xref: /netbsd-src/sys/kern/tty.c (revision ca453df649ce9db45b64d73678ba06cbccf9aa11)
1 /*	$NetBSD: tty.c,v 1.245 2011/07/17 20:54:52 joerg Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 1982, 1986, 1990, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63  */
64 
65 #include <sys/cdefs.h>
66 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.245 2011/07/17 20:54:52 joerg Exp $");
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/ioctl.h>
71 #include <sys/proc.h>
72 #define	TTYDEFCHARS
73 #include <sys/tty.h>
74 #undef	TTYDEFCHARS
75 #include <sys/file.h>
76 #include <sys/conf.h>
77 #include <sys/cpu.h>
78 #include <sys/dkstat.h>
79 #include <sys/uio.h>
80 #include <sys/kernel.h>
81 #include <sys/vnode.h>
82 #include <sys/syslog.h>
83 #include <sys/kmem.h>
84 #include <sys/signalvar.h>
85 #include <sys/resourcevar.h>
86 #include <sys/poll.h>
87 #include <sys/kprintf.h>
88 #include <sys/namei.h>
89 #include <sys/sysctl.h>
90 #include <sys/kauth.h>
91 #include <sys/intr.h>
92 #include <sys/ioctl_compat.h>
93 #include <sys/module.h>
94 
95 static int	ttnread(struct tty *);
96 static void	ttyblock(struct tty *);
97 static void	ttyecho(int, struct tty *);
98 static void	ttyrubo(struct tty *, int);
99 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
100     __attribute__((__format__(__printf__,2,3)));
101 static int	proc_compare(struct proc *, struct proc *);
102 static void	ttysigintr(void *);
103 
104 /* Symbolic sleep message strings. */
105 const char	ttclos[] = "ttycls";
106 const char	ttopen[] = "ttyopn";
107 const char	ttybg[] = "ttybg";
108 const char	ttyin[] = "ttyin";
109 const char	ttyout[] = "ttyout";
110 
111 /*
112  * Used to determine whether we still have a connection.  This is true in
113  * one of 3 cases:
114  * 1) We have carrier.
115  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
116  * 3) We're using a flow control mechanism that overloads the carrier signal.
117  */
118 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
119 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
120 
121 /*
122  * Table with character classes and parity. The 8th bit indicates parity,
123  * the 7th bit indicates the character is an alphameric or underscore (for
124  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
125  * are 0 then the character needs no special processing on output; classes
126  * other than 0 might be translated or (not currently) require delays.
127  */
128 #define	E	0x00	/* Even parity. */
129 #define	O	0x80	/* Odd parity. */
130 #define	PARITY(c)	(char_type[c] & O)
131 
132 #define	ALPHA	0x40	/* Alpha or underscore. */
133 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
134 
135 #define	CCLASSMASK	0x3f
136 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
137 
138 #define	BS	BACKSPACE
139 #define	CC	CONTROL
140 #define	CR	RETURN
141 #define	NA	ORDINARY | ALPHA
142 #define	NL	NEWLINE
143 #define	NO	ORDINARY
144 #define	TB	TAB
145 #define	VT	VTAB
146 
147 unsigned char const char_type[] = {
148 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
149 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
150 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
151 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
152 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
153 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
154 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
155 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
156 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
157 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
159 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
160 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
161 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
163 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
164 	/*
165 	 * Meta chars; should be settable per character set;
166 	 * for now, treat them all as normal characters.
167 	 */
168 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 };
185 #undef	BS
186 #undef	CC
187 #undef	CR
188 #undef	NA
189 #undef	NL
190 #undef	NO
191 #undef	TB
192 #undef	VT
193 
194 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
195 static void *tty_sigsih;
196 
197 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
198 int tty_count;
199 kmutex_t tty_lock;
200 krwlock_t ttcompat_lock;
201 int (*ttcompatvec)(struct tty *, u_long, void *, int, struct lwp *);
202 
203 uint64_t tk_cancc;
204 uint64_t tk_nin;
205 uint64_t tk_nout;
206 uint64_t tk_rawcc;
207 
208 static kauth_listener_t tty_listener;
209 
210 static struct sysctllog *kern_tkstat_sysctllog;
211 
212 static void
213 sysctl_kern_tkstat_setup(void)
214 {
215 
216 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
217 		       CTLFLAG_PERMANENT,
218 		       CTLTYPE_NODE, "kern", NULL,
219 		       NULL, 0, NULL, 0,
220 		       CTL_KERN, CTL_EOL);
221 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
222 		       CTLFLAG_PERMANENT,
223 		       CTLTYPE_NODE, "tkstat",
224 		       SYSCTL_DESCR("Number of characters sent and and "
225 				    "received on ttys"),
226 		       NULL, 0, NULL, 0,
227 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
228 
229 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
230 		       CTLFLAG_PERMANENT,
231 		       CTLTYPE_QUAD, "nin",
232 		       SYSCTL_DESCR("Total number of tty input characters"),
233 		       NULL, 0, &tk_nin, 0,
234 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
235 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
236 		       CTLFLAG_PERMANENT,
237 		       CTLTYPE_QUAD, "nout",
238 		       SYSCTL_DESCR("Total number of tty output characters"),
239 		       NULL, 0, &tk_nout, 0,
240 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
241 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
242 		       CTLFLAG_PERMANENT,
243 		       CTLTYPE_QUAD, "cancc",
244 		       SYSCTL_DESCR("Number of canonical tty input characters"),
245 		       NULL, 0, &tk_cancc, 0,
246 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
247 	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
248 		       CTLFLAG_PERMANENT,
249 		       CTLTYPE_QUAD, "rawcc",
250 		       SYSCTL_DESCR("Number of raw tty input characters"),
251 		       NULL, 0, &tk_rawcc, 0,
252 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
253 }
254 
255 int
256 ttyopen(struct tty *tp, int dialout, int nonblock)
257 {
258 	int	error;
259 
260 	error = 0;
261 
262 	mutex_spin_enter(&tty_lock);
263 
264 	if (dialout) {
265 		/*
266 		 * If the device is already open for non-dialout, fail.
267 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
268 		 * opens.
269 		 */
270 		if (ISSET(tp->t_state, TS_ISOPEN) &&
271 		    !ISSET(tp->t_state, TS_DIALOUT)) {
272 			error = EBUSY;
273 			goto out;
274 		}
275 		SET(tp->t_state, TS_DIALOUT);
276 	} else {
277 		if (!nonblock) {
278 			/*
279 			 * Wait for carrier.  Also wait for any dialout
280 			 * processes to close the tty first.
281 			 */
282 			while (ISSET(tp->t_state, TS_DIALOUT) ||
283 			       !CONNECTED(tp)) {
284 				tp->t_wopen++;
285 				error = ttysleep(tp, &tp->t_rawcv, true, 0);
286 				tp->t_wopen--;
287 				if (error)
288 					goto out;
289 			}
290 		} else {
291 			/*
292 			 * Don't allow a non-blocking non-dialout open if the
293 			 * device is already open for dialout.
294 			 */
295 			if (ISSET(tp->t_state, TS_DIALOUT)) {
296 				error = EBUSY;
297 				goto out;
298 			}
299 		}
300 	}
301 
302 out:
303 	mutex_spin_exit(&tty_lock);
304 	return (error);
305 }
306 
307 /*
308  * Initial open of tty, or (re)entry to standard tty line discipline.
309  */
310 int
311 ttylopen(dev_t device, struct tty *tp)
312 {
313 
314 	mutex_spin_enter(&tty_lock);
315 	tp->t_dev = device;
316 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
317 		SET(tp->t_state, TS_ISOPEN);
318 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
319 		tp->t_flags = 0;
320 	}
321 	mutex_spin_exit(&tty_lock);
322 	return (0);
323 }
324 
325 /*
326  * Handle close() on a tty line: flush and set to initial state,
327  * bumping generation number so that pending read/write calls
328  * can detect recycling of the tty.
329  */
330 int
331 ttyclose(struct tty *tp)
332 {
333 	extern struct tty *constty;	/* Temporary virtual console. */
334 	struct session *sess;
335 
336 	mutex_spin_enter(&tty_lock);
337 
338 	if (constty == tp)
339 		constty = NULL;
340 
341 	ttyflush(tp, FREAD | FWRITE);
342 
343 	tp->t_gen++;
344 	tp->t_pgrp = NULL;
345 	tp->t_state = 0;
346 	sess = tp->t_session;
347 	tp->t_session = NULL;
348 
349 	mutex_spin_exit(&tty_lock);
350 
351 	if (sess != NULL) {
352 		mutex_enter(proc_lock);
353 		/* Releases proc_lock. */
354 		proc_sessrele(sess);
355 	}
356 	return (0);
357 }
358 
359 #define	FLUSHQ(q) {							\
360 	if ((q)->c_cc)							\
361 		ndflush(q, (q)->c_cc);					\
362 }
363 
364 /*
365  * This macro is used in canonical mode input processing, where a read
366  * request shall not return unless a 'line delimiter' ('\n') or 'break'
367  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
368  * is an extension to the POSIX.1 defined set of special characters,
369  * recognize it only if IEXTEN is set in the set of local flags.
370  */
371 #define	TTBREAKC(c, lflg)						\
372 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
373 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
374 
375 
376 
377 /*
378  * ttyinput() helper.
379  * Call with the tty lock held.
380  */
381 /* XXX static */ int
382 ttyinput_wlock(int c, struct tty *tp)
383 {
384 	int	iflag, lflag, i, error;
385 	u_char	*cc;
386 
387 	KASSERT(mutex_owned(&tty_lock));
388 
389 	/*
390 	 * If input is pending take it first.
391 	 */
392 	lflag = tp->t_lflag;
393 	if (ISSET(lflag, PENDIN))
394 		ttypend(tp);
395 	/*
396 	 * Gather stats.
397 	 */
398 	if (ISSET(lflag, ICANON)) {
399 		++tk_cancc;
400 		++tp->t_cancc;
401 	} else {
402 		++tk_rawcc;
403 		++tp->t_rawcc;
404 	}
405 	++tk_nin;
406 
407 	cc = tp->t_cc;
408 
409 	/*
410 	 * Handle exceptional conditions (break, parity, framing).
411 	 */
412 	iflag = tp->t_iflag;
413 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
414 		CLR(c, TTY_ERRORMASK);
415 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
416 			if (ISSET(iflag, IGNBRK))
417 				return (0);
418 			else if (ISSET(iflag, BRKINT)) {
419 				ttyflush(tp, FREAD | FWRITE);
420 				ttysig(tp, TTYSIG_PG1, SIGINT);
421 				return (0);
422 			} else if (ISSET(iflag, PARMRK))
423 				goto parmrk;
424 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
425 		    ISSET(error, TTY_FE)) {
426 			if (ISSET(iflag, IGNPAR))
427 				return (0);
428 			else if (ISSET(iflag, PARMRK)) {
429  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
430 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
431 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
432 				return (0);
433 			} else
434 				c = 0;
435 		}
436 	} else if (c == 0377 &&
437 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
438 		/* "Escape" a valid character of '\377'. */
439 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
440 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
441 		goto endcase;
442 	}
443 
444 	/*
445 	 * In tandem mode, check high water mark.
446 	 */
447 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
448 		ttyblock(tp);
449 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
450 		CLR(c, 0x80);
451 	if (!ISSET(lflag, EXTPROC)) {
452 		/*
453 		 * Check for literal nexting very first
454 		 */
455 		if (ISSET(tp->t_state, TS_LNCH)) {
456 			SET(c, TTY_QUOTE);
457 			CLR(tp->t_state, TS_LNCH);
458 		}
459 		/*
460 		 * Scan for special characters.  This code
461 		 * is really just a big case statement with
462 		 * non-constant cases.  The bottom of the
463 		 * case statement is labeled ``endcase'', so goto
464 		 * it after a case match, or similar.
465 		 */
466 
467 		/*
468 		 * Control chars which aren't controlled
469 		 * by ICANON, ISIG, or IXON.
470 		 */
471 		if (ISSET(lflag, IEXTEN)) {
472 			if (CCEQ(cc[VLNEXT], c)) {
473 				if (ISSET(lflag, ECHO)) {
474 					if (ISSET(lflag, ECHOE)) {
475 						(void)ttyoutput('^', tp);
476 						(void)ttyoutput('\b', tp);
477 					} else
478 						ttyecho(c, tp);
479 				}
480 				SET(tp->t_state, TS_LNCH);
481 				goto endcase;
482 			}
483 			if (CCEQ(cc[VDISCARD], c)) {
484 				if (ISSET(lflag, FLUSHO))
485 					CLR(tp->t_lflag, FLUSHO);
486 				else {
487 					ttyflush(tp, FWRITE);
488 					ttyecho(c, tp);
489 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
490 						ttyretype(tp);
491 					SET(tp->t_lflag, FLUSHO);
492 				}
493 				goto startoutput;
494 			}
495 		}
496 		/*
497 		 * Signals.
498 		 */
499 		if (ISSET(lflag, ISIG)) {
500 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
501 				if (!ISSET(lflag, NOFLSH))
502 					ttyflush(tp, FREAD | FWRITE);
503 				ttyecho(c, tp);
504 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
505 				    SIGINT : SIGQUIT);
506 				goto endcase;
507 			}
508 			if (CCEQ(cc[VSUSP], c)) {
509 				if (!ISSET(lflag, NOFLSH))
510 					ttyflush(tp, FREAD);
511 				ttyecho(c, tp);
512 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
513 				goto endcase;
514 			}
515 		}
516 		/*
517 		 * Handle start/stop characters.
518 		 */
519 		if (ISSET(iflag, IXON)) {
520 			if (CCEQ(cc[VSTOP], c)) {
521 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
522 					SET(tp->t_state, TS_TTSTOP);
523 					cdev_stop(tp, 0);
524 					return (0);
525 				}
526 				if (!CCEQ(cc[VSTART], c))
527 					return (0);
528 				/*
529 				 * if VSTART == VSTOP then toggle
530 				 */
531 				goto endcase;
532 			}
533 			if (CCEQ(cc[VSTART], c))
534 				goto restartoutput;
535 		}
536 		/*
537 		 * IGNCR, ICRNL, & INLCR
538 		 */
539 		if (c == '\r') {
540 			if (ISSET(iflag, IGNCR))
541 				goto endcase;
542 			else if (ISSET(iflag, ICRNL))
543 				c = '\n';
544 		} else if (c == '\n' && ISSET(iflag, INLCR))
545 			c = '\r';
546 	}
547 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
548 		/*
549 		 * From here on down canonical mode character
550 		 * processing takes place.
551 		 */
552 		/*
553 		 * erase (^H / ^?)
554 		 */
555 		if (CCEQ(cc[VERASE], c)) {
556 			if (tp->t_rawq.c_cc)
557 				ttyrub(unputc(&tp->t_rawq), tp);
558 			goto endcase;
559 		}
560 		/*
561 		 * kill (^U)
562 		 */
563 		if (CCEQ(cc[VKILL], c)) {
564 			if (ISSET(lflag, ECHOKE) &&
565 			    tp->t_rawq.c_cc == tp->t_rocount &&
566 			    !ISSET(lflag, ECHOPRT))
567 				while (tp->t_rawq.c_cc)
568 					ttyrub(unputc(&tp->t_rawq), tp);
569 			else {
570 				ttyecho(c, tp);
571 				if (ISSET(lflag, ECHOK) ||
572 				    ISSET(lflag, ECHOKE))
573 					ttyecho('\n', tp);
574 				FLUSHQ(&tp->t_rawq);
575 				tp->t_rocount = 0;
576 			}
577 			CLR(tp->t_state, TS_LOCAL);
578 			goto endcase;
579 		}
580 		/*
581 		 * Extensions to the POSIX.1 GTI set of functions.
582 		 */
583 		if (ISSET(lflag, IEXTEN)) {
584 			/*
585 			 * word erase (^W)
586 			 */
587 			if (CCEQ(cc[VWERASE], c)) {
588 				int alt = ISSET(lflag, ALTWERASE);
589 				int ctype;
590 
591 				/*
592 				 * erase whitespace
593 				 */
594 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
595 				    c == '\t')
596 					ttyrub(c, tp);
597 				if (c == -1)
598 					goto endcase;
599 				/*
600 				 * erase last char of word and remember the
601 				 * next chars type (for ALTWERASE)
602 				 */
603 				ttyrub(c, tp);
604 				c = unputc(&tp->t_rawq);
605 				if (c == -1)
606 					goto endcase;
607 				if (c == ' ' || c == '\t') {
608 					(void)putc(c, &tp->t_rawq);
609 					goto endcase;
610 				}
611 				ctype = ISALPHA(c);
612 				/*
613 				 * erase rest of word
614 				 */
615 				do {
616 					ttyrub(c, tp);
617 					c = unputc(&tp->t_rawq);
618 					if (c == -1)
619 						goto endcase;
620 				} while (c != ' ' && c != '\t' &&
621 				    (alt == 0 || ISALPHA(c) == ctype));
622 				(void)putc(c, &tp->t_rawq);
623 				goto endcase;
624 			}
625 			/*
626 			 * reprint line (^R)
627 			 */
628 			if (CCEQ(cc[VREPRINT], c)) {
629 				ttyretype(tp);
630 				goto endcase;
631 			}
632 			/*
633 			 * ^T - kernel info and generate SIGINFO
634 			 */
635 			if (CCEQ(cc[VSTATUS], c)) {
636 				ttysig(tp, TTYSIG_PG1, SIGINFO);
637 				goto endcase;
638 			}
639 		}
640 	}
641 	/*
642 	 * Check for input buffer overflow
643 	 */
644 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
645 		if (ISSET(iflag, IMAXBEL)) {
646 			if (tp->t_outq.c_cc < tp->t_hiwat)
647 				(void)ttyoutput(CTRL('g'), tp);
648 		} else
649 			ttyflush(tp, FREAD | FWRITE);
650 		goto endcase;
651 	}
652 	/*
653 	 * Put data char in q for user and
654 	 * wakeup on seeing a line delimiter.
655 	 */
656 	if (putc(c, &tp->t_rawq) >= 0) {
657 		if (!ISSET(lflag, ICANON)) {
658 			ttwakeup(tp);
659 			ttyecho(c, tp);
660 			goto endcase;
661 		}
662 		if (TTBREAKC(c, lflag)) {
663 			tp->t_rocount = 0;
664 			catq(&tp->t_rawq, &tp->t_canq);
665 			ttwakeup(tp);
666 		} else if (tp->t_rocount++ == 0)
667 			tp->t_rocol = tp->t_column;
668 		if (ISSET(tp->t_state, TS_ERASE)) {
669 			/*
670 			 * end of prterase \.../
671 			 */
672 			CLR(tp->t_state, TS_ERASE);
673 			(void)ttyoutput('/', tp);
674 		}
675 		i = tp->t_column;
676 		ttyecho(c, tp);
677 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
678 			/*
679 			 * Place the cursor over the '^' of the ^D.
680 			 */
681 			i = min(2, tp->t_column - i);
682 			while (i > 0) {
683 				(void)ttyoutput('\b', tp);
684 				i--;
685 			}
686 		}
687 	}
688  endcase:
689 	/*
690 	 * IXANY means allow any character to restart output.
691 	 */
692 	if (ISSET(tp->t_state, TS_TTSTOP) &&
693 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
694 		return (0);
695 	}
696  restartoutput:
697 	CLR(tp->t_lflag, FLUSHO);
698 	CLR(tp->t_state, TS_TTSTOP);
699  startoutput:
700 	return (ttstart(tp));
701 }
702 
703 /*
704  * Process input of a single character received on a tty.
705  *
706  * XXX - this is a hack, all drivers must changed to acquire the
707  *	 lock before calling linesw->l_rint()
708  */
709 int
710 ttyinput(int c, struct tty *tp)
711 {
712 	int error;
713 
714 	/*
715 	 * Unless the receiver is enabled, drop incoming data.
716 	 */
717 	if (!ISSET(tp->t_cflag, CREAD))
718 		return (0);
719 
720 	mutex_spin_enter(&tty_lock);
721 	error = ttyinput_wlock(c, tp);
722 	mutex_spin_exit(&tty_lock);
723 
724 	return (error);
725 }
726 
727 /*
728  * Output a single character on a tty, doing output processing
729  * as needed (expanding tabs, newline processing, etc.).
730  * Returns < 0 if succeeds, otherwise returns char to resend.
731  * Must be recursive.
732  *
733  * Call with tty lock held.
734  */
735 int
736 ttyoutput(int c, struct tty *tp)
737 {
738 	long	oflag;
739 	int	col, notout;
740 
741 	KASSERT(mutex_owned(&tty_lock));
742 
743 	oflag = tp->t_oflag;
744 	if (!ISSET(oflag, OPOST)) {
745 		tk_nout++;
746 		tp->t_outcc++;
747 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
748 			return (c);
749 		return (-1);
750 	}
751 	/*
752 	 * Do tab expansion if OXTABS is set.  Special case if we do external
753 	 * processing, we don't do the tab expansion because we'll probably
754 	 * get it wrong.  If tab expansion needs to be done, let it happen
755 	 * externally.
756 	 */
757 	CLR(c, ~TTY_CHARMASK);
758 	if (c == '\t' &&
759 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
760 		c = 8 - (tp->t_column & 7);
761 		if (ISSET(tp->t_lflag, FLUSHO)) {
762 			notout = 0;
763 		} else {
764 			notout = b_to_q("        ", c, &tp->t_outq);
765 			c -= notout;
766 			tk_nout += c;
767 			tp->t_outcc += c;
768 		}
769 		tp->t_column += c;
770 		return (notout ? '\t' : -1);
771 	}
772 	if (c == CEOT && ISSET(oflag, ONOEOT))
773 		return (-1);
774 
775 	/*
776 	 * Newline translation: if ONLCR is set,
777 	 * translate newline into "\r\n".
778 	 */
779 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
780 		tk_nout++;
781 		tp->t_outcc++;
782 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
783 			return (c);
784 	}
785 	/* If OCRNL is set, translate "\r" into "\n". */
786 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
787 		c = '\n';
788 	/* If ONOCR is set, don't transmit CRs when on column 0. */
789 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
790 		return (-1);
791 
792 	tk_nout++;
793 	tp->t_outcc++;
794 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
795 		return (c);
796 
797 	col = tp->t_column;
798 	switch (CCLASS(c)) {
799 	case BACKSPACE:
800 		if (col > 0)
801 			--col;
802 		break;
803 	case CONTROL:
804 		break;
805 	case NEWLINE:
806 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
807 			col = 0;
808 		break;
809 	case RETURN:
810 		col = 0;
811 		break;
812 	case ORDINARY:
813 		++col;
814 		break;
815 	case TAB:
816 		col = (col + 8) & ~7;
817 		break;
818 	}
819 	tp->t_column = col;
820 	return (-1);
821 }
822 
823 /*
824  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
825  * has been called to do discipline-specific functions and/or reject any
826  * of these ioctl commands.
827  */
828 /* ARGSUSED */
829 int
830 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
831 {
832 	extern struct tty *constty;	/* Temporary virtual console. */
833 	struct proc *p = l ? l->l_proc : NULL;
834 	struct linesw	*lp;
835 	int		s, error;
836 	struct pathbuf *pb;
837 	struct nameidata nd;
838 	char		infobuf[200];
839 
840 	/* If the ioctl involves modification, hang if in the background. */
841 	switch (cmd) {
842 	case  TIOCFLUSH:
843 	case  TIOCDRAIN:
844 	case  TIOCSBRK:
845 	case  TIOCCBRK:
846 	case  TIOCSTART:
847 	case  TIOCSETA:
848 	case  TIOCSETD:
849 	case  TIOCSLINED:
850 	case  TIOCSETAF:
851 	case  TIOCSETAW:
852 #ifdef notdef
853 	case  TIOCSPGRP:
854 	case  FIOSETOWN:
855 #endif
856 	case  TIOCSTAT:
857 	case  TIOCSTI:
858 	case  TIOCSWINSZ:
859 	case  TIOCLBIC:
860 	case  TIOCLBIS:
861 	case  TIOCLSET:
862 	case  TIOCSETC:
863 	case OTIOCSETD:
864 	case  TIOCSETN:
865 	case  TIOCSETP:
866 	case  TIOCSLTC:
867 		mutex_spin_enter(&tty_lock);
868 		while (isbackground(curproc, tp) &&
869 		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
870 		    !sigismasked(l, SIGTTOU)) {
871 			mutex_spin_exit(&tty_lock);
872 
873 			mutex_enter(proc_lock);
874 			pgsignal(p->p_pgrp, SIGTTOU, 1);
875 			mutex_exit(proc_lock);
876 
877 			mutex_spin_enter(&tty_lock);
878 			error = ttysleep(tp, &lbolt, true, 0);
879 			if (error) {
880 				mutex_spin_exit(&tty_lock);
881 				return (error);
882 			}
883 		}
884 		mutex_spin_exit(&tty_lock);
885 		break;
886 	}
887 
888 	switch (cmd) {			/* Process the ioctl. */
889 	case FIOASYNC:			/* set/clear async i/o */
890 		mutex_spin_enter(&tty_lock);
891 		if (*(int *)data)
892 			SET(tp->t_state, TS_ASYNC);
893 		else
894 			CLR(tp->t_state, TS_ASYNC);
895 		mutex_spin_exit(&tty_lock);
896 		break;
897 	case FIONBIO:			/* set/clear non-blocking i/o */
898 		break;			/* XXX: delete. */
899 	case FIONREAD:			/* get # bytes to read */
900 		mutex_spin_enter(&tty_lock);
901 		*(int *)data = ttnread(tp);
902 		mutex_spin_exit(&tty_lock);
903 		break;
904 	case FIONWRITE:			/* get # bytes to written & unsent */
905 		mutex_spin_enter(&tty_lock);
906 		*(int *)data = tp->t_outq.c_cc;
907 		mutex_spin_exit(&tty_lock);
908 		break;
909 	case FIONSPACE:			/* get # bytes to written & unsent */
910 		mutex_spin_enter(&tty_lock);
911 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
912 		mutex_spin_exit(&tty_lock);
913 		break;
914 	case TIOCEXCL:			/* set exclusive use of tty */
915 		mutex_spin_enter(&tty_lock);
916 		SET(tp->t_state, TS_XCLUDE);
917 		mutex_spin_exit(&tty_lock);
918 		break;
919 	case TIOCFLUSH: {		/* flush buffers */
920 		int flags = *(int *)data;
921 
922 		if (flags == 0)
923 			flags = FREAD | FWRITE;
924 		else
925 			flags &= FREAD | FWRITE;
926 		mutex_spin_enter(&tty_lock);
927 		ttyflush(tp, flags);
928 		mutex_spin_exit(&tty_lock);
929 		break;
930 	}
931 	case TIOCCONS:			/* become virtual console */
932 		if (*(int *)data) {
933 			if (constty && constty != tp &&
934 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
935 			    (TS_CARR_ON | TS_ISOPEN))
936 				return EBUSY;
937 
938 			pb = pathbuf_create("/dev/console");
939 			if (pb == NULL) {
940 				return ENOMEM;
941 			}
942 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, pb);
943 			if ((error = namei(&nd)) != 0) {
944 				pathbuf_destroy(pb);
945 				return error;
946 			}
947 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
948 			vput(nd.ni_vp);
949 			pathbuf_destroy(pb);
950 			if (error)
951 				return error;
952 
953 			constty = tp;
954 		} else if (tp == constty)
955 			constty = NULL;
956 		break;
957 	case TIOCDRAIN:			/* wait till output drained */
958 		if ((error = ttywait(tp)) != 0)
959 			return (error);
960 		break;
961 	case TIOCGETA: {		/* get termios struct */
962 		struct termios *t = (struct termios *)data;
963 
964 		memcpy(t, &tp->t_termios, sizeof(struct termios));
965 		break;
966 	}
967 	case TIOCGETD:			/* get line discipline (old) */
968 		*(int *)data = tp->t_linesw->l_no;
969 		break;
970 	case TIOCGLINED:		/* get line discipline (new) */
971 		(void)strncpy((char *)data, tp->t_linesw->l_name,
972 		    TTLINEDNAMELEN - 1);
973 		break;
974 	case TIOCGWINSZ:		/* get window size */
975 		*(struct winsize *)data = tp->t_winsize;
976 		break;
977 	case FIOGETOWN:
978 		mutex_enter(proc_lock);
979 		if (tp->t_session != NULL && !isctty(p, tp)) {
980 			mutex_exit(proc_lock);
981 			return (ENOTTY);
982 		}
983 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
984 		mutex_exit(proc_lock);
985 		break;
986 	case TIOCGPGRP:			/* get pgrp of tty */
987 		mutex_enter(proc_lock);
988 		if (!isctty(p, tp)) {
989 			mutex_exit(proc_lock);
990 			return (ENOTTY);
991 		}
992 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
993 		mutex_exit(proc_lock);
994 		break;
995 	case TIOCGSID:			/* get sid of tty */
996 		mutex_enter(proc_lock);
997 		if (!isctty(p, tp)) {
998 			mutex_exit(proc_lock);
999 			return (ENOTTY);
1000 		}
1001 		*(int *)data = tp->t_session->s_sid;
1002 		mutex_exit(proc_lock);
1003 		break;
1004 #ifdef TIOCHPCL
1005 	case TIOCHPCL:			/* hang up on last close */
1006 		mutex_spin_enter(&tty_lock);
1007 		SET(tp->t_cflag, HUPCL);
1008 		mutex_spin_exit(&tty_lock);
1009 		break;
1010 #endif
1011 	case TIOCNXCL:			/* reset exclusive use of tty */
1012 		mutex_spin_enter(&tty_lock);
1013 		CLR(tp->t_state, TS_XCLUDE);
1014 		mutex_spin_exit(&tty_lock);
1015 		break;
1016 	case TIOCOUTQ:			/* output queue size */
1017 		*(int *)data = tp->t_outq.c_cc;
1018 		break;
1019 	case TIOCSETA:			/* set termios struct */
1020 	case TIOCSETAW:			/* drain output, set */
1021 	case TIOCSETAF: {		/* drn out, fls in, set */
1022 		struct termios *t = (struct termios *)data;
1023 
1024 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1025 			if ((error = ttywait(tp)) != 0)
1026 				return (error);
1027 
1028 			if (cmd == TIOCSETAF) {
1029 				mutex_spin_enter(&tty_lock);
1030 				ttyflush(tp, FREAD);
1031 				mutex_spin_exit(&tty_lock);
1032 			}
1033 		}
1034 
1035 		s = spltty();
1036 		/*
1037 		 * XXXSMP - some drivers call back on us from t_param(), so
1038 		 *	    don't take the tty spin lock here.
1039 		 *	    require t_param() to unlock upon callback?
1040 		 */
1041 		/* wanted here: mutex_spin_enter(&tty_lock); */
1042 		if (!ISSET(t->c_cflag, CIGNORE)) {
1043 			/*
1044 			 * Set device hardware.
1045 			 */
1046 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1047 				/* wanted here: mutex_spin_exit(&tty_lock); */
1048 				splx(s);
1049 				return (error);
1050 			} else {
1051 				tp->t_cflag = t->c_cflag;
1052 				tp->t_ispeed = t->c_ispeed;
1053 				tp->t_ospeed = t->c_ospeed;
1054 				if (t->c_ospeed == 0)
1055 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1056 			}
1057 			ttsetwater(tp);
1058 		}
1059 
1060 		/* delayed lock acquiring */
1061 		mutex_spin_enter(&tty_lock);
1062 		if (cmd != TIOCSETAF) {
1063 			if (ISSET(t->c_lflag, ICANON) !=
1064 			    ISSET(tp->t_lflag, ICANON)) {
1065 				if (ISSET(t->c_lflag, ICANON)) {
1066 					SET(tp->t_lflag, PENDIN);
1067 					ttwakeup(tp);
1068 				} else {
1069 					struct clist tq;
1070 
1071 					catq(&tp->t_rawq, &tp->t_canq);
1072 					tq = tp->t_rawq;
1073 					tp->t_rawq = tp->t_canq;
1074 					tp->t_canq = tq;
1075 					CLR(tp->t_lflag, PENDIN);
1076 				}
1077 			}
1078 		}
1079 		tp->t_iflag = t->c_iflag;
1080 		tp->t_oflag = t->c_oflag;
1081 		/*
1082 		 * Make the EXTPROC bit read only.
1083 		 */
1084 		if (ISSET(tp->t_lflag, EXTPROC))
1085 			SET(t->c_lflag, EXTPROC);
1086 		else
1087 			CLR(t->c_lflag, EXTPROC);
1088 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1089 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1090 		mutex_spin_exit(&tty_lock);
1091 		splx(s);
1092 		break;
1093 	}
1094 	case TIOCSETD:			/* set line discipline (old) */
1095 		lp = ttyldisc_lookup_bynum(*(int *)data);
1096 		goto setldisc;
1097 
1098 	case TIOCSLINED: {		/* set line discipline (new) */
1099 		char *name = (char *)data;
1100 		dev_t device;
1101 
1102 		/* Null terminate to prevent buffer overflow */
1103 		name[TTLINEDNAMELEN - 1] = '\0';
1104 		lp = ttyldisc_lookup(name);
1105  setldisc:
1106 		if (lp == NULL)
1107 			return (ENXIO);
1108 
1109 		if (lp != tp->t_linesw) {
1110 			device = tp->t_dev;
1111 			s = spltty();
1112 			(*tp->t_linesw->l_close)(tp, flag);
1113 			error = (*lp->l_open)(device, tp);
1114 			if (error) {
1115 				(void)(*tp->t_linesw->l_open)(device, tp);
1116 				splx(s);
1117 				ttyldisc_release(lp);
1118 				return (error);
1119 			}
1120 			ttyldisc_release(tp->t_linesw);
1121 			tp->t_linesw = lp;
1122 			splx(s);
1123 		} else {
1124 			/* Drop extra reference. */
1125 			ttyldisc_release(lp);
1126 		}
1127 		break;
1128 	}
1129 	case TIOCSTART:			/* start output, like ^Q */
1130 		mutex_spin_enter(&tty_lock);
1131 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1132 		    ISSET(tp->t_lflag, FLUSHO)) {
1133 			CLR(tp->t_lflag, FLUSHO);
1134 			CLR(tp->t_state, TS_TTSTOP);
1135 			ttstart(tp);
1136 		}
1137 		mutex_spin_exit(&tty_lock);
1138 		break;
1139 	case TIOCSTI:			/* simulate terminal input */
1140 		if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_STI,
1141 		    tp) != 0) {
1142 			if (!ISSET(flag, FREAD))
1143 				return (EPERM);
1144 			if (!isctty(p, tp))
1145 				return (EACCES);
1146 		}
1147 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1148 		break;
1149 	case TIOCSTOP:			/* stop output, like ^S */
1150 	{
1151 		mutex_spin_enter(&tty_lock);
1152 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1153 			SET(tp->t_state, TS_TTSTOP);
1154 			cdev_stop(tp, 0);
1155 		}
1156 		mutex_spin_exit(&tty_lock);
1157 		break;
1158 	}
1159 	case TIOCSCTTY:			/* become controlling tty */
1160 		mutex_enter(proc_lock);
1161 		mutex_spin_enter(&tty_lock);
1162 
1163 		/* Session ctty vnode pointer set in vnode layer. */
1164 		if (!SESS_LEADER(p) ||
1165 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1166 		    (tp->t_session != p->p_session))) {
1167 			mutex_spin_exit(&tty_lock);
1168 			mutex_exit(proc_lock);
1169 			return (EPERM);
1170 		}
1171 
1172 		/*
1173 		 * `p_session' acquires a reference.
1174 		 * But note that if `t_session' is set at this point,
1175 		 * it must equal `p_session', in which case the session
1176 		 * already has the correct reference count.
1177 		 */
1178 		if (tp->t_session == NULL) {
1179 			proc_sesshold(p->p_session);
1180 		}
1181 		tp->t_session = p->p_session;
1182 		tp->t_pgrp = p->p_pgrp;
1183 		p->p_session->s_ttyp = tp;
1184 		p->p_lflag |= PL_CONTROLT;
1185 		mutex_spin_exit(&tty_lock);
1186 		mutex_exit(proc_lock);
1187 		break;
1188 	case FIOSETOWN: {		/* set pgrp of tty */
1189 		pid_t pgid = *(int *)data;
1190 		struct pgrp *pgrp;
1191 
1192 		mutex_enter(proc_lock);
1193 		if (tp->t_session != NULL && !isctty(p, tp)) {
1194 			mutex_exit(proc_lock);
1195 			return (ENOTTY);
1196 		}
1197 
1198 		if (pgid < 0) {
1199 			pgrp = pgrp_find(-pgid);
1200 			if (pgrp == NULL) {
1201 				mutex_exit(proc_lock);
1202 				return (EINVAL);
1203 			}
1204 		} else {
1205 			struct proc *p1;
1206 			p1 = proc_find(pgid);
1207 			if (!p1) {
1208 				mutex_exit(proc_lock);
1209 				return (ESRCH);
1210 			}
1211 			pgrp = p1->p_pgrp;
1212 		}
1213 
1214 		if (pgrp->pg_session != p->p_session) {
1215 			mutex_exit(proc_lock);
1216 			return (EPERM);
1217 		}
1218 		mutex_spin_enter(&tty_lock);
1219 		tp->t_pgrp = pgrp;
1220 		mutex_spin_exit(&tty_lock);
1221 		mutex_exit(proc_lock);
1222 		break;
1223 	}
1224 	case TIOCSPGRP: {		/* set pgrp of tty */
1225 		struct pgrp *pgrp;
1226 
1227 		mutex_enter(proc_lock);
1228 		if (!isctty(p, tp)) {
1229 			mutex_exit(proc_lock);
1230 			return (ENOTTY);
1231 		}
1232 		pgrp = pgrp_find(*(pid_t *)data);
1233 		if (pgrp == NULL) {
1234 			mutex_exit(proc_lock);
1235 			return (EINVAL);
1236 		}
1237 		if (pgrp->pg_session != p->p_session) {
1238 			mutex_exit(proc_lock);
1239 			return (EPERM);
1240 		}
1241 		mutex_spin_enter(&tty_lock);
1242 		tp->t_pgrp = pgrp;
1243 		mutex_spin_exit(&tty_lock);
1244 		mutex_exit(proc_lock);
1245 		break;
1246 	}
1247 	case TIOCSTAT:			/* get load avg stats */
1248 		mutex_enter(proc_lock);
1249 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1250 		mutex_exit(proc_lock);
1251 
1252 		mutex_spin_enter(&tty_lock);
1253 		ttyputinfo(tp, infobuf);
1254 		mutex_spin_exit(&tty_lock);
1255 		break;
1256 	case TIOCSWINSZ:		/* set window size */
1257 		mutex_spin_enter(&tty_lock);
1258 		if (memcmp((void *)&tp->t_winsize, data,
1259 		    sizeof(struct winsize))) {
1260 			tp->t_winsize = *(struct winsize *)data;
1261 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1262 		}
1263 		mutex_spin_exit(&tty_lock);
1264 		break;
1265 	default:
1266 		/* We may have to load the compat module for this. */
1267 		for (;;) {
1268 			rw_enter(&ttcompat_lock, RW_READER);
1269 			if (ttcompatvec != NULL) {
1270 				break;
1271 			}
1272 			rw_exit(&ttcompat_lock);
1273 			(void)module_autoload("compat", MODULE_CLASS_ANY);
1274 			if (ttcompatvec == NULL) {
1275 				return EPASSTHROUGH;
1276 			}
1277 		}
1278 		error = (*ttcompatvec)(tp, cmd, data, flag, l);
1279 		rw_exit(&ttcompat_lock);
1280 		return error;
1281 	}
1282 	return (0);
1283 }
1284 
1285 int
1286 ttpoll(struct tty *tp, int events, struct lwp *l)
1287 {
1288 	int	revents;
1289 
1290 	revents = 0;
1291 	mutex_spin_enter(&tty_lock);
1292 	if (events & (POLLIN | POLLRDNORM))
1293 		if (ttnread(tp) > 0)
1294 			revents |= events & (POLLIN | POLLRDNORM);
1295 
1296 	if (events & (POLLOUT | POLLWRNORM))
1297 		if (tp->t_outq.c_cc <= tp->t_lowat)
1298 			revents |= events & (POLLOUT | POLLWRNORM);
1299 
1300 	if (events & POLLHUP)
1301 		if (!CONNECTED(tp))
1302 			revents |= POLLHUP;
1303 
1304 	if (revents == 0) {
1305 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1306 			selrecord(l, &tp->t_rsel);
1307 
1308 		if (events & (POLLOUT | POLLWRNORM))
1309 			selrecord(l, &tp->t_wsel);
1310 	}
1311 
1312 	mutex_spin_exit(&tty_lock);
1313 
1314 	return (revents);
1315 }
1316 
1317 static void
1318 filt_ttyrdetach(struct knote *kn)
1319 {
1320 	struct tty	*tp;
1321 
1322 	tp = kn->kn_hook;
1323 	mutex_spin_enter(&tty_lock);
1324 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1325 	mutex_spin_exit(&tty_lock);
1326 }
1327 
1328 static int
1329 filt_ttyread(struct knote *kn, long hint)
1330 {
1331 	struct tty	*tp;
1332 
1333 	tp = kn->kn_hook;
1334 	if ((hint & NOTE_SUBMIT) == 0)
1335 		mutex_spin_enter(&tty_lock);
1336 	kn->kn_data = ttnread(tp);
1337 	if ((hint & NOTE_SUBMIT) == 0)
1338 		mutex_spin_exit(&tty_lock);
1339 	return (kn->kn_data > 0);
1340 }
1341 
1342 static void
1343 filt_ttywdetach(struct knote *kn)
1344 {
1345 	struct tty	*tp;
1346 
1347 	tp = kn->kn_hook;
1348 	mutex_spin_enter(&tty_lock);
1349 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1350 	mutex_spin_exit(&tty_lock);
1351 }
1352 
1353 static int
1354 filt_ttywrite(struct knote *kn, long hint)
1355 {
1356 	struct tty	*tp;
1357 	int		canwrite;
1358 
1359 	tp = kn->kn_hook;
1360 	if ((hint & NOTE_SUBMIT) == 0)
1361 		mutex_spin_enter(&tty_lock);
1362 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1363 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1364 	if ((hint & NOTE_SUBMIT) == 0)
1365 		mutex_spin_exit(&tty_lock);
1366 	return (canwrite);
1367 }
1368 
1369 static const struct filterops ttyread_filtops =
1370 	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1371 static const struct filterops ttywrite_filtops =
1372 	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1373 
1374 int
1375 ttykqfilter(dev_t dev, struct knote *kn)
1376 {
1377 	struct tty	*tp;
1378 	struct klist	*klist;
1379 
1380 	if ((tp = cdev_tty(dev)) == NULL)
1381 		return (ENXIO);
1382 
1383 	switch (kn->kn_filter) {
1384 	case EVFILT_READ:
1385 		klist = &tp->t_rsel.sel_klist;
1386 		kn->kn_fop = &ttyread_filtops;
1387 		break;
1388 	case EVFILT_WRITE:
1389 		klist = &tp->t_wsel.sel_klist;
1390 		kn->kn_fop = &ttywrite_filtops;
1391 		break;
1392 	default:
1393 		return EINVAL;
1394 	}
1395 
1396 	kn->kn_hook = tp;
1397 
1398 	mutex_spin_enter(&tty_lock);
1399 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1400 	mutex_spin_exit(&tty_lock);
1401 
1402 	return (0);
1403 }
1404 
1405 /*
1406  * Find the number of chars ready to be read from this tty.
1407  * Call with the tty lock held.
1408  */
1409 static int
1410 ttnread(struct tty *tp)
1411 {
1412 	int	nread;
1413 
1414 	KASSERT(mutex_owned(&tty_lock));
1415 
1416 	if (ISSET(tp->t_lflag, PENDIN))
1417 		ttypend(tp);
1418 	nread = tp->t_canq.c_cc;
1419 	if (!ISSET(tp->t_lflag, ICANON)) {
1420 		nread += tp->t_rawq.c_cc;
1421 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1422 			nread = 0;
1423 	}
1424 	return (nread);
1425 }
1426 
1427 /*
1428  * Wait for output to drain.
1429  */
1430 int
1431 ttywait(struct tty *tp)
1432 {
1433 	int	error;
1434 
1435 	error = 0;
1436 
1437 	mutex_spin_enter(&tty_lock);
1438 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1439 	    CONNECTED(tp) && tp->t_oproc) {
1440 		(*tp->t_oproc)(tp);
1441 		error = ttysleep(tp, &tp->t_outcv, true, 0);
1442 		if (error)
1443 			break;
1444 	}
1445 	mutex_spin_exit(&tty_lock);
1446 
1447 	return (error);
1448 }
1449 
1450 /*
1451  * Flush if successfully wait.
1452  */
1453 int
1454 ttywflush(struct tty *tp)
1455 {
1456 	int	error;
1457 
1458 	if ((error = ttywait(tp)) == 0) {
1459 		mutex_spin_enter(&tty_lock);
1460 		ttyflush(tp, FREAD);
1461 		mutex_spin_exit(&tty_lock);
1462 	}
1463 	return (error);
1464 }
1465 
1466 /*
1467  * Flush tty read and/or write queues, notifying anyone waiting.
1468  * Call with the tty lock held.
1469  */
1470 void
1471 ttyflush(struct tty *tp, int rw)
1472 {
1473 
1474 	KASSERT(mutex_owned(&tty_lock));
1475 
1476 	if (rw & FREAD) {
1477 		FLUSHQ(&tp->t_canq);
1478 		FLUSHQ(&tp->t_rawq);
1479 		tp->t_rocount = 0;
1480 		tp->t_rocol = 0;
1481 		CLR(tp->t_state, TS_LOCAL);
1482 		ttwakeup(tp);
1483 	}
1484 	if (rw & FWRITE) {
1485 		CLR(tp->t_state, TS_TTSTOP);
1486 		cdev_stop(tp, rw);
1487 		FLUSHQ(&tp->t_outq);
1488 		cv_broadcast(&tp->t_outcv);
1489 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1490 	}
1491 }
1492 
1493 /*
1494  * Copy in the default termios characters.
1495  */
1496 void
1497 ttychars(struct tty *tp)
1498 {
1499 
1500 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1501 }
1502 
1503 /*
1504  * Send stop character on input overflow.
1505  * Call with the tty lock held.
1506  */
1507 static void
1508 ttyblock(struct tty *tp)
1509 {
1510 	int	total;
1511 
1512 	KASSERT(mutex_owned(&tty_lock));
1513 
1514 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1515 	if (tp->t_rawq.c_cc > TTYHOG) {
1516 		ttyflush(tp, FREAD | FWRITE);
1517 		CLR(tp->t_state, TS_TBLOCK);
1518 	}
1519 	/*
1520 	 * Block further input iff: current input > threshold
1521 	 * AND input is available to user program.
1522 	 */
1523 	if (total >= TTYHOG / 2 &&
1524 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1525 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1526 		if (ISSET(tp->t_iflag, IXOFF) &&
1527 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1528 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1529 			SET(tp->t_state, TS_TBLOCK);
1530 			ttstart(tp);
1531 		}
1532 		/* Try to block remote output via hardware flow control. */
1533 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1534 		    (*tp->t_hwiflow)(tp, 1) != 0)
1535 			SET(tp->t_state, TS_TBLOCK);
1536 	}
1537 }
1538 
1539 /*
1540  * Delayed line discipline output
1541  */
1542 void
1543 ttrstrt(void *tp_arg)
1544 {
1545 	struct tty	*tp;
1546 
1547 #ifdef DIAGNOSTIC
1548 	if (tp_arg == NULL)
1549 		panic("ttrstrt");
1550 #endif
1551 	tp = tp_arg;
1552 	mutex_spin_enter(&tty_lock);
1553 
1554 	CLR(tp->t_state, TS_TIMEOUT);
1555 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1556 
1557 	mutex_spin_exit(&tty_lock);
1558 }
1559 
1560 /*
1561  * start a line discipline
1562  * Always call with tty lock held?
1563  */
1564 int
1565 ttstart(struct tty *tp)
1566 {
1567 
1568 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1569 		(*tp->t_oproc)(tp);
1570 	return (0);
1571 }
1572 
1573 /*
1574  * "close" a line discipline
1575  */
1576 int
1577 ttylclose(struct tty *tp, int flag)
1578 {
1579 
1580 	if (flag & FNONBLOCK) {
1581 		mutex_spin_enter(&tty_lock);
1582 		ttyflush(tp, FREAD | FWRITE);
1583 		mutex_spin_exit(&tty_lock);
1584 	} else
1585 		ttywflush(tp);
1586 	return (0);
1587 }
1588 
1589 /*
1590  * Handle modem control transition on a tty.
1591  * Flag indicates new state of carrier.
1592  * Returns 0 if the line should be turned off, otherwise 1.
1593  */
1594 int
1595 ttymodem(struct tty *tp, int flag)
1596 {
1597 
1598 	mutex_spin_enter(&tty_lock);
1599 	if (flag == 0) {
1600 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1601 			/*
1602 			 * Lost carrier.
1603 			 */
1604 			CLR(tp->t_state, TS_CARR_ON);
1605 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1606 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1607 				ttyflush(tp, FREAD | FWRITE);
1608 				mutex_spin_exit(&tty_lock);
1609 				return (0);
1610 			}
1611 		}
1612 	} else {
1613 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1614 			/*
1615 			 * Carrier now on.
1616 			 */
1617 			SET(tp->t_state, TS_CARR_ON);
1618 			ttwakeup(tp);
1619 		}
1620 	}
1621 	mutex_spin_exit(&tty_lock);
1622 
1623 	return (1);
1624 }
1625 
1626 /*
1627  * Default modem control routine (for other line disciplines).
1628  * Return argument flag, to turn off device on carrier drop.
1629  */
1630 int
1631 nullmodem(struct tty *tp, int flag)
1632 {
1633 
1634 	mutex_spin_enter(&tty_lock);
1635 	if (flag)
1636 		SET(tp->t_state, TS_CARR_ON);
1637 	else {
1638 		CLR(tp->t_state, TS_CARR_ON);
1639 		if (!CONNECTED(tp)) {
1640 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1641 			mutex_spin_exit(&tty_lock);
1642 			return (0);
1643 		}
1644 	}
1645 	mutex_spin_exit(&tty_lock);
1646 
1647 	return (1);
1648 }
1649 
1650 /*
1651  * Reinput pending characters after state switch.
1652  */
1653 void
1654 ttypend(struct tty *tp)
1655 {
1656 	struct clist	tq;
1657 	int		c;
1658 
1659 	KASSERT(mutex_owned(&tty_lock));
1660 
1661 	CLR(tp->t_lflag, PENDIN);
1662 	SET(tp->t_state, TS_TYPEN);
1663 	tq = tp->t_rawq;
1664 	tp->t_rawq.c_cc = 0;
1665 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1666 	while ((c = getc(&tq)) >= 0)
1667 		ttyinput_wlock(c, tp);
1668 	CLR(tp->t_state, TS_TYPEN);
1669 }
1670 
1671 /*
1672  * Process a read call on a tty device.
1673  */
1674 int
1675 ttread(struct tty *tp, struct uio *uio, int flag)
1676 {
1677 	struct clist	*qp;
1678 	u_char		*cc;
1679 	struct proc	*p;
1680 	int		c, first, error, has_stime, last_cc;
1681 	long		lflag, slp;
1682 	struct timeval	now, stime;
1683 
1684 	if (uio->uio_resid == 0)
1685 		return 0;
1686 
1687 	stime.tv_usec = 0;	/* XXX gcc */
1688 	stime.tv_sec = 0;	/* XXX gcc */
1689 
1690 	cc = tp->t_cc;
1691 	p = curproc;
1692 	error = 0;
1693 	has_stime = 0;
1694 	last_cc = 0;
1695 	slp = 0;
1696 
1697  loop:
1698 	mutex_spin_enter(&tty_lock);
1699 	lflag = tp->t_lflag;
1700 	/*
1701 	 * take pending input first
1702 	 */
1703 	if (ISSET(lflag, PENDIN))
1704 		ttypend(tp);
1705 
1706 	/*
1707 	 * Hang process if it's in the background.
1708 	 */
1709 	if (isbackground(p, tp)) {
1710 		if (sigismasked(curlwp, SIGTTIN) ||
1711 		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1712 			mutex_spin_exit(&tty_lock);
1713 			return (EIO);
1714 		}
1715 		mutex_spin_exit(&tty_lock);
1716 
1717 		mutex_enter(proc_lock);
1718 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1719 		mutex_exit(proc_lock);
1720 
1721 		mutex_spin_enter(&tty_lock);
1722 		error = ttysleep(tp, &lbolt, true, 0);
1723 		mutex_spin_exit(&tty_lock);
1724 		if (error)
1725 			return (error);
1726 		goto loop;
1727 	}
1728 
1729 	if (!ISSET(lflag, ICANON)) {
1730 		int m = cc[VMIN];
1731 		long t = cc[VTIME];
1732 
1733 		qp = &tp->t_rawq;
1734 		/*
1735 		 * Check each of the four combinations.
1736 		 * (m > 0 && t == 0) is the normal read case.
1737 		 * It should be fairly efficient, so we check that and its
1738 		 * companion case (m == 0 && t == 0) first.
1739 		 * For the other two cases, we compute the target sleep time
1740 		 * into slp.
1741 		 */
1742 		if (t == 0) {
1743 			if (qp->c_cc < m)
1744 				goto sleep;
1745 			goto read;
1746 		}
1747 		t *= hz;		/* time in deca-ticks */
1748 /*
1749  * Time difference in deca-ticks, split division to avoid numeric overflow.
1750  * Ok for hz < ~200kHz
1751  */
1752 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1753 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1754 		if (m > 0) {
1755 			if (qp->c_cc <= 0)
1756 				goto sleep;
1757 			if (qp->c_cc >= m)
1758 				goto read;
1759 			if (!has_stime) {
1760 				/* first character, start timer */
1761 				has_stime = 1;
1762 				getmicrotime(&stime);
1763 				slp = t;
1764 			} else if (qp->c_cc > last_cc) {
1765 				/* got a character, restart timer */
1766 				getmicrotime(&stime);
1767 				slp = t;
1768 			} else {
1769 				/* nothing, check expiration */
1770 				getmicrotime(&now);
1771 				slp = t - diff(now, stime);
1772 			}
1773 		} else {	/* m == 0 */
1774 			if (qp->c_cc > 0)
1775 				goto read;
1776 			if (!has_stime) {
1777 				has_stime = 1;
1778 				getmicrotime(&stime);
1779 				slp = t;
1780 			} else {
1781 				getmicrotime(&now);
1782 				slp = t - diff(now, stime);
1783 			}
1784 		}
1785 		last_cc = qp->c_cc;
1786 #undef diff
1787 		if (slp > 0) {
1788 			/*
1789 			 * Convert deca-ticks back to ticks.
1790 			 * Rounding down may make us wake up just short
1791 			 * of the target, so we round up.
1792 			 * Maybe we should do 'slp/10 + 1' because the
1793 			 * first tick maybe almost immediate.
1794 			 * However it is more useful for a program that sets
1795 			 * VTIME=10 to wakeup every second not every 1.01
1796 			 * seconds (if hz=100).
1797 			 */
1798 			slp = (slp + 9)/ 10;
1799 			goto sleep;
1800 		}
1801 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1802 		int	carrier;
1803 
1804  sleep:
1805 		/*
1806 		 * If there is no input, sleep on rawq
1807 		 * awaiting hardware receipt and notification.
1808 		 * If we have data, we don't need to check for carrier.
1809 		 */
1810 		carrier = CONNECTED(tp);
1811 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1812 			mutex_spin_exit(&tty_lock);
1813 			return (0);	/* EOF */
1814 		}
1815 		if (!has_stime || slp <= 0) {
1816 			if (flag & IO_NDELAY) {
1817 				mutex_spin_exit(&tty_lock);
1818 				return (EWOULDBLOCK);
1819 			}
1820 		}
1821 		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1822 		mutex_spin_exit(&tty_lock);
1823 		/* VMIN == 0: any quantity read satisfies */
1824 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1825 			return (0);
1826 		if (error && error != EWOULDBLOCK)
1827 			return (error);
1828 		goto loop;
1829 	}
1830  read:
1831 	mutex_spin_exit(&tty_lock);
1832 
1833 	/*
1834 	 * Input present, check for input mapping and processing.
1835 	 */
1836 	first = 1;
1837 	while ((c = getc(qp)) >= 0) {
1838 		/*
1839 		 * delayed suspend (^Y)
1840 		 */
1841 		if (CCEQ(cc[VDSUSP], c) &&
1842 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
1843 			mutex_spin_enter(&tty_lock);
1844 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
1845 			if (first) {
1846 				error = ttysleep(tp, &lbolt, true, 0);
1847 				mutex_spin_exit(&tty_lock);
1848 				if (error)
1849 					break;
1850 				goto loop;
1851 			} else
1852 				mutex_spin_exit(&tty_lock);
1853 			break;
1854 		}
1855 		/*
1856 		 * Interpret EOF only in canonical mode.
1857 		 */
1858 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1859 			break;
1860 		/*
1861 		 * Give user character.
1862 		 */
1863  		error = ureadc(c, uio);
1864 		if (error)
1865 			break;
1866  		if (uio->uio_resid == 0)
1867 			break;
1868 		/*
1869 		 * In canonical mode check for a "break character"
1870 		 * marking the end of a "line of input".
1871 		 */
1872 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1873 			break;
1874 		first = 0;
1875 	}
1876 	/*
1877 	 * Look to unblock output now that (presumably)
1878 	 * the input queue has gone down.
1879 	 */
1880 	mutex_spin_enter(&tty_lock);
1881 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
1882 		if (ISSET(tp->t_iflag, IXOFF) &&
1883 		    cc[VSTART] != _POSIX_VDISABLE &&
1884 		    putc(cc[VSTART], &tp->t_outq) == 0) {
1885 			CLR(tp->t_state, TS_TBLOCK);
1886 			ttstart(tp);
1887 		}
1888 		/* Try to unblock remote output via hardware flow control. */
1889 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1890 		    (*tp->t_hwiflow)(tp, 0) != 0)
1891 			CLR(tp->t_state, TS_TBLOCK);
1892 	}
1893 	mutex_spin_exit(&tty_lock);
1894 
1895 	return (error);
1896 }
1897 
1898 /*
1899  * Check the output queue on tp for space for a kernel message (from uprintf
1900  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1901  * lose messages due to normal flow control, but don't let the tty run amok.
1902  * Sleeps here are not interruptible, but we return prematurely if new signals
1903  * arrive.
1904  * Call with tty lock held.
1905  */
1906 static int
1907 ttycheckoutq_wlock(struct tty *tp, int wait)
1908 {
1909 	int	hiwat, error;
1910 
1911 	KASSERT(mutex_owned(&tty_lock));
1912 
1913 	hiwat = tp->t_hiwat;
1914 	if (tp->t_outq.c_cc > hiwat + 200)
1915 		while (tp->t_outq.c_cc > hiwat) {
1916 			ttstart(tp);
1917 			if (wait == 0)
1918 				return (0);
1919 			error = ttysleep(tp, &tp->t_outcv, true, hz);
1920 			if (error == EINTR)
1921 				wait = 0;
1922 		}
1923 
1924 	return (1);
1925 }
1926 
1927 int
1928 ttycheckoutq(struct tty *tp, int wait)
1929 {
1930 	int	r;
1931 
1932 	mutex_spin_enter(&tty_lock);
1933 	r = ttycheckoutq_wlock(tp, wait);
1934 	mutex_spin_exit(&tty_lock);
1935 
1936 	return (r);
1937 }
1938 
1939 /*
1940  * Process a write call on a tty device.
1941  */
1942 int
1943 ttwrite(struct tty *tp, struct uio *uio, int flag)
1944 {
1945 	u_char		*cp;
1946 	struct proc	*p;
1947 	int		cc, ce, i, hiwat, error;
1948 	u_char		obuf[OBUFSIZ];
1949 
1950 	cp = NULL;
1951 	hiwat = tp->t_hiwat;
1952 	error = 0;
1953 	cc = 0;
1954  loop:
1955 	mutex_spin_enter(&tty_lock);
1956 	if (!CONNECTED(tp)) {
1957 		if (ISSET(tp->t_state, TS_ISOPEN)) {
1958 			mutex_spin_exit(&tty_lock);
1959 			return (EIO);
1960 		} else if (flag & IO_NDELAY) {
1961 			mutex_spin_exit(&tty_lock);
1962 			error = EWOULDBLOCK;
1963 			goto out;
1964 		} else {
1965 			/* Sleep awaiting carrier. */
1966 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
1967 			mutex_spin_exit(&tty_lock);
1968 			if (error)
1969 				goto out;
1970 			goto loop;
1971 		}
1972 	}
1973 
1974 	/*
1975 	 * Hang the process if it's in the background.
1976 	 */
1977 	p = curproc;
1978 	if (isbackground(p, tp) &&
1979 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
1980 	    !sigismasked(curlwp, SIGTTOU)) {
1981 		if (p->p_pgrp->pg_jobc == 0) {
1982 			error = EIO;
1983 			mutex_spin_exit(&tty_lock);
1984 			goto out;
1985 		}
1986 		mutex_spin_exit(&tty_lock);
1987 
1988 		mutex_enter(proc_lock);
1989 		pgsignal(p->p_pgrp, SIGTTOU, 1);
1990 		mutex_exit(proc_lock);
1991 
1992 		mutex_spin_enter(&tty_lock);
1993 		error = ttysleep(tp, &lbolt, true, 0);
1994 		mutex_spin_exit(&tty_lock);
1995 		if (error)
1996 			goto out;
1997 		goto loop;
1998 	}
1999 	mutex_spin_exit(&tty_lock);
2000 
2001 	/*
2002 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2003 	 * output translation.  Keep track of high water mark, sleep on
2004 	 * overflow awaiting device aid in acquiring new space.
2005 	 */
2006 	while (uio->uio_resid > 0 || cc > 0) {
2007 		if (ISSET(tp->t_lflag, FLUSHO)) {
2008 			uio->uio_resid = 0;
2009 			return (0);
2010 		}
2011 		if (tp->t_outq.c_cc > hiwat)
2012 			goto ovhiwat;
2013 		/*
2014 		 * Grab a hunk of data from the user, unless we have some
2015 		 * leftover from last time.
2016 		 */
2017 		if (cc == 0) {
2018 			cc = min(uio->uio_resid, OBUFSIZ);
2019 			cp = obuf;
2020 			error = uiomove(cp, cc, uio);
2021 			if (error) {
2022 				cc = 0;
2023 				goto out;
2024 			}
2025 		}
2026 		/*
2027 		 * If nothing fancy need be done, grab those characters we
2028 		 * can handle without any of ttyoutput's processing and
2029 		 * just transfer them to the output q.  For those chars
2030 		 * which require special processing (as indicated by the
2031 		 * bits in char_type), call ttyoutput.  After processing
2032 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2033 		 * immediately.
2034 		 */
2035 		mutex_spin_enter(&tty_lock);
2036 		while (cc > 0) {
2037 			if (!ISSET(tp->t_oflag, OPOST))
2038 				ce = cc;
2039 			else {
2040 				ce = cc - scanc((u_int)cc, cp, char_type,
2041 				    CCLASSMASK);
2042 				/*
2043 				 * If ce is zero, then we're processing
2044 				 * a special character through ttyoutput.
2045 				 */
2046 				if (ce == 0) {
2047 					tp->t_rocount = 0;
2048 					if (ttyoutput(*cp, tp) >= 0) {
2049 						/* out of space */
2050 						mutex_spin_exit(&tty_lock);
2051 						goto overfull;
2052 					}
2053 					cp++;
2054 					cc--;
2055 					if (ISSET(tp->t_lflag, FLUSHO) ||
2056 					    tp->t_outq.c_cc > hiwat) {
2057 						mutex_spin_exit(&tty_lock);
2058 						goto ovhiwat;
2059 					}
2060 					continue;
2061 				}
2062 			}
2063 			/*
2064 			 * A bunch of normal characters have been found.
2065 			 * Transfer them en masse to the output queue and
2066 			 * continue processing at the top of the loop.
2067 			 * If there are any further characters in this
2068 			 * <= OBUFSIZ chunk, the first should be a character
2069 			 * requiring special handling by ttyoutput.
2070 			 */
2071 			tp->t_rocount = 0;
2072 			i = b_to_q(cp, ce, &tp->t_outq);
2073 			ce -= i;
2074 			tp->t_column += ce;
2075 			cp += ce, cc -= ce, tk_nout += ce;
2076 			tp->t_outcc += ce;
2077 			if (i > 0) {
2078 				/* out of space */
2079 				mutex_spin_exit(&tty_lock);
2080 				goto overfull;
2081 			}
2082 			if (ISSET(tp->t_lflag, FLUSHO) ||
2083 			    tp->t_outq.c_cc > hiwat)
2084 				break;
2085 		}
2086 		ttstart(tp);
2087 		mutex_spin_exit(&tty_lock);
2088 	}
2089 
2090  out:
2091 	/*
2092 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2093 	 * offset and iov pointers have moved forward, but it doesn't matter
2094 	 * (the call will either return short or restart with a new uio).
2095 	 */
2096 	uio->uio_resid += cc;
2097 	return (error);
2098 
2099  overfull:
2100 	/*
2101 	 * Since we are using ring buffers, if we can't insert any more into
2102 	 * the output queue, we can assume the ring is full and that someone
2103 	 * forgot to set the high water mark correctly.  We set it and then
2104 	 * proceed as normal.
2105 	 */
2106 	hiwat = tp->t_outq.c_cc - 1;
2107 
2108  ovhiwat:
2109 	mutex_spin_enter(&tty_lock);
2110 	ttstart(tp);
2111 	/*
2112 	 * This can only occur if FLUSHO is set in t_lflag,
2113 	 * or if ttstart/oproc is synchronous (or very fast).
2114 	 */
2115 	if (tp->t_outq.c_cc <= hiwat) {
2116 		mutex_spin_exit(&tty_lock);
2117 		goto loop;
2118 	}
2119 	if (flag & IO_NDELAY) {
2120 		mutex_spin_exit(&tty_lock);
2121 		error = EWOULDBLOCK;
2122 		goto out;
2123 	}
2124 	error = ttysleep(tp, &tp->t_outcv, true, 0);
2125 	mutex_spin_exit(&tty_lock);
2126 	if (error)
2127 		goto out;
2128 	goto loop;
2129 }
2130 
2131 /*
2132  * Try to pull more output from the producer.  Return non-zero if
2133  * there is output ready to be sent.
2134  */
2135 bool
2136 ttypull(struct tty *tp)
2137 {
2138 
2139 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2140 
2141 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2142 		cv_broadcast(&tp->t_outcv);
2143 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2144 	}
2145 	return tp->t_outq.c_cc != 0;
2146 }
2147 
2148 /*
2149  * Rubout one character from the rawq of tp
2150  * as cleanly as possible.
2151  * Called with tty lock held.
2152  */
2153 void
2154 ttyrub(int c, struct tty *tp)
2155 {
2156 	u_char	*cp;
2157 	int	savecol, tabc;
2158 
2159 	KASSERT(mutex_owned(&tty_lock));
2160 
2161 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2162 		return;
2163 	CLR(tp->t_lflag, FLUSHO);
2164 	if (ISSET(tp->t_lflag, ECHOE)) {
2165 		if (tp->t_rocount == 0) {
2166 			/*
2167 			 * Screwed by ttwrite; retype
2168 			 */
2169 			ttyretype(tp);
2170 			return;
2171 		}
2172 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2173 			ttyrubo(tp, 2);
2174 		else {
2175 			CLR(c, ~TTY_CHARMASK);
2176 			switch (CCLASS(c)) {
2177 			case ORDINARY:
2178 				ttyrubo(tp, 1);
2179 				break;
2180 			case BACKSPACE:
2181 			case CONTROL:
2182 			case NEWLINE:
2183 			case RETURN:
2184 			case VTAB:
2185 				if (ISSET(tp->t_lflag, ECHOCTL))
2186 					ttyrubo(tp, 2);
2187 				break;
2188 			case TAB:
2189 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2190 					ttyretype(tp);
2191 					return;
2192 				}
2193 				savecol = tp->t_column;
2194 				SET(tp->t_state, TS_CNTTB);
2195 				SET(tp->t_lflag, FLUSHO);
2196 				tp->t_column = tp->t_rocol;
2197 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2198 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2199 					ttyecho(tabc, tp);
2200 				CLR(tp->t_lflag, FLUSHO);
2201 				CLR(tp->t_state, TS_CNTTB);
2202 
2203 				/* savecol will now be length of the tab. */
2204 				savecol -= tp->t_column;
2205 				tp->t_column += savecol;
2206 				if (savecol > 8)
2207 					savecol = 8;	/* overflow screw */
2208 				while (--savecol >= 0)
2209 					(void)ttyoutput('\b', tp);
2210 				break;
2211 			default:			/* XXX */
2212 				(void)printf("ttyrub: would panic c = %d, "
2213 				    "val = %d\n", c, CCLASS(c));
2214 			}
2215 		}
2216 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2217 		if (!ISSET(tp->t_state, TS_ERASE)) {
2218 			SET(tp->t_state, TS_ERASE);
2219 			(void)ttyoutput('\\', tp);
2220 		}
2221 		ttyecho(c, tp);
2222 	} else
2223 		ttyecho(tp->t_cc[VERASE], tp);
2224 	--tp->t_rocount;
2225 }
2226 
2227 /*
2228  * Back over cnt characters, erasing them.
2229  * Called with tty lock held.
2230  */
2231 static void
2232 ttyrubo(struct tty *tp, int cnt)
2233 {
2234 
2235 	KASSERT(mutex_owned(&tty_lock));
2236 
2237 	while (cnt-- > 0) {
2238 		(void)ttyoutput('\b', tp);
2239 		(void)ttyoutput(' ', tp);
2240 		(void)ttyoutput('\b', tp);
2241 	}
2242 }
2243 
2244 /*
2245  * ttyretype --
2246  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2247  *	been checked.
2248  *
2249  * Called with tty lock held.
2250  */
2251 void
2252 ttyretype(struct tty *tp)
2253 {
2254 	u_char	*cp;
2255 	int	c;
2256 
2257 	KASSERT(mutex_owned(&tty_lock));
2258 
2259 	/* Echo the reprint character. */
2260 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2261 		ttyecho(tp->t_cc[VREPRINT], tp);
2262 
2263 	(void)ttyoutput('\n', tp);
2264 
2265 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2266 		ttyecho(c, tp);
2267 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2268 		ttyecho(c, tp);
2269 	CLR(tp->t_state, TS_ERASE);
2270 
2271 	tp->t_rocount = tp->t_rawq.c_cc;
2272 	tp->t_rocol = 0;
2273 }
2274 
2275 /*
2276  * Echo a typed character to the terminal.
2277  * Called with tty lock held.
2278  */
2279 static void
2280 ttyecho(int c, struct tty *tp)
2281 {
2282 
2283 	KASSERT(mutex_owned(&tty_lock));
2284 
2285 	if (!ISSET(tp->t_state, TS_CNTTB))
2286 		CLR(tp->t_lflag, FLUSHO);
2287 	if ((!ISSET(tp->t_lflag, ECHO) &&
2288 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2289 	    ISSET(tp->t_lflag, EXTPROC))
2290 		return;
2291 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2292 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2293 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2294 		(void)ttyoutput('^', tp);
2295 		CLR(c, ~TTY_CHARMASK);
2296 		if (c == 0177)
2297 			c = '?';
2298 		else
2299 			c += 'A' - 1;
2300 	}
2301 	(void)ttyoutput(c, tp);
2302 }
2303 
2304 /*
2305  * Wake up any readers on a tty.
2306  * Called with tty lock held.
2307  */
2308 void
2309 ttwakeup(struct tty *tp)
2310 {
2311 
2312 	KASSERT(mutex_owned(&tty_lock));
2313 
2314 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2315 	if (ISSET(tp->t_state, TS_ASYNC))
2316 		ttysig(tp, TTYSIG_PG2, SIGIO);
2317 	cv_broadcast(&tp->t_rawcv);
2318 }
2319 
2320 /*
2321  * Look up a code for a specified speed in a conversion table;
2322  * used by drivers to map software speed values to hardware parameters.
2323  */
2324 int
2325 ttspeedtab(int speed, const struct speedtab *table)
2326 {
2327 
2328 	for (; table->sp_speed != -1; table++)
2329 		if (table->sp_speed == speed)
2330 			return (table->sp_code);
2331 	return (-1);
2332 }
2333 
2334 /*
2335  * Set tty hi and low water marks.
2336  *
2337  * Try to arrange the dynamics so there's about one second
2338  * from hi to low water.
2339  */
2340 void
2341 ttsetwater(struct tty *tp)
2342 {
2343 	int	cps, x;
2344 
2345 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2346 
2347 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2348 
2349 	cps = tp->t_ospeed / 10;
2350 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2351 	x += cps;
2352 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2353 	tp->t_hiwat = roundup(x, CBSIZE);
2354 #undef	CLAMP
2355 }
2356 
2357 /*
2358  * Prepare report on state of foreground process group.
2359  * Call with proc_lock held.
2360  */
2361 void
2362 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2363 {
2364 	struct lwp	*l;
2365 	struct proc	*p, *pick = NULL;
2366 	struct timeval	utime, stime;
2367 	int		tmp;
2368 	fixpt_t		pctcpu = 0;
2369 	const char	*msg;
2370 	char		lmsg[100];
2371 	long		rss;
2372 
2373 	KASSERT(mutex_owned(proc_lock));
2374 
2375 	*buf = '\0';
2376 
2377 	if (tp->t_session == NULL)
2378 		msg = "not a controlling terminal\n";
2379 	else if (tp->t_pgrp == NULL)
2380 		msg = "no foreground process group\n";
2381 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2382 		msg = "empty foreground process group\n";
2383 	else {
2384 		/* Pick interesting process. */
2385 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2386 			struct proc *oldpick;
2387 
2388 			if (pick == NULL) {
2389 				pick = p;
2390 				continue;
2391 			}
2392 			if (pick->p_lock < p->p_lock) {
2393 				mutex_enter(pick->p_lock);
2394 				mutex_enter(p->p_lock);
2395 			} else if (pick->p_lock > p->p_lock) {
2396 				mutex_enter(p->p_lock);
2397 				mutex_enter(pick->p_lock);
2398 			} else
2399 				mutex_enter(p->p_lock);
2400 			oldpick = pick;
2401 			if (proc_compare(pick, p))
2402 				pick = p;
2403 			mutex_exit(p->p_lock);
2404 			if (p->p_lock != oldpick->p_lock)
2405 				mutex_exit(oldpick->p_lock);
2406 		}
2407 		if (fromsig &&
2408 		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2409 		    SA_NOKERNINFO))
2410 			return;
2411 		msg = NULL;
2412 	}
2413 
2414 	/* Print load average. */
2415 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2416 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2417 	strlcat(buf, lmsg, bufsz);
2418 
2419 	if (pick == NULL) {
2420 		strlcat(buf, msg, bufsz);
2421 		return;
2422 	}
2423 
2424 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2425 	    pick->p_pid);
2426 	strlcat(buf, lmsg, bufsz);
2427 
2428 	mutex_enter(pick->p_lock);
2429 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2430 		const char *lp;
2431 		lwp_lock(l);
2432 #ifdef LWP_PC
2433 #define FMT_RUN "%#"PRIxVADDR
2434 #define VAL_RUNNING (vaddr_t)LWP_PC(l)
2435 #define VAL_RUNABLE (vaddr_t)LWP_PC(l)
2436 #else
2437 #define FMT_RUN "%s"
2438 #define VAL_RUNNING "running"
2439 #define VAL_RUNABLE "runnable"
2440 #endif
2441 		switch (l->l_stat) {
2442 		case LSONPROC:
2443 			snprintf(lmsg, sizeof(lmsg), FMT_RUN"/%d", VAL_RUNNING,
2444 			    cpu_index(l->l_cpu));
2445 			lp = lmsg;
2446 			break;
2447 		case LSRUN:
2448 			snprintf(lmsg, sizeof(lmsg), FMT_RUN, VAL_RUNABLE);
2449 			lp = lmsg;
2450 			break;
2451 		default:
2452 			lp = l->l_wchan ? l->l_wmesg : "iowait";
2453 			break;
2454 		}
2455 		strlcat(buf, lp, bufsz);
2456 		strlcat(buf, LIST_NEXT(l, l_sibling) != NULL ? " " : "] ",
2457 		    bufsz);
2458 		pctcpu += l->l_pctcpu;
2459 		lwp_unlock(l);
2460 	}
2461 	pctcpu += pick->p_pctcpu;
2462 	calcru(pick, &utime, &stime, NULL, NULL);
2463 	mutex_exit(pick->p_lock);
2464 
2465 	/* Round up and print user+system time, %CPU and RSS. */
2466 	utime.tv_usec += 5000;
2467 	if (utime.tv_usec >= 1000000) {
2468 		utime.tv_sec += 1;
2469 		utime.tv_usec -= 1000000;
2470 	}
2471 	stime.tv_usec += 5000;
2472 	if (stime.tv_usec >= 1000000) {
2473 		stime.tv_sec += 1;
2474 		stime.tv_usec -= 1000000;
2475 	}
2476 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2477 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2478 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2479 		rss = 0;
2480 	else
2481 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2482 
2483 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2484 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2485 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2486 	    tmp / 100, rss);
2487 	strlcat(buf, lmsg, bufsz);
2488 }
2489 
2490 /*
2491  * Print report on state of foreground process group.
2492  * Call with tty_lock held.
2493  */
2494 void
2495 ttyputinfo(struct tty *tp, char *buf)
2496 {
2497 
2498 	KASSERT(mutex_owned(&tty_lock));
2499 
2500 	if (ttycheckoutq_wlock(tp, 0) == 0)
2501 		return;
2502 	ttyprintf_nolock(tp, "%s\n", buf);
2503 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2504 }
2505 
2506 /*
2507  * Returns 1 if p2 is "better" than p1
2508  *
2509  * The algorithm for picking the "interesting" process is thus:
2510  *
2511  *	1) Only foreground processes are eligible - implied.
2512  *	2) Runnable processes are favored over anything else.  The runner
2513  *	   with the highest CPU utilization is picked (l_pctcpu).  Ties are
2514  *	   broken by picking the highest pid.
2515  *	3) The sleeper with the shortest sleep time is next.  With ties,
2516  *	   we pick out just "short-term" sleepers (P_SINTR == 0).
2517  *	4) Further ties are broken by picking the highest pid.
2518  */
2519 #define	ISRUN(p)	((p)->p_nrlwps > 0)
2520 #define	TESTAB(a, b)	((a)<<1 | (b))
2521 #define	ONLYA	2
2522 #define	ONLYB	1
2523 #define	BOTH	3
2524 
2525 static int
2526 proc_compare(struct proc *p1, struct proc *p2)
2527 {
2528 	lwp_t *l1, *l2;
2529 
2530 	KASSERT(mutex_owned(p1->p_lock));
2531 	KASSERT(mutex_owned(p2->p_lock));
2532 
2533 	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2534 		return (1);
2535 	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2536 		return (0);
2537 	/*
2538 	 * see if at least one of them is runnable
2539 	 */
2540 	switch (TESTAB(ISRUN(p1), ISRUN(p2))) {
2541 	case ONLYA:
2542 		return (0);
2543 	case ONLYB:
2544 		return (1);
2545 	case BOTH:
2546 		/*
2547 		 * tie - favor one with highest recent CPU utilization
2548 		 */
2549 		if (l2->l_pctcpu > l1->l_pctcpu)
2550 			return (1);
2551 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2552 	}
2553 	/*
2554  	 * weed out zombies
2555 	 */
2556 	switch (TESTAB(P_ZOMBIE(p1), P_ZOMBIE(p2))) {
2557 	case ONLYA:
2558 		return (1);
2559 	case ONLYB:
2560 		return (0);
2561 	case BOTH:
2562 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2563 	}
2564 	/*
2565 	 * pick the one with the smallest sleep time
2566 	 */
2567 	if (l2->l_slptime > l2->l_slptime)
2568 		return (0);
2569 	if (l2->l_slptime > l2->l_slptime)
2570 		return (1);
2571 	/*
2572 	 * favor one sleeping in a non-interruptible sleep
2573 	 */
2574 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2575 		return (1);
2576 	if (l2->l_flag & LW_SINTR && (l2->l_flag & LW_SINTR) == 0)
2577 		return (0);
2578 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2579 }
2580 
2581 /*
2582  * Output char to tty; console putchar style.
2583  * Can be called with tty lock held through kprintf() machinery..
2584  */
2585 int
2586 tputchar(int c, int flags, struct tty *tp)
2587 {
2588 	int r = 0;
2589 
2590 	if ((flags & NOLOCK) == 0)
2591 		mutex_spin_enter(&tty_lock);
2592 	if (!CONNECTED(tp)) {
2593 		r = -1;
2594 		goto out;
2595 	}
2596 	if (c == '\n')
2597 		(void)ttyoutput('\r', tp);
2598 	(void)ttyoutput(c, tp);
2599 	ttstart(tp);
2600 out:
2601 	if ((flags & NOLOCK) == 0)
2602 		mutex_spin_exit(&tty_lock);
2603 	return (r);
2604 }
2605 
2606 /*
2607  * Sleep on chan, returning ERESTART if tty changed while we napped and
2608  * returning any errors (e.g. EINTR/ETIMEDOUT) reported by cv_timedwait(_sig).
2609  * If the tty is revoked, restarting a pending call will redo validation done
2610  * at the start of the call.
2611  *
2612  * Must be called with the tty lock held.
2613  */
2614 int
2615 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch, int timo)
2616 {
2617 	int	error;
2618 	short	gen;
2619 
2620 	KASSERT(mutex_owned(&tty_lock));
2621 
2622 	gen = tp->t_gen;
2623 	if (catch)
2624 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2625 	else
2626 		error = cv_timedwait(cv, &tty_lock, timo);
2627 	if (error != 0)
2628 		return (error);
2629 	return (tp->t_gen == gen ? 0 : ERESTART);
2630 }
2631 
2632 /*
2633  * Attach a tty to the tty list.
2634  *
2635  * This should be called ONLY once per real tty (including pty's).
2636  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2637  * distinctly NOT usable as tty's, and thus should not be attached to
2638  * the ttylist.  This is why this call is not done from tty_alloc().
2639  *
2640  * Device drivers should attach tty's at a similar time that they are
2641  * allocated, or, for the case of statically allocated struct tty's
2642  * either in the attach or (first) open routine.
2643  */
2644 void
2645 tty_attach(struct tty *tp)
2646 {
2647 
2648 	mutex_spin_enter(&tty_lock);
2649 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2650 	++tty_count;
2651 	mutex_spin_exit(&tty_lock);
2652 }
2653 
2654 /*
2655  * Remove a tty from the tty list.
2656  */
2657 void
2658 tty_detach(struct tty *tp)
2659 {
2660 
2661 	mutex_spin_enter(&tty_lock);
2662 	--tty_count;
2663 #ifdef DIAGNOSTIC
2664 	if (tty_count < 0)
2665 		panic("tty_detach: tty_count < 0");
2666 #endif
2667 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2668 	mutex_spin_exit(&tty_lock);
2669 }
2670 
2671 /*
2672  * Allocate a tty structure and its associated buffers.
2673  */
2674 struct tty *
2675 tty_alloc(void)
2676 {
2677 	struct tty *tp;
2678 	int i;
2679 
2680 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2681 	callout_init(&tp->t_rstrt_ch, 0);
2682 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2683 	/* XXX: default to 1024 chars for now */
2684 	clalloc(&tp->t_rawq, 1024, 1);
2685 	cv_init(&tp->t_rawcv, "ttyraw");
2686 	cv_init(&tp->t_rawcvf, "ttyrawf");
2687 	clalloc(&tp->t_canq, 1024, 1);
2688 	cv_init(&tp->t_cancv, "ttycan");
2689 	cv_init(&tp->t_cancvf, "ttycanf");
2690 	/* output queue doesn't need quoting */
2691 	clalloc(&tp->t_outq, 1024, 0);
2692 	cv_init(&tp->t_outcv, "ttyout");
2693 	cv_init(&tp->t_outcvf, "ttyoutf");
2694 	/* Set default line discipline. */
2695 	tp->t_linesw = ttyldisc_default();
2696 	tp->t_dev = NODEV;
2697 	selinit(&tp->t_rsel);
2698 	selinit(&tp->t_wsel);
2699 	for (i = 0; i < TTYSIG_COUNT; i++)  {
2700 		sigemptyset(&tp->t_sigs[i]);
2701 	}
2702 
2703 	return tp;
2704 }
2705 
2706 /*
2707  * Free a tty structure and its buffers.
2708  *
2709  * Be sure to call tty_detach() for any tty that has been
2710  * tty_attach()ed.
2711  */
2712 void
2713 tty_free(struct tty *tp)
2714 {
2715 	int i;
2716 
2717 	mutex_enter(proc_lock);
2718 	mutex_enter(&tty_lock);
2719 	for (i = 0; i < TTYSIG_COUNT; i++)
2720 		sigemptyset(&tp->t_sigs[i]);
2721 	if (tp->t_sigcount != 0)
2722 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2723 	mutex_exit(&tty_lock);
2724 	mutex_exit(proc_lock);
2725 
2726 	callout_halt(&tp->t_rstrt_ch, NULL);
2727 	callout_destroy(&tp->t_rstrt_ch);
2728 	ttyldisc_release(tp->t_linesw);
2729 	clfree(&tp->t_rawq);
2730 	clfree(&tp->t_canq);
2731 	clfree(&tp->t_outq);
2732 	cv_destroy(&tp->t_rawcv);
2733 	cv_destroy(&tp->t_rawcvf);
2734 	cv_destroy(&tp->t_cancv);
2735 	cv_destroy(&tp->t_cancvf);
2736 	cv_destroy(&tp->t_outcv);
2737 	cv_destroy(&tp->t_outcvf);
2738 	seldestroy(&tp->t_rsel);
2739 	seldestroy(&tp->t_wsel);
2740 	kmem_free(tp, sizeof(*tp));
2741 }
2742 
2743 /*
2744  * ttyprintf_nolock: send a message to a specific tty, without locking.
2745  *
2746  * => should be used only by tty driver or anything that knows the
2747  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2748  *    use tprintf]
2749  */
2750 static void
2751 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2752 {
2753 	va_list ap;
2754 
2755 	/* No mutex needed; going to process TTY. */
2756 	va_start(ap, fmt);
2757 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2758 	va_end(ap);
2759 }
2760 
2761 static int
2762 tty_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
2763     void *arg0, void *arg1, void *arg2, void *arg3)
2764 {
2765 	struct tty *tty;
2766 	int result;
2767 
2768 	result = KAUTH_RESULT_DEFER;
2769 
2770 	if (action != KAUTH_DEVICE_TTY_OPEN)
2771 		return result;
2772 
2773 	tty = arg0;
2774 
2775 	/* If it's not opened, we allow. */
2776 	if ((tty->t_state & TS_ISOPEN) == 0)
2777 		result = KAUTH_RESULT_ALLOW;
2778 	else {
2779 		/*
2780 		 * If it's opened, we can only allow if it's not exclusively
2781 		 * opened; otherwise, that's a privileged operation and we
2782 		 * let the secmodel handle it.
2783 		 */
2784 		if ((tty->t_state & TS_XCLUDE) == 0)
2785 			result = KAUTH_RESULT_ALLOW;
2786 	}
2787 
2788 	return result;
2789 }
2790 
2791 /*
2792  * Initialize the tty subsystem.
2793  */
2794 void
2795 tty_init(void)
2796 {
2797 
2798 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2799 	rw_init(&ttcompat_lock);
2800 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2801 	KASSERT(tty_sigsih != NULL);
2802 
2803 	tty_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
2804 	    tty_listener_cb, NULL);
2805 
2806 	sysctl_kern_tkstat_setup();
2807 }
2808 
2809 /*
2810  * Send a signal from a tty to its process group or session leader.
2811  * Handoff to the target is deferred to a soft interrupt.
2812  */
2813 void
2814 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2815 {
2816 	sigset_t *sp;
2817 
2818 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2819 
2820 	sp = &tp->t_sigs[st];
2821 	if (sigismember(sp, sig))
2822 		return;
2823 	sigaddset(sp, sig);
2824 	if (tp->t_sigcount++ == 0)
2825 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2826 	softint_schedule(tty_sigsih);
2827 }
2828 
2829 /*
2830  * Deliver deferred signals from ttys.  Note that the process groups
2831  * and sessions associated with the ttys may have changed from when
2832  * the signal was originally sent, but in practice it should not matter.
2833  * For signals produced as a result of a syscall, the soft interrupt
2834  * will fire before the syscall returns to the user.
2835  */
2836 static void
2837 ttysigintr(void *cookie)
2838 {
2839 	struct tty *tp;
2840 	enum ttysigtype st;
2841 	struct pgrp *pgrp;
2842 	struct session *sess;
2843 	int sig, lflag;
2844 	char infobuf[200];
2845 
2846 	mutex_enter(proc_lock);
2847 	mutex_spin_enter(&tty_lock);
2848 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2849 		KASSERT(tp->t_sigcount > 0);
2850 		for (st = 0; st < TTYSIG_COUNT; st++) {
2851 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2852 				break;
2853 		}
2854 		KASSERT(st < TTYSIG_COUNT);
2855 		sigdelset(&tp->t_sigs[st], sig);
2856 		if (--tp->t_sigcount == 0)
2857 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2858 		pgrp = tp->t_pgrp;
2859 		sess = tp->t_session;
2860 		lflag = tp->t_lflag;
2861 		if  (sig == SIGINFO) {
2862 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2863 				/* Via ioctl: ignore tty option. */
2864 				tp->t_state &= ~TS_SIGINFO;
2865 				lflag |= ISIG;
2866 			}
2867 			if (!ISSET(lflag, NOKERNINFO)) {
2868 				mutex_spin_exit(&tty_lock);
2869 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
2870 				mutex_spin_enter(&tty_lock);
2871 				ttyputinfo(tp, infobuf);
2872 			}
2873 			if (!ISSET(lflag, ISIG))
2874 				continue;
2875 		}
2876 		mutex_spin_exit(&tty_lock);
2877 		KASSERT(sig != 0);
2878 		switch (st) {
2879 		case TTYSIG_PG1:
2880 			if (pgrp != NULL)
2881 				pgsignal(pgrp, sig, 1);
2882 			break;
2883 		case TTYSIG_PG2:
2884 			if (pgrp != NULL)
2885 				pgsignal(pgrp, sig, sess != NULL);
2886 			break;
2887 		case TTYSIG_LEADER:
2888 			if (sess != NULL && sess->s_leader != NULL)
2889 				psignal(sess->s_leader, sig);
2890 			break;
2891 		default:
2892 			/* NOTREACHED */
2893 			break;
2894 		}
2895 		mutex_spin_enter(&tty_lock);
2896 	}
2897 	mutex_spin_exit(&tty_lock);
2898 	mutex_exit(proc_lock);
2899 }
2900