xref: /netbsd-src/sys/kern/tty.c (revision b757af438b42b93f8c6571f026d8b8ef3eaf5fc9)
1 /*	$NetBSD: tty.c,v 1.250 2012/03/12 18:27:08 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 1982, 1986, 1990, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63  */
64 
65 #include <sys/cdefs.h>
66 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.250 2012/03/12 18:27:08 christos Exp $");
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/ioctl.h>
71 #include <sys/proc.h>
72 #define	TTYDEFCHARS
73 #include <sys/tty.h>
74 #undef	TTYDEFCHARS
75 #include <sys/file.h>
76 #include <sys/conf.h>
77 #include <sys/cpu.h>
78 #include <sys/dkstat.h>
79 #include <sys/uio.h>
80 #include <sys/kernel.h>
81 #include <sys/vnode.h>
82 #include <sys/syslog.h>
83 #include <sys/kmem.h>
84 #include <sys/signalvar.h>
85 #include <sys/resourcevar.h>
86 #include <sys/poll.h>
87 #include <sys/kprintf.h>
88 #include <sys/namei.h>
89 #include <sys/sysctl.h>
90 #include <sys/kauth.h>
91 #include <sys/intr.h>
92 #include <sys/ioctl_compat.h>
93 #include <sys/module.h>
94 #include <sys/bitops.h>
95 
96 static int	ttnread(struct tty *);
97 static void	ttyblock(struct tty *);
98 static void	ttyecho(int, struct tty *);
99 static void	ttyrubo(struct tty *, int);
100 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
101     __attribute__((__format__(__printf__,2,3)));
102 static int	proc_compare_wrapper(struct proc *, struct proc *);
103 static void	ttysigintr(void *);
104 
105 /* Symbolic sleep message strings. */
106 const char	ttclos[] = "ttycls";
107 const char	ttopen[] = "ttyopn";
108 const char	ttybg[] = "ttybg";
109 const char	ttyin[] = "ttyin";
110 const char	ttyout[] = "ttyout";
111 
112 /*
113  * Used to determine whether we still have a connection.  This is true in
114  * one of 3 cases:
115  * 1) We have carrier.
116  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
117  * 3) We're using a flow control mechanism that overloads the carrier signal.
118  */
119 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
120 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 unsigned char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
196 static void *tty_sigsih;
197 
198 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
199 int tty_count;
200 kmutex_t tty_lock;
201 krwlock_t ttcompat_lock;
202 int (*ttcompatvec)(struct tty *, u_long, void *, int, struct lwp *);
203 
204 uint64_t tk_cancc;
205 uint64_t tk_nin;
206 uint64_t tk_nout;
207 uint64_t tk_rawcc;
208 
209 static kauth_listener_t tty_listener;
210 
211 #define	TTY_MINQSIZE	0x00400
212 #define	TTY_MAXQSIZE	0x10000
213 int tty_qsize = TTY_MINQSIZE;
214 
215 static int
216 tty_get_qsize(int *qsize, int newsize)
217 {
218 	newsize = 1 << ilog2(newsize);	/* Make it a power of two */
219 
220 	if (newsize < TTY_MINQSIZE || newsize > TTY_MAXQSIZE)
221 		return EINVAL;
222 
223 	*qsize = newsize;
224 	return 0;
225 }
226 
227 static void
228 tty_set_qsize(struct tty *tp, int newsize)
229 {
230 	struct clist rawq, canq, outq;
231 	struct clist orawq, ocanq, ooutq;
232 
233 	clalloc(&rawq, newsize, 1);
234 	clalloc(&canq, newsize, 1);
235 	clalloc(&outq, newsize, 0);
236 
237 	mutex_spin_enter(&tty_lock);
238 
239 	orawq = tp->t_rawq;
240 	ocanq = tp->t_canq;
241 	ooutq = tp->t_outq;
242 
243 	tp->t_qsize = newsize;
244 	tp->t_rawq = rawq;
245 	tp->t_canq = canq;
246 	tp->t_outq = outq;
247 
248 	ttsetwater(tp);
249 
250 	mutex_spin_exit(&tty_lock);
251 
252 	clfree(&orawq);
253 	clfree(&ocanq);
254 	clfree(&ooutq);
255 }
256 
257 static int
258 sysctl_kern_tty_qsize(SYSCTLFN_ARGS)
259 {
260 	int newsize;
261 	int error;
262 	struct sysctlnode node;
263 	node = *rnode;
264 	node.sysctl_data = &newsize;
265 
266 	newsize = tty_qsize;
267 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
268 	if (error || newp == NULL)
269 		return error;
270 
271 
272 	return tty_get_qsize(&tty_qsize, newsize);
273 }
274 
275 static void
276 sysctl_kern_tty_setup(void)
277 {
278 	const struct sysctlnode *rnode, *cnode;
279 	struct sysctllog *kern_tkstat_sysctllog, *kern_tty_sysctllog;
280 
281 	kern_tkstat_sysctllog = NULL;
282 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
283 		       CTLFLAG_PERMANENT,
284 		       CTLTYPE_NODE, "kern", NULL,
285 		       NULL, 0, NULL, 0,
286 		       CTL_KERN, CTL_EOL);
287 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
288 		       CTLFLAG_PERMANENT,
289 		       CTLTYPE_NODE, "tkstat",
290 		       SYSCTL_DESCR("Number of characters sent and and "
291 				    "received on ttys"),
292 		       NULL, 0, NULL, 0,
293 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
294 
295 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
296 		       CTLFLAG_PERMANENT,
297 		       CTLTYPE_QUAD, "nin",
298 		       SYSCTL_DESCR("Total number of tty input characters"),
299 		       NULL, 0, &tk_nin, 0,
300 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
301 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
302 		       CTLFLAG_PERMANENT,
303 		       CTLTYPE_QUAD, "nout",
304 		       SYSCTL_DESCR("Total number of tty output characters"),
305 		       NULL, 0, &tk_nout, 0,
306 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
307 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
308 		       CTLFLAG_PERMANENT,
309 		       CTLTYPE_QUAD, "cancc",
310 		       SYSCTL_DESCR("Number of canonical tty input characters"),
311 		       NULL, 0, &tk_cancc, 0,
312 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
313 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
314 		       CTLFLAG_PERMANENT,
315 		       CTLTYPE_QUAD, "rawcc",
316 		       SYSCTL_DESCR("Number of raw tty input characters"),
317 		       NULL, 0, &tk_rawcc, 0,
318 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
319 
320 	kern_tty_sysctllog = NULL;
321 	sysctl_createv(&kern_tty_sysctllog, 0, NULL, &rnode,
322 		       CTLFLAG_PERMANENT,
323 		       CTLTYPE_NODE, "tty", NULL,
324 		       NULL, 0, NULL, 0,
325 		       CTL_KERN, CTL_CREATE, CTL_EOL);
326 	sysctl_createv(&kern_tty_sysctllog, 0, &rnode, &cnode,
327 		       CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
328 		       CTLTYPE_INT, "qsize",
329 		       SYSCTL_DESCR("TTY input and output queue size"),
330 		       sysctl_kern_tty_qsize, 0, &tty_qsize, 0,
331 		       CTL_CREATE, CTL_EOL);
332 }
333 
334 int
335 ttyopen(struct tty *tp, int dialout, int nonblock)
336 {
337 	int	error;
338 
339 	error = 0;
340 
341 	mutex_spin_enter(&tty_lock);
342 
343 	if (dialout) {
344 		/*
345 		 * If the device is already open for non-dialout, fail.
346 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
347 		 * opens.
348 		 */
349 		if (ISSET(tp->t_state, TS_ISOPEN) &&
350 		    !ISSET(tp->t_state, TS_DIALOUT)) {
351 			error = EBUSY;
352 			goto out;
353 		}
354 		SET(tp->t_state, TS_DIALOUT);
355 	} else {
356 		if (!nonblock) {
357 			/*
358 			 * Wait for carrier.  Also wait for any dialout
359 			 * processes to close the tty first.
360 			 */
361 			while (ISSET(tp->t_state, TS_DIALOUT) ||
362 			       !CONNECTED(tp)) {
363 				tp->t_wopen++;
364 				error = ttysleep(tp, &tp->t_rawcv, true, 0);
365 				tp->t_wopen--;
366 				if (error)
367 					goto out;
368 			}
369 		} else {
370 			/*
371 			 * Don't allow a non-blocking non-dialout open if the
372 			 * device is already open for dialout.
373 			 */
374 			if (ISSET(tp->t_state, TS_DIALOUT)) {
375 				error = EBUSY;
376 				goto out;
377 			}
378 		}
379 	}
380 
381 out:
382 	mutex_spin_exit(&tty_lock);
383 	return (error);
384 }
385 
386 /*
387  * Initial open of tty, or (re)entry to standard tty line discipline.
388  */
389 int
390 ttylopen(dev_t device, struct tty *tp)
391 {
392 
393 	mutex_spin_enter(&tty_lock);
394 	tp->t_dev = device;
395 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
396 		SET(tp->t_state, TS_ISOPEN);
397 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
398 		tp->t_flags = 0;
399 	}
400 	mutex_spin_exit(&tty_lock);
401 	if (tp->t_qsize != tty_qsize)
402 		tty_set_qsize(tp, tty_qsize);
403 	return (0);
404 }
405 
406 /*
407  * Handle close() on a tty line: flush and set to initial state,
408  * bumping generation number so that pending read/write calls
409  * can detect recycling of the tty.
410  */
411 int
412 ttyclose(struct tty *tp)
413 {
414 	extern struct tty *constty;	/* Temporary virtual console. */
415 	struct session *sess;
416 
417 	mutex_spin_enter(&tty_lock);
418 
419 	if (constty == tp)
420 		constty = NULL;
421 
422 	ttyflush(tp, FREAD | FWRITE);
423 
424 	tp->t_gen++;
425 	tp->t_pgrp = NULL;
426 	tp->t_state = 0;
427 	sess = tp->t_session;
428 	tp->t_session = NULL;
429 
430 	mutex_spin_exit(&tty_lock);
431 
432 	if (sess != NULL) {
433 		mutex_enter(proc_lock);
434 		/* Releases proc_lock. */
435 		proc_sessrele(sess);
436 	}
437 	return (0);
438 }
439 
440 #define	FLUSHQ(q) {							\
441 	if ((q)->c_cc)							\
442 		ndflush(q, (q)->c_cc);					\
443 }
444 
445 /*
446  * This macro is used in canonical mode input processing, where a read
447  * request shall not return unless a 'line delimiter' ('\n') or 'break'
448  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
449  * is an extension to the POSIX.1 defined set of special characters,
450  * recognize it only if IEXTEN is set in the set of local flags.
451  */
452 #define	TTBREAKC(c, lflg)						\
453 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
454 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
455 
456 
457 
458 /*
459  * ttyinput() helper.
460  * Call with the tty lock held.
461  */
462 /* XXX static */ int
463 ttyinput_wlock(int c, struct tty *tp)
464 {
465 	int	iflag, lflag, i, error;
466 	u_char	*cc;
467 
468 	KASSERT(mutex_owned(&tty_lock));
469 
470 	/*
471 	 * If input is pending take it first.
472 	 */
473 	lflag = tp->t_lflag;
474 	if (ISSET(lflag, PENDIN))
475 		ttypend(tp);
476 	/*
477 	 * Gather stats.
478 	 */
479 	if (ISSET(lflag, ICANON)) {
480 		++tk_cancc;
481 		++tp->t_cancc;
482 	} else {
483 		++tk_rawcc;
484 		++tp->t_rawcc;
485 	}
486 	++tk_nin;
487 
488 	cc = tp->t_cc;
489 
490 	/*
491 	 * Handle exceptional conditions (break, parity, framing).
492 	 */
493 	iflag = tp->t_iflag;
494 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
495 		CLR(c, TTY_ERRORMASK);
496 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
497 			if (ISSET(iflag, IGNBRK))
498 				return (0);
499 			else if (ISSET(iflag, BRKINT)) {
500 				ttyflush(tp, FREAD | FWRITE);
501 				ttysig(tp, TTYSIG_PG1, SIGINT);
502 				return (0);
503 			} else if (ISSET(iflag, PARMRK))
504 				goto parmrk;
505 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
506 		    ISSET(error, TTY_FE)) {
507 			if (ISSET(iflag, IGNPAR))
508 				return (0);
509 			else if (ISSET(iflag, PARMRK)) {
510  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
511 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
512 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
513 				return (0);
514 			} else
515 				c = 0;
516 		}
517 	} else if (c == 0377 &&
518 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
519 		/* "Escape" a valid character of '\377'. */
520 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
521 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
522 		goto endcase;
523 	}
524 
525 	/*
526 	 * In tandem mode, check high water mark.
527 	 */
528 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
529 		ttyblock(tp);
530 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
531 		CLR(c, 0x80);
532 	if (!ISSET(lflag, EXTPROC)) {
533 		/*
534 		 * Check for literal nexting very first
535 		 */
536 		if (ISSET(tp->t_state, TS_LNCH)) {
537 			SET(c, TTY_QUOTE);
538 			CLR(tp->t_state, TS_LNCH);
539 		}
540 		/*
541 		 * Scan for special characters.  This code
542 		 * is really just a big case statement with
543 		 * non-constant cases.  The bottom of the
544 		 * case statement is labeled ``endcase'', so goto
545 		 * it after a case match, or similar.
546 		 */
547 
548 		/*
549 		 * Control chars which aren't controlled
550 		 * by ICANON, ISIG, or IXON.
551 		 */
552 		if (ISSET(lflag, IEXTEN)) {
553 			if (CCEQ(cc[VLNEXT], c)) {
554 				if (ISSET(lflag, ECHO)) {
555 					if (ISSET(lflag, ECHOE)) {
556 						(void)ttyoutput('^', tp);
557 						(void)ttyoutput('\b', tp);
558 					} else
559 						ttyecho(c, tp);
560 				}
561 				SET(tp->t_state, TS_LNCH);
562 				goto endcase;
563 			}
564 			if (CCEQ(cc[VDISCARD], c)) {
565 				if (ISSET(lflag, FLUSHO))
566 					CLR(tp->t_lflag, FLUSHO);
567 				else {
568 					ttyflush(tp, FWRITE);
569 					ttyecho(c, tp);
570 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
571 						ttyretype(tp);
572 					SET(tp->t_lflag, FLUSHO);
573 				}
574 				goto startoutput;
575 			}
576 		}
577 		/*
578 		 * Signals.
579 		 */
580 		if (ISSET(lflag, ISIG)) {
581 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
582 				if (!ISSET(lflag, NOFLSH))
583 					ttyflush(tp, FREAD | FWRITE);
584 				ttyecho(c, tp);
585 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
586 				    SIGINT : SIGQUIT);
587 				goto endcase;
588 			}
589 			if (CCEQ(cc[VSUSP], c)) {
590 				if (!ISSET(lflag, NOFLSH))
591 					ttyflush(tp, FREAD);
592 				ttyecho(c, tp);
593 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
594 				goto endcase;
595 			}
596 		}
597 		/*
598 		 * Handle start/stop characters.
599 		 */
600 		if (ISSET(iflag, IXON)) {
601 			if (CCEQ(cc[VSTOP], c)) {
602 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
603 					SET(tp->t_state, TS_TTSTOP);
604 					cdev_stop(tp, 0);
605 					return (0);
606 				}
607 				if (!CCEQ(cc[VSTART], c))
608 					return (0);
609 				/*
610 				 * if VSTART == VSTOP then toggle
611 				 */
612 				goto endcase;
613 			}
614 			if (CCEQ(cc[VSTART], c))
615 				goto restartoutput;
616 		}
617 		/*
618 		 * IGNCR, ICRNL, & INLCR
619 		 */
620 		if (c == '\r') {
621 			if (ISSET(iflag, IGNCR))
622 				goto endcase;
623 			else if (ISSET(iflag, ICRNL))
624 				c = '\n';
625 		} else if (c == '\n' && ISSET(iflag, INLCR))
626 			c = '\r';
627 	}
628 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
629 		/*
630 		 * From here on down canonical mode character
631 		 * processing takes place.
632 		 */
633 		/*
634 		 * erase (^H / ^?)
635 		 */
636 		if (CCEQ(cc[VERASE], c)) {
637 			if (tp->t_rawq.c_cc)
638 				ttyrub(unputc(&tp->t_rawq), tp);
639 			goto endcase;
640 		}
641 		/*
642 		 * kill (^U)
643 		 */
644 		if (CCEQ(cc[VKILL], c)) {
645 			if (ISSET(lflag, ECHOKE) &&
646 			    tp->t_rawq.c_cc == tp->t_rocount &&
647 			    !ISSET(lflag, ECHOPRT))
648 				while (tp->t_rawq.c_cc)
649 					ttyrub(unputc(&tp->t_rawq), tp);
650 			else {
651 				ttyecho(c, tp);
652 				if (ISSET(lflag, ECHOK) ||
653 				    ISSET(lflag, ECHOKE))
654 					ttyecho('\n', tp);
655 				FLUSHQ(&tp->t_rawq);
656 				tp->t_rocount = 0;
657 			}
658 			CLR(tp->t_state, TS_LOCAL);
659 			goto endcase;
660 		}
661 		/*
662 		 * Extensions to the POSIX.1 GTI set of functions.
663 		 */
664 		if (ISSET(lflag, IEXTEN)) {
665 			/*
666 			 * word erase (^W)
667 			 */
668 			if (CCEQ(cc[VWERASE], c)) {
669 				int alt = ISSET(lflag, ALTWERASE);
670 				int ctype;
671 
672 				/*
673 				 * erase whitespace
674 				 */
675 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
676 				    c == '\t')
677 					ttyrub(c, tp);
678 				if (c == -1)
679 					goto endcase;
680 				/*
681 				 * erase last char of word and remember the
682 				 * next chars type (for ALTWERASE)
683 				 */
684 				ttyrub(c, tp);
685 				c = unputc(&tp->t_rawq);
686 				if (c == -1)
687 					goto endcase;
688 				if (c == ' ' || c == '\t') {
689 					(void)putc(c, &tp->t_rawq);
690 					goto endcase;
691 				}
692 				ctype = ISALPHA(c);
693 				/*
694 				 * erase rest of word
695 				 */
696 				do {
697 					ttyrub(c, tp);
698 					c = unputc(&tp->t_rawq);
699 					if (c == -1)
700 						goto endcase;
701 				} while (c != ' ' && c != '\t' &&
702 				    (alt == 0 || ISALPHA(c) == ctype));
703 				(void)putc(c, &tp->t_rawq);
704 				goto endcase;
705 			}
706 			/*
707 			 * reprint line (^R)
708 			 */
709 			if (CCEQ(cc[VREPRINT], c)) {
710 				ttyretype(tp);
711 				goto endcase;
712 			}
713 			/*
714 			 * ^T - kernel info and generate SIGINFO
715 			 */
716 			if (CCEQ(cc[VSTATUS], c)) {
717 				ttysig(tp, TTYSIG_PG1, SIGINFO);
718 				goto endcase;
719 			}
720 		}
721 	}
722 	/*
723 	 * Check for input buffer overflow
724 	 */
725 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
726 		if (ISSET(iflag, IMAXBEL)) {
727 			if (tp->t_outq.c_cc < tp->t_hiwat)
728 				(void)ttyoutput(CTRL('g'), tp);
729 		} else
730 			ttyflush(tp, FREAD | FWRITE);
731 		goto endcase;
732 	}
733 	/*
734 	 * Put data char in q for user and
735 	 * wakeup on seeing a line delimiter.
736 	 */
737 	if (putc(c, &tp->t_rawq) >= 0) {
738 		if (!ISSET(lflag, ICANON)) {
739 			ttwakeup(tp);
740 			ttyecho(c, tp);
741 			goto endcase;
742 		}
743 		if (TTBREAKC(c, lflag)) {
744 			tp->t_rocount = 0;
745 			catq(&tp->t_rawq, &tp->t_canq);
746 			ttwakeup(tp);
747 		} else if (tp->t_rocount++ == 0)
748 			tp->t_rocol = tp->t_column;
749 		if (ISSET(tp->t_state, TS_ERASE)) {
750 			/*
751 			 * end of prterase \.../
752 			 */
753 			CLR(tp->t_state, TS_ERASE);
754 			(void)ttyoutput('/', tp);
755 		}
756 		i = tp->t_column;
757 		ttyecho(c, tp);
758 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
759 			/*
760 			 * Place the cursor over the '^' of the ^D.
761 			 */
762 			i = min(2, tp->t_column - i);
763 			while (i > 0) {
764 				(void)ttyoutput('\b', tp);
765 				i--;
766 			}
767 		}
768 	}
769  endcase:
770 	/*
771 	 * IXANY means allow any character to restart output.
772 	 */
773 	if (ISSET(tp->t_state, TS_TTSTOP) &&
774 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
775 		return (0);
776 	}
777  restartoutput:
778 	CLR(tp->t_lflag, FLUSHO);
779 	CLR(tp->t_state, TS_TTSTOP);
780  startoutput:
781 	return (ttstart(tp));
782 }
783 
784 /*
785  * Process input of a single character received on a tty.
786  *
787  * XXX - this is a hack, all drivers must changed to acquire the
788  *	 lock before calling linesw->l_rint()
789  */
790 int
791 ttyinput(int c, struct tty *tp)
792 {
793 	int error;
794 
795 	/*
796 	 * Unless the receiver is enabled, drop incoming data.
797 	 */
798 	if (!ISSET(tp->t_cflag, CREAD))
799 		return (0);
800 
801 	mutex_spin_enter(&tty_lock);
802 	error = ttyinput_wlock(c, tp);
803 	mutex_spin_exit(&tty_lock);
804 
805 	return (error);
806 }
807 
808 /*
809  * Output a single character on a tty, doing output processing
810  * as needed (expanding tabs, newline processing, etc.).
811  * Returns < 0 if succeeds, otherwise returns char to resend.
812  * Must be recursive.
813  *
814  * Call with tty lock held.
815  */
816 int
817 ttyoutput(int c, struct tty *tp)
818 {
819 	long	oflag;
820 	int	col, notout;
821 
822 	KASSERT(mutex_owned(&tty_lock));
823 
824 	oflag = tp->t_oflag;
825 	if (!ISSET(oflag, OPOST)) {
826 		tk_nout++;
827 		tp->t_outcc++;
828 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
829 			return (c);
830 		return (-1);
831 	}
832 	/*
833 	 * Do tab expansion if OXTABS is set.  Special case if we do external
834 	 * processing, we don't do the tab expansion because we'll probably
835 	 * get it wrong.  If tab expansion needs to be done, let it happen
836 	 * externally.
837 	 */
838 	CLR(c, ~TTY_CHARMASK);
839 	if (c == '\t' &&
840 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
841 		c = 8 - (tp->t_column & 7);
842 		if (ISSET(tp->t_lflag, FLUSHO)) {
843 			notout = 0;
844 		} else {
845 			notout = b_to_q("        ", c, &tp->t_outq);
846 			c -= notout;
847 			tk_nout += c;
848 			tp->t_outcc += c;
849 		}
850 		tp->t_column += c;
851 		return (notout ? '\t' : -1);
852 	}
853 	if (c == CEOT && ISSET(oflag, ONOEOT))
854 		return (-1);
855 
856 	/*
857 	 * Newline translation: if ONLCR is set,
858 	 * translate newline into "\r\n".
859 	 */
860 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
861 		tk_nout++;
862 		tp->t_outcc++;
863 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
864 			return (c);
865 	}
866 	/* If OCRNL is set, translate "\r" into "\n". */
867 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
868 		c = '\n';
869 	/* If ONOCR is set, don't transmit CRs when on column 0. */
870 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
871 		return (-1);
872 
873 	tk_nout++;
874 	tp->t_outcc++;
875 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
876 		return (c);
877 
878 	col = tp->t_column;
879 	switch (CCLASS(c)) {
880 	case BACKSPACE:
881 		if (col > 0)
882 			--col;
883 		break;
884 	case CONTROL:
885 		break;
886 	case NEWLINE:
887 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
888 			col = 0;
889 		break;
890 	case RETURN:
891 		col = 0;
892 		break;
893 	case ORDINARY:
894 		++col;
895 		break;
896 	case TAB:
897 		col = (col + 8) & ~7;
898 		break;
899 	}
900 	tp->t_column = col;
901 	return (-1);
902 }
903 
904 /*
905  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
906  * has been called to do discipline-specific functions and/or reject any
907  * of these ioctl commands.
908  */
909 /* ARGSUSED */
910 int
911 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
912 {
913 	extern struct tty *constty;	/* Temporary virtual console. */
914 	struct proc *p = l ? l->l_proc : NULL;
915 	struct linesw	*lp;
916 	int		s, error;
917 	struct pathbuf *pb;
918 	struct nameidata nd;
919 	char		infobuf[200];
920 
921 	/* If the ioctl involves modification, hang if in the background. */
922 	switch (cmd) {
923 	case  TIOCFLUSH:
924 	case  TIOCDRAIN:
925 	case  TIOCSBRK:
926 	case  TIOCCBRK:
927 	case  TIOCSTART:
928 	case  TIOCSETA:
929 	case  TIOCSETD:
930 	case  TIOCSLINED:
931 	case  TIOCSETAF:
932 	case  TIOCSETAW:
933 #ifdef notdef
934 	case  TIOCSPGRP:
935 	case  FIOSETOWN:
936 #endif
937 	case  TIOCSTAT:
938 	case  TIOCSTI:
939 	case  TIOCSWINSZ:
940 	case  TIOCSQSIZE:
941 	case  TIOCLBIC:
942 	case  TIOCLBIS:
943 	case  TIOCLSET:
944 	case  TIOCSETC:
945 	case OTIOCSETD:
946 	case  TIOCSETN:
947 	case  TIOCSETP:
948 	case  TIOCSLTC:
949 		mutex_spin_enter(&tty_lock);
950 		while (isbackground(curproc, tp) &&
951 		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
952 		    !sigismasked(l, SIGTTOU)) {
953 			mutex_spin_exit(&tty_lock);
954 
955 			mutex_enter(proc_lock);
956 			pgsignal(p->p_pgrp, SIGTTOU, 1);
957 			mutex_exit(proc_lock);
958 
959 			mutex_spin_enter(&tty_lock);
960 			error = ttypause(tp, hz);
961 			if (error) {
962 				mutex_spin_exit(&tty_lock);
963 				return (error);
964 			}
965 		}
966 		mutex_spin_exit(&tty_lock);
967 		break;
968 	}
969 
970 	switch (cmd) {			/* Process the ioctl. */
971 	case FIOASYNC:			/* set/clear async i/o */
972 		mutex_spin_enter(&tty_lock);
973 		if (*(int *)data)
974 			SET(tp->t_state, TS_ASYNC);
975 		else
976 			CLR(tp->t_state, TS_ASYNC);
977 		mutex_spin_exit(&tty_lock);
978 		break;
979 	case FIONBIO:			/* set/clear non-blocking i/o */
980 		break;			/* XXX: delete. */
981 	case FIONREAD:			/* get # bytes to read */
982 		mutex_spin_enter(&tty_lock);
983 		*(int *)data = ttnread(tp);
984 		mutex_spin_exit(&tty_lock);
985 		break;
986 	case FIONWRITE:			/* get # bytes to written & unsent */
987 		mutex_spin_enter(&tty_lock);
988 		*(int *)data = tp->t_outq.c_cc;
989 		mutex_spin_exit(&tty_lock);
990 		break;
991 	case FIONSPACE:			/* get # bytes to written & unsent */
992 		mutex_spin_enter(&tty_lock);
993 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
994 		mutex_spin_exit(&tty_lock);
995 		break;
996 	case TIOCEXCL:			/* set exclusive use of tty */
997 		mutex_spin_enter(&tty_lock);
998 		SET(tp->t_state, TS_XCLUDE);
999 		mutex_spin_exit(&tty_lock);
1000 		break;
1001 	case TIOCFLUSH: {		/* flush buffers */
1002 		int flags = *(int *)data;
1003 
1004 		if (flags == 0)
1005 			flags = FREAD | FWRITE;
1006 		else
1007 			flags &= FREAD | FWRITE;
1008 		mutex_spin_enter(&tty_lock);
1009 		ttyflush(tp, flags);
1010 		mutex_spin_exit(&tty_lock);
1011 		break;
1012 	}
1013 	case TIOCCONS:			/* become virtual console */
1014 		if (*(int *)data) {
1015 			if (constty && constty != tp &&
1016 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
1017 			    (TS_CARR_ON | TS_ISOPEN))
1018 				return EBUSY;
1019 
1020 			pb = pathbuf_create("/dev/console");
1021 			if (pb == NULL) {
1022 				return ENOMEM;
1023 			}
1024 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, pb);
1025 			if ((error = namei(&nd)) != 0) {
1026 				pathbuf_destroy(pb);
1027 				return error;
1028 			}
1029 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
1030 			vput(nd.ni_vp);
1031 			pathbuf_destroy(pb);
1032 			if (error)
1033 				return error;
1034 
1035 			constty = tp;
1036 		} else if (tp == constty)
1037 			constty = NULL;
1038 		break;
1039 	case TIOCDRAIN:			/* wait till output drained */
1040 		if ((error = ttywait(tp)) != 0)
1041 			return (error);
1042 		break;
1043 	case TIOCGETA: {		/* get termios struct */
1044 		struct termios *t = (struct termios *)data;
1045 
1046 		memcpy(t, &tp->t_termios, sizeof(struct termios));
1047 		break;
1048 	}
1049 	case TIOCGETD:			/* get line discipline (old) */
1050 		*(int *)data = tp->t_linesw->l_no;
1051 		break;
1052 	case TIOCGLINED:		/* get line discipline (new) */
1053 		(void)strncpy((char *)data, tp->t_linesw->l_name,
1054 		    TTLINEDNAMELEN - 1);
1055 		break;
1056 	case TIOCGWINSZ:		/* get window size */
1057 		*(struct winsize *)data = tp->t_winsize;
1058 		break;
1059 	case TIOCGQSIZE:
1060 		*(int *)data = tp->t_qsize;
1061 		break;
1062 	case FIOGETOWN:
1063 		mutex_enter(proc_lock);
1064 		if (tp->t_session != NULL && !isctty(p, tp)) {
1065 			mutex_exit(proc_lock);
1066 			return (ENOTTY);
1067 		}
1068 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
1069 		mutex_exit(proc_lock);
1070 		break;
1071 	case TIOCGPGRP:			/* get pgrp of tty */
1072 		mutex_enter(proc_lock);
1073 		if (!isctty(p, tp)) {
1074 			mutex_exit(proc_lock);
1075 			return (ENOTTY);
1076 		}
1077 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
1078 		mutex_exit(proc_lock);
1079 		break;
1080 	case TIOCGSID:			/* get sid of tty */
1081 		mutex_enter(proc_lock);
1082 		if (!isctty(p, tp)) {
1083 			mutex_exit(proc_lock);
1084 			return (ENOTTY);
1085 		}
1086 		*(int *)data = tp->t_session->s_sid;
1087 		mutex_exit(proc_lock);
1088 		break;
1089 #ifdef TIOCHPCL
1090 	case TIOCHPCL:			/* hang up on last close */
1091 		mutex_spin_enter(&tty_lock);
1092 		SET(tp->t_cflag, HUPCL);
1093 		mutex_spin_exit(&tty_lock);
1094 		break;
1095 #endif
1096 	case TIOCNXCL:			/* reset exclusive use of tty */
1097 		mutex_spin_enter(&tty_lock);
1098 		CLR(tp->t_state, TS_XCLUDE);
1099 		mutex_spin_exit(&tty_lock);
1100 		break;
1101 	case TIOCOUTQ:			/* output queue size */
1102 		*(int *)data = tp->t_outq.c_cc;
1103 		break;
1104 	case TIOCSETA:			/* set termios struct */
1105 	case TIOCSETAW:			/* drain output, set */
1106 	case TIOCSETAF: {		/* drn out, fls in, set */
1107 		struct termios *t = (struct termios *)data;
1108 
1109 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1110 			if ((error = ttywait(tp)) != 0)
1111 				return (error);
1112 
1113 			if (cmd == TIOCSETAF) {
1114 				mutex_spin_enter(&tty_lock);
1115 				ttyflush(tp, FREAD);
1116 				mutex_spin_exit(&tty_lock);
1117 			}
1118 		}
1119 
1120 		s = spltty();
1121 		/*
1122 		 * XXXSMP - some drivers call back on us from t_param(), so
1123 		 *	    don't take the tty spin lock here.
1124 		 *	    require t_param() to unlock upon callback?
1125 		 */
1126 		/* wanted here: mutex_spin_enter(&tty_lock); */
1127 		if (!ISSET(t->c_cflag, CIGNORE)) {
1128 			/*
1129 			 * Set device hardware.
1130 			 */
1131 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1132 				/* wanted here: mutex_spin_exit(&tty_lock); */
1133 				splx(s);
1134 				return (error);
1135 			} else {
1136 				tp->t_cflag = t->c_cflag;
1137 				tp->t_ispeed = t->c_ispeed;
1138 				tp->t_ospeed = t->c_ospeed;
1139 				if (t->c_ospeed == 0)
1140 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1141 			}
1142 			ttsetwater(tp);
1143 		}
1144 
1145 		/* delayed lock acquiring */
1146 		mutex_spin_enter(&tty_lock);
1147 		if (cmd != TIOCSETAF) {
1148 			if (ISSET(t->c_lflag, ICANON) !=
1149 			    ISSET(tp->t_lflag, ICANON)) {
1150 				if (ISSET(t->c_lflag, ICANON)) {
1151 					SET(tp->t_lflag, PENDIN);
1152 					ttwakeup(tp);
1153 				} else {
1154 					struct clist tq;
1155 
1156 					catq(&tp->t_rawq, &tp->t_canq);
1157 					tq = tp->t_rawq;
1158 					tp->t_rawq = tp->t_canq;
1159 					tp->t_canq = tq;
1160 					CLR(tp->t_lflag, PENDIN);
1161 				}
1162 			}
1163 		}
1164 		tp->t_iflag = t->c_iflag;
1165 		tp->t_oflag = t->c_oflag;
1166 		/*
1167 		 * Make the EXTPROC bit read only.
1168 		 */
1169 		if (ISSET(tp->t_lflag, EXTPROC))
1170 			SET(t->c_lflag, EXTPROC);
1171 		else
1172 			CLR(t->c_lflag, EXTPROC);
1173 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1174 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1175 		mutex_spin_exit(&tty_lock);
1176 		splx(s);
1177 		break;
1178 	}
1179 	case TIOCSETD:			/* set line discipline (old) */
1180 		lp = ttyldisc_lookup_bynum(*(int *)data);
1181 		goto setldisc;
1182 
1183 	case TIOCSLINED: {		/* set line discipline (new) */
1184 		char *name = (char *)data;
1185 		dev_t device;
1186 
1187 		/* Null terminate to prevent buffer overflow */
1188 		name[TTLINEDNAMELEN - 1] = '\0';
1189 		lp = ttyldisc_lookup(name);
1190  setldisc:
1191 		if (lp == NULL)
1192 			return (ENXIO);
1193 
1194 		if (lp != tp->t_linesw) {
1195 			device = tp->t_dev;
1196 			s = spltty();
1197 			(*tp->t_linesw->l_close)(tp, flag);
1198 			error = (*lp->l_open)(device, tp);
1199 			if (error) {
1200 				(void)(*tp->t_linesw->l_open)(device, tp);
1201 				splx(s);
1202 				ttyldisc_release(lp);
1203 				return (error);
1204 			}
1205 			ttyldisc_release(tp->t_linesw);
1206 			tp->t_linesw = lp;
1207 			splx(s);
1208 		} else {
1209 			/* Drop extra reference. */
1210 			ttyldisc_release(lp);
1211 		}
1212 		break;
1213 	}
1214 	case TIOCSTART:			/* start output, like ^Q */
1215 		mutex_spin_enter(&tty_lock);
1216 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1217 		    ISSET(tp->t_lflag, FLUSHO)) {
1218 			CLR(tp->t_lflag, FLUSHO);
1219 			CLR(tp->t_state, TS_TTSTOP);
1220 			ttstart(tp);
1221 		}
1222 		mutex_spin_exit(&tty_lock);
1223 		break;
1224 	case TIOCSTI:			/* simulate terminal input */
1225 		if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_STI,
1226 		    tp) != 0) {
1227 			if (!ISSET(flag, FREAD))
1228 				return (EPERM);
1229 			if (!isctty(p, tp))
1230 				return (EACCES);
1231 		}
1232 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1233 		break;
1234 	case TIOCSTOP:			/* stop output, like ^S */
1235 	{
1236 		mutex_spin_enter(&tty_lock);
1237 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1238 			SET(tp->t_state, TS_TTSTOP);
1239 			cdev_stop(tp, 0);
1240 		}
1241 		mutex_spin_exit(&tty_lock);
1242 		break;
1243 	}
1244 	case TIOCSCTTY:			/* become controlling tty */
1245 		mutex_enter(proc_lock);
1246 		mutex_spin_enter(&tty_lock);
1247 
1248 		/* Session ctty vnode pointer set in vnode layer. */
1249 		if (!SESS_LEADER(p) ||
1250 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1251 		    (tp->t_session != p->p_session))) {
1252 			mutex_spin_exit(&tty_lock);
1253 			mutex_exit(proc_lock);
1254 			return (EPERM);
1255 		}
1256 
1257 		/*
1258 		 * `p_session' acquires a reference.
1259 		 * But note that if `t_session' is set at this point,
1260 		 * it must equal `p_session', in which case the session
1261 		 * already has the correct reference count.
1262 		 */
1263 		if (tp->t_session == NULL) {
1264 			proc_sesshold(p->p_session);
1265 		}
1266 		tp->t_session = p->p_session;
1267 		tp->t_pgrp = p->p_pgrp;
1268 		p->p_session->s_ttyp = tp;
1269 		p->p_lflag |= PL_CONTROLT;
1270 		mutex_spin_exit(&tty_lock);
1271 		mutex_exit(proc_lock);
1272 		break;
1273 	case FIOSETOWN: {		/* set pgrp of tty */
1274 		pid_t pgid = *(pid_t *)data;
1275 		struct pgrp *pgrp;
1276 
1277 		mutex_enter(proc_lock);
1278 		if (tp->t_session != NULL && !isctty(p, tp)) {
1279 			mutex_exit(proc_lock);
1280 			return (ENOTTY);
1281 		}
1282 
1283 		if (pgid < 0) {
1284 			pgrp = pgrp_find(-pgid);
1285 			if (pgrp == NULL) {
1286 				mutex_exit(proc_lock);
1287 				return (EINVAL);
1288 			}
1289 		} else {
1290 			struct proc *p1;
1291 			p1 = proc_find(pgid);
1292 			if (!p1) {
1293 				mutex_exit(proc_lock);
1294 				return (ESRCH);
1295 			}
1296 			pgrp = p1->p_pgrp;
1297 		}
1298 
1299 		if (pgrp->pg_session != p->p_session) {
1300 			mutex_exit(proc_lock);
1301 			return (EPERM);
1302 		}
1303 		mutex_spin_enter(&tty_lock);
1304 		tp->t_pgrp = pgrp;
1305 		mutex_spin_exit(&tty_lock);
1306 		mutex_exit(proc_lock);
1307 		break;
1308 	}
1309 	case TIOCSPGRP: {		/* set pgrp of tty */
1310 		struct pgrp *pgrp;
1311 		pid_t pgid = *(pid_t *)data;
1312 
1313 		if (pgid == NO_PGID)
1314 			return EINVAL;
1315 
1316 		mutex_enter(proc_lock);
1317 		if (!isctty(p, tp)) {
1318 			mutex_exit(proc_lock);
1319 			return (ENOTTY);
1320 		}
1321 		pgrp = pgrp_find(pgid);
1322 		if (pgrp == NULL || pgrp->pg_session != p->p_session) {
1323 			mutex_exit(proc_lock);
1324 			return (EPERM);
1325 		}
1326 		mutex_spin_enter(&tty_lock);
1327 		tp->t_pgrp = pgrp;
1328 		mutex_spin_exit(&tty_lock);
1329 		mutex_exit(proc_lock);
1330 		break;
1331 	}
1332 	case TIOCSTAT:			/* get load avg stats */
1333 		mutex_enter(proc_lock);
1334 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1335 		mutex_exit(proc_lock);
1336 
1337 		mutex_spin_enter(&tty_lock);
1338 		ttyputinfo(tp, infobuf);
1339 		mutex_spin_exit(&tty_lock);
1340 		break;
1341 	case TIOCSWINSZ:		/* set window size */
1342 		mutex_spin_enter(&tty_lock);
1343 		if (memcmp((void *)&tp->t_winsize, data,
1344 		    sizeof(struct winsize))) {
1345 			tp->t_winsize = *(struct winsize *)data;
1346 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1347 		}
1348 		mutex_spin_exit(&tty_lock);
1349 		break;
1350 	case TIOCSQSIZE:
1351 		if ((error = tty_get_qsize(&s, *(int *)data)) == 0 &&
1352 		    s != tp->t_qsize)
1353 			tty_set_qsize(tp, s);
1354 		return error;
1355 	default:
1356 		/* We may have to load the compat module for this. */
1357 		for (;;) {
1358 			rw_enter(&ttcompat_lock, RW_READER);
1359 			if (ttcompatvec != NULL) {
1360 				break;
1361 			}
1362 			rw_exit(&ttcompat_lock);
1363 			(void)module_autoload("compat", MODULE_CLASS_ANY);
1364 			if (ttcompatvec == NULL) {
1365 				return EPASSTHROUGH;
1366 			}
1367 		}
1368 		error = (*ttcompatvec)(tp, cmd, data, flag, l);
1369 		rw_exit(&ttcompat_lock);
1370 		return error;
1371 	}
1372 	return (0);
1373 }
1374 
1375 int
1376 ttpoll(struct tty *tp, int events, struct lwp *l)
1377 {
1378 	int	revents;
1379 
1380 	revents = 0;
1381 	mutex_spin_enter(&tty_lock);
1382 	if (events & (POLLIN | POLLRDNORM))
1383 		if (ttnread(tp) > 0)
1384 			revents |= events & (POLLIN | POLLRDNORM);
1385 
1386 	if (events & (POLLOUT | POLLWRNORM))
1387 		if (tp->t_outq.c_cc <= tp->t_lowat)
1388 			revents |= events & (POLLOUT | POLLWRNORM);
1389 
1390 	if (events & POLLHUP)
1391 		if (!CONNECTED(tp))
1392 			revents |= POLLHUP;
1393 
1394 	if (revents == 0) {
1395 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1396 			selrecord(l, &tp->t_rsel);
1397 
1398 		if (events & (POLLOUT | POLLWRNORM))
1399 			selrecord(l, &tp->t_wsel);
1400 	}
1401 
1402 	mutex_spin_exit(&tty_lock);
1403 
1404 	return (revents);
1405 }
1406 
1407 static void
1408 filt_ttyrdetach(struct knote *kn)
1409 {
1410 	struct tty	*tp;
1411 
1412 	tp = kn->kn_hook;
1413 	mutex_spin_enter(&tty_lock);
1414 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1415 	mutex_spin_exit(&tty_lock);
1416 }
1417 
1418 static int
1419 filt_ttyread(struct knote *kn, long hint)
1420 {
1421 	struct tty	*tp;
1422 
1423 	tp = kn->kn_hook;
1424 	if ((hint & NOTE_SUBMIT) == 0)
1425 		mutex_spin_enter(&tty_lock);
1426 	kn->kn_data = ttnread(tp);
1427 	if ((hint & NOTE_SUBMIT) == 0)
1428 		mutex_spin_exit(&tty_lock);
1429 	return (kn->kn_data > 0);
1430 }
1431 
1432 static void
1433 filt_ttywdetach(struct knote *kn)
1434 {
1435 	struct tty	*tp;
1436 
1437 	tp = kn->kn_hook;
1438 	mutex_spin_enter(&tty_lock);
1439 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1440 	mutex_spin_exit(&tty_lock);
1441 }
1442 
1443 static int
1444 filt_ttywrite(struct knote *kn, long hint)
1445 {
1446 	struct tty	*tp;
1447 	int		canwrite;
1448 
1449 	tp = kn->kn_hook;
1450 	if ((hint & NOTE_SUBMIT) == 0)
1451 		mutex_spin_enter(&tty_lock);
1452 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1453 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1454 	if ((hint & NOTE_SUBMIT) == 0)
1455 		mutex_spin_exit(&tty_lock);
1456 	return (canwrite);
1457 }
1458 
1459 static const struct filterops ttyread_filtops =
1460 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1461 static const struct filterops ttywrite_filtops =
1462 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1463 
1464 int
1465 ttykqfilter(dev_t dev, struct knote *kn)
1466 {
1467 	struct tty	*tp;
1468 	struct klist	*klist;
1469 
1470 	if ((tp = cdev_tty(dev)) == NULL)
1471 		return (ENXIO);
1472 
1473 	switch (kn->kn_filter) {
1474 	case EVFILT_READ:
1475 		klist = &tp->t_rsel.sel_klist;
1476 		kn->kn_fop = &ttyread_filtops;
1477 		break;
1478 	case EVFILT_WRITE:
1479 		klist = &tp->t_wsel.sel_klist;
1480 		kn->kn_fop = &ttywrite_filtops;
1481 		break;
1482 	default:
1483 		return EINVAL;
1484 	}
1485 
1486 	kn->kn_hook = tp;
1487 
1488 	mutex_spin_enter(&tty_lock);
1489 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1490 	mutex_spin_exit(&tty_lock);
1491 
1492 	return (0);
1493 }
1494 
1495 /*
1496  * Find the number of chars ready to be read from this tty.
1497  * Call with the tty lock held.
1498  */
1499 static int
1500 ttnread(struct tty *tp)
1501 {
1502 	int	nread;
1503 
1504 	KASSERT(mutex_owned(&tty_lock));
1505 
1506 	if (ISSET(tp->t_lflag, PENDIN))
1507 		ttypend(tp);
1508 	nread = tp->t_canq.c_cc;
1509 	if (!ISSET(tp->t_lflag, ICANON)) {
1510 		nread += tp->t_rawq.c_cc;
1511 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1512 			nread = 0;
1513 	}
1514 	return (nread);
1515 }
1516 
1517 /*
1518  * Wait for output to drain.
1519  */
1520 int
1521 ttywait(struct tty *tp)
1522 {
1523 	int	error;
1524 
1525 	error = 0;
1526 
1527 	mutex_spin_enter(&tty_lock);
1528 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1529 	    CONNECTED(tp) && tp->t_oproc) {
1530 		(*tp->t_oproc)(tp);
1531 		error = ttysleep(tp, &tp->t_outcv, true, 0);
1532 		if (error)
1533 			break;
1534 	}
1535 	mutex_spin_exit(&tty_lock);
1536 
1537 	return (error);
1538 }
1539 
1540 /*
1541  * Flush if successfully wait.
1542  */
1543 int
1544 ttywflush(struct tty *tp)
1545 {
1546 	int	error;
1547 
1548 	if ((error = ttywait(tp)) == 0) {
1549 		mutex_spin_enter(&tty_lock);
1550 		ttyflush(tp, FREAD);
1551 		mutex_spin_exit(&tty_lock);
1552 	}
1553 	return (error);
1554 }
1555 
1556 /*
1557  * Flush tty read and/or write queues, notifying anyone waiting.
1558  * Call with the tty lock held.
1559  */
1560 void
1561 ttyflush(struct tty *tp, int rw)
1562 {
1563 
1564 	KASSERT(mutex_owned(&tty_lock));
1565 
1566 	if (rw & FREAD) {
1567 		FLUSHQ(&tp->t_canq);
1568 		FLUSHQ(&tp->t_rawq);
1569 		tp->t_rocount = 0;
1570 		tp->t_rocol = 0;
1571 		CLR(tp->t_state, TS_LOCAL);
1572 		ttwakeup(tp);
1573 	}
1574 	if (rw & FWRITE) {
1575 		CLR(tp->t_state, TS_TTSTOP);
1576 		cdev_stop(tp, rw);
1577 		FLUSHQ(&tp->t_outq);
1578 		cv_broadcast(&tp->t_outcv);
1579 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1580 	}
1581 }
1582 
1583 /*
1584  * Copy in the default termios characters.
1585  */
1586 void
1587 ttychars(struct tty *tp)
1588 {
1589 
1590 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1591 }
1592 
1593 /*
1594  * Send stop character on input overflow.
1595  * Call with the tty lock held.
1596  */
1597 static void
1598 ttyblock(struct tty *tp)
1599 {
1600 	int	total;
1601 
1602 	KASSERT(mutex_owned(&tty_lock));
1603 
1604 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1605 	if (tp->t_rawq.c_cc > TTYHOG) {
1606 		ttyflush(tp, FREAD | FWRITE);
1607 		CLR(tp->t_state, TS_TBLOCK);
1608 	}
1609 	/*
1610 	 * Block further input iff: current input > threshold
1611 	 * AND input is available to user program.
1612 	 */
1613 	if (total >= TTYHOG / 2 &&
1614 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1615 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1616 		if (ISSET(tp->t_iflag, IXOFF) &&
1617 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1618 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1619 			SET(tp->t_state, TS_TBLOCK);
1620 			ttstart(tp);
1621 		}
1622 		/* Try to block remote output via hardware flow control. */
1623 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1624 		    (*tp->t_hwiflow)(tp, 1) != 0)
1625 			SET(tp->t_state, TS_TBLOCK);
1626 	}
1627 }
1628 
1629 /*
1630  * Delayed line discipline output
1631  */
1632 void
1633 ttrstrt(void *tp_arg)
1634 {
1635 	struct tty	*tp;
1636 
1637 #ifdef DIAGNOSTIC
1638 	if (tp_arg == NULL)
1639 		panic("ttrstrt");
1640 #endif
1641 	tp = tp_arg;
1642 	mutex_spin_enter(&tty_lock);
1643 
1644 	CLR(tp->t_state, TS_TIMEOUT);
1645 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1646 
1647 	mutex_spin_exit(&tty_lock);
1648 }
1649 
1650 /*
1651  * start a line discipline
1652  * Always call with tty lock held?
1653  */
1654 int
1655 ttstart(struct tty *tp)
1656 {
1657 
1658 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1659 		(*tp->t_oproc)(tp);
1660 	return (0);
1661 }
1662 
1663 /*
1664  * "close" a line discipline
1665  */
1666 int
1667 ttylclose(struct tty *tp, int flag)
1668 {
1669 
1670 	if (flag & FNONBLOCK) {
1671 		mutex_spin_enter(&tty_lock);
1672 		ttyflush(tp, FREAD | FWRITE);
1673 		mutex_spin_exit(&tty_lock);
1674 	} else
1675 		ttywflush(tp);
1676 	return (0);
1677 }
1678 
1679 /*
1680  * Handle modem control transition on a tty.
1681  * Flag indicates new state of carrier.
1682  * Returns 0 if the line should be turned off, otherwise 1.
1683  */
1684 int
1685 ttymodem(struct tty *tp, int flag)
1686 {
1687 
1688 	mutex_spin_enter(&tty_lock);
1689 	if (flag == 0) {
1690 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1691 			/*
1692 			 * Lost carrier.
1693 			 */
1694 			CLR(tp->t_state, TS_CARR_ON);
1695 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1696 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1697 				ttyflush(tp, FREAD | FWRITE);
1698 				mutex_spin_exit(&tty_lock);
1699 				return (0);
1700 			}
1701 		}
1702 	} else {
1703 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1704 			/*
1705 			 * Carrier now on.
1706 			 */
1707 			SET(tp->t_state, TS_CARR_ON);
1708 			ttwakeup(tp);
1709 		}
1710 	}
1711 	mutex_spin_exit(&tty_lock);
1712 
1713 	return (1);
1714 }
1715 
1716 /*
1717  * Default modem control routine (for other line disciplines).
1718  * Return argument flag, to turn off device on carrier drop.
1719  */
1720 int
1721 nullmodem(struct tty *tp, int flag)
1722 {
1723 
1724 	mutex_spin_enter(&tty_lock);
1725 	if (flag)
1726 		SET(tp->t_state, TS_CARR_ON);
1727 	else {
1728 		CLR(tp->t_state, TS_CARR_ON);
1729 		if (!CONNECTED(tp)) {
1730 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1731 			mutex_spin_exit(&tty_lock);
1732 			return (0);
1733 		}
1734 	}
1735 	mutex_spin_exit(&tty_lock);
1736 
1737 	return (1);
1738 }
1739 
1740 /*
1741  * Reinput pending characters after state switch.
1742  */
1743 void
1744 ttypend(struct tty *tp)
1745 {
1746 	struct clist	tq;
1747 	int		c;
1748 
1749 	KASSERT(mutex_owned(&tty_lock));
1750 
1751 	CLR(tp->t_lflag, PENDIN);
1752 	SET(tp->t_state, TS_TYPEN);
1753 	tq = tp->t_rawq;
1754 	tp->t_rawq.c_cc = 0;
1755 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1756 	while ((c = getc(&tq)) >= 0)
1757 		ttyinput_wlock(c, tp);
1758 	CLR(tp->t_state, TS_TYPEN);
1759 }
1760 
1761 /*
1762  * Process a read call on a tty device.
1763  */
1764 int
1765 ttread(struct tty *tp, struct uio *uio, int flag)
1766 {
1767 	struct clist	*qp;
1768 	u_char		*cc;
1769 	struct proc	*p;
1770 	int		c, first, error, has_stime, last_cc;
1771 	long		lflag, slp;
1772 	struct timeval	now, stime;
1773 
1774 	if (uio->uio_resid == 0)
1775 		return 0;
1776 
1777 	stime.tv_usec = 0;	/* XXX gcc */
1778 	stime.tv_sec = 0;	/* XXX gcc */
1779 
1780 	cc = tp->t_cc;
1781 	p = curproc;
1782 	error = 0;
1783 	has_stime = 0;
1784 	last_cc = 0;
1785 	slp = 0;
1786 
1787  loop:
1788 	mutex_spin_enter(&tty_lock);
1789 	lflag = tp->t_lflag;
1790 	/*
1791 	 * take pending input first
1792 	 */
1793 	if (ISSET(lflag, PENDIN))
1794 		ttypend(tp);
1795 
1796 	/*
1797 	 * Hang process if it's in the background.
1798 	 */
1799 	if (isbackground(p, tp)) {
1800 		if (sigismasked(curlwp, SIGTTIN) ||
1801 		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1802 			mutex_spin_exit(&tty_lock);
1803 			return (EIO);
1804 		}
1805 		mutex_spin_exit(&tty_lock);
1806 
1807 		mutex_enter(proc_lock);
1808 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1809 		mutex_exit(proc_lock);
1810 
1811 		mutex_spin_enter(&tty_lock);
1812 		error = ttypause(tp, hz);
1813 		mutex_spin_exit(&tty_lock);
1814 		if (error)
1815 			return (error);
1816 		goto loop;
1817 	}
1818 
1819 	if (!ISSET(lflag, ICANON)) {
1820 		int m = cc[VMIN];
1821 		long t = cc[VTIME];
1822 
1823 		qp = &tp->t_rawq;
1824 		/*
1825 		 * Check each of the four combinations.
1826 		 * (m > 0 && t == 0) is the normal read case.
1827 		 * It should be fairly efficient, so we check that and its
1828 		 * companion case (m == 0 && t == 0) first.
1829 		 * For the other two cases, we compute the target sleep time
1830 		 * into slp.
1831 		 */
1832 		if (t == 0) {
1833 			if (qp->c_cc < m)
1834 				goto sleep;
1835 			goto read;
1836 		}
1837 		t *= hz;		/* time in deca-ticks */
1838 /*
1839  * Time difference in deca-ticks, split division to avoid numeric overflow.
1840  * Ok for hz < ~200kHz
1841  */
1842 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1843 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1844 		if (m > 0) {
1845 			if (qp->c_cc <= 0)
1846 				goto sleep;
1847 			if (qp->c_cc >= m)
1848 				goto read;
1849 			if (!has_stime) {
1850 				/* first character, start timer */
1851 				has_stime = 1;
1852 				getmicrotime(&stime);
1853 				slp = t;
1854 			} else if (qp->c_cc > last_cc) {
1855 				/* got a character, restart timer */
1856 				getmicrotime(&stime);
1857 				slp = t;
1858 			} else {
1859 				/* nothing, check expiration */
1860 				getmicrotime(&now);
1861 				slp = t - diff(now, stime);
1862 			}
1863 		} else {	/* m == 0 */
1864 			if (qp->c_cc > 0)
1865 				goto read;
1866 			if (!has_stime) {
1867 				has_stime = 1;
1868 				getmicrotime(&stime);
1869 				slp = t;
1870 			} else {
1871 				getmicrotime(&now);
1872 				slp = t - diff(now, stime);
1873 			}
1874 		}
1875 		last_cc = qp->c_cc;
1876 #undef diff
1877 		if (slp > 0) {
1878 			/*
1879 			 * Convert deca-ticks back to ticks.
1880 			 * Rounding down may make us wake up just short
1881 			 * of the target, so we round up.
1882 			 * Maybe we should do 'slp/10 + 1' because the
1883 			 * first tick maybe almost immediate.
1884 			 * However it is more useful for a program that sets
1885 			 * VTIME=10 to wakeup every second not every 1.01
1886 			 * seconds (if hz=100).
1887 			 */
1888 			slp = (slp + 9)/ 10;
1889 			goto sleep;
1890 		}
1891 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1892 		int	carrier;
1893 
1894  sleep:
1895 		/*
1896 		 * If there is no input, sleep on rawq
1897 		 * awaiting hardware receipt and notification.
1898 		 * If we have data, we don't need to check for carrier.
1899 		 */
1900 		carrier = CONNECTED(tp);
1901 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1902 			mutex_spin_exit(&tty_lock);
1903 			return (0);	/* EOF */
1904 		}
1905 		if (!has_stime || slp <= 0) {
1906 			if (flag & IO_NDELAY) {
1907 				mutex_spin_exit(&tty_lock);
1908 				return (EWOULDBLOCK);
1909 			}
1910 		}
1911 		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1912 		mutex_spin_exit(&tty_lock);
1913 		/* VMIN == 0: any quantity read satisfies */
1914 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1915 			return (0);
1916 		if (error && error != EWOULDBLOCK)
1917 			return (error);
1918 		goto loop;
1919 	}
1920  read:
1921 	mutex_spin_exit(&tty_lock);
1922 
1923 	/*
1924 	 * Input present, check for input mapping and processing.
1925 	 */
1926 	first = 1;
1927 	while ((c = getc(qp)) >= 0) {
1928 		/*
1929 		 * delayed suspend (^Y)
1930 		 */
1931 		if (CCEQ(cc[VDSUSP], c) &&
1932 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
1933 			mutex_spin_enter(&tty_lock);
1934 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
1935 			if (first) {
1936 				error = ttypause(tp, hz);
1937 				mutex_spin_exit(&tty_lock);
1938 				if (error)
1939 					break;
1940 				goto loop;
1941 			} else
1942 				mutex_spin_exit(&tty_lock);
1943 			break;
1944 		}
1945 		/*
1946 		 * Interpret EOF only in canonical mode.
1947 		 */
1948 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1949 			break;
1950 		/*
1951 		 * Give user character.
1952 		 */
1953  		error = ureadc(c, uio);
1954 		if (error)
1955 			break;
1956  		if (uio->uio_resid == 0)
1957 			break;
1958 		/*
1959 		 * In canonical mode check for a "break character"
1960 		 * marking the end of a "line of input".
1961 		 */
1962 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1963 			break;
1964 		first = 0;
1965 	}
1966 	/*
1967 	 * Look to unblock output now that (presumably)
1968 	 * the input queue has gone down.
1969 	 */
1970 	mutex_spin_enter(&tty_lock);
1971 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
1972 		if (ISSET(tp->t_iflag, IXOFF) &&
1973 		    cc[VSTART] != _POSIX_VDISABLE &&
1974 		    putc(cc[VSTART], &tp->t_outq) == 0) {
1975 			CLR(tp->t_state, TS_TBLOCK);
1976 			ttstart(tp);
1977 		}
1978 		/* Try to unblock remote output via hardware flow control. */
1979 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1980 		    (*tp->t_hwiflow)(tp, 0) != 0)
1981 			CLR(tp->t_state, TS_TBLOCK);
1982 	}
1983 	mutex_spin_exit(&tty_lock);
1984 
1985 	return (error);
1986 }
1987 
1988 /*
1989  * Check the output queue on tp for space for a kernel message (from uprintf
1990  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1991  * lose messages due to normal flow control, but don't let the tty run amok.
1992  * Sleeps here are not interruptible, but we return prematurely if new signals
1993  * arrive.
1994  * Call with tty lock held.
1995  */
1996 static int
1997 ttycheckoutq_wlock(struct tty *tp, int wait)
1998 {
1999 	int	hiwat, error;
2000 
2001 	KASSERT(mutex_owned(&tty_lock));
2002 
2003 	hiwat = tp->t_hiwat;
2004 	if (tp->t_outq.c_cc > hiwat + 200)
2005 		while (tp->t_outq.c_cc > hiwat) {
2006 			ttstart(tp);
2007 			if (wait == 0)
2008 				return (0);
2009 			error = ttysleep(tp, &tp->t_outcv, true, hz);
2010 			if (error == EINTR)
2011 				wait = 0;
2012 		}
2013 
2014 	return (1);
2015 }
2016 
2017 int
2018 ttycheckoutq(struct tty *tp, int wait)
2019 {
2020 	int	r;
2021 
2022 	mutex_spin_enter(&tty_lock);
2023 	r = ttycheckoutq_wlock(tp, wait);
2024 	mutex_spin_exit(&tty_lock);
2025 
2026 	return (r);
2027 }
2028 
2029 /*
2030  * Process a write call on a tty device.
2031  */
2032 int
2033 ttwrite(struct tty *tp, struct uio *uio, int flag)
2034 {
2035 	u_char		*cp;
2036 	struct proc	*p;
2037 	int		cc, ce, i, hiwat, error;
2038 	u_char		obuf[OBUFSIZ];
2039 
2040 	cp = NULL;
2041 	hiwat = tp->t_hiwat;
2042 	error = 0;
2043 	cc = 0;
2044  loop:
2045 	mutex_spin_enter(&tty_lock);
2046 	if (!CONNECTED(tp)) {
2047 		if (ISSET(tp->t_state, TS_ISOPEN)) {
2048 			mutex_spin_exit(&tty_lock);
2049 			return (EIO);
2050 		} else if (flag & IO_NDELAY) {
2051 			mutex_spin_exit(&tty_lock);
2052 			error = EWOULDBLOCK;
2053 			goto out;
2054 		} else {
2055 			/* Sleep awaiting carrier. */
2056 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
2057 			mutex_spin_exit(&tty_lock);
2058 			if (error)
2059 				goto out;
2060 			goto loop;
2061 		}
2062 	}
2063 
2064 	/*
2065 	 * Hang the process if it's in the background.
2066 	 */
2067 	p = curproc;
2068 	if (isbackground(p, tp) &&
2069 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
2070 	    !sigismasked(curlwp, SIGTTOU)) {
2071 		if (p->p_pgrp->pg_jobc == 0) {
2072 			error = EIO;
2073 			mutex_spin_exit(&tty_lock);
2074 			goto out;
2075 		}
2076 		mutex_spin_exit(&tty_lock);
2077 
2078 		mutex_enter(proc_lock);
2079 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2080 		mutex_exit(proc_lock);
2081 
2082 		mutex_spin_enter(&tty_lock);
2083 		error = ttypause(tp, hz);
2084 		mutex_spin_exit(&tty_lock);
2085 		if (error)
2086 			goto out;
2087 		goto loop;
2088 	}
2089 	mutex_spin_exit(&tty_lock);
2090 
2091 	/*
2092 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2093 	 * output translation.  Keep track of high water mark, sleep on
2094 	 * overflow awaiting device aid in acquiring new space.
2095 	 */
2096 	while (uio->uio_resid > 0 || cc > 0) {
2097 		if (ISSET(tp->t_lflag, FLUSHO)) {
2098 			uio->uio_resid = 0;
2099 			return (0);
2100 		}
2101 		if (tp->t_outq.c_cc > hiwat)
2102 			goto ovhiwat;
2103 		/*
2104 		 * Grab a hunk of data from the user, unless we have some
2105 		 * leftover from last time.
2106 		 */
2107 		if (cc == 0) {
2108 			cc = min(uio->uio_resid, OBUFSIZ);
2109 			cp = obuf;
2110 			error = uiomove(cp, cc, uio);
2111 			if (error) {
2112 				cc = 0;
2113 				goto out;
2114 			}
2115 		}
2116 		/*
2117 		 * If nothing fancy need be done, grab those characters we
2118 		 * can handle without any of ttyoutput's processing and
2119 		 * just transfer them to the output q.  For those chars
2120 		 * which require special processing (as indicated by the
2121 		 * bits in char_type), call ttyoutput.  After processing
2122 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2123 		 * immediately.
2124 		 */
2125 		mutex_spin_enter(&tty_lock);
2126 		while (cc > 0) {
2127 			if (!ISSET(tp->t_oflag, OPOST))
2128 				ce = cc;
2129 			else {
2130 				ce = cc - scanc((u_int)cc, cp, char_type,
2131 				    CCLASSMASK);
2132 				/*
2133 				 * If ce is zero, then we're processing
2134 				 * a special character through ttyoutput.
2135 				 */
2136 				if (ce == 0) {
2137 					tp->t_rocount = 0;
2138 					if (ttyoutput(*cp, tp) >= 0) {
2139 						/* out of space */
2140 						mutex_spin_exit(&tty_lock);
2141 						goto overfull;
2142 					}
2143 					cp++;
2144 					cc--;
2145 					if (ISSET(tp->t_lflag, FLUSHO) ||
2146 					    tp->t_outq.c_cc > hiwat) {
2147 						mutex_spin_exit(&tty_lock);
2148 						goto ovhiwat;
2149 					}
2150 					continue;
2151 				}
2152 			}
2153 			/*
2154 			 * A bunch of normal characters have been found.
2155 			 * Transfer them en masse to the output queue and
2156 			 * continue processing at the top of the loop.
2157 			 * If there are any further characters in this
2158 			 * <= OBUFSIZ chunk, the first should be a character
2159 			 * requiring special handling by ttyoutput.
2160 			 */
2161 			tp->t_rocount = 0;
2162 			i = b_to_q(cp, ce, &tp->t_outq);
2163 			ce -= i;
2164 			tp->t_column += ce;
2165 			cp += ce, cc -= ce, tk_nout += ce;
2166 			tp->t_outcc += ce;
2167 			if (i > 0) {
2168 				/* out of space */
2169 				mutex_spin_exit(&tty_lock);
2170 				goto overfull;
2171 			}
2172 			if (ISSET(tp->t_lflag, FLUSHO) ||
2173 			    tp->t_outq.c_cc > hiwat)
2174 				break;
2175 		}
2176 		ttstart(tp);
2177 		mutex_spin_exit(&tty_lock);
2178 	}
2179 
2180  out:
2181 	/*
2182 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2183 	 * offset and iov pointers have moved forward, but it doesn't matter
2184 	 * (the call will either return short or restart with a new uio).
2185 	 */
2186 	uio->uio_resid += cc;
2187 	return (error);
2188 
2189  overfull:
2190 	/*
2191 	 * Since we are using ring buffers, if we can't insert any more into
2192 	 * the output queue, we can assume the ring is full and that someone
2193 	 * forgot to set the high water mark correctly.  We set it and then
2194 	 * proceed as normal.
2195 	 */
2196 	hiwat = tp->t_outq.c_cc - 1;
2197 
2198  ovhiwat:
2199 	mutex_spin_enter(&tty_lock);
2200 	ttstart(tp);
2201 	/*
2202 	 * This can only occur if FLUSHO is set in t_lflag,
2203 	 * or if ttstart/oproc is synchronous (or very fast).
2204 	 */
2205 	if (tp->t_outq.c_cc <= hiwat) {
2206 		mutex_spin_exit(&tty_lock);
2207 		goto loop;
2208 	}
2209 	if (flag & IO_NDELAY) {
2210 		mutex_spin_exit(&tty_lock);
2211 		error = EWOULDBLOCK;
2212 		goto out;
2213 	}
2214 	error = ttysleep(tp, &tp->t_outcv, true, 0);
2215 	mutex_spin_exit(&tty_lock);
2216 	if (error)
2217 		goto out;
2218 	goto loop;
2219 }
2220 
2221 /*
2222  * Try to pull more output from the producer.  Return non-zero if
2223  * there is output ready to be sent.
2224  */
2225 bool
2226 ttypull(struct tty *tp)
2227 {
2228 
2229 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2230 
2231 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2232 		cv_broadcast(&tp->t_outcv);
2233 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2234 	}
2235 	return tp->t_outq.c_cc != 0;
2236 }
2237 
2238 /*
2239  * Rubout one character from the rawq of tp
2240  * as cleanly as possible.
2241  * Called with tty lock held.
2242  */
2243 void
2244 ttyrub(int c, struct tty *tp)
2245 {
2246 	u_char	*cp;
2247 	int	savecol, tabc;
2248 
2249 	KASSERT(mutex_owned(&tty_lock));
2250 
2251 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2252 		return;
2253 	CLR(tp->t_lflag, FLUSHO);
2254 	if (ISSET(tp->t_lflag, ECHOE)) {
2255 		if (tp->t_rocount == 0) {
2256 			/*
2257 			 * Screwed by ttwrite; retype
2258 			 */
2259 			ttyretype(tp);
2260 			return;
2261 		}
2262 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2263 			ttyrubo(tp, 2);
2264 		else {
2265 			CLR(c, ~TTY_CHARMASK);
2266 			switch (CCLASS(c)) {
2267 			case ORDINARY:
2268 				ttyrubo(tp, 1);
2269 				break;
2270 			case BACKSPACE:
2271 			case CONTROL:
2272 			case NEWLINE:
2273 			case RETURN:
2274 			case VTAB:
2275 				if (ISSET(tp->t_lflag, ECHOCTL))
2276 					ttyrubo(tp, 2);
2277 				break;
2278 			case TAB:
2279 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2280 					ttyretype(tp);
2281 					return;
2282 				}
2283 				savecol = tp->t_column;
2284 				SET(tp->t_state, TS_CNTTB);
2285 				SET(tp->t_lflag, FLUSHO);
2286 				tp->t_column = tp->t_rocol;
2287 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2288 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2289 					ttyecho(tabc, tp);
2290 				CLR(tp->t_lflag, FLUSHO);
2291 				CLR(tp->t_state, TS_CNTTB);
2292 
2293 				/* savecol will now be length of the tab. */
2294 				savecol -= tp->t_column;
2295 				tp->t_column += savecol;
2296 				if (savecol > 8)
2297 					savecol = 8;	/* overflow screw */
2298 				while (--savecol >= 0)
2299 					(void)ttyoutput('\b', tp);
2300 				break;
2301 			default:			/* XXX */
2302 				(void)printf("ttyrub: would panic c = %d, "
2303 				    "val = %d\n", c, CCLASS(c));
2304 			}
2305 		}
2306 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2307 		if (!ISSET(tp->t_state, TS_ERASE)) {
2308 			SET(tp->t_state, TS_ERASE);
2309 			(void)ttyoutput('\\', tp);
2310 		}
2311 		ttyecho(c, tp);
2312 	} else
2313 		ttyecho(tp->t_cc[VERASE], tp);
2314 	--tp->t_rocount;
2315 }
2316 
2317 /*
2318  * Back over cnt characters, erasing them.
2319  * Called with tty lock held.
2320  */
2321 static void
2322 ttyrubo(struct tty *tp, int cnt)
2323 {
2324 
2325 	KASSERT(mutex_owned(&tty_lock));
2326 
2327 	while (cnt-- > 0) {
2328 		(void)ttyoutput('\b', tp);
2329 		(void)ttyoutput(' ', tp);
2330 		(void)ttyoutput('\b', tp);
2331 	}
2332 }
2333 
2334 /*
2335  * ttyretype --
2336  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2337  *	been checked.
2338  *
2339  * Called with tty lock held.
2340  */
2341 void
2342 ttyretype(struct tty *tp)
2343 {
2344 	u_char	*cp;
2345 	int	c;
2346 
2347 	KASSERT(mutex_owned(&tty_lock));
2348 
2349 	/* Echo the reprint character. */
2350 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2351 		ttyecho(tp->t_cc[VREPRINT], tp);
2352 
2353 	(void)ttyoutput('\n', tp);
2354 
2355 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2356 		ttyecho(c, tp);
2357 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2358 		ttyecho(c, tp);
2359 	CLR(tp->t_state, TS_ERASE);
2360 
2361 	tp->t_rocount = tp->t_rawq.c_cc;
2362 	tp->t_rocol = 0;
2363 }
2364 
2365 /*
2366  * Echo a typed character to the terminal.
2367  * Called with tty lock held.
2368  */
2369 static void
2370 ttyecho(int c, struct tty *tp)
2371 {
2372 
2373 	KASSERT(mutex_owned(&tty_lock));
2374 
2375 	if (!ISSET(tp->t_state, TS_CNTTB))
2376 		CLR(tp->t_lflag, FLUSHO);
2377 	if ((!ISSET(tp->t_lflag, ECHO) &&
2378 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2379 	    ISSET(tp->t_lflag, EXTPROC))
2380 		return;
2381 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2382 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2383 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2384 		(void)ttyoutput('^', tp);
2385 		CLR(c, ~TTY_CHARMASK);
2386 		if (c == 0177)
2387 			c = '?';
2388 		else
2389 			c += 'A' - 1;
2390 	}
2391 	(void)ttyoutput(c, tp);
2392 }
2393 
2394 /*
2395  * Wake up any readers on a tty.
2396  * Called with tty lock held.
2397  */
2398 void
2399 ttwakeup(struct tty *tp)
2400 {
2401 
2402 	KASSERT(mutex_owned(&tty_lock));
2403 
2404 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2405 	if (ISSET(tp->t_state, TS_ASYNC))
2406 		ttysig(tp, TTYSIG_PG2, SIGIO);
2407 	cv_broadcast(&tp->t_rawcv);
2408 }
2409 
2410 /*
2411  * Look up a code for a specified speed in a conversion table;
2412  * used by drivers to map software speed values to hardware parameters.
2413  */
2414 int
2415 ttspeedtab(int speed, const struct speedtab *table)
2416 {
2417 
2418 	for (; table->sp_speed != -1; table++)
2419 		if (table->sp_speed == speed)
2420 			return (table->sp_code);
2421 	return (-1);
2422 }
2423 
2424 /*
2425  * Set tty hi and low water marks.
2426  *
2427  * Try to arrange the dynamics so there's about one second
2428  * from hi to low water.
2429  */
2430 void
2431 ttsetwater(struct tty *tp)
2432 {
2433 	int	cps, x;
2434 
2435 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2436 
2437 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2438 
2439 	cps = tp->t_ospeed / 10;
2440 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2441 	x += cps;
2442 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2443 	tp->t_hiwat = roundup(x, TTROUND);
2444 #undef	CLAMP
2445 }
2446 
2447 /*
2448  * Prepare report on state of foreground process group.
2449  * Call with proc_lock held.
2450  */
2451 void
2452 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2453 {
2454 	struct lwp	*l;
2455 	struct proc	*p, *pick = NULL;
2456 	struct timeval	utime, stime;
2457 	int		tmp;
2458 	fixpt_t		pctcpu = 0;
2459 	const char	*msg;
2460 	char		lmsg[100];
2461 	long		rss;
2462 
2463 	KASSERT(mutex_owned(proc_lock));
2464 
2465 	*buf = '\0';
2466 
2467 	if (tp->t_session == NULL)
2468 		msg = "not a controlling terminal\n";
2469 	else if (tp->t_pgrp == NULL)
2470 		msg = "no foreground process group\n";
2471 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2472 		msg = "empty foreground process group\n";
2473 	else {
2474 		/* Pick interesting process. */
2475 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2476 			struct proc *oldpick;
2477 
2478 			if (pick == NULL) {
2479 				pick = p;
2480 				continue;
2481 			}
2482 			if (pick->p_lock < p->p_lock) {
2483 				mutex_enter(pick->p_lock);
2484 				mutex_enter(p->p_lock);
2485 			} else if (pick->p_lock > p->p_lock) {
2486 				mutex_enter(p->p_lock);
2487 				mutex_enter(pick->p_lock);
2488 			} else
2489 				mutex_enter(p->p_lock);
2490 			oldpick = pick;
2491 			if (proc_compare_wrapper(pick, p))
2492 				pick = p;
2493 			mutex_exit(p->p_lock);
2494 			if (p->p_lock != oldpick->p_lock)
2495 				mutex_exit(oldpick->p_lock);
2496 		}
2497 		if (fromsig &&
2498 		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2499 		    SA_NOKERNINFO))
2500 			return;
2501 		msg = NULL;
2502 	}
2503 
2504 	/* Print load average. */
2505 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2506 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2507 	strlcat(buf, lmsg, bufsz);
2508 
2509 	if (pick == NULL) {
2510 		strlcat(buf, msg, bufsz);
2511 		return;
2512 	}
2513 
2514 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2515 	    pick->p_pid);
2516 	strlcat(buf, lmsg, bufsz);
2517 
2518 	mutex_enter(pick->p_lock);
2519 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2520 		const char *lp;
2521 		lwp_lock(l);
2522 #ifdef LWP_PC
2523 #define FMT_RUN "%#"PRIxVADDR
2524 #define VAL_RUNNING (vaddr_t)LWP_PC(l)
2525 #define VAL_RUNABLE (vaddr_t)LWP_PC(l)
2526 #else
2527 #define FMT_RUN "%s"
2528 #define VAL_RUNNING "running"
2529 #define VAL_RUNABLE "runnable"
2530 #endif
2531 		switch (l->l_stat) {
2532 		case LSONPROC:
2533 			snprintf(lmsg, sizeof(lmsg), FMT_RUN"/%d", VAL_RUNNING,
2534 			    cpu_index(l->l_cpu));
2535 			lp = lmsg;
2536 			break;
2537 		case LSRUN:
2538 			snprintf(lmsg, sizeof(lmsg), FMT_RUN, VAL_RUNABLE);
2539 			lp = lmsg;
2540 			break;
2541 		default:
2542 			lp = l->l_wchan ? l->l_wmesg : "iowait";
2543 			break;
2544 		}
2545 		strlcat(buf, lp, bufsz);
2546 		strlcat(buf, LIST_NEXT(l, l_sibling) != NULL ? " " : "] ",
2547 		    bufsz);
2548 		pctcpu += l->l_pctcpu;
2549 		lwp_unlock(l);
2550 	}
2551 	pctcpu += pick->p_pctcpu;
2552 	calcru(pick, &utime, &stime, NULL, NULL);
2553 	mutex_exit(pick->p_lock);
2554 
2555 	/* Round up and print user+system time, %CPU and RSS. */
2556 	utime.tv_usec += 5000;
2557 	if (utime.tv_usec >= 1000000) {
2558 		utime.tv_sec += 1;
2559 		utime.tv_usec -= 1000000;
2560 	}
2561 	stime.tv_usec += 5000;
2562 	if (stime.tv_usec >= 1000000) {
2563 		stime.tv_sec += 1;
2564 		stime.tv_usec -= 1000000;
2565 	}
2566 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2567 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2568 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2569 		rss = 0;
2570 	else
2571 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2572 
2573 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2574 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2575 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2576 	    tmp / 100, rss);
2577 	strlcat(buf, lmsg, bufsz);
2578 }
2579 
2580 /*
2581  * Print report on state of foreground process group.
2582  * Call with tty_lock held.
2583  */
2584 void
2585 ttyputinfo(struct tty *tp, char *buf)
2586 {
2587 
2588 	KASSERT(mutex_owned(&tty_lock));
2589 
2590 	if (ttycheckoutq_wlock(tp, 0) == 0)
2591 		return;
2592 	ttyprintf_nolock(tp, "%s\n", buf);
2593 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2594 }
2595 
2596 /*
2597  * Returns 1 if p2 has a better chance being the active foreground process
2598  * in a terminal instead of p1.
2599  */
2600 static int
2601 proc_compare_wrapper(struct proc *p1, struct proc *p2)
2602 {
2603 	lwp_t *l1, *l2;
2604 
2605 	KASSERT(mutex_owned(p1->p_lock));
2606 	KASSERT(mutex_owned(p2->p_lock));
2607 
2608 	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2609 		return 1;
2610 
2611 	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2612 		return 0;
2613 
2614 	return proc_compare(p1, l1, p2, l2);
2615 }
2616 
2617 /*
2618  * Output char to tty; console putchar style.
2619  * Can be called with tty lock held through kprintf() machinery..
2620  */
2621 int
2622 tputchar(int c, int flags, struct tty *tp)
2623 {
2624 	int r = 0;
2625 
2626 	if ((flags & NOLOCK) == 0)
2627 		mutex_spin_enter(&tty_lock);
2628 	if (!CONNECTED(tp)) {
2629 		r = -1;
2630 		goto out;
2631 	}
2632 	if (c == '\n')
2633 		(void)ttyoutput('\r', tp);
2634 	(void)ttyoutput(c, tp);
2635 	ttstart(tp);
2636 out:
2637 	if ((flags & NOLOCK) == 0)
2638 		mutex_spin_exit(&tty_lock);
2639 	return (r);
2640 }
2641 
2642 /*
2643  * Sleep on chan, returning ERESTART if tty changed while we napped and
2644  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by
2645  * cv_timedwait(_sig).
2646  * If the tty is revoked, restarting a pending call will redo validation done
2647  * at the start of the call.
2648  *
2649  * Must be called with the tty lock held.
2650  */
2651 int
2652 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch, int timo)
2653 {
2654 	int	error;
2655 	short	gen;
2656 
2657 	KASSERT(mutex_owned(&tty_lock));
2658 
2659 	gen = tp->t_gen;
2660 	if (cv == NULL)
2661 		error = kpause("ttypause", catch, timo, &tty_lock);
2662 	else if (catch)
2663 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2664 	else
2665 		error = cv_timedwait(cv, &tty_lock, timo);
2666 	if (error != 0)
2667 		return (error);
2668 	return (tp->t_gen == gen ? 0 : ERESTART);
2669 }
2670 
2671 int
2672 ttypause(struct tty *tp, int timo)
2673 {
2674 	int error;
2675 
2676 	error = ttysleep(tp, NULL, true, timo);
2677 	if (error == EWOULDBLOCK)
2678 		error = 0;
2679 	return error;
2680 }
2681 
2682 /*
2683  * Attach a tty to the tty list.
2684  *
2685  * This should be called ONLY once per real tty (including pty's).
2686  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2687  * distinctly NOT usable as tty's, and thus should not be attached to
2688  * the ttylist.  This is why this call is not done from tty_alloc().
2689  *
2690  * Device drivers should attach tty's at a similar time that they are
2691  * allocated, or, for the case of statically allocated struct tty's
2692  * either in the attach or (first) open routine.
2693  */
2694 void
2695 tty_attach(struct tty *tp)
2696 {
2697 
2698 	mutex_spin_enter(&tty_lock);
2699 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2700 	++tty_count;
2701 	mutex_spin_exit(&tty_lock);
2702 }
2703 
2704 /*
2705  * Remove a tty from the tty list.
2706  */
2707 void
2708 tty_detach(struct tty *tp)
2709 {
2710 
2711 	mutex_spin_enter(&tty_lock);
2712 	--tty_count;
2713 #ifdef DIAGNOSTIC
2714 	if (tty_count < 0)
2715 		panic("tty_detach: tty_count < 0");
2716 #endif
2717 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2718 	mutex_spin_exit(&tty_lock);
2719 }
2720 
2721 /*
2722  * Allocate a tty structure and its associated buffers.
2723  */
2724 struct tty *
2725 tty_alloc(void)
2726 {
2727 	struct tty *tp;
2728 	int i;
2729 
2730 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2731 	callout_init(&tp->t_rstrt_ch, 0);
2732 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2733 	tp->t_qsize = tty_qsize;
2734 	clalloc(&tp->t_rawq, tp->t_qsize, 1);
2735 	cv_init(&tp->t_rawcv, "ttyraw");
2736 	cv_init(&tp->t_rawcvf, "ttyrawf");
2737 	clalloc(&tp->t_canq, tp->t_qsize, 1);
2738 	cv_init(&tp->t_cancv, "ttycan");
2739 	cv_init(&tp->t_cancvf, "ttycanf");
2740 	/* output queue doesn't need quoting */
2741 	clalloc(&tp->t_outq, tp->t_qsize, 0);
2742 	cv_init(&tp->t_outcv, "ttyout");
2743 	cv_init(&tp->t_outcvf, "ttyoutf");
2744 	/* Set default line discipline. */
2745 	tp->t_linesw = ttyldisc_default();
2746 	tp->t_dev = NODEV;
2747 	selinit(&tp->t_rsel);
2748 	selinit(&tp->t_wsel);
2749 	for (i = 0; i < TTYSIG_COUNT; i++)  {
2750 		sigemptyset(&tp->t_sigs[i]);
2751 	}
2752 
2753 	return tp;
2754 }
2755 
2756 /*
2757  * Free a tty structure and its buffers.
2758  *
2759  * Be sure to call tty_detach() for any tty that has been
2760  * tty_attach()ed.
2761  */
2762 void
2763 tty_free(struct tty *tp)
2764 {
2765 	int i;
2766 
2767 	mutex_enter(proc_lock);
2768 	mutex_enter(&tty_lock);
2769 	for (i = 0; i < TTYSIG_COUNT; i++)
2770 		sigemptyset(&tp->t_sigs[i]);
2771 	if (tp->t_sigcount != 0)
2772 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2773 	mutex_exit(&tty_lock);
2774 	mutex_exit(proc_lock);
2775 
2776 	callout_halt(&tp->t_rstrt_ch, NULL);
2777 	callout_destroy(&tp->t_rstrt_ch);
2778 	ttyldisc_release(tp->t_linesw);
2779 	clfree(&tp->t_rawq);
2780 	clfree(&tp->t_canq);
2781 	clfree(&tp->t_outq);
2782 	cv_destroy(&tp->t_rawcv);
2783 	cv_destroy(&tp->t_rawcvf);
2784 	cv_destroy(&tp->t_cancv);
2785 	cv_destroy(&tp->t_cancvf);
2786 	cv_destroy(&tp->t_outcv);
2787 	cv_destroy(&tp->t_outcvf);
2788 	seldestroy(&tp->t_rsel);
2789 	seldestroy(&tp->t_wsel);
2790 	kmem_free(tp, sizeof(*tp));
2791 }
2792 
2793 /*
2794  * ttyprintf_nolock: send a message to a specific tty, without locking.
2795  *
2796  * => should be used only by tty driver or anything that knows the
2797  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2798  *    use tprintf]
2799  */
2800 static void
2801 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2802 {
2803 	va_list ap;
2804 
2805 	/* No mutex needed; going to process TTY. */
2806 	va_start(ap, fmt);
2807 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2808 	va_end(ap);
2809 }
2810 
2811 static int
2812 tty_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
2813     void *arg0, void *arg1, void *arg2, void *arg3)
2814 {
2815 	struct tty *tty;
2816 	int result;
2817 
2818 	result = KAUTH_RESULT_DEFER;
2819 
2820 	if (action != KAUTH_DEVICE_TTY_OPEN)
2821 		return result;
2822 
2823 	tty = arg0;
2824 
2825 	/* If it's not opened, we allow. */
2826 	if ((tty->t_state & TS_ISOPEN) == 0)
2827 		result = KAUTH_RESULT_ALLOW;
2828 	else {
2829 		/*
2830 		 * If it's opened, we can only allow if it's not exclusively
2831 		 * opened; otherwise, that's a privileged operation and we
2832 		 * let the secmodel handle it.
2833 		 */
2834 		if ((tty->t_state & TS_XCLUDE) == 0)
2835 			result = KAUTH_RESULT_ALLOW;
2836 	}
2837 
2838 	return result;
2839 }
2840 
2841 /*
2842  * Initialize the tty subsystem.
2843  */
2844 void
2845 tty_init(void)
2846 {
2847 
2848 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2849 	rw_init(&ttcompat_lock);
2850 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2851 	KASSERT(tty_sigsih != NULL);
2852 
2853 	tty_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
2854 	    tty_listener_cb, NULL);
2855 
2856 	sysctl_kern_tty_setup();
2857 }
2858 
2859 /*
2860  * Send a signal from a tty to its process group or session leader.
2861  * Handoff to the target is deferred to a soft interrupt.
2862  */
2863 void
2864 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2865 {
2866 	sigset_t *sp;
2867 
2868 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2869 
2870 	sp = &tp->t_sigs[st];
2871 	if (sigismember(sp, sig))
2872 		return;
2873 	sigaddset(sp, sig);
2874 	if (tp->t_sigcount++ == 0)
2875 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2876 	softint_schedule(tty_sigsih);
2877 }
2878 
2879 /*
2880  * Deliver deferred signals from ttys.  Note that the process groups
2881  * and sessions associated with the ttys may have changed from when
2882  * the signal was originally sent, but in practice it should not matter.
2883  * For signals produced as a result of a syscall, the soft interrupt
2884  * will fire before the syscall returns to the user.
2885  */
2886 static void
2887 ttysigintr(void *cookie)
2888 {
2889 	struct tty *tp;
2890 	enum ttysigtype st;
2891 	struct pgrp *pgrp;
2892 	struct session *sess;
2893 	int sig, lflag;
2894 	char infobuf[200];
2895 
2896 	mutex_enter(proc_lock);
2897 	mutex_spin_enter(&tty_lock);
2898 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2899 		KASSERT(tp->t_sigcount > 0);
2900 		for (st = 0; st < TTYSIG_COUNT; st++) {
2901 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2902 				break;
2903 		}
2904 		KASSERT(st < TTYSIG_COUNT);
2905 		sigdelset(&tp->t_sigs[st], sig);
2906 		if (--tp->t_sigcount == 0)
2907 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2908 		pgrp = tp->t_pgrp;
2909 		sess = tp->t_session;
2910 		lflag = tp->t_lflag;
2911 		if  (sig == SIGINFO) {
2912 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2913 				/* Via ioctl: ignore tty option. */
2914 				tp->t_state &= ~TS_SIGINFO;
2915 				lflag |= ISIG;
2916 			}
2917 			if (!ISSET(lflag, NOKERNINFO)) {
2918 				mutex_spin_exit(&tty_lock);
2919 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
2920 				mutex_spin_enter(&tty_lock);
2921 				ttyputinfo(tp, infobuf);
2922 			}
2923 			if (!ISSET(lflag, ISIG))
2924 				continue;
2925 		}
2926 		mutex_spin_exit(&tty_lock);
2927 		KASSERT(sig != 0);
2928 		switch (st) {
2929 		case TTYSIG_PG1:
2930 			if (pgrp != NULL)
2931 				pgsignal(pgrp, sig, 1);
2932 			break;
2933 		case TTYSIG_PG2:
2934 			if (pgrp != NULL)
2935 				pgsignal(pgrp, sig, sess != NULL);
2936 			break;
2937 		case TTYSIG_LEADER:
2938 			if (sess != NULL && sess->s_leader != NULL)
2939 				psignal(sess->s_leader, sig);
2940 			break;
2941 		default:
2942 			/* NOTREACHED */
2943 			break;
2944 		}
2945 		mutex_spin_enter(&tty_lock);
2946 	}
2947 	mutex_spin_exit(&tty_lock);
2948 	mutex_exit(proc_lock);
2949 }
2950