xref: /netbsd-src/sys/kern/tty.c (revision 5bbd2a12505d72a8177929a37b5cee489d0a1cfd)
1 /*	$NetBSD: tty.c,v 1.253 2012/08/17 16:21:19 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 1982, 1986, 1990, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63  */
64 
65 #include <sys/cdefs.h>
66 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.253 2012/08/17 16:21:19 christos Exp $");
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/ioctl.h>
71 #include <sys/proc.h>
72 #define	TTYDEFCHARS
73 #include <sys/tty.h>
74 #undef	TTYDEFCHARS
75 #include <sys/file.h>
76 #include <sys/conf.h>
77 #include <sys/cpu.h>
78 #include <sys/dkstat.h>
79 #include <sys/uio.h>
80 #include <sys/kernel.h>
81 #include <sys/vnode.h>
82 #include <sys/syslog.h>
83 #include <sys/kmem.h>
84 #include <sys/signalvar.h>
85 #include <sys/resourcevar.h>
86 #include <sys/poll.h>
87 #include <sys/kprintf.h>
88 #include <sys/namei.h>
89 #include <sys/sysctl.h>
90 #include <sys/kauth.h>
91 #include <sys/intr.h>
92 #include <sys/ioctl_compat.h>
93 #include <sys/module.h>
94 #include <sys/bitops.h>
95 
96 static int	ttnread(struct tty *);
97 static void	ttyblock(struct tty *);
98 static void	ttyecho(int, struct tty *);
99 static void	ttyrubo(struct tty *, int);
100 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
101     __attribute__((__format__(__printf__,2,3)));
102 static int	proc_compare_wrapper(struct proc *, struct proc *);
103 static void	ttysigintr(void *);
104 
105 /* Symbolic sleep message strings. */
106 const char	ttclos[] = "ttycls";
107 const char	ttopen[] = "ttyopn";
108 const char	ttybg[] = "ttybg";
109 const char	ttyin[] = "ttyin";
110 const char	ttyout[] = "ttyout";
111 
112 /*
113  * Used to determine whether we still have a connection.  This is true in
114  * one of 3 cases:
115  * 1) We have carrier.
116  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
117  * 3) We're using a flow control mechanism that overloads the carrier signal.
118  */
119 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
120 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 unsigned char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
196 static void *tty_sigsih;
197 
198 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
199 int tty_count;
200 kmutex_t tty_lock;
201 krwlock_t ttcompat_lock;
202 int (*ttcompatvec)(struct tty *, u_long, void *, int, struct lwp *);
203 
204 uint64_t tk_cancc;
205 uint64_t tk_nin;
206 uint64_t tk_nout;
207 uint64_t tk_rawcc;
208 
209 static kauth_listener_t tty_listener;
210 
211 #define	TTY_MINQSIZE	0x00400
212 #define	TTY_MAXQSIZE	0x10000
213 int tty_qsize = TTY_MINQSIZE;
214 
215 static int
216 tty_get_qsize(int *qsize, int newsize)
217 {
218 	newsize = 1 << ilog2(newsize);	/* Make it a power of two */
219 
220 	if (newsize < TTY_MINQSIZE || newsize > TTY_MAXQSIZE)
221 		return EINVAL;
222 
223 	*qsize = newsize;
224 	return 0;
225 }
226 
227 static int
228 tty_set_qsize(struct tty *tp, int newsize)
229 {
230 	struct clist rawq, canq, outq;
231 	struct clist orawq, ocanq, ooutq;
232 
233 	clalloc(&rawq, newsize, 1);
234 	clalloc(&canq, newsize, 1);
235 	clalloc(&outq, newsize, 0);
236 
237 	mutex_spin_enter(&tty_lock);
238 
239 	if (tp->t_outq.c_cc != 0) {
240 		mutex_spin_exit(&tty_lock);
241 		clfree(&rawq);
242 		clfree(&canq);
243 		clfree(&outq);
244 		return EBUSY;
245 	}
246 
247 	orawq = tp->t_rawq;
248 	ocanq = tp->t_canq;
249 	ooutq = tp->t_outq;
250 
251 	tp->t_qsize = newsize;
252 	tp->t_rawq = rawq;
253 	tp->t_canq = canq;
254 	tp->t_outq = outq;
255 
256 	ttsetwater(tp);
257 
258 	mutex_spin_exit(&tty_lock);
259 
260 	clfree(&orawq);
261 	clfree(&ocanq);
262 	clfree(&ooutq);
263 
264 	return 0;
265 }
266 
267 static int
268 sysctl_kern_tty_qsize(SYSCTLFN_ARGS)
269 {
270 	int newsize;
271 	int error;
272 	struct sysctlnode node;
273 	node = *rnode;
274 	node.sysctl_data = &newsize;
275 
276 	newsize = tty_qsize;
277 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
278 	if (error || newp == NULL)
279 		return error;
280 
281 
282 	return tty_get_qsize(&tty_qsize, newsize);
283 }
284 
285 static void
286 sysctl_kern_tty_setup(void)
287 {
288 	const struct sysctlnode *rnode, *cnode;
289 	struct sysctllog *kern_tkstat_sysctllog, *kern_tty_sysctllog;
290 
291 	kern_tkstat_sysctllog = NULL;
292 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
293 		       CTLFLAG_PERMANENT,
294 		       CTLTYPE_NODE, "kern", NULL,
295 		       NULL, 0, NULL, 0,
296 		       CTL_KERN, CTL_EOL);
297 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
298 		       CTLFLAG_PERMANENT,
299 		       CTLTYPE_NODE, "tkstat",
300 		       SYSCTL_DESCR("Number of characters sent and and "
301 				    "received on ttys"),
302 		       NULL, 0, NULL, 0,
303 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
304 
305 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
306 		       CTLFLAG_PERMANENT,
307 		       CTLTYPE_QUAD, "nin",
308 		       SYSCTL_DESCR("Total number of tty input characters"),
309 		       NULL, 0, &tk_nin, 0,
310 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
311 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
312 		       CTLFLAG_PERMANENT,
313 		       CTLTYPE_QUAD, "nout",
314 		       SYSCTL_DESCR("Total number of tty output characters"),
315 		       NULL, 0, &tk_nout, 0,
316 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
317 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
318 		       CTLFLAG_PERMANENT,
319 		       CTLTYPE_QUAD, "cancc",
320 		       SYSCTL_DESCR("Number of canonical tty input characters"),
321 		       NULL, 0, &tk_cancc, 0,
322 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
323 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
324 		       CTLFLAG_PERMANENT,
325 		       CTLTYPE_QUAD, "rawcc",
326 		       SYSCTL_DESCR("Number of raw tty input characters"),
327 		       NULL, 0, &tk_rawcc, 0,
328 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
329 
330 	kern_tty_sysctllog = NULL;
331 	sysctl_createv(&kern_tty_sysctllog, 0, NULL, &rnode,
332 		       CTLFLAG_PERMANENT,
333 		       CTLTYPE_NODE, "tty", NULL,
334 		       NULL, 0, NULL, 0,
335 		       CTL_KERN, CTL_CREATE, CTL_EOL);
336 	sysctl_createv(&kern_tty_sysctllog, 0, &rnode, &cnode,
337 		       CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
338 		       CTLTYPE_INT, "qsize",
339 		       SYSCTL_DESCR("TTY input and output queue size"),
340 		       sysctl_kern_tty_qsize, 0, &tty_qsize, 0,
341 		       CTL_CREATE, CTL_EOL);
342 }
343 
344 int
345 ttyopen(struct tty *tp, int dialout, int nonblock)
346 {
347 	int	error;
348 
349 	error = 0;
350 
351 	mutex_spin_enter(&tty_lock);
352 
353 	if (dialout) {
354 		/*
355 		 * If the device is already open for non-dialout, fail.
356 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
357 		 * opens.
358 		 */
359 		if (ISSET(tp->t_state, TS_ISOPEN) &&
360 		    !ISSET(tp->t_state, TS_DIALOUT)) {
361 			error = EBUSY;
362 			goto out;
363 		}
364 		SET(tp->t_state, TS_DIALOUT);
365 	} else {
366 		if (!nonblock) {
367 			/*
368 			 * Wait for carrier.  Also wait for any dialout
369 			 * processes to close the tty first.
370 			 */
371 			while (ISSET(tp->t_state, TS_DIALOUT) ||
372 			       !CONNECTED(tp)) {
373 				tp->t_wopen++;
374 				error = ttysleep(tp, &tp->t_rawcv, true, 0);
375 				tp->t_wopen--;
376 				if (error)
377 					goto out;
378 			}
379 		} else {
380 			/*
381 			 * Don't allow a non-blocking non-dialout open if the
382 			 * device is already open for dialout.
383 			 */
384 			if (ISSET(tp->t_state, TS_DIALOUT)) {
385 				error = EBUSY;
386 				goto out;
387 			}
388 		}
389 	}
390 
391 out:
392 	mutex_spin_exit(&tty_lock);
393 	return (error);
394 }
395 
396 /*
397  * Initial open of tty, or (re)entry to standard tty line discipline.
398  */
399 int
400 ttylopen(dev_t device, struct tty *tp)
401 {
402 
403 	mutex_spin_enter(&tty_lock);
404 	tp->t_dev = device;
405 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
406 		SET(tp->t_state, TS_ISOPEN);
407 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
408 		tp->t_flags = 0;
409 	}
410 	mutex_spin_exit(&tty_lock);
411 	if (tp->t_qsize != tty_qsize)
412 		tty_set_qsize(tp, tty_qsize);
413 	return (0);
414 }
415 
416 /*
417  * Handle close() on a tty line: flush and set to initial state,
418  * bumping generation number so that pending read/write calls
419  * can detect recycling of the tty.
420  */
421 int
422 ttyclose(struct tty *tp)
423 {
424 	extern struct tty *constty;	/* Temporary virtual console. */
425 	struct session *sess;
426 
427 	mutex_spin_enter(&tty_lock);
428 
429 	if (constty == tp)
430 		constty = NULL;
431 
432 	ttyflush(tp, FREAD | FWRITE);
433 
434 	tp->t_gen++;
435 	tp->t_pgrp = NULL;
436 	tp->t_state = 0;
437 	sess = tp->t_session;
438 	tp->t_session = NULL;
439 
440 	mutex_spin_exit(&tty_lock);
441 
442 	if (sess != NULL) {
443 		mutex_enter(proc_lock);
444 		/* Releases proc_lock. */
445 		proc_sessrele(sess);
446 	}
447 	return (0);
448 }
449 
450 #define	FLUSHQ(q) {							\
451 	if ((q)->c_cc)							\
452 		ndflush(q, (q)->c_cc);					\
453 }
454 
455 /*
456  * This macro is used in canonical mode input processing, where a read
457  * request shall not return unless a 'line delimiter' ('\n') or 'break'
458  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
459  * is an extension to the POSIX.1 defined set of special characters,
460  * recognize it only if IEXTEN is set in the set of local flags.
461  */
462 #define	TTBREAKC(c, lflg)						\
463 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
464 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
465 
466 
467 
468 /*
469  * ttyinput() helper.
470  * Call with the tty lock held.
471  */
472 /* XXX static */ int
473 ttyinput_wlock(int c, struct tty *tp)
474 {
475 	int	iflag, lflag, i, error;
476 	u_char	*cc;
477 
478 	KASSERT(mutex_owned(&tty_lock));
479 
480 	/*
481 	 * If input is pending take it first.
482 	 */
483 	lflag = tp->t_lflag;
484 	if (ISSET(lflag, PENDIN))
485 		ttypend(tp);
486 	/*
487 	 * Gather stats.
488 	 */
489 	if (ISSET(lflag, ICANON)) {
490 		++tk_cancc;
491 		++tp->t_cancc;
492 	} else {
493 		++tk_rawcc;
494 		++tp->t_rawcc;
495 	}
496 	++tk_nin;
497 
498 	cc = tp->t_cc;
499 
500 	/*
501 	 * Handle exceptional conditions (break, parity, framing).
502 	 */
503 	iflag = tp->t_iflag;
504 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
505 		CLR(c, TTY_ERRORMASK);
506 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
507 			if (ISSET(iflag, IGNBRK))
508 				return (0);
509 			else if (ISSET(iflag, BRKINT)) {
510 				ttyflush(tp, FREAD | FWRITE);
511 				ttysig(tp, TTYSIG_PG1, SIGINT);
512 				return (0);
513 			} else if (ISSET(iflag, PARMRK))
514 				goto parmrk;
515 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
516 		    ISSET(error, TTY_FE)) {
517 			if (ISSET(iflag, IGNPAR))
518 				return (0);
519 			else if (ISSET(iflag, PARMRK)) {
520  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
521 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
522 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
523 				return (0);
524 			} else
525 				c = 0;
526 		}
527 	} else if (c == 0377 &&
528 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
529 		/* "Escape" a valid character of '\377'. */
530 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
531 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
532 		goto endcase;
533 	}
534 
535 	/*
536 	 * In tandem mode, check high water mark.
537 	 */
538 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
539 		ttyblock(tp);
540 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
541 		CLR(c, 0x80);
542 	if (!ISSET(lflag, EXTPROC)) {
543 		/*
544 		 * Check for literal nexting very first
545 		 */
546 		if (ISSET(tp->t_state, TS_LNCH)) {
547 			SET(c, TTY_QUOTE);
548 			CLR(tp->t_state, TS_LNCH);
549 		}
550 		/*
551 		 * Scan for special characters.  This code
552 		 * is really just a big case statement with
553 		 * non-constant cases.  The bottom of the
554 		 * case statement is labeled ``endcase'', so goto
555 		 * it after a case match, or similar.
556 		 */
557 
558 		/*
559 		 * Control chars which aren't controlled
560 		 * by ICANON, ISIG, or IXON.
561 		 */
562 		if (ISSET(lflag, IEXTEN)) {
563 			if (CCEQ(cc[VLNEXT], c)) {
564 				if (ISSET(lflag, ECHO)) {
565 					if (ISSET(lflag, ECHOE)) {
566 						(void)ttyoutput('^', tp);
567 						(void)ttyoutput('\b', tp);
568 					} else
569 						ttyecho(c, tp);
570 				}
571 				SET(tp->t_state, TS_LNCH);
572 				goto endcase;
573 			}
574 			if (CCEQ(cc[VDISCARD], c)) {
575 				if (ISSET(lflag, FLUSHO))
576 					CLR(tp->t_lflag, FLUSHO);
577 				else {
578 					ttyflush(tp, FWRITE);
579 					ttyecho(c, tp);
580 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
581 						ttyretype(tp);
582 					SET(tp->t_lflag, FLUSHO);
583 				}
584 				goto startoutput;
585 			}
586 		}
587 		/*
588 		 * Signals.
589 		 */
590 		if (ISSET(lflag, ISIG)) {
591 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
592 				if (!ISSET(lflag, NOFLSH))
593 					ttyflush(tp, FREAD | FWRITE);
594 				ttyecho(c, tp);
595 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
596 				    SIGINT : SIGQUIT);
597 				goto endcase;
598 			}
599 			if (CCEQ(cc[VSUSP], c)) {
600 				if (!ISSET(lflag, NOFLSH))
601 					ttyflush(tp, FREAD);
602 				ttyecho(c, tp);
603 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
604 				goto endcase;
605 			}
606 		}
607 		/*
608 		 * Handle start/stop characters.
609 		 */
610 		if (ISSET(iflag, IXON)) {
611 			if (CCEQ(cc[VSTOP], c)) {
612 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
613 					SET(tp->t_state, TS_TTSTOP);
614 					cdev_stop(tp, 0);
615 					return (0);
616 				}
617 				if (!CCEQ(cc[VSTART], c))
618 					return (0);
619 				/*
620 				 * if VSTART == VSTOP then toggle
621 				 */
622 				goto endcase;
623 			}
624 			if (CCEQ(cc[VSTART], c))
625 				goto restartoutput;
626 		}
627 		/*
628 		 * IGNCR, ICRNL, & INLCR
629 		 */
630 		if (c == '\r') {
631 			if (ISSET(iflag, IGNCR))
632 				goto endcase;
633 			else if (ISSET(iflag, ICRNL))
634 				c = '\n';
635 		} else if (c == '\n' && ISSET(iflag, INLCR))
636 			c = '\r';
637 	}
638 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
639 		/*
640 		 * From here on down canonical mode character
641 		 * processing takes place.
642 		 */
643 		/*
644 		 * erase (^H / ^?)
645 		 */
646 		if (CCEQ(cc[VERASE], c)) {
647 			if (tp->t_rawq.c_cc)
648 				ttyrub(unputc(&tp->t_rawq), tp);
649 			goto endcase;
650 		}
651 		/*
652 		 * kill (^U)
653 		 */
654 		if (CCEQ(cc[VKILL], c)) {
655 			if (ISSET(lflag, ECHOKE) &&
656 			    tp->t_rawq.c_cc == tp->t_rocount &&
657 			    !ISSET(lflag, ECHOPRT))
658 				while (tp->t_rawq.c_cc)
659 					ttyrub(unputc(&tp->t_rawq), tp);
660 			else {
661 				ttyecho(c, tp);
662 				if (ISSET(lflag, ECHOK) ||
663 				    ISSET(lflag, ECHOKE))
664 					ttyecho('\n', tp);
665 				FLUSHQ(&tp->t_rawq);
666 				tp->t_rocount = 0;
667 			}
668 			CLR(tp->t_state, TS_LOCAL);
669 			goto endcase;
670 		}
671 		/*
672 		 * Extensions to the POSIX.1 GTI set of functions.
673 		 */
674 		if (ISSET(lflag, IEXTEN)) {
675 			/*
676 			 * word erase (^W)
677 			 */
678 			if (CCEQ(cc[VWERASE], c)) {
679 				int alt = ISSET(lflag, ALTWERASE);
680 				int ctype;
681 
682 				/*
683 				 * erase whitespace
684 				 */
685 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
686 				    c == '\t')
687 					ttyrub(c, tp);
688 				if (c == -1)
689 					goto endcase;
690 				/*
691 				 * erase last char of word and remember the
692 				 * next chars type (for ALTWERASE)
693 				 */
694 				ttyrub(c, tp);
695 				c = unputc(&tp->t_rawq);
696 				if (c == -1)
697 					goto endcase;
698 				if (c == ' ' || c == '\t') {
699 					(void)putc(c, &tp->t_rawq);
700 					goto endcase;
701 				}
702 				ctype = ISALPHA(c);
703 				/*
704 				 * erase rest of word
705 				 */
706 				do {
707 					ttyrub(c, tp);
708 					c = unputc(&tp->t_rawq);
709 					if (c == -1)
710 						goto endcase;
711 				} while (c != ' ' && c != '\t' &&
712 				    (alt == 0 || ISALPHA(c) == ctype));
713 				(void)putc(c, &tp->t_rawq);
714 				goto endcase;
715 			}
716 			/*
717 			 * reprint line (^R)
718 			 */
719 			if (CCEQ(cc[VREPRINT], c)) {
720 				ttyretype(tp);
721 				goto endcase;
722 			}
723 			/*
724 			 * ^T - kernel info and generate SIGINFO
725 			 */
726 			if (CCEQ(cc[VSTATUS], c)) {
727 				ttysig(tp, TTYSIG_PG1, SIGINFO);
728 				goto endcase;
729 			}
730 		}
731 	}
732 	/*
733 	 * Check for input buffer overflow
734 	 */
735 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
736 		if (ISSET(iflag, IMAXBEL)) {
737 			if (tp->t_outq.c_cc < tp->t_hiwat)
738 				(void)ttyoutput(CTRL('g'), tp);
739 		} else
740 			ttyflush(tp, FREAD | FWRITE);
741 		goto endcase;
742 	}
743 	/*
744 	 * Put data char in q for user and
745 	 * wakeup on seeing a line delimiter.
746 	 */
747 	if (putc(c, &tp->t_rawq) >= 0) {
748 		if (!ISSET(lflag, ICANON)) {
749 			ttwakeup(tp);
750 			ttyecho(c, tp);
751 			goto endcase;
752 		}
753 		if (TTBREAKC(c, lflag)) {
754 			tp->t_rocount = 0;
755 			catq(&tp->t_rawq, &tp->t_canq);
756 			ttwakeup(tp);
757 		} else if (tp->t_rocount++ == 0)
758 			tp->t_rocol = tp->t_column;
759 		if (ISSET(tp->t_state, TS_ERASE)) {
760 			/*
761 			 * end of prterase \.../
762 			 */
763 			CLR(tp->t_state, TS_ERASE);
764 			(void)ttyoutput('/', tp);
765 		}
766 		i = tp->t_column;
767 		ttyecho(c, tp);
768 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
769 			/*
770 			 * Place the cursor over the '^' of the ^D.
771 			 */
772 			i = min(2, tp->t_column - i);
773 			while (i > 0) {
774 				(void)ttyoutput('\b', tp);
775 				i--;
776 			}
777 		}
778 	}
779  endcase:
780 	/*
781 	 * IXANY means allow any character to restart output.
782 	 */
783 	if (ISSET(tp->t_state, TS_TTSTOP) &&
784 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
785 		return (0);
786 	}
787  restartoutput:
788 	CLR(tp->t_lflag, FLUSHO);
789 	CLR(tp->t_state, TS_TTSTOP);
790  startoutput:
791 	return (ttstart(tp));
792 }
793 
794 /*
795  * Process input of a single character received on a tty.
796  *
797  * XXX - this is a hack, all drivers must changed to acquire the
798  *	 lock before calling linesw->l_rint()
799  */
800 int
801 ttyinput(int c, struct tty *tp)
802 {
803 	int error;
804 
805 	/*
806 	 * Unless the receiver is enabled, drop incoming data.
807 	 */
808 	if (!ISSET(tp->t_cflag, CREAD))
809 		return (0);
810 
811 	mutex_spin_enter(&tty_lock);
812 	error = ttyinput_wlock(c, tp);
813 	mutex_spin_exit(&tty_lock);
814 
815 	return (error);
816 }
817 
818 /*
819  * Output a single character on a tty, doing output processing
820  * as needed (expanding tabs, newline processing, etc.).
821  * Returns < 0 if succeeds, otherwise returns char to resend.
822  * Must be recursive.
823  *
824  * Call with tty lock held.
825  */
826 int
827 ttyoutput(int c, struct tty *tp)
828 {
829 	long	oflag;
830 	int	col, notout;
831 
832 	KASSERT(mutex_owned(&tty_lock));
833 
834 	oflag = tp->t_oflag;
835 	if (!ISSET(oflag, OPOST)) {
836 		tk_nout++;
837 		tp->t_outcc++;
838 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
839 			return (c);
840 		return (-1);
841 	}
842 	/*
843 	 * Do tab expansion if OXTABS is set.  Special case if we do external
844 	 * processing, we don't do the tab expansion because we'll probably
845 	 * get it wrong.  If tab expansion needs to be done, let it happen
846 	 * externally.
847 	 */
848 	CLR(c, ~TTY_CHARMASK);
849 	if (c == '\t' &&
850 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
851 		c = 8 - (tp->t_column & 7);
852 		if (ISSET(tp->t_lflag, FLUSHO)) {
853 			notout = 0;
854 		} else {
855 			notout = b_to_q("        ", c, &tp->t_outq);
856 			c -= notout;
857 			tk_nout += c;
858 			tp->t_outcc += c;
859 		}
860 		tp->t_column += c;
861 		return (notout ? '\t' : -1);
862 	}
863 	if (c == CEOT && ISSET(oflag, ONOEOT))
864 		return (-1);
865 
866 	/*
867 	 * Newline translation: if ONLCR is set,
868 	 * translate newline into "\r\n".
869 	 */
870 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
871 		tk_nout++;
872 		tp->t_outcc++;
873 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
874 			return (c);
875 	}
876 	/* If OCRNL is set, translate "\r" into "\n". */
877 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
878 		c = '\n';
879 	/* If ONOCR is set, don't transmit CRs when on column 0. */
880 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
881 		return (-1);
882 
883 	tk_nout++;
884 	tp->t_outcc++;
885 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
886 		return (c);
887 
888 	col = tp->t_column;
889 	switch (CCLASS(c)) {
890 	case BACKSPACE:
891 		if (col > 0)
892 			--col;
893 		break;
894 	case CONTROL:
895 		break;
896 	case NEWLINE:
897 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
898 			col = 0;
899 		break;
900 	case RETURN:
901 		col = 0;
902 		break;
903 	case ORDINARY:
904 		++col;
905 		break;
906 	case TAB:
907 		col = (col + 8) & ~7;
908 		break;
909 	}
910 	tp->t_column = col;
911 	return (-1);
912 }
913 
914 /*
915  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
916  * has been called to do discipline-specific functions and/or reject any
917  * of these ioctl commands.
918  */
919 /* ARGSUSED */
920 int
921 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
922 {
923 	extern struct tty *constty;	/* Temporary virtual console. */
924 	struct proc *p = l ? l->l_proc : NULL;
925 	struct linesw	*lp;
926 	int		s, error;
927 	struct pathbuf *pb;
928 	struct nameidata nd;
929 	char		infobuf[200];
930 
931 	/* If the ioctl involves modification, hang if in the background. */
932 	switch (cmd) {
933 	case  TIOCFLUSH:
934 	case  TIOCDRAIN:
935 	case  TIOCSBRK:
936 	case  TIOCCBRK:
937 	case  TIOCSTART:
938 	case  TIOCSETA:
939 	case  TIOCSETD:
940 	case  TIOCSLINED:
941 	case  TIOCSETAF:
942 	case  TIOCSETAW:
943 #ifdef notdef
944 	case  TIOCSPGRP:
945 	case  FIOSETOWN:
946 #endif
947 	case  TIOCSTAT:
948 	case  TIOCSTI:
949 	case  TIOCSWINSZ:
950 	case  TIOCSQSIZE:
951 	case  TIOCLBIC:
952 	case  TIOCLBIS:
953 	case  TIOCLSET:
954 	case  TIOCSETC:
955 	case OTIOCSETD:
956 	case  TIOCSETN:
957 	case  TIOCSETP:
958 	case  TIOCSLTC:
959 		mutex_spin_enter(&tty_lock);
960 		while (isbackground(curproc, tp) &&
961 		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
962 		    !sigismasked(l, SIGTTOU)) {
963 			mutex_spin_exit(&tty_lock);
964 
965 			mutex_enter(proc_lock);
966 			pgsignal(p->p_pgrp, SIGTTOU, 1);
967 			mutex_exit(proc_lock);
968 
969 			mutex_spin_enter(&tty_lock);
970 			error = ttypause(tp, hz);
971 			if (error) {
972 				mutex_spin_exit(&tty_lock);
973 				return (error);
974 			}
975 		}
976 		mutex_spin_exit(&tty_lock);
977 		break;
978 	}
979 
980 	switch (cmd) {			/* Process the ioctl. */
981 	case FIOASYNC:			/* set/clear async i/o */
982 		mutex_spin_enter(&tty_lock);
983 		if (*(int *)data)
984 			SET(tp->t_state, TS_ASYNC);
985 		else
986 			CLR(tp->t_state, TS_ASYNC);
987 		mutex_spin_exit(&tty_lock);
988 		break;
989 	case FIONBIO:			/* set/clear non-blocking i/o */
990 		break;			/* XXX: delete. */
991 	case FIONREAD:			/* get # bytes to read */
992 		mutex_spin_enter(&tty_lock);
993 		*(int *)data = ttnread(tp);
994 		mutex_spin_exit(&tty_lock);
995 		break;
996 	case FIONWRITE:			/* get # bytes to written & unsent */
997 		mutex_spin_enter(&tty_lock);
998 		*(int *)data = tp->t_outq.c_cc;
999 		mutex_spin_exit(&tty_lock);
1000 		break;
1001 	case FIONSPACE:			/* get # bytes to written & unsent */
1002 		mutex_spin_enter(&tty_lock);
1003 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1004 		mutex_spin_exit(&tty_lock);
1005 		break;
1006 	case TIOCEXCL:			/* set exclusive use of tty */
1007 		mutex_spin_enter(&tty_lock);
1008 		SET(tp->t_state, TS_XCLUDE);
1009 		mutex_spin_exit(&tty_lock);
1010 		break;
1011 	case TIOCFLUSH: {		/* flush buffers */
1012 		int flags = *(int *)data;
1013 
1014 		if (flags == 0)
1015 			flags = FREAD | FWRITE;
1016 		else
1017 			flags &= FREAD | FWRITE;
1018 		mutex_spin_enter(&tty_lock);
1019 		ttyflush(tp, flags);
1020 		mutex_spin_exit(&tty_lock);
1021 		break;
1022 	}
1023 	case TIOCCONS:			/* become virtual console */
1024 		if (*(int *)data) {
1025 			if (constty && constty != tp &&
1026 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
1027 			    (TS_CARR_ON | TS_ISOPEN))
1028 				return EBUSY;
1029 
1030 			pb = pathbuf_create("/dev/console");
1031 			if (pb == NULL) {
1032 				return ENOMEM;
1033 			}
1034 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, pb);
1035 			if ((error = namei(&nd)) != 0) {
1036 				pathbuf_destroy(pb);
1037 				return error;
1038 			}
1039 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
1040 			vput(nd.ni_vp);
1041 			pathbuf_destroy(pb);
1042 			if (error)
1043 				return error;
1044 
1045 			constty = tp;
1046 		} else if (tp == constty)
1047 			constty = NULL;
1048 		break;
1049 	case TIOCDRAIN:			/* wait till output drained */
1050 		if ((error = ttywait(tp)) != 0)
1051 			return (error);
1052 		break;
1053 	case TIOCGETA: {		/* get termios struct */
1054 		struct termios *t = (struct termios *)data;
1055 
1056 		memcpy(t, &tp->t_termios, sizeof(struct termios));
1057 		break;
1058 	}
1059 	case TIOCGETD:			/* get line discipline (old) */
1060 		*(int *)data = tp->t_linesw->l_no;
1061 		break;
1062 	case TIOCGLINED:		/* get line discipline (new) */
1063 		(void)strncpy((char *)data, tp->t_linesw->l_name,
1064 		    TTLINEDNAMELEN - 1);
1065 		break;
1066 	case TIOCGWINSZ:		/* get window size */
1067 		*(struct winsize *)data = tp->t_winsize;
1068 		break;
1069 	case TIOCGQSIZE:
1070 		*(int *)data = tp->t_qsize;
1071 		break;
1072 	case FIOGETOWN:
1073 		mutex_enter(proc_lock);
1074 		if (tp->t_session != NULL && !isctty(p, tp)) {
1075 			mutex_exit(proc_lock);
1076 			return (ENOTTY);
1077 		}
1078 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
1079 		mutex_exit(proc_lock);
1080 		break;
1081 	case TIOCGPGRP:			/* get pgrp of tty */
1082 		mutex_enter(proc_lock);
1083 		if (!isctty(p, tp)) {
1084 			mutex_exit(proc_lock);
1085 			return (ENOTTY);
1086 		}
1087 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
1088 		mutex_exit(proc_lock);
1089 		break;
1090 	case TIOCGSID:			/* get sid of tty */
1091 		mutex_enter(proc_lock);
1092 		if (!isctty(p, tp)) {
1093 			mutex_exit(proc_lock);
1094 			return (ENOTTY);
1095 		}
1096 		*(int *)data = tp->t_session->s_sid;
1097 		mutex_exit(proc_lock);
1098 		break;
1099 #ifdef TIOCHPCL
1100 	case TIOCHPCL:			/* hang up on last close */
1101 		mutex_spin_enter(&tty_lock);
1102 		SET(tp->t_cflag, HUPCL);
1103 		mutex_spin_exit(&tty_lock);
1104 		break;
1105 #endif
1106 	case TIOCNXCL:			/* reset exclusive use of tty */
1107 		mutex_spin_enter(&tty_lock);
1108 		CLR(tp->t_state, TS_XCLUDE);
1109 		mutex_spin_exit(&tty_lock);
1110 		break;
1111 	case TIOCOUTQ:			/* output queue size */
1112 		*(int *)data = tp->t_outq.c_cc;
1113 		break;
1114 	case TIOCSETA:			/* set termios struct */
1115 	case TIOCSETAW:			/* drain output, set */
1116 	case TIOCSETAF: {		/* drn out, fls in, set */
1117 		struct termios *t = (struct termios *)data;
1118 
1119 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1120 			if ((error = ttywait(tp)) != 0)
1121 				return (error);
1122 
1123 			if (cmd == TIOCSETAF) {
1124 				mutex_spin_enter(&tty_lock);
1125 				ttyflush(tp, FREAD);
1126 				mutex_spin_exit(&tty_lock);
1127 			}
1128 		}
1129 
1130 		s = spltty();
1131 		/*
1132 		 * XXXSMP - some drivers call back on us from t_param(), so
1133 		 *	    don't take the tty spin lock here.
1134 		 *	    require t_param() to unlock upon callback?
1135 		 */
1136 		/* wanted here: mutex_spin_enter(&tty_lock); */
1137 		if (!ISSET(t->c_cflag, CIGNORE)) {
1138 			/*
1139 			 * Set device hardware.
1140 			 */
1141 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1142 				/* wanted here: mutex_spin_exit(&tty_lock); */
1143 				splx(s);
1144 				return (error);
1145 			} else {
1146 				tp->t_cflag = t->c_cflag;
1147 				tp->t_ispeed = t->c_ispeed;
1148 				tp->t_ospeed = t->c_ospeed;
1149 				if (t->c_ospeed == 0)
1150 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1151 			}
1152 			ttsetwater(tp);
1153 		}
1154 
1155 		/* delayed lock acquiring */
1156 		mutex_spin_enter(&tty_lock);
1157 		if (cmd != TIOCSETAF) {
1158 			if (ISSET(t->c_lflag, ICANON) !=
1159 			    ISSET(tp->t_lflag, ICANON)) {
1160 				if (ISSET(t->c_lflag, ICANON)) {
1161 					SET(tp->t_lflag, PENDIN);
1162 					ttwakeup(tp);
1163 				} else {
1164 					struct clist tq;
1165 
1166 					catq(&tp->t_rawq, &tp->t_canq);
1167 					tq = tp->t_rawq;
1168 					tp->t_rawq = tp->t_canq;
1169 					tp->t_canq = tq;
1170 					CLR(tp->t_lflag, PENDIN);
1171 				}
1172 			}
1173 		}
1174 		tp->t_iflag = t->c_iflag;
1175 		tp->t_oflag = t->c_oflag;
1176 		/*
1177 		 * Make the EXTPROC bit read only.
1178 		 */
1179 		if (ISSET(tp->t_lflag, EXTPROC))
1180 			SET(t->c_lflag, EXTPROC);
1181 		else
1182 			CLR(t->c_lflag, EXTPROC);
1183 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1184 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1185 		mutex_spin_exit(&tty_lock);
1186 		splx(s);
1187 		break;
1188 	}
1189 	case TIOCSETD:			/* set line discipline (old) */
1190 		lp = ttyldisc_lookup_bynum(*(int *)data);
1191 		goto setldisc;
1192 
1193 	case TIOCSLINED: {		/* set line discipline (new) */
1194 		char *name = (char *)data;
1195 		dev_t device;
1196 
1197 		/* Null terminate to prevent buffer overflow */
1198 		name[TTLINEDNAMELEN - 1] = '\0';
1199 		lp = ttyldisc_lookup(name);
1200  setldisc:
1201 		if (lp == NULL)
1202 			return (ENXIO);
1203 
1204 		if (lp != tp->t_linesw) {
1205 			device = tp->t_dev;
1206 			s = spltty();
1207 			(*tp->t_linesw->l_close)(tp, flag);
1208 			error = (*lp->l_open)(device, tp);
1209 			if (error) {
1210 				(void)(*tp->t_linesw->l_open)(device, tp);
1211 				splx(s);
1212 				ttyldisc_release(lp);
1213 				return (error);
1214 			}
1215 			ttyldisc_release(tp->t_linesw);
1216 			tp->t_linesw = lp;
1217 			splx(s);
1218 		} else {
1219 			/* Drop extra reference. */
1220 			ttyldisc_release(lp);
1221 		}
1222 		break;
1223 	}
1224 	case TIOCSTART:			/* start output, like ^Q */
1225 		mutex_spin_enter(&tty_lock);
1226 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1227 		    ISSET(tp->t_lflag, FLUSHO)) {
1228 			CLR(tp->t_lflag, FLUSHO);
1229 			CLR(tp->t_state, TS_TTSTOP);
1230 			ttstart(tp);
1231 		}
1232 		mutex_spin_exit(&tty_lock);
1233 		break;
1234 	case TIOCSTI:			/* simulate terminal input */
1235 		if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_STI,
1236 		    tp) != 0) {
1237 			if (!ISSET(flag, FREAD))
1238 				return (EPERM);
1239 			if (!isctty(p, tp))
1240 				return (EACCES);
1241 		}
1242 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1243 		break;
1244 	case TIOCSTOP:			/* stop output, like ^S */
1245 	{
1246 		mutex_spin_enter(&tty_lock);
1247 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1248 			SET(tp->t_state, TS_TTSTOP);
1249 			cdev_stop(tp, 0);
1250 		}
1251 		mutex_spin_exit(&tty_lock);
1252 		break;
1253 	}
1254 	case TIOCSCTTY:			/* become controlling tty */
1255 		mutex_enter(proc_lock);
1256 		mutex_spin_enter(&tty_lock);
1257 
1258 		/* Session ctty vnode pointer set in vnode layer. */
1259 		if (!SESS_LEADER(p) ||
1260 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1261 		    (tp->t_session != p->p_session))) {
1262 			mutex_spin_exit(&tty_lock);
1263 			mutex_exit(proc_lock);
1264 			return (EPERM);
1265 		}
1266 
1267 		/*
1268 		 * `p_session' acquires a reference.
1269 		 * But note that if `t_session' is set at this point,
1270 		 * it must equal `p_session', in which case the session
1271 		 * already has the correct reference count.
1272 		 */
1273 		if (tp->t_session == NULL) {
1274 			proc_sesshold(p->p_session);
1275 		}
1276 		tp->t_session = p->p_session;
1277 		tp->t_pgrp = p->p_pgrp;
1278 		p->p_session->s_ttyp = tp;
1279 		p->p_lflag |= PL_CONTROLT;
1280 		mutex_spin_exit(&tty_lock);
1281 		mutex_exit(proc_lock);
1282 		break;
1283 	case FIOSETOWN: {		/* set pgrp of tty */
1284 		pid_t pgid = *(pid_t *)data;
1285 		struct pgrp *pgrp;
1286 
1287 		mutex_enter(proc_lock);
1288 		if (tp->t_session != NULL && !isctty(p, tp)) {
1289 			mutex_exit(proc_lock);
1290 			return (ENOTTY);
1291 		}
1292 
1293 		if (pgid < 0) {
1294 			pgrp = pgrp_find(-pgid);
1295 			if (pgrp == NULL) {
1296 				mutex_exit(proc_lock);
1297 				return (EINVAL);
1298 			}
1299 		} else {
1300 			struct proc *p1;
1301 			p1 = proc_find(pgid);
1302 			if (!p1) {
1303 				mutex_exit(proc_lock);
1304 				return (ESRCH);
1305 			}
1306 			pgrp = p1->p_pgrp;
1307 		}
1308 
1309 		if (pgrp->pg_session != p->p_session) {
1310 			mutex_exit(proc_lock);
1311 			return (EPERM);
1312 		}
1313 		mutex_spin_enter(&tty_lock);
1314 		tp->t_pgrp = pgrp;
1315 		mutex_spin_exit(&tty_lock);
1316 		mutex_exit(proc_lock);
1317 		break;
1318 	}
1319 	case TIOCSPGRP: {		/* set pgrp of tty */
1320 		struct pgrp *pgrp;
1321 		pid_t pgid = *(pid_t *)data;
1322 
1323 		if (pgid == NO_PGID)
1324 			return EINVAL;
1325 
1326 		mutex_enter(proc_lock);
1327 		if (!isctty(p, tp)) {
1328 			mutex_exit(proc_lock);
1329 			return (ENOTTY);
1330 		}
1331 		pgrp = pgrp_find(pgid);
1332 		if (pgrp == NULL || pgrp->pg_session != p->p_session) {
1333 			mutex_exit(proc_lock);
1334 			return (EPERM);
1335 		}
1336 		mutex_spin_enter(&tty_lock);
1337 		tp->t_pgrp = pgrp;
1338 		mutex_spin_exit(&tty_lock);
1339 		mutex_exit(proc_lock);
1340 		break;
1341 	}
1342 	case TIOCSTAT:			/* get load avg stats */
1343 		mutex_enter(proc_lock);
1344 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1345 		mutex_exit(proc_lock);
1346 
1347 		mutex_spin_enter(&tty_lock);
1348 		ttyputinfo(tp, infobuf);
1349 		mutex_spin_exit(&tty_lock);
1350 		break;
1351 	case TIOCSWINSZ:		/* set window size */
1352 		mutex_spin_enter(&tty_lock);
1353 		if (memcmp((void *)&tp->t_winsize, data,
1354 		    sizeof(struct winsize))) {
1355 			tp->t_winsize = *(struct winsize *)data;
1356 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1357 		}
1358 		mutex_spin_exit(&tty_lock);
1359 		break;
1360 	case TIOCSQSIZE:
1361 		if ((error = tty_get_qsize(&s, *(int *)data)) == 0 &&
1362 		    s != tp->t_qsize)
1363 			error = tty_set_qsize(tp, s);
1364 		return error;
1365 	default:
1366 		/* We may have to load the compat module for this. */
1367 		for (;;) {
1368 			rw_enter(&ttcompat_lock, RW_READER);
1369 			if (ttcompatvec != NULL) {
1370 				break;
1371 			}
1372 			rw_exit(&ttcompat_lock);
1373 			(void)module_autoload("compat", MODULE_CLASS_ANY);
1374 			if (ttcompatvec == NULL) {
1375 				return EPASSTHROUGH;
1376 			}
1377 		}
1378 		error = (*ttcompatvec)(tp, cmd, data, flag, l);
1379 		rw_exit(&ttcompat_lock);
1380 		return error;
1381 	}
1382 	return (0);
1383 }
1384 
1385 int
1386 ttpoll(struct tty *tp, int events, struct lwp *l)
1387 {
1388 	int	revents;
1389 
1390 	revents = 0;
1391 	mutex_spin_enter(&tty_lock);
1392 	if (events & (POLLIN | POLLRDNORM))
1393 		if (ttnread(tp) > 0)
1394 			revents |= events & (POLLIN | POLLRDNORM);
1395 
1396 	if (events & (POLLOUT | POLLWRNORM))
1397 		if (tp->t_outq.c_cc <= tp->t_lowat)
1398 			revents |= events & (POLLOUT | POLLWRNORM);
1399 
1400 	if (events & POLLHUP)
1401 		if (!CONNECTED(tp))
1402 			revents |= POLLHUP;
1403 
1404 	if (revents == 0) {
1405 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1406 			selrecord(l, &tp->t_rsel);
1407 
1408 		if (events & (POLLOUT | POLLWRNORM))
1409 			selrecord(l, &tp->t_wsel);
1410 	}
1411 
1412 	mutex_spin_exit(&tty_lock);
1413 
1414 	return (revents);
1415 }
1416 
1417 static void
1418 filt_ttyrdetach(struct knote *kn)
1419 {
1420 	struct tty	*tp;
1421 
1422 	tp = kn->kn_hook;
1423 	mutex_spin_enter(&tty_lock);
1424 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1425 	mutex_spin_exit(&tty_lock);
1426 }
1427 
1428 static int
1429 filt_ttyread(struct knote *kn, long hint)
1430 {
1431 	struct tty	*tp;
1432 
1433 	tp = kn->kn_hook;
1434 	if ((hint & NOTE_SUBMIT) == 0)
1435 		mutex_spin_enter(&tty_lock);
1436 	kn->kn_data = ttnread(tp);
1437 	if ((hint & NOTE_SUBMIT) == 0)
1438 		mutex_spin_exit(&tty_lock);
1439 	return (kn->kn_data > 0);
1440 }
1441 
1442 static void
1443 filt_ttywdetach(struct knote *kn)
1444 {
1445 	struct tty	*tp;
1446 
1447 	tp = kn->kn_hook;
1448 	mutex_spin_enter(&tty_lock);
1449 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1450 	mutex_spin_exit(&tty_lock);
1451 }
1452 
1453 static int
1454 filt_ttywrite(struct knote *kn, long hint)
1455 {
1456 	struct tty	*tp;
1457 	int		canwrite;
1458 
1459 	tp = kn->kn_hook;
1460 	if ((hint & NOTE_SUBMIT) == 0)
1461 		mutex_spin_enter(&tty_lock);
1462 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1463 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1464 	if ((hint & NOTE_SUBMIT) == 0)
1465 		mutex_spin_exit(&tty_lock);
1466 	return (canwrite);
1467 }
1468 
1469 static const struct filterops ttyread_filtops =
1470 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1471 static const struct filterops ttywrite_filtops =
1472 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1473 
1474 int
1475 ttykqfilter(dev_t dev, struct knote *kn)
1476 {
1477 	struct tty	*tp;
1478 	struct klist	*klist;
1479 
1480 	if ((tp = cdev_tty(dev)) == NULL)
1481 		return (ENXIO);
1482 
1483 	switch (kn->kn_filter) {
1484 	case EVFILT_READ:
1485 		klist = &tp->t_rsel.sel_klist;
1486 		kn->kn_fop = &ttyread_filtops;
1487 		break;
1488 	case EVFILT_WRITE:
1489 		klist = &tp->t_wsel.sel_klist;
1490 		kn->kn_fop = &ttywrite_filtops;
1491 		break;
1492 	default:
1493 		return EINVAL;
1494 	}
1495 
1496 	kn->kn_hook = tp;
1497 
1498 	mutex_spin_enter(&tty_lock);
1499 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1500 	mutex_spin_exit(&tty_lock);
1501 
1502 	return (0);
1503 }
1504 
1505 /*
1506  * Find the number of chars ready to be read from this tty.
1507  * Call with the tty lock held.
1508  */
1509 static int
1510 ttnread(struct tty *tp)
1511 {
1512 	int	nread;
1513 
1514 	KASSERT(mutex_owned(&tty_lock));
1515 
1516 	if (ISSET(tp->t_lflag, PENDIN))
1517 		ttypend(tp);
1518 	nread = tp->t_canq.c_cc;
1519 	if (!ISSET(tp->t_lflag, ICANON)) {
1520 		nread += tp->t_rawq.c_cc;
1521 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1522 			nread = 0;
1523 	}
1524 	return (nread);
1525 }
1526 
1527 /*
1528  * Wait for output to drain.
1529  */
1530 int
1531 ttywait(struct tty *tp)
1532 {
1533 	int	error;
1534 
1535 	error = 0;
1536 
1537 	mutex_spin_enter(&tty_lock);
1538 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1539 	    CONNECTED(tp) && tp->t_oproc) {
1540 		(*tp->t_oproc)(tp);
1541 		error = ttysleep(tp, &tp->t_outcv, true, 0);
1542 		if (error)
1543 			break;
1544 	}
1545 	mutex_spin_exit(&tty_lock);
1546 
1547 	return (error);
1548 }
1549 
1550 /*
1551  * Flush if successfully wait.
1552  */
1553 int
1554 ttywflush(struct tty *tp)
1555 {
1556 	int	error;
1557 
1558 	if ((error = ttywait(tp)) == 0) {
1559 		mutex_spin_enter(&tty_lock);
1560 		ttyflush(tp, FREAD);
1561 		mutex_spin_exit(&tty_lock);
1562 	}
1563 	return (error);
1564 }
1565 
1566 /*
1567  * Flush tty read and/or write queues, notifying anyone waiting.
1568  * Call with the tty lock held.
1569  */
1570 void
1571 ttyflush(struct tty *tp, int rw)
1572 {
1573 
1574 	KASSERT(mutex_owned(&tty_lock));
1575 
1576 	if (rw & FREAD) {
1577 		FLUSHQ(&tp->t_canq);
1578 		FLUSHQ(&tp->t_rawq);
1579 		tp->t_rocount = 0;
1580 		tp->t_rocol = 0;
1581 		CLR(tp->t_state, TS_LOCAL);
1582 		ttwakeup(tp);
1583 	}
1584 	if (rw & FWRITE) {
1585 		CLR(tp->t_state, TS_TTSTOP);
1586 		cdev_stop(tp, rw);
1587 		FLUSHQ(&tp->t_outq);
1588 		cv_broadcast(&tp->t_outcv);
1589 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1590 	}
1591 }
1592 
1593 /*
1594  * Copy in the default termios characters.
1595  */
1596 void
1597 ttychars(struct tty *tp)
1598 {
1599 
1600 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1601 }
1602 
1603 /*
1604  * Send stop character on input overflow.
1605  * Call with the tty lock held.
1606  */
1607 static void
1608 ttyblock(struct tty *tp)
1609 {
1610 	int	total;
1611 
1612 	KASSERT(mutex_owned(&tty_lock));
1613 
1614 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1615 	if (tp->t_rawq.c_cc > TTYHOG) {
1616 		ttyflush(tp, FREAD | FWRITE);
1617 		CLR(tp->t_state, TS_TBLOCK);
1618 	}
1619 	/*
1620 	 * Block further input iff: current input > threshold
1621 	 * AND input is available to user program.
1622 	 */
1623 	if (total >= TTYHOG / 2 &&
1624 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1625 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1626 		if (ISSET(tp->t_iflag, IXOFF) &&
1627 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1628 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1629 			SET(tp->t_state, TS_TBLOCK);
1630 			ttstart(tp);
1631 		}
1632 		/* Try to block remote output via hardware flow control. */
1633 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1634 		    (*tp->t_hwiflow)(tp, 1) != 0)
1635 			SET(tp->t_state, TS_TBLOCK);
1636 	}
1637 }
1638 
1639 /*
1640  * Delayed line discipline output
1641  */
1642 void
1643 ttrstrt(void *tp_arg)
1644 {
1645 	struct tty	*tp;
1646 
1647 #ifdef DIAGNOSTIC
1648 	if (tp_arg == NULL)
1649 		panic("ttrstrt");
1650 #endif
1651 	tp = tp_arg;
1652 	mutex_spin_enter(&tty_lock);
1653 
1654 	CLR(tp->t_state, TS_TIMEOUT);
1655 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1656 
1657 	mutex_spin_exit(&tty_lock);
1658 }
1659 
1660 /*
1661  * start a line discipline
1662  * Always call with tty lock held?
1663  */
1664 int
1665 ttstart(struct tty *tp)
1666 {
1667 
1668 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1669 		(*tp->t_oproc)(tp);
1670 	return (0);
1671 }
1672 
1673 /*
1674  * "close" a line discipline
1675  */
1676 int
1677 ttylclose(struct tty *tp, int flag)
1678 {
1679 
1680 	if (flag & FNONBLOCK) {
1681 		mutex_spin_enter(&tty_lock);
1682 		ttyflush(tp, FREAD | FWRITE);
1683 		mutex_spin_exit(&tty_lock);
1684 	} else
1685 		ttywflush(tp);
1686 	return (0);
1687 }
1688 
1689 /*
1690  * Handle modem control transition on a tty.
1691  * Flag indicates new state of carrier.
1692  * Returns 0 if the line should be turned off, otherwise 1.
1693  */
1694 int
1695 ttymodem(struct tty *tp, int flag)
1696 {
1697 
1698 	mutex_spin_enter(&tty_lock);
1699 	if (flag == 0) {
1700 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1701 			/*
1702 			 * Lost carrier.
1703 			 */
1704 			CLR(tp->t_state, TS_CARR_ON);
1705 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1706 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1707 				ttyflush(tp, FREAD | FWRITE);
1708 				mutex_spin_exit(&tty_lock);
1709 				return (0);
1710 			}
1711 		}
1712 	} else {
1713 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1714 			/*
1715 			 * Carrier now on.
1716 			 */
1717 			SET(tp->t_state, TS_CARR_ON);
1718 			ttwakeup(tp);
1719 		}
1720 	}
1721 	mutex_spin_exit(&tty_lock);
1722 
1723 	return (1);
1724 }
1725 
1726 /*
1727  * Default modem control routine (for other line disciplines).
1728  * Return argument flag, to turn off device on carrier drop.
1729  */
1730 int
1731 nullmodem(struct tty *tp, int flag)
1732 {
1733 
1734 	mutex_spin_enter(&tty_lock);
1735 	if (flag)
1736 		SET(tp->t_state, TS_CARR_ON);
1737 	else {
1738 		CLR(tp->t_state, TS_CARR_ON);
1739 		if (!CONNECTED(tp)) {
1740 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1741 			mutex_spin_exit(&tty_lock);
1742 			return (0);
1743 		}
1744 	}
1745 	mutex_spin_exit(&tty_lock);
1746 
1747 	return (1);
1748 }
1749 
1750 /*
1751  * Reinput pending characters after state switch.
1752  */
1753 void
1754 ttypend(struct tty *tp)
1755 {
1756 	struct clist	tq;
1757 	int		c;
1758 
1759 	KASSERT(mutex_owned(&tty_lock));
1760 
1761 	CLR(tp->t_lflag, PENDIN);
1762 	SET(tp->t_state, TS_TYPEN);
1763 	tq = tp->t_rawq;
1764 	tp->t_rawq.c_cc = 0;
1765 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1766 	while ((c = getc(&tq)) >= 0)
1767 		ttyinput_wlock(c, tp);
1768 	CLR(tp->t_state, TS_TYPEN);
1769 }
1770 
1771 /*
1772  * Process a read call on a tty device.
1773  */
1774 int
1775 ttread(struct tty *tp, struct uio *uio, int flag)
1776 {
1777 	struct clist	*qp;
1778 	u_char		*cc;
1779 	struct proc	*p;
1780 	int		c, first, error, has_stime, last_cc;
1781 	long		lflag, slp;
1782 	struct timeval	now, stime;
1783 
1784 	if (uio->uio_resid == 0)
1785 		return 0;
1786 
1787 	stime.tv_usec = 0;	/* XXX gcc */
1788 	stime.tv_sec = 0;	/* XXX gcc */
1789 
1790 	cc = tp->t_cc;
1791 	p = curproc;
1792 	error = 0;
1793 	has_stime = 0;
1794 	last_cc = 0;
1795 	slp = 0;
1796 
1797  loop:
1798 	mutex_spin_enter(&tty_lock);
1799 	lflag = tp->t_lflag;
1800 	/*
1801 	 * take pending input first
1802 	 */
1803 	if (ISSET(lflag, PENDIN))
1804 		ttypend(tp);
1805 
1806 	/*
1807 	 * Hang process if it's in the background.
1808 	 */
1809 	if (isbackground(p, tp)) {
1810 		if (sigismasked(curlwp, SIGTTIN) ||
1811 		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1812 			mutex_spin_exit(&tty_lock);
1813 			return (EIO);
1814 		}
1815 		mutex_spin_exit(&tty_lock);
1816 
1817 		mutex_enter(proc_lock);
1818 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1819 		mutex_exit(proc_lock);
1820 
1821 		mutex_spin_enter(&tty_lock);
1822 		error = ttypause(tp, hz);
1823 		mutex_spin_exit(&tty_lock);
1824 		if (error)
1825 			return (error);
1826 		goto loop;
1827 	}
1828 
1829 	if (!ISSET(lflag, ICANON)) {
1830 		int m = cc[VMIN];
1831 		long t = cc[VTIME];
1832 
1833 		qp = &tp->t_rawq;
1834 		/*
1835 		 * Check each of the four combinations.
1836 		 * (m > 0 && t == 0) is the normal read case.
1837 		 * It should be fairly efficient, so we check that and its
1838 		 * companion case (m == 0 && t == 0) first.
1839 		 * For the other two cases, we compute the target sleep time
1840 		 * into slp.
1841 		 */
1842 		if (t == 0) {
1843 			if (qp->c_cc < m)
1844 				goto sleep;
1845 			goto read;
1846 		}
1847 		t *= hz;		/* time in deca-ticks */
1848 /*
1849  * Time difference in deca-ticks, split division to avoid numeric overflow.
1850  * Ok for hz < ~200kHz
1851  */
1852 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1853 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1854 		if (m > 0) {
1855 			if (qp->c_cc <= 0)
1856 				goto sleep;
1857 			if (qp->c_cc >= m)
1858 				goto read;
1859 			if (!has_stime) {
1860 				/* first character, start timer */
1861 				has_stime = 1;
1862 				getmicrotime(&stime);
1863 				slp = t;
1864 			} else if (qp->c_cc > last_cc) {
1865 				/* got a character, restart timer */
1866 				getmicrotime(&stime);
1867 				slp = t;
1868 			} else {
1869 				/* nothing, check expiration */
1870 				getmicrotime(&now);
1871 				slp = t - diff(now, stime);
1872 			}
1873 		} else {	/* m == 0 */
1874 			if (qp->c_cc > 0)
1875 				goto read;
1876 			if (!has_stime) {
1877 				has_stime = 1;
1878 				getmicrotime(&stime);
1879 				slp = t;
1880 			} else {
1881 				getmicrotime(&now);
1882 				slp = t - diff(now, stime);
1883 			}
1884 		}
1885 		last_cc = qp->c_cc;
1886 #undef diff
1887 		if (slp > 0) {
1888 			/*
1889 			 * Convert deca-ticks back to ticks.
1890 			 * Rounding down may make us wake up just short
1891 			 * of the target, so we round up.
1892 			 * Maybe we should do 'slp/10 + 1' because the
1893 			 * first tick maybe almost immediate.
1894 			 * However it is more useful for a program that sets
1895 			 * VTIME=10 to wakeup every second not every 1.01
1896 			 * seconds (if hz=100).
1897 			 */
1898 			slp = (slp + 9)/ 10;
1899 			goto sleep;
1900 		}
1901 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1902 		int	carrier;
1903 
1904  sleep:
1905 		/*
1906 		 * If there is no input, sleep on rawq
1907 		 * awaiting hardware receipt and notification.
1908 		 * If we have data, we don't need to check for carrier.
1909 		 */
1910 		carrier = CONNECTED(tp);
1911 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1912 			mutex_spin_exit(&tty_lock);
1913 			return (0);	/* EOF */
1914 		}
1915 		if (!has_stime || slp <= 0) {
1916 			if (flag & IO_NDELAY) {
1917 				mutex_spin_exit(&tty_lock);
1918 				return (EWOULDBLOCK);
1919 			}
1920 		}
1921 		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1922 		mutex_spin_exit(&tty_lock);
1923 		/* VMIN == 0: any quantity read satisfies */
1924 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1925 			return (0);
1926 		if (error && error != EWOULDBLOCK)
1927 			return (error);
1928 		goto loop;
1929 	}
1930  read:
1931 	mutex_spin_exit(&tty_lock);
1932 
1933 	/*
1934 	 * Input present, check for input mapping and processing.
1935 	 */
1936 	first = 1;
1937 	while ((c = getc(qp)) >= 0) {
1938 		/*
1939 		 * delayed suspend (^Y)
1940 		 */
1941 		if (CCEQ(cc[VDSUSP], c) &&
1942 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
1943 			mutex_spin_enter(&tty_lock);
1944 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
1945 			if (first) {
1946 				error = ttypause(tp, hz);
1947 				mutex_spin_exit(&tty_lock);
1948 				if (error)
1949 					break;
1950 				goto loop;
1951 			} else
1952 				mutex_spin_exit(&tty_lock);
1953 			break;
1954 		}
1955 		/*
1956 		 * Interpret EOF only in canonical mode.
1957 		 */
1958 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1959 			break;
1960 		/*
1961 		 * Give user character.
1962 		 */
1963  		error = ureadc(c, uio);
1964 		if (error)
1965 			break;
1966  		if (uio->uio_resid == 0)
1967 			break;
1968 		/*
1969 		 * In canonical mode check for a "break character"
1970 		 * marking the end of a "line of input".
1971 		 */
1972 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1973 			break;
1974 		first = 0;
1975 	}
1976 	/*
1977 	 * Look to unblock output now that (presumably)
1978 	 * the input queue has gone down.
1979 	 */
1980 	mutex_spin_enter(&tty_lock);
1981 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
1982 		if (ISSET(tp->t_iflag, IXOFF) &&
1983 		    cc[VSTART] != _POSIX_VDISABLE &&
1984 		    putc(cc[VSTART], &tp->t_outq) == 0) {
1985 			CLR(tp->t_state, TS_TBLOCK);
1986 			ttstart(tp);
1987 		}
1988 		/* Try to unblock remote output via hardware flow control. */
1989 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1990 		    (*tp->t_hwiflow)(tp, 0) != 0)
1991 			CLR(tp->t_state, TS_TBLOCK);
1992 	}
1993 	mutex_spin_exit(&tty_lock);
1994 
1995 	return (error);
1996 }
1997 
1998 /*
1999  * Check the output queue on tp for space for a kernel message (from uprintf
2000  * or tprintf).  Allow some space over the normal hiwater mark so we don't
2001  * lose messages due to normal flow control, but don't let the tty run amok.
2002  * Sleeps here are not interruptible, but we return prematurely if new signals
2003  * arrive.
2004  * Call with tty lock held.
2005  */
2006 static int
2007 ttycheckoutq_wlock(struct tty *tp, int wait)
2008 {
2009 	int	hiwat, error;
2010 
2011 	KASSERT(mutex_owned(&tty_lock));
2012 
2013 	hiwat = tp->t_hiwat;
2014 	if (tp->t_outq.c_cc > hiwat + 200)
2015 		while (tp->t_outq.c_cc > hiwat) {
2016 			ttstart(tp);
2017 			if (wait == 0)
2018 				return (0);
2019 			error = ttysleep(tp, &tp->t_outcv, true, hz);
2020 			if (error == EINTR)
2021 				wait = 0;
2022 		}
2023 
2024 	return (1);
2025 }
2026 
2027 int
2028 ttycheckoutq(struct tty *tp, int wait)
2029 {
2030 	int	r;
2031 
2032 	mutex_spin_enter(&tty_lock);
2033 	r = ttycheckoutq_wlock(tp, wait);
2034 	mutex_spin_exit(&tty_lock);
2035 
2036 	return (r);
2037 }
2038 
2039 /*
2040  * Process a write call on a tty device.
2041  */
2042 int
2043 ttwrite(struct tty *tp, struct uio *uio, int flag)
2044 {
2045 	u_char		*cp;
2046 	struct proc	*p;
2047 	int		cc, ce, i, hiwat, error;
2048 	u_char		obuf[OBUFSIZ];
2049 
2050 	cp = NULL;
2051 	hiwat = tp->t_hiwat;
2052 	error = 0;
2053 	cc = 0;
2054  loop:
2055 	mutex_spin_enter(&tty_lock);
2056 	if (!CONNECTED(tp)) {
2057 		if (ISSET(tp->t_state, TS_ISOPEN)) {
2058 			mutex_spin_exit(&tty_lock);
2059 			return (EIO);
2060 		} else if (flag & IO_NDELAY) {
2061 			mutex_spin_exit(&tty_lock);
2062 			error = EWOULDBLOCK;
2063 			goto out;
2064 		} else {
2065 			/* Sleep awaiting carrier. */
2066 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
2067 			mutex_spin_exit(&tty_lock);
2068 			if (error)
2069 				goto out;
2070 			goto loop;
2071 		}
2072 	}
2073 
2074 	/*
2075 	 * Hang the process if it's in the background.
2076 	 */
2077 	p = curproc;
2078 	if (isbackground(p, tp) &&
2079 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
2080 	    !sigismasked(curlwp, SIGTTOU)) {
2081 		if (p->p_pgrp->pg_jobc == 0) {
2082 			error = EIO;
2083 			mutex_spin_exit(&tty_lock);
2084 			goto out;
2085 		}
2086 		mutex_spin_exit(&tty_lock);
2087 
2088 		mutex_enter(proc_lock);
2089 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2090 		mutex_exit(proc_lock);
2091 
2092 		mutex_spin_enter(&tty_lock);
2093 		error = ttypause(tp, hz);
2094 		mutex_spin_exit(&tty_lock);
2095 		if (error)
2096 			goto out;
2097 		goto loop;
2098 	}
2099 	mutex_spin_exit(&tty_lock);
2100 
2101 	/*
2102 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2103 	 * output translation.  Keep track of high water mark, sleep on
2104 	 * overflow awaiting device aid in acquiring new space.
2105 	 */
2106 	while (uio->uio_resid > 0 || cc > 0) {
2107 		if (ISSET(tp->t_lflag, FLUSHO)) {
2108 			uio->uio_resid = 0;
2109 			return (0);
2110 		}
2111 		if (tp->t_outq.c_cc > hiwat)
2112 			goto ovhiwat;
2113 		/*
2114 		 * Grab a hunk of data from the user, unless we have some
2115 		 * leftover from last time.
2116 		 */
2117 		if (cc == 0) {
2118 			cc = min(uio->uio_resid, OBUFSIZ);
2119 			cp = obuf;
2120 			error = uiomove(cp, cc, uio);
2121 			if (error) {
2122 				cc = 0;
2123 				goto out;
2124 			}
2125 		}
2126 		/*
2127 		 * If nothing fancy need be done, grab those characters we
2128 		 * can handle without any of ttyoutput's processing and
2129 		 * just transfer them to the output q.  For those chars
2130 		 * which require special processing (as indicated by the
2131 		 * bits in char_type), call ttyoutput.  After processing
2132 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2133 		 * immediately.
2134 		 */
2135 		mutex_spin_enter(&tty_lock);
2136 		while (cc > 0) {
2137 			if (!ISSET(tp->t_oflag, OPOST))
2138 				ce = cc;
2139 			else {
2140 				ce = cc - scanc((u_int)cc, cp, char_type,
2141 				    CCLASSMASK);
2142 				/*
2143 				 * If ce is zero, then we're processing
2144 				 * a special character through ttyoutput.
2145 				 */
2146 				if (ce == 0) {
2147 					tp->t_rocount = 0;
2148 					if (ttyoutput(*cp, tp) >= 0) {
2149 						/* out of space */
2150 						mutex_spin_exit(&tty_lock);
2151 						goto overfull;
2152 					}
2153 					cp++;
2154 					cc--;
2155 					if (ISSET(tp->t_lflag, FLUSHO) ||
2156 					    tp->t_outq.c_cc > hiwat) {
2157 						mutex_spin_exit(&tty_lock);
2158 						goto ovhiwat;
2159 					}
2160 					continue;
2161 				}
2162 			}
2163 			/*
2164 			 * A bunch of normal characters have been found.
2165 			 * Transfer them en masse to the output queue and
2166 			 * continue processing at the top of the loop.
2167 			 * If there are any further characters in this
2168 			 * <= OBUFSIZ chunk, the first should be a character
2169 			 * requiring special handling by ttyoutput.
2170 			 */
2171 			tp->t_rocount = 0;
2172 			i = b_to_q(cp, ce, &tp->t_outq);
2173 			ce -= i;
2174 			tp->t_column += ce;
2175 			cp += ce, cc -= ce, tk_nout += ce;
2176 			tp->t_outcc += ce;
2177 			if (i > 0) {
2178 				/* out of space */
2179 				mutex_spin_exit(&tty_lock);
2180 				goto overfull;
2181 			}
2182 			if (ISSET(tp->t_lflag, FLUSHO) ||
2183 			    tp->t_outq.c_cc > hiwat)
2184 				break;
2185 		}
2186 		ttstart(tp);
2187 		mutex_spin_exit(&tty_lock);
2188 	}
2189 
2190  out:
2191 	/*
2192 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2193 	 * offset and iov pointers have moved forward, but it doesn't matter
2194 	 * (the call will either return short or restart with a new uio).
2195 	 */
2196 	uio->uio_resid += cc;
2197 	return (error);
2198 
2199  overfull:
2200 	/*
2201 	 * Since we are using ring buffers, if we can't insert any more into
2202 	 * the output queue, we can assume the ring is full and that someone
2203 	 * forgot to set the high water mark correctly.  We set it and then
2204 	 * proceed as normal.
2205 	 */
2206 	hiwat = tp->t_outq.c_cc - 1;
2207 
2208  ovhiwat:
2209 	mutex_spin_enter(&tty_lock);
2210 	ttstart(tp);
2211 	/*
2212 	 * This can only occur if FLUSHO is set in t_lflag,
2213 	 * or if ttstart/oproc is synchronous (or very fast).
2214 	 */
2215 	if (tp->t_outq.c_cc <= hiwat) {
2216 		mutex_spin_exit(&tty_lock);
2217 		goto loop;
2218 	}
2219 	if (flag & IO_NDELAY) {
2220 		mutex_spin_exit(&tty_lock);
2221 		error = EWOULDBLOCK;
2222 		goto out;
2223 	}
2224 	error = ttysleep(tp, &tp->t_outcv, true, 0);
2225 	mutex_spin_exit(&tty_lock);
2226 	if (error)
2227 		goto out;
2228 	goto loop;
2229 }
2230 
2231 /*
2232  * Try to pull more output from the producer.  Return non-zero if
2233  * there is output ready to be sent.
2234  */
2235 bool
2236 ttypull(struct tty *tp)
2237 {
2238 
2239 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2240 
2241 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2242 		cv_broadcast(&tp->t_outcv);
2243 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2244 	}
2245 	return tp->t_outq.c_cc != 0;
2246 }
2247 
2248 /*
2249  * Rubout one character from the rawq of tp
2250  * as cleanly as possible.
2251  * Called with tty lock held.
2252  */
2253 void
2254 ttyrub(int c, struct tty *tp)
2255 {
2256 	u_char	*cp;
2257 	int	savecol, tabc;
2258 
2259 	KASSERT(mutex_owned(&tty_lock));
2260 
2261 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2262 		return;
2263 	CLR(tp->t_lflag, FLUSHO);
2264 	if (ISSET(tp->t_lflag, ECHOE)) {
2265 		if (tp->t_rocount == 0) {
2266 			/*
2267 			 * Screwed by ttwrite; retype
2268 			 */
2269 			ttyretype(tp);
2270 			return;
2271 		}
2272 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2273 			ttyrubo(tp, 2);
2274 		else {
2275 			CLR(c, ~TTY_CHARMASK);
2276 			switch (CCLASS(c)) {
2277 			case ORDINARY:
2278 				ttyrubo(tp, 1);
2279 				break;
2280 			case BACKSPACE:
2281 			case CONTROL:
2282 			case NEWLINE:
2283 			case RETURN:
2284 			case VTAB:
2285 				if (ISSET(tp->t_lflag, ECHOCTL))
2286 					ttyrubo(tp, 2);
2287 				break;
2288 			case TAB:
2289 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2290 					ttyretype(tp);
2291 					return;
2292 				}
2293 				savecol = tp->t_column;
2294 				SET(tp->t_state, TS_CNTTB);
2295 				SET(tp->t_lflag, FLUSHO);
2296 				tp->t_column = tp->t_rocol;
2297 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2298 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2299 					ttyecho(tabc, tp);
2300 				CLR(tp->t_lflag, FLUSHO);
2301 				CLR(tp->t_state, TS_CNTTB);
2302 
2303 				/* savecol will now be length of the tab. */
2304 				savecol -= tp->t_column;
2305 				tp->t_column += savecol;
2306 				if (savecol > 8)
2307 					savecol = 8;	/* overflow screw */
2308 				while (--savecol >= 0)
2309 					(void)ttyoutput('\b', tp);
2310 				break;
2311 			default:			/* XXX */
2312 				(void)printf("ttyrub: would panic c = %d, "
2313 				    "val = %d\n", c, CCLASS(c));
2314 			}
2315 		}
2316 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2317 		if (!ISSET(tp->t_state, TS_ERASE)) {
2318 			SET(tp->t_state, TS_ERASE);
2319 			(void)ttyoutput('\\', tp);
2320 		}
2321 		ttyecho(c, tp);
2322 	} else
2323 		ttyecho(tp->t_cc[VERASE], tp);
2324 	--tp->t_rocount;
2325 }
2326 
2327 /*
2328  * Back over cnt characters, erasing them.
2329  * Called with tty lock held.
2330  */
2331 static void
2332 ttyrubo(struct tty *tp, int cnt)
2333 {
2334 
2335 	KASSERT(mutex_owned(&tty_lock));
2336 
2337 	while (cnt-- > 0) {
2338 		(void)ttyoutput('\b', tp);
2339 		(void)ttyoutput(' ', tp);
2340 		(void)ttyoutput('\b', tp);
2341 	}
2342 }
2343 
2344 /*
2345  * ttyretype --
2346  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2347  *	been checked.
2348  *
2349  * Called with tty lock held.
2350  */
2351 void
2352 ttyretype(struct tty *tp)
2353 {
2354 	u_char	*cp;
2355 	int	c;
2356 
2357 	KASSERT(mutex_owned(&tty_lock));
2358 
2359 	/* Echo the reprint character. */
2360 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2361 		ttyecho(tp->t_cc[VREPRINT], tp);
2362 
2363 	(void)ttyoutput('\n', tp);
2364 
2365 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2366 		ttyecho(c, tp);
2367 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2368 		ttyecho(c, tp);
2369 	CLR(tp->t_state, TS_ERASE);
2370 
2371 	tp->t_rocount = tp->t_rawq.c_cc;
2372 	tp->t_rocol = 0;
2373 }
2374 
2375 /*
2376  * Echo a typed character to the terminal.
2377  * Called with tty lock held.
2378  */
2379 static void
2380 ttyecho(int c, struct tty *tp)
2381 {
2382 
2383 	KASSERT(mutex_owned(&tty_lock));
2384 
2385 	if (!ISSET(tp->t_state, TS_CNTTB))
2386 		CLR(tp->t_lflag, FLUSHO);
2387 	if ((!ISSET(tp->t_lflag, ECHO) &&
2388 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2389 	    ISSET(tp->t_lflag, EXTPROC))
2390 		return;
2391 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2392 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2393 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2394 		(void)ttyoutput('^', tp);
2395 		CLR(c, ~TTY_CHARMASK);
2396 		if (c == 0177)
2397 			c = '?';
2398 		else
2399 			c += 'A' - 1;
2400 	}
2401 	(void)ttyoutput(c, tp);
2402 }
2403 
2404 /*
2405  * Wake up any readers on a tty.
2406  * Called with tty lock held.
2407  */
2408 void
2409 ttwakeup(struct tty *tp)
2410 {
2411 
2412 	KASSERT(mutex_owned(&tty_lock));
2413 
2414 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2415 	if (ISSET(tp->t_state, TS_ASYNC))
2416 		ttysig(tp, TTYSIG_PG2, SIGIO);
2417 	cv_broadcast(&tp->t_rawcv);
2418 }
2419 
2420 /*
2421  * Look up a code for a specified speed in a conversion table;
2422  * used by drivers to map software speed values to hardware parameters.
2423  */
2424 int
2425 ttspeedtab(int speed, const struct speedtab *table)
2426 {
2427 
2428 	for (; table->sp_speed != -1; table++)
2429 		if (table->sp_speed == speed)
2430 			return (table->sp_code);
2431 	return (-1);
2432 }
2433 
2434 /*
2435  * Set tty hi and low water marks.
2436  *
2437  * Try to arrange the dynamics so there's about one second
2438  * from hi to low water.
2439  */
2440 void
2441 ttsetwater(struct tty *tp)
2442 {
2443 	int	cps, x;
2444 
2445 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2446 
2447 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2448 
2449 	cps = tp->t_ospeed / 10;
2450 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2451 	x += cps;
2452 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2453 	tp->t_hiwat = roundup(x, TTROUND);
2454 #undef	CLAMP
2455 }
2456 
2457 /*
2458  * Prepare report on state of foreground process group.
2459  * Call with proc_lock held.
2460  */
2461 void
2462 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2463 {
2464 	struct lwp	*l;
2465 	struct proc	*p, *pick = NULL;
2466 	struct timeval	utime, stime;
2467 	int		tmp;
2468 	fixpt_t		pctcpu = 0;
2469 	const char	*msg;
2470 	char		lmsg[100];
2471 	long		rss;
2472 
2473 	KASSERT(mutex_owned(proc_lock));
2474 
2475 	*buf = '\0';
2476 
2477 	if (tp->t_session == NULL)
2478 		msg = "not a controlling terminal\n";
2479 	else if (tp->t_pgrp == NULL)
2480 		msg = "no foreground process group\n";
2481 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2482 		msg = "empty foreground process group\n";
2483 	else {
2484 		/* Pick interesting process. */
2485 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2486 			struct proc *oldpick;
2487 
2488 			if (pick == NULL) {
2489 				pick = p;
2490 				continue;
2491 			}
2492 			if (pick->p_lock < p->p_lock) {
2493 				mutex_enter(pick->p_lock);
2494 				mutex_enter(p->p_lock);
2495 			} else if (pick->p_lock > p->p_lock) {
2496 				mutex_enter(p->p_lock);
2497 				mutex_enter(pick->p_lock);
2498 			} else
2499 				mutex_enter(p->p_lock);
2500 			oldpick = pick;
2501 			if (proc_compare_wrapper(pick, p))
2502 				pick = p;
2503 			mutex_exit(p->p_lock);
2504 			if (p->p_lock != oldpick->p_lock)
2505 				mutex_exit(oldpick->p_lock);
2506 		}
2507 		if (fromsig &&
2508 		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2509 		    SA_NOKERNINFO))
2510 			return;
2511 		msg = NULL;
2512 	}
2513 
2514 	/* Print load average. */
2515 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2516 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2517 	strlcat(buf, lmsg, bufsz);
2518 
2519 	if (pick == NULL) {
2520 		strlcat(buf, msg, bufsz);
2521 		return;
2522 	}
2523 
2524 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2525 	    pick->p_pid);
2526 	strlcat(buf, lmsg, bufsz);
2527 
2528 	mutex_enter(pick->p_lock);
2529 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2530 		const char *lp;
2531 		lwp_lock(l);
2532 #ifdef LWP_PC
2533 #define FMT_RUN "%#"PRIxVADDR
2534 #define VAL_RUNNING (vaddr_t)LWP_PC(l)
2535 #define VAL_RUNABLE (vaddr_t)LWP_PC(l)
2536 #else
2537 #define FMT_RUN "%s"
2538 #define VAL_RUNNING "running"
2539 #define VAL_RUNABLE "runnable"
2540 #endif
2541 		switch (l->l_stat) {
2542 		case LSONPROC:
2543 			snprintf(lmsg, sizeof(lmsg), FMT_RUN"/%d", VAL_RUNNING,
2544 			    cpu_index(l->l_cpu));
2545 			lp = lmsg;
2546 			break;
2547 		case LSRUN:
2548 			snprintf(lmsg, sizeof(lmsg), FMT_RUN, VAL_RUNABLE);
2549 			lp = lmsg;
2550 			break;
2551 		default:
2552 			lp = l->l_wchan ? l->l_wmesg : "iowait";
2553 			break;
2554 		}
2555 		strlcat(buf, lp, bufsz);
2556 		strlcat(buf, LIST_NEXT(l, l_sibling) != NULL ? " " : "] ",
2557 		    bufsz);
2558 		pctcpu += l->l_pctcpu;
2559 		lwp_unlock(l);
2560 	}
2561 	pctcpu += pick->p_pctcpu;
2562 	calcru(pick, &utime, &stime, NULL, NULL);
2563 	mutex_exit(pick->p_lock);
2564 
2565 	/* Round up and print user+system time, %CPU and RSS. */
2566 	utime.tv_usec += 5000;
2567 	if (utime.tv_usec >= 1000000) {
2568 		utime.tv_sec += 1;
2569 		utime.tv_usec -= 1000000;
2570 	}
2571 	stime.tv_usec += 5000;
2572 	if (stime.tv_usec >= 1000000) {
2573 		stime.tv_sec += 1;
2574 		stime.tv_usec -= 1000000;
2575 	}
2576 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2577 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2578 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2579 		rss = 0;
2580 	else
2581 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2582 
2583 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2584 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2585 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2586 	    tmp / 100, rss);
2587 	strlcat(buf, lmsg, bufsz);
2588 }
2589 
2590 /*
2591  * Print report on state of foreground process group.
2592  * Call with tty_lock held.
2593  */
2594 void
2595 ttyputinfo(struct tty *tp, char *buf)
2596 {
2597 
2598 	KASSERT(mutex_owned(&tty_lock));
2599 
2600 	if (ttycheckoutq_wlock(tp, 0) == 0)
2601 		return;
2602 	ttyprintf_nolock(tp, "%s\n", buf);
2603 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2604 }
2605 
2606 /*
2607  * Returns 1 if p2 has a better chance being the active foreground process
2608  * in a terminal instead of p1.
2609  */
2610 static int
2611 proc_compare_wrapper(struct proc *p1, struct proc *p2)
2612 {
2613 	lwp_t *l1, *l2;
2614 
2615 	KASSERT(mutex_owned(p1->p_lock));
2616 	KASSERT(mutex_owned(p2->p_lock));
2617 
2618 	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2619 		return 1;
2620 
2621 	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2622 		return 0;
2623 
2624 	return proc_compare(p1, l1, p2, l2);
2625 }
2626 
2627 /*
2628  * Output char to tty; console putchar style.
2629  * Can be called with tty lock held through kprintf() machinery..
2630  */
2631 int
2632 tputchar(int c, int flags, struct tty *tp)
2633 {
2634 	int r = 0;
2635 
2636 	if ((flags & NOLOCK) == 0)
2637 		mutex_spin_enter(&tty_lock);
2638 	if (!CONNECTED(tp)) {
2639 		r = -1;
2640 		goto out;
2641 	}
2642 	if (c == '\n')
2643 		(void)ttyoutput('\r', tp);
2644 	(void)ttyoutput(c, tp);
2645 	ttstart(tp);
2646 out:
2647 	if ((flags & NOLOCK) == 0)
2648 		mutex_spin_exit(&tty_lock);
2649 	return (r);
2650 }
2651 
2652 /*
2653  * Sleep on chan, returning ERESTART if tty changed while we napped and
2654  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by
2655  * cv_timedwait(_sig).
2656  * If the tty is revoked, restarting a pending call will redo validation done
2657  * at the start of the call.
2658  *
2659  * Must be called with the tty lock held.
2660  */
2661 int
2662 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch, int timo)
2663 {
2664 	int	error;
2665 	short	gen;
2666 
2667 	KASSERT(mutex_owned(&tty_lock));
2668 
2669 	gen = tp->t_gen;
2670 	if (cv == NULL)
2671 		error = kpause("ttypause", catch, timo, &tty_lock);
2672 	else if (catch)
2673 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2674 	else
2675 		error = cv_timedwait(cv, &tty_lock, timo);
2676 	if (error != 0)
2677 		return (error);
2678 	return (tp->t_gen == gen ? 0 : ERESTART);
2679 }
2680 
2681 int
2682 ttypause(struct tty *tp, int timo)
2683 {
2684 	int error;
2685 
2686 	error = ttysleep(tp, NULL, true, timo);
2687 	if (error == EWOULDBLOCK)
2688 		error = 0;
2689 	return error;
2690 }
2691 
2692 /*
2693  * Attach a tty to the tty list.
2694  *
2695  * This should be called ONLY once per real tty (including pty's).
2696  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2697  * distinctly NOT usable as tty's, and thus should not be attached to
2698  * the ttylist.  This is why this call is not done from tty_alloc().
2699  *
2700  * Device drivers should attach tty's at a similar time that they are
2701  * allocated, or, for the case of statically allocated struct tty's
2702  * either in the attach or (first) open routine.
2703  */
2704 void
2705 tty_attach(struct tty *tp)
2706 {
2707 
2708 	mutex_spin_enter(&tty_lock);
2709 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2710 	++tty_count;
2711 	mutex_spin_exit(&tty_lock);
2712 }
2713 
2714 /*
2715  * Remove a tty from the tty list.
2716  */
2717 void
2718 tty_detach(struct tty *tp)
2719 {
2720 
2721 	mutex_spin_enter(&tty_lock);
2722 	--tty_count;
2723 #ifdef DIAGNOSTIC
2724 	if (tty_count < 0)
2725 		panic("tty_detach: tty_count < 0");
2726 #endif
2727 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2728 	mutex_spin_exit(&tty_lock);
2729 }
2730 
2731 /*
2732  * Allocate a tty structure and its associated buffers.
2733  */
2734 struct tty *
2735 tty_alloc(void)
2736 {
2737 	struct tty *tp;
2738 	int i;
2739 
2740 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2741 	callout_init(&tp->t_rstrt_ch, 0);
2742 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2743 	tp->t_qsize = tty_qsize;
2744 	clalloc(&tp->t_rawq, tp->t_qsize, 1);
2745 	cv_init(&tp->t_rawcv, "ttyraw");
2746 	cv_init(&tp->t_rawcvf, "ttyrawf");
2747 	clalloc(&tp->t_canq, tp->t_qsize, 1);
2748 	cv_init(&tp->t_cancv, "ttycan");
2749 	cv_init(&tp->t_cancvf, "ttycanf");
2750 	/* output queue doesn't need quoting */
2751 	clalloc(&tp->t_outq, tp->t_qsize, 0);
2752 	cv_init(&tp->t_outcv, "ttyout");
2753 	cv_init(&tp->t_outcvf, "ttyoutf");
2754 	/* Set default line discipline. */
2755 	tp->t_linesw = ttyldisc_default();
2756 	tp->t_dev = NODEV;
2757 	selinit(&tp->t_rsel);
2758 	selinit(&tp->t_wsel);
2759 	for (i = 0; i < TTYSIG_COUNT; i++)  {
2760 		sigemptyset(&tp->t_sigs[i]);
2761 	}
2762 
2763 	return tp;
2764 }
2765 
2766 /*
2767  * Free a tty structure and its buffers.
2768  *
2769  * Be sure to call tty_detach() for any tty that has been
2770  * tty_attach()ed.
2771  */
2772 void
2773 tty_free(struct tty *tp)
2774 {
2775 	int i;
2776 
2777 	mutex_enter(proc_lock);
2778 	mutex_enter(&tty_lock);
2779 	for (i = 0; i < TTYSIG_COUNT; i++)
2780 		sigemptyset(&tp->t_sigs[i]);
2781 	if (tp->t_sigcount != 0)
2782 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2783 	mutex_exit(&tty_lock);
2784 	mutex_exit(proc_lock);
2785 
2786 	callout_halt(&tp->t_rstrt_ch, NULL);
2787 	callout_destroy(&tp->t_rstrt_ch);
2788 	ttyldisc_release(tp->t_linesw);
2789 	clfree(&tp->t_rawq);
2790 	clfree(&tp->t_canq);
2791 	clfree(&tp->t_outq);
2792 	cv_destroy(&tp->t_rawcv);
2793 	cv_destroy(&tp->t_rawcvf);
2794 	cv_destroy(&tp->t_cancv);
2795 	cv_destroy(&tp->t_cancvf);
2796 	cv_destroy(&tp->t_outcv);
2797 	cv_destroy(&tp->t_outcvf);
2798 	seldestroy(&tp->t_rsel);
2799 	seldestroy(&tp->t_wsel);
2800 	kmem_free(tp, sizeof(*tp));
2801 }
2802 
2803 /*
2804  * ttyprintf_nolock: send a message to a specific tty, without locking.
2805  *
2806  * => should be used only by tty driver or anything that knows the
2807  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2808  *    use tprintf]
2809  */
2810 static void
2811 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2812 {
2813 	va_list ap;
2814 
2815 	/* No mutex needed; going to process TTY. */
2816 	va_start(ap, fmt);
2817 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2818 	va_end(ap);
2819 }
2820 
2821 static int
2822 tty_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
2823     void *arg0, void *arg1, void *arg2, void *arg3)
2824 {
2825 	struct tty *tty;
2826 	int result;
2827 
2828 	result = KAUTH_RESULT_DEFER;
2829 
2830 	if (action != KAUTH_DEVICE_TTY_OPEN)
2831 		return result;
2832 
2833 	tty = arg0;
2834 
2835 	/* If it's not opened, we allow. */
2836 	if ((tty->t_state & TS_ISOPEN) == 0)
2837 		result = KAUTH_RESULT_ALLOW;
2838 	else {
2839 		/*
2840 		 * If it's opened, we can only allow if it's not exclusively
2841 		 * opened; otherwise, that's a privileged operation and we
2842 		 * let the secmodel handle it.
2843 		 */
2844 		if ((tty->t_state & TS_XCLUDE) == 0)
2845 			result = KAUTH_RESULT_ALLOW;
2846 	}
2847 
2848 	return result;
2849 }
2850 
2851 /*
2852  * Initialize the tty subsystem.
2853  */
2854 void
2855 tty_init(void)
2856 {
2857 
2858 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2859 	rw_init(&ttcompat_lock);
2860 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2861 	KASSERT(tty_sigsih != NULL);
2862 
2863 	tty_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
2864 	    tty_listener_cb, NULL);
2865 
2866 	sysctl_kern_tty_setup();
2867 }
2868 
2869 /*
2870  * Send a signal from a tty to its process group or session leader.
2871  * Handoff to the target is deferred to a soft interrupt.
2872  */
2873 void
2874 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2875 {
2876 	sigset_t *sp;
2877 
2878 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2879 
2880 	sp = &tp->t_sigs[st];
2881 	if (sigismember(sp, sig))
2882 		return;
2883 	sigaddset(sp, sig);
2884 	if (tp->t_sigcount++ == 0)
2885 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2886 	softint_schedule(tty_sigsih);
2887 }
2888 
2889 /*
2890  * Deliver deferred signals from ttys.  Note that the process groups
2891  * and sessions associated with the ttys may have changed from when
2892  * the signal was originally sent, but in practice it should not matter.
2893  * For signals produced as a result of a syscall, the soft interrupt
2894  * will fire before the syscall returns to the user.
2895  */
2896 static void
2897 ttysigintr(void *cookie)
2898 {
2899 	struct tty *tp;
2900 	enum ttysigtype st;
2901 	struct pgrp *pgrp;
2902 	struct session *sess;
2903 	int sig, lflag;
2904 	char infobuf[200];
2905 
2906 	mutex_enter(proc_lock);
2907 	mutex_spin_enter(&tty_lock);
2908 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2909 		KASSERT(tp->t_sigcount > 0);
2910 		for (st = 0; st < TTYSIG_COUNT; st++) {
2911 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2912 				break;
2913 		}
2914 		KASSERT(st < TTYSIG_COUNT);
2915 		sigdelset(&tp->t_sigs[st], sig);
2916 		if (--tp->t_sigcount == 0)
2917 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2918 		pgrp = tp->t_pgrp;
2919 		sess = tp->t_session;
2920 		lflag = tp->t_lflag;
2921 		if  (sig == SIGINFO) {
2922 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2923 				/* Via ioctl: ignore tty option. */
2924 				tp->t_state &= ~TS_SIGINFO;
2925 				lflag |= ISIG;
2926 			}
2927 			if (!ISSET(lflag, NOKERNINFO)) {
2928 				mutex_spin_exit(&tty_lock);
2929 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
2930 				mutex_spin_enter(&tty_lock);
2931 				ttyputinfo(tp, infobuf);
2932 			}
2933 			if (!ISSET(lflag, ISIG))
2934 				continue;
2935 		}
2936 		mutex_spin_exit(&tty_lock);
2937 		KASSERT(sig != 0);
2938 		switch (st) {
2939 		case TTYSIG_PG1:
2940 			if (pgrp != NULL)
2941 				pgsignal(pgrp, sig, 1);
2942 			break;
2943 		case TTYSIG_PG2:
2944 			if (pgrp != NULL)
2945 				pgsignal(pgrp, sig, sess != NULL);
2946 			break;
2947 		case TTYSIG_LEADER:
2948 			if (sess != NULL && sess->s_leader != NULL)
2949 				psignal(sess->s_leader, sig);
2950 			break;
2951 		default:
2952 			/* NOTREACHED */
2953 			break;
2954 		}
2955 		mutex_spin_enter(&tty_lock);
2956 	}
2957 	mutex_spin_exit(&tty_lock);
2958 	mutex_exit(proc_lock);
2959 }
2960