xref: /netbsd-src/sys/kern/tty.c (revision b1c86f5f087524e68db12794ee9c3e3da1ab17a0)
1 /*	$NetBSD: tty.c,v 1.238 2010/08/21 13:19:39 pgoyette Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 1982, 1986, 1990, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63  */
64 
65 #include <sys/cdefs.h>
66 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.238 2010/08/21 13:19:39 pgoyette Exp $");
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/ioctl.h>
71 #include <sys/proc.h>
72 #define	TTYDEFCHARS
73 #include <sys/tty.h>
74 #undef	TTYDEFCHARS
75 #include <sys/file.h>
76 #include <sys/conf.h>
77 #include <sys/dkstat.h>
78 #include <sys/uio.h>
79 #include <sys/kernel.h>
80 #include <sys/vnode.h>
81 #include <sys/syslog.h>
82 #include <sys/kmem.h>
83 #include <sys/signalvar.h>
84 #include <sys/resourcevar.h>
85 #include <sys/poll.h>
86 #include <sys/kprintf.h>
87 #include <sys/namei.h>
88 #include <sys/sysctl.h>
89 #include <sys/kauth.h>
90 #include <sys/intr.h>
91 #include <sys/ioctl_compat.h>
92 #include <sys/module.h>
93 
94 #include <machine/stdarg.h>
95 
96 static int	ttnread(struct tty *);
97 static void	ttyblock(struct tty *);
98 static void	ttyecho(int, struct tty *);
99 static void	ttyrubo(struct tty *, int);
100 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
101     __attribute__((__format__(__printf__,2,3)));
102 static int	proc_compare(struct proc *, struct proc *);
103 static void	ttysigintr(void *);
104 
105 /* Symbolic sleep message strings. */
106 const char	ttclos[] = "ttycls";
107 const char	ttopen[] = "ttyopn";
108 const char	ttybg[] = "ttybg";
109 const char	ttyin[] = "ttyin";
110 const char	ttyout[] = "ttyout";
111 
112 /*
113  * Used to determine whether we still have a connection.  This is true in
114  * one of 3 cases:
115  * 1) We have carrier.
116  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
117  * 3) We're using a flow control mechanism that overloads the carrier signal.
118  */
119 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
120 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 unsigned char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
196 static void *tty_sigsih;
197 
198 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
199 int tty_count;
200 kmutex_t tty_lock;
201 krwlock_t ttcompat_lock;
202 int (*ttcompatvec)(struct tty *, u_long, void *, int, struct lwp *);
203 
204 uint64_t tk_cancc;
205 uint64_t tk_nin;
206 uint64_t tk_nout;
207 uint64_t tk_rawcc;
208 
209 static kauth_listener_t tty_listener;
210 
211 static struct sysctllog *kern_tkstat_sysctllog;
212 
213 static void
214 sysctl_kern_tkstat_setup(void)
215 {
216 
217 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
218 		       CTLFLAG_PERMANENT,
219 		       CTLTYPE_NODE, "kern", NULL,
220 		       NULL, 0, NULL, 0,
221 		       CTL_KERN, CTL_EOL);
222 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
223 		       CTLFLAG_PERMANENT,
224 		       CTLTYPE_NODE, "tkstat",
225 		       SYSCTL_DESCR("Number of characters sent and and "
226 				    "received on ttys"),
227 		       NULL, 0, NULL, 0,
228 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
229 
230 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
231 		       CTLFLAG_PERMANENT,
232 		       CTLTYPE_QUAD, "nin",
233 		       SYSCTL_DESCR("Total number of tty input characters"),
234 		       NULL, 0, &tk_nin, 0,
235 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
236 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
237 		       CTLFLAG_PERMANENT,
238 		       CTLTYPE_QUAD, "nout",
239 		       SYSCTL_DESCR("Total number of tty output characters"),
240 		       NULL, 0, &tk_nout, 0,
241 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
242 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
243 		       CTLFLAG_PERMANENT,
244 		       CTLTYPE_QUAD, "cancc",
245 		       SYSCTL_DESCR("Number of canonical tty input characters"),
246 		       NULL, 0, &tk_cancc, 0,
247 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
248 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
249 		       CTLFLAG_PERMANENT,
250 		       CTLTYPE_QUAD, "rawcc",
251 		       SYSCTL_DESCR("Number of raw tty input characters"),
252 		       NULL, 0, &tk_rawcc, 0,
253 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
254 }
255 
256 int
257 ttyopen(struct tty *tp, int dialout, int nonblock)
258 {
259 	int	error;
260 
261 	error = 0;
262 
263 	mutex_spin_enter(&tty_lock);
264 
265 	if (dialout) {
266 		/*
267 		 * If the device is already open for non-dialout, fail.
268 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
269 		 * opens.
270 		 */
271 		if (ISSET(tp->t_state, TS_ISOPEN) &&
272 		    !ISSET(tp->t_state, TS_DIALOUT)) {
273 			error = EBUSY;
274 			goto out;
275 		}
276 		SET(tp->t_state, TS_DIALOUT);
277 	} else {
278 		if (!nonblock) {
279 			/*
280 			 * Wait for carrier.  Also wait for any dialout
281 			 * processes to close the tty first.
282 			 */
283 			while (ISSET(tp->t_state, TS_DIALOUT) ||
284 			       !CONNECTED(tp)) {
285 				tp->t_wopen++;
286 				error = ttysleep(tp, &tp->t_rawcv, true, 0);
287 				tp->t_wopen--;
288 				if (error)
289 					goto out;
290 			}
291 		} else {
292 			/*
293 			 * Don't allow a non-blocking non-dialout open if the
294 			 * device is already open for dialout.
295 			 */
296 			if (ISSET(tp->t_state, TS_DIALOUT)) {
297 				error = EBUSY;
298 				goto out;
299 			}
300 		}
301 	}
302 
303 out:
304 	mutex_spin_exit(&tty_lock);
305 	return (error);
306 }
307 
308 /*
309  * Initial open of tty, or (re)entry to standard tty line discipline.
310  */
311 int
312 ttylopen(dev_t device, struct tty *tp)
313 {
314 
315 	mutex_spin_enter(&tty_lock);
316 	tp->t_dev = device;
317 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
318 		SET(tp->t_state, TS_ISOPEN);
319 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
320 		tp->t_flags = 0;
321 	}
322 	mutex_spin_exit(&tty_lock);
323 	return (0);
324 }
325 
326 /*
327  * Handle close() on a tty line: flush and set to initial state,
328  * bumping generation number so that pending read/write calls
329  * can detect recycling of the tty.
330  */
331 int
332 ttyclose(struct tty *tp)
333 {
334 	extern struct tty *constty;	/* Temporary virtual console. */
335 	struct session *sess;
336 
337 	mutex_spin_enter(&tty_lock);
338 
339 	if (constty == tp)
340 		constty = NULL;
341 
342 	ttyflush(tp, FREAD | FWRITE);
343 
344 	tp->t_gen++;
345 	tp->t_pgrp = NULL;
346 	tp->t_state = 0;
347 	sess = tp->t_session;
348 	tp->t_session = NULL;
349 
350 	mutex_spin_exit(&tty_lock);
351 
352 	if (sess != NULL) {
353 		mutex_enter(proc_lock);
354 		/* Releases proc_lock. */
355 		proc_sessrele(sess);
356 	}
357 	return (0);
358 }
359 
360 #define	FLUSHQ(q) {							\
361 	if ((q)->c_cc)							\
362 		ndflush(q, (q)->c_cc);					\
363 }
364 
365 /*
366  * This macro is used in canonical mode input processing, where a read
367  * request shall not return unless a 'line delimiter' ('\n') or 'break'
368  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
369  * is an extension to the POSIX.1 defined set of special characters,
370  * recognize it only if IEXTEN is set in the set of local flags.
371  */
372 #define	TTBREAKC(c, lflg)						\
373 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
374 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
375 
376 
377 
378 /*
379  * ttyinput() helper.
380  * Call with the tty lock held.
381  */
382 /* XXX static */ int
383 ttyinput_wlock(int c, struct tty *tp)
384 {
385 	int	iflag, lflag, i, error;
386 	u_char	*cc;
387 
388 	KASSERT(mutex_owned(&tty_lock));
389 
390 	/*
391 	 * If input is pending take it first.
392 	 */
393 	lflag = tp->t_lflag;
394 	if (ISSET(lflag, PENDIN))
395 		ttypend(tp);
396 	/*
397 	 * Gather stats.
398 	 */
399 	if (ISSET(lflag, ICANON)) {
400 		++tk_cancc;
401 		++tp->t_cancc;
402 	} else {
403 		++tk_rawcc;
404 		++tp->t_rawcc;
405 	}
406 	++tk_nin;
407 
408 	cc = tp->t_cc;
409 
410 	/*
411 	 * Handle exceptional conditions (break, parity, framing).
412 	 */
413 	iflag = tp->t_iflag;
414 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
415 		CLR(c, TTY_ERRORMASK);
416 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
417 			if (ISSET(iflag, IGNBRK))
418 				return (0);
419 			else if (ISSET(iflag, BRKINT)) {
420 				ttyflush(tp, FREAD | FWRITE);
421 				ttysig(tp, TTYSIG_PG1, SIGINT);
422 				return (0);
423 			} else if (ISSET(iflag, PARMRK))
424 				goto parmrk;
425 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
426 		    ISSET(error, TTY_FE)) {
427 			if (ISSET(iflag, IGNPAR))
428 				return (0);
429 			else if (ISSET(iflag, PARMRK)) {
430  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
431 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
432 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
433 				return (0);
434 			} else
435 				c = 0;
436 		}
437 	} else if (c == 0377 &&
438 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
439 		/* "Escape" a valid character of '\377'. */
440 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
441 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
442 		goto endcase;
443 	}
444 
445 	/*
446 	 * In tandem mode, check high water mark.
447 	 */
448 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
449 		ttyblock(tp);
450 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
451 		CLR(c, 0x80);
452 	if (!ISSET(lflag, EXTPROC)) {
453 		/*
454 		 * Check for literal nexting very first
455 		 */
456 		if (ISSET(tp->t_state, TS_LNCH)) {
457 			SET(c, TTY_QUOTE);
458 			CLR(tp->t_state, TS_LNCH);
459 		}
460 		/*
461 		 * Scan for special characters.  This code
462 		 * is really just a big case statement with
463 		 * non-constant cases.  The bottom of the
464 		 * case statement is labeled ``endcase'', so goto
465 		 * it after a case match, or similar.
466 		 */
467 
468 		/*
469 		 * Control chars which aren't controlled
470 		 * by ICANON, ISIG, or IXON.
471 		 */
472 		if (ISSET(lflag, IEXTEN)) {
473 			if (CCEQ(cc[VLNEXT], c)) {
474 				if (ISSET(lflag, ECHO)) {
475 					if (ISSET(lflag, ECHOE)) {
476 						(void)ttyoutput('^', tp);
477 						(void)ttyoutput('\b', tp);
478 					} else
479 						ttyecho(c, tp);
480 				}
481 				SET(tp->t_state, TS_LNCH);
482 				goto endcase;
483 			}
484 			if (CCEQ(cc[VDISCARD], c)) {
485 				if (ISSET(lflag, FLUSHO))
486 					CLR(tp->t_lflag, FLUSHO);
487 				else {
488 					ttyflush(tp, FWRITE);
489 					ttyecho(c, tp);
490 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
491 						ttyretype(tp);
492 					SET(tp->t_lflag, FLUSHO);
493 				}
494 				goto startoutput;
495 			}
496 		}
497 		/*
498 		 * Signals.
499 		 */
500 		if (ISSET(lflag, ISIG)) {
501 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
502 				if (!ISSET(lflag, NOFLSH))
503 					ttyflush(tp, FREAD | FWRITE);
504 				ttyecho(c, tp);
505 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
506 				    SIGINT : SIGQUIT);
507 				goto endcase;
508 			}
509 			if (CCEQ(cc[VSUSP], c)) {
510 				if (!ISSET(lflag, NOFLSH))
511 					ttyflush(tp, FREAD);
512 				ttyecho(c, tp);
513 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
514 				goto endcase;
515 			}
516 		}
517 		/*
518 		 * Handle start/stop characters.
519 		 */
520 		if (ISSET(iflag, IXON)) {
521 			if (CCEQ(cc[VSTOP], c)) {
522 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
523 					SET(tp->t_state, TS_TTSTOP);
524 					cdev_stop(tp, 0);
525 					return (0);
526 				}
527 				if (!CCEQ(cc[VSTART], c))
528 					return (0);
529 				/*
530 				 * if VSTART == VSTOP then toggle
531 				 */
532 				goto endcase;
533 			}
534 			if (CCEQ(cc[VSTART], c))
535 				goto restartoutput;
536 		}
537 		/*
538 		 * IGNCR, ICRNL, & INLCR
539 		 */
540 		if (c == '\r') {
541 			if (ISSET(iflag, IGNCR))
542 				goto endcase;
543 			else if (ISSET(iflag, ICRNL))
544 				c = '\n';
545 		} else if (c == '\n' && ISSET(iflag, INLCR))
546 			c = '\r';
547 	}
548 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
549 		/*
550 		 * From here on down canonical mode character
551 		 * processing takes place.
552 		 */
553 		/*
554 		 * erase (^H / ^?)
555 		 */
556 		if (CCEQ(cc[VERASE], c)) {
557 			if (tp->t_rawq.c_cc)
558 				ttyrub(unputc(&tp->t_rawq), tp);
559 			goto endcase;
560 		}
561 		/*
562 		 * kill (^U)
563 		 */
564 		if (CCEQ(cc[VKILL], c)) {
565 			if (ISSET(lflag, ECHOKE) &&
566 			    tp->t_rawq.c_cc == tp->t_rocount &&
567 			    !ISSET(lflag, ECHOPRT))
568 				while (tp->t_rawq.c_cc)
569 					ttyrub(unputc(&tp->t_rawq), tp);
570 			else {
571 				ttyecho(c, tp);
572 				if (ISSET(lflag, ECHOK) ||
573 				    ISSET(lflag, ECHOKE))
574 					ttyecho('\n', tp);
575 				FLUSHQ(&tp->t_rawq);
576 				tp->t_rocount = 0;
577 			}
578 			CLR(tp->t_state, TS_LOCAL);
579 			goto endcase;
580 		}
581 		/*
582 		 * Extensions to the POSIX.1 GTI set of functions.
583 		 */
584 		if (ISSET(lflag, IEXTEN)) {
585 			/*
586 			 * word erase (^W)
587 			 */
588 			if (CCEQ(cc[VWERASE], c)) {
589 				int alt = ISSET(lflag, ALTWERASE);
590 				int ctype;
591 
592 				/*
593 				 * erase whitespace
594 				 */
595 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
596 				    c == '\t')
597 					ttyrub(c, tp);
598 				if (c == -1)
599 					goto endcase;
600 				/*
601 				 * erase last char of word and remember the
602 				 * next chars type (for ALTWERASE)
603 				 */
604 				ttyrub(c, tp);
605 				c = unputc(&tp->t_rawq);
606 				if (c == -1)
607 					goto endcase;
608 				if (c == ' ' || c == '\t') {
609 					(void)putc(c, &tp->t_rawq);
610 					goto endcase;
611 				}
612 				ctype = ISALPHA(c);
613 				/*
614 				 * erase rest of word
615 				 */
616 				do {
617 					ttyrub(c, tp);
618 					c = unputc(&tp->t_rawq);
619 					if (c == -1)
620 						goto endcase;
621 				} while (c != ' ' && c != '\t' &&
622 				    (alt == 0 || ISALPHA(c) == ctype));
623 				(void)putc(c, &tp->t_rawq);
624 				goto endcase;
625 			}
626 			/*
627 			 * reprint line (^R)
628 			 */
629 			if (CCEQ(cc[VREPRINT], c)) {
630 				ttyretype(tp);
631 				goto endcase;
632 			}
633 			/*
634 			 * ^T - kernel info and generate SIGINFO
635 			 */
636 			if (CCEQ(cc[VSTATUS], c)) {
637 				ttysig(tp, TTYSIG_PG1, SIGINFO);
638 				goto endcase;
639 			}
640 		}
641 	}
642 	/*
643 	 * Check for input buffer overflow
644 	 */
645 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
646 		if (ISSET(iflag, IMAXBEL)) {
647 			if (tp->t_outq.c_cc < tp->t_hiwat)
648 				(void)ttyoutput(CTRL('g'), tp);
649 		} else
650 			ttyflush(tp, FREAD | FWRITE);
651 		goto endcase;
652 	}
653 	/*
654 	 * Put data char in q for user and
655 	 * wakeup on seeing a line delimiter.
656 	 */
657 	if (putc(c, &tp->t_rawq) >= 0) {
658 		if (!ISSET(lflag, ICANON)) {
659 			ttwakeup(tp);
660 			ttyecho(c, tp);
661 			goto endcase;
662 		}
663 		if (TTBREAKC(c, lflag)) {
664 			tp->t_rocount = 0;
665 			catq(&tp->t_rawq, &tp->t_canq);
666 			ttwakeup(tp);
667 		} else if (tp->t_rocount++ == 0)
668 			tp->t_rocol = tp->t_column;
669 		if (ISSET(tp->t_state, TS_ERASE)) {
670 			/*
671 			 * end of prterase \.../
672 			 */
673 			CLR(tp->t_state, TS_ERASE);
674 			(void)ttyoutput('/', tp);
675 		}
676 		i = tp->t_column;
677 		ttyecho(c, tp);
678 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
679 			/*
680 			 * Place the cursor over the '^' of the ^D.
681 			 */
682 			i = min(2, tp->t_column - i);
683 			while (i > 0) {
684 				(void)ttyoutput('\b', tp);
685 				i--;
686 			}
687 		}
688 	}
689  endcase:
690 	/*
691 	 * IXANY means allow any character to restart output.
692 	 */
693 	if (ISSET(tp->t_state, TS_TTSTOP) &&
694 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
695 		return (0);
696 	}
697  restartoutput:
698 	CLR(tp->t_lflag, FLUSHO);
699 	CLR(tp->t_state, TS_TTSTOP);
700  startoutput:
701 	return (ttstart(tp));
702 }
703 
704 /*
705  * Process input of a single character received on a tty.
706  *
707  * XXX - this is a hack, all drivers must changed to acquire the
708  *	 lock before calling linesw->l_rint()
709  */
710 int
711 ttyinput(int c, struct tty *tp)
712 {
713 	int error;
714 
715 	/*
716 	 * Unless the receiver is enabled, drop incoming data.
717 	 */
718 	if (!ISSET(tp->t_cflag, CREAD))
719 		return (0);
720 
721 	mutex_spin_enter(&tty_lock);
722 	error = ttyinput_wlock(c, tp);
723 	mutex_spin_exit(&tty_lock);
724 
725 	return (error);
726 }
727 
728 /*
729  * Output a single character on a tty, doing output processing
730  * as needed (expanding tabs, newline processing, etc.).
731  * Returns < 0 if succeeds, otherwise returns char to resend.
732  * Must be recursive.
733  *
734  * Call with tty lock held.
735  */
736 int
737 ttyoutput(int c, struct tty *tp)
738 {
739 	long	oflag;
740 	int	col, notout;
741 
742 	KASSERT(mutex_owned(&tty_lock));
743 
744 	oflag = tp->t_oflag;
745 	if (!ISSET(oflag, OPOST)) {
746 		tk_nout++;
747 		tp->t_outcc++;
748 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
749 			return (c);
750 		return (-1);
751 	}
752 	/*
753 	 * Do tab expansion if OXTABS is set.  Special case if we do external
754 	 * processing, we don't do the tab expansion because we'll probably
755 	 * get it wrong.  If tab expansion needs to be done, let it happen
756 	 * externally.
757 	 */
758 	CLR(c, ~TTY_CHARMASK);
759 	if (c == '\t' &&
760 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
761 		c = 8 - (tp->t_column & 7);
762 		if (ISSET(tp->t_lflag, FLUSHO)) {
763 			notout = 0;
764 		} else {
765 			notout = b_to_q("        ", c, &tp->t_outq);
766 			c -= notout;
767 			tk_nout += c;
768 			tp->t_outcc += c;
769 		}
770 		tp->t_column += c;
771 		return (notout ? '\t' : -1);
772 	}
773 	if (c == CEOT && ISSET(oflag, ONOEOT))
774 		return (-1);
775 
776 	/*
777 	 * Newline translation: if ONLCR is set,
778 	 * translate newline into "\r\n".
779 	 */
780 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
781 		tk_nout++;
782 		tp->t_outcc++;
783 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
784 			return (c);
785 	}
786 	/* If OCRNL is set, translate "\r" into "\n". */
787 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
788 		c = '\n';
789 	/* If ONOCR is set, don't transmit CRs when on column 0. */
790 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
791 		return (-1);
792 
793 	tk_nout++;
794 	tp->t_outcc++;
795 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
796 		return (c);
797 
798 	col = tp->t_column;
799 	switch (CCLASS(c)) {
800 	case BACKSPACE:
801 		if (col > 0)
802 			--col;
803 		break;
804 	case CONTROL:
805 		break;
806 	case NEWLINE:
807 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
808 			col = 0;
809 		break;
810 	case RETURN:
811 		col = 0;
812 		break;
813 	case ORDINARY:
814 		++col;
815 		break;
816 	case TAB:
817 		col = (col + 8) & ~7;
818 		break;
819 	}
820 	tp->t_column = col;
821 	return (-1);
822 }
823 
824 /*
825  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
826  * has been called to do discipline-specific functions and/or reject any
827  * of these ioctl commands.
828  */
829 /* ARGSUSED */
830 int
831 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
832 {
833 	extern struct tty *constty;	/* Temporary virtual console. */
834 	struct proc *p = l ? l->l_proc : NULL;
835 	struct linesw	*lp;
836 	int		s, error;
837 	struct nameidata nd;
838 	char		infobuf[200];
839 
840 	/* If the ioctl involves modification, hang if in the background. */
841 	switch (cmd) {
842 	case  TIOCFLUSH:
843 	case  TIOCDRAIN:
844 	case  TIOCSBRK:
845 	case  TIOCCBRK:
846 	case  TIOCSTART:
847 	case  TIOCSETA:
848 	case  TIOCSETD:
849 	case  TIOCSLINED:
850 	case  TIOCSETAF:
851 	case  TIOCSETAW:
852 #ifdef notdef
853 	case  TIOCSPGRP:
854 	case  FIOSETOWN:
855 #endif
856 	case  TIOCSTAT:
857 	case  TIOCSTI:
858 	case  TIOCSWINSZ:
859 	case  TIOCLBIC:
860 	case  TIOCLBIS:
861 	case  TIOCLSET:
862 	case  TIOCSETC:
863 	case OTIOCSETD:
864 	case  TIOCSETN:
865 	case  TIOCSETP:
866 	case  TIOCSLTC:
867 		mutex_spin_enter(&tty_lock);
868 		while (isbackground(curproc, tp) &&
869 		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
870 		    !sigismasked(l, SIGTTOU)) {
871 			mutex_spin_exit(&tty_lock);
872 
873 			mutex_enter(proc_lock);
874 			pgsignal(p->p_pgrp, SIGTTOU, 1);
875 			mutex_exit(proc_lock);
876 
877 			mutex_spin_enter(&tty_lock);
878 			error = ttysleep(tp, &lbolt, true, 0);
879 			if (error) {
880 				mutex_spin_exit(&tty_lock);
881 				return (error);
882 			}
883 		}
884 		mutex_spin_exit(&tty_lock);
885 		break;
886 	}
887 
888 	switch (cmd) {			/* Process the ioctl. */
889 	case FIOASYNC:			/* set/clear async i/o */
890 		mutex_spin_enter(&tty_lock);
891 		if (*(int *)data)
892 			SET(tp->t_state, TS_ASYNC);
893 		else
894 			CLR(tp->t_state, TS_ASYNC);
895 		mutex_spin_exit(&tty_lock);
896 		break;
897 	case FIONBIO:			/* set/clear non-blocking i/o */
898 		break;			/* XXX: delete. */
899 	case FIONREAD:			/* get # bytes to read */
900 		mutex_spin_enter(&tty_lock);
901 		*(int *)data = ttnread(tp);
902 		mutex_spin_exit(&tty_lock);
903 		break;
904 	case FIONWRITE:			/* get # bytes to written & unsent */
905 		mutex_spin_enter(&tty_lock);
906 		*(int *)data = tp->t_outq.c_cc;
907 		mutex_spin_exit(&tty_lock);
908 		break;
909 	case FIONSPACE:			/* get # bytes to written & unsent */
910 		mutex_spin_enter(&tty_lock);
911 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
912 		mutex_spin_exit(&tty_lock);
913 		break;
914 	case TIOCEXCL:			/* set exclusive use of tty */
915 		mutex_spin_enter(&tty_lock);
916 		SET(tp->t_state, TS_XCLUDE);
917 		mutex_spin_exit(&tty_lock);
918 		break;
919 	case TIOCFLUSH: {		/* flush buffers */
920 		int flags = *(int *)data;
921 
922 		if (flags == 0)
923 			flags = FREAD | FWRITE;
924 		else
925 			flags &= FREAD | FWRITE;
926 		mutex_spin_enter(&tty_lock);
927 		ttyflush(tp, flags);
928 		mutex_spin_exit(&tty_lock);
929 		break;
930 	}
931 	case TIOCCONS:			/* become virtual console */
932 		if (*(int *)data) {
933 			if (constty && constty != tp &&
934 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
935 			    (TS_CARR_ON | TS_ISOPEN))
936 				return EBUSY;
937 
938 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
939 			    "/dev/console");
940 			if ((error = namei(&nd)) != 0)
941 				return error;
942 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
943 			vput(nd.ni_vp);
944 			if (error)
945 				return error;
946 
947 			constty = tp;
948 		} else if (tp == constty)
949 			constty = NULL;
950 		break;
951 	case TIOCDRAIN:			/* wait till output drained */
952 		if ((error = ttywait(tp)) != 0)
953 			return (error);
954 		break;
955 	case TIOCGETA: {		/* get termios struct */
956 		struct termios *t = (struct termios *)data;
957 
958 		memcpy(t, &tp->t_termios, sizeof(struct termios));
959 		break;
960 	}
961 	case TIOCGETD:			/* get line discipline (old) */
962 		*(int *)data = tp->t_linesw->l_no;
963 		break;
964 	case TIOCGLINED:		/* get line discipline (new) */
965 		(void)strncpy((char *)data, tp->t_linesw->l_name,
966 		    TTLINEDNAMELEN - 1);
967 		break;
968 	case TIOCGWINSZ:		/* get window size */
969 		*(struct winsize *)data = tp->t_winsize;
970 		break;
971 	case FIOGETOWN:
972 		mutex_enter(proc_lock);
973 		if (tp->t_session != NULL && !isctty(p, tp)) {
974 			mutex_exit(proc_lock);
975 			return (ENOTTY);
976 		}
977 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
978 		mutex_exit(proc_lock);
979 		break;
980 	case TIOCGPGRP:			/* get pgrp of tty */
981 		mutex_enter(proc_lock);
982 		if (!isctty(p, tp)) {
983 			mutex_exit(proc_lock);
984 			return (ENOTTY);
985 		}
986 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
987 		mutex_exit(proc_lock);
988 		break;
989 	case TIOCGSID:			/* get sid of tty */
990 		mutex_enter(proc_lock);
991 		if (!isctty(p, tp)) {
992 			mutex_exit(proc_lock);
993 			return (ENOTTY);
994 		}
995 		*(int *)data = tp->t_session->s_sid;
996 		mutex_exit(proc_lock);
997 		break;
998 #ifdef TIOCHPCL
999 	case TIOCHPCL:			/* hang up on last close */
1000 		mutex_spin_enter(&tty_lock);
1001 		SET(tp->t_cflag, HUPCL);
1002 		mutex_spin_exit(&tty_lock);
1003 		break;
1004 #endif
1005 	case TIOCNXCL:			/* reset exclusive use of tty */
1006 		mutex_spin_enter(&tty_lock);
1007 		CLR(tp->t_state, TS_XCLUDE);
1008 		mutex_spin_exit(&tty_lock);
1009 		break;
1010 	case TIOCOUTQ:			/* output queue size */
1011 		*(int *)data = tp->t_outq.c_cc;
1012 		break;
1013 	case TIOCSETA:			/* set termios struct */
1014 	case TIOCSETAW:			/* drain output, set */
1015 	case TIOCSETAF: {		/* drn out, fls in, set */
1016 		struct termios *t = (struct termios *)data;
1017 
1018 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1019 			if ((error = ttywait(tp)) != 0)
1020 				return (error);
1021 
1022 			if (cmd == TIOCSETAF) {
1023 				mutex_spin_enter(&tty_lock);
1024 				ttyflush(tp, FREAD);
1025 				mutex_spin_exit(&tty_lock);
1026 			}
1027 		}
1028 
1029 		s = spltty();
1030 		/*
1031 		 * XXXSMP - some drivers call back on us from t_param(), so
1032 		 *	    don't take the tty spin lock here.
1033 		 *	    require t_param() to unlock upon callback?
1034 		 */
1035 		/* wanted here: mutex_spin_enter(&tty_lock); */
1036 		if (!ISSET(t->c_cflag, CIGNORE)) {
1037 			/*
1038 			 * Set device hardware.
1039 			 */
1040 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1041 				/* wanted here: mutex_spin_exit(&tty_lock); */
1042 				splx(s);
1043 				return (error);
1044 			} else {
1045 				tp->t_cflag = t->c_cflag;
1046 				tp->t_ispeed = t->c_ispeed;
1047 				tp->t_ospeed = t->c_ospeed;
1048 				if (t->c_ospeed == 0)
1049 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1050 			}
1051 			ttsetwater(tp);
1052 		}
1053 
1054 		/* delayed lock acquiring */
1055 		mutex_spin_enter(&tty_lock);
1056 		if (cmd != TIOCSETAF) {
1057 			if (ISSET(t->c_lflag, ICANON) !=
1058 			    ISSET(tp->t_lflag, ICANON)) {
1059 				if (ISSET(t->c_lflag, ICANON)) {
1060 					SET(tp->t_lflag, PENDIN);
1061 					ttwakeup(tp);
1062 				} else {
1063 					struct clist tq;
1064 
1065 					catq(&tp->t_rawq, &tp->t_canq);
1066 					tq = tp->t_rawq;
1067 					tp->t_rawq = tp->t_canq;
1068 					tp->t_canq = tq;
1069 					CLR(tp->t_lflag, PENDIN);
1070 				}
1071 			}
1072 		}
1073 		tp->t_iflag = t->c_iflag;
1074 		tp->t_oflag = t->c_oflag;
1075 		/*
1076 		 * Make the EXTPROC bit read only.
1077 		 */
1078 		if (ISSET(tp->t_lflag, EXTPROC))
1079 			SET(t->c_lflag, EXTPROC);
1080 		else
1081 			CLR(t->c_lflag, EXTPROC);
1082 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1083 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1084 		mutex_spin_exit(&tty_lock);
1085 		splx(s);
1086 		break;
1087 	}
1088 	case TIOCSETD:			/* set line discipline (old) */
1089 		lp = ttyldisc_lookup_bynum(*(int *)data);
1090 		goto setldisc;
1091 
1092 	case TIOCSLINED: {		/* set line discipline (new) */
1093 		char *name = (char *)data;
1094 		dev_t device;
1095 
1096 		/* Null terminate to prevent buffer overflow */
1097 		name[TTLINEDNAMELEN - 1] = '\0';
1098 		lp = ttyldisc_lookup(name);
1099  setldisc:
1100 		if (lp == NULL)
1101 			return (ENXIO);
1102 
1103 		if (lp != tp->t_linesw) {
1104 			device = tp->t_dev;
1105 			s = spltty();
1106 			(*tp->t_linesw->l_close)(tp, flag);
1107 			error = (*lp->l_open)(device, tp);
1108 			if (error) {
1109 				(void)(*tp->t_linesw->l_open)(device, tp);
1110 				splx(s);
1111 				ttyldisc_release(lp);
1112 				return (error);
1113 			}
1114 			ttyldisc_release(tp->t_linesw);
1115 			tp->t_linesw = lp;
1116 			splx(s);
1117 		} else {
1118 			/* Drop extra reference. */
1119 			ttyldisc_release(lp);
1120 		}
1121 		break;
1122 	}
1123 	case TIOCSTART:			/* start output, like ^Q */
1124 		mutex_spin_enter(&tty_lock);
1125 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1126 		    ISSET(tp->t_lflag, FLUSHO)) {
1127 			CLR(tp->t_lflag, FLUSHO);
1128 			CLR(tp->t_state, TS_TTSTOP);
1129 			ttstart(tp);
1130 		}
1131 		mutex_spin_exit(&tty_lock);
1132 		break;
1133 	case TIOCSTI:			/* simulate terminal input */
1134 		if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_STI,
1135 		    tp) != 0) {
1136 			if (!ISSET(flag, FREAD))
1137 				return (EPERM);
1138 			if (!isctty(p, tp))
1139 				return (EACCES);
1140 		}
1141 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1142 		break;
1143 	case TIOCSTOP:			/* stop output, like ^S */
1144 	{
1145 		mutex_spin_enter(&tty_lock);
1146 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1147 			SET(tp->t_state, TS_TTSTOP);
1148 			cdev_stop(tp, 0);
1149 		}
1150 		mutex_spin_exit(&tty_lock);
1151 		break;
1152 	}
1153 	case TIOCSCTTY:			/* become controlling tty */
1154 		mutex_enter(proc_lock);
1155 		mutex_spin_enter(&tty_lock);
1156 
1157 		/* Session ctty vnode pointer set in vnode layer. */
1158 		if (!SESS_LEADER(p) ||
1159 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1160 		    (tp->t_session != p->p_session))) {
1161 			mutex_spin_exit(&tty_lock);
1162 			mutex_exit(proc_lock);
1163 			return (EPERM);
1164 		}
1165 
1166 		/*
1167 		 * `p_session' acquires a reference.
1168 		 * But note that if `t_session' is set at this point,
1169 		 * it must equal `p_session', in which case the session
1170 		 * already has the correct reference count.
1171 		 */
1172 		if (tp->t_session == NULL) {
1173 			proc_sesshold(p->p_session);
1174 		}
1175 		tp->t_session = p->p_session;
1176 		tp->t_pgrp = p->p_pgrp;
1177 		p->p_session->s_ttyp = tp;
1178 		p->p_lflag |= PL_CONTROLT;
1179 		mutex_spin_exit(&tty_lock);
1180 		mutex_exit(proc_lock);
1181 		break;
1182 	case FIOSETOWN: {		/* set pgrp of tty */
1183 		pid_t pgid = *(int *)data;
1184 		struct pgrp *pgrp;
1185 
1186 		mutex_enter(proc_lock);
1187 		if (tp->t_session != NULL && !isctty(p, tp)) {
1188 			mutex_exit(proc_lock);
1189 			return (ENOTTY);
1190 		}
1191 
1192 		if (pgid < 0) {
1193 			pgrp = pgrp_find(-pgid);
1194 			if (pgrp == NULL) {
1195 				mutex_exit(proc_lock);
1196 				return (EINVAL);
1197 			}
1198 		} else {
1199 			struct proc *p1;
1200 			p1 = proc_find(pgid);
1201 			if (!p1) {
1202 				mutex_exit(proc_lock);
1203 				return (ESRCH);
1204 			}
1205 			pgrp = p1->p_pgrp;
1206 		}
1207 
1208 		if (pgrp->pg_session != p->p_session) {
1209 			mutex_exit(proc_lock);
1210 			return (EPERM);
1211 		}
1212 		mutex_spin_enter(&tty_lock);
1213 		tp->t_pgrp = pgrp;
1214 		mutex_spin_exit(&tty_lock);
1215 		mutex_exit(proc_lock);
1216 		break;
1217 	}
1218 	case TIOCSPGRP: {		/* set pgrp of tty */
1219 		struct pgrp *pgrp;
1220 
1221 		mutex_enter(proc_lock);
1222 		if (!isctty(p, tp)) {
1223 			mutex_exit(proc_lock);
1224 			return (ENOTTY);
1225 		}
1226 		pgrp = pgrp_find(*(pid_t *)data);
1227 		if (pgrp == NULL) {
1228 			mutex_exit(proc_lock);
1229 			return (EINVAL);
1230 		}
1231 		if (pgrp->pg_session != p->p_session) {
1232 			mutex_exit(proc_lock);
1233 			return (EPERM);
1234 		}
1235 		mutex_spin_enter(&tty_lock);
1236 		tp->t_pgrp = pgrp;
1237 		mutex_spin_exit(&tty_lock);
1238 		mutex_exit(proc_lock);
1239 		break;
1240 	}
1241 	case TIOCSTAT:			/* get load avg stats */
1242 		mutex_enter(proc_lock);
1243 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1244 		mutex_exit(proc_lock);
1245 
1246 		mutex_spin_enter(&tty_lock);
1247 		ttyputinfo(tp, infobuf);
1248 		mutex_spin_exit(&tty_lock);
1249 		break;
1250 	case TIOCSWINSZ:		/* set window size */
1251 		mutex_spin_enter(&tty_lock);
1252 		if (memcmp((void *)&tp->t_winsize, data,
1253 		    sizeof(struct winsize))) {
1254 			tp->t_winsize = *(struct winsize *)data;
1255 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1256 		}
1257 		mutex_spin_exit(&tty_lock);
1258 		break;
1259 	default:
1260 		/* We may have to load the compat module for this. */
1261 		for (;;) {
1262 			rw_enter(&ttcompat_lock, RW_READER);
1263 			if (ttcompatvec != NULL) {
1264 				break;
1265 			}
1266 			rw_exit(&ttcompat_lock);
1267 			(void)module_autoload("compat", MODULE_CLASS_ANY);
1268 			if (ttcompatvec == NULL) {
1269 				return EPASSTHROUGH;
1270 			}
1271 		}
1272 		error = (*ttcompatvec)(tp, cmd, data, flag, l);
1273 		rw_exit(&ttcompat_lock);
1274 		return error;
1275 	}
1276 	return (0);
1277 }
1278 
1279 int
1280 ttpoll(struct tty *tp, int events, struct lwp *l)
1281 {
1282 	int	revents;
1283 
1284 	revents = 0;
1285 	mutex_spin_enter(&tty_lock);
1286 	if (events & (POLLIN | POLLRDNORM))
1287 		if (ttnread(tp) > 0)
1288 			revents |= events & (POLLIN | POLLRDNORM);
1289 
1290 	if (events & (POLLOUT | POLLWRNORM))
1291 		if (tp->t_outq.c_cc <= tp->t_lowat)
1292 			revents |= events & (POLLOUT | POLLWRNORM);
1293 
1294 	if (events & POLLHUP)
1295 		if (!CONNECTED(tp))
1296 			revents |= POLLHUP;
1297 
1298 	if (revents == 0) {
1299 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1300 			selrecord(l, &tp->t_rsel);
1301 
1302 		if (events & (POLLOUT | POLLWRNORM))
1303 			selrecord(l, &tp->t_wsel);
1304 	}
1305 
1306 	mutex_spin_exit(&tty_lock);
1307 
1308 	return (revents);
1309 }
1310 
1311 static void
1312 filt_ttyrdetach(struct knote *kn)
1313 {
1314 	struct tty	*tp;
1315 
1316 	tp = kn->kn_hook;
1317 	mutex_spin_enter(&tty_lock);
1318 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1319 	mutex_spin_exit(&tty_lock);
1320 }
1321 
1322 static int
1323 filt_ttyread(struct knote *kn, long hint)
1324 {
1325 	struct tty	*tp;
1326 
1327 	tp = kn->kn_hook;
1328 	if ((hint & NOTE_SUBMIT) == 0)
1329 		mutex_spin_enter(&tty_lock);
1330 	kn->kn_data = ttnread(tp);
1331 	if ((hint & NOTE_SUBMIT) == 0)
1332 		mutex_spin_exit(&tty_lock);
1333 	return (kn->kn_data > 0);
1334 }
1335 
1336 static void
1337 filt_ttywdetach(struct knote *kn)
1338 {
1339 	struct tty	*tp;
1340 
1341 	tp = kn->kn_hook;
1342 	mutex_spin_enter(&tty_lock);
1343 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1344 	mutex_spin_exit(&tty_lock);
1345 }
1346 
1347 static int
1348 filt_ttywrite(struct knote *kn, long hint)
1349 {
1350 	struct tty	*tp;
1351 	int		canwrite;
1352 
1353 	tp = kn->kn_hook;
1354 	if ((hint & NOTE_SUBMIT) == 0)
1355 		mutex_spin_enter(&tty_lock);
1356 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1357 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1358 	if ((hint & NOTE_SUBMIT) == 0)
1359 		mutex_spin_exit(&tty_lock);
1360 	return (canwrite);
1361 }
1362 
1363 static const struct filterops ttyread_filtops =
1364 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1365 static const struct filterops ttywrite_filtops =
1366 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1367 
1368 int
1369 ttykqfilter(dev_t dev, struct knote *kn)
1370 {
1371 	struct tty	*tp;
1372 	struct klist	*klist;
1373 
1374 	if ((tp = cdev_tty(dev)) == NULL)
1375 		return (ENXIO);
1376 
1377 	switch (kn->kn_filter) {
1378 	case EVFILT_READ:
1379 		klist = &tp->t_rsel.sel_klist;
1380 		kn->kn_fop = &ttyread_filtops;
1381 		break;
1382 	case EVFILT_WRITE:
1383 		klist = &tp->t_wsel.sel_klist;
1384 		kn->kn_fop = &ttywrite_filtops;
1385 		break;
1386 	default:
1387 		return EINVAL;
1388 	}
1389 
1390 	kn->kn_hook = tp;
1391 
1392 	mutex_spin_enter(&tty_lock);
1393 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1394 	mutex_spin_exit(&tty_lock);
1395 
1396 	return (0);
1397 }
1398 
1399 /*
1400  * Find the number of chars ready to be read from this tty.
1401  * Call with the tty lock held.
1402  */
1403 static int
1404 ttnread(struct tty *tp)
1405 {
1406 	int	nread;
1407 
1408 	KASSERT(mutex_owned(&tty_lock));
1409 
1410 	if (ISSET(tp->t_lflag, PENDIN))
1411 		ttypend(tp);
1412 	nread = tp->t_canq.c_cc;
1413 	if (!ISSET(tp->t_lflag, ICANON)) {
1414 		nread += tp->t_rawq.c_cc;
1415 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1416 			nread = 0;
1417 	}
1418 	return (nread);
1419 }
1420 
1421 /*
1422  * Wait for output to drain.
1423  */
1424 int
1425 ttywait(struct tty *tp)
1426 {
1427 	int	error;
1428 
1429 	error = 0;
1430 
1431 	mutex_spin_enter(&tty_lock);
1432 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1433 	    CONNECTED(tp) && tp->t_oproc) {
1434 		(*tp->t_oproc)(tp);
1435 		error = ttysleep(tp, &tp->t_outcv, true, 0);
1436 		if (error)
1437 			break;
1438 	}
1439 	mutex_spin_exit(&tty_lock);
1440 
1441 	return (error);
1442 }
1443 
1444 /*
1445  * Flush if successfully wait.
1446  */
1447 int
1448 ttywflush(struct tty *tp)
1449 {
1450 	int	error;
1451 
1452 	if ((error = ttywait(tp)) == 0) {
1453 		mutex_spin_enter(&tty_lock);
1454 		ttyflush(tp, FREAD);
1455 		mutex_spin_exit(&tty_lock);
1456 	}
1457 	return (error);
1458 }
1459 
1460 /*
1461  * Flush tty read and/or write queues, notifying anyone waiting.
1462  * Call with the tty lock held.
1463  */
1464 void
1465 ttyflush(struct tty *tp, int rw)
1466 {
1467 
1468 	KASSERT(mutex_owned(&tty_lock));
1469 
1470 	if (rw & FREAD) {
1471 		FLUSHQ(&tp->t_canq);
1472 		FLUSHQ(&tp->t_rawq);
1473 		tp->t_rocount = 0;
1474 		tp->t_rocol = 0;
1475 		CLR(tp->t_state, TS_LOCAL);
1476 		ttwakeup(tp);
1477 	}
1478 	if (rw & FWRITE) {
1479 		CLR(tp->t_state, TS_TTSTOP);
1480 		cdev_stop(tp, rw);
1481 		FLUSHQ(&tp->t_outq);
1482 		cv_broadcast(&tp->t_outcv);
1483 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1484 	}
1485 }
1486 
1487 /*
1488  * Copy in the default termios characters.
1489  */
1490 void
1491 ttychars(struct tty *tp)
1492 {
1493 
1494 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1495 }
1496 
1497 /*
1498  * Send stop character on input overflow.
1499  * Call with the tty lock held.
1500  */
1501 static void
1502 ttyblock(struct tty *tp)
1503 {
1504 	int	total;
1505 
1506 	KASSERT(mutex_owned(&tty_lock));
1507 
1508 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1509 	if (tp->t_rawq.c_cc > TTYHOG) {
1510 		ttyflush(tp, FREAD | FWRITE);
1511 		CLR(tp->t_state, TS_TBLOCK);
1512 	}
1513 	/*
1514 	 * Block further input iff: current input > threshold
1515 	 * AND input is available to user program.
1516 	 */
1517 	if (total >= TTYHOG / 2 &&
1518 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1519 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1520 		if (ISSET(tp->t_iflag, IXOFF) &&
1521 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1522 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1523 			SET(tp->t_state, TS_TBLOCK);
1524 			ttstart(tp);
1525 		}
1526 		/* Try to block remote output via hardware flow control. */
1527 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1528 		    (*tp->t_hwiflow)(tp, 1) != 0)
1529 			SET(tp->t_state, TS_TBLOCK);
1530 	}
1531 }
1532 
1533 /*
1534  * Delayed line discipline output
1535  */
1536 void
1537 ttrstrt(void *tp_arg)
1538 {
1539 	struct tty	*tp;
1540 
1541 #ifdef DIAGNOSTIC
1542 	if (tp_arg == NULL)
1543 		panic("ttrstrt");
1544 #endif
1545 	tp = tp_arg;
1546 	mutex_spin_enter(&tty_lock);
1547 
1548 	CLR(tp->t_state, TS_TIMEOUT);
1549 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1550 
1551 	mutex_spin_exit(&tty_lock);
1552 }
1553 
1554 /*
1555  * start a line discipline
1556  * Always call with tty lock held?
1557  */
1558 int
1559 ttstart(struct tty *tp)
1560 {
1561 
1562 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1563 		(*tp->t_oproc)(tp);
1564 	return (0);
1565 }
1566 
1567 /*
1568  * "close" a line discipline
1569  */
1570 int
1571 ttylclose(struct tty *tp, int flag)
1572 {
1573 
1574 	if (flag & FNONBLOCK) {
1575 		mutex_spin_enter(&tty_lock);
1576 		ttyflush(tp, FREAD | FWRITE);
1577 		mutex_spin_exit(&tty_lock);
1578 	} else
1579 		ttywflush(tp);
1580 	return (0);
1581 }
1582 
1583 /*
1584  * Handle modem control transition on a tty.
1585  * Flag indicates new state of carrier.
1586  * Returns 0 if the line should be turned off, otherwise 1.
1587  */
1588 int
1589 ttymodem(struct tty *tp, int flag)
1590 {
1591 
1592 	mutex_spin_enter(&tty_lock);
1593 	if (flag == 0) {
1594 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1595 			/*
1596 			 * Lost carrier.
1597 			 */
1598 			CLR(tp->t_state, TS_CARR_ON);
1599 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1600 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1601 				ttyflush(tp, FREAD | FWRITE);
1602 				mutex_spin_exit(&tty_lock);
1603 				return (0);
1604 			}
1605 		}
1606 	} else {
1607 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1608 			/*
1609 			 * Carrier now on.
1610 			 */
1611 			SET(tp->t_state, TS_CARR_ON);
1612 			ttwakeup(tp);
1613 		}
1614 	}
1615 	mutex_spin_exit(&tty_lock);
1616 
1617 	return (1);
1618 }
1619 
1620 /*
1621  * Default modem control routine (for other line disciplines).
1622  * Return argument flag, to turn off device on carrier drop.
1623  */
1624 int
1625 nullmodem(struct tty *tp, int flag)
1626 {
1627 
1628 	mutex_spin_enter(&tty_lock);
1629 	if (flag)
1630 		SET(tp->t_state, TS_CARR_ON);
1631 	else {
1632 		CLR(tp->t_state, TS_CARR_ON);
1633 		if (!CONNECTED(tp)) {
1634 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1635 			mutex_spin_exit(&tty_lock);
1636 			return (0);
1637 		}
1638 	}
1639 	mutex_spin_exit(&tty_lock);
1640 
1641 	return (1);
1642 }
1643 
1644 /*
1645  * Reinput pending characters after state switch.
1646  */
1647 void
1648 ttypend(struct tty *tp)
1649 {
1650 	struct clist	tq;
1651 	int		c;
1652 
1653 	KASSERT(mutex_owned(&tty_lock));
1654 
1655 	CLR(tp->t_lflag, PENDIN);
1656 	SET(tp->t_state, TS_TYPEN);
1657 	tq = tp->t_rawq;
1658 	tp->t_rawq.c_cc = 0;
1659 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1660 	while ((c = getc(&tq)) >= 0)
1661 		ttyinput_wlock(c, tp);
1662 	CLR(tp->t_state, TS_TYPEN);
1663 }
1664 
1665 /*
1666  * Process a read call on a tty device.
1667  */
1668 int
1669 ttread(struct tty *tp, struct uio *uio, int flag)
1670 {
1671 	struct clist	*qp;
1672 	u_char		*cc;
1673 	struct proc	*p;
1674 	int		c, first, error, has_stime, last_cc;
1675 	long		lflag, slp;
1676 	struct timeval	now, stime;
1677 
1678 	if (uio->uio_resid == 0)
1679 		return 0;
1680 
1681 	stime.tv_usec = 0;	/* XXX gcc */
1682 	stime.tv_sec = 0;	/* XXX gcc */
1683 
1684 	cc = tp->t_cc;
1685 	p = curproc;
1686 	error = 0;
1687 	has_stime = 0;
1688 	last_cc = 0;
1689 	slp = 0;
1690 
1691  loop:
1692 	mutex_spin_enter(&tty_lock);
1693 	lflag = tp->t_lflag;
1694 	/*
1695 	 * take pending input first
1696 	 */
1697 	if (ISSET(lflag, PENDIN))
1698 		ttypend(tp);
1699 
1700 	/*
1701 	 * Hang process if it's in the background.
1702 	 */
1703 	if (isbackground(p, tp)) {
1704 		if (sigismasked(curlwp, SIGTTIN) ||
1705 		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1706 			mutex_spin_exit(&tty_lock);
1707 			return (EIO);
1708 		}
1709 		mutex_spin_exit(&tty_lock);
1710 
1711 		mutex_enter(proc_lock);
1712 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1713 		mutex_exit(proc_lock);
1714 
1715 		mutex_spin_enter(&tty_lock);
1716 		error = ttysleep(tp, &lbolt, true, 0);
1717 		mutex_spin_exit(&tty_lock);
1718 		if (error)
1719 			return (error);
1720 		goto loop;
1721 	}
1722 
1723 	if (!ISSET(lflag, ICANON)) {
1724 		int m = cc[VMIN];
1725 		long t = cc[VTIME];
1726 
1727 		qp = &tp->t_rawq;
1728 		/*
1729 		 * Check each of the four combinations.
1730 		 * (m > 0 && t == 0) is the normal read case.
1731 		 * It should be fairly efficient, so we check that and its
1732 		 * companion case (m == 0 && t == 0) first.
1733 		 * For the other two cases, we compute the target sleep time
1734 		 * into slp.
1735 		 */
1736 		if (t == 0) {
1737 			if (qp->c_cc < m)
1738 				goto sleep;
1739 			goto read;
1740 		}
1741 		t *= hz;		/* time in deca-ticks */
1742 /*
1743  * Time difference in deca-ticks, split division to avoid numeric overflow.
1744  * Ok for hz < ~200kHz
1745  */
1746 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1747 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1748 		if (m > 0) {
1749 			if (qp->c_cc <= 0)
1750 				goto sleep;
1751 			if (qp->c_cc >= m)
1752 				goto read;
1753 			if (!has_stime) {
1754 				/* first character, start timer */
1755 				has_stime = 1;
1756 				getmicrotime(&stime);
1757 				slp = t;
1758 			} else if (qp->c_cc > last_cc) {
1759 				/* got a character, restart timer */
1760 				getmicrotime(&stime);
1761 				slp = t;
1762 			} else {
1763 				/* nothing, check expiration */
1764 				getmicrotime(&now);
1765 				slp = t - diff(now, stime);
1766 			}
1767 		} else {	/* m == 0 */
1768 			if (qp->c_cc > 0)
1769 				goto read;
1770 			if (!has_stime) {
1771 				has_stime = 1;
1772 				getmicrotime(&stime);
1773 				slp = t;
1774 			} else {
1775 				getmicrotime(&now);
1776 				slp = t - diff(now, stime);
1777 			}
1778 		}
1779 		last_cc = qp->c_cc;
1780 #undef diff
1781 		if (slp > 0) {
1782 			/*
1783 			 * Convert deca-ticks back to ticks.
1784 			 * Rounding down may make us wake up just short
1785 			 * of the target, so we round up.
1786 			 * Maybe we should do 'slp/10 + 1' because the
1787 			 * first tick maybe almost immediate.
1788 			 * However it is more useful for a program that sets
1789 			 * VTIME=10 to wakeup every second not every 1.01
1790 			 * seconds (if hz=100).
1791 			 */
1792 			slp = (slp + 9)/ 10;
1793 			goto sleep;
1794 		}
1795 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1796 		int	carrier;
1797 
1798  sleep:
1799 		/*
1800 		 * If there is no input, sleep on rawq
1801 		 * awaiting hardware receipt and notification.
1802 		 * If we have data, we don't need to check for carrier.
1803 		 */
1804 		carrier = CONNECTED(tp);
1805 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1806 			mutex_spin_exit(&tty_lock);
1807 			return (0);	/* EOF */
1808 		}
1809 		if (!has_stime || slp <= 0) {
1810 			if (flag & IO_NDELAY) {
1811 				mutex_spin_exit(&tty_lock);
1812 				return (EWOULDBLOCK);
1813 			}
1814 		}
1815 		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1816 		mutex_spin_exit(&tty_lock);
1817 		/* VMIN == 0: any quantity read satisfies */
1818 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1819 			return (0);
1820 		if (error && error != EWOULDBLOCK)
1821 			return (error);
1822 		goto loop;
1823 	}
1824  read:
1825 	mutex_spin_exit(&tty_lock);
1826 
1827 	/*
1828 	 * Input present, check for input mapping and processing.
1829 	 */
1830 	first = 1;
1831 	while ((c = getc(qp)) >= 0) {
1832 		/*
1833 		 * delayed suspend (^Y)
1834 		 */
1835 		if (CCEQ(cc[VDSUSP], c) &&
1836 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
1837 			mutex_spin_enter(&tty_lock);
1838 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
1839 			if (first) {
1840 				error = ttysleep(tp, &lbolt, true, 0);
1841 				mutex_spin_exit(&tty_lock);
1842 				if (error)
1843 					break;
1844 				goto loop;
1845 			} else
1846 				mutex_spin_exit(&tty_lock);
1847 			break;
1848 		}
1849 		/*
1850 		 * Interpret EOF only in canonical mode.
1851 		 */
1852 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1853 			break;
1854 		/*
1855 		 * Give user character.
1856 		 */
1857  		error = ureadc(c, uio);
1858 		if (error)
1859 			break;
1860  		if (uio->uio_resid == 0)
1861 			break;
1862 		/*
1863 		 * In canonical mode check for a "break character"
1864 		 * marking the end of a "line of input".
1865 		 */
1866 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1867 			break;
1868 		first = 0;
1869 	}
1870 	/*
1871 	 * Look to unblock output now that (presumably)
1872 	 * the input queue has gone down.
1873 	 */
1874 	mutex_spin_enter(&tty_lock);
1875 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
1876 		if (ISSET(tp->t_iflag, IXOFF) &&
1877 		    cc[VSTART] != _POSIX_VDISABLE &&
1878 		    putc(cc[VSTART], &tp->t_outq) == 0) {
1879 			CLR(tp->t_state, TS_TBLOCK);
1880 			ttstart(tp);
1881 		}
1882 		/* Try to unblock remote output via hardware flow control. */
1883 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1884 		    (*tp->t_hwiflow)(tp, 0) != 0)
1885 			CLR(tp->t_state, TS_TBLOCK);
1886 	}
1887 	mutex_spin_exit(&tty_lock);
1888 
1889 	return (error);
1890 }
1891 
1892 /*
1893  * Check the output queue on tp for space for a kernel message (from uprintf
1894  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1895  * lose messages due to normal flow control, but don't let the tty run amok.
1896  * Sleeps here are not interruptible, but we return prematurely if new signals
1897  * arrive.
1898  * Call with tty lock held.
1899  */
1900 static int
1901 ttycheckoutq_wlock(struct tty *tp, int wait)
1902 {
1903 	int	hiwat, error;
1904 
1905 	KASSERT(mutex_owned(&tty_lock));
1906 
1907 	hiwat = tp->t_hiwat;
1908 	if (tp->t_outq.c_cc > hiwat + 200)
1909 		while (tp->t_outq.c_cc > hiwat) {
1910 			ttstart(tp);
1911 			if (wait == 0)
1912 				return (0);
1913 			error = ttysleep(tp, &tp->t_outcv, true, hz);
1914 			if (error == EINTR)
1915 				wait = 0;
1916 		}
1917 
1918 	return (1);
1919 }
1920 
1921 int
1922 ttycheckoutq(struct tty *tp, int wait)
1923 {
1924 	int	r;
1925 
1926 	mutex_spin_enter(&tty_lock);
1927 	r = ttycheckoutq_wlock(tp, wait);
1928 	mutex_spin_exit(&tty_lock);
1929 
1930 	return (r);
1931 }
1932 
1933 /*
1934  * Process a write call on a tty device.
1935  */
1936 int
1937 ttwrite(struct tty *tp, struct uio *uio, int flag)
1938 {
1939 	u_char		*cp;
1940 	struct proc	*p;
1941 	int		cc, ce, i, hiwat, error;
1942 	u_char		obuf[OBUFSIZ];
1943 
1944 	cp = NULL;
1945 	hiwat = tp->t_hiwat;
1946 	error = 0;
1947 	cc = 0;
1948  loop:
1949 	mutex_spin_enter(&tty_lock);
1950 	if (!CONNECTED(tp)) {
1951 		if (ISSET(tp->t_state, TS_ISOPEN)) {
1952 			mutex_spin_exit(&tty_lock);
1953 			return (EIO);
1954 		} else if (flag & IO_NDELAY) {
1955 			mutex_spin_exit(&tty_lock);
1956 			error = EWOULDBLOCK;
1957 			goto out;
1958 		} else {
1959 			/* Sleep awaiting carrier. */
1960 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
1961 			mutex_spin_exit(&tty_lock);
1962 			if (error)
1963 				goto out;
1964 			goto loop;
1965 		}
1966 	}
1967 
1968 	/*
1969 	 * Hang the process if it's in the background.
1970 	 */
1971 	p = curproc;
1972 	if (isbackground(p, tp) &&
1973 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
1974 	    !sigismasked(curlwp, SIGTTOU)) {
1975 		if (p->p_pgrp->pg_jobc == 0) {
1976 			error = EIO;
1977 			mutex_spin_exit(&tty_lock);
1978 			goto out;
1979 		}
1980 		mutex_spin_exit(&tty_lock);
1981 
1982 		mutex_enter(proc_lock);
1983 		pgsignal(p->p_pgrp, SIGTTOU, 1);
1984 		mutex_exit(proc_lock);
1985 
1986 		mutex_spin_enter(&tty_lock);
1987 		error = ttysleep(tp, &lbolt, true, 0);
1988 		mutex_spin_exit(&tty_lock);
1989 		if (error)
1990 			goto out;
1991 		goto loop;
1992 	}
1993 	mutex_spin_exit(&tty_lock);
1994 
1995 	/*
1996 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
1997 	 * output translation.  Keep track of high water mark, sleep on
1998 	 * overflow awaiting device aid in acquiring new space.
1999 	 */
2000 	while (uio->uio_resid > 0 || cc > 0) {
2001 		if (ISSET(tp->t_lflag, FLUSHO)) {
2002 			uio->uio_resid = 0;
2003 			return (0);
2004 		}
2005 		if (tp->t_outq.c_cc > hiwat)
2006 			goto ovhiwat;
2007 		/*
2008 		 * Grab a hunk of data from the user, unless we have some
2009 		 * leftover from last time.
2010 		 */
2011 		if (cc == 0) {
2012 			cc = min(uio->uio_resid, OBUFSIZ);
2013 			cp = obuf;
2014 			error = uiomove(cp, cc, uio);
2015 			if (error) {
2016 				cc = 0;
2017 				goto out;
2018 			}
2019 		}
2020 		/*
2021 		 * If nothing fancy need be done, grab those characters we
2022 		 * can handle without any of ttyoutput's processing and
2023 		 * just transfer them to the output q.  For those chars
2024 		 * which require special processing (as indicated by the
2025 		 * bits in char_type), call ttyoutput.  After processing
2026 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2027 		 * immediately.
2028 		 */
2029 		mutex_spin_enter(&tty_lock);
2030 		while (cc > 0) {
2031 			if (!ISSET(tp->t_oflag, OPOST))
2032 				ce = cc;
2033 			else {
2034 				ce = cc - scanc((u_int)cc, cp, char_type,
2035 				    CCLASSMASK);
2036 				/*
2037 				 * If ce is zero, then we're processing
2038 				 * a special character through ttyoutput.
2039 				 */
2040 				if (ce == 0) {
2041 					tp->t_rocount = 0;
2042 					if (ttyoutput(*cp, tp) >= 0) {
2043 						/* out of space */
2044 						mutex_spin_exit(&tty_lock);
2045 						goto overfull;
2046 					}
2047 					cp++;
2048 					cc--;
2049 					if (ISSET(tp->t_lflag, FLUSHO) ||
2050 					    tp->t_outq.c_cc > hiwat) {
2051 						mutex_spin_exit(&tty_lock);
2052 						goto ovhiwat;
2053 					}
2054 					continue;
2055 				}
2056 			}
2057 			/*
2058 			 * A bunch of normal characters have been found.
2059 			 * Transfer them en masse to the output queue and
2060 			 * continue processing at the top of the loop.
2061 			 * If there are any further characters in this
2062 			 * <= OBUFSIZ chunk, the first should be a character
2063 			 * requiring special handling by ttyoutput.
2064 			 */
2065 			tp->t_rocount = 0;
2066 			i = b_to_q(cp, ce, &tp->t_outq);
2067 			ce -= i;
2068 			tp->t_column += ce;
2069 			cp += ce, cc -= ce, tk_nout += ce;
2070 			tp->t_outcc += ce;
2071 			if (i > 0) {
2072 				/* out of space */
2073 				mutex_spin_exit(&tty_lock);
2074 				goto overfull;
2075 			}
2076 			if (ISSET(tp->t_lflag, FLUSHO) ||
2077 			    tp->t_outq.c_cc > hiwat)
2078 				break;
2079 		}
2080 		ttstart(tp);
2081 		mutex_spin_exit(&tty_lock);
2082 	}
2083 
2084  out:
2085 	/*
2086 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2087 	 * offset and iov pointers have moved forward, but it doesn't matter
2088 	 * (the call will either return short or restart with a new uio).
2089 	 */
2090 	uio->uio_resid += cc;
2091 	return (error);
2092 
2093  overfull:
2094 	/*
2095 	 * Since we are using ring buffers, if we can't insert any more into
2096 	 * the output queue, we can assume the ring is full and that someone
2097 	 * forgot to set the high water mark correctly.  We set it and then
2098 	 * proceed as normal.
2099 	 */
2100 	hiwat = tp->t_outq.c_cc - 1;
2101 
2102  ovhiwat:
2103 	mutex_spin_enter(&tty_lock);
2104 	ttstart(tp);
2105 	/*
2106 	 * This can only occur if FLUSHO is set in t_lflag,
2107 	 * or if ttstart/oproc is synchronous (or very fast).
2108 	 */
2109 	if (tp->t_outq.c_cc <= hiwat) {
2110 		mutex_spin_exit(&tty_lock);
2111 		goto loop;
2112 	}
2113 	if (flag & IO_NDELAY) {
2114 		mutex_spin_exit(&tty_lock);
2115 		error = EWOULDBLOCK;
2116 		goto out;
2117 	}
2118 	error = ttysleep(tp, &tp->t_outcv, true, 0);
2119 	mutex_spin_exit(&tty_lock);
2120 	if (error)
2121 		goto out;
2122 	goto loop;
2123 }
2124 
2125 /*
2126  * Try to pull more output from the producer.  Return non-zero if
2127  * there is output ready to be sent.
2128  */
2129 bool
2130 ttypull(struct tty *tp)
2131 {
2132 
2133 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2134 
2135 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2136 		cv_broadcast(&tp->t_outcv);
2137 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2138 	}
2139 	return tp->t_outq.c_cc != 0;
2140 }
2141 
2142 /*
2143  * Rubout one character from the rawq of tp
2144  * as cleanly as possible.
2145  * Called with tty lock held.
2146  */
2147 void
2148 ttyrub(int c, struct tty *tp)
2149 {
2150 	u_char	*cp;
2151 	int	savecol, tabc;
2152 
2153 	KASSERT(mutex_owned(&tty_lock));
2154 
2155 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2156 		return;
2157 	CLR(tp->t_lflag, FLUSHO);
2158 	if (ISSET(tp->t_lflag, ECHOE)) {
2159 		if (tp->t_rocount == 0) {
2160 			/*
2161 			 * Screwed by ttwrite; retype
2162 			 */
2163 			ttyretype(tp);
2164 			return;
2165 		}
2166 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2167 			ttyrubo(tp, 2);
2168 		else {
2169 			CLR(c, ~TTY_CHARMASK);
2170 			switch (CCLASS(c)) {
2171 			case ORDINARY:
2172 				ttyrubo(tp, 1);
2173 				break;
2174 			case BACKSPACE:
2175 			case CONTROL:
2176 			case NEWLINE:
2177 			case RETURN:
2178 			case VTAB:
2179 				if (ISSET(tp->t_lflag, ECHOCTL))
2180 					ttyrubo(tp, 2);
2181 				break;
2182 			case TAB:
2183 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2184 					ttyretype(tp);
2185 					return;
2186 				}
2187 				savecol = tp->t_column;
2188 				SET(tp->t_state, TS_CNTTB);
2189 				SET(tp->t_lflag, FLUSHO);
2190 				tp->t_column = tp->t_rocol;
2191 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2192 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2193 					ttyecho(tabc, tp);
2194 				CLR(tp->t_lflag, FLUSHO);
2195 				CLR(tp->t_state, TS_CNTTB);
2196 
2197 				/* savecol will now be length of the tab. */
2198 				savecol -= tp->t_column;
2199 				tp->t_column += savecol;
2200 				if (savecol > 8)
2201 					savecol = 8;	/* overflow screw */
2202 				while (--savecol >= 0)
2203 					(void)ttyoutput('\b', tp);
2204 				break;
2205 			default:			/* XXX */
2206 				(void)printf("ttyrub: would panic c = %d, "
2207 				    "val = %d\n", c, CCLASS(c));
2208 			}
2209 		}
2210 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2211 		if (!ISSET(tp->t_state, TS_ERASE)) {
2212 			SET(tp->t_state, TS_ERASE);
2213 			(void)ttyoutput('\\', tp);
2214 		}
2215 		ttyecho(c, tp);
2216 	} else
2217 		ttyecho(tp->t_cc[VERASE], tp);
2218 	--tp->t_rocount;
2219 }
2220 
2221 /*
2222  * Back over cnt characters, erasing them.
2223  * Called with tty lock held.
2224  */
2225 static void
2226 ttyrubo(struct tty *tp, int cnt)
2227 {
2228 
2229 	KASSERT(mutex_owned(&tty_lock));
2230 
2231 	while (cnt-- > 0) {
2232 		(void)ttyoutput('\b', tp);
2233 		(void)ttyoutput(' ', tp);
2234 		(void)ttyoutput('\b', tp);
2235 	}
2236 }
2237 
2238 /*
2239  * ttyretype --
2240  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2241  *	been checked.
2242  *
2243  * Called with tty lock held.
2244  */
2245 void
2246 ttyretype(struct tty *tp)
2247 {
2248 	u_char	*cp;
2249 	int	c;
2250 
2251 	KASSERT(mutex_owned(&tty_lock));
2252 
2253 	/* Echo the reprint character. */
2254 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2255 		ttyecho(tp->t_cc[VREPRINT], tp);
2256 
2257 	(void)ttyoutput('\n', tp);
2258 
2259 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2260 		ttyecho(c, tp);
2261 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2262 		ttyecho(c, tp);
2263 	CLR(tp->t_state, TS_ERASE);
2264 
2265 	tp->t_rocount = tp->t_rawq.c_cc;
2266 	tp->t_rocol = 0;
2267 }
2268 
2269 /*
2270  * Echo a typed character to the terminal.
2271  * Called with tty lock held.
2272  */
2273 static void
2274 ttyecho(int c, struct tty *tp)
2275 {
2276 
2277 	KASSERT(mutex_owned(&tty_lock));
2278 
2279 	if (!ISSET(tp->t_state, TS_CNTTB))
2280 		CLR(tp->t_lflag, FLUSHO);
2281 	if ((!ISSET(tp->t_lflag, ECHO) &&
2282 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2283 	    ISSET(tp->t_lflag, EXTPROC))
2284 		return;
2285 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2286 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2287 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2288 		(void)ttyoutput('^', tp);
2289 		CLR(c, ~TTY_CHARMASK);
2290 		if (c == 0177)
2291 			c = '?';
2292 		else
2293 			c += 'A' - 1;
2294 	}
2295 	(void)ttyoutput(c, tp);
2296 }
2297 
2298 /*
2299  * Wake up any readers on a tty.
2300  * Called with tty lock held.
2301  */
2302 void
2303 ttwakeup(struct tty *tp)
2304 {
2305 
2306 	KASSERT(mutex_owned(&tty_lock));
2307 
2308 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2309 	if (ISSET(tp->t_state, TS_ASYNC))
2310 		ttysig(tp, TTYSIG_PG2, SIGIO);
2311 	cv_broadcast(&tp->t_rawcv);
2312 }
2313 
2314 /*
2315  * Look up a code for a specified speed in a conversion table;
2316  * used by drivers to map software speed values to hardware parameters.
2317  */
2318 int
2319 ttspeedtab(int speed, const struct speedtab *table)
2320 {
2321 
2322 	for (; table->sp_speed != -1; table++)
2323 		if (table->sp_speed == speed)
2324 			return (table->sp_code);
2325 	return (-1);
2326 }
2327 
2328 /*
2329  * Set tty hi and low water marks.
2330  *
2331  * Try to arrange the dynamics so there's about one second
2332  * from hi to low water.
2333  */
2334 void
2335 ttsetwater(struct tty *tp)
2336 {
2337 	int	cps, x;
2338 
2339 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2340 
2341 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2342 
2343 	cps = tp->t_ospeed / 10;
2344 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2345 	x += cps;
2346 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2347 	tp->t_hiwat = roundup(x, CBSIZE);
2348 #undef	CLAMP
2349 }
2350 
2351 /*
2352  * Prepare report on state of foreground process group.
2353  * Call with proc_lock held.
2354  */
2355 void
2356 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2357 {
2358 	struct lwp	*l;
2359 	struct proc	*p, *pick = NULL;
2360 	struct timeval	utime, stime;
2361 	int		tmp;
2362 	fixpt_t		pctcpu = 0;
2363 	const char	*msg;
2364 	char		lmsg[100];
2365 	long		rss;
2366 
2367 	KASSERT(mutex_owned(proc_lock));
2368 
2369 	*buf = '\0';
2370 
2371 	if (tp->t_session == NULL)
2372 		msg = "not a controlling terminal\n";
2373 	else if (tp->t_pgrp == NULL)
2374 		msg = "no foreground process group\n";
2375 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2376 		msg = "empty foreground process group\n";
2377 	else {
2378 		/* Pick interesting process. */
2379 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2380 			struct proc *oldpick;
2381 
2382 			if (pick == NULL) {
2383 				pick = p;
2384 				continue;
2385 			}
2386 			if (pick->p_lock < p->p_lock) {
2387 				mutex_enter(pick->p_lock);
2388 				mutex_enter(p->p_lock);
2389 			} else if (pick->p_lock > p->p_lock) {
2390 				mutex_enter(p->p_lock);
2391 				mutex_enter(pick->p_lock);
2392 			} else
2393 				mutex_enter(p->p_lock);
2394 			oldpick = pick;
2395 			if (proc_compare(pick, p))
2396 				pick = p;
2397 			mutex_exit(p->p_lock);
2398 			if (p->p_lock != oldpick->p_lock)
2399 				mutex_exit(oldpick->p_lock);
2400 		}
2401 		if (fromsig &&
2402 		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2403 		    SA_NOKERNINFO))
2404 			return;
2405 		msg = NULL;
2406 	}
2407 
2408 	/* Print load average. */
2409 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2410 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2411 	strlcat(buf, lmsg, bufsz);
2412 
2413 	if (pick == NULL) {
2414 		strlcat(buf, msg, bufsz);
2415 		return;
2416 	}
2417 
2418 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2419 	    pick->p_pid);
2420 	strlcat(buf, lmsg, bufsz);
2421 
2422 	mutex_enter(pick->p_lock);
2423 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2424 		lwp_lock(l);
2425 		snprintf(lmsg, sizeof(lmsg), "%s%s",
2426 		    l->l_stat == LSONPROC ? "running" :
2427 		    l->l_stat == LSRUN ? "runnable" :
2428 		    l->l_wchan ? l->l_wmesg : "iowait",
2429 		    (LIST_NEXT(l, l_sibling) != NULL) ? " " : "] ");
2430 		lwp_unlock(l);
2431 		strlcat(buf, lmsg, bufsz);
2432 		pctcpu += l->l_pctcpu;
2433 	}
2434 	pctcpu += pick->p_pctcpu;
2435 	calcru(pick, &utime, &stime, NULL, NULL);
2436 	mutex_exit(pick->p_lock);
2437 
2438 	/* Round up and print user+system time, %CPU and RSS. */
2439 	utime.tv_usec += 5000;
2440 	if (utime.tv_usec >= 1000000) {
2441 		utime.tv_sec += 1;
2442 		utime.tv_usec -= 1000000;
2443 	}
2444 	stime.tv_usec += 5000;
2445 	if (stime.tv_usec >= 1000000) {
2446 		stime.tv_sec += 1;
2447 		stime.tv_usec -= 1000000;
2448 	}
2449 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2450 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2451 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2452 		rss = 0;
2453 	else
2454 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2455 
2456 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2457 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2458 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2459 	    tmp / 100, rss);
2460 	strlcat(buf, lmsg, bufsz);
2461 }
2462 
2463 /*
2464  * Print report on state of foreground process group.
2465  * Call with tty_lock held.
2466  */
2467 void
2468 ttyputinfo(struct tty *tp, char *buf)
2469 {
2470 
2471 	KASSERT(mutex_owned(&tty_lock));
2472 
2473 	if (ttycheckoutq_wlock(tp, 0) == 0)
2474 		return;
2475 	ttyprintf_nolock(tp, "%s\n", buf);
2476 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2477 }
2478 
2479 /*
2480  * Returns 1 if p2 is "better" than p1
2481  *
2482  * The algorithm for picking the "interesting" process is thus:
2483  *
2484  *	1) Only foreground processes are eligible - implied.
2485  *	2) Runnable processes are favored over anything else.  The runner
2486  *	   with the highest CPU utilization is picked (l_pctcpu).  Ties are
2487  *	   broken by picking the highest pid.
2488  *	3) The sleeper with the shortest sleep time is next.  With ties,
2489  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2490  *	4) Further ties are broken by picking the highest pid.
2491  */
2492 #define	ISRUN(p)	((p)->p_nrlwps > 0)
2493 #define	TESTAB(a, b)	((a)<<1 | (b))
2494 #define	ONLYA	2
2495 #define	ONLYB	1
2496 #define	BOTH	3
2497 
2498 static int
2499 proc_compare(struct proc *p1, struct proc *p2)
2500 {
2501 	lwp_t *l1, *l2;
2502 
2503 	KASSERT(mutex_owned(p1->p_lock));
2504 	KASSERT(mutex_owned(p2->p_lock));
2505 
2506 	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2507 		return (1);
2508 	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2509 		return (0);
2510 	/*
2511 	 * see if at least one of them is runnable
2512 	 */
2513 	switch (TESTAB(ISRUN(p1), ISRUN(p2))) {
2514 	case ONLYA:
2515 		return (0);
2516 	case ONLYB:
2517 		return (1);
2518 	case BOTH:
2519 		/*
2520 		 * tie - favor one with highest recent CPU utilization
2521 		 */
2522 		if (l2->l_pctcpu > l1->l_pctcpu)
2523 			return (1);
2524 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2525 	}
2526 	/*
2527  	 * weed out zombies
2528 	 */
2529 	switch (TESTAB(P_ZOMBIE(p1), P_ZOMBIE(p2))) {
2530 	case ONLYA:
2531 		return (1);
2532 	case ONLYB:
2533 		return (0);
2534 	case BOTH:
2535 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2536 	}
2537 	/*
2538 	 * pick the one with the smallest sleep time
2539 	 */
2540 	if (l2->l_slptime > l2->l_slptime)
2541 		return (0);
2542 	if (l2->l_slptime > l2->l_slptime)
2543 		return (1);
2544 	/*
2545 	 * favor one sleeping in a non-interruptible sleep
2546 	 */
2547 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2548 		return (1);
2549 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2550 		return (0);
2551 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2552 }
2553 
2554 /*
2555  * Output char to tty; console putchar style.
2556  * Can be called with tty lock held through kprintf() machinery..
2557  */
2558 int
2559 tputchar(int c, int flags, struct tty *tp)
2560 {
2561 	int r = 0;
2562 
2563 	if ((flags & NOLOCK) == 0)
2564 		mutex_spin_enter(&tty_lock);
2565 	if (!CONNECTED(tp)) {
2566 		r = -1;
2567 		goto out;
2568 	}
2569 	if (c == '\n')
2570 		(void)ttyoutput('\r', tp);
2571 	(void)ttyoutput(c, tp);
2572 	ttstart(tp);
2573 out:
2574 	if ((flags & NOLOCK) == 0)
2575 		mutex_spin_exit(&tty_lock);
2576 	return (r);
2577 }
2578 
2579 /*
2580  * Sleep on chan, returning ERESTART if tty changed while we napped and
2581  * returning any errors (e.g. EINTR/ETIMEDOUT) reported by cv_timedwait(_sig).
2582  * If the tty is revoked, restarting a pending call will redo validation done
2583  * at the start of the call.
2584  *
2585  * Must be called with the tty lock held.
2586  */
2587 int
2588 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch, int timo)
2589 {
2590 	int	error;
2591 	short	gen;
2592 
2593 	KASSERT(mutex_owned(&tty_lock));
2594 
2595 	gen = tp->t_gen;
2596 	if (catch)
2597 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2598 	else
2599 		error = cv_timedwait(cv, &tty_lock, timo);
2600 	if (error != 0)
2601 		return (error);
2602 	return (tp->t_gen == gen ? 0 : ERESTART);
2603 }
2604 
2605 /*
2606  * Attach a tty to the tty list.
2607  *
2608  * This should be called ONLY once per real tty (including pty's).
2609  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2610  * distinctly NOT usable as tty's, and thus should not be attached to
2611  * the ttylist.  This is why this call is not done from ttymalloc().
2612  *
2613  * Device drivers should attach tty's at a similar time that they are
2614  * ttymalloc()'ed, or, for the case of statically allocated struct tty's
2615  * either in the attach or (first) open routine.
2616  */
2617 void
2618 tty_attach(struct tty *tp)
2619 {
2620 
2621 	mutex_spin_enter(&tty_lock);
2622 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2623 	++tty_count;
2624 	mutex_spin_exit(&tty_lock);
2625 }
2626 
2627 /*
2628  * Remove a tty from the tty list.
2629  */
2630 void
2631 tty_detach(struct tty *tp)
2632 {
2633 
2634 	mutex_spin_enter(&tty_lock);
2635 	--tty_count;
2636 #ifdef DIAGNOSTIC
2637 	if (tty_count < 0)
2638 		panic("tty_detach: tty_count < 0");
2639 #endif
2640 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2641 	mutex_spin_exit(&tty_lock);
2642 }
2643 
2644 /*
2645  * Allocate a tty structure and its associated buffers.
2646  */
2647 struct tty *
2648 ttymalloc(void)
2649 {
2650 	struct tty	*tp;
2651 	int i;
2652 
2653 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2654 	callout_init(&tp->t_rstrt_ch, 0);
2655 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2656 	/* XXX: default to 1024 chars for now */
2657 	clalloc(&tp->t_rawq, 1024, 1);
2658 	cv_init(&tp->t_rawcv, "ttyraw");
2659 	cv_init(&tp->t_rawcvf, "ttyrawf");
2660 	clalloc(&tp->t_canq, 1024, 1);
2661 	cv_init(&tp->t_cancv, "ttycan");
2662 	cv_init(&tp->t_cancvf, "ttycanf");
2663 	/* output queue doesn't need quoting */
2664 	clalloc(&tp->t_outq, 1024, 0);
2665 	cv_init(&tp->t_outcv, "ttyout");
2666 	cv_init(&tp->t_outcvf, "ttyoutf");
2667 	/* Set default line discipline. */
2668 	tp->t_linesw = ttyldisc_default();
2669 	selinit(&tp->t_rsel);
2670 	selinit(&tp->t_wsel);
2671 	for (i = 0; i < TTYSIG_COUNT; i++)
2672 		sigemptyset(&tp->t_sigs[i]);
2673 	return (tp);
2674 }
2675 
2676 /*
2677  * Free a tty structure and its buffers.
2678  *
2679  * Be sure to call tty_detach() for any tty that has been
2680  * tty_attach()ed.
2681  */
2682 void
2683 ttyfree(struct tty *tp)
2684 {
2685 	int i;
2686 
2687 	mutex_enter(proc_lock);
2688 	mutex_enter(&tty_lock);
2689 	for (i = 0; i < TTYSIG_COUNT; i++)
2690 		sigemptyset(&tp->t_sigs[i]);
2691 	if (tp->t_sigcount != 0)
2692 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2693 	mutex_exit(&tty_lock);
2694 	mutex_exit(proc_lock);
2695 
2696 	callout_halt(&tp->t_rstrt_ch, NULL);
2697 	callout_destroy(&tp->t_rstrt_ch);
2698 	ttyldisc_release(tp->t_linesw);
2699 	clfree(&tp->t_rawq);
2700 	clfree(&tp->t_canq);
2701 	clfree(&tp->t_outq);
2702 	cv_destroy(&tp->t_rawcv);
2703 	cv_destroy(&tp->t_rawcvf);
2704 	cv_destroy(&tp->t_cancv);
2705 	cv_destroy(&tp->t_cancvf);
2706 	cv_destroy(&tp->t_outcv);
2707 	cv_destroy(&tp->t_outcvf);
2708 	seldestroy(&tp->t_rsel);
2709 	seldestroy(&tp->t_wsel);
2710 	kmem_free(tp, sizeof(*tp));
2711 }
2712 
2713 /*
2714  * ttyprintf_nolock: send a message to a specific tty, without locking.
2715  *
2716  * => should be used only by tty driver or anything that knows the
2717  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2718  *    use tprintf]
2719  */
2720 static void
2721 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2722 {
2723 	va_list ap;
2724 
2725 	/* No mutex needed; going to process TTY. */
2726 	va_start(ap, fmt);
2727 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2728 	va_end(ap);
2729 }
2730 
2731 static int
2732 tty_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
2733     void *arg0, void *arg1, void *arg2, void *arg3)
2734 {
2735 	struct tty *tty;
2736 	int result;
2737 
2738 	result = KAUTH_RESULT_DEFER;
2739 
2740 	if (action != KAUTH_DEVICE_TTY_OPEN)
2741 		return result;
2742 
2743 	tty = arg0;
2744 
2745 	/* If it's not opened, we allow. */
2746 	if ((tty->t_state & TS_ISOPEN) == 0)
2747 		result = KAUTH_RESULT_ALLOW;
2748 	else {
2749 		/*
2750 		 * If it's opened, we can only allow if it's not exclusively
2751 		 * opened; otherwise, that's a privileged operation and we
2752 		 * let the secmodel handle it.
2753 		 */
2754 		if ((tty->t_state & TS_XCLUDE) == 0)
2755 			result = KAUTH_RESULT_ALLOW;
2756 	}
2757 
2758 	return result;
2759 }
2760 
2761 /*
2762  * Initialize the tty subsystem.
2763  */
2764 void
2765 tty_init(void)
2766 {
2767 
2768 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2769 	rw_init(&ttcompat_lock);
2770 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2771 	KASSERT(tty_sigsih != NULL);
2772 
2773 	tty_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
2774 	    tty_listener_cb, NULL);
2775 
2776 	sysctl_kern_tkstat_setup();
2777 }
2778 
2779 /*
2780  * Send a signal from a tty to its process group or session leader.
2781  * Handoff to the target is deferred to a soft interrupt.
2782  */
2783 void
2784 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2785 {
2786 	sigset_t *sp;
2787 
2788 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2789 
2790 	sp = &tp->t_sigs[st];
2791 	if (sigismember(sp, sig))
2792 		return;
2793 	sigaddset(sp, sig);
2794 	if (tp->t_sigcount++ == 0)
2795 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2796 	softint_schedule(tty_sigsih);
2797 }
2798 
2799 /*
2800  * Deliver deferred signals from ttys.  Note that the process groups
2801  * and sessions associated with the ttys may have changed from when
2802  * the signal was originally sent, but in practice it should not matter.
2803  * For signals produced as a result of a syscall, the soft interrupt
2804  * will fire before the syscall returns to the user.
2805  */
2806 static void
2807 ttysigintr(void *cookie)
2808 {
2809 	struct tty *tp;
2810 	enum ttysigtype st;
2811 	struct pgrp *pgrp;
2812 	struct session *sess;
2813 	int sig, lflag;
2814 	char infobuf[200];
2815 
2816 	mutex_enter(proc_lock);
2817 	mutex_spin_enter(&tty_lock);
2818 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2819 		KASSERT(tp->t_sigcount > 0);
2820 		for (st = 0; st < TTYSIG_COUNT; st++) {
2821 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2822 				break;
2823 		}
2824 		KASSERT(st < TTYSIG_COUNT);
2825 		sigdelset(&tp->t_sigs[st], sig);
2826 		if (--tp->t_sigcount == 0)
2827 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2828 		pgrp = tp->t_pgrp;
2829 		sess = tp->t_session;
2830 		lflag = tp->t_lflag;
2831 		if  (sig == SIGINFO) {
2832 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2833 				/* Via ioctl: ignore tty option. */
2834 				tp->t_state &= ~TS_SIGINFO;
2835 				lflag |= ISIG;
2836 			}
2837 			if (!ISSET(lflag, NOKERNINFO)) {
2838 				mutex_spin_exit(&tty_lock);
2839 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
2840 				mutex_spin_enter(&tty_lock);
2841 				ttyputinfo(tp, infobuf);
2842 			}
2843 			if (!ISSET(lflag, ISIG))
2844 				continue;
2845 		}
2846 		mutex_spin_exit(&tty_lock);
2847 		KASSERT(sig != 0);
2848 		switch (st) {
2849 		case TTYSIG_PG1:
2850 			if (pgrp != NULL)
2851 				pgsignal(pgrp, sig, 1);
2852 			break;
2853 		case TTYSIG_PG2:
2854 			if (pgrp != NULL)
2855 				pgsignal(pgrp, sig, sess != NULL);
2856 			break;
2857 		case TTYSIG_LEADER:
2858 			if (sess != NULL && sess->s_leader != NULL)
2859 				psignal(sess->s_leader, sig);
2860 			break;
2861 		default:
2862 			/* NOTREACHED */
2863 			break;
2864 		}
2865 		mutex_spin_enter(&tty_lock);
2866 	}
2867 	mutex_spin_exit(&tty_lock);
2868 	mutex_exit(proc_lock);
2869 }
2870