xref: /netbsd-src/sys/kern/tty.c (revision 404fbe5fb94ca1e054339640cabb2801ce52dd30)
1 /*	$NetBSD: tty.c,v 1.228 2008/11/19 18:36:07 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 1982, 1986, 1990, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63  */
64 
65 #include <sys/cdefs.h>
66 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.228 2008/11/19 18:36:07 ad Exp $");
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/ioctl.h>
71 #include <sys/proc.h>
72 #define	TTYDEFCHARS
73 #include <sys/tty.h>
74 #undef	TTYDEFCHARS
75 #include <sys/file.h>
76 #include <sys/conf.h>
77 #include <sys/dkstat.h>
78 #include <sys/uio.h>
79 #include <sys/kernel.h>
80 #include <sys/vnode.h>
81 #include <sys/syslog.h>
82 #include <sys/malloc.h>
83 #include <sys/kmem.h>
84 #include <sys/signalvar.h>
85 #include <sys/resourcevar.h>
86 #include <sys/poll.h>
87 #include <sys/kprintf.h>
88 #include <sys/namei.h>
89 #include <sys/sysctl.h>
90 #include <sys/kauth.h>
91 #include <sys/intr.h>
92 #include <sys/ioctl_compat.h>
93 #include <sys/module.h>
94 
95 #include <machine/stdarg.h>
96 
97 static int	ttnread(struct tty *);
98 static void	ttyblock(struct tty *);
99 static void	ttyecho(int, struct tty *);
100 static void	ttyrubo(struct tty *, int);
101 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
102     __attribute__((__format__(__printf__,2,3)));
103 static int	proc_compare(struct proc *, struct proc *);
104 static void	ttysigintr(void *);
105 
106 /* Symbolic sleep message strings. */
107 const char	ttclos[] = "ttycls";
108 const char	ttopen[] = "ttyopn";
109 const char	ttybg[] = "ttybg";
110 const char	ttyin[] = "ttyin";
111 const char	ttyout[] = "ttyout";
112 
113 /*
114  * Used to determine whether we still have a connection.  This is true in
115  * one of 3 cases:
116  * 1) We have carrier.
117  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
118  * 3) We're using a flow control mechanism that overloads the carrier signal.
119  */
120 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
121 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
122 
123 /*
124  * Table with character classes and parity. The 8th bit indicates parity,
125  * the 7th bit indicates the character is an alphameric or underscore (for
126  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
127  * are 0 then the character needs no special processing on output; classes
128  * other than 0 might be translated or (not currently) require delays.
129  */
130 #define	E	0x00	/* Even parity. */
131 #define	O	0x80	/* Odd parity. */
132 #define	PARITY(c)	(char_type[c] & O)
133 
134 #define	ALPHA	0x40	/* Alpha or underscore. */
135 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
136 
137 #define	CCLASSMASK	0x3f
138 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
139 
140 #define	BS	BACKSPACE
141 #define	CC	CONTROL
142 #define	CR	RETURN
143 #define	NA	ORDINARY | ALPHA
144 #define	NL	NEWLINE
145 #define	NO	ORDINARY
146 #define	TB	TAB
147 #define	VT	VTAB
148 
149 unsigned char const char_type[] = {
150 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
151 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
152 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
153 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
154 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
155 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
156 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
157 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
158 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
160 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
161 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
162 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
164 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
165 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
166 	/*
167 	 * Meta chars; should be settable per character set;
168 	 * for now, treat them all as normal characters.
169 	 */
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
186 };
187 #undef	BS
188 #undef	CC
189 #undef	CR
190 #undef	NA
191 #undef	NL
192 #undef	NO
193 #undef	TB
194 #undef	VT
195 
196 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
197 static void *tty_sigsih;
198 
199 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
200 int tty_count;
201 kmutex_t tty_lock;
202 krwlock_t ttcompat_lock;
203 int (*ttcompatvec)(struct tty *, u_long, void *, int, struct lwp *);
204 
205 uint64_t tk_cancc;
206 uint64_t tk_nin;
207 uint64_t tk_nout;
208 uint64_t tk_rawcc;
209 
210 SYSCTL_SETUP(sysctl_kern_tkstat_setup, "sysctl kern.tkstat subtree setup")
211 {
212 
213 	sysctl_createv(clog, 0, NULL, NULL,
214 		       CTLFLAG_PERMANENT,
215 		       CTLTYPE_NODE, "kern", NULL,
216 		       NULL, 0, NULL, 0,
217 		       CTL_KERN, CTL_EOL);
218 	sysctl_createv(clog, 0, NULL, NULL,
219 		       CTLFLAG_PERMANENT,
220 		       CTLTYPE_NODE, "tkstat",
221 		       SYSCTL_DESCR("Number of characters sent and and "
222 				    "received on ttys"),
223 		       NULL, 0, NULL, 0,
224 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
225 
226 	sysctl_createv(clog, 0, NULL, NULL,
227 		       CTLFLAG_PERMANENT,
228 		       CTLTYPE_QUAD, "nin",
229 		       SYSCTL_DESCR("Total number of tty input characters"),
230 		       NULL, 0, &tk_nin, 0,
231 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
232 	sysctl_createv(clog, 0, NULL, NULL,
233 		       CTLFLAG_PERMANENT,
234 		       CTLTYPE_QUAD, "nout",
235 		       SYSCTL_DESCR("Total number of tty output characters"),
236 		       NULL, 0, &tk_nout, 0,
237 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
238 	sysctl_createv(clog, 0, NULL, NULL,
239 		       CTLFLAG_PERMANENT,
240 		       CTLTYPE_QUAD, "cancc",
241 		       SYSCTL_DESCR("Number of canonical tty input characters"),
242 		       NULL, 0, &tk_cancc, 0,
243 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
244 	sysctl_createv(clog, 0, NULL, NULL,
245 		       CTLFLAG_PERMANENT,
246 		       CTLTYPE_QUAD, "rawcc",
247 		       SYSCTL_DESCR("Number of raw tty input characters"),
248 		       NULL, 0, &tk_rawcc, 0,
249 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
250 }
251 
252 int
253 ttyopen(struct tty *tp, int dialout, int nonblock)
254 {
255 	int	error;
256 
257 	error = 0;
258 
259 	mutex_spin_enter(&tty_lock);
260 
261 	if (dialout) {
262 		/*
263 		 * If the device is already open for non-dialout, fail.
264 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
265 		 * opens.
266 		 */
267 		if (ISSET(tp->t_state, TS_ISOPEN) &&
268 		    !ISSET(tp->t_state, TS_DIALOUT)) {
269 			error = EBUSY;
270 			goto out;
271 		}
272 		SET(tp->t_state, TS_DIALOUT);
273 	} else {
274 		if (!nonblock) {
275 			/*
276 			 * Wait for carrier.  Also wait for any dialout
277 			 * processes to close the tty first.
278 			 */
279 			while (ISSET(tp->t_state, TS_DIALOUT) ||
280 			       !CONNECTED(tp)) {
281 				tp->t_wopen++;
282 				error = ttysleep(tp, &tp->t_rawcv, true, 0);
283 				tp->t_wopen--;
284 				if (error)
285 					goto out;
286 			}
287 		} else {
288 			/*
289 			 * Don't allow a non-blocking non-dialout open if the
290 			 * device is already open for dialout.
291 			 */
292 			if (ISSET(tp->t_state, TS_DIALOUT)) {
293 				error = EBUSY;
294 				goto out;
295 			}
296 		}
297 	}
298 
299 out:
300 	mutex_spin_exit(&tty_lock);
301 	return (error);
302 }
303 
304 /*
305  * Initial open of tty, or (re)entry to standard tty line discipline.
306  */
307 int
308 ttylopen(dev_t device, struct tty *tp)
309 {
310 
311 	mutex_spin_enter(&tty_lock);
312 	tp->t_dev = device;
313 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
314 		SET(tp->t_state, TS_ISOPEN);
315 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
316 		tp->t_flags = 0;
317 	}
318 	mutex_spin_exit(&tty_lock);
319 	return (0);
320 }
321 
322 /*
323  * Handle close() on a tty line: flush and set to initial state,
324  * bumping generation number so that pending read/write calls
325  * can detect recycling of the tty.
326  */
327 int
328 ttyclose(struct tty *tp)
329 {
330 	extern struct tty *constty;	/* Temporary virtual console. */
331 	struct session *sess;
332 
333 	mutex_spin_enter(&tty_lock);
334 
335 	if (constty == tp)
336 		constty = NULL;
337 
338 	ttyflush(tp, FREAD | FWRITE);
339 
340 	tp->t_gen++;
341 	tp->t_pgrp = NULL;
342 	tp->t_state = 0;
343 	sess = tp->t_session;
344 	tp->t_session = NULL;
345 
346 	mutex_spin_exit(&tty_lock);
347 
348 	mutex_enter(proc_lock);
349 	if (sess != NULL)
350 		SESSRELE(sess);
351 	mutex_exit(proc_lock);
352 
353 	return (0);
354 }
355 
356 #define	FLUSHQ(q) {							\
357 	if ((q)->c_cc)							\
358 		ndflush(q, (q)->c_cc);					\
359 }
360 
361 /*
362  * This macro is used in canonical mode input processing, where a read
363  * request shall not return unless a 'line delimiter' ('\n') or 'break'
364  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
365  * is an extension to the POSIX.1 defined set of special characters,
366  * recognize it only if IEXTEN is set in the set of local flags.
367  */
368 #define	TTBREAKC(c, lflg)						\
369 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
370 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
371 
372 
373 
374 /*
375  * ttyinput() helper.
376  * Call with the tty lock held.
377  */
378 static int
379 ttyinput_wlock(int c, struct tty *tp)
380 {
381 	int	iflag, lflag, i, error;
382 	u_char	*cc;
383 
384 	KASSERT(mutex_owned(&tty_lock));
385 
386 	/*
387 	 * If input is pending take it first.
388 	 */
389 	lflag = tp->t_lflag;
390 	if (ISSET(lflag, PENDIN))
391 		ttypend(tp);
392 	/*
393 	 * Gather stats.
394 	 */
395 	if (ISSET(lflag, ICANON)) {
396 		++tk_cancc;
397 		++tp->t_cancc;
398 	} else {
399 		++tk_rawcc;
400 		++tp->t_rawcc;
401 	}
402 	++tk_nin;
403 
404 	cc = tp->t_cc;
405 
406 	/*
407 	 * Handle exceptional conditions (break, parity, framing).
408 	 */
409 	iflag = tp->t_iflag;
410 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
411 		CLR(c, TTY_ERRORMASK);
412 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
413 			if (ISSET(iflag, IGNBRK))
414 				return (0);
415 			else if (ISSET(iflag, BRKINT)) {
416 				ttyflush(tp, FREAD | FWRITE);
417 				ttysig(tp, TTYSIG_PG1, SIGINT);
418 				return (0);
419 			} else if (ISSET(iflag, PARMRK))
420 				goto parmrk;
421 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
422 		    ISSET(error, TTY_FE)) {
423 			if (ISSET(iflag, IGNPAR))
424 				return (0);
425 			else if (ISSET(iflag, PARMRK)) {
426  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
427 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
428 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
429 				return (0);
430 			} else
431 				c = 0;
432 		}
433 	} else if (c == 0377 &&
434 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
435 		/* "Escape" a valid character of '\377'. */
436 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
437 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
438 		goto endcase;
439 	}
440 
441 	/*
442 	 * In tandem mode, check high water mark.
443 	 */
444 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
445 		ttyblock(tp);
446 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
447 		CLR(c, 0x80);
448 	if (!ISSET(lflag, EXTPROC)) {
449 		/*
450 		 * Check for literal nexting very first
451 		 */
452 		if (ISSET(tp->t_state, TS_LNCH)) {
453 			SET(c, TTY_QUOTE);
454 			CLR(tp->t_state, TS_LNCH);
455 		}
456 		/*
457 		 * Scan for special characters.  This code
458 		 * is really just a big case statement with
459 		 * non-constant cases.  The bottom of the
460 		 * case statement is labeled ``endcase'', so goto
461 		 * it after a case match, or similar.
462 		 */
463 
464 		/*
465 		 * Control chars which aren't controlled
466 		 * by ICANON, ISIG, or IXON.
467 		 */
468 		if (ISSET(lflag, IEXTEN)) {
469 			if (CCEQ(cc[VLNEXT], c)) {
470 				if (ISSET(lflag, ECHO)) {
471 					if (ISSET(lflag, ECHOE)) {
472 						(void)ttyoutput('^', tp);
473 						(void)ttyoutput('\b', tp);
474 					} else
475 						ttyecho(c, tp);
476 				}
477 				SET(tp->t_state, TS_LNCH);
478 				goto endcase;
479 			}
480 			if (CCEQ(cc[VDISCARD], c)) {
481 				if (ISSET(lflag, FLUSHO))
482 					CLR(tp->t_lflag, FLUSHO);
483 				else {
484 					ttyflush(tp, FWRITE);
485 					ttyecho(c, tp);
486 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
487 						ttyretype(tp);
488 					SET(tp->t_lflag, FLUSHO);
489 				}
490 				goto startoutput;
491 			}
492 		}
493 		/*
494 		 * Signals.
495 		 */
496 		if (ISSET(lflag, ISIG)) {
497 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
498 				if (!ISSET(lflag, NOFLSH))
499 					ttyflush(tp, FREAD | FWRITE);
500 				ttyecho(c, tp);
501 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
502 				    SIGINT : SIGQUIT);
503 				goto endcase;
504 			}
505 			if (CCEQ(cc[VSUSP], c)) {
506 				if (!ISSET(lflag, NOFLSH))
507 					ttyflush(tp, FREAD);
508 				ttyecho(c, tp);
509 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
510 				goto endcase;
511 			}
512 		}
513 		/*
514 		 * Handle start/stop characters.
515 		 */
516 		if (ISSET(iflag, IXON)) {
517 			if (CCEQ(cc[VSTOP], c)) {
518 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
519 					SET(tp->t_state, TS_TTSTOP);
520 					cdev_stop(tp, 0);
521 					return (0);
522 				}
523 				if (!CCEQ(cc[VSTART], c))
524 					return (0);
525 				/*
526 				 * if VSTART == VSTOP then toggle
527 				 */
528 				goto endcase;
529 			}
530 			if (CCEQ(cc[VSTART], c))
531 				goto restartoutput;
532 		}
533 		/*
534 		 * IGNCR, ICRNL, & INLCR
535 		 */
536 		if (c == '\r') {
537 			if (ISSET(iflag, IGNCR))
538 				goto endcase;
539 			else if (ISSET(iflag, ICRNL))
540 				c = '\n';
541 		} else if (c == '\n' && ISSET(iflag, INLCR))
542 			c = '\r';
543 	}
544 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
545 		/*
546 		 * From here on down canonical mode character
547 		 * processing takes place.
548 		 */
549 		/*
550 		 * erase (^H / ^?)
551 		 */
552 		if (CCEQ(cc[VERASE], c)) {
553 			if (tp->t_rawq.c_cc)
554 				ttyrub(unputc(&tp->t_rawq), tp);
555 			goto endcase;
556 		}
557 		/*
558 		 * kill (^U)
559 		 */
560 		if (CCEQ(cc[VKILL], c)) {
561 			if (ISSET(lflag, ECHOKE) &&
562 			    tp->t_rawq.c_cc == tp->t_rocount &&
563 			    !ISSET(lflag, ECHOPRT))
564 				while (tp->t_rawq.c_cc)
565 					ttyrub(unputc(&tp->t_rawq), tp);
566 			else {
567 				ttyecho(c, tp);
568 				if (ISSET(lflag, ECHOK) ||
569 				    ISSET(lflag, ECHOKE))
570 					ttyecho('\n', tp);
571 				FLUSHQ(&tp->t_rawq);
572 				tp->t_rocount = 0;
573 			}
574 			CLR(tp->t_state, TS_LOCAL);
575 			goto endcase;
576 		}
577 		/*
578 		 * Extensions to the POSIX.1 GTI set of functions.
579 		 */
580 		if (ISSET(lflag, IEXTEN)) {
581 			/*
582 			 * word erase (^W)
583 			 */
584 			if (CCEQ(cc[VWERASE], c)) {
585 				int alt = ISSET(lflag, ALTWERASE);
586 				int ctype;
587 
588 				/*
589 				 * erase whitespace
590 				 */
591 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
592 				    c == '\t')
593 					ttyrub(c, tp);
594 				if (c == -1)
595 					goto endcase;
596 				/*
597 				 * erase last char of word and remember the
598 				 * next chars type (for ALTWERASE)
599 				 */
600 				ttyrub(c, tp);
601 				c = unputc(&tp->t_rawq);
602 				if (c == -1)
603 					goto endcase;
604 				if (c == ' ' || c == '\t') {
605 					(void)putc(c, &tp->t_rawq);
606 					goto endcase;
607 				}
608 				ctype = ISALPHA(c);
609 				/*
610 				 * erase rest of word
611 				 */
612 				do {
613 					ttyrub(c, tp);
614 					c = unputc(&tp->t_rawq);
615 					if (c == -1)
616 						goto endcase;
617 				} while (c != ' ' && c != '\t' &&
618 				    (alt == 0 || ISALPHA(c) == ctype));
619 				(void)putc(c, &tp->t_rawq);
620 				goto endcase;
621 			}
622 			/*
623 			 * reprint line (^R)
624 			 */
625 			if (CCEQ(cc[VREPRINT], c)) {
626 				ttyretype(tp);
627 				goto endcase;
628 			}
629 			/*
630 			 * ^T - kernel info and generate SIGINFO
631 			 */
632 			if (CCEQ(cc[VSTATUS], c)) {
633 				ttysig(tp, TTYSIG_PG1, SIGINFO);
634 				goto endcase;
635 			}
636 		}
637 	}
638 	/*
639 	 * Check for input buffer overflow
640 	 */
641 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
642 		if (ISSET(iflag, IMAXBEL)) {
643 			if (tp->t_outq.c_cc < tp->t_hiwat)
644 				(void)ttyoutput(CTRL('g'), tp);
645 		} else
646 			ttyflush(tp, FREAD | FWRITE);
647 		goto endcase;
648 	}
649 	/*
650 	 * Put data char in q for user and
651 	 * wakeup on seeing a line delimiter.
652 	 */
653 	if (putc(c, &tp->t_rawq) >= 0) {
654 		if (!ISSET(lflag, ICANON)) {
655 			ttwakeup(tp);
656 			ttyecho(c, tp);
657 			goto endcase;
658 		}
659 		if (TTBREAKC(c, lflag)) {
660 			tp->t_rocount = 0;
661 			catq(&tp->t_rawq, &tp->t_canq);
662 			ttwakeup(tp);
663 		} else if (tp->t_rocount++ == 0)
664 			tp->t_rocol = tp->t_column;
665 		if (ISSET(tp->t_state, TS_ERASE)) {
666 			/*
667 			 * end of prterase \.../
668 			 */
669 			CLR(tp->t_state, TS_ERASE);
670 			(void)ttyoutput('/', tp);
671 		}
672 		i = tp->t_column;
673 		ttyecho(c, tp);
674 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
675 			/*
676 			 * Place the cursor over the '^' of the ^D.
677 			 */
678 			i = min(2, tp->t_column - i);
679 			while (i > 0) {
680 				(void)ttyoutput('\b', tp);
681 				i--;
682 			}
683 		}
684 	}
685  endcase:
686 	/*
687 	 * IXANY means allow any character to restart output.
688 	 */
689 	if (ISSET(tp->t_state, TS_TTSTOP) &&
690 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
691 		return (0);
692 	}
693  restartoutput:
694 	CLR(tp->t_lflag, FLUSHO);
695 	CLR(tp->t_state, TS_TTSTOP);
696  startoutput:
697 	return (ttstart(tp));
698 }
699 
700 /*
701  * Process input of a single character received on a tty.
702  *
703  * XXX - this is a hack, all drivers must changed to acquire the
704  *	 lock before calling linesw->l_rint()
705  */
706 int
707 ttyinput(int c, struct tty *tp)
708 {
709 	int error;
710 
711 	/*
712 	 * Unless the receiver is enabled, drop incoming data.
713 	 */
714 	if (!ISSET(tp->t_cflag, CREAD))
715 		return (0);
716 
717 	mutex_spin_enter(&tty_lock);
718 	error = ttyinput_wlock(c, tp);
719 	mutex_spin_exit(&tty_lock);
720 
721 	return (error);
722 }
723 
724 /*
725  * Output a single character on a tty, doing output processing
726  * as needed (expanding tabs, newline processing, etc.).
727  * Returns < 0 if succeeds, otherwise returns char to resend.
728  * Must be recursive.
729  *
730  * Call with tty lock held.
731  */
732 int
733 ttyoutput(int c, struct tty *tp)
734 {
735 	long	oflag;
736 	int	col, notout;
737 
738 	KASSERT(mutex_owned(&tty_lock));
739 
740 	oflag = tp->t_oflag;
741 	if (!ISSET(oflag, OPOST)) {
742 		tk_nout++;
743 		tp->t_outcc++;
744 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
745 			return (c);
746 		return (-1);
747 	}
748 	/*
749 	 * Do tab expansion if OXTABS is set.  Special case if we do external
750 	 * processing, we don't do the tab expansion because we'll probably
751 	 * get it wrong.  If tab expansion needs to be done, let it happen
752 	 * externally.
753 	 */
754 	CLR(c, ~TTY_CHARMASK);
755 	if (c == '\t' &&
756 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
757 		c = 8 - (tp->t_column & 7);
758 		if (ISSET(tp->t_lflag, FLUSHO)) {
759 			notout = 0;
760 		} else {
761 			notout = b_to_q("        ", c, &tp->t_outq);
762 			c -= notout;
763 			tk_nout += c;
764 			tp->t_outcc += c;
765 		}
766 		tp->t_column += c;
767 		return (notout ? '\t' : -1);
768 	}
769 	if (c == CEOT && ISSET(oflag, ONOEOT))
770 		return (-1);
771 
772 	/*
773 	 * Newline translation: if ONLCR is set,
774 	 * translate newline into "\r\n".
775 	 */
776 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
777 		tk_nout++;
778 		tp->t_outcc++;
779 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
780 			return (c);
781 	}
782 	/* If OCRNL is set, translate "\r" into "\n". */
783 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
784 		c = '\n';
785 	/* If ONOCR is set, don't transmit CRs when on column 0. */
786 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
787 		return (-1);
788 
789 	tk_nout++;
790 	tp->t_outcc++;
791 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
792 		return (c);
793 
794 	col = tp->t_column;
795 	switch (CCLASS(c)) {
796 	case BACKSPACE:
797 		if (col > 0)
798 			--col;
799 		break;
800 	case CONTROL:
801 		break;
802 	case NEWLINE:
803 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
804 			col = 0;
805 		break;
806 	case RETURN:
807 		col = 0;
808 		break;
809 	case ORDINARY:
810 		++col;
811 		break;
812 	case TAB:
813 		col = (col + 8) & ~7;
814 		break;
815 	}
816 	tp->t_column = col;
817 	return (-1);
818 }
819 
820 /*
821  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
822  * has been called to do discipline-specific functions and/or reject any
823  * of these ioctl commands.
824  */
825 /* ARGSUSED */
826 int
827 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
828 {
829 	extern struct tty *constty;	/* Temporary virtual console. */
830 	struct proc *p = l ? l->l_proc : NULL;
831 	struct linesw	*lp;
832 	int		s, error;
833 	struct nameidata nd;
834 	char		infobuf[200];
835 
836 	/* If the ioctl involves modification, hang if in the background. */
837 	switch (cmd) {
838 	case  TIOCFLUSH:
839 	case  TIOCDRAIN:
840 	case  TIOCSBRK:
841 	case  TIOCCBRK:
842 	case  TIOCSTART:
843 	case  TIOCSETA:
844 	case  TIOCSETD:
845 	case  TIOCSLINED:
846 	case  TIOCSETAF:
847 	case  TIOCSETAW:
848 #ifdef notdef
849 	case  TIOCSPGRP:
850 	case  FIOSETOWN:
851 #endif
852 	case  TIOCSTAT:
853 	case  TIOCSTI:
854 	case  TIOCSWINSZ:
855 	case  TIOCLBIC:
856 	case  TIOCLBIS:
857 	case  TIOCLSET:
858 	case  TIOCSETC:
859 	case OTIOCSETD:
860 	case  TIOCSETN:
861 	case  TIOCSETP:
862 	case  TIOCSLTC:
863 		mutex_spin_enter(&tty_lock);
864 		while (isbackground(curproc, tp) &&
865 		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
866 		    !sigismasked(l, SIGTTOU)) {
867 			mutex_spin_exit(&tty_lock);
868 
869 			mutex_enter(proc_lock);
870 			pgsignal(p->p_pgrp, SIGTTOU, 1);
871 			mutex_exit(proc_lock);
872 
873 			mutex_spin_enter(&tty_lock);
874 			error = ttysleep(tp, &lbolt, true, 0);
875 			if (error) {
876 				mutex_spin_exit(&tty_lock);
877 				return (error);
878 			}
879 		}
880 		mutex_spin_exit(&tty_lock);
881 		break;
882 	}
883 
884 	switch (cmd) {			/* Process the ioctl. */
885 	case FIOASYNC:			/* set/clear async i/o */
886 		mutex_spin_enter(&tty_lock);
887 		if (*(int *)data)
888 			SET(tp->t_state, TS_ASYNC);
889 		else
890 			CLR(tp->t_state, TS_ASYNC);
891 		mutex_spin_exit(&tty_lock);
892 		break;
893 	case FIONBIO:			/* set/clear non-blocking i/o */
894 		break;			/* XXX: delete. */
895 	case FIONREAD:			/* get # bytes to read */
896 		mutex_spin_enter(&tty_lock);
897 		*(int *)data = ttnread(tp);
898 		mutex_spin_exit(&tty_lock);
899 		break;
900 	case FIONWRITE:			/* get # bytes to written & unsent */
901 		mutex_spin_enter(&tty_lock);
902 		*(int *)data = tp->t_outq.c_cc;
903 		mutex_spin_exit(&tty_lock);
904 		break;
905 	case FIONSPACE:			/* get # bytes to written & unsent */
906 		mutex_spin_enter(&tty_lock);
907 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
908 		mutex_spin_exit(&tty_lock);
909 		break;
910 	case TIOCEXCL:			/* set exclusive use of tty */
911 		mutex_spin_enter(&tty_lock);
912 		SET(tp->t_state, TS_XCLUDE);
913 		mutex_spin_exit(&tty_lock);
914 		break;
915 	case TIOCFLUSH: {		/* flush buffers */
916 		int flags = *(int *)data;
917 
918 		if (flags == 0)
919 			flags = FREAD | FWRITE;
920 		else
921 			flags &= FREAD | FWRITE;
922 		mutex_spin_enter(&tty_lock);
923 		ttyflush(tp, flags);
924 		mutex_spin_exit(&tty_lock);
925 		break;
926 	}
927 	case TIOCCONS:			/* become virtual console */
928 		if (*(int *)data) {
929 			if (constty && constty != tp &&
930 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
931 			    (TS_CARR_ON | TS_ISOPEN))
932 				return EBUSY;
933 
934 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
935 			    "/dev/console");
936 			if ((error = namei(&nd)) != 0)
937 				return error;
938 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
939 			vput(nd.ni_vp);
940 			if (error)
941 				return error;
942 
943 			constty = tp;
944 		} else if (tp == constty)
945 			constty = NULL;
946 		break;
947 	case TIOCDRAIN:			/* wait till output drained */
948 		if ((error = ttywait(tp)) != 0)
949 			return (error);
950 		break;
951 	case TIOCGETA: {		/* get termios struct */
952 		struct termios *t = (struct termios *)data;
953 
954 		memcpy(t, &tp->t_termios, sizeof(struct termios));
955 		break;
956 	}
957 	case TIOCGETD:			/* get line discipline (old) */
958 		*(int *)data = tp->t_linesw->l_no;
959 		break;
960 	case TIOCGLINED:		/* get line discipline (new) */
961 		(void)strncpy((char *)data, tp->t_linesw->l_name,
962 		    TTLINEDNAMELEN - 1);
963 		break;
964 	case TIOCGWINSZ:		/* get window size */
965 		*(struct winsize *)data = tp->t_winsize;
966 		break;
967 	case FIOGETOWN:
968 		mutex_enter(proc_lock);
969 		if (tp->t_session != NULL && !isctty(p, tp)) {
970 			mutex_exit(proc_lock);
971 			return (ENOTTY);
972 		}
973 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
974 		mutex_exit(proc_lock);
975 		break;
976 	case TIOCGPGRP:			/* get pgrp of tty */
977 		mutex_enter(proc_lock);
978 		if (!isctty(p, tp)) {
979 			mutex_exit(proc_lock);
980 			return (ENOTTY);
981 		}
982 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
983 		mutex_exit(proc_lock);
984 		break;
985 	case TIOCGSID:			/* get sid of tty */
986 		mutex_enter(proc_lock);
987 		if (!isctty(p, tp)) {
988 			mutex_exit(proc_lock);
989 			return (ENOTTY);
990 		}
991 		*(int *)data = tp->t_session->s_sid;
992 		mutex_exit(proc_lock);
993 		break;
994 #ifdef TIOCHPCL
995 	case TIOCHPCL:			/* hang up on last close */
996 		mutex_spin_enter(&tty_lock);
997 		SET(tp->t_cflag, HUPCL);
998 		mutex_spin_exit(&tty_lock);
999 		break;
1000 #endif
1001 	case TIOCNXCL:			/* reset exclusive use of tty */
1002 		mutex_spin_enter(&tty_lock);
1003 		CLR(tp->t_state, TS_XCLUDE);
1004 		mutex_spin_exit(&tty_lock);
1005 		break;
1006 	case TIOCOUTQ:			/* output queue size */
1007 		*(int *)data = tp->t_outq.c_cc;
1008 		break;
1009 	case TIOCSETA:			/* set termios struct */
1010 	case TIOCSETAW:			/* drain output, set */
1011 	case TIOCSETAF: {		/* drn out, fls in, set */
1012 		struct termios *t = (struct termios *)data;
1013 
1014 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1015 			if ((error = ttywait(tp)) != 0)
1016 				return (error);
1017 
1018 			if (cmd == TIOCSETAF) {
1019 				mutex_spin_enter(&tty_lock);
1020 				ttyflush(tp, FREAD);
1021 				mutex_spin_exit(&tty_lock);
1022 			}
1023 		}
1024 
1025 		s = spltty();
1026 		/*
1027 		 * XXXSMP - some drivers call back on us from t_param(), so
1028 		 *	    don't take the tty spin lock here.
1029 		 *	    require t_param() to unlock upon callback?
1030 		 */
1031 		/* wanted here: mutex_spin_enter(&tty_lock); */
1032 		if (!ISSET(t->c_cflag, CIGNORE)) {
1033 			/*
1034 			 * Set device hardware.
1035 			 */
1036 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1037 				/* wanted here: mutex_spin_exit(&tty_lock); */
1038 				splx(s);
1039 				return (error);
1040 			} else {
1041 				tp->t_cflag = t->c_cflag;
1042 				tp->t_ispeed = t->c_ispeed;
1043 				tp->t_ospeed = t->c_ospeed;
1044 				if (t->c_ospeed == 0)
1045 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1046 			}
1047 			ttsetwater(tp);
1048 		}
1049 
1050 		/* delayed lock acquiring */
1051 		mutex_spin_enter(&tty_lock);
1052 		if (cmd != TIOCSETAF) {
1053 			if (ISSET(t->c_lflag, ICANON) !=
1054 			    ISSET(tp->t_lflag, ICANON)) {
1055 				if (ISSET(t->c_lflag, ICANON)) {
1056 					SET(tp->t_lflag, PENDIN);
1057 					ttwakeup(tp);
1058 				} else {
1059 					struct clist tq;
1060 
1061 					catq(&tp->t_rawq, &tp->t_canq);
1062 					tq = tp->t_rawq;
1063 					tp->t_rawq = tp->t_canq;
1064 					tp->t_canq = tq;
1065 					CLR(tp->t_lflag, PENDIN);
1066 				}
1067 			}
1068 		}
1069 		tp->t_iflag = t->c_iflag;
1070 		tp->t_oflag = t->c_oflag;
1071 		/*
1072 		 * Make the EXTPROC bit read only.
1073 		 */
1074 		if (ISSET(tp->t_lflag, EXTPROC))
1075 			SET(t->c_lflag, EXTPROC);
1076 		else
1077 			CLR(t->c_lflag, EXTPROC);
1078 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1079 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1080 		mutex_spin_exit(&tty_lock);
1081 		splx(s);
1082 		break;
1083 	}
1084 	case TIOCSETD:			/* set line discipline (old) */
1085 		lp = ttyldisc_lookup_bynum(*(int *)data);
1086 		goto setldisc;
1087 
1088 	case TIOCSLINED: {		/* set line discipline (new) */
1089 		char *name = (char *)data;
1090 		dev_t device;
1091 
1092 		/* Null terminate to prevent buffer overflow */
1093 		name[TTLINEDNAMELEN - 1] = '\0';
1094 		lp = ttyldisc_lookup(name);
1095  setldisc:
1096 		if (lp == NULL)
1097 			return (ENXIO);
1098 
1099 		if (lp != tp->t_linesw) {
1100 			device = tp->t_dev;
1101 			s = spltty();
1102 			(*tp->t_linesw->l_close)(tp, flag);
1103 			error = (*lp->l_open)(device, tp);
1104 			if (error) {
1105 				(void)(*tp->t_linesw->l_open)(device, tp);
1106 				splx(s);
1107 				ttyldisc_release(lp);
1108 				return (error);
1109 			}
1110 			ttyldisc_release(tp->t_linesw);
1111 			tp->t_linesw = lp;
1112 			splx(s);
1113 		} else {
1114 			/* Drop extra reference. */
1115 			ttyldisc_release(lp);
1116 		}
1117 		break;
1118 	}
1119 	case TIOCSTART:			/* start output, like ^Q */
1120 		mutex_spin_enter(&tty_lock);
1121 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1122 		    ISSET(tp->t_lflag, FLUSHO)) {
1123 			CLR(tp->t_lflag, FLUSHO);
1124 			CLR(tp->t_state, TS_TTSTOP);
1125 			ttstart(tp);
1126 		}
1127 		mutex_spin_exit(&tty_lock);
1128 		break;
1129 	case TIOCSTI:			/* simulate terminal input */
1130 		if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_STI,
1131 		    tp) != 0) {
1132 			if (!ISSET(flag, FREAD))
1133 				return (EPERM);
1134 			if (!isctty(p, tp))
1135 				return (EACCES);
1136 		}
1137 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1138 		break;
1139 	case TIOCSTOP:			/* stop output, like ^S */
1140 	{
1141 		mutex_spin_enter(&tty_lock);
1142 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1143 			SET(tp->t_state, TS_TTSTOP);
1144 			cdev_stop(tp, 0);
1145 		}
1146 		mutex_spin_exit(&tty_lock);
1147 		break;
1148 	}
1149 	case TIOCSCTTY:			/* become controlling tty */
1150 		mutex_enter(proc_lock);
1151 		mutex_spin_enter(&tty_lock);
1152 
1153 		/* Session ctty vnode pointer set in vnode layer. */
1154 		if (!SESS_LEADER(p) ||
1155 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1156 		    (tp->t_session != p->p_session))) {
1157 			mutex_spin_exit(&tty_lock);
1158 			mutex_exit(proc_lock);
1159 			return (EPERM);
1160 		}
1161 
1162 		/*
1163 		 * `p_session' acquires a reference.
1164 		 * But note that if `t_session' is set at this point,
1165 		 * it must equal `p_session', in which case the session
1166 		 * already has the correct reference count.
1167 		 */
1168 		if (tp->t_session == NULL)
1169 			SESSHOLD(p->p_session);
1170 
1171 		tp->t_session = p->p_session;
1172 		tp->t_pgrp = p->p_pgrp;
1173 		p->p_session->s_ttyp = tp;
1174 		p->p_lflag |= PL_CONTROLT;
1175 		mutex_spin_exit(&tty_lock);
1176 		mutex_exit(proc_lock);
1177 		break;
1178 	case FIOSETOWN: {		/* set pgrp of tty */
1179 		pid_t pgid = *(int *)data;
1180 		struct pgrp *pgrp;
1181 
1182 		mutex_enter(proc_lock);
1183 		if (tp->t_session != NULL && !isctty(p, tp)) {
1184 			mutex_exit(proc_lock);
1185 			return (ENOTTY);
1186 		}
1187 
1188 		if (pgid < 0) {
1189 			pgrp = pg_find(-pgid, PFIND_LOCKED | PFIND_UNLOCK_FAIL);
1190 			if (pgrp == NULL)
1191 				return (EINVAL);
1192 		} else {
1193 			struct proc *p1;
1194 			p1 = p_find(pgid, PFIND_LOCKED | PFIND_UNLOCK_FAIL);
1195 			if (!p1)
1196 				return (ESRCH);
1197 			pgrp = p1->p_pgrp;
1198 		}
1199 
1200 		if (pgrp->pg_session != p->p_session) {
1201 			mutex_exit(proc_lock);
1202 			return (EPERM);
1203 		}
1204 		mutex_spin_enter(&tty_lock);
1205 		tp->t_pgrp = pgrp;
1206 		mutex_spin_exit(&tty_lock);
1207 		mutex_exit(proc_lock);
1208 		break;
1209 	}
1210 	case TIOCSPGRP: {		/* set pgrp of tty */
1211 		struct pgrp *pgrp;
1212 
1213 		mutex_enter(proc_lock);
1214 		if (!isctty(p, tp)) {
1215 			mutex_exit(proc_lock);
1216 			return (ENOTTY);
1217 		}
1218 		pgrp = pg_find(*(int *)data, PFIND_LOCKED | PFIND_UNLOCK_FAIL);
1219 		if (pgrp == NULL)
1220 			return (EINVAL);
1221 		if (pgrp->pg_session != p->p_session) {
1222 			mutex_exit(proc_lock);
1223 			return (EPERM);
1224 		}
1225 		mutex_spin_enter(&tty_lock);
1226 		tp->t_pgrp = pgrp;
1227 		mutex_spin_exit(&tty_lock);
1228 		mutex_exit(proc_lock);
1229 		break;
1230 	}
1231 	case TIOCSTAT:			/* get load avg stats */
1232 		mutex_enter(proc_lock);
1233 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1234 		mutex_exit(proc_lock);
1235 
1236 		mutex_spin_enter(&tty_lock);
1237 		ttyputinfo(tp, infobuf);
1238 		mutex_spin_exit(&tty_lock);
1239 		break;
1240 	case TIOCSWINSZ:		/* set window size */
1241 		mutex_spin_enter(&tty_lock);
1242 		if (memcmp((void *)&tp->t_winsize, data,
1243 		    sizeof(struct winsize))) {
1244 			tp->t_winsize = *(struct winsize *)data;
1245 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1246 		}
1247 		mutex_spin_exit(&tty_lock);
1248 		break;
1249 	default:
1250 		/* We may have to load the compat module for this. */
1251 		for (;;) {
1252 			rw_enter(&ttcompat_lock, RW_READER);
1253 			if (ttcompatvec != NULL) {
1254 				break;
1255 			}
1256 			rw_exit(&ttcompat_lock);
1257 			mutex_enter(&module_lock);
1258 			(void)module_autoload("compat", MODULE_CLASS_ANY);
1259 			if (ttcompatvec == NULL) {
1260 				mutex_exit(&module_lock);
1261 				return EPASSTHROUGH;
1262 			}
1263 			mutex_exit(&module_lock);
1264 		}
1265 		error = (*ttcompatvec)(tp, cmd, data, flag, l);
1266 		rw_exit(&ttcompat_lock);
1267 		return error;
1268 	}
1269 	return (0);
1270 }
1271 
1272 int
1273 ttpoll(struct tty *tp, int events, struct lwp *l)
1274 {
1275 	int	revents;
1276 
1277 	revents = 0;
1278 	mutex_spin_enter(&tty_lock);
1279 	if (events & (POLLIN | POLLRDNORM))
1280 		if (ttnread(tp) > 0)
1281 			revents |= events & (POLLIN | POLLRDNORM);
1282 
1283 	if (events & (POLLOUT | POLLWRNORM))
1284 		if (tp->t_outq.c_cc <= tp->t_lowat)
1285 			revents |= events & (POLLOUT | POLLWRNORM);
1286 
1287 	if (events & POLLHUP)
1288 		if (!CONNECTED(tp))
1289 			revents |= POLLHUP;
1290 
1291 	if (revents == 0) {
1292 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1293 			selrecord(l, &tp->t_rsel);
1294 
1295 		if (events & (POLLOUT | POLLWRNORM))
1296 			selrecord(l, &tp->t_wsel);
1297 	}
1298 
1299 	mutex_spin_exit(&tty_lock);
1300 
1301 	return (revents);
1302 }
1303 
1304 static void
1305 filt_ttyrdetach(struct knote *kn)
1306 {
1307 	struct tty	*tp;
1308 
1309 	tp = kn->kn_hook;
1310 	mutex_spin_enter(&tty_lock);
1311 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1312 	mutex_spin_exit(&tty_lock);
1313 }
1314 
1315 static int
1316 filt_ttyread(struct knote *kn, long hint)
1317 {
1318 	struct tty	*tp;
1319 
1320 	tp = kn->kn_hook;
1321 	if ((hint & NOTE_SUBMIT) == 0)
1322 		mutex_spin_enter(&tty_lock);
1323 	kn->kn_data = ttnread(tp);
1324 	if ((hint & NOTE_SUBMIT) == 0)
1325 		mutex_spin_exit(&tty_lock);
1326 	return (kn->kn_data > 0);
1327 }
1328 
1329 static void
1330 filt_ttywdetach(struct knote *kn)
1331 {
1332 	struct tty	*tp;
1333 
1334 	tp = kn->kn_hook;
1335 	mutex_spin_enter(&tty_lock);
1336 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1337 	mutex_spin_exit(&tty_lock);
1338 }
1339 
1340 static int
1341 filt_ttywrite(struct knote *kn, long hint)
1342 {
1343 	struct tty	*tp;
1344 	int		canwrite;
1345 
1346 	tp = kn->kn_hook;
1347 	if ((hint & NOTE_SUBMIT) == 0)
1348 		mutex_spin_enter(&tty_lock);
1349 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1350 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1351 	if ((hint & NOTE_SUBMIT) == 0)
1352 		mutex_spin_exit(&tty_lock);
1353 	return (canwrite);
1354 }
1355 
1356 static const struct filterops ttyread_filtops =
1357 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1358 static const struct filterops ttywrite_filtops =
1359 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1360 
1361 int
1362 ttykqfilter(dev_t dev, struct knote *kn)
1363 {
1364 	struct tty	*tp;
1365 	struct klist	*klist;
1366 
1367 	if ((tp = cdev_tty(dev)) == NULL)
1368 		return (ENXIO);
1369 
1370 	switch (kn->kn_filter) {
1371 	case EVFILT_READ:
1372 		klist = &tp->t_rsel.sel_klist;
1373 		kn->kn_fop = &ttyread_filtops;
1374 		break;
1375 	case EVFILT_WRITE:
1376 		klist = &tp->t_wsel.sel_klist;
1377 		kn->kn_fop = &ttywrite_filtops;
1378 		break;
1379 	default:
1380 		return EINVAL;
1381 	}
1382 
1383 	kn->kn_hook = tp;
1384 
1385 	mutex_spin_enter(&tty_lock);
1386 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1387 	mutex_spin_exit(&tty_lock);
1388 
1389 	return (0);
1390 }
1391 
1392 /*
1393  * Find the number of chars ready to be read from this tty.
1394  * Call with the tty lock held.
1395  */
1396 static int
1397 ttnread(struct tty *tp)
1398 {
1399 	int	nread;
1400 
1401 	KASSERT(mutex_owned(&tty_lock));
1402 
1403 	if (ISSET(tp->t_lflag, PENDIN))
1404 		ttypend(tp);
1405 	nread = tp->t_canq.c_cc;
1406 	if (!ISSET(tp->t_lflag, ICANON)) {
1407 		nread += tp->t_rawq.c_cc;
1408 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1409 			nread = 0;
1410 	}
1411 	return (nread);
1412 }
1413 
1414 /*
1415  * Wait for output to drain.
1416  */
1417 int
1418 ttywait(struct tty *tp)
1419 {
1420 	int	error;
1421 
1422 	error = 0;
1423 
1424 	mutex_spin_enter(&tty_lock);
1425 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1426 	    CONNECTED(tp) && tp->t_oproc) {
1427 		(*tp->t_oproc)(tp);
1428 		error = ttysleep(tp, &tp->t_outcv, true, 0);
1429 		if (error)
1430 			break;
1431 	}
1432 	mutex_spin_exit(&tty_lock);
1433 
1434 	return (error);
1435 }
1436 
1437 /*
1438  * Flush if successfully wait.
1439  */
1440 int
1441 ttywflush(struct tty *tp)
1442 {
1443 	int	error;
1444 
1445 	if ((error = ttywait(tp)) == 0) {
1446 		mutex_spin_enter(&tty_lock);
1447 		ttyflush(tp, FREAD);
1448 		mutex_spin_exit(&tty_lock);
1449 	}
1450 	return (error);
1451 }
1452 
1453 /*
1454  * Flush tty read and/or write queues, notifying anyone waiting.
1455  * Call with the tty lock held.
1456  */
1457 void
1458 ttyflush(struct tty *tp, int rw)
1459 {
1460 
1461 	KASSERT(mutex_owned(&tty_lock));
1462 
1463 	if (rw & FREAD) {
1464 		FLUSHQ(&tp->t_canq);
1465 		FLUSHQ(&tp->t_rawq);
1466 		tp->t_rocount = 0;
1467 		tp->t_rocol = 0;
1468 		CLR(tp->t_state, TS_LOCAL);
1469 		ttwakeup(tp);
1470 	}
1471 	if (rw & FWRITE) {
1472 		CLR(tp->t_state, TS_TTSTOP);
1473 		cdev_stop(tp, rw);
1474 		FLUSHQ(&tp->t_outq);
1475 		cv_broadcast(&tp->t_outcv);
1476 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1477 	}
1478 }
1479 
1480 /*
1481  * Copy in the default termios characters.
1482  */
1483 void
1484 ttychars(struct tty *tp)
1485 {
1486 
1487 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1488 }
1489 
1490 /*
1491  * Send stop character on input overflow.
1492  * Call with the tty lock held.
1493  */
1494 static void
1495 ttyblock(struct tty *tp)
1496 {
1497 	int	total;
1498 
1499 	KASSERT(mutex_owned(&tty_lock));
1500 
1501 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1502 	if (tp->t_rawq.c_cc > TTYHOG) {
1503 		ttyflush(tp, FREAD | FWRITE);
1504 		CLR(tp->t_state, TS_TBLOCK);
1505 	}
1506 	/*
1507 	 * Block further input iff: current input > threshold
1508 	 * AND input is available to user program.
1509 	 */
1510 	if (total >= TTYHOG / 2 &&
1511 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1512 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1513 		if (ISSET(tp->t_iflag, IXOFF) &&
1514 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1515 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1516 			SET(tp->t_state, TS_TBLOCK);
1517 			ttstart(tp);
1518 		}
1519 		/* Try to block remote output via hardware flow control. */
1520 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1521 		    (*tp->t_hwiflow)(tp, 1) != 0)
1522 			SET(tp->t_state, TS_TBLOCK);
1523 	}
1524 }
1525 
1526 /*
1527  * Delayed line discipline output
1528  */
1529 void
1530 ttrstrt(void *tp_arg)
1531 {
1532 	struct tty	*tp;
1533 
1534 #ifdef DIAGNOSTIC
1535 	if (tp_arg == NULL)
1536 		panic("ttrstrt");
1537 #endif
1538 	tp = tp_arg;
1539 	mutex_spin_enter(&tty_lock);
1540 
1541 	CLR(tp->t_state, TS_TIMEOUT);
1542 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1543 
1544 	mutex_spin_exit(&tty_lock);
1545 }
1546 
1547 /*
1548  * start a line discipline
1549  * Always call with tty lock held?
1550  */
1551 int
1552 ttstart(struct tty *tp)
1553 {
1554 
1555 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1556 		(*tp->t_oproc)(tp);
1557 	return (0);
1558 }
1559 
1560 /*
1561  * "close" a line discipline
1562  */
1563 int
1564 ttylclose(struct tty *tp, int flag)
1565 {
1566 
1567 	if (flag & FNONBLOCK) {
1568 		mutex_spin_enter(&tty_lock);
1569 		ttyflush(tp, FREAD | FWRITE);
1570 		mutex_spin_exit(&tty_lock);
1571 	} else
1572 		ttywflush(tp);
1573 	return (0);
1574 }
1575 
1576 /*
1577  * Handle modem control transition on a tty.
1578  * Flag indicates new state of carrier.
1579  * Returns 0 if the line should be turned off, otherwise 1.
1580  */
1581 int
1582 ttymodem(struct tty *tp, int flag)
1583 {
1584 
1585 	mutex_spin_enter(&tty_lock);
1586 	if (flag == 0) {
1587 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1588 			/*
1589 			 * Lost carrier.
1590 			 */
1591 			CLR(tp->t_state, TS_CARR_ON);
1592 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1593 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1594 				ttyflush(tp, FREAD | FWRITE);
1595 				mutex_spin_exit(&tty_lock);
1596 				return (0);
1597 			}
1598 		}
1599 	} else {
1600 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1601 			/*
1602 			 * Carrier now on.
1603 			 */
1604 			SET(tp->t_state, TS_CARR_ON);
1605 			ttwakeup(tp);
1606 		}
1607 	}
1608 	mutex_spin_exit(&tty_lock);
1609 
1610 	return (1);
1611 }
1612 
1613 /*
1614  * Default modem control routine (for other line disciplines).
1615  * Return argument flag, to turn off device on carrier drop.
1616  */
1617 int
1618 nullmodem(struct tty *tp, int flag)
1619 {
1620 
1621 	mutex_spin_enter(&tty_lock);
1622 	if (flag)
1623 		SET(tp->t_state, TS_CARR_ON);
1624 	else {
1625 		CLR(tp->t_state, TS_CARR_ON);
1626 		if (!CONNECTED(tp)) {
1627 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1628 			mutex_spin_exit(&tty_lock);
1629 			return (0);
1630 		}
1631 	}
1632 	mutex_spin_exit(&tty_lock);
1633 
1634 	return (1);
1635 }
1636 
1637 /*
1638  * Reinput pending characters after state switch.
1639  */
1640 void
1641 ttypend(struct tty *tp)
1642 {
1643 	struct clist	tq;
1644 	int		c;
1645 
1646 	KASSERT(mutex_owned(&tty_lock));
1647 
1648 	CLR(tp->t_lflag, PENDIN);
1649 	SET(tp->t_state, TS_TYPEN);
1650 	tq = tp->t_rawq;
1651 	tp->t_rawq.c_cc = 0;
1652 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1653 	while ((c = getc(&tq)) >= 0)
1654 		ttyinput_wlock(c, tp);
1655 	CLR(tp->t_state, TS_TYPEN);
1656 }
1657 
1658 /*
1659  * Process a read call on a tty device.
1660  */
1661 int
1662 ttread(struct tty *tp, struct uio *uio, int flag)
1663 {
1664 	struct clist	*qp;
1665 	u_char		*cc;
1666 	struct proc	*p;
1667 	int		c, first, error, has_stime, last_cc;
1668 	long		lflag, slp;
1669 	struct timeval	now, stime;
1670 
1671 	stime.tv_usec = 0;	/* XXX gcc */
1672 	stime.tv_sec = 0;	/* XXX gcc */
1673 
1674 	cc = tp->t_cc;
1675 	p = curproc;
1676 	error = 0;
1677 	has_stime = 0;
1678 	last_cc = 0;
1679 	slp = 0;
1680 
1681  loop:
1682 	mutex_spin_enter(&tty_lock);
1683 	lflag = tp->t_lflag;
1684 	/*
1685 	 * take pending input first
1686 	 */
1687 	if (ISSET(lflag, PENDIN))
1688 		ttypend(tp);
1689 
1690 	/*
1691 	 * Hang process if it's in the background.
1692 	 */
1693 	if (isbackground(p, tp)) {
1694 		if (sigismasked(curlwp, SIGTTIN) ||
1695 		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1696 			mutex_spin_exit(&tty_lock);
1697 			return (EIO);
1698 		}
1699 		mutex_spin_exit(&tty_lock);
1700 
1701 		mutex_enter(proc_lock);
1702 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1703 		mutex_exit(proc_lock);
1704 
1705 		mutex_spin_enter(&tty_lock);
1706 		error = ttysleep(tp, &lbolt, true, 0);
1707 		mutex_spin_exit(&tty_lock);
1708 		if (error)
1709 			return (error);
1710 		goto loop;
1711 	}
1712 
1713 	if (!ISSET(lflag, ICANON)) {
1714 		int m = cc[VMIN];
1715 		long t = cc[VTIME];
1716 
1717 		qp = &tp->t_rawq;
1718 		/*
1719 		 * Check each of the four combinations.
1720 		 * (m > 0 && t == 0) is the normal read case.
1721 		 * It should be fairly efficient, so we check that and its
1722 		 * companion case (m == 0 && t == 0) first.
1723 		 * For the other two cases, we compute the target sleep time
1724 		 * into slp.
1725 		 */
1726 		if (t == 0) {
1727 			if (qp->c_cc < m)
1728 				goto sleep;
1729 			goto read;
1730 		}
1731 		t *= hz;		/* time in deca-ticks */
1732 /*
1733  * Time difference in deca-ticks, split division to avoid numeric overflow.
1734  * Ok for hz < ~200kHz
1735  */
1736 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1737 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1738 		if (m > 0) {
1739 			if (qp->c_cc <= 0)
1740 				goto sleep;
1741 			if (qp->c_cc >= m)
1742 				goto read;
1743 			if (!has_stime) {
1744 				/* first character, start timer */
1745 				has_stime = 1;
1746 				getmicrotime(&stime);
1747 				slp = t;
1748 			} else if (qp->c_cc > last_cc) {
1749 				/* got a character, restart timer */
1750 				getmicrotime(&stime);
1751 				slp = t;
1752 			} else {
1753 				/* nothing, check expiration */
1754 				getmicrotime(&now);
1755 				slp = t - diff(now, stime);
1756 			}
1757 		} else {	/* m == 0 */
1758 			if (qp->c_cc > 0)
1759 				goto read;
1760 			if (!has_stime) {
1761 				has_stime = 1;
1762 				getmicrotime(&stime);
1763 				slp = t;
1764 			} else {
1765 				getmicrotime(&now);
1766 				slp = t - diff(now, stime);
1767 			}
1768 		}
1769 		last_cc = qp->c_cc;
1770 #undef diff
1771 		if (slp > 0) {
1772 			/*
1773 			 * Convert deca-ticks back to ticks.
1774 			 * Rounding down may make us wake up just short
1775 			 * of the target, so we round up.
1776 			 * Maybe we should do 'slp/10 + 1' because the
1777 			 * first tick maybe almost immediate.
1778 			 * However it is more useful for a program that sets
1779 			 * VTIME=10 to wakeup every second not every 1.01
1780 			 * seconds (if hz=100).
1781 			 */
1782 			slp = (slp + 9)/ 10;
1783 			goto sleep;
1784 		}
1785 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1786 		int	carrier;
1787 
1788  sleep:
1789 		/*
1790 		 * If there is no input, sleep on rawq
1791 		 * awaiting hardware receipt and notification.
1792 		 * If we have data, we don't need to check for carrier.
1793 		 */
1794 		carrier = CONNECTED(tp);
1795 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1796 			mutex_spin_exit(&tty_lock);
1797 			return (0);	/* EOF */
1798 		}
1799 		if (flag & IO_NDELAY) {
1800 			mutex_spin_exit(&tty_lock);
1801 			return (EWOULDBLOCK);
1802 		}
1803 		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1804 		mutex_spin_exit(&tty_lock);
1805 		/* VMIN == 0: any quantity read satisfies */
1806 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1807 			return (0);
1808 		if (error && error != EWOULDBLOCK)
1809 			return (error);
1810 		goto loop;
1811 	}
1812  read:
1813 	mutex_spin_exit(&tty_lock);
1814 
1815 	/*
1816 	 * Input present, check for input mapping and processing.
1817 	 */
1818 	first = 1;
1819 	while ((c = getc(qp)) >= 0) {
1820 		/*
1821 		 * delayed suspend (^Y)
1822 		 */
1823 		if (CCEQ(cc[VDSUSP], c) &&
1824 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
1825 			mutex_spin_enter(&tty_lock);
1826 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
1827 			if (first) {
1828 				error = ttysleep(tp, &lbolt, true, 0);
1829 				mutex_spin_exit(&tty_lock);
1830 				if (error)
1831 					break;
1832 				goto loop;
1833 			} else
1834 				mutex_spin_exit(&tty_lock);
1835 			break;
1836 		}
1837 		/*
1838 		 * Interpret EOF only in canonical mode.
1839 		 */
1840 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1841 			break;
1842 		/*
1843 		 * Give user character.
1844 		 */
1845  		error = ureadc(c, uio);
1846 		if (error)
1847 			break;
1848  		if (uio->uio_resid == 0)
1849 			break;
1850 		/*
1851 		 * In canonical mode check for a "break character"
1852 		 * marking the end of a "line of input".
1853 		 */
1854 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1855 			break;
1856 		first = 0;
1857 	}
1858 	/*
1859 	 * Look to unblock output now that (presumably)
1860 	 * the input queue has gone down.
1861 	 */
1862 	mutex_spin_enter(&tty_lock);
1863 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
1864 		if (ISSET(tp->t_iflag, IXOFF) &&
1865 		    cc[VSTART] != _POSIX_VDISABLE &&
1866 		    putc(cc[VSTART], &tp->t_outq) == 0) {
1867 			CLR(tp->t_state, TS_TBLOCK);
1868 			ttstart(tp);
1869 		}
1870 		/* Try to unblock remote output via hardware flow control. */
1871 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1872 		    (*tp->t_hwiflow)(tp, 0) != 0)
1873 			CLR(tp->t_state, TS_TBLOCK);
1874 	}
1875 	mutex_spin_exit(&tty_lock);
1876 
1877 	return (error);
1878 }
1879 
1880 /*
1881  * Check the output queue on tp for space for a kernel message (from uprintf
1882  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1883  * lose messages due to normal flow control, but don't let the tty run amok.
1884  * Sleeps here are not interruptible, but we return prematurely if new signals
1885  * arrive.
1886  * Call with tty lock held.
1887  */
1888 static int
1889 ttycheckoutq_wlock(struct tty *tp, int wait)
1890 {
1891 	int	hiwat, error;
1892 
1893 	KASSERT(mutex_owned(&tty_lock));
1894 
1895 	hiwat = tp->t_hiwat;
1896 	if (tp->t_outq.c_cc > hiwat + 200)
1897 		while (tp->t_outq.c_cc > hiwat) {
1898 			ttstart(tp);
1899 			if (wait == 0)
1900 				return (0);
1901 			error = ttysleep(tp, &tp->t_outcv, true, hz);
1902 			if (error == EINTR)
1903 				wait = 0;
1904 		}
1905 
1906 	return (1);
1907 }
1908 
1909 int
1910 ttycheckoutq(struct tty *tp, int wait)
1911 {
1912 	int	r;
1913 
1914 	mutex_spin_enter(&tty_lock);
1915 	r = ttycheckoutq_wlock(tp, wait);
1916 	mutex_spin_exit(&tty_lock);
1917 
1918 	return (r);
1919 }
1920 
1921 /*
1922  * Process a write call on a tty device.
1923  */
1924 int
1925 ttwrite(struct tty *tp, struct uio *uio, int flag)
1926 {
1927 	u_char		*cp;
1928 	struct proc	*p;
1929 	int		cc, ce, i, hiwat, error;
1930 	u_char		obuf[OBUFSIZ];
1931 
1932 	cp = NULL;
1933 	hiwat = tp->t_hiwat;
1934 	error = 0;
1935 	cc = 0;
1936  loop:
1937 	mutex_spin_enter(&tty_lock);
1938 	if (!CONNECTED(tp)) {
1939 		if (ISSET(tp->t_state, TS_ISOPEN)) {
1940 			mutex_spin_exit(&tty_lock);
1941 			return (EIO);
1942 		} else if (flag & IO_NDELAY) {
1943 			mutex_spin_exit(&tty_lock);
1944 			error = EWOULDBLOCK;
1945 			goto out;
1946 		} else {
1947 			/* Sleep awaiting carrier. */
1948 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
1949 			mutex_spin_exit(&tty_lock);
1950 			if (error)
1951 				goto out;
1952 			goto loop;
1953 		}
1954 	}
1955 
1956 	/*
1957 	 * Hang the process if it's in the background.
1958 	 */
1959 	p = curproc;
1960 	if (isbackground(p, tp) &&
1961 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
1962 	    !sigismasked(curlwp, SIGTTOU)) {
1963 		if (p->p_pgrp->pg_jobc == 0) {
1964 			error = EIO;
1965 			mutex_spin_exit(&tty_lock);
1966 			goto out;
1967 		}
1968 		mutex_spin_exit(&tty_lock);
1969 
1970 		mutex_enter(proc_lock);
1971 		pgsignal(p->p_pgrp, SIGTTOU, 1);
1972 		mutex_exit(proc_lock);
1973 
1974 		mutex_spin_enter(&tty_lock);
1975 		error = ttysleep(tp, &lbolt, true, 0);
1976 		mutex_spin_exit(&tty_lock);
1977 		if (error)
1978 			goto out;
1979 		goto loop;
1980 	}
1981 	mutex_spin_exit(&tty_lock);
1982 
1983 	/*
1984 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1985 	 * output translation.  Keep track of high water mark, sleep on
1986 	 * overflow awaiting device aid in acquiring new space.
1987 	 */
1988 	while (uio->uio_resid > 0 || cc > 0) {
1989 		if (ISSET(tp->t_lflag, FLUSHO)) {
1990 			uio->uio_resid = 0;
1991 			return (0);
1992 		}
1993 		if (tp->t_outq.c_cc > hiwat)
1994 			goto ovhiwat;
1995 		/*
1996 		 * Grab a hunk of data from the user, unless we have some
1997 		 * leftover from last time.
1998 		 */
1999 		if (cc == 0) {
2000 			cc = min(uio->uio_resid, OBUFSIZ);
2001 			cp = obuf;
2002 			error = uiomove(cp, cc, uio);
2003 			if (error) {
2004 				cc = 0;
2005 				goto out;
2006 			}
2007 		}
2008 		/*
2009 		 * If nothing fancy need be done, grab those characters we
2010 		 * can handle without any of ttyoutput's processing and
2011 		 * just transfer them to the output q.  For those chars
2012 		 * which require special processing (as indicated by the
2013 		 * bits in char_type), call ttyoutput.  After processing
2014 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2015 		 * immediately.
2016 		 */
2017 		mutex_spin_enter(&tty_lock);
2018 		while (cc > 0) {
2019 			if (!ISSET(tp->t_oflag, OPOST))
2020 				ce = cc;
2021 			else {
2022 				ce = cc - scanc((u_int)cc, cp, char_type,
2023 				    CCLASSMASK);
2024 				/*
2025 				 * If ce is zero, then we're processing
2026 				 * a special character through ttyoutput.
2027 				 */
2028 				if (ce == 0) {
2029 					tp->t_rocount = 0;
2030 					if (ttyoutput(*cp, tp) >= 0) {
2031 						/* out of space */
2032 						mutex_spin_exit(&tty_lock);
2033 						goto overfull;
2034 					}
2035 					cp++;
2036 					cc--;
2037 					if (ISSET(tp->t_lflag, FLUSHO) ||
2038 					    tp->t_outq.c_cc > hiwat) {
2039 						mutex_spin_exit(&tty_lock);
2040 						goto ovhiwat;
2041 					}
2042 					continue;
2043 				}
2044 			}
2045 			/*
2046 			 * A bunch of normal characters have been found.
2047 			 * Transfer them en masse to the output queue and
2048 			 * continue processing at the top of the loop.
2049 			 * If there are any further characters in this
2050 			 * <= OBUFSIZ chunk, the first should be a character
2051 			 * requiring special handling by ttyoutput.
2052 			 */
2053 			tp->t_rocount = 0;
2054 			i = b_to_q(cp, ce, &tp->t_outq);
2055 			ce -= i;
2056 			tp->t_column += ce;
2057 			cp += ce, cc -= ce, tk_nout += ce;
2058 			tp->t_outcc += ce;
2059 			if (i > 0) {
2060 				/* out of space */
2061 				mutex_spin_exit(&tty_lock);
2062 				goto overfull;
2063 			}
2064 			if (ISSET(tp->t_lflag, FLUSHO) ||
2065 			    tp->t_outq.c_cc > hiwat)
2066 				break;
2067 		}
2068 		ttstart(tp);
2069 		mutex_spin_exit(&tty_lock);
2070 	}
2071 
2072  out:
2073 	/*
2074 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2075 	 * offset and iov pointers have moved forward, but it doesn't matter
2076 	 * (the call will either return short or restart with a new uio).
2077 	 */
2078 	uio->uio_resid += cc;
2079 	return (error);
2080 
2081  overfull:
2082 	/*
2083 	 * Since we are using ring buffers, if we can't insert any more into
2084 	 * the output queue, we can assume the ring is full and that someone
2085 	 * forgot to set the high water mark correctly.  We set it and then
2086 	 * proceed as normal.
2087 	 */
2088 	hiwat = tp->t_outq.c_cc - 1;
2089 
2090  ovhiwat:
2091 	mutex_spin_enter(&tty_lock);
2092 	ttstart(tp);
2093 	/*
2094 	 * This can only occur if FLUSHO is set in t_lflag,
2095 	 * or if ttstart/oproc is synchronous (or very fast).
2096 	 */
2097 	if (tp->t_outq.c_cc <= hiwat) {
2098 		mutex_spin_exit(&tty_lock);
2099 		goto loop;
2100 	}
2101 	if (flag & IO_NDELAY) {
2102 		mutex_spin_exit(&tty_lock);
2103 		error = EWOULDBLOCK;
2104 		goto out;
2105 	}
2106 	error = ttysleep(tp, &tp->t_outcv, true, 0);
2107 	mutex_spin_exit(&tty_lock);
2108 	if (error)
2109 		goto out;
2110 	goto loop;
2111 }
2112 
2113 /*
2114  * Try to pull more output from the producer.  Return non-zero if
2115  * there is output ready to be sent.
2116  */
2117 bool
2118 ttypull(struct tty *tp)
2119 {
2120 
2121 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2122 
2123 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2124 		cv_broadcast(&tp->t_outcv);
2125 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2126 	}
2127 	return tp->t_outq.c_cc != 0;
2128 }
2129 
2130 /*
2131  * Rubout one character from the rawq of tp
2132  * as cleanly as possible.
2133  * Called with tty lock held.
2134  */
2135 void
2136 ttyrub(int c, struct tty *tp)
2137 {
2138 	u_char	*cp;
2139 	int	savecol, tabc;
2140 
2141 	KASSERT(mutex_owned(&tty_lock));
2142 
2143 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2144 		return;
2145 	CLR(tp->t_lflag, FLUSHO);
2146 	if (ISSET(tp->t_lflag, ECHOE)) {
2147 		if (tp->t_rocount == 0) {
2148 			/*
2149 			 * Screwed by ttwrite; retype
2150 			 */
2151 			ttyretype(tp);
2152 			return;
2153 		}
2154 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2155 			ttyrubo(tp, 2);
2156 		else {
2157 			CLR(c, ~TTY_CHARMASK);
2158 			switch (CCLASS(c)) {
2159 			case ORDINARY:
2160 				ttyrubo(tp, 1);
2161 				break;
2162 			case BACKSPACE:
2163 			case CONTROL:
2164 			case NEWLINE:
2165 			case RETURN:
2166 			case VTAB:
2167 				if (ISSET(tp->t_lflag, ECHOCTL))
2168 					ttyrubo(tp, 2);
2169 				break;
2170 			case TAB:
2171 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2172 					ttyretype(tp);
2173 					return;
2174 				}
2175 				savecol = tp->t_column;
2176 				SET(tp->t_state, TS_CNTTB);
2177 				SET(tp->t_lflag, FLUSHO);
2178 				tp->t_column = tp->t_rocol;
2179 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2180 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2181 					ttyecho(tabc, tp);
2182 				CLR(tp->t_lflag, FLUSHO);
2183 				CLR(tp->t_state, TS_CNTTB);
2184 
2185 				/* savecol will now be length of the tab. */
2186 				savecol -= tp->t_column;
2187 				tp->t_column += savecol;
2188 				if (savecol > 8)
2189 					savecol = 8;	/* overflow screw */
2190 				while (--savecol >= 0)
2191 					(void)ttyoutput('\b', tp);
2192 				break;
2193 			default:			/* XXX */
2194 				(void)printf("ttyrub: would panic c = %d, "
2195 				    "val = %d\n", c, CCLASS(c));
2196 			}
2197 		}
2198 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2199 		if (!ISSET(tp->t_state, TS_ERASE)) {
2200 			SET(tp->t_state, TS_ERASE);
2201 			(void)ttyoutput('\\', tp);
2202 		}
2203 		ttyecho(c, tp);
2204 	} else
2205 		ttyecho(tp->t_cc[VERASE], tp);
2206 	--tp->t_rocount;
2207 }
2208 
2209 /*
2210  * Back over cnt characters, erasing them.
2211  * Called with tty lock held.
2212  */
2213 static void
2214 ttyrubo(struct tty *tp, int cnt)
2215 {
2216 
2217 	KASSERT(mutex_owned(&tty_lock));
2218 
2219 	while (cnt-- > 0) {
2220 		(void)ttyoutput('\b', tp);
2221 		(void)ttyoutput(' ', tp);
2222 		(void)ttyoutput('\b', tp);
2223 	}
2224 }
2225 
2226 /*
2227  * ttyretype --
2228  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2229  *	been checked.
2230  *
2231  * Called with tty lock held.
2232  */
2233 void
2234 ttyretype(struct tty *tp)
2235 {
2236 	u_char	*cp;
2237 	int	c;
2238 
2239 	KASSERT(mutex_owned(&tty_lock));
2240 
2241 	/* Echo the reprint character. */
2242 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2243 		ttyecho(tp->t_cc[VREPRINT], tp);
2244 
2245 	(void)ttyoutput('\n', tp);
2246 
2247 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2248 		ttyecho(c, tp);
2249 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2250 		ttyecho(c, tp);
2251 	CLR(tp->t_state, TS_ERASE);
2252 
2253 	tp->t_rocount = tp->t_rawq.c_cc;
2254 	tp->t_rocol = 0;
2255 }
2256 
2257 /*
2258  * Echo a typed character to the terminal.
2259  * Called with tty lock held.
2260  */
2261 static void
2262 ttyecho(int c, struct tty *tp)
2263 {
2264 
2265 	KASSERT(mutex_owned(&tty_lock));
2266 
2267 	if (!ISSET(tp->t_state, TS_CNTTB))
2268 		CLR(tp->t_lflag, FLUSHO);
2269 	if ((!ISSET(tp->t_lflag, ECHO) &&
2270 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2271 	    ISSET(tp->t_lflag, EXTPROC))
2272 		return;
2273 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2274 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2275 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2276 		(void)ttyoutput('^', tp);
2277 		CLR(c, ~TTY_CHARMASK);
2278 		if (c == 0177)
2279 			c = '?';
2280 		else
2281 			c += 'A' - 1;
2282 	}
2283 	(void)ttyoutput(c, tp);
2284 }
2285 
2286 /*
2287  * Wake up any readers on a tty.
2288  * Called with tty lock held.
2289  */
2290 void
2291 ttwakeup(struct tty *tp)
2292 {
2293 
2294 	KASSERT(mutex_owned(&tty_lock));
2295 
2296 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2297 	if (ISSET(tp->t_state, TS_ASYNC))
2298 		ttysig(tp, TTYSIG_PG2, SIGIO);
2299 	cv_broadcast(&tp->t_rawcv);
2300 }
2301 
2302 /*
2303  * Look up a code for a specified speed in a conversion table;
2304  * used by drivers to map software speed values to hardware parameters.
2305  */
2306 int
2307 ttspeedtab(int speed, const struct speedtab *table)
2308 {
2309 
2310 	for (; table->sp_speed != -1; table++)
2311 		if (table->sp_speed == speed)
2312 			return (table->sp_code);
2313 	return (-1);
2314 }
2315 
2316 /*
2317  * Set tty hi and low water marks.
2318  *
2319  * Try to arrange the dynamics so there's about one second
2320  * from hi to low water.
2321  */
2322 void
2323 ttsetwater(struct tty *tp)
2324 {
2325 	int	cps, x;
2326 
2327 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2328 
2329 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2330 
2331 	cps = tp->t_ospeed / 10;
2332 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2333 	x += cps;
2334 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2335 	tp->t_hiwat = roundup(x, CBSIZE);
2336 #undef	CLAMP
2337 }
2338 
2339 /*
2340  * Prepare report on state of foreground process group.
2341  * Call with proc_lock held.
2342  */
2343 void
2344 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2345 {
2346 	struct lwp	*l;
2347 	struct proc	*p, *pick = NULL;
2348 	struct timeval	utime, stime;
2349 	int		tmp;
2350 	fixpt_t		pctcpu = 0;
2351 	const char	*msg;
2352 	char		lmsg[100];
2353 	long		rss;
2354 
2355 	KASSERT(mutex_owned(proc_lock));
2356 
2357 	*buf = '\0';
2358 
2359 	if (tp->t_session == NULL)
2360 		msg = "not a controlling terminal\n";
2361 	else if (tp->t_pgrp == NULL)
2362 		msg = "no foreground process group\n";
2363 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2364 		msg = "empty foreground process group\n";
2365 	else {
2366 		/* Pick interesting process. */
2367 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2368 			struct proc *oldpick;
2369 
2370 			if (pick == NULL) {
2371 				pick = p;
2372 				continue;
2373 			}
2374 			if (pick->p_lock < p->p_lock) {
2375 				mutex_enter(pick->p_lock);
2376 				mutex_enter(p->p_lock);
2377 			} else if (pick->p_lock > p->p_lock) {
2378 				mutex_enter(p->p_lock);
2379 				mutex_enter(pick->p_lock);
2380 			} else
2381 				mutex_enter(p->p_lock);
2382 			oldpick = pick;
2383 			if (proc_compare(pick, p))
2384 				pick = p;
2385 			mutex_exit(p->p_lock);
2386 			if (p->p_lock != oldpick->p_lock)
2387 				mutex_exit(oldpick->p_lock);
2388 		}
2389 		if (fromsig &&
2390 		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2391 		    SA_NOKERNINFO))
2392 			return;
2393 		msg = NULL;
2394 	}
2395 
2396 	/* Print load average. */
2397 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2398 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2399 	strlcat(buf, lmsg, bufsz);
2400 
2401 	if (pick == NULL) {
2402 		strlcat(buf, msg, bufsz);
2403 		return;
2404 	}
2405 
2406 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2407 	    pick->p_pid);
2408 	strlcat(buf, lmsg, bufsz);
2409 
2410 	mutex_enter(pick->p_lock);
2411 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2412 		lwp_lock(l);
2413 		snprintf(lmsg, sizeof(lmsg), "%s%s",
2414 		    l->l_stat == LSONPROC ? "running" :
2415 		    l->l_stat == LSRUN ? "runnable" :
2416 		    l->l_wchan ? l->l_wmesg : "iowait",
2417 		    (LIST_NEXT(l, l_sibling) != NULL) ? " " : "] ");
2418 		lwp_unlock(l);
2419 		strlcat(buf, lmsg, bufsz);
2420 		pctcpu += l->l_pctcpu;
2421 	}
2422 	pctcpu += pick->p_pctcpu;
2423 	calcru(pick, &utime, &stime, NULL, NULL);
2424 	mutex_exit(pick->p_lock);
2425 
2426 	/* Round up and print user+system time, %CPU and RSS. */
2427 	utime.tv_usec += 5000;
2428 	if (utime.tv_usec >= 1000000) {
2429 		utime.tv_sec += 1;
2430 		utime.tv_usec -= 1000000;
2431 	}
2432 	stime.tv_usec += 5000;
2433 	if (stime.tv_usec >= 1000000) {
2434 		stime.tv_sec += 1;
2435 		stime.tv_usec -= 1000000;
2436 	}
2437 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2438 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2439 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2440 		rss = 0;
2441 	else
2442 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2443 
2444 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2445 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2446 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2447 	    tmp / 100, rss);
2448 	strlcat(buf, lmsg, bufsz);
2449 }
2450 
2451 /*
2452  * Print report on state of foreground process group.
2453  * Call with tty_lock held.
2454  */
2455 void
2456 ttyputinfo(struct tty *tp, char *buf)
2457 {
2458 
2459 	KASSERT(mutex_owned(&tty_lock));
2460 
2461 	if (ttycheckoutq_wlock(tp, 0) == 0)
2462 		return;
2463 	ttyprintf_nolock(tp, "%s\n", buf);
2464 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2465 }
2466 
2467 /*
2468  * Returns 1 if p2 is "better" than p1
2469  *
2470  * The algorithm for picking the "interesting" process is thus:
2471  *
2472  *	1) Only foreground processes are eligible - implied.
2473  *	2) Runnable processes are favored over anything else.  The runner
2474  *	   with the highest CPU utilization is picked (l_pctcpu).  Ties are
2475  *	   broken by picking the highest pid.
2476  *	3) The sleeper with the shortest sleep time is next.  With ties,
2477  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2478  *	4) Further ties are broken by picking the highest pid.
2479  */
2480 #define	ISRUN(p)	((p)->p_nrlwps > 0)
2481 #define	TESTAB(a, b)	((a)<<1 | (b))
2482 #define	ONLYA	2
2483 #define	ONLYB	1
2484 #define	BOTH	3
2485 
2486 static int
2487 proc_compare(struct proc *p1, struct proc *p2)
2488 {
2489 	lwp_t *l1, *l2;
2490 
2491 	KASSERT(mutex_owned(p1->p_lock));
2492 	KASSERT(mutex_owned(p2->p_lock));
2493 
2494 	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2495 		return (1);
2496 	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2497 		return (0);
2498 	/*
2499 	 * see if at least one of them is runnable
2500 	 */
2501 	switch (TESTAB(ISRUN(p1), ISRUN(p2))) {
2502 	case ONLYA:
2503 		return (0);
2504 	case ONLYB:
2505 		return (1);
2506 	case BOTH:
2507 		/*
2508 		 * tie - favor one with highest recent CPU utilization
2509 		 */
2510 		if (l2->l_pctcpu > l1->l_pctcpu)
2511 			return (1);
2512 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2513 	}
2514 	/*
2515  	 * weed out zombies
2516 	 */
2517 	switch (TESTAB(P_ZOMBIE(p1), P_ZOMBIE(p2))) {
2518 	case ONLYA:
2519 		return (1);
2520 	case ONLYB:
2521 		return (0);
2522 	case BOTH:
2523 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2524 	}
2525 	/*
2526 	 * pick the one with the smallest sleep time
2527 	 */
2528 	if (l2->l_slptime > l2->l_slptime)
2529 		return (0);
2530 	if (l2->l_slptime > l2->l_slptime)
2531 		return (1);
2532 	/*
2533 	 * favor one sleeping in a non-interruptible sleep
2534 	 */
2535 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2536 		return (1);
2537 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2538 		return (0);
2539 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2540 }
2541 
2542 /*
2543  * Output char to tty; console putchar style.
2544  * Can be called with tty lock held through kprintf() machinery..
2545  */
2546 int
2547 tputchar(int c, int flags, struct tty *tp)
2548 {
2549 	int r = 0;
2550 
2551 	if ((flags & NOLOCK) == 0)
2552 		mutex_spin_enter(&tty_lock);
2553 	if (!CONNECTED(tp)) {
2554 		r = -1;
2555 		goto out;
2556 	}
2557 	if (c == '\n')
2558 		(void)ttyoutput('\r', tp);
2559 	(void)ttyoutput(c, tp);
2560 	ttstart(tp);
2561 out:
2562 	if ((flags & NOLOCK) == 0)
2563 		mutex_spin_exit(&tty_lock);
2564 	return (r);
2565 }
2566 
2567 /*
2568  * Sleep on chan, returning ERESTART if tty changed while we napped and
2569  * returning any errors (e.g. EINTR/ETIMEDOUT) reported by tsleep.  If
2570  * the tty is revoked, restarting a pending call will redo validation done
2571  * at the start of the call.
2572  *
2573  * Must be called with the tty lock held.
2574  */
2575 int
2576 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch, int timo)
2577 {
2578 	int	error;
2579 	short	gen;
2580 
2581 	KASSERT(mutex_owned(&tty_lock));
2582 
2583 	gen = tp->t_gen;
2584 	if (catch)
2585 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2586 	else
2587 		error = cv_timedwait(cv, &tty_lock, timo);
2588 	if (error != 0)
2589 		return (error);
2590 	return (tp->t_gen == gen ? 0 : ERESTART);
2591 }
2592 
2593 /*
2594  * Attach a tty to the tty list.
2595  *
2596  * This should be called ONLY once per real tty (including pty's).
2597  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2598  * distinctly NOT usable as tty's, and thus should not be attached to
2599  * the ttylist.  This is why this call is not done from ttymalloc().
2600  *
2601  * Device drivers should attach tty's at a similar time that they are
2602  * ttymalloc()'ed, or, for the case of statically allocated struct tty's
2603  * either in the attach or (first) open routine.
2604  */
2605 void
2606 tty_attach(struct tty *tp)
2607 {
2608 
2609 	mutex_spin_enter(&tty_lock);
2610 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2611 	++tty_count;
2612 	mutex_spin_exit(&tty_lock);
2613 }
2614 
2615 /*
2616  * Remove a tty from the tty list.
2617  */
2618 void
2619 tty_detach(struct tty *tp)
2620 {
2621 
2622 	mutex_spin_enter(&tty_lock);
2623 	--tty_count;
2624 #ifdef DIAGNOSTIC
2625 	if (tty_count < 0)
2626 		panic("tty_detach: tty_count < 0");
2627 #endif
2628 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2629 	mutex_spin_exit(&tty_lock);
2630 }
2631 
2632 /*
2633  * Allocate a tty structure and its associated buffers.
2634  */
2635 struct tty *
2636 ttymalloc(void)
2637 {
2638 	struct tty	*tp;
2639 	int i;
2640 
2641 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2642 	callout_init(&tp->t_rstrt_ch, 0);
2643 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2644 	/* XXX: default to 1024 chars for now */
2645 	clalloc(&tp->t_rawq, 1024, 1);
2646 	cv_init(&tp->t_rawcv, "ttyraw");
2647 	cv_init(&tp->t_rawcvf, "ttyrawf");
2648 	clalloc(&tp->t_canq, 1024, 1);
2649 	cv_init(&tp->t_cancv, "ttycan");
2650 	cv_init(&tp->t_cancvf, "ttycanf");
2651 	/* output queue doesn't need quoting */
2652 	clalloc(&tp->t_outq, 1024, 0);
2653 	cv_init(&tp->t_outcv, "ttyout");
2654 	cv_init(&tp->t_outcvf, "ttyoutf");
2655 	/* Set default line discipline. */
2656 	tp->t_linesw = ttyldisc_default();
2657 	selinit(&tp->t_rsel);
2658 	selinit(&tp->t_wsel);
2659 	for (i = 0; i < TTYSIG_COUNT; i++)
2660 		sigemptyset(&tp->t_sigs[i]);
2661 	return (tp);
2662 }
2663 
2664 /*
2665  * Free a tty structure and its buffers.
2666  *
2667  * Be sure to call tty_detach() for any tty that has been
2668  * tty_attach()ed.
2669  */
2670 void
2671 ttyfree(struct tty *tp)
2672 {
2673 	int i;
2674 
2675 	mutex_enter(proc_lock);
2676 	mutex_enter(&tty_lock);
2677 	for (i = 0; i < TTYSIG_COUNT; i++)
2678 		sigemptyset(&tp->t_sigs[i]);
2679 	if (tp->t_sigcount != 0)
2680 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2681 	mutex_exit(&tty_lock);
2682 	mutex_exit(proc_lock);
2683 
2684 	callout_halt(&tp->t_rstrt_ch, NULL);
2685 	callout_destroy(&tp->t_rstrt_ch);
2686 	ttyldisc_release(tp->t_linesw);
2687 	clfree(&tp->t_rawq);
2688 	clfree(&tp->t_canq);
2689 	clfree(&tp->t_outq);
2690 	cv_destroy(&tp->t_rawcv);
2691 	cv_destroy(&tp->t_rawcvf);
2692 	cv_destroy(&tp->t_cancv);
2693 	cv_destroy(&tp->t_cancvf);
2694 	cv_destroy(&tp->t_outcv);
2695 	cv_destroy(&tp->t_outcvf);
2696 	seldestroy(&tp->t_rsel);
2697 	seldestroy(&tp->t_wsel);
2698 	kmem_free(tp, sizeof(*tp));
2699 }
2700 
2701 /*
2702  * ttyprintf_nolock: send a message to a specific tty, without locking.
2703  *
2704  * => should be used only by tty driver or anything that knows the
2705  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2706  *    use tprintf]
2707  */
2708 static void
2709 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2710 {
2711 	va_list ap;
2712 
2713 	/* No mutex needed; going to process TTY. */
2714 	va_start(ap, fmt);
2715 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2716 	va_end(ap);
2717 }
2718 
2719 /*
2720  * Initialize the tty subsystem.
2721  */
2722 void
2723 tty_init(void)
2724 {
2725 
2726 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2727 	rw_init(&ttcompat_lock);
2728 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2729 	KASSERT(tty_sigsih != NULL);
2730 }
2731 
2732 /*
2733  * Send a signal from a tty to its process group or session leader.
2734  * Handoff to the target is deferred to a soft interrupt.
2735  */
2736 void
2737 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2738 {
2739 	sigset_t *sp;
2740 
2741 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2742 
2743 	sp = &tp->t_sigs[st];
2744 	if (sigismember(sp, sig))
2745 		return;
2746 	sigaddset(sp, sig);
2747 	if (tp->t_sigcount++ == 0)
2748 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2749 	softint_schedule(tty_sigsih);
2750 }
2751 
2752 /*
2753  * Deliver deferred signals from ttys.  Note that the process groups
2754  * and sessions associated with the ttys may have changed from when
2755  * the signal was originally sent, but in practice it should not matter.
2756  * For signals produced as a result of a syscall, the soft interrupt
2757  * will fire before the syscall returns to the user.
2758  */
2759 static void
2760 ttysigintr(void *cookie)
2761 {
2762 	struct tty *tp;
2763 	enum ttysigtype st;
2764 	struct pgrp *pgrp;
2765 	struct session *sess;
2766 	int sig, lflag;
2767 	char infobuf[200];
2768 
2769 	mutex_enter(proc_lock);
2770 	mutex_spin_enter(&tty_lock);
2771 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2772 		KASSERT(tp->t_sigcount > 0);
2773 		for (st = 0; st < TTYSIG_COUNT; st++) {
2774 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2775 				break;
2776 		}
2777 		KASSERT(st < TTYSIG_COUNT);
2778 		sigdelset(&tp->t_sigs[st], sig);
2779 		if (--tp->t_sigcount == 0)
2780 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2781 		pgrp = tp->t_pgrp;
2782 		sess = tp->t_session;
2783 		lflag = tp->t_lflag;
2784 		if  (sig == SIGINFO) {
2785 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2786 				/* Via ioctl: ignore tty option. */
2787 				tp->t_state &= ~TS_SIGINFO;
2788 				lflag |= ISIG;
2789 			}
2790 			if (!ISSET(lflag, NOKERNINFO)) {
2791 				mutex_spin_exit(&tty_lock);
2792 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
2793 				mutex_spin_enter(&tty_lock);
2794 				ttyputinfo(tp, infobuf);
2795 			}
2796 			if (!ISSET(lflag, ISIG))
2797 				continue;
2798 		}
2799 		mutex_spin_exit(&tty_lock);
2800 		KASSERT(sig != 0);
2801 		switch (st) {
2802 		case TTYSIG_PG1:
2803 			if (pgrp != NULL)
2804 				pgsignal(pgrp, sig, 1);
2805 			break;
2806 		case TTYSIG_PG2:
2807 			if (pgrp != NULL)
2808 				pgsignal(pgrp, sig, sess != NULL);
2809 			break;
2810 		case TTYSIG_LEADER:
2811 			if (sess != NULL && sess->s_leader != NULL)
2812 				psignal(sess->s_leader, sig);
2813 			break;
2814 		default:
2815 			/* NOTREACHED */
2816 			break;
2817 		}
2818 		mutex_spin_enter(&tty_lock);
2819 	}
2820 	mutex_spin_exit(&tty_lock);
2821 	mutex_exit(proc_lock);
2822 }
2823