t_dev)
2847 			t.t_dev = (cdev_t)(uintptr_t)dev2udev(t.t_dev);
2848 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2849 		if (error)
2850 			break;
2851 	}
2852 	TAILQ_REMOVE(&tty_list, &marker, t_list);
2853 	lwkt_reltoken(&tty_token);
2854 	return (error);
2855 }
2856 
2857 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2858 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2859 
2860 void
2861 nottystop(struct tty *tp, int rw)
2862 {
2863 	return;
2864 }
2865 
2866 int
2867 ttyread(struct dev_read_args *ap)
2868 {
2869 	struct tty *tp;
2870 	int ret;
2871 
2872 	tp = ap->a_head.a_dev->si_tty;
2873 	if (tp == NULL)
2874 		return (ENODEV);
2875 	lwkt_gettoken(&tty_token);
2876 	ret = ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2877 	lwkt_reltoken(&tty_token);
2878 
2879 	return ret;
2880 }
2881 
2882 int
2883 ttywrite(struct dev_write_args *ap)
2884 {
2885 	struct tty *tp;
2886 	int ret;
2887 
2888 	tp = ap->a_head.a_dev->si_tty;
2889 	if (tp == NULL)
2890 		return (ENODEV);
2891 	lwkt_gettoken(&tty_token);
2892 	ret = ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2893 	lwkt_reltoken(&tty_token);
2894 
2895 	return ret;
2896 }
2897