xref: /netbsd-src/sys/kern/tty.c (revision c505c4429840c353a86d4eb53b5e2bfc0092264e)
1 /*	$NetBSD: tty.c,v 1.237 2010/07/01 02:38:31 rmind Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 1982, 1986, 1990, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63  */
64 
65 #include <sys/cdefs.h>
66 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.237 2010/07/01 02:38:31 rmind Exp $");
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/ioctl.h>
71 #include <sys/proc.h>
72 #define	TTYDEFCHARS
73 #include <sys/tty.h>
74 #undef	TTYDEFCHARS
75 #include <sys/file.h>
76 #include <sys/conf.h>
77 #include <sys/dkstat.h>
78 #include <sys/uio.h>
79 #include <sys/kernel.h>
80 #include <sys/vnode.h>
81 #include <sys/syslog.h>
82 #include <sys/kmem.h>
83 #include <sys/signalvar.h>
84 #include <sys/resourcevar.h>
85 #include <sys/poll.h>
86 #include <sys/kprintf.h>
87 #include <sys/namei.h>
88 #include <sys/sysctl.h>
89 #include <sys/kauth.h>
90 #include <sys/intr.h>
91 #include <sys/ioctl_compat.h>
92 #include <sys/module.h>
93 
94 #include <machine/stdarg.h>
95 
96 static int	ttnread(struct tty *);
97 static void	ttyblock(struct tty *);
98 static void	ttyecho(int, struct tty *);
99 static void	ttyrubo(struct tty *, int);
100 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
101     __attribute__((__format__(__printf__,2,3)));
102 static int	proc_compare(struct proc *, struct proc *);
103 static void	ttysigintr(void *);
104 
105 /* Symbolic sleep message strings. */
106 const char	ttclos[] = "ttycls";
107 const char	ttopen[] = "ttyopn";
108 const char	ttybg[] = "ttybg";
109 const char	ttyin[] = "ttyin";
110 const char	ttyout[] = "ttyout";
111 
112 /*
113  * Used to determine whether we still have a connection.  This is true in
114  * one of 3 cases:
115  * 1) We have carrier.
116  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
117  * 3) We're using a flow control mechanism that overloads the carrier signal.
118  */
119 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
120 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 unsigned char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
196 static void *tty_sigsih;
197 
198 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
199 int tty_count;
200 kmutex_t tty_lock;
201 krwlock_t ttcompat_lock;
202 int (*ttcompatvec)(struct tty *, u_long, void *, int, struct lwp *);
203 
204 uint64_t tk_cancc;
205 uint64_t tk_nin;
206 uint64_t tk_nout;
207 uint64_t tk_rawcc;
208 
209 static kauth_listener_t tty_listener;
210 
211 static struct sysctllog *kern_tkstat_sysctllog;
212 
213 static void
214 sysctl_kern_tkstat_setup(void)
215 {
216 
217 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
218 		       CTLFLAG_PERMANENT,
219 		       CTLTYPE_NODE, "kern", NULL,
220 		       NULL, 0, NULL, 0,
221 		       CTL_KERN, CTL_EOL);
222 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
223 		       CTLFLAG_PERMANENT,
224 		       CTLTYPE_NODE, "tkstat",
225 		       SYSCTL_DESCR("Number of characters sent and and "
226 				    "received on ttys"),
227 		       NULL, 0, NULL, 0,
228 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
229 
230 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
231 		       CTLFLAG_PERMANENT,
232 		       CTLTYPE_QUAD, "nin",
233 		       SYSCTL_DESCR("Total number of tty input characters"),
234 		       NULL, 0, &tk_nin, 0,
235 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
236 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
237 		       CTLFLAG_PERMANENT,
238 		       CTLTYPE_QUAD, "nout",
239 		       SYSCTL_DESCR("Total number of tty output characters"),
240 		       NULL, 0, &tk_nout, 0,
241 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
242 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
243 		       CTLFLAG_PERMANENT,
244 		       CTLTYPE_QUAD, "cancc",
245 		       SYSCTL_DESCR("Number of canonical tty input characters"),
246 		       NULL, 0, &tk_cancc, 0,
247 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
248 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
249 		       CTLFLAG_PERMANENT,
250 		       CTLTYPE_QUAD, "rawcc",
251 		       SYSCTL_DESCR("Number of raw tty input characters"),
252 		       NULL, 0, &tk_rawcc, 0,
253 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
254 }
255 
256 int
257 ttyopen(struct tty *tp, int dialout, int nonblock)
258 {
259 	int	error;
260 
261 	error = 0;
262 
263 	mutex_spin_enter(&tty_lock);
264 
265 	if (dialout) {
266 		/*
267 		 * If the device is already open for non-dialout, fail.
268 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
269 		 * opens.
270 		 */
271 		if (ISSET(tp->t_state, TS_ISOPEN) &&
272 		    !ISSET(tp->t_state, TS_DIALOUT)) {
273 			error = EBUSY;
274 			goto out;
275 		}
276 		SET(tp->t_state, TS_DIALOUT);
277 	} else {
278 		if (!nonblock) {
279 			/*
280 			 * Wait for carrier.  Also wait for any dialout
281 			 * processes to close the tty first.
282 			 */
283 			while (ISSET(tp->t_state, TS_DIALOUT) ||
284 			       !CONNECTED(tp)) {
285 				tp->t_wopen++;
286 				error = ttysleep(tp, &tp->t_rawcv, true, 0);
287 				tp->t_wopen--;
288 				if (error)
289 					goto out;
290 			}
291 		} else {
292 			/*
293 			 * Don't allow a non-blocking non-dialout open if the
294 			 * device is already open for dialout.
295 			 */
296 			if (ISSET(tp->t_state, TS_DIALOUT)) {
297 				error = EBUSY;
298 				goto out;
299 			}
300 		}
301 	}
302 
303 out:
304 	mutex_spin_exit(&tty_lock);
305 	return (error);
306 }
307 
308 /*
309  * Initial open of tty, or (re)entry to standard tty line discipline.
310  */
311 int
312 ttylopen(dev_t device, struct tty *tp)
313 {
314 
315 	mutex_spin_enter(&tty_lock);
316 	tp->t_dev = device;
317 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
318 		SET(tp->t_state, TS_ISOPEN);
319 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
320 		tp->t_flags = 0;
321 	}
322 	mutex_spin_exit(&tty_lock);
323 	return (0);
324 }
325 
326 /*
327  * Handle close() on a tty line: flush and set to initial state,
328  * bumping generation number so that pending read/write calls
329  * can detect recycling of the tty.
330  */
331 int
332 ttyclose(struct tty *tp)
333 {
334 	extern struct tty *constty;	/* Temporary virtual console. */
335 	struct session *sess;
336 
337 	mutex_spin_enter(&tty_lock);
338 
339 	if (constty == tp)
340 		constty = NULL;
341 
342 	ttyflush(tp, FREAD | FWRITE);
343 
344 	tp->t_gen++;
345 	tp->t_pgrp = NULL;
346 	tp->t_state = 0;
347 	sess = tp->t_session;
348 	tp->t_session = NULL;
349 
350 	mutex_spin_exit(&tty_lock);
351 
352 	if (sess != NULL) {
353 		mutex_enter(proc_lock);
354 		/* Releases proc_lock. */
355 		proc_sessrele(sess);
356 	}
357 	return (0);
358 }
359 
360 #define	FLUSHQ(q) {							\
361 	if ((q)->c_cc)							\
362 		ndflush(q, (q)->c_cc);					\
363 }
364 
365 /*
366  * This macro is used in canonical mode input processing, where a read
367  * request shall not return unless a 'line delimiter' ('\n') or 'break'
368  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
369  * is an extension to the POSIX.1 defined set of special characters,
370  * recognize it only if IEXTEN is set in the set of local flags.
371  */
372 #define	TTBREAKC(c, lflg)						\
373 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
374 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
375 
376 
377 
378 /*
379  * ttyinput() helper.
380  * Call with the tty lock held.
381  */
382 /* XXX static */ int
383 ttyinput_wlock(int c, struct tty *tp)
384 {
385 	int	iflag, lflag, i, error;
386 	u_char	*cc;
387 
388 	KASSERT(mutex_owned(&tty_lock));
389 
390 	/*
391 	 * If input is pending take it first.
392 	 */
393 	lflag = tp->t_lflag;
394 	if (ISSET(lflag, PENDIN))
395 		ttypend(tp);
396 	/*
397 	 * Gather stats.
398 	 */
399 	if (ISSET(lflag, ICANON)) {
400 		++tk_cancc;
401 		++tp->t_cancc;
402 	} else {
403 		++tk_rawcc;
404 		++tp->t_rawcc;
405 	}
406 	++tk_nin;
407 
408 	cc = tp->t_cc;
409 
410 	/*
411 	 * Handle exceptional conditions (break, parity, framing).
412 	 */
413 	iflag = tp->t_iflag;
414 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
415 		CLR(c, TTY_ERRORMASK);
416 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
417 			if (ISSET(iflag, IGNBRK))
418 				return (0);
419 			else if (ISSET(iflag, BRKINT)) {
420 				ttyflush(tp, FREAD | FWRITE);
421 				ttysig(tp, TTYSIG_PG1, SIGINT);
422 				return (0);
423 			} else if (ISSET(iflag, PARMRK))
424 				goto parmrk;
425 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
426 		    ISSET(error, TTY_FE)) {
427 			if (ISSET(iflag, IGNPAR))
428 				return (0);
429 			else if (ISSET(iflag, PARMRK)) {
430  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
431 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
432 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
433 				return (0);
434 			} else
435 				c = 0;
436 		}
437 	} else if (c == 0377 &&
438 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
439 		/* "Escape" a valid character of '\377'. */
440 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
441 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
442 		goto endcase;
443 	}
444 
445 	/*
446 	 * In tandem mode, check high water mark.
447 	 */
448 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
449 		ttyblock(tp);
450 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
451 		CLR(c, 0x80);
452 	if (!ISSET(lflag, EXTPROC)) {
453 		/*
454 		 * Check for literal nexting very first
455 		 */
456 		if (ISSET(tp->t_state, TS_LNCH)) {
457 			SET(c, TTY_QUOTE);
458 			CLR(tp->t_state, TS_LNCH);
459 		}
460 		/*
461 		 * Scan for special characters.  This code
462 		 * is really just a big case statement with
463 		 * non-constant cases.  The bottom of the
464 		 * case statement is labeled ``endcase'', so goto
465 		 * it after a case match, or similar.
466 		 */
467 
468 		/*
469 		 * Control chars which aren't controlled
470 		 * by ICANON, ISIG, or IXON.
471 		 */
472 		if (ISSET(lflag, IEXTEN)) {
473 			if (CCEQ(cc[VLNEXT], c)) {
474 				if (ISSET(lflag, ECHO)) {
475 					if (ISSET(lflag, ECHOE)) {
476 						(void)ttyoutput('^', tp);
477 						(void)ttyoutput('\b', tp);
478 					} else
479 						ttyecho(c, tp);
480 				}
481 				SET(tp->t_state, TS_LNCH);
482 				goto endcase;
483 			}
484 			if (CCEQ(cc[VDISCARD], c)) {
485 				if (ISSET(lflag, FLUSHO))
486 					CLR(tp->t_lflag, FLUSHO);
487 				else {
488 					ttyflush(tp, FWRITE);
489 					ttyecho(c, tp);
490 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
491 						ttyretype(tp);
492 					SET(tp->t_lflag, FLUSHO);
493 				}
494 				goto startoutput;
495 			}
496 		}
497 		/*
498 		 * Signals.
499 		 */
500 		if (ISSET(lflag, ISIG)) {
501 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
502 				if (!ISSET(lflag, NOFLSH))
503 					ttyflush(tp, FREAD | FWRITE);
504 				ttyecho(c, tp);
505 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
506 				    SIGINT : SIGQUIT);
507 				goto endcase;
508 			}
509 			if (CCEQ(cc[VSUSP], c)) {
510 				if (!ISSET(lflag, NOFLSH))
511 					ttyflush(tp, FREAD);
512 				ttyecho(c, tp);
513 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
514 				goto endcase;
515 			}
516 		}
517 		/*
518 		 * Handle start/stop characters.
519 		 */
520 		if (ISSET(iflag, IXON)) {
521 			if (CCEQ(cc[VSTOP], c)) {
522 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
523 					SET(tp->t_state, TS_TTSTOP);
524 					cdev_stop(tp, 0);
525 					return (0);
526 				}
527 				if (!CCEQ(cc[VSTART], c))
528 					return (0);
529 				/*
530 				 * if VSTART == VSTOP then toggle
531 				 */
532 				goto endcase;
533 			}
534 			if (CCEQ(cc[VSTART], c))
535 				goto restartoutput;
536 		}
537 		/*
538 		 * IGNCR, ICRNL, & INLCR
539 		 */
540 		if (c == '\r') {
541 			if (ISSET(iflag, IGNCR))
542 				goto endcase;
543 			else if (ISSET(iflag, ICRNL))
544 				c = '\n';
545 		} else if (c == '\n' && ISSET(iflag, INLCR))
546 			c = '\r';
547 	}
548 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
549 		/*
550 		 * From here on down canonical mode character
551 		 * processing takes place.
552 		 */
553 		/*
554 		 * erase (^H / ^?)
555 		 */
556 		if (CCEQ(cc[VERASE], c)) {
557 			if (tp->t_rawq.c_cc)
558 				ttyrub(unputc(&tp->t_rawq), tp);
559 			goto endcase;
560 		}
561 		/*
562 		 * kill (^U)
563 		 */
564 		if (CCEQ(cc[VKILL], c)) {
565 			if (ISSET(lflag, ECHOKE) &&
566 			    tp->t_rawq.c_cc == tp->t_rocount &&
567 			    !ISSET(lflag, ECHOPRT))
568 				while (tp->t_rawq.c_cc)
569 					ttyrub(unputc(&tp->t_rawq), tp);
570 			else {
571 				ttyecho(c, tp);
572 				if (ISSET(lflag, ECHOK) ||
573 				    ISSET(lflag, ECHOKE))
574 					ttyecho('\n', tp);
575 				FLUSHQ(&tp->t_rawq);
576 				tp->t_rocount = 0;
577 			}
578 			CLR(tp->t_state, TS_LOCAL);
579 			goto endcase;
580 		}
581 		/*
582 		 * Extensions to the POSIX.1 GTI set of functions.
583 		 */
584 		if (ISSET(lflag, IEXTEN)) {
585 			/*
586 			 * word erase (^W)
587 			 */
588 			if (CCEQ(cc[VWERASE], c)) {
589 				int alt = ISSET(lflag, ALTWERASE);
590 				int ctype;
591 
592 				/*
593 				 * erase whitespace
594 				 */
595 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
596 				    c == '\t')
597 					ttyrub(c, tp);
598 				if (c == -1)
599 					goto endcase;
600 				/*
601 				 * erase last char of word and remember the
602 				 * next chars type (for ALTWERASE)
603 				 */
604 				ttyrub(c, tp);
605 				c = unputc(&tp->t_rawq);
606 				if (c == -1)
607 					goto endcase;
608 				if (c == ' ' || c == '\t') {
609 					(void)putc(c, &tp->t_rawq);
610 					goto endcase;
611 				}
612 				ctype = ISALPHA(c);
613 				/*
614 				 * erase rest of word
615 				 */
616 				do {
617 					ttyrub(c, tp);
618 					c = unputc(&tp->t_rawq);
619 					if (c == -1)
620 						goto endcase;
621 				} while (c != ' ' && c != '\t' &&
622 				    (alt == 0 || ISALPHA(c) == ctype));
623 				(void)putc(c, &tp->t_rawq);
624 				goto endcase;
625 			}
626 			/*
627 			 * reprint line (^R)
628 			 */
629 			if (CCEQ(cc[VREPRINT], c)) {
630 				ttyretype(tp);
631 				goto endcase;
632 			}
633 			/*
634 			 * ^T - kernel info and generate SIGINFO
635 			 */
636 			if (CCEQ(cc[VSTATUS], c)) {
637 				ttysig(tp, TTYSIG_PG1, SIGINFO);
638 				goto endcase;
639 			}
640 		}
641 	}
642 	/*
643 	 * Check for input buffer overflow
644 	 */
645 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
646 		if (ISSET(iflag, IMAXBEL)) {
647 			if (tp->t_outq.c_cc < tp->t_hiwat)
648 				(void)ttyoutput(CTRL('g'), tp);
649 		} else
650 			ttyflush(tp, FREAD | FWRITE);
651 		goto endcase;
652 	}
653 	/*
654 	 * Put data char in q for user and
655 	 * wakeup on seeing a line delimiter.
656 	 */
657 	if (putc(c, &tp->t_rawq) >= 0) {
658 		if (!ISSET(lflag, ICANON)) {
659 			ttwakeup(tp);
660 			ttyecho(c, tp);
661 			goto endcase;
662 		}
663 		if (TTBREAKC(c, lflag)) {
664 			tp->t_rocount = 0;
665 			catq(&tp->t_rawq, &tp->t_canq);
666 			ttwakeup(tp);
667 		} else if (tp->t_rocount++ == 0)
668 			tp->t_rocol = tp->t_column;
669 		if (ISSET(tp->t_state, TS_ERASE)) {
670 			/*
671 			 * end of prterase \.../
672 			 */
673 			CLR(tp->t_state, TS_ERASE);
674 			(void)ttyoutput('/', tp);
675 		}
676 		i = tp->t_column;
677 		ttyecho(c, tp);
678 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
679 			/*
680 			 * Place the cursor over the '^' of the ^D.
681 			 */
682 			i = min(2, tp->t_column - i);
683 			while (i > 0) {
684 				(void)ttyoutput('\b', tp);
685 				i--;
686 			}
687 		}
688 	}
689  endcase:
690 	/*
691 	 * IXANY means allow any character to restart output.
692 	 */
693 	if (ISSET(tp->t_state, TS_TTSTOP) &&
694 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
695 		return (0);
696 	}
697  restartoutput:
698 	CLR(tp->t_lflag, FLUSHO);
699 	CLR(tp->t_state, TS_TTSTOP);
700  startoutput:
701 	return (ttstart(tp));
702 }
703 
704 /*
705  * Process input of a single character received on a tty.
706  *
707  * XXX - this is a hack, all drivers must changed to acquire the
708  *	 lock before calling linesw->l_rint()
709  */
710 int
711 ttyinput(int c, struct tty *tp)
712 {
713 	int error;
714 
715 	/*
716 	 * Unless the receiver is enabled, drop incoming data.
717 	 */
718 	if (!ISSET(tp->t_cflag, CREAD))
719 		return (0);
720 
721 	mutex_spin_enter(&tty_lock);
722 	error = ttyinput_wlock(c, tp);
723 	mutex_spin_exit(&tty_lock);
724 
725 	return (error);
726 }
727 
728 /*
729  * Output a single character on a tty, doing output processing
730  * as needed (expanding tabs, newline processing, etc.).
731  * Returns < 0 if succeeds, otherwise returns char to resend.
732  * Must be recursive.
733  *
734  * Call with tty lock held.
735  */
736 int
737 ttyoutput(int c, struct tty *tp)
738 {
739 	long	oflag;
740 	int	col, notout;
741 
742 	KASSERT(mutex_owned(&tty_lock));
743 
744 	oflag = tp->t_oflag;
745 	if (!ISSET(oflag, OPOST)) {
746 		tk_nout++;
747 		tp->t_outcc++;
748 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
749 			return (c);
750 		return (-1);
751 	}
752 	/*
753 	 * Do tab expansion if OXTABS is set.  Special case if we do external
754 	 * processing, we don't do the tab expansion because we'll probably
755 	 * get it wrong.  If tab expansion needs to be done, let it happen
756 	 * externally.
757 	 */
758 	CLR(c, ~TTY_CHARMASK);
759 	if (c == '\t' &&
760 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
761 		c = 8 - (tp->t_column & 7);
762 		if (ISSET(tp->t_lflag, FLUSHO)) {
763 			notout = 0;
764 		} else {
765 			notout = b_to_q("        ", c, &tp->t_outq);
766 			c -= notout;
767 			tk_nout += c;
768 			tp->t_outcc += c;
769 		}
770 		tp->t_column += c;
771 		return (notout ? '\t' : -1);
772 	}
773 	if (c == CEOT && ISSET(oflag, ONOEOT))
774 		return (-1);
775 
776 	/*
777 	 * Newline translation: if ONLCR is set,
778 	 * translate newline into "\r\n".
779 	 */
780 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
781 		tk_nout++;
782 		tp->t_outcc++;
783 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
784 			return (c);
785 	}
786 	/* If OCRNL is set, translate "\r" into "\n". */
787 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
788 		c = '\n';
789 	/* If ONOCR is set, don't transmit CRs when on column 0. */
790 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
791 		return (-1);
792 
793 	tk_nout++;
794 	tp->t_outcc++;
795 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
796 		return (c);
797 
798 	col = tp->t_column;
799 	switch (CCLASS(c)) {
800 	case BACKSPACE:
801 		if (col > 0)
802 			--col;
803 		break;
804 	case CONTROL:
805 		break;
806 	case NEWLINE:
807 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
808 			col = 0;
809 		break;
810 	case RETURN:
811 		col = 0;
812 		break;
813 	case ORDINARY:
814 		++col;
815 		break;
816 	case TAB:
817 		col = (col + 8) & ~7;
818 		break;
819 	}
820 	tp->t_column = col;
821 	return (-1);
822 }
823 
824 /*
825  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
826  * has been called to do discipline-specific functions and/or reject any
827  * of these ioctl commands.
828  */
829 /* ARGSUSED */
830 int
831 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
832 {
833 	extern struct tty *constty;	/* Temporary virtual console. */
834 	struct proc *p = l ? l->l_proc : NULL;
835 	struct linesw	*lp;
836 	int		s, error;
837 	struct nameidata nd;
838 	char		infobuf[200];
839 
840 	/* If the ioctl involves modification, hang if in the background. */
841 	switch (cmd) {
842 	case  TIOCFLUSH:
843 	case  TIOCDRAIN:
844 	case  TIOCSBRK:
845 	case  TIOCCBRK:
846 	case  TIOCSTART:
847 	case  TIOCSETA:
848 	case  TIOCSETD:
849 	case  TIOCSLINED:
850 	case  TIOCSETAF:
851 	case  TIOCSETAW:
852 #ifdef notdef
853 	case  TIOCSPGRP:
854 	case  FIOSETOWN:
855 #endif
856 	case  TIOCSTAT:
857 	case  TIOCSTI:
858 	case  TIOCSWINSZ:
859 	case  TIOCLBIC:
860 	case  TIOCLBIS:
861 	case  TIOCLSET:
862 	case  TIOCSETC:
863 	case OTIOCSETD:
864 	case  TIOCSETN:
865 	case  TIOCSETP:
866 	case  TIOCSLTC:
867 		mutex_spin_enter(&tty_lock);
868 		while (isbackground(curproc, tp) &&
869 		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
870 		    !sigismasked(l, SIGTTOU)) {
871 			mutex_spin_exit(&tty_lock);
872 
873 			mutex_enter(proc_lock);
874 			pgsignal(p->p_pgrp, SIGTTOU, 1);
875 			mutex_exit(proc_lock);
876 
877 			mutex_spin_enter(&tty_lock);
878 			error = ttysleep(tp, &lbolt, true, 0);
879 			if (error) {
880 				mutex_spin_exit(&tty_lock);
881 				return (error);
882 			}
883 		}
884 		mutex_spin_exit(&tty_lock);
885 		break;
886 	}
887 
888 	switch (cmd) {			/* Process the ioctl. */
889 	case FIOASYNC:			/* set/clear async i/o */
890 		mutex_spin_enter(&tty_lock);
891 		if (*(int *)data)
892 			SET(tp->t_state, TS_ASYNC);
893 		else
894 			CLR(tp->t_state, TS_ASYNC);
895 		mutex_spin_exit(&tty_lock);
896 		break;
897 	case FIONBIO:			/* set/clear non-blocking i/o */
898 		break;			/* XXX: delete. */
899 	case FIONREAD:			/* get # bytes to read */
900 		mutex_spin_enter(&tty_lock);
901 		*(int *)data = ttnread(tp);
902 		mutex_spin_exit(&tty_lock);
903 		break;
904 	case FIONWRITE:			/* get # bytes to written & unsent */
905 		mutex_spin_enter(&tty_lock);
906 		*(int *)data = tp->t_outq.c_cc;
907 		mutex_spin_exit(&tty_lock);
908 		break;
909 	case FIONSPACE:			/* get # bytes to written & unsent */
910 		mutex_spin_enter(&tty_lock);
911 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
912 		mutex_spin_exit(&tty_lock);
913 		break;
914 	case TIOCEXCL:			/* set exclusive use of tty */
915 		mutex_spin_enter(&tty_lock);
916 		SET(tp->t_state, TS_XCLUDE);
917 		mutex_spin_exit(&tty_lock);
918 		break;
919 	case TIOCFLUSH: {		/* flush buffers */
920 		int flags = *(int *)data;
921 
922 		if (flags == 0)
923 			flags = FREAD | FWRITE;
924 		else
925 			flags &= FREAD | FWRITE;
926 		mutex_spin_enter(&tty_lock);
927 		ttyflush(tp, flags);
928 		mutex_spin_exit(&tty_lock);
929 		break;
930 	}
931 	case TIOCCONS:			/* become virtual console */
932 		if (*(int *)data) {
933 			if (constty && constty != tp &&
934 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
935 			    (TS_CARR_ON | TS_ISOPEN))
936 				return EBUSY;
937 
938 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
939 			    "/dev/console");
940 			if ((error = namei(&nd)) != 0)
941 				return error;
942 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
943 			vput(nd.ni_vp);
944 			if (error)
945 				return error;
946 
947 			constty = tp;
948 		} else if (tp == constty)
949 			constty = NULL;
950 		break;
951 	case TIOCDRAIN:			/* wait till output drained */
952 		if ((error = ttywait(tp)) != 0)
953 			return (error);
954 		break;
955 	case TIOCGETA: {		/* get termios struct */
956 		struct termios *t = (struct termios *)data;
957 
958 		memcpy(t, &tp->t_termios, sizeof(struct termios));
959 		break;
960 	}
961 	case TIOCGETD:			/* get line discipline (old) */
962 		*(int *)data = tp->t_linesw->l_no;
963 		break;
964 	case TIOCGLINED:		/* get line discipline (new) */
965 		(void)strncpy((char *)data, tp->t_linesw->l_name,
966 		    TTLINEDNAMELEN - 1);
967 		break;
968 	case TIOCGWINSZ:		/* get window size */
969 		*(struct winsize *)data = tp->t_winsize;
970 		break;
971 	case FIOGETOWN:
972 		mutex_enter(proc_lock);
973 		if (tp->t_session != NULL && !isctty(p, tp)) {
974 			mutex_exit(proc_lock);
975 			return (ENOTTY);
976 		}
977 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
978 		mutex_exit(proc_lock);
979 		break;
980 	case TIOCGPGRP:			/* get pgrp of tty */
981 		mutex_enter(proc_lock);
982 		if (!isctty(p, tp)) {
983 			mutex_exit(proc_lock);
984 			return (ENOTTY);
985 		}
986 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
987 		mutex_exit(proc_lock);
988 		break;
989 	case TIOCGSID:			/* get sid of tty */
990 		mutex_enter(proc_lock);
991 		if (!isctty(p, tp)) {
992 			mutex_exit(proc_lock);
993 			return (ENOTTY);
994 		}
995 		*(int *)data = tp->t_session->s_sid;
996 		mutex_exit(proc_lock);
997 		break;
998 #ifdef TIOCHPCL
999 	case TIOCHPCL:			/* hang up on last close */
1000 		mutex_spin_enter(&tty_lock);
1001 		SET(tp->t_cflag, HUPCL);
1002 		mutex_spin_exit(&tty_lock);
1003 		break;
1004 #endif
1005 	case TIOCNXCL:			/* reset exclusive use of tty */
1006 		mutex_spin_enter(&tty_lock);
1007 		CLR(tp->t_state, TS_XCLUDE);
1008 		mutex_spin_exit(&tty_lock);
1009 		break;
1010 	case TIOCOUTQ:			/* output queue size */
1011 		*(int *)data = tp->t_outq.c_cc;
1012 		break;
1013 	case TIOCSETA:			/* set termios struct */
1014 	case TIOCSETAW:			/* drain output, set */
1015 	case TIOCSETAF: {		/* drn out, fls in, set */
1016 		struct termios *t = (struct termios *)data;
1017 
1018 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1019 			if ((error = ttywait(tp)) != 0)
1020 				return (error);
1021 
1022 			if (cmd == TIOCSETAF) {
1023 				mutex_spin_enter(&tty_lock);
1024 				ttyflush(tp, FREAD);
1025 				mutex_spin_exit(&tty_lock);
1026 			}
1027 		}
1028 
1029 		s = spltty();
1030 		/*
1031 		 * XXXSMP - some drivers call back on us from t_param(), so
1032 		 *	    don't take the tty spin lock here.
1033 		 *	    require t_param() to unlock upon callback?
1034 		 */
1035 		/* wanted here: mutex_spin_enter(&tty_lock); */
1036 		if (!ISSET(t->c_cflag, CIGNORE)) {
1037 			/*
1038 			 * Set device hardware.
1039 			 */
1040 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1041 				/* wanted here: mutex_spin_exit(&tty_lock); */
1042 				splx(s);
1043 				return (error);
1044 			} else {
1045 				tp->t_cflag = t->c_cflag;
1046 				tp->t_ispeed = t->c_ispeed;
1047 				tp->t_ospeed = t->c_ospeed;
1048 				if (t->c_ospeed == 0)
1049 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1050 			}
1051 			ttsetwater(tp);
1052 		}
1053 
1054 		/* delayed lock acquiring */
1055 		mutex_spin_enter(&tty_lock);
1056 		if (cmd != TIOCSETAF) {
1057 			if (ISSET(t->c_lflag, ICANON) !=
1058 			    ISSET(tp->t_lflag, ICANON)) {
1059 				if (ISSET(t->c_lflag, ICANON)) {
1060 					SET(tp->t_lflag, PENDIN);
1061 					ttwakeup(tp);
1062 				} else {
1063 					struct clist tq;
1064 
1065 					catq(&tp->t_rawq, &tp->t_canq);
1066 					tq = tp->t_rawq;
1067 					tp->t_rawq = tp->t_canq;
1068 					tp->t_canq = tq;
1069 					CLR(tp->t_lflag, PENDIN);
1070 				}
1071 			}
1072 		}
1073 		tp->t_iflag = t->c_iflag;
1074 		tp->t_oflag = t->c_oflag;
1075 		/*
1076 		 * Make the EXTPROC bit read only.
1077 		 */
1078 		if (ISSET(tp->t_lflag, EXTPROC))
1079 			SET(t->c_lflag, EXTPROC);
1080 		else
1081 			CLR(t->c_lflag, EXTPROC);
1082 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1083 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1084 		mutex_spin_exit(&tty_lock);
1085 		splx(s);
1086 		break;
1087 	}
1088 	case TIOCSETD:			/* set line discipline (old) */
1089 		lp = ttyldisc_lookup_bynum(*(int *)data);
1090 		goto setldisc;
1091 
1092 	case TIOCSLINED: {		/* set line discipline (new) */
1093 		char *name = (char *)data;
1094 		dev_t device;
1095 
1096 		/* Null terminate to prevent buffer overflow */
1097 		name[TTLINEDNAMELEN - 1] = '\0';
1098 		lp = ttyldisc_lookup(name);
1099  setldisc:
1100 		if (lp == NULL)
1101 			return (ENXIO);
1102 
1103 		if (lp != tp->t_linesw) {
1104 			device = tp->t_dev;
1105 			s = spltty();
1106 			(*tp->t_linesw->l_close)(tp, flag);
1107 			error = (*lp->l_open)(device, tp);
1108 			if (error) {
1109 				(void)(*tp->t_linesw->l_open)(device, tp);
1110 				splx(s);
1111 				ttyldisc_release(lp);
1112 				return (error);
1113 			}
1114 			ttyldisc_release(tp->t_linesw);
1115 			tp->t_linesw = lp;
1116 			splx(s);
1117 		} else {
1118 			/* Drop extra reference. */
1119 			ttyldisc_release(lp);
1120 		}
1121 		break;
1122 	}
1123 	case TIOCSTART:			/* start output, like ^Q */
1124 		mutex_spin_enter(&tty_lock);
1125 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1126 		    ISSET(tp->t_lflag, FLUSHO)) {
1127 			CLR(tp->t_lflag, FLUSHO);
1128 			CLR(tp->t_state, TS_TTSTOP);
1129 			ttstart(tp);
1130 		}
1131 		mutex_spin_exit(&tty_lock);
1132 		break;
1133 	case TIOCSTI:			/* simulate terminal input */
1134 		if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_STI,
1135 		    tp) != 0) {
1136 			if (!ISSET(flag, FREAD))
1137 				return (EPERM);
1138 			if (!isctty(p, tp))
1139 				return (EACCES);
1140 		}
1141 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1142 		break;
1143 	case TIOCSTOP:			/* stop output, like ^S */
1144 	{
1145 		mutex_spin_enter(&tty_lock);
1146 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1147 			SET(tp->t_state, TS_TTSTOP);
1148 			cdev_stop(tp, 0);
1149 		}
1150 		mutex_spin_exit(&tty_lock);
1151 		break;
1152 	}
1153 	case TIOCSCTTY:			/* become controlling tty */
1154 		mutex_enter(proc_lock);
1155 		mutex_spin_enter(&tty_lock);
1156 
1157 		/* Session ctty vnode pointer set in vnode layer. */
1158 		if (!SESS_LEADER(p) ||
1159 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1160 		    (tp->t_session != p->p_session))) {
1161 			mutex_spin_exit(&tty_lock);
1162 			mutex_exit(proc_lock);
1163 			return (EPERM);
1164 		}
1165 
1166 		/*
1167 		 * `p_session' acquires a reference.
1168 		 * But note that if `t_session' is set at this point,
1169 		 * it must equal `p_session', in which case the session
1170 		 * already has the correct reference count.
1171 		 */
1172 		if (tp->t_session == NULL) {
1173 			proc_sesshold(p->p_session);
1174 		}
1175 		tp->t_session = p->p_session;
1176 		tp->t_pgrp = p->p_pgrp;
1177 		p->p_session->s_ttyp = tp;
1178 		p->p_lflag |= PL_CONTROLT;
1179 		mutex_spin_exit(&tty_lock);
1180 		mutex_exit(proc_lock);
1181 		break;
1182 	case FIOSETOWN: {		/* set pgrp of tty */
1183 		pid_t pgid = *(int *)data;
1184 		struct pgrp *pgrp;
1185 
1186 		mutex_enter(proc_lock);
1187 		if (tp->t_session != NULL && !isctty(p, tp)) {
1188 			mutex_exit(proc_lock);
1189 			return (ENOTTY);
1190 		}
1191 
1192 		if (pgid < 0) {
1193 			pgrp = pgrp_find(-pgid);
1194 			if (pgrp == NULL) {
1195 				mutex_exit(proc_lock);
1196 				return (EINVAL);
1197 			}
1198 		} else {
1199 			struct proc *p1;
1200 			p1 = proc_find(pgid);
1201 			if (!p1) {
1202 				mutex_exit(proc_lock);
1203 				return (ESRCH);
1204 			}
1205 			pgrp = p1->p_pgrp;
1206 		}
1207 
1208 		if (pgrp->pg_session != p->p_session) {
1209 			mutex_exit(proc_lock);
1210 			return (EPERM);
1211 		}
1212 		mutex_spin_enter(&tty_lock);
1213 		tp->t_pgrp = pgrp;
1214 		mutex_spin_exit(&tty_lock);
1215 		mutex_exit(proc_lock);
1216 		break;
1217 	}
1218 	case TIOCSPGRP: {		/* set pgrp of tty */
1219 		struct pgrp *pgrp;
1220 
1221 		mutex_enter(proc_lock);
1222 		if (!isctty(p, tp)) {
1223 			mutex_exit(proc_lock);
1224 			return (ENOTTY);
1225 		}
1226 		pgrp = pgrp_find(*(pid_t *)data);
1227 		if (pgrp == NULL) {
1228 			mutex_exit(proc_lock);
1229 			return (EINVAL);
1230 		}
1231 		if (pgrp->pg_session != p->p_session) {
1232 			mutex_exit(proc_lock);
1233 			return (EPERM);
1234 		}
1235 		mutex_spin_enter(&tty_lock);
1236 		tp->t_pgrp = pgrp;
1237 		mutex_spin_exit(&tty_lock);
1238 		mutex_exit(proc_lock);
1239 		break;
1240 	}
1241 	case TIOCSTAT:			/* get load avg stats */
1242 		mutex_enter(proc_lock);
1243 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1244 		mutex_exit(proc_lock);
1245 
1246 		mutex_spin_enter(&tty_lock);
1247 		ttyputinfo(tp, infobuf);
1248 		mutex_spin_exit(&tty_lock);
1249 		break;
1250 	case TIOCSWINSZ:		/* set window size */
1251 		mutex_spin_enter(&tty_lock);
1252 		if (memcmp((void *)&tp->t_winsize, data,
1253 		    sizeof(struct winsize))) {
1254 			tp->t_winsize = *(struct winsize *)data;
1255 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1256 		}
1257 		mutex_spin_exit(&tty_lock);
1258 		break;
1259 	default:
1260 		/* We may have to load the compat module for this. */
1261 		for (;;) {
1262 			rw_enter(&ttcompat_lock, RW_READER);
1263 			if (ttcompatvec != NULL) {
1264 				break;
1265 			}
1266 			rw_exit(&ttcompat_lock);
1267 			mutex_enter(&module_lock);
1268 			(void)module_autoload("compat", MODULE_CLASS_ANY);
1269 			if (ttcompatvec == NULL) {
1270 				mutex_exit(&module_lock);
1271 				return EPASSTHROUGH;
1272 			}
1273 			mutex_exit(&module_lock);
1274 		}
1275 		error = (*ttcompatvec)(tp, cmd, data, flag, l);
1276 		rw_exit(&ttcompat_lock);
1277 		return error;
1278 	}
1279 	return (0);
1280 }
1281 
1282 int
1283 ttpoll(struct tty *tp, int events, struct lwp *l)
1284 {
1285 	int	revents;
1286 
1287 	revents = 0;
1288 	mutex_spin_enter(&tty_lock);
1289 	if (events & (POLLIN | POLLRDNORM))
1290 		if (ttnread(tp) > 0)
1291 			revents |= events & (POLLIN | POLLRDNORM);
1292 
1293 	if (events & (POLLOUT | POLLWRNORM))
1294 		if (tp->t_outq.c_cc <= tp->t_lowat)
1295 			revents |= events & (POLLOUT | POLLWRNORM);
1296 
1297 	if (events & POLLHUP)
1298 		if (!CONNECTED(tp))
1299 			revents |= POLLHUP;
1300 
1301 	if (revents == 0) {
1302 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1303 			selrecord(l, &tp->t_rsel);
1304 
1305 		if (events & (POLLOUT | POLLWRNORM))
1306 			selrecord(l, &tp->t_wsel);
1307 	}
1308 
1309 	mutex_spin_exit(&tty_lock);
1310 
1311 	return (revents);
1312 }
1313 
1314 static void
1315 filt_ttyrdetach(struct knote *kn)
1316 {
1317 	struct tty	*tp;
1318 
1319 	tp = kn->kn_hook;
1320 	mutex_spin_enter(&tty_lock);
1321 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1322 	mutex_spin_exit(&tty_lock);
1323 }
1324 
1325 static int
1326 filt_ttyread(struct knote *kn, long hint)
1327 {
1328 	struct tty	*tp;
1329 
1330 	tp = kn->kn_hook;
1331 	if ((hint & NOTE_SUBMIT) == 0)
1332 		mutex_spin_enter(&tty_lock);
1333 	kn->kn_data = ttnread(tp);
1334 	if ((hint & NOTE_SUBMIT) == 0)
1335 		mutex_spin_exit(&tty_lock);
1336 	return (kn->kn_data > 0);
1337 }
1338 
1339 static void
1340 filt_ttywdetach(struct knote *kn)
1341 {
1342 	struct tty	*tp;
1343 
1344 	tp = kn->kn_hook;
1345 	mutex_spin_enter(&tty_lock);
1346 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1347 	mutex_spin_exit(&tty_lock);
1348 }
1349 
1350 static int
1351 filt_ttywrite(struct knote *kn, long hint)
1352 {
1353 	struct tty	*tp;
1354 	int		canwrite;
1355 
1356 	tp = kn->kn_hook;
1357 	if ((hint & NOTE_SUBMIT) == 0)
1358 		mutex_spin_enter(&tty_lock);
1359 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1360 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1361 	if ((hint & NOTE_SUBMIT) == 0)
1362 		mutex_spin_exit(&tty_lock);
1363 	return (canwrite);
1364 }
1365 
1366 static const struct filterops ttyread_filtops =
1367 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1368 static const struct filterops ttywrite_filtops =
1369 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1370 
1371 int
1372 ttykqfilter(dev_t dev, struct knote *kn)
1373 {
1374 	struct tty	*tp;
1375 	struct klist	*klist;
1376 
1377 	if ((tp = cdev_tty(dev)) == NULL)
1378 		return (ENXIO);
1379 
1380 	switch (kn->kn_filter) {
1381 	case EVFILT_READ:
1382 		klist = &tp->t_rsel.sel_klist;
1383 		kn->kn_fop = &ttyread_filtops;
1384 		break;
1385 	case EVFILT_WRITE:
1386 		klist = &tp->t_wsel.sel_klist;
1387 		kn->kn_fop = &ttywrite_filtops;
1388 		break;
1389 	default:
1390 		return EINVAL;
1391 	}
1392 
1393 	kn->kn_hook = tp;
1394 
1395 	mutex_spin_enter(&tty_lock);
1396 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1397 	mutex_spin_exit(&tty_lock);
1398 
1399 	return (0);
1400 }
1401 
1402 /*
1403  * Find the number of chars ready to be read from this tty.
1404  * Call with the tty lock held.
1405  */
1406 static int
1407 ttnread(struct tty *tp)
1408 {
1409 	int	nread;
1410 
1411 	KASSERT(mutex_owned(&tty_lock));
1412 
1413 	if (ISSET(tp->t_lflag, PENDIN))
1414 		ttypend(tp);
1415 	nread = tp->t_canq.c_cc;
1416 	if (!ISSET(tp->t_lflag, ICANON)) {
1417 		nread += tp->t_rawq.c_cc;
1418 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1419 			nread = 0;
1420 	}
1421 	return (nread);
1422 }
1423 
1424 /*
1425  * Wait for output to drain.
1426  */
1427 int
1428 ttywait(struct tty *tp)
1429 {
1430 	int	error;
1431 
1432 	error = 0;
1433 
1434 	mutex_spin_enter(&tty_lock);
1435 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1436 	    CONNECTED(tp) && tp->t_oproc) {
1437 		(*tp->t_oproc)(tp);
1438 		error = ttysleep(tp, &tp->t_outcv, true, 0);
1439 		if (error)
1440 			break;
1441 	}
1442 	mutex_spin_exit(&tty_lock);
1443 
1444 	return (error);
1445 }
1446 
1447 /*
1448  * Flush if successfully wait.
1449  */
1450 int
1451 ttywflush(struct tty *tp)
1452 {
1453 	int	error;
1454 
1455 	if ((error = ttywait(tp)) == 0) {
1456 		mutex_spin_enter(&tty_lock);
1457 		ttyflush(tp, FREAD);
1458 		mutex_spin_exit(&tty_lock);
1459 	}
1460 	return (error);
1461 }
1462 
1463 /*
1464  * Flush tty read and/or write queues, notifying anyone waiting.
1465  * Call with the tty lock held.
1466  */
1467 void
1468 ttyflush(struct tty *tp, int rw)
1469 {
1470 
1471 	KASSERT(mutex_owned(&tty_lock));
1472 
1473 	if (rw & FREAD) {
1474 		FLUSHQ(&tp->t_canq);
1475 		FLUSHQ(&tp->t_rawq);
1476 		tp->t_rocount = 0;
1477 		tp->t_rocol = 0;
1478 		CLR(tp->t_state, TS_LOCAL);
1479 		ttwakeup(tp);
1480 	}
1481 	if (rw & FWRITE) {
1482 		CLR(tp->t_state, TS_TTSTOP);
1483 		cdev_stop(tp, rw);
1484 		FLUSHQ(&tp->t_outq);
1485 		cv_broadcast(&tp->t_outcv);
1486 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1487 	}
1488 }
1489 
1490 /*
1491  * Copy in the default termios characters.
1492  */
1493 void
1494 ttychars(struct tty *tp)
1495 {
1496 
1497 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1498 }
1499 
1500 /*
1501  * Send stop character on input overflow.
1502  * Call with the tty lock held.
1503  */
1504 static void
1505 ttyblock(struct tty *tp)
1506 {
1507 	int	total;
1508 
1509 	KASSERT(mutex_owned(&tty_lock));
1510 
1511 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1512 	if (tp->t_rawq.c_cc > TTYHOG) {
1513 		ttyflush(tp, FREAD | FWRITE);
1514 		CLR(tp->t_state, TS_TBLOCK);
1515 	}
1516 	/*
1517 	 * Block further input iff: current input > threshold
1518 	 * AND input is available to user program.
1519 	 */
1520 	if (total >= TTYHOG / 2 &&
1521 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1522 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1523 		if (ISSET(tp->t_iflag, IXOFF) &&
1524 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1525 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1526 			SET(tp->t_state, TS_TBLOCK);
1527 			ttstart(tp);
1528 		}
1529 		/* Try to block remote output via hardware flow control. */
1530 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1531 		    (*tp->t_hwiflow)(tp, 1) != 0)
1532 			SET(tp->t_state, TS_TBLOCK);
1533 	}
1534 }
1535 
1536 /*
1537  * Delayed line discipline output
1538  */
1539 void
1540 ttrstrt(void *tp_arg)
1541 {
1542 	struct tty	*tp;
1543 
1544 #ifdef DIAGNOSTIC
1545 	if (tp_arg == NULL)
1546 		panic("ttrstrt");
1547 #endif
1548 	tp = tp_arg;
1549 	mutex_spin_enter(&tty_lock);
1550 
1551 	CLR(tp->t_state, TS_TIMEOUT);
1552 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1553 
1554 	mutex_spin_exit(&tty_lock);
1555 }
1556 
1557 /*
1558  * start a line discipline
1559  * Always call with tty lock held?
1560  */
1561 int
1562 ttstart(struct tty *tp)
1563 {
1564 
1565 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1566 		(*tp->t_oproc)(tp);
1567 	return (0);
1568 }
1569 
1570 /*
1571  * "close" a line discipline
1572  */
1573 int
1574 ttylclose(struct tty *tp, int flag)
1575 {
1576 
1577 	if (flag & FNONBLOCK) {
1578 		mutex_spin_enter(&tty_lock);
1579 		ttyflush(tp, FREAD | FWRITE);
1580 		mutex_spin_exit(&tty_lock);
1581 	} else
1582 		ttywflush(tp);
1583 	return (0);
1584 }
1585 
1586 /*
1587  * Handle modem control transition on a tty.
1588  * Flag indicates new state of carrier.
1589  * Returns 0 if the line should be turned off, otherwise 1.
1590  */
1591 int
1592 ttymodem(struct tty *tp, int flag)
1593 {
1594 
1595 	mutex_spin_enter(&tty_lock);
1596 	if (flag == 0) {
1597 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1598 			/*
1599 			 * Lost carrier.
1600 			 */
1601 			CLR(tp->t_state, TS_CARR_ON);
1602 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1603 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1604 				ttyflush(tp, FREAD | FWRITE);
1605 				mutex_spin_exit(&tty_lock);
1606 				return (0);
1607 			}
1608 		}
1609 	} else {
1610 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1611 			/*
1612 			 * Carrier now on.
1613 			 */
1614 			SET(tp->t_state, TS_CARR_ON);
1615 			ttwakeup(tp);
1616 		}
1617 	}
1618 	mutex_spin_exit(&tty_lock);
1619 
1620 	return (1);
1621 }
1622 
1623 /*
1624  * Default modem control routine (for other line disciplines).
1625  * Return argument flag, to turn off device on carrier drop.
1626  */
1627 int
1628 nullmodem(struct tty *tp, int flag)
1629 {
1630 
1631 	mutex_spin_enter(&tty_lock);
1632 	if (flag)
1633 		SET(tp->t_state, TS_CARR_ON);
1634 	else {
1635 		CLR(tp->t_state, TS_CARR_ON);
1636 		if (!CONNECTED(tp)) {
1637 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1638 			mutex_spin_exit(&tty_lock);
1639 			return (0);
1640 		}
1641 	}
1642 	mutex_spin_exit(&tty_lock);
1643 
1644 	return (1);
1645 }
1646 
1647 /*
1648  * Reinput pending characters after state switch.
1649  */
1650 void
1651 ttypend(struct tty *tp)
1652 {
1653 	struct clist	tq;
1654 	int		c;
1655 
1656 	KASSERT(mutex_owned(&tty_lock));
1657 
1658 	CLR(tp->t_lflag, PENDIN);
1659 	SET(tp->t_state, TS_TYPEN);
1660 	tq = tp->t_rawq;
1661 	tp->t_rawq.c_cc = 0;
1662 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1663 	while ((c = getc(&tq)) >= 0)
1664 		ttyinput_wlock(c, tp);
1665 	CLR(tp->t_state, TS_TYPEN);
1666 }
1667 
1668 /*
1669  * Process a read call on a tty device.
1670  */
1671 int
1672 ttread(struct tty *tp, struct uio *uio, int flag)
1673 {
1674 	struct clist	*qp;
1675 	u_char		*cc;
1676 	struct proc	*p;
1677 	int		c, first, error, has_stime, last_cc;
1678 	long		lflag, slp;
1679 	struct timeval	now, stime;
1680 
1681 	if (uio->uio_resid == 0)
1682 		return 0;
1683 
1684 	stime.tv_usec = 0;	/* XXX gcc */
1685 	stime.tv_sec = 0;	/* XXX gcc */
1686 
1687 	cc = tp->t_cc;
1688 	p = curproc;
1689 	error = 0;
1690 	has_stime = 0;
1691 	last_cc = 0;
1692 	slp = 0;
1693 
1694  loop:
1695 	mutex_spin_enter(&tty_lock);
1696 	lflag = tp->t_lflag;
1697 	/*
1698 	 * take pending input first
1699 	 */
1700 	if (ISSET(lflag, PENDIN))
1701 		ttypend(tp);
1702 
1703 	/*
1704 	 * Hang process if it's in the background.
1705 	 */
1706 	if (isbackground(p, tp)) {
1707 		if (sigismasked(curlwp, SIGTTIN) ||
1708 		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1709 			mutex_spin_exit(&tty_lock);
1710 			return (EIO);
1711 		}
1712 		mutex_spin_exit(&tty_lock);
1713 
1714 		mutex_enter(proc_lock);
1715 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1716 		mutex_exit(proc_lock);
1717 
1718 		mutex_spin_enter(&tty_lock);
1719 		error = ttysleep(tp, &lbolt, true, 0);
1720 		mutex_spin_exit(&tty_lock);
1721 		if (error)
1722 			return (error);
1723 		goto loop;
1724 	}
1725 
1726 	if (!ISSET(lflag, ICANON)) {
1727 		int m = cc[VMIN];
1728 		long t = cc[VTIME];
1729 
1730 		qp = &tp->t_rawq;
1731 		/*
1732 		 * Check each of the four combinations.
1733 		 * (m > 0 && t == 0) is the normal read case.
1734 		 * It should be fairly efficient, so we check that and its
1735 		 * companion case (m == 0 && t == 0) first.
1736 		 * For the other two cases, we compute the target sleep time
1737 		 * into slp.
1738 		 */
1739 		if (t == 0) {
1740 			if (qp->c_cc < m)
1741 				goto sleep;
1742 			goto read;
1743 		}
1744 		t *= hz;		/* time in deca-ticks */
1745 /*
1746  * Time difference in deca-ticks, split division to avoid numeric overflow.
1747  * Ok for hz < ~200kHz
1748  */
1749 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1750 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1751 		if (m > 0) {
1752 			if (qp->c_cc <= 0)
1753 				goto sleep;
1754 			if (qp->c_cc >= m)
1755 				goto read;
1756 			if (!has_stime) {
1757 				/* first character, start timer */
1758 				has_stime = 1;
1759 				getmicrotime(&stime);
1760 				slp = t;
1761 			} else if (qp->c_cc > last_cc) {
1762 				/* got a character, restart timer */
1763 				getmicrotime(&stime);
1764 				slp = t;
1765 			} else {
1766 				/* nothing, check expiration */
1767 				getmicrotime(&now);
1768 				slp = t - diff(now, stime);
1769 			}
1770 		} else {	/* m == 0 */
1771 			if (qp->c_cc > 0)
1772 				goto read;
1773 			if (!has_stime) {
1774 				has_stime = 1;
1775 				getmicrotime(&stime);
1776 				slp = t;
1777 			} else {
1778 				getmicrotime(&now);
1779 				slp = t - diff(now, stime);
1780 			}
1781 		}
1782 		last_cc = qp->c_cc;
1783 #undef diff
1784 		if (slp > 0) {
1785 			/*
1786 			 * Convert deca-ticks back to ticks.
1787 			 * Rounding down may make us wake up just short
1788 			 * of the target, so we round up.
1789 			 * Maybe we should do 'slp/10 + 1' because the
1790 			 * first tick maybe almost immediate.
1791 			 * However it is more useful for a program that sets
1792 			 * VTIME=10 to wakeup every second not every 1.01
1793 			 * seconds (if hz=100).
1794 			 */
1795 			slp = (slp + 9)/ 10;
1796 			goto sleep;
1797 		}
1798 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1799 		int	carrier;
1800 
1801  sleep:
1802 		/*
1803 		 * If there is no input, sleep on rawq
1804 		 * awaiting hardware receipt and notification.
1805 		 * If we have data, we don't need to check for carrier.
1806 		 */
1807 		carrier = CONNECTED(tp);
1808 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1809 			mutex_spin_exit(&tty_lock);
1810 			return (0);	/* EOF */
1811 		}
1812 		if (!has_stime || slp <= 0) {
1813 			if (flag & IO_NDELAY) {
1814 				mutex_spin_exit(&tty_lock);
1815 				return (EWOULDBLOCK);
1816 			}
1817 		}
1818 		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1819 		mutex_spin_exit(&tty_lock);
1820 		/* VMIN == 0: any quantity read satisfies */
1821 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1822 			return (0);
1823 		if (error && error != EWOULDBLOCK)
1824 			return (error);
1825 		goto loop;
1826 	}
1827  read:
1828 	mutex_spin_exit(&tty_lock);
1829 
1830 	/*
1831 	 * Input present, check for input mapping and processing.
1832 	 */
1833 	first = 1;
1834 	while ((c = getc(qp)) >= 0) {
1835 		/*
1836 		 * delayed suspend (^Y)
1837 		 */
1838 		if (CCEQ(cc[VDSUSP], c) &&
1839 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
1840 			mutex_spin_enter(&tty_lock);
1841 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
1842 			if (first) {
1843 				error = ttysleep(tp, &lbolt, true, 0);
1844 				mutex_spin_exit(&tty_lock);
1845 				if (error)
1846 					break;
1847 				goto loop;
1848 			} else
1849 				mutex_spin_exit(&tty_lock);
1850 			break;
1851 		}
1852 		/*
1853 		 * Interpret EOF only in canonical mode.
1854 		 */
1855 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1856 			break;
1857 		/*
1858 		 * Give user character.
1859 		 */
1860  		error = ureadc(c, uio);
1861 		if (error)
1862 			break;
1863  		if (uio->uio_resid == 0)
1864 			break;
1865 		/*
1866 		 * In canonical mode check for a "break character"
1867 		 * marking the end of a "line of input".
1868 		 */
1869 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1870 			break;
1871 		first = 0;
1872 	}
1873 	/*
1874 	 * Look to unblock output now that (presumably)
1875 	 * the input queue has gone down.
1876 	 */
1877 	mutex_spin_enter(&tty_lock);
1878 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
1879 		if (ISSET(tp->t_iflag, IXOFF) &&
1880 		    cc[VSTART] != _POSIX_VDISABLE &&
1881 		    putc(cc[VSTART], &tp->t_outq) == 0) {
1882 			CLR(tp->t_state, TS_TBLOCK);
1883 			ttstart(tp);
1884 		}
1885 		/* Try to unblock remote output via hardware flow control. */
1886 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1887 		    (*tp->t_hwiflow)(tp, 0) != 0)
1888 			CLR(tp->t_state, TS_TBLOCK);
1889 	}
1890 	mutex_spin_exit(&tty_lock);
1891 
1892 	return (error);
1893 }
1894 
1895 /*
1896  * Check the output queue on tp for space for a kernel message (from uprintf
1897  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1898  * lose messages due to normal flow control, but don't let the tty run amok.
1899  * Sleeps here are not interruptible, but we return prematurely if new signals
1900  * arrive.
1901  * Call with tty lock held.
1902  */
1903 static int
1904 ttycheckoutq_wlock(struct tty *tp, int wait)
1905 {
1906 	int	hiwat, error;
1907 
1908 	KASSERT(mutex_owned(&tty_lock));
1909 
1910 	hiwat = tp->t_hiwat;
1911 	if (tp->t_outq.c_cc > hiwat + 200)
1912 		while (tp->t_outq.c_cc > hiwat) {
1913 			ttstart(tp);
1914 			if (wait == 0)
1915 				return (0);
1916 			error = ttysleep(tp, &tp->t_outcv, true, hz);
1917 			if (error == EINTR)
1918 				wait = 0;
1919 		}
1920 
1921 	return (1);
1922 }
1923 
1924 int
1925 ttycheckoutq(struct tty *tp, int wait)
1926 {
1927 	int	r;
1928 
1929 	mutex_spin_enter(&tty_lock);
1930 	r = ttycheckoutq_wlock(tp, wait);
1931 	mutex_spin_exit(&tty_lock);
1932 
1933 	return (r);
1934 }
1935 
1936 /*
1937  * Process a write call on a tty device.
1938  */
1939 int
1940 ttwrite(struct tty *tp, struct uio *uio, int flag)
1941 {
1942 	u_char		*cp;
1943 	struct proc	*p;
1944 	int		cc, ce, i, hiwat, error;
1945 	u_char		obuf[OBUFSIZ];
1946 
1947 	cp = NULL;
1948 	hiwat = tp->t_hiwat;
1949 	error = 0;
1950 	cc = 0;
1951  loop:
1952 	mutex_spin_enter(&tty_lock);
1953 	if (!CONNECTED(tp)) {
1954 		if (ISSET(tp->t_state, TS_ISOPEN)) {
1955 			mutex_spin_exit(&tty_lock);
1956 			return (EIO);
1957 		} else if (flag & IO_NDELAY) {
1958 			mutex_spin_exit(&tty_lock);
1959 			error = EWOULDBLOCK;
1960 			goto out;
1961 		} else {
1962 			/* Sleep awaiting carrier. */
1963 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
1964 			mutex_spin_exit(&tty_lock);
1965 			if (error)
1966 				goto out;
1967 			goto loop;
1968 		}
1969 	}
1970 
1971 	/*
1972 	 * Hang the process if it's in the background.
1973 	 */
1974 	p = curproc;
1975 	if (isbackground(p, tp) &&
1976 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
1977 	    !sigismasked(curlwp, SIGTTOU)) {
1978 		if (p->p_pgrp->pg_jobc == 0) {
1979 			error = EIO;
1980 			mutex_spin_exit(&tty_lock);
1981 			goto out;
1982 		}
1983 		mutex_spin_exit(&tty_lock);
1984 
1985 		mutex_enter(proc_lock);
1986 		pgsignal(p->p_pgrp, SIGTTOU, 1);
1987 		mutex_exit(proc_lock);
1988 
1989 		mutex_spin_enter(&tty_lock);
1990 		error = ttysleep(tp, &lbolt, true, 0);
1991 		mutex_spin_exit(&tty_lock);
1992 		if (error)
1993 			goto out;
1994 		goto loop;
1995 	}
1996 	mutex_spin_exit(&tty_lock);
1997 
1998 	/*
1999 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2000 	 * output translation.  Keep track of high water mark, sleep on
2001 	 * overflow awaiting device aid in acquiring new space.
2002 	 */
2003 	while (uio->uio_resid > 0 || cc > 0) {
2004 		if (ISSET(tp->t_lflag, FLUSHO)) {
2005 			uio->uio_resid = 0;
2006 			return (0);
2007 		}
2008 		if (tp->t_outq.c_cc > hiwat)
2009 			goto ovhiwat;
2010 		/*
2011 		 * Grab a hunk of data from the user, unless we have some
2012 		 * leftover from last time.
2013 		 */
2014 		if (cc == 0) {
2015 			cc = min(uio->uio_resid, OBUFSIZ);
2016 			cp = obuf;
2017 			error = uiomove(cp, cc, uio);
2018 			if (error) {
2019 				cc = 0;
2020 				goto out;
2021 			}
2022 		}
2023 		/*
2024 		 * If nothing fancy need be done, grab those characters we
2025 		 * can handle without any of ttyoutput's processing and
2026 		 * just transfer them to the output q.  For those chars
2027 		 * which require special processing (as indicated by the
2028 		 * bits in char_type), call ttyoutput.  After processing
2029 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2030 		 * immediately.
2031 		 */
2032 		mutex_spin_enter(&tty_lock);
2033 		while (cc > 0) {
2034 			if (!ISSET(tp->t_oflag, OPOST))
2035 				ce = cc;
2036 			else {
2037 				ce = cc - scanc((u_int)cc, cp, char_type,
2038 				    CCLASSMASK);
2039 				/*
2040 				 * If ce is zero, then we're processing
2041 				 * a special character through ttyoutput.
2042 				 */
2043 				if (ce == 0) {
2044 					tp->t_rocount = 0;
2045 					if (ttyoutput(*cp, tp) >= 0) {
2046 						/* out of space */
2047 						mutex_spin_exit(&tty_lock);
2048 						goto overfull;
2049 					}
2050 					cp++;
2051 					cc--;
2052 					if (ISSET(tp->t_lflag, FLUSHO) ||
2053 					    tp->t_outq.c_cc > hiwat) {
2054 						mutex_spin_exit(&tty_lock);
2055 						goto ovhiwat;
2056 					}
2057 					continue;
2058 				}
2059 			}
2060 			/*
2061 			 * A bunch of normal characters have been found.
2062 			 * Transfer them en masse to the output queue and
2063 			 * continue processing at the top of the loop.
2064 			 * If there are any further characters in this
2065 			 * <= OBUFSIZ chunk, the first should be a character
2066 			 * requiring special handling by ttyoutput.
2067 			 */
2068 			tp->t_rocount = 0;
2069 			i = b_to_q(cp, ce, &tp->t_outq);
2070 			ce -= i;
2071 			tp->t_column += ce;
2072 			cp += ce, cc -= ce, tk_nout += ce;
2073 			tp->t_outcc += ce;
2074 			if (i > 0) {
2075 				/* out of space */
2076 				mutex_spin_exit(&tty_lock);
2077 				goto overfull;
2078 			}
2079 			if (ISSET(tp->t_lflag, FLUSHO) ||
2080 			    tp->t_outq.c_cc > hiwat)
2081 				break;
2082 		}
2083 		ttstart(tp);
2084 		mutex_spin_exit(&tty_lock);
2085 	}
2086 
2087  out:
2088 	/*
2089 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2090 	 * offset and iov pointers have moved forward, but it doesn't matter
2091 	 * (the call will either return short or restart with a new uio).
2092 	 */
2093 	uio->uio_resid += cc;
2094 	return (error);
2095 
2096  overfull:
2097 	/*
2098 	 * Since we are using ring buffers, if we can't insert any more into
2099 	 * the output queue, we can assume the ring is full and that someone
2100 	 * forgot to set the high water mark correctly.  We set it and then
2101 	 * proceed as normal.
2102 	 */
2103 	hiwat = tp->t_outq.c_cc - 1;
2104 
2105  ovhiwat:
2106 	mutex_spin_enter(&tty_lock);
2107 	ttstart(tp);
2108 	/*
2109 	 * This can only occur if FLUSHO is set in t_lflag,
2110 	 * or if ttstart/oproc is synchronous (or very fast).
2111 	 */
2112 	if (tp->t_outq.c_cc <= hiwat) {
2113 		mutex_spin_exit(&tty_lock);
2114 		goto loop;
2115 	}
2116 	if (flag & IO_NDELAY) {
2117 		mutex_spin_exit(&tty_lock);
2118 		error = EWOULDBLOCK;
2119 		goto out;
2120 	}
2121 	error = ttysleep(tp, &tp->t_outcv, true, 0);
2122 	mutex_spin_exit(&tty_lock);
2123 	if (error)
2124 		goto out;
2125 	goto loop;
2126 }
2127 
2128 /*
2129  * Try to pull more output from the producer.  Return non-zero if
2130  * there is output ready to be sent.
2131  */
2132 bool
2133 ttypull(struct tty *tp)
2134 {
2135 
2136 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2137 
2138 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2139 		cv_broadcast(&tp->t_outcv);
2140 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2141 	}
2142 	return tp->t_outq.c_cc != 0;
2143 }
2144 
2145 /*
2146  * Rubout one character from the rawq of tp
2147  * as cleanly as possible.
2148  * Called with tty lock held.
2149  */
2150 void
2151 ttyrub(int c, struct tty *tp)
2152 {
2153 	u_char	*cp;
2154 	int	savecol, tabc;
2155 
2156 	KASSERT(mutex_owned(&tty_lock));
2157 
2158 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2159 		return;
2160 	CLR(tp->t_lflag, FLUSHO);
2161 	if (ISSET(tp->t_lflag, ECHOE)) {
2162 		if (tp->t_rocount == 0) {
2163 			/*
2164 			 * Screwed by ttwrite; retype
2165 			 */
2166 			ttyretype(tp);
2167 			return;
2168 		}
2169 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2170 			ttyrubo(tp, 2);
2171 		else {
2172 			CLR(c, ~TTY_CHARMASK);
2173 			switch (CCLASS(c)) {
2174 			case ORDINARY:
2175 				ttyrubo(tp, 1);
2176 				break;
2177 			case BACKSPACE:
2178 			case CONTROL:
2179 			case NEWLINE:
2180 			case RETURN:
2181 			case VTAB:
2182 				if (ISSET(tp->t_lflag, ECHOCTL))
2183 					ttyrubo(tp, 2);
2184 				break;
2185 			case TAB:
2186 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2187 					ttyretype(tp);
2188 					return;
2189 				}
2190 				savecol = tp->t_column;
2191 				SET(tp->t_state, TS_CNTTB);
2192 				SET(tp->t_lflag, FLUSHO);
2193 				tp->t_column = tp->t_rocol;
2194 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2195 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2196 					ttyecho(tabc, tp);
2197 				CLR(tp->t_lflag, FLUSHO);
2198 				CLR(tp->t_state, TS_CNTTB);
2199 
2200 				/* savecol will now be length of the tab. */
2201 				savecol -= tp->t_column;
2202 				tp->t_column += savecol;
2203 				if (savecol > 8)
2204 					savecol = 8;	/* overflow screw */
2205 				while (--savecol >= 0)
2206 					(void)ttyoutput('\b', tp);
2207 				break;
2208 			default:			/* XXX */
2209 				(void)printf("ttyrub: would panic c = %d, "
2210 				    "val = %d\n", c, CCLASS(c));
2211 			}
2212 		}
2213 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2214 		if (!ISSET(tp->t_state, TS_ERASE)) {
2215 			SET(tp->t_state, TS_ERASE);
2216 			(void)ttyoutput('\\', tp);
2217 		}
2218 		ttyecho(c, tp);
2219 	} else
2220 		ttyecho(tp->t_cc[VERASE], tp);
2221 	--tp->t_rocount;
2222 }
2223 
2224 /*
2225  * Back over cnt characters, erasing them.
2226  * Called with tty lock held.
2227  */
2228 static void
2229 ttyrubo(struct tty *tp, int cnt)
2230 {
2231 
2232 	KASSERT(mutex_owned(&tty_lock));
2233 
2234 	while (cnt-- > 0) {
2235 		(void)ttyoutput('\b', tp);
2236 		(void)ttyoutput(' ', tp);
2237 		(void)ttyoutput('\b', tp);
2238 	}
2239 }
2240 
2241 /*
2242  * ttyretype --
2243  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2244  *	been checked.
2245  *
2246  * Called with tty lock held.
2247  */
2248 void
2249 ttyretype(struct tty *tp)
2250 {
2251 	u_char	*cp;
2252 	int	c;
2253 
2254 	KASSERT(mutex_owned(&tty_lock));
2255 
2256 	/* Echo the reprint character. */
2257 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2258 		ttyecho(tp->t_cc[VREPRINT], tp);
2259 
2260 	(void)ttyoutput('\n', tp);
2261 
2262 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2263 		ttyecho(c, tp);
2264 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2265 		ttyecho(c, tp);
2266 	CLR(tp->t_state, TS_ERASE);
2267 
2268 	tp->t_rocount = tp->t_rawq.c_cc;
2269 	tp->t_rocol = 0;
2270 }
2271 
2272 /*
2273  * Echo a typed character to the terminal.
2274  * Called with tty lock held.
2275  */
2276 static void
2277 ttyecho(int c, struct tty *tp)
2278 {
2279 
2280 	KASSERT(mutex_owned(&tty_lock));
2281 
2282 	if (!ISSET(tp->t_state, TS_CNTTB))
2283 		CLR(tp->t_lflag, FLUSHO);
2284 	if ((!ISSET(tp->t_lflag, ECHO) &&
2285 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2286 	    ISSET(tp->t_lflag, EXTPROC))
2287 		return;
2288 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2289 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2290 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2291 		(void)ttyoutput('^', tp);
2292 		CLR(c, ~TTY_CHARMASK);
2293 		if (c == 0177)
2294 			c = '?';
2295 		else
2296 			c += 'A' - 1;
2297 	}
2298 	(void)ttyoutput(c, tp);
2299 }
2300 
2301 /*
2302  * Wake up any readers on a tty.
2303  * Called with tty lock held.
2304  */
2305 void
2306 ttwakeup(struct tty *tp)
2307 {
2308 
2309 	KASSERT(mutex_owned(&tty_lock));
2310 
2311 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2312 	if (ISSET(tp->t_state, TS_ASYNC))
2313 		ttysig(tp, TTYSIG_PG2, SIGIO);
2314 	cv_broadcast(&tp->t_rawcv);
2315 }
2316 
2317 /*
2318  * Look up a code for a specified speed in a conversion table;
2319  * used by drivers to map software speed values to hardware parameters.
2320  */
2321 int
2322 ttspeedtab(int speed, const struct speedtab *table)
2323 {
2324 
2325 	for (; table->sp_speed != -1; table++)
2326 		if (table->sp_speed == speed)
2327 			return (table->sp_code);
2328 	return (-1);
2329 }
2330 
2331 /*
2332  * Set tty hi and low water marks.
2333  *
2334  * Try to arrange the dynamics so there's about one second
2335  * from hi to low water.
2336  */
2337 void
2338 ttsetwater(struct tty *tp)
2339 {
2340 	int	cps, x;
2341 
2342 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2343 
2344 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2345 
2346 	cps = tp->t_ospeed / 10;
2347 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2348 	x += cps;
2349 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2350 	tp->t_hiwat = roundup(x, CBSIZE);
2351 #undef	CLAMP
2352 }
2353 
2354 /*
2355  * Prepare report on state of foreground process group.
2356  * Call with proc_lock held.
2357  */
2358 void
2359 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2360 {
2361 	struct lwp	*l;
2362 	struct proc	*p, *pick = NULL;
2363 	struct timeval	utime, stime;
2364 	int		tmp;
2365 	fixpt_t		pctcpu = 0;
2366 	const char	*msg;
2367 	char		lmsg[100];
2368 	long		rss;
2369 
2370 	KASSERT(mutex_owned(proc_lock));
2371 
2372 	*buf = '\0';
2373 
2374 	if (tp->t_session == NULL)
2375 		msg = "not a controlling terminal\n";
2376 	else if (tp->t_pgrp == NULL)
2377 		msg = "no foreground process group\n";
2378 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2379 		msg = "empty foreground process group\n";
2380 	else {
2381 		/* Pick interesting process. */
2382 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2383 			struct proc *oldpick;
2384 
2385 			if (pick == NULL) {
2386 				pick = p;
2387 				continue;
2388 			}
2389 			if (pick->p_lock < p->p_lock) {
2390 				mutex_enter(pick->p_lock);
2391 				mutex_enter(p->p_lock);
2392 			} else if (pick->p_lock > p->p_lock) {
2393 				mutex_enter(p->p_lock);
2394 				mutex_enter(pick->p_lock);
2395 			} else
2396 				mutex_enter(p->p_lock);
2397 			oldpick = pick;
2398 			if (proc_compare(pick, p))
2399 				pick = p;
2400 			mutex_exit(p->p_lock);
2401 			if (p->p_lock != oldpick->p_lock)
2402 				mutex_exit(oldpick->p_lock);
2403 		}
2404 		if (fromsig &&
2405 		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2406 		    SA_NOKERNINFO))
2407 			return;
2408 		msg = NULL;
2409 	}
2410 
2411 	/* Print load average. */
2412 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2413 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2414 	strlcat(buf, lmsg, bufsz);
2415 
2416 	if (pick == NULL) {
2417 		strlcat(buf, msg, bufsz);
2418 		return;
2419 	}
2420 
2421 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2422 	    pick->p_pid);
2423 	strlcat(buf, lmsg, bufsz);
2424 
2425 	mutex_enter(pick->p_lock);
2426 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2427 		lwp_lock(l);
2428 		snprintf(lmsg, sizeof(lmsg), "%s%s",
2429 		    l->l_stat == LSONPROC ? "running" :
2430 		    l->l_stat == LSRUN ? "runnable" :
2431 		    l->l_wchan ? l->l_wmesg : "iowait",
2432 		    (LIST_NEXT(l, l_sibling) != NULL) ? " " : "] ");
2433 		lwp_unlock(l);
2434 		strlcat(buf, lmsg, bufsz);
2435 		pctcpu += l->l_pctcpu;
2436 	}
2437 	pctcpu += pick->p_pctcpu;
2438 	calcru(pick, &utime, &stime, NULL, NULL);
2439 	mutex_exit(pick->p_lock);
2440 
2441 	/* Round up and print user+system time, %CPU and RSS. */
2442 	utime.tv_usec += 5000;
2443 	if (utime.tv_usec >= 1000000) {
2444 		utime.tv_sec += 1;
2445 		utime.tv_usec -= 1000000;
2446 	}
2447 	stime.tv_usec += 5000;
2448 	if (stime.tv_usec >= 1000000) {
2449 		stime.tv_sec += 1;
2450 		stime.tv_usec -= 1000000;
2451 	}
2452 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2453 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2454 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2455 		rss = 0;
2456 	else
2457 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2458 
2459 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2460 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2461 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2462 	    tmp / 100, rss);
2463 	strlcat(buf, lmsg, bufsz);
2464 }
2465 
2466 /*
2467  * Print report on state of foreground process group.
2468  * Call with tty_lock held.
2469  */
2470 void
2471 ttyputinfo(struct tty *tp, char *buf)
2472 {
2473 
2474 	KASSERT(mutex_owned(&tty_lock));
2475 
2476 	if (ttycheckoutq_wlock(tp, 0) == 0)
2477 		return;
2478 	ttyprintf_nolock(tp, "%s\n", buf);
2479 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2480 }
2481 
2482 /*
2483  * Returns 1 if p2 is "better" than p1
2484  *
2485  * The algorithm for picking the "interesting" process is thus:
2486  *
2487  *	1) Only foreground processes are eligible - implied.
2488  *	2) Runnable processes are favored over anything else.  The runner
2489  *	   with the highest CPU utilization is picked (l_pctcpu).  Ties are
2490  *	   broken by picking the highest pid.
2491  *	3) The sleeper with the shortest sleep time is next.  With ties,
2492  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2493  *	4) Further ties are broken by picking the highest pid.
2494  */
2495 #define	ISRUN(p)	((p)->p_nrlwps > 0)
2496 #define	TESTAB(a, b)	((a)<<1 | (b))
2497 #define	ONLYA	2
2498 #define	ONLYB	1
2499 #define	BOTH	3
2500 
2501 static int
2502 proc_compare(struct proc *p1, struct proc *p2)
2503 {
2504 	lwp_t *l1, *l2;
2505 
2506 	KASSERT(mutex_owned(p1->p_lock));
2507 	KASSERT(mutex_owned(p2->p_lock));
2508 
2509 	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2510 		return (1);
2511 	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2512 		return (0);
2513 	/*
2514 	 * see if at least one of them is runnable
2515 	 */
2516 	switch (TESTAB(ISRUN(p1), ISRUN(p2))) {
2517 	case ONLYA:
2518 		return (0);
2519 	case ONLYB:
2520 		return (1);
2521 	case BOTH:
2522 		/*
2523 		 * tie - favor one with highest recent CPU utilization
2524 		 */
2525 		if (l2->l_pctcpu > l1->l_pctcpu)
2526 			return (1);
2527 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2528 	}
2529 	/*
2530  	 * weed out zombies
2531 	 */
2532 	switch (TESTAB(P_ZOMBIE(p1), P_ZOMBIE(p2))) {
2533 	case ONLYA:
2534 		return (1);
2535 	case ONLYB:
2536 		return (0);
2537 	case BOTH:
2538 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2539 	}
2540 	/*
2541 	 * pick the one with the smallest sleep time
2542 	 */
2543 	if (l2->l_slptime > l2->l_slptime)
2544 		return (0);
2545 	if (l2->l_slptime > l2->l_slptime)
2546 		return (1);
2547 	/*
2548 	 * favor one sleeping in a non-interruptible sleep
2549 	 */
2550 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2551 		return (1);
2552 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2553 		return (0);
2554 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2555 }
2556 
2557 /*
2558  * Output char to tty; console putchar style.
2559  * Can be called with tty lock held through kprintf() machinery..
2560  */
2561 int
2562 tputchar(int c, int flags, struct tty *tp)
2563 {
2564 	int r = 0;
2565 
2566 	if ((flags & NOLOCK) == 0)
2567 		mutex_spin_enter(&tty_lock);
2568 	if (!CONNECTED(tp)) {
2569 		r = -1;
2570 		goto out;
2571 	}
2572 	if (c == '\n')
2573 		(void)ttyoutput('\r', tp);
2574 	(void)ttyoutput(c, tp);
2575 	ttstart(tp);
2576 out:
2577 	if ((flags & NOLOCK) == 0)
2578 		mutex_spin_exit(&tty_lock);
2579 	return (r);
2580 }
2581 
2582 /*
2583  * Sleep on chan, returning ERESTART if tty changed while we napped and
2584  * returning any errors (e.g. EINTR/ETIMEDOUT) reported by cv_timedwait(_sig).
2585  * If the tty is revoked, restarting a pending call will redo validation done
2586  * at the start of the call.
2587  *
2588  * Must be called with the tty lock held.
2589  */
2590 int
2591 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch, int timo)
2592 {
2593 	int	error;
2594 	short	gen;
2595 
2596 	KASSERT(mutex_owned(&tty_lock));
2597 
2598 	gen = tp->t_gen;
2599 	if (catch)
2600 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2601 	else
2602 		error = cv_timedwait(cv, &tty_lock, timo);
2603 	if (error != 0)
2604 		return (error);
2605 	return (tp->t_gen == gen ? 0 : ERESTART);
2606 }
2607 
2608 /*
2609  * Attach a tty to the tty list.
2610  *
2611  * This should be called ONLY once per real tty (including pty's).
2612  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2613  * distinctly NOT usable as tty's, and thus should not be attached to
2614  * the ttylist.  This is why this call is not done from ttymalloc().
2615  *
2616  * Device drivers should attach tty's at a similar time that they are
2617  * ttymalloc()'ed, or, for the case of statically allocated struct tty's
2618  * either in the attach or (first) open routine.
2619  */
2620 void
2621 tty_attach(struct tty *tp)
2622 {
2623 
2624 	mutex_spin_enter(&tty_lock);
2625 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2626 	++tty_count;
2627 	mutex_spin_exit(&tty_lock);
2628 }
2629 
2630 /*
2631  * Remove a tty from the tty list.
2632  */
2633 void
2634 tty_detach(struct tty *tp)
2635 {
2636 
2637 	mutex_spin_enter(&tty_lock);
2638 	--tty_count;
2639 #ifdef DIAGNOSTIC
2640 	if (tty_count < 0)
2641 		panic("tty_detach: tty_count < 0");
2642 #endif
2643 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2644 	mutex_spin_exit(&tty_lock);
2645 }
2646 
2647 /*
2648  * Allocate a tty structure and its associated buffers.
2649  */
2650 struct tty *
2651 ttymalloc(void)
2652 {
2653 	struct tty	*tp;
2654 	int i;
2655 
2656 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2657 	callout_init(&tp->t_rstrt_ch, 0);
2658 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2659 	/* XXX: default to 1024 chars for now */
2660 	clalloc(&tp->t_rawq, 1024, 1);
2661 	cv_init(&tp->t_rawcv, "ttyraw");
2662 	cv_init(&tp->t_rawcvf, "ttyrawf");
2663 	clalloc(&tp->t_canq, 1024, 1);
2664 	cv_init(&tp->t_cancv, "ttycan");
2665 	cv_init(&tp->t_cancvf, "ttycanf");
2666 	/* output queue doesn't need quoting */
2667 	clalloc(&tp->t_outq, 1024, 0);
2668 	cv_init(&tp->t_outcv, "ttyout");
2669 	cv_init(&tp->t_outcvf, "ttyoutf");
2670 	/* Set default line discipline. */
2671 	tp->t_linesw = ttyldisc_default();
2672 	selinit(&tp->t_rsel);
2673 	selinit(&tp->t_wsel);
2674 	for (i = 0; i < TTYSIG_COUNT; i++)
2675 		sigemptyset(&tp->t_sigs[i]);
2676 	return (tp);
2677 }
2678 
2679 /*
2680  * Free a tty structure and its buffers.
2681  *
2682  * Be sure to call tty_detach() for any tty that has been
2683  * tty_attach()ed.
2684  */
2685 void
2686 ttyfree(struct tty *tp)
2687 {
2688 	int i;
2689 
2690 	mutex_enter(proc_lock);
2691 	mutex_enter(&tty_lock);
2692 	for (i = 0; i < TTYSIG_COUNT; i++)
2693 		sigemptyset(&tp->t_sigs[i]);
2694 	if (tp->t_sigcount != 0)
2695 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2696 	mutex_exit(&tty_lock);
2697 	mutex_exit(proc_lock);
2698 
2699 	callout_halt(&tp->t_rstrt_ch, NULL);
2700 	callout_destroy(&tp->t_rstrt_ch);
2701 	ttyldisc_release(tp->t_linesw);
2702 	clfree(&tp->t_rawq);
2703 	clfree(&tp->t_canq);
2704 	clfree(&tp->t_outq);
2705 	cv_destroy(&tp->t_rawcv);
2706 	cv_destroy(&tp->t_rawcvf);
2707 	cv_destroy(&tp->t_cancv);
2708 	cv_destroy(&tp->t_cancvf);
2709 	cv_destroy(&tp->t_outcv);
2710 	cv_destroy(&tp->t_outcvf);
2711 	seldestroy(&tp->t_rsel);
2712 	seldestroy(&tp->t_wsel);
2713 	kmem_free(tp, sizeof(*tp));
2714 }
2715 
2716 /*
2717  * ttyprintf_nolock: send a message to a specific tty, without locking.
2718  *
2719  * => should be used only by tty driver or anything that knows the
2720  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2721  *    use tprintf]
2722  */
2723 static void
2724 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2725 {
2726 	va_list ap;
2727 
2728 	/* No mutex needed; going to process TTY. */
2729 	va_start(ap, fmt);
2730 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2731 	va_end(ap);
2732 }
2733 
2734 static int
2735 tty_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
2736     void *arg0, void *arg1, void *arg2, void *arg3)
2737 {
2738 	struct tty *tty;
2739 	int result;
2740 
2741 	result = KAUTH_RESULT_DEFER;
2742 
2743 	if (action != KAUTH_DEVICE_TTY_OPEN)
2744 		return result;
2745 
2746 	tty = arg0;
2747 
2748 	/* If it's not opened, we allow. */
2749 	if ((tty->t_state & TS_ISOPEN) == 0)
2750 		result = KAUTH_RESULT_ALLOW;
2751 	else {
2752 		/*
2753 		 * If it's opened, we can only allow if it's not exclusively
2754 		 * opened; otherwise, that's a privileged operation and we
2755 		 * let the secmodel handle it.
2756 		 */
2757 		if ((tty->t_state & TS_XCLUDE) == 0)
2758 			result = KAUTH_RESULT_ALLOW;
2759 	}
2760 
2761 	return result;
2762 }
2763 
2764 /*
2765  * Initialize the tty subsystem.
2766  */
2767 void
2768 tty_init(void)
2769 {
2770 
2771 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2772 	rw_init(&ttcompat_lock);
2773 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2774 	KASSERT(tty_sigsih != NULL);
2775 
2776 	tty_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
2777 	    tty_listener_cb, NULL);
2778 
2779 	sysctl_kern_tkstat_setup();
2780 }
2781 
2782 /*
2783  * Send a signal from a tty to its process group or session leader.
2784  * Handoff to the target is deferred to a soft interrupt.
2785  */
2786 void
2787 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2788 {
2789 	sigset_t *sp;
2790 
2791 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2792 
2793 	sp = &tp->t_sigs[st];
2794 	if (sigismember(sp, sig))
2795 		return;
2796 	sigaddset(sp, sig);
2797 	if (tp->t_sigcount++ == 0)
2798 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2799 	softint_schedule(tty_sigsih);
2800 }
2801 
2802 /*
2803  * Deliver deferred signals from ttys.  Note that the process groups
2804  * and sessions associated with the ttys may have changed from when
2805  * the signal was originally sent, but in practice it should not matter.
2806  * For signals produced as a result of a syscall, the soft interrupt
2807  * will fire before the syscall returns to the user.
2808  */
2809 static void
2810 ttysigintr(void *cookie)
2811 {
2812 	struct tty *tp;
2813 	enum ttysigtype st;
2814 	struct pgrp *pgrp;
2815 	struct session *sess;
2816 	int sig, lflag;
2817 	char infobuf[200];
2818 
2819 	mutex_enter(proc_lock);
2820 	mutex_spin_enter(&tty_lock);
2821 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2822 		KASSERT(tp->t_sigcount > 0);
2823 		for (st = 0; st < TTYSIG_COUNT; st++) {
2824 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2825 				break;
2826 		}
2827 		KASSERT(st < TTYSIG_COUNT);
2828 		sigdelset(&tp->t_sigs[st], sig);
2829 		if (--tp->t_sigcount == 0)
2830 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2831 		pgrp = tp->t_pgrp;
2832 		sess = tp->t_session;
2833 		lflag = tp->t_lflag;
2834 		if  (sig == SIGINFO) {
2835 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2836 				/* Via ioctl: ignore tty option. */
2837 				tp->t_state &= ~TS_SIGINFO;
2838 				lflag |= ISIG;
2839 			}
2840 			if (!ISSET(lflag, NOKERNINFO)) {
2841 				mutex_spin_exit(&tty_lock);
2842 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
2843 				mutex_spin_enter(&tty_lock);
2844 				ttyputinfo(tp, infobuf);
2845 			}
2846 			if (!ISSET(lflag, ISIG))
2847 				continue;
2848 		}
2849 		mutex_spin_exit(&tty_lock);
2850 		KASSERT(sig != 0);
2851 		switch (st) {
2852 		case TTYSIG_PG1:
2853 			if (pgrp != NULL)
2854 				pgsignal(pgrp, sig, 1);
2855 			break;
2856 		case TTYSIG_PG2:
2857 			if (pgrp != NULL)
2858 				pgsignal(pgrp, sig, sess != NULL);
2859 			break;
2860 		case TTYSIG_LEADER:
2861 			if (sess != NULL && sess->s_leader != NULL)
2862 				psignal(sess->s_leader, sig);
2863 			break;
2864 		default:
2865 			/* NOTREACHED */
2866 			break;
2867 		}
2868 		mutex_spin_enter(&tty_lock);
2869 	}
2870 	mutex_spin_exit(&tty_lock);
2871 	mutex_exit(proc_lock);
2872 }
2873