xref: /netbsd-src/sys/kern/tty.c (revision 8ac07aec990b9d2e483062509d0a9fa5b4f57cf2)
1 /*	$NetBSD: tty.c,v 1.221 2008/04/24 18:39:24 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by the NetBSD
18  *	Foundation, Inc. and its contributors.
19  * 4. Neither the name of The NetBSD Foundation nor the names of its
20  *    contributors may be used to endorse or promote products derived
21  *    from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
24  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33  * POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /*-
37  * Copyright (c) 1982, 1986, 1990, 1991, 1993
38  *	The Regents of the University of California.  All rights reserved.
39  * (c) UNIX System Laboratories, Inc.
40  * All or some portions of this file are derived from material licensed
41  * to the University of California by American Telephone and Telegraph
42  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
43  * the permission of UNIX System Laboratories, Inc.
44  *
45  * Redistribution and use in source and binary forms, with or without
46  * modification, are permitted provided that the following conditions
47  * are met:
48  * 1. Redistributions of source code must retain the above copyright
49  *    notice, this list of conditions and the following disclaimer.
50  * 2. Redistributions in binary form must reproduce the above copyright
51  *    notice, this list of conditions and the following disclaimer in the
52  *    documentation and/or other materials provided with the distribution.
53  * 3. Neither the name of the University nor the names of its contributors
54  *    may be used to endorse or promote products derived from this software
55  *    without specific prior written permission.
56  *
57  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
58  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
59  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
60  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
61  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
62  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
63  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
64  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
65  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
66  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
67  * SUCH DAMAGE.
68  *
69  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
70  */
71 
72 #include <sys/cdefs.h>
73 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.221 2008/04/24 18:39:24 ad Exp $");
74 
75 #include <sys/param.h>
76 #include <sys/systm.h>
77 #include <sys/ioctl.h>
78 #include <sys/proc.h>
79 #define	TTYDEFCHARS
80 #include <sys/tty.h>
81 #undef	TTYDEFCHARS
82 #include <sys/file.h>
83 #include <sys/conf.h>
84 #include <sys/dkstat.h>
85 #include <sys/uio.h>
86 #include <sys/kernel.h>
87 #include <sys/vnode.h>
88 #include <sys/syslog.h>
89 #include <sys/malloc.h>
90 #include <sys/kmem.h>
91 #include <sys/signalvar.h>
92 #include <sys/resourcevar.h>
93 #include <sys/poll.h>
94 #include <sys/kprintf.h>
95 #include <sys/namei.h>
96 #include <sys/sysctl.h>
97 #include <sys/kauth.h>
98 #include <sys/intr.h>
99 
100 #include <machine/stdarg.h>
101 
102 static int	ttnread(struct tty *);
103 static void	ttyblock(struct tty *);
104 static void	ttyecho(int, struct tty *);
105 static void	ttyrubo(struct tty *, int);
106 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
107     __attribute__((__format__(__printf__,2,3)));
108 static int	proc_compare(struct proc *, struct proc *);
109 static void	ttysigintr(void *);
110 
111 /* Symbolic sleep message strings. */
112 const char	ttclos[] = "ttycls";
113 const char	ttopen[] = "ttyopn";
114 const char	ttybg[] = "ttybg";
115 const char	ttyin[] = "ttyin";
116 const char	ttyout[] = "ttyout";
117 
118 /*
119  * Used to determine whether we still have a connection.  This is true in
120  * one of 3 cases:
121  * 1) We have carrier.
122  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
123  * 3) We're using a flow control mechanism that overloads the carrier signal.
124  */
125 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
126 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
127 
128 /*
129  * Table with character classes and parity. The 8th bit indicates parity,
130  * the 7th bit indicates the character is an alphameric or underscore (for
131  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
132  * are 0 then the character needs no special processing on output; classes
133  * other than 0 might be translated or (not currently) require delays.
134  */
135 #define	E	0x00	/* Even parity. */
136 #define	O	0x80	/* Odd parity. */
137 #define	PARITY(c)	(char_type[c] & O)
138 
139 #define	ALPHA	0x40	/* Alpha or underscore. */
140 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
141 
142 #define	CCLASSMASK	0x3f
143 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
144 
145 #define	BS	BACKSPACE
146 #define	CC	CONTROL
147 #define	CR	RETURN
148 #define	NA	ORDINARY | ALPHA
149 #define	NL	NEWLINE
150 #define	NO	ORDINARY
151 #define	TB	TAB
152 #define	VT	VTAB
153 
154 unsigned char const char_type[] = {
155 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
156 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
157 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
158 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
159 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
160 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
161 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
162 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
163 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
164 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
165 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
166 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
167 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
168 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
169 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
170 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
171 	/*
172 	 * Meta chars; should be settable per character set;
173 	 * for now, treat them all as normal characters.
174 	 */
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
186 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
187 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
188 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
189 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
190 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
191 };
192 #undef	BS
193 #undef	CC
194 #undef	CR
195 #undef	NA
196 #undef	NL
197 #undef	NO
198 #undef	TB
199 #undef	VT
200 
201 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
202 static void *tty_sigsih;
203 
204 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
205 int tty_count;
206 kmutex_t tty_lock;
207 
208 uint64_t tk_cancc;
209 uint64_t tk_nin;
210 uint64_t tk_nout;
211 uint64_t tk_rawcc;
212 
213 SYSCTL_SETUP(sysctl_kern_tkstat_setup, "sysctl kern.tkstat subtree setup")
214 {
215 
216 	sysctl_createv(clog, 0, NULL, NULL,
217 		       CTLFLAG_PERMANENT,
218 		       CTLTYPE_NODE, "kern", NULL,
219 		       NULL, 0, NULL, 0,
220 		       CTL_KERN, CTL_EOL);
221 	sysctl_createv(clog, 0, NULL, NULL,
222 		       CTLFLAG_PERMANENT,
223 		       CTLTYPE_NODE, "tkstat",
224 		       SYSCTL_DESCR("Number of characters sent and and "
225 				    "received on ttys"),
226 		       NULL, 0, NULL, 0,
227 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
228 
229 	sysctl_createv(clog, 0, NULL, NULL,
230 		       CTLFLAG_PERMANENT,
231 		       CTLTYPE_QUAD, "nin",
232 		       SYSCTL_DESCR("Total number of tty input characters"),
233 		       NULL, 0, &tk_nin, 0,
234 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
235 	sysctl_createv(clog, 0, NULL, NULL,
236 		       CTLFLAG_PERMANENT,
237 		       CTLTYPE_QUAD, "nout",
238 		       SYSCTL_DESCR("Total number of tty output characters"),
239 		       NULL, 0, &tk_nout, 0,
240 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
241 	sysctl_createv(clog, 0, NULL, NULL,
242 		       CTLFLAG_PERMANENT,
243 		       CTLTYPE_QUAD, "cancc",
244 		       SYSCTL_DESCR("Number of canonical tty input characters"),
245 		       NULL, 0, &tk_cancc, 0,
246 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
247 	sysctl_createv(clog, 0, NULL, NULL,
248 		       CTLFLAG_PERMANENT,
249 		       CTLTYPE_QUAD, "rawcc",
250 		       SYSCTL_DESCR("Number of raw tty input characters"),
251 		       NULL, 0, &tk_rawcc, 0,
252 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
253 }
254 
255 int
256 ttyopen(struct tty *tp, int dialout, int nonblock)
257 {
258 	int	error;
259 
260 	error = 0;
261 
262 	mutex_spin_enter(&tty_lock);
263 
264 	if (dialout) {
265 		/*
266 		 * If the device is already open for non-dialout, fail.
267 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
268 		 * opens.
269 		 */
270 		if (ISSET(tp->t_state, TS_ISOPEN) &&
271 		    !ISSET(tp->t_state, TS_DIALOUT)) {
272 			error = EBUSY;
273 			goto out;
274 		}
275 		SET(tp->t_state, TS_DIALOUT);
276 	} else {
277 		if (!nonblock) {
278 			/*
279 			 * Wait for carrier.  Also wait for any dialout
280 			 * processes to close the tty first.
281 			 */
282 			while (ISSET(tp->t_state, TS_DIALOUT) ||
283 			       !CONNECTED(tp)) {
284 				tp->t_wopen++;
285 				error = ttysleep(tp, &tp->t_rawq.c_cv, true, 0);
286 				tp->t_wopen--;
287 				if (error)
288 					goto out;
289 			}
290 		} else {
291 			/*
292 			 * Don't allow a non-blocking non-dialout open if the
293 			 * device is already open for dialout.
294 			 */
295 			if (ISSET(tp->t_state, TS_DIALOUT)) {
296 				error = EBUSY;
297 				goto out;
298 			}
299 		}
300 	}
301 
302 out:
303 	mutex_spin_exit(&tty_lock);
304 	return (error);
305 }
306 
307 /*
308  * Initial open of tty, or (re)entry to standard tty line discipline.
309  */
310 int
311 ttylopen(dev_t device, struct tty *tp)
312 {
313 
314 	mutex_spin_enter(&tty_lock);
315 	tp->t_dev = device;
316 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
317 		SET(tp->t_state, TS_ISOPEN);
318 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
319 #ifdef COMPAT_OLDTTY
320 		tp->t_flags = 0;
321 #endif
322 	}
323 	mutex_spin_exit(&tty_lock);
324 	return (0);
325 }
326 
327 /*
328  * Handle close() on a tty line: flush and set to initial state,
329  * bumping generation number so that pending read/write calls
330  * can detect recycling of the tty.
331  */
332 int
333 ttyclose(struct tty *tp)
334 {
335 	extern struct tty *constty;	/* Temporary virtual console. */
336 	struct session *sess;
337 
338 	mutex_spin_enter(&tty_lock);
339 
340 	if (constty == tp)
341 		constty = NULL;
342 
343 	ttyflush(tp, FREAD | FWRITE);
344 
345 	tp->t_gen++;
346 	tp->t_pgrp = NULL;
347 	tp->t_state = 0;
348 	sess = tp->t_session;
349 	tp->t_session = NULL;
350 
351 	mutex_spin_exit(&tty_lock);
352 
353 	mutex_enter(proc_lock);
354 	if (sess != NULL)
355 		SESSRELE(sess);
356 	mutex_exit(proc_lock);
357 
358 	return (0);
359 }
360 
361 #define	FLUSHQ(q) {							\
362 	if ((q)->c_cc)							\
363 		ndflush(q, (q)->c_cc);					\
364 }
365 
366 /*
367  * This macro is used in canonical mode input processing, where a read
368  * request shall not return unless a 'line delimiter' ('\n') or 'break'
369  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
370  * is an extension to the POSIX.1 defined set of special characters,
371  * recognize it only if IEXTEN is set in the set of local flags.
372  */
373 #define	TTBREAKC(c, lflg)						\
374 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
375 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
376 
377 
378 
379 /*
380  * ttyinput() helper.
381  * Call with the tty lock held.
382  */
383 static int
384 ttyinput_wlock(int c, struct tty *tp)
385 {
386 	int	iflag, lflag, i, error;
387 	u_char	*cc;
388 
389 	KASSERT(mutex_owned(&tty_lock));
390 
391 	/*
392 	 * If input is pending take it first.
393 	 */
394 	lflag = tp->t_lflag;
395 	if (ISSET(lflag, PENDIN))
396 		ttypend(tp);
397 	/*
398 	 * Gather stats.
399 	 */
400 	if (ISSET(lflag, ICANON)) {
401 		++tk_cancc;
402 		++tp->t_cancc;
403 	} else {
404 		++tk_rawcc;
405 		++tp->t_rawcc;
406 	}
407 	++tk_nin;
408 
409 	cc = tp->t_cc;
410 
411 	/*
412 	 * Handle exceptional conditions (break, parity, framing).
413 	 */
414 	iflag = tp->t_iflag;
415 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
416 		CLR(c, TTY_ERRORMASK);
417 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
418 			if (ISSET(iflag, IGNBRK))
419 				return (0);
420 			else if (ISSET(iflag, BRKINT)) {
421 				ttyflush(tp, FREAD | FWRITE);
422 				ttysig(tp, TTYSIG_PG1, SIGINT);
423 				return (0);
424 			} else if (ISSET(iflag, PARMRK))
425 				goto parmrk;
426 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
427 		    ISSET(error, TTY_FE)) {
428 			if (ISSET(iflag, IGNPAR))
429 				return (0);
430 			else if (ISSET(iflag, PARMRK)) {
431  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
432 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
433 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
434 				return (0);
435 			} else
436 				c = 0;
437 		}
438 	} else if (c == 0377 &&
439 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
440 		/* "Escape" a valid character of '\377'. */
441 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
442 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
443 		goto endcase;
444 	}
445 
446 	/*
447 	 * In tandem mode, check high water mark.
448 	 */
449 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
450 		ttyblock(tp);
451 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
452 		CLR(c, 0x80);
453 	if (!ISSET(lflag, EXTPROC)) {
454 		/*
455 		 * Check for literal nexting very first
456 		 */
457 		if (ISSET(tp->t_state, TS_LNCH)) {
458 			SET(c, TTY_QUOTE);
459 			CLR(tp->t_state, TS_LNCH);
460 		}
461 		/*
462 		 * Scan for special characters.  This code
463 		 * is really just a big case statement with
464 		 * non-constant cases.  The bottom of the
465 		 * case statement is labeled ``endcase'', so goto
466 		 * it after a case match, or similar.
467 		 */
468 
469 		/*
470 		 * Control chars which aren't controlled
471 		 * by ICANON, ISIG, or IXON.
472 		 */
473 		if (ISSET(lflag, IEXTEN)) {
474 			if (CCEQ(cc[VLNEXT], c)) {
475 				if (ISSET(lflag, ECHO)) {
476 					if (ISSET(lflag, ECHOE)) {
477 						(void)ttyoutput('^', tp);
478 						(void)ttyoutput('\b', tp);
479 					} else
480 						ttyecho(c, tp);
481 				}
482 				SET(tp->t_state, TS_LNCH);
483 				goto endcase;
484 			}
485 			if (CCEQ(cc[VDISCARD], c)) {
486 				if (ISSET(lflag, FLUSHO))
487 					CLR(tp->t_lflag, FLUSHO);
488 				else {
489 					ttyflush(tp, FWRITE);
490 					ttyecho(c, tp);
491 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
492 						ttyretype(tp);
493 					SET(tp->t_lflag, FLUSHO);
494 				}
495 				goto startoutput;
496 			}
497 		}
498 		/*
499 		 * Signals.
500 		 */
501 		if (ISSET(lflag, ISIG)) {
502 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
503 				if (!ISSET(lflag, NOFLSH))
504 					ttyflush(tp, FREAD | FWRITE);
505 				ttyecho(c, tp);
506 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
507 				    SIGINT : SIGQUIT);
508 				goto endcase;
509 			}
510 			if (CCEQ(cc[VSUSP], c)) {
511 				if (!ISSET(lflag, NOFLSH))
512 					ttyflush(tp, FREAD);
513 				ttyecho(c, tp);
514 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
515 				goto endcase;
516 			}
517 		}
518 		/*
519 		 * Handle start/stop characters.
520 		 */
521 		if (ISSET(iflag, IXON)) {
522 			if (CCEQ(cc[VSTOP], c)) {
523 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
524 					SET(tp->t_state, TS_TTSTOP);
525 					cdev_stop(tp, 0);
526 					return (0);
527 				}
528 				if (!CCEQ(cc[VSTART], c))
529 					return (0);
530 				/*
531 				 * if VSTART == VSTOP then toggle
532 				 */
533 				goto endcase;
534 			}
535 			if (CCEQ(cc[VSTART], c))
536 				goto restartoutput;
537 		}
538 		/*
539 		 * IGNCR, ICRNL, & INLCR
540 		 */
541 		if (c == '\r') {
542 			if (ISSET(iflag, IGNCR))
543 				goto endcase;
544 			else if (ISSET(iflag, ICRNL))
545 				c = '\n';
546 		} else if (c == '\n' && ISSET(iflag, INLCR))
547 			c = '\r';
548 	}
549 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
550 		/*
551 		 * From here on down canonical mode character
552 		 * processing takes place.
553 		 */
554 		/*
555 		 * erase (^H / ^?)
556 		 */
557 		if (CCEQ(cc[VERASE], c)) {
558 			if (tp->t_rawq.c_cc)
559 				ttyrub(unputc(&tp->t_rawq), tp);
560 			goto endcase;
561 		}
562 		/*
563 		 * kill (^U)
564 		 */
565 		if (CCEQ(cc[VKILL], c)) {
566 			if (ISSET(lflag, ECHOKE) &&
567 			    tp->t_rawq.c_cc == tp->t_rocount &&
568 			    !ISSET(lflag, ECHOPRT))
569 				while (tp->t_rawq.c_cc)
570 					ttyrub(unputc(&tp->t_rawq), tp);
571 			else {
572 				ttyecho(c, tp);
573 				if (ISSET(lflag, ECHOK) ||
574 				    ISSET(lflag, ECHOKE))
575 					ttyecho('\n', tp);
576 				FLUSHQ(&tp->t_rawq);
577 				tp->t_rocount = 0;
578 			}
579 			CLR(tp->t_state, TS_LOCAL);
580 			goto endcase;
581 		}
582 		/*
583 		 * Extensions to the POSIX.1 GTI set of functions.
584 		 */
585 		if (ISSET(lflag, IEXTEN)) {
586 			/*
587 			 * word erase (^W)
588 			 */
589 			if (CCEQ(cc[VWERASE], c)) {
590 				int alt = ISSET(lflag, ALTWERASE);
591 				int ctype;
592 
593 				/*
594 				 * erase whitespace
595 				 */
596 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
597 				    c == '\t')
598 					ttyrub(c, tp);
599 				if (c == -1)
600 					goto endcase;
601 				/*
602 				 * erase last char of word and remember the
603 				 * next chars type (for ALTWERASE)
604 				 */
605 				ttyrub(c, tp);
606 				c = unputc(&tp->t_rawq);
607 				if (c == -1)
608 					goto endcase;
609 				if (c == ' ' || c == '\t') {
610 					(void)putc(c, &tp->t_rawq);
611 					goto endcase;
612 				}
613 				ctype = ISALPHA(c);
614 				/*
615 				 * erase rest of word
616 				 */
617 				do {
618 					ttyrub(c, tp);
619 					c = unputc(&tp->t_rawq);
620 					if (c == -1)
621 						goto endcase;
622 				} while (c != ' ' && c != '\t' &&
623 				    (alt == 0 || ISALPHA(c) == ctype));
624 				(void)putc(c, &tp->t_rawq);
625 				goto endcase;
626 			}
627 			/*
628 			 * reprint line (^R)
629 			 */
630 			if (CCEQ(cc[VREPRINT], c)) {
631 				ttyretype(tp);
632 				goto endcase;
633 			}
634 			/*
635 			 * ^T - kernel info and generate SIGINFO
636 			 */
637 			if (CCEQ(cc[VSTATUS], c)) {
638 				ttysig(tp, TTYSIG_PG1, SIGINFO);
639 				goto endcase;
640 			}
641 		}
642 	}
643 	/*
644 	 * Check for input buffer overflow
645 	 */
646 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
647 		if (ISSET(iflag, IMAXBEL)) {
648 			if (tp->t_outq.c_cc < tp->t_hiwat)
649 				(void)ttyoutput(CTRL('g'), tp);
650 		} else
651 			ttyflush(tp, FREAD | FWRITE);
652 		goto endcase;
653 	}
654 	/*
655 	 * Put data char in q for user and
656 	 * wakeup on seeing a line delimiter.
657 	 */
658 	if (putc(c, &tp->t_rawq) >= 0) {
659 		if (!ISSET(lflag, ICANON)) {
660 			ttwakeup(tp);
661 			ttyecho(c, tp);
662 			goto endcase;
663 		}
664 		if (TTBREAKC(c, lflag)) {
665 			tp->t_rocount = 0;
666 			catq(&tp->t_rawq, &tp->t_canq);
667 			ttwakeup(tp);
668 		} else if (tp->t_rocount++ == 0)
669 			tp->t_rocol = tp->t_column;
670 		if (ISSET(tp->t_state, TS_ERASE)) {
671 			/*
672 			 * end of prterase \.../
673 			 */
674 			CLR(tp->t_state, TS_ERASE);
675 			(void)ttyoutput('/', tp);
676 		}
677 		i = tp->t_column;
678 		ttyecho(c, tp);
679 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
680 			/*
681 			 * Place the cursor over the '^' of the ^D.
682 			 */
683 			i = min(2, tp->t_column - i);
684 			while (i > 0) {
685 				(void)ttyoutput('\b', tp);
686 				i--;
687 			}
688 		}
689 	}
690  endcase:
691 	/*
692 	 * IXANY means allow any character to restart output.
693 	 */
694 	if (ISSET(tp->t_state, TS_TTSTOP) &&
695 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
696 		return (0);
697 	}
698  restartoutput:
699 	CLR(tp->t_lflag, FLUSHO);
700 	CLR(tp->t_state, TS_TTSTOP);
701  startoutput:
702 	return (ttstart(tp));
703 }
704 
705 /*
706  * Process input of a single character received on a tty.
707  *
708  * XXX - this is a hack, all drivers must changed to acquire the
709  *	 lock before calling linesw->l_rint()
710  */
711 int
712 ttyinput(int c, struct tty *tp)
713 {
714 	int error;
715 
716 	/*
717 	 * Unless the receiver is enabled, drop incoming data.
718 	 */
719 	if (!ISSET(tp->t_cflag, CREAD))
720 		return (0);
721 
722 	mutex_spin_enter(&tty_lock);
723 	error = ttyinput_wlock(c, tp);
724 	mutex_spin_exit(&tty_lock);
725 
726 	return (error);
727 }
728 
729 /*
730  * Output a single character on a tty, doing output processing
731  * as needed (expanding tabs, newline processing, etc.).
732  * Returns < 0 if succeeds, otherwise returns char to resend.
733  * Must be recursive.
734  *
735  * Call with tty lock held.
736  */
737 int
738 ttyoutput(int c, struct tty *tp)
739 {
740 	long	oflag;
741 	int	col, notout;
742 
743 	KASSERT(mutex_owned(&tty_lock));
744 
745 	oflag = tp->t_oflag;
746 	if (!ISSET(oflag, OPOST)) {
747 		tk_nout++;
748 		tp->t_outcc++;
749 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
750 			return (c);
751 		return (-1);
752 	}
753 	/*
754 	 * Do tab expansion if OXTABS is set.  Special case if we do external
755 	 * processing, we don't do the tab expansion because we'll probably
756 	 * get it wrong.  If tab expansion needs to be done, let it happen
757 	 * externally.
758 	 */
759 	CLR(c, ~TTY_CHARMASK);
760 	if (c == '\t' &&
761 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
762 		c = 8 - (tp->t_column & 7);
763 		if (ISSET(tp->t_lflag, FLUSHO)) {
764 			notout = 0;
765 		} else {
766 			notout = b_to_q("        ", c, &tp->t_outq);
767 			c -= notout;
768 			tk_nout += c;
769 			tp->t_outcc += c;
770 		}
771 		tp->t_column += c;
772 		return (notout ? '\t' : -1);
773 	}
774 	if (c == CEOT && ISSET(oflag, ONOEOT))
775 		return (-1);
776 
777 	/*
778 	 * Newline translation: if ONLCR is set,
779 	 * translate newline into "\r\n".
780 	 */
781 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
782 		tk_nout++;
783 		tp->t_outcc++;
784 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
785 			return (c);
786 	}
787 	/* If OCRNL is set, translate "\r" into "\n". */
788 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
789 		c = '\n';
790 	/* If ONOCR is set, don't transmit CRs when on column 0. */
791 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
792 		return (-1);
793 
794 	tk_nout++;
795 	tp->t_outcc++;
796 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
797 		return (c);
798 
799 	col = tp->t_column;
800 	switch (CCLASS(c)) {
801 	case BACKSPACE:
802 		if (col > 0)
803 			--col;
804 		break;
805 	case CONTROL:
806 		break;
807 	case NEWLINE:
808 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
809 			col = 0;
810 		break;
811 	case RETURN:
812 		col = 0;
813 		break;
814 	case ORDINARY:
815 		++col;
816 		break;
817 	case TAB:
818 		col = (col + 8) & ~7;
819 		break;
820 	}
821 	tp->t_column = col;
822 	return (-1);
823 }
824 
825 /*
826  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
827  * has been called to do discipline-specific functions and/or reject any
828  * of these ioctl commands.
829  */
830 /* ARGSUSED */
831 int
832 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
833 {
834 	extern struct tty *constty;	/* Temporary virtual console. */
835 	struct proc *p = l ? l->l_proc : NULL;
836 	struct linesw	*lp;
837 	int		s, error;
838 	struct nameidata nd;
839 	char		infobuf[200];
840 
841 	/* If the ioctl involves modification, hang if in the background. */
842 	switch (cmd) {
843 	case  TIOCFLUSH:
844 	case  TIOCDRAIN:
845 	case  TIOCSBRK:
846 	case  TIOCCBRK:
847 	case  TIOCSTART:
848 	case  TIOCSETA:
849 	case  TIOCSETD:
850 	case  TIOCSLINED:
851 	case  TIOCSETAF:
852 	case  TIOCSETAW:
853 #ifdef notdef
854 	case  TIOCSPGRP:
855 	case  FIOSETOWN:
856 #endif
857 	case  TIOCSTAT:
858 	case  TIOCSTI:
859 	case  TIOCSWINSZ:
860 #ifdef COMPAT_OLDTTY
861 	case  TIOCLBIC:
862 	case  TIOCLBIS:
863 	case  TIOCLSET:
864 	case  TIOCSETC:
865 	case OTIOCSETD:
866 	case  TIOCSETN:
867 	case  TIOCSETP:
868 	case  TIOCSLTC:
869 #endif
870 		mutex_spin_enter(&tty_lock);
871 		while (isbackground(curproc, tp) &&
872 		    p->p_pgrp->pg_jobc && (p->p_sflag & PS_PPWAIT) == 0 &&
873 		    !sigismasked(l, SIGTTOU)) {
874 			mutex_spin_exit(&tty_lock);
875 
876 			mutex_enter(proc_lock);
877 			pgsignal(p->p_pgrp, SIGTTOU, 1);
878 			mutex_exit(proc_lock);
879 
880 			mutex_spin_enter(&tty_lock);
881 			error = ttysleep(tp, &lbolt, true, 0);
882 			if (error) {
883 				mutex_spin_exit(&tty_lock);
884 				return (error);
885 			}
886 		}
887 		mutex_spin_exit(&tty_lock);
888 		break;
889 	}
890 
891 	switch (cmd) {			/* Process the ioctl. */
892 	case FIOASYNC:			/* set/clear async i/o */
893 		mutex_spin_enter(&tty_lock);
894 		if (*(int *)data)
895 			SET(tp->t_state, TS_ASYNC);
896 		else
897 			CLR(tp->t_state, TS_ASYNC);
898 		mutex_spin_exit(&tty_lock);
899 		break;
900 	case FIONBIO:			/* set/clear non-blocking i/o */
901 		break;			/* XXX: delete. */
902 	case FIONREAD:			/* get # bytes to read */
903 		mutex_spin_enter(&tty_lock);
904 		*(int *)data = ttnread(tp);
905 		mutex_spin_exit(&tty_lock);
906 		break;
907 	case FIONWRITE:			/* get # bytes to written & unsent */
908 		mutex_spin_enter(&tty_lock);
909 		*(int *)data = tp->t_outq.c_cc;
910 		mutex_spin_exit(&tty_lock);
911 		break;
912 	case FIONSPACE:			/* get # bytes to written & unsent */
913 		mutex_spin_enter(&tty_lock);
914 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
915 		mutex_spin_exit(&tty_lock);
916 		break;
917 	case TIOCEXCL:			/* set exclusive use of tty */
918 		mutex_spin_enter(&tty_lock);
919 		SET(tp->t_state, TS_XCLUDE);
920 		mutex_spin_exit(&tty_lock);
921 		break;
922 	case TIOCFLUSH: {		/* flush buffers */
923 		int flags = *(int *)data;
924 
925 		if (flags == 0)
926 			flags = FREAD | FWRITE;
927 		else
928 			flags &= FREAD | FWRITE;
929 		mutex_spin_enter(&tty_lock);
930 		ttyflush(tp, flags);
931 		mutex_spin_exit(&tty_lock);
932 		break;
933 	}
934 	case TIOCCONS:			/* become virtual console */
935 		if (*(int *)data) {
936 			if (constty && constty != tp &&
937 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
938 			    (TS_CARR_ON | TS_ISOPEN))
939 				return EBUSY;
940 
941 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
942 			    "/dev/console");
943 			if ((error = namei(&nd)) != 0)
944 				return error;
945 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
946 			vput(nd.ni_vp);
947 			if (error)
948 				return error;
949 
950 			constty = tp;
951 		} else if (tp == constty)
952 			constty = NULL;
953 		break;
954 	case TIOCDRAIN:			/* wait till output drained */
955 		if ((error = ttywait(tp)) != 0)
956 			return (error);
957 		break;
958 	case TIOCGETA: {		/* get termios struct */
959 		struct termios *t = (struct termios *)data;
960 
961 		memcpy(t, &tp->t_termios, sizeof(struct termios));
962 		break;
963 	}
964 	case TIOCGETD:			/* get line discipline (old) */
965 		*(int *)data = tp->t_linesw->l_no;
966 		break;
967 	case TIOCGLINED:		/* get line discipline (new) */
968 		(void)strncpy((char *)data, tp->t_linesw->l_name,
969 		    TTLINEDNAMELEN - 1);
970 		break;
971 	case TIOCGWINSZ:		/* get window size */
972 		*(struct winsize *)data = tp->t_winsize;
973 		break;
974 	case FIOGETOWN:
975 		mutex_enter(proc_lock);
976 		if (tp->t_session != NULL && !isctty(p, tp)) {
977 			mutex_exit(proc_lock);
978 			return (ENOTTY);
979 		}
980 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
981 		mutex_exit(proc_lock);
982 		break;
983 	case TIOCGPGRP:			/* get pgrp of tty */
984 		mutex_enter(proc_lock);
985 		if (!isctty(p, tp)) {
986 			mutex_exit(proc_lock);
987 			return (ENOTTY);
988 		}
989 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
990 		mutex_exit(proc_lock);
991 		break;
992 	case TIOCGSID:			/* get sid of tty */
993 		mutex_enter(proc_lock);
994 		if (!isctty(p, tp)) {
995 			mutex_exit(proc_lock);
996 			return (ENOTTY);
997 		}
998 		*(int *)data = tp->t_session->s_sid;
999 		mutex_exit(proc_lock);
1000 		break;
1001 #ifdef TIOCHPCL
1002 	case TIOCHPCL:			/* hang up on last close */
1003 		mutex_spin_enter(&tty_lock);
1004 		SET(tp->t_cflag, HUPCL);
1005 		mutex_spin_exit(&tty_lock);
1006 		break;
1007 #endif
1008 	case TIOCNXCL:			/* reset exclusive use of tty */
1009 		mutex_spin_enter(&tty_lock);
1010 		CLR(tp->t_state, TS_XCLUDE);
1011 		mutex_spin_exit(&tty_lock);
1012 		break;
1013 	case TIOCOUTQ:			/* output queue size */
1014 		*(int *)data = tp->t_outq.c_cc;
1015 		break;
1016 	case TIOCSETA:			/* set termios struct */
1017 	case TIOCSETAW:			/* drain output, set */
1018 	case TIOCSETAF: {		/* drn out, fls in, set */
1019 		struct termios *t = (struct termios *)data;
1020 
1021 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1022 			if ((error = ttywait(tp)) != 0)
1023 				return (error);
1024 
1025 			if (cmd == TIOCSETAF) {
1026 				mutex_spin_enter(&tty_lock);
1027 				ttyflush(tp, FREAD);
1028 				mutex_spin_exit(&tty_lock);
1029 			}
1030 		}
1031 
1032 		s = spltty();
1033 		/*
1034 		 * XXXSMP - some drivers call back on us from t_param(), so
1035 		 *	    don't take the tty spin lock here.
1036 		 *	    require t_param() to unlock upon callback?
1037 		 */
1038 		/* wanted here: mutex_spin_enter(&tty_lock); */
1039 		if (!ISSET(t->c_cflag, CIGNORE)) {
1040 			/*
1041 			 * Set device hardware.
1042 			 */
1043 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1044 				/* wanted here: mutex_spin_exit(&tty_lock); */
1045 				splx(s);
1046 				return (error);
1047 			} else {
1048 				tp->t_cflag = t->c_cflag;
1049 				tp->t_ispeed = t->c_ispeed;
1050 				tp->t_ospeed = t->c_ospeed;
1051 				if (t->c_ospeed == 0)
1052 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1053 			}
1054 			ttsetwater(tp);
1055 		}
1056 
1057 		/* delayed lock acquiring */
1058 		mutex_spin_enter(&tty_lock);
1059 		if (cmd != TIOCSETAF) {
1060 			if (ISSET(t->c_lflag, ICANON) !=
1061 			    ISSET(tp->t_lflag, ICANON)) {
1062 				if (ISSET(t->c_lflag, ICANON)) {
1063 					SET(tp->t_lflag, PENDIN);
1064 					ttwakeup(tp);
1065 				} else {
1066 					struct clist tq;
1067 
1068 					catq(&tp->t_rawq, &tp->t_canq);
1069 					tq = tp->t_rawq;
1070 					tp->t_rawq = tp->t_canq;
1071 					tp->t_canq = tq;
1072 					CLR(tp->t_lflag, PENDIN);
1073 				}
1074 			}
1075 		}
1076 		tp->t_iflag = t->c_iflag;
1077 		tp->t_oflag = t->c_oflag;
1078 		/*
1079 		 * Make the EXTPROC bit read only.
1080 		 */
1081 		if (ISSET(tp->t_lflag, EXTPROC))
1082 			SET(t->c_lflag, EXTPROC);
1083 		else
1084 			CLR(t->c_lflag, EXTPROC);
1085 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1086 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1087 		mutex_spin_exit(&tty_lock);
1088 		splx(s);
1089 		break;
1090 	}
1091 	case TIOCSETD:			/* set line discipline (old) */
1092 		lp = ttyldisc_lookup_bynum(*(int *)data);
1093 		goto setldisc;
1094 
1095 	case TIOCSLINED: {		/* set line discipline (new) */
1096 		char *name = (char *)data;
1097 		dev_t device;
1098 
1099 		/* Null terminate to prevent buffer overflow */
1100 		name[TTLINEDNAMELEN - 1] = '\0';
1101 		lp = ttyldisc_lookup(name);
1102  setldisc:
1103 		if (lp == NULL)
1104 			return (ENXIO);
1105 
1106 		if (lp != tp->t_linesw) {
1107 			device = tp->t_dev;
1108 			s = spltty();
1109 			(*tp->t_linesw->l_close)(tp, flag);
1110 			error = (*lp->l_open)(device, tp);
1111 			if (error) {
1112 				(void)(*tp->t_linesw->l_open)(device, tp);
1113 				splx(s);
1114 				ttyldisc_release(lp);
1115 				return (error);
1116 			}
1117 			ttyldisc_release(tp->t_linesw);
1118 			tp->t_linesw = lp;
1119 			splx(s);
1120 		} else {
1121 			/* Drop extra reference. */
1122 			ttyldisc_release(lp);
1123 		}
1124 		break;
1125 	}
1126 	case TIOCSTART:			/* start output, like ^Q */
1127 		mutex_spin_enter(&tty_lock);
1128 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1129 		    ISSET(tp->t_lflag, FLUSHO)) {
1130 			CLR(tp->t_lflag, FLUSHO);
1131 			CLR(tp->t_state, TS_TTSTOP);
1132 			ttstart(tp);
1133 		}
1134 		mutex_spin_exit(&tty_lock);
1135 		break;
1136 	case TIOCSTI:			/* simulate terminal input */
1137 		if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_STI,
1138 		    tp) != 0) {
1139 			if (!ISSET(flag, FREAD))
1140 				return (EPERM);
1141 			if (!isctty(p, tp))
1142 				return (EACCES);
1143 		}
1144 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1145 		break;
1146 	case TIOCSTOP:			/* stop output, like ^S */
1147 	{
1148 		mutex_spin_enter(&tty_lock);
1149 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1150 			SET(tp->t_state, TS_TTSTOP);
1151 			cdev_stop(tp, 0);
1152 		}
1153 		mutex_spin_exit(&tty_lock);
1154 		break;
1155 	}
1156 	case TIOCSCTTY:			/* become controlling tty */
1157 		mutex_enter(proc_lock);
1158 		mutex_spin_enter(&tty_lock);
1159 
1160 		/* Session ctty vnode pointer set in vnode layer. */
1161 		if (!SESS_LEADER(p) ||
1162 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1163 		    (tp->t_session != p->p_session))) {
1164 			mutex_spin_exit(&tty_lock);
1165 			mutex_exit(proc_lock);
1166 			return (EPERM);
1167 		}
1168 
1169 		/*
1170 		 * `p_session' acquires a reference.
1171 		 * But note that if `t_session' is set at this point,
1172 		 * it must equal `p_session', in which case the session
1173 		 * already has the correct reference count.
1174 		 */
1175 		if (tp->t_session == NULL)
1176 			SESSHOLD(p->p_session);
1177 
1178 		tp->t_session = p->p_session;
1179 		tp->t_pgrp = p->p_pgrp;
1180 		p->p_session->s_ttyp = tp;
1181 		p->p_lflag |= PL_CONTROLT;
1182 		mutex_spin_exit(&tty_lock);
1183 		mutex_exit(proc_lock);
1184 		break;
1185 	case FIOSETOWN: {		/* set pgrp of tty */
1186 		pid_t pgid = *(int *)data;
1187 		struct pgrp *pgrp;
1188 
1189 		mutex_enter(proc_lock);
1190 		if (tp->t_session != NULL && !isctty(p, tp)) {
1191 			mutex_exit(proc_lock);
1192 			return (ENOTTY);
1193 		}
1194 
1195 		if (pgid < 0) {
1196 			pgrp = pg_find(-pgid, PFIND_LOCKED | PFIND_UNLOCK_FAIL);
1197 			if (pgrp == NULL)
1198 				return (EINVAL);
1199 		} else {
1200 			struct proc *p1;
1201 			p1 = p_find(pgid, PFIND_LOCKED | PFIND_UNLOCK_FAIL);
1202 			if (!p1)
1203 				return (ESRCH);
1204 			pgrp = p1->p_pgrp;
1205 		}
1206 
1207 		if (pgrp->pg_session != p->p_session) {
1208 			mutex_exit(proc_lock);
1209 			return (EPERM);
1210 		}
1211 		mutex_spin_enter(&tty_lock);
1212 		tp->t_pgrp = pgrp;
1213 		mutex_spin_exit(&tty_lock);
1214 		mutex_exit(proc_lock);
1215 		break;
1216 	}
1217 	case TIOCSPGRP: {		/* set pgrp of tty */
1218 		struct pgrp *pgrp;
1219 
1220 		mutex_enter(proc_lock);
1221 		if (!isctty(p, tp)) {
1222 			mutex_exit(proc_lock);
1223 			return (ENOTTY);
1224 		}
1225 		pgrp = pg_find(*(int *)data, PFIND_LOCKED | PFIND_UNLOCK_FAIL);
1226 		if (pgrp == NULL)
1227 			return (EINVAL);
1228 		if (pgrp->pg_session != p->p_session) {
1229 			mutex_exit(proc_lock);
1230 			return (EPERM);
1231 		}
1232 		mutex_spin_enter(&tty_lock);
1233 		tp->t_pgrp = pgrp;
1234 		mutex_spin_exit(&tty_lock);
1235 		mutex_exit(proc_lock);
1236 		break;
1237 	}
1238 	case TIOCSTAT:			/* get load avg stats */
1239 		mutex_enter(proc_lock);
1240 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1241 		mutex_exit(proc_lock);
1242 
1243 		mutex_spin_enter(&tty_lock);
1244 		ttyputinfo(tp, infobuf);
1245 		mutex_spin_exit(&tty_lock);
1246 		break;
1247 	case TIOCSWINSZ:		/* set window size */
1248 		mutex_spin_enter(&tty_lock);
1249 		if (memcmp((void *)&tp->t_winsize, data,
1250 		    sizeof(struct winsize))) {
1251 			tp->t_winsize = *(struct winsize *)data;
1252 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1253 		}
1254 		mutex_spin_exit(&tty_lock);
1255 		break;
1256 	default:
1257 #ifdef COMPAT_OLDTTY
1258 		return (ttcompat(tp, cmd, data, flag, l));
1259 #else
1260 		return (EPASSTHROUGH);
1261 #endif
1262 	}
1263 	return (0);
1264 }
1265 
1266 int
1267 ttpoll(struct tty *tp, int events, struct lwp *l)
1268 {
1269 	int	revents;
1270 
1271 	revents = 0;
1272 	mutex_spin_enter(&tty_lock);
1273 	if (events & (POLLIN | POLLRDNORM))
1274 		if (ttnread(tp) > 0)
1275 			revents |= events & (POLLIN | POLLRDNORM);
1276 
1277 	if (events & (POLLOUT | POLLWRNORM))
1278 		if (tp->t_outq.c_cc <= tp->t_lowat)
1279 			revents |= events & (POLLOUT | POLLWRNORM);
1280 
1281 	if (events & POLLHUP)
1282 		if (!CONNECTED(tp))
1283 			revents |= POLLHUP;
1284 
1285 	if (revents == 0) {
1286 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1287 			selrecord(l, &tp->t_rsel);
1288 
1289 		if (events & (POLLOUT | POLLWRNORM))
1290 			selrecord(l, &tp->t_wsel);
1291 	}
1292 
1293 	mutex_spin_exit(&tty_lock);
1294 
1295 	return (revents);
1296 }
1297 
1298 static void
1299 filt_ttyrdetach(struct knote *kn)
1300 {
1301 	struct tty	*tp;
1302 
1303 	tp = kn->kn_hook;
1304 	mutex_spin_enter(&tty_lock);
1305 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1306 	mutex_spin_exit(&tty_lock);
1307 }
1308 
1309 static int
1310 filt_ttyread(struct knote *kn, long hint)
1311 {
1312 	struct tty	*tp;
1313 
1314 	tp = kn->kn_hook;
1315 	if ((hint & NOTE_SUBMIT) == 0)
1316 		mutex_spin_enter(&tty_lock);
1317 	kn->kn_data = ttnread(tp);
1318 	if ((hint & NOTE_SUBMIT) == 0)
1319 		mutex_spin_exit(&tty_lock);
1320 	return (kn->kn_data > 0);
1321 }
1322 
1323 static void
1324 filt_ttywdetach(struct knote *kn)
1325 {
1326 	struct tty	*tp;
1327 
1328 	tp = kn->kn_hook;
1329 	mutex_spin_enter(&tty_lock);
1330 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1331 	mutex_spin_exit(&tty_lock);
1332 }
1333 
1334 static int
1335 filt_ttywrite(struct knote *kn, long hint)
1336 {
1337 	struct tty	*tp;
1338 	int		canwrite;
1339 
1340 	tp = kn->kn_hook;
1341 	if ((hint & NOTE_SUBMIT) == 0)
1342 		mutex_spin_enter(&tty_lock);
1343 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1344 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1345 	if ((hint & NOTE_SUBMIT) == 0)
1346 		mutex_spin_exit(&tty_lock);
1347 	return (canwrite);
1348 }
1349 
1350 static const struct filterops ttyread_filtops =
1351 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1352 static const struct filterops ttywrite_filtops =
1353 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1354 
1355 int
1356 ttykqfilter(dev_t dev, struct knote *kn)
1357 {
1358 	struct tty	*tp;
1359 	struct klist	*klist;
1360 
1361 	if ((tp = cdev_tty(dev)) == NULL)
1362 		return (ENXIO);
1363 
1364 	switch (kn->kn_filter) {
1365 	case EVFILT_READ:
1366 		klist = &tp->t_rsel.sel_klist;
1367 		kn->kn_fop = &ttyread_filtops;
1368 		break;
1369 	case EVFILT_WRITE:
1370 		klist = &tp->t_wsel.sel_klist;
1371 		kn->kn_fop = &ttywrite_filtops;
1372 		break;
1373 	default:
1374 		return EINVAL;
1375 	}
1376 
1377 	kn->kn_hook = tp;
1378 
1379 	mutex_spin_enter(&tty_lock);
1380 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1381 	mutex_spin_exit(&tty_lock);
1382 
1383 	return (0);
1384 }
1385 
1386 /*
1387  * Find the number of chars ready to be read from this tty.
1388  * Call with the tty lock held.
1389  */
1390 static int
1391 ttnread(struct tty *tp)
1392 {
1393 	int	nread;
1394 
1395 	KASSERT(mutex_owned(&tty_lock));
1396 
1397 	if (ISSET(tp->t_lflag, PENDIN))
1398 		ttypend(tp);
1399 	nread = tp->t_canq.c_cc;
1400 	if (!ISSET(tp->t_lflag, ICANON)) {
1401 		nread += tp->t_rawq.c_cc;
1402 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1403 			nread = 0;
1404 	}
1405 	return (nread);
1406 }
1407 
1408 /*
1409  * Wait for output to drain.
1410  */
1411 int
1412 ttywait(struct tty *tp)
1413 {
1414 	int	error;
1415 
1416 	error = 0;
1417 
1418 	mutex_spin_enter(&tty_lock);
1419 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1420 	    CONNECTED(tp) && tp->t_oproc) {
1421 		(*tp->t_oproc)(tp);
1422 		error = ttysleep(tp, &tp->t_outq.c_cv, true, 0);
1423 		if (error)
1424 			break;
1425 	}
1426 	mutex_spin_exit(&tty_lock);
1427 
1428 	return (error);
1429 }
1430 
1431 /*
1432  * Flush if successfully wait.
1433  */
1434 int
1435 ttywflush(struct tty *tp)
1436 {
1437 	int	error;
1438 
1439 	if ((error = ttywait(tp)) == 0) {
1440 		mutex_spin_enter(&tty_lock);
1441 		ttyflush(tp, FREAD);
1442 		mutex_spin_exit(&tty_lock);
1443 	}
1444 	return (error);
1445 }
1446 
1447 /*
1448  * Flush tty read and/or write queues, notifying anyone waiting.
1449  * Call with the tty lock held.
1450  */
1451 void
1452 ttyflush(struct tty *tp, int rw)
1453 {
1454 
1455 	KASSERT(mutex_owned(&tty_lock));
1456 
1457 	if (rw & FREAD) {
1458 		FLUSHQ(&tp->t_canq);
1459 		FLUSHQ(&tp->t_rawq);
1460 		tp->t_rocount = 0;
1461 		tp->t_rocol = 0;
1462 		CLR(tp->t_state, TS_LOCAL);
1463 		ttwakeup(tp);
1464 	}
1465 	if (rw & FWRITE) {
1466 		CLR(tp->t_state, TS_TTSTOP);
1467 		cdev_stop(tp, rw);
1468 		FLUSHQ(&tp->t_outq);
1469 		clwakeup(&tp->t_outq);
1470 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1471 	}
1472 }
1473 
1474 /*
1475  * Copy in the default termios characters.
1476  */
1477 void
1478 ttychars(struct tty *tp)
1479 {
1480 
1481 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1482 }
1483 
1484 /*
1485  * Send stop character on input overflow.
1486  * Call with the tty lock held.
1487  */
1488 static void
1489 ttyblock(struct tty *tp)
1490 {
1491 	int	total;
1492 
1493 	KASSERT(mutex_owned(&tty_lock));
1494 
1495 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1496 	if (tp->t_rawq.c_cc > TTYHOG) {
1497 		ttyflush(tp, FREAD | FWRITE);
1498 		CLR(tp->t_state, TS_TBLOCK);
1499 	}
1500 	/*
1501 	 * Block further input iff: current input > threshold
1502 	 * AND input is available to user program.
1503 	 */
1504 	if (total >= TTYHOG / 2 &&
1505 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1506 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1507 		if (ISSET(tp->t_iflag, IXOFF) &&
1508 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1509 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1510 			SET(tp->t_state, TS_TBLOCK);
1511 			ttstart(tp);
1512 		}
1513 		/* Try to block remote output via hardware flow control. */
1514 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1515 		    (*tp->t_hwiflow)(tp, 1) != 0)
1516 			SET(tp->t_state, TS_TBLOCK);
1517 	}
1518 }
1519 
1520 /*
1521  * Delayed line discipline output
1522  */
1523 void
1524 ttrstrt(void *tp_arg)
1525 {
1526 	struct tty	*tp;
1527 
1528 #ifdef DIAGNOSTIC
1529 	if (tp_arg == NULL)
1530 		panic("ttrstrt");
1531 #endif
1532 	tp = tp_arg;
1533 	mutex_spin_enter(&tty_lock);
1534 
1535 	CLR(tp->t_state, TS_TIMEOUT);
1536 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1537 
1538 	mutex_spin_exit(&tty_lock);
1539 }
1540 
1541 /*
1542  * start a line discipline
1543  * Always call with tty lock held?
1544  */
1545 int
1546 ttstart(struct tty *tp)
1547 {
1548 
1549 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1550 		(*tp->t_oproc)(tp);
1551 	return (0);
1552 }
1553 
1554 /*
1555  * "close" a line discipline
1556  */
1557 int
1558 ttylclose(struct tty *tp, int flag)
1559 {
1560 
1561 	if (flag & FNONBLOCK) {
1562 		mutex_spin_enter(&tty_lock);
1563 		ttyflush(tp, FREAD | FWRITE);
1564 		mutex_spin_exit(&tty_lock);
1565 	} else
1566 		ttywflush(tp);
1567 	return (0);
1568 }
1569 
1570 /*
1571  * Handle modem control transition on a tty.
1572  * Flag indicates new state of carrier.
1573  * Returns 0 if the line should be turned off, otherwise 1.
1574  */
1575 int
1576 ttymodem(struct tty *tp, int flag)
1577 {
1578 
1579 	mutex_spin_enter(&tty_lock);
1580 	if (flag == 0) {
1581 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1582 			/*
1583 			 * Lost carrier.
1584 			 */
1585 			CLR(tp->t_state, TS_CARR_ON);
1586 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1587 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1588 				ttyflush(tp, FREAD | FWRITE);
1589 				mutex_spin_exit(&tty_lock);
1590 				return (0);
1591 			}
1592 		}
1593 	} else {
1594 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1595 			/*
1596 			 * Carrier now on.
1597 			 */
1598 			SET(tp->t_state, TS_CARR_ON);
1599 			ttwakeup(tp);
1600 		}
1601 	}
1602 	mutex_spin_exit(&tty_lock);
1603 
1604 	return (1);
1605 }
1606 
1607 /*
1608  * Default modem control routine (for other line disciplines).
1609  * Return argument flag, to turn off device on carrier drop.
1610  */
1611 int
1612 nullmodem(struct tty *tp, int flag)
1613 {
1614 
1615 	mutex_spin_enter(&tty_lock);
1616 	if (flag)
1617 		SET(tp->t_state, TS_CARR_ON);
1618 	else {
1619 		CLR(tp->t_state, TS_CARR_ON);
1620 		if (!CONNECTED(tp)) {
1621 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1622 			mutex_spin_exit(&tty_lock);
1623 			return (0);
1624 		}
1625 	}
1626 	mutex_spin_exit(&tty_lock);
1627 
1628 	return (1);
1629 }
1630 
1631 /*
1632  * Reinput pending characters after state switch.
1633  */
1634 void
1635 ttypend(struct tty *tp)
1636 {
1637 	struct clist	tq;
1638 	int		c;
1639 
1640 	KASSERT(mutex_owned(&tty_lock));
1641 
1642 	CLR(tp->t_lflag, PENDIN);
1643 	SET(tp->t_state, TS_TYPEN);
1644 	tq = tp->t_rawq;
1645 	tp->t_rawq.c_cc = 0;
1646 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1647 	while ((c = getc(&tq)) >= 0)
1648 		ttyinput_wlock(c, tp);
1649 	CLR(tp->t_state, TS_TYPEN);
1650 }
1651 
1652 /*
1653  * Process a read call on a tty device.
1654  */
1655 int
1656 ttread(struct tty *tp, struct uio *uio, int flag)
1657 {
1658 	struct clist	*qp;
1659 	u_char		*cc;
1660 	struct proc	*p;
1661 	int		c, first, error, has_stime, last_cc;
1662 	long		lflag, slp;
1663 	struct timeval	now, stime;
1664 
1665 	stime.tv_usec = 0;	/* XXX gcc */
1666 	stime.tv_sec = 0;	/* XXX gcc */
1667 
1668 	cc = tp->t_cc;
1669 	p = curproc;
1670 	error = 0;
1671 	has_stime = 0;
1672 	last_cc = 0;
1673 	slp = 0;
1674 
1675  loop:
1676 	mutex_spin_enter(&tty_lock);
1677 	lflag = tp->t_lflag;
1678 	/*
1679 	 * take pending input first
1680 	 */
1681 	if (ISSET(lflag, PENDIN))
1682 		ttypend(tp);
1683 
1684 	/*
1685 	 * Hang process if it's in the background.
1686 	 */
1687 	if (isbackground(p, tp)) {
1688 		if (sigismember(&p->p_sigctx.ps_sigignore, SIGTTIN) ||
1689 		    sigismember(&curlwp->l_sigmask, SIGTTIN) ||
1690 		    p->p_sflag & PS_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1691 			mutex_spin_exit(&tty_lock);
1692 			return (EIO);
1693 		}
1694 		mutex_spin_exit(&tty_lock);
1695 
1696 		mutex_enter(proc_lock);
1697 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1698 		mutex_exit(proc_lock);
1699 
1700 		mutex_spin_enter(&tty_lock);
1701 		error = ttysleep(tp, &lbolt, true, 0);
1702 		mutex_spin_exit(&tty_lock);
1703 		if (error)
1704 			return (error);
1705 		goto loop;
1706 	}
1707 
1708 	if (!ISSET(lflag, ICANON)) {
1709 		int m = cc[VMIN];
1710 		long t = cc[VTIME];
1711 
1712 		qp = &tp->t_rawq;
1713 		/*
1714 		 * Check each of the four combinations.
1715 		 * (m > 0 && t == 0) is the normal read case.
1716 		 * It should be fairly efficient, so we check that and its
1717 		 * companion case (m == 0 && t == 0) first.
1718 		 * For the other two cases, we compute the target sleep time
1719 		 * into slp.
1720 		 */
1721 		if (t == 0) {
1722 			if (qp->c_cc < m)
1723 				goto sleep;
1724 			goto read;
1725 		}
1726 		t *= hz;		/* time in deca-ticks */
1727 /*
1728  * Time difference in deca-ticks, split division to avoid numeric overflow.
1729  * Ok for hz < ~200kHz
1730  */
1731 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1732 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1733 		if (m > 0) {
1734 			if (qp->c_cc <= 0)
1735 				goto sleep;
1736 			if (qp->c_cc >= m)
1737 				goto read;
1738 			if (!has_stime) {
1739 				/* first character, start timer */
1740 				has_stime = 1;
1741 				getmicrotime(&stime);
1742 				slp = t;
1743 			} else if (qp->c_cc > last_cc) {
1744 				/* got a character, restart timer */
1745 				getmicrotime(&stime);
1746 				slp = t;
1747 			} else {
1748 				/* nothing, check expiration */
1749 				getmicrotime(&now);
1750 				slp = t - diff(now, stime);
1751 			}
1752 		} else {	/* m == 0 */
1753 			if (qp->c_cc > 0)
1754 				goto read;
1755 			if (!has_stime) {
1756 				has_stime = 1;
1757 				getmicrotime(&stime);
1758 				slp = t;
1759 			} else {
1760 				getmicrotime(&now);
1761 				slp = t - diff(now, stime);
1762 			}
1763 		}
1764 		last_cc = qp->c_cc;
1765 #undef diff
1766 		if (slp > 0) {
1767 			/*
1768 			 * Convert deca-ticks back to ticks.
1769 			 * Rounding down may make us wake up just short
1770 			 * of the target, so we round up.
1771 			 * Maybe we should do 'slp/10 + 1' because the
1772 			 * first tick maybe almost immediate.
1773 			 * However it is more useful for a program that sets
1774 			 * VTIME=10 to wakeup every second not every 1.01
1775 			 * seconds (if hz=100).
1776 			 */
1777 			slp = (slp + 9)/ 10;
1778 			goto sleep;
1779 		}
1780 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1781 		int	carrier;
1782 
1783  sleep:
1784 		/*
1785 		 * If there is no input, sleep on rawq
1786 		 * awaiting hardware receipt and notification.
1787 		 * If we have data, we don't need to check for carrier.
1788 		 */
1789 		carrier = CONNECTED(tp);
1790 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1791 			mutex_spin_exit(&tty_lock);
1792 			return (0);	/* EOF */
1793 		}
1794 		if (flag & IO_NDELAY) {
1795 			mutex_spin_exit(&tty_lock);
1796 			return (EWOULDBLOCK);
1797 		}
1798 		error = ttysleep(tp, &tp->t_rawq.c_cv, true, slp);
1799 		mutex_spin_exit(&tty_lock);
1800 		/* VMIN == 0: any quantity read satisfies */
1801 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1802 			return (0);
1803 		if (error && error != EWOULDBLOCK)
1804 			return (error);
1805 		goto loop;
1806 	}
1807  read:
1808 	mutex_spin_exit(&tty_lock);
1809 
1810 	/*
1811 	 * Input present, check for input mapping and processing.
1812 	 */
1813 	first = 1;
1814 	while ((c = getc(qp)) >= 0) {
1815 		/*
1816 		 * delayed suspend (^Y)
1817 		 */
1818 		if (CCEQ(cc[VDSUSP], c) &&
1819 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
1820 			mutex_spin_enter(&tty_lock);
1821 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
1822 			if (first) {
1823 				error = ttysleep(tp, &lbolt, true, 0);
1824 				mutex_spin_exit(&tty_lock);
1825 				if (error)
1826 					break;
1827 				goto loop;
1828 			} else
1829 				mutex_spin_exit(&tty_lock);
1830 			break;
1831 		}
1832 		/*
1833 		 * Interpret EOF only in canonical mode.
1834 		 */
1835 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1836 			break;
1837 		/*
1838 		 * Give user character.
1839 		 */
1840  		error = ureadc(c, uio);
1841 		if (error)
1842 			break;
1843  		if (uio->uio_resid == 0)
1844 			break;
1845 		/*
1846 		 * In canonical mode check for a "break character"
1847 		 * marking the end of a "line of input".
1848 		 */
1849 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1850 			break;
1851 		first = 0;
1852 	}
1853 	/*
1854 	 * Look to unblock output now that (presumably)
1855 	 * the input queue has gone down.
1856 	 */
1857 	mutex_spin_enter(&tty_lock);
1858 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
1859 		if (ISSET(tp->t_iflag, IXOFF) &&
1860 		    cc[VSTART] != _POSIX_VDISABLE &&
1861 		    putc(cc[VSTART], &tp->t_outq) == 0) {
1862 			CLR(tp->t_state, TS_TBLOCK);
1863 			ttstart(tp);
1864 		}
1865 		/* Try to unblock remote output via hardware flow control. */
1866 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1867 		    (*tp->t_hwiflow)(tp, 0) != 0)
1868 			CLR(tp->t_state, TS_TBLOCK);
1869 	}
1870 	mutex_spin_exit(&tty_lock);
1871 
1872 	return (error);
1873 }
1874 
1875 /*
1876  * Check the output queue on tp for space for a kernel message (from uprintf
1877  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1878  * lose messages due to normal flow control, but don't let the tty run amok.
1879  * Sleeps here are not interruptible, but we return prematurely if new signals
1880  * arrive.
1881  * Call with tty lock held.
1882  */
1883 static int
1884 ttycheckoutq_wlock(struct tty *tp, int wait)
1885 {
1886 	int	hiwat, error;
1887 
1888 	KASSERT(mutex_owned(&tty_lock));
1889 
1890 	hiwat = tp->t_hiwat;
1891 	if (tp->t_outq.c_cc > hiwat + 200)
1892 		while (tp->t_outq.c_cc > hiwat) {
1893 			ttstart(tp);
1894 			if (wait == 0)
1895 				return (0);
1896 			error = ttysleep(tp, &tp->t_outq.c_cv, true, hz);
1897 			if (error == EINTR)
1898 				wait = 0;
1899 		}
1900 
1901 	return (1);
1902 }
1903 
1904 int
1905 ttycheckoutq(struct tty *tp, int wait)
1906 {
1907 	int	r;
1908 
1909 	mutex_spin_enter(&tty_lock);
1910 	r = ttycheckoutq_wlock(tp, wait);
1911 	mutex_spin_exit(&tty_lock);
1912 
1913 	return (r);
1914 }
1915 
1916 /*
1917  * Process a write call on a tty device.
1918  */
1919 int
1920 ttwrite(struct tty *tp, struct uio *uio, int flag)
1921 {
1922 	u_char		*cp;
1923 	struct proc	*p;
1924 	int		cc, ce, i, hiwat, error;
1925 	size_t		cnt;
1926 	u_char		obuf[OBUFSIZ];
1927 
1928 	cp = NULL;
1929 	hiwat = tp->t_hiwat;
1930 	cnt = uio->uio_resid;
1931 	error = 0;
1932 	cc = 0;
1933  loop:
1934 	mutex_spin_enter(&tty_lock);
1935 	if (!CONNECTED(tp)) {
1936 		if (ISSET(tp->t_state, TS_ISOPEN)) {
1937 			mutex_spin_exit(&tty_lock);
1938 			return (EIO);
1939 		} else if (flag & IO_NDELAY) {
1940 			mutex_spin_exit(&tty_lock);
1941 			error = EWOULDBLOCK;
1942 			goto out;
1943 		} else {
1944 			/* Sleep awaiting carrier. */
1945 			error = ttysleep(tp, &tp->t_rawq.c_cv, true, 0);
1946 			mutex_spin_exit(&tty_lock);
1947 			if (error)
1948 				goto out;
1949 			goto loop;
1950 		}
1951 	}
1952 
1953 	/*
1954 	 * Hang the process if it's in the background.
1955 	 */
1956 	p = curproc;
1957 	if (isbackground(p, tp) &&
1958 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_sflag & PS_PPWAIT) == 0 &&
1959 	    !sigismember(&p->p_sigctx.ps_sigignore, SIGTTOU) &&
1960 	    !sigismember(&curlwp->l_sigmask, SIGTTOU)) {
1961 		if (p->p_pgrp->pg_jobc == 0) {
1962 			error = EIO;
1963 			mutex_spin_exit(&tty_lock);
1964 			goto out;
1965 		}
1966 		mutex_spin_exit(&tty_lock);
1967 
1968 		mutex_enter(proc_lock);
1969 		pgsignal(p->p_pgrp, SIGTTOU, 1);
1970 		mutex_exit(proc_lock);
1971 
1972 		mutex_spin_enter(&tty_lock);
1973 		error = ttysleep(tp, &lbolt, true, 0);
1974 		mutex_spin_exit(&tty_lock);
1975 		if (error)
1976 			goto out;
1977 		goto loop;
1978 	}
1979 	mutex_spin_exit(&tty_lock);
1980 
1981 	/*
1982 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1983 	 * output translation.  Keep track of high water mark, sleep on
1984 	 * overflow awaiting device aid in acquiring new space.
1985 	 */
1986 	while (uio->uio_resid > 0 || cc > 0) {
1987 		if (ISSET(tp->t_lflag, FLUSHO)) {
1988 			uio->uio_resid = 0;
1989 			return (0);
1990 		}
1991 		if (tp->t_outq.c_cc > hiwat)
1992 			goto ovhiwat;
1993 		/*
1994 		 * Grab a hunk of data from the user, unless we have some
1995 		 * leftover from last time.
1996 		 */
1997 		if (cc == 0) {
1998 			cc = min(uio->uio_resid, OBUFSIZ);
1999 			cp = obuf;
2000 			error = uiomove(cp, cc, uio);
2001 			if (error) {
2002 				cc = 0;
2003 				goto out;
2004 			}
2005 		}
2006 		/*
2007 		 * If nothing fancy need be done, grab those characters we
2008 		 * can handle without any of ttyoutput's processing and
2009 		 * just transfer them to the output q.  For those chars
2010 		 * which require special processing (as indicated by the
2011 		 * bits in char_type), call ttyoutput.  After processing
2012 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2013 		 * immediately.
2014 		 */
2015 		mutex_spin_enter(&tty_lock);
2016 		while (cc > 0) {
2017 			if (!ISSET(tp->t_oflag, OPOST))
2018 				ce = cc;
2019 			else {
2020 				ce = cc - scanc((u_int)cc, cp, char_type,
2021 				    CCLASSMASK);
2022 				/*
2023 				 * If ce is zero, then we're processing
2024 				 * a special character through ttyoutput.
2025 				 */
2026 				if (ce == 0) {
2027 					tp->t_rocount = 0;
2028 					if (ttyoutput(*cp, tp) >= 0) {
2029 						/* out of space */
2030 						mutex_spin_exit(&tty_lock);
2031 						goto overfull;
2032 					}
2033 					cp++;
2034 					cc--;
2035 					if (ISSET(tp->t_lflag, FLUSHO) ||
2036 					    tp->t_outq.c_cc > hiwat) {
2037 						mutex_spin_exit(&tty_lock);
2038 						goto ovhiwat;
2039 					}
2040 					continue;
2041 				}
2042 			}
2043 			/*
2044 			 * A bunch of normal characters have been found.
2045 			 * Transfer them en masse to the output queue and
2046 			 * continue processing at the top of the loop.
2047 			 * If there are any further characters in this
2048 			 * <= OBUFSIZ chunk, the first should be a character
2049 			 * requiring special handling by ttyoutput.
2050 			 */
2051 			tp->t_rocount = 0;
2052 			i = b_to_q(cp, ce, &tp->t_outq);
2053 			ce -= i;
2054 			tp->t_column += ce;
2055 			cp += ce, cc -= ce, tk_nout += ce;
2056 			tp->t_outcc += ce;
2057 			if (i > 0) {
2058 				/* out of space */
2059 				mutex_spin_exit(&tty_lock);
2060 				goto overfull;
2061 			}
2062 			if (ISSET(tp->t_lflag, FLUSHO) ||
2063 			    tp->t_outq.c_cc > hiwat)
2064 				break;
2065 		}
2066 		ttstart(tp);
2067 		mutex_spin_exit(&tty_lock);
2068 	}
2069 
2070  out:
2071 	/*
2072 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2073 	 * offset and iov pointers have moved forward, but it doesn't matter
2074 	 * (the call will either return short or restart with a new uio).
2075 	 */
2076 	uio->uio_resid += cc;
2077 	return (error);
2078 
2079  overfull:
2080 	/*
2081 	 * Since we are using ring buffers, if we can't insert any more into
2082 	 * the output queue, we can assume the ring is full and that someone
2083 	 * forgot to set the high water mark correctly.  We set it and then
2084 	 * proceed as normal.
2085 	 */
2086 	hiwat = tp->t_outq.c_cc - 1;
2087 
2088  ovhiwat:
2089 	mutex_spin_enter(&tty_lock);
2090 	ttstart(tp);
2091 	/*
2092 	 * This can only occur if FLUSHO is set in t_lflag,
2093 	 * or if ttstart/oproc is synchronous (or very fast).
2094 	 */
2095 	if (tp->t_outq.c_cc <= hiwat) {
2096 		mutex_spin_exit(&tty_lock);
2097 		goto loop;
2098 	}
2099 	if (flag & IO_NDELAY) {
2100 		mutex_spin_exit(&tty_lock);
2101 		error = EWOULDBLOCK;
2102 		goto out;
2103 	}
2104 	error = ttysleep(tp, &tp->t_outq.c_cv, true, 0);
2105 	mutex_spin_exit(&tty_lock);
2106 	if (error)
2107 		goto out;
2108 	goto loop;
2109 }
2110 
2111 /*
2112  * Try to pull more output from the producer.  Return non-zero if
2113  * there is output ready to be sent.
2114  */
2115 bool
2116 ttypull(struct tty *tp)
2117 {
2118 
2119 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2120 
2121 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2122 		clwakeup(&tp->t_outq);
2123 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2124 	}
2125 	return tp->t_outq.c_cc != 0;
2126 }
2127 
2128 /*
2129  * Rubout one character from the rawq of tp
2130  * as cleanly as possible.
2131  * Called with tty lock held.
2132  */
2133 void
2134 ttyrub(int c, struct tty *tp)
2135 {
2136 	u_char	*cp;
2137 	int	savecol, tabc;
2138 
2139 	KASSERT(mutex_owned(&tty_lock));
2140 
2141 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2142 		return;
2143 	CLR(tp->t_lflag, FLUSHO);
2144 	if (ISSET(tp->t_lflag, ECHOE)) {
2145 		if (tp->t_rocount == 0) {
2146 			/*
2147 			 * Screwed by ttwrite; retype
2148 			 */
2149 			ttyretype(tp);
2150 			return;
2151 		}
2152 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2153 			ttyrubo(tp, 2);
2154 		else {
2155 			CLR(c, ~TTY_CHARMASK);
2156 			switch (CCLASS(c)) {
2157 			case ORDINARY:
2158 				ttyrubo(tp, 1);
2159 				break;
2160 			case BACKSPACE:
2161 			case CONTROL:
2162 			case NEWLINE:
2163 			case RETURN:
2164 			case VTAB:
2165 				if (ISSET(tp->t_lflag, ECHOCTL))
2166 					ttyrubo(tp, 2);
2167 				break;
2168 			case TAB:
2169 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2170 					ttyretype(tp);
2171 					return;
2172 				}
2173 				savecol = tp->t_column;
2174 				SET(tp->t_state, TS_CNTTB);
2175 				SET(tp->t_lflag, FLUSHO);
2176 				tp->t_column = tp->t_rocol;
2177 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2178 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2179 					ttyecho(tabc, tp);
2180 				CLR(tp->t_lflag, FLUSHO);
2181 				CLR(tp->t_state, TS_CNTTB);
2182 
2183 				/* savecol will now be length of the tab. */
2184 				savecol -= tp->t_column;
2185 				tp->t_column += savecol;
2186 				if (savecol > 8)
2187 					savecol = 8;	/* overflow screw */
2188 				while (--savecol >= 0)
2189 					(void)ttyoutput('\b', tp);
2190 				break;
2191 			default:			/* XXX */
2192 				(void)printf("ttyrub: would panic c = %d, "
2193 				    "val = %d\n", c, CCLASS(c));
2194 			}
2195 		}
2196 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2197 		if (!ISSET(tp->t_state, TS_ERASE)) {
2198 			SET(tp->t_state, TS_ERASE);
2199 			(void)ttyoutput('\\', tp);
2200 		}
2201 		ttyecho(c, tp);
2202 	} else
2203 		ttyecho(tp->t_cc[VERASE], tp);
2204 	--tp->t_rocount;
2205 }
2206 
2207 /*
2208  * Back over cnt characters, erasing them.
2209  * Called with tty lock held.
2210  */
2211 static void
2212 ttyrubo(struct tty *tp, int cnt)
2213 {
2214 
2215 	KASSERT(mutex_owned(&tty_lock));
2216 
2217 	while (cnt-- > 0) {
2218 		(void)ttyoutput('\b', tp);
2219 		(void)ttyoutput(' ', tp);
2220 		(void)ttyoutput('\b', tp);
2221 	}
2222 }
2223 
2224 /*
2225  * ttyretype --
2226  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2227  *	been checked.
2228  *
2229  * Called with tty lock held.
2230  */
2231 void
2232 ttyretype(struct tty *tp)
2233 {
2234 	u_char	*cp;
2235 	int	c;
2236 
2237 	KASSERT(mutex_owned(&tty_lock));
2238 
2239 	/* Echo the reprint character. */
2240 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2241 		ttyecho(tp->t_cc[VREPRINT], tp);
2242 
2243 	(void)ttyoutput('\n', tp);
2244 
2245 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2246 		ttyecho(c, tp);
2247 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2248 		ttyecho(c, tp);
2249 	CLR(tp->t_state, TS_ERASE);
2250 
2251 	tp->t_rocount = tp->t_rawq.c_cc;
2252 	tp->t_rocol = 0;
2253 }
2254 
2255 /*
2256  * Echo a typed character to the terminal.
2257  * Called with tty lock held.
2258  */
2259 static void
2260 ttyecho(int c, struct tty *tp)
2261 {
2262 
2263 	KASSERT(mutex_owned(&tty_lock));
2264 
2265 	if (!ISSET(tp->t_state, TS_CNTTB))
2266 		CLR(tp->t_lflag, FLUSHO);
2267 	if ((!ISSET(tp->t_lflag, ECHO) &&
2268 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2269 	    ISSET(tp->t_lflag, EXTPROC))
2270 		return;
2271 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2272 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2273 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2274 		(void)ttyoutput('^', tp);
2275 		CLR(c, ~TTY_CHARMASK);
2276 		if (c == 0177)
2277 			c = '?';
2278 		else
2279 			c += 'A' - 1;
2280 	}
2281 	(void)ttyoutput(c, tp);
2282 }
2283 
2284 /*
2285  * Wake up any readers on a tty.
2286  * Called with tty lock held.
2287  */
2288 void
2289 ttwakeup(struct tty *tp)
2290 {
2291 
2292 	KASSERT(mutex_owned(&tty_lock));
2293 
2294 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2295 	if (ISSET(tp->t_state, TS_ASYNC))
2296 		ttysig(tp, TTYSIG_PG2, SIGIO);
2297 #if 0
2298 	/* XXX tp->t_rawq.c_cv.cv_waiters dropping to zero early!? */
2299 	clwakeup(&tp->t_rawq);
2300 #else
2301 	cv_wakeup(&tp->t_rawq.c_cv);
2302 #endif
2303 }
2304 
2305 /*
2306  * Look up a code for a specified speed in a conversion table;
2307  * used by drivers to map software speed values to hardware parameters.
2308  */
2309 int
2310 ttspeedtab(int speed, const struct speedtab *table)
2311 {
2312 
2313 	for (; table->sp_speed != -1; table++)
2314 		if (table->sp_speed == speed)
2315 			return (table->sp_code);
2316 	return (-1);
2317 }
2318 
2319 /*
2320  * Set tty hi and low water marks.
2321  *
2322  * Try to arrange the dynamics so there's about one second
2323  * from hi to low water.
2324  */
2325 void
2326 ttsetwater(struct tty *tp)
2327 {
2328 	int	cps, x;
2329 
2330 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2331 
2332 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2333 
2334 	cps = tp->t_ospeed / 10;
2335 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2336 	x += cps;
2337 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2338 	tp->t_hiwat = roundup(x, CBSIZE);
2339 #undef	CLAMP
2340 }
2341 
2342 /*
2343  * Prepare report on state of foreground process group.
2344  * Call with proc_lock held.
2345  */
2346 void
2347 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2348 {
2349 	struct lwp	*l;
2350 	struct proc	*p, *pick = NULL;
2351 	struct timeval	utime, stime;
2352 	int		tmp;
2353 	fixpt_t		pctcpu = 0;
2354 	const char	*msg;
2355 	char		lmsg[100];
2356 	long		rss;
2357 
2358 	KASSERT(mutex_owned(proc_lock));
2359 
2360 	*buf = '\0';
2361 
2362 	if (tp->t_session == NULL)
2363 		msg = "not a controlling terminal\n";
2364 	else if (tp->t_pgrp == NULL)
2365 		msg = "no foreground process group\n";
2366 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2367 		msg = "empty foreground process group\n";
2368 	else {
2369 		/* Pick interesting process. */
2370 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2371 			struct proc *oldpick;
2372 
2373 			if (pick == NULL) {
2374 				pick = p;
2375 				continue;
2376 			}
2377 			if (pick->p_lock < p->p_lock) {
2378 				mutex_enter(pick->p_lock);
2379 				mutex_enter(p->p_lock);
2380 			} else if (pick->p_lock > p->p_lock) {
2381 				mutex_enter(p->p_lock);
2382 				mutex_enter(pick->p_lock);
2383 			} else
2384 				mutex_enter(p->p_lock);
2385 			oldpick = pick;
2386 			if (proc_compare(pick, p))
2387 				pick = p;
2388 			mutex_exit(p->p_lock);
2389 			if (p->p_lock != oldpick->p_lock)
2390 				mutex_exit(oldpick->p_lock);
2391 		}
2392 		if (fromsig &&
2393 		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2394 		    SA_NOKERNINFO))
2395 			return;
2396 		msg = NULL;
2397 	}
2398 
2399 	/* Print load average. */
2400 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2401 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2402 	strlcat(buf, lmsg, bufsz);
2403 
2404 	if (pick == NULL) {
2405 		strlcat(buf, msg, bufsz);
2406 		return;
2407 	}
2408 
2409 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2410 	    pick->p_pid);
2411 	strlcat(buf, lmsg, bufsz);
2412 
2413 	mutex_enter(pick->p_lock);
2414 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2415 		lwp_lock(l);
2416 		snprintf(lmsg, sizeof(lmsg), "%s%s",
2417 		    l->l_stat == LSONPROC ? "running" :
2418 		    l->l_stat == LSRUN ? "runnable" :
2419 		    l->l_wchan ? l->l_wmesg : "iowait",
2420 		    (LIST_NEXT(l, l_sibling) != NULL) ? " " : "] ");
2421 		lwp_unlock(l);
2422 		strlcat(buf, lmsg, bufsz);
2423 		pctcpu += l->l_pctcpu;
2424 	}
2425 	pctcpu += pick->p_pctcpu;
2426 	calcru(pick, &utime, &stime, NULL, NULL);
2427 	mutex_exit(pick->p_lock);
2428 
2429 	/* Round up and print user+system time, %CPU and RSS. */
2430 	utime.tv_usec += 5000;
2431 	if (utime.tv_usec >= 1000000) {
2432 		utime.tv_sec += 1;
2433 		utime.tv_usec -= 1000000;
2434 	}
2435 	stime.tv_usec += 5000;
2436 	if (stime.tv_usec >= 1000000) {
2437 		stime.tv_sec += 1;
2438 		stime.tv_usec -= 1000000;
2439 	}
2440 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2441 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2442 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2443 		rss = 0;
2444 	else
2445 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2446 
2447 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2448 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2449 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2450 	    tmp / 100, rss);
2451 	strlcat(buf, lmsg, bufsz);
2452 }
2453 
2454 /*
2455  * Print report on state of foreground process group.
2456  * Call with tty_lock held.
2457  */
2458 void
2459 ttyputinfo(struct tty *tp, char *buf)
2460 {
2461 
2462 	KASSERT(mutex_owned(&tty_lock));
2463 
2464 	if (ttycheckoutq_wlock(tp, 0) == 0)
2465 		return;
2466 	ttyprintf_nolock(tp, "%s\n", buf);
2467 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2468 }
2469 
2470 /*
2471  * Returns 1 if p2 is "better" than p1
2472  *
2473  * The algorithm for picking the "interesting" process is thus:
2474  *
2475  *	1) Only foreground processes are eligible - implied.
2476  *	2) Runnable processes are favored over anything else.  The runner
2477  *	   with the highest CPU utilization is picked (l_pctcpu).  Ties are
2478  *	   broken by picking the highest pid.
2479  *	3) The sleeper with the shortest sleep time is next.  With ties,
2480  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2481  *	4) Further ties are broken by picking the highest pid.
2482  */
2483 #define	ISRUN(p)	((p)->p_nrlwps > 0)
2484 #define	TESTAB(a, b)	((a)<<1 | (b))
2485 #define	ONLYA	2
2486 #define	ONLYB	1
2487 #define	BOTH	3
2488 
2489 static int
2490 proc_compare(struct proc *p1, struct proc *p2)
2491 {
2492 	lwp_t *l1, *l2;
2493 
2494 	KASSERT(mutex_owned(p1->p_lock));
2495 	KASSERT(mutex_owned(p2->p_lock));
2496 
2497 	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2498 		return (1);
2499 	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2500 		return (0);
2501 	/*
2502 	 * see if at least one of them is runnable
2503 	 */
2504 	switch (TESTAB(ISRUN(p1), ISRUN(p2))) {
2505 	case ONLYA:
2506 		return (0);
2507 	case ONLYB:
2508 		return (1);
2509 	case BOTH:
2510 		/*
2511 		 * tie - favor one with highest recent CPU utilization
2512 		 */
2513 		if (l2->l_pctcpu > l1->l_pctcpu)
2514 			return (1);
2515 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2516 	}
2517 	/*
2518  	 * weed out zombies
2519 	 */
2520 	switch (TESTAB(P_ZOMBIE(p1), P_ZOMBIE(p2))) {
2521 	case ONLYA:
2522 		return (1);
2523 	case ONLYB:
2524 		return (0);
2525 	case BOTH:
2526 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2527 	}
2528 	/*
2529 	 * pick the one with the smallest sleep time
2530 	 */
2531 	if (l2->l_slptime > l2->l_slptime)
2532 		return (0);
2533 	if (l2->l_slptime > l2->l_slptime)
2534 		return (1);
2535 	/*
2536 	 * favor one sleeping in a non-interruptible sleep
2537 	 */
2538 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2539 		return (1);
2540 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2541 		return (0);
2542 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2543 }
2544 
2545 /*
2546  * Output char to tty; console putchar style.
2547  * Can be called with tty lock held through kprintf() machinery..
2548  */
2549 int
2550 tputchar(int c, int flags, struct tty *tp)
2551 {
2552 	int r = 0;
2553 
2554 	if ((flags & NOLOCK) == 0)
2555 		mutex_spin_enter(&tty_lock);
2556 	if (!CONNECTED(tp)) {
2557 		r = -1;
2558 		goto out;
2559 	}
2560 	if (c == '\n')
2561 		(void)ttyoutput('\r', tp);
2562 	(void)ttyoutput(c, tp);
2563 	ttstart(tp);
2564 out:
2565 	if ((flags & NOLOCK) == 0)
2566 		mutex_spin_exit(&tty_lock);
2567 	return (r);
2568 }
2569 
2570 /*
2571  * Sleep on chan, returning ERESTART if tty changed while we napped and
2572  * returning any errors (e.g. EINTR/ETIMEDOUT) reported by tsleep.  If
2573  * the tty is revoked, restarting a pending call will redo validation done
2574  * at the start of the call.
2575  *
2576  * Must be called with the tty lock held.
2577  */
2578 int
2579 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch, int timo)
2580 {
2581 	int	error;
2582 	short	gen;
2583 
2584 	KASSERT(mutex_owned(&tty_lock));
2585 
2586 	gen = tp->t_gen;
2587 	if (catch)
2588 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2589 	else
2590 		error = cv_timedwait(cv, &tty_lock, timo);
2591 	if (error != 0)
2592 		return (error);
2593 	return (tp->t_gen == gen ? 0 : ERESTART);
2594 }
2595 
2596 /*
2597  * Attach a tty to the tty list.
2598  *
2599  * This should be called ONLY once per real tty (including pty's).
2600  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2601  * distinctly NOT usable as tty's, and thus should not be attached to
2602  * the ttylist.  This is why this call is not done from ttymalloc().
2603  *
2604  * Device drivers should attach tty's at a similar time that they are
2605  * ttymalloc()'ed, or, for the case of statically allocated struct tty's
2606  * either in the attach or (first) open routine.
2607  */
2608 void
2609 tty_attach(struct tty *tp)
2610 {
2611 
2612 	mutex_spin_enter(&tty_lock);
2613 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2614 	++tty_count;
2615 	mutex_spin_exit(&tty_lock);
2616 }
2617 
2618 /*
2619  * Remove a tty from the tty list.
2620  */
2621 void
2622 tty_detach(struct tty *tp)
2623 {
2624 
2625 	mutex_spin_enter(&tty_lock);
2626 	--tty_count;
2627 #ifdef DIAGNOSTIC
2628 	if (tty_count < 0)
2629 		panic("tty_detach: tty_count < 0");
2630 #endif
2631 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2632 	mutex_spin_exit(&tty_lock);
2633 }
2634 
2635 /*
2636  * Allocate a tty structure and its associated buffers.
2637  */
2638 struct tty *
2639 ttymalloc(void)
2640 {
2641 	struct tty	*tp;
2642 	int i;
2643 
2644 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2645 	callout_init(&tp->t_rstrt_ch, 0);
2646 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2647 	/* XXX: default to 1024 chars for now */
2648 	clalloc(&tp->t_rawq, 1024, 1);
2649 	clalloc(&tp->t_canq, 1024, 1);
2650 	/* output queue doesn't need quoting */
2651 	clalloc(&tp->t_outq, 1024, 0);
2652 	/* Set default line discipline. */
2653 	tp->t_linesw = ttyldisc_default();
2654 	selinit(&tp->t_rsel);
2655 	selinit(&tp->t_wsel);
2656 	for (i = 0; i < TTYSIG_COUNT; i++)
2657 		sigemptyset(&tp->t_sigs[i]);
2658 	return (tp);
2659 }
2660 
2661 /*
2662  * Free a tty structure and its buffers.
2663  *
2664  * Be sure to call tty_detach() for any tty that has been
2665  * tty_attach()ed.
2666  */
2667 void
2668 ttyfree(struct tty *tp)
2669 {
2670 	int i;
2671 
2672 	mutex_enter(proc_lock);
2673 	mutex_enter(&tty_lock);
2674 	for (i = 0; i < TTYSIG_COUNT; i++)
2675 		sigemptyset(&tp->t_sigs[i]);
2676 	if (tp->t_sigcount != 0)
2677 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2678 	mutex_exit(&tty_lock);
2679 	mutex_exit(proc_lock);
2680 
2681 	callout_halt(&tp->t_rstrt_ch, NULL);
2682 	callout_destroy(&tp->t_rstrt_ch);
2683 	ttyldisc_release(tp->t_linesw);
2684 	clfree(&tp->t_rawq);
2685 	clfree(&tp->t_canq);
2686 	clfree(&tp->t_outq);
2687 	seldestroy(&tp->t_rsel);
2688 	seldestroy(&tp->t_wsel);
2689 	kmem_free(tp, sizeof(*tp));
2690 }
2691 
2692 /*
2693  * ttyprintf_nolock: send a message to a specific tty, without locking.
2694  *
2695  * => should be used only by tty driver or anything that knows the
2696  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2697  *    use tprintf]
2698  */
2699 static void
2700 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2701 {
2702 	va_list ap;
2703 
2704 	/* No mutex needed; going to process TTY. */
2705 	va_start(ap, fmt);
2706 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2707 	va_end(ap);
2708 }
2709 
2710 /*
2711  * Initialize the tty subsystem.
2712  */
2713 void
2714 tty_init(void)
2715 {
2716 
2717 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2718 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2719 	KASSERT(tty_sigsih != NULL);
2720 }
2721 
2722 /*
2723  * Send a signal from a tty to its process group or session leader.
2724  * Handoff to the target is deferred to a soft interrupt.
2725  */
2726 void
2727 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2728 {
2729 	sigset_t *sp;
2730 
2731 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2732 
2733 	sp = &tp->t_sigs[st];
2734 	if (sigismember(sp, sig))
2735 		return;
2736 	sigaddset(sp, sig);
2737 	if (tp->t_sigcount++ == 0)
2738 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2739 	softint_schedule(tty_sigsih);
2740 }
2741 
2742 /*
2743  * Deliver deferred signals from ttys.  Note that the process groups
2744  * and sessions associated with the ttys may have changed from when
2745  * the signal was originally sent, but in practice it should not matter.
2746  * For signals produced as a result of a syscall, the soft interrupt
2747  * will fire before the syscall returns to the user.
2748  */
2749 static void
2750 ttysigintr(void *cookie)
2751 {
2752 	struct tty *tp;
2753 	enum ttysigtype st;
2754 	struct pgrp *pgrp;
2755 	struct session *sess;
2756 	int sig, lflag;
2757 	char infobuf[200];
2758 
2759 	mutex_enter(proc_lock);
2760 	mutex_spin_enter(&tty_lock);
2761 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2762 		KASSERT(tp->t_sigcount > 0);
2763 		for (st = 0; st < TTYSIG_COUNT; st++) {
2764 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2765 				break;
2766 		}
2767 		KASSERT(st < TTYSIG_COUNT);
2768 		sigdelset(&tp->t_sigs[st], sig);
2769 		if (--tp->t_sigcount == 0)
2770 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2771 		pgrp = tp->t_pgrp;
2772 		sess = tp->t_session;
2773 		lflag = tp->t_lflag;
2774 		if  (sig == SIGINFO) {
2775 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2776 				/* Via ioctl: ignore tty option. */
2777 				tp->t_state &= ~TS_SIGINFO;
2778 				lflag |= ISIG;
2779 			}
2780 			if (!ISSET(lflag, NOKERNINFO)) {
2781 				mutex_spin_exit(&tty_lock);
2782 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
2783 				mutex_spin_enter(&tty_lock);
2784 				ttyputinfo(tp, infobuf);
2785 			}
2786 			if (!ISSET(lflag, ISIG))
2787 				continue;
2788 		}
2789 		mutex_spin_exit(&tty_lock);
2790 		KASSERT(sig != 0);
2791 		switch (st) {
2792 		case TTYSIG_PG1:
2793 			if (pgrp != NULL)
2794 				pgsignal(pgrp, sig, 1);
2795 			break;
2796 		case TTYSIG_PG2:
2797 			if (pgrp != NULL)
2798 				pgsignal(pgrp, sig, sess != NULL);
2799 			break;
2800 		case TTYSIG_LEADER:
2801 			if (sess != NULL && sess->s_leader != NULL)
2802 				psignal(sess->s_leader, sig);
2803 			break;
2804 		default:
2805 			/* NOTREACHED */
2806 			break;
2807 		}
2808 		mutex_spin_enter(&tty_lock);
2809 	}
2810 	mutex_spin_exit(&tty_lock);
2811 	mutex_exit(proc_lock);
2812 }
2813