xref: /netbsd-src/sys/kern/tty.c (revision d90047b5d07facf36e6c01dcc0bded8997ce9cc2)
1 /*	$NetBSD: tty.c,v 1.288 2020/06/22 16:29:24 maxv Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008, 2020 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 1982, 1986, 1990, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63  */
64 
65 #include <sys/cdefs.h>
66 __KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.288 2020/06/22 16:29:24 maxv Exp $");
67 
68 #ifdef _KERNEL_OPT
69 #include "opt_compat_netbsd.h"
70 #endif
71 
72 #define TTY_ALLOW_PRIVATE
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/ioctl.h>
77 #include <sys/proc.h>
78 #define	TTYDEFCHARS
79 #include <sys/tty.h>
80 #undef	TTYDEFCHARS
81 #include <sys/file.h>
82 #include <sys/conf.h>
83 #include <sys/cpu.h>
84 #include <sys/dkstat.h>
85 #include <sys/uio.h>
86 #include <sys/kernel.h>
87 #include <sys/vnode.h>
88 #include <sys/syslog.h>
89 #include <sys/kmem.h>
90 #include <sys/signalvar.h>
91 #include <sys/resourcevar.h>
92 #include <sys/poll.h>
93 #include <sys/kprintf.h>
94 #include <sys/namei.h>
95 #include <sys/sysctl.h>
96 #include <sys/kauth.h>
97 #include <sys/intr.h>
98 #include <sys/ioctl_compat.h>
99 #include <sys/module.h>
100 #include <sys/bitops.h>
101 #include <sys/compat_stub.h>
102 
103 #ifdef COMPAT_60
104 #include <compat/sys/ttycom.h>
105 #endif /* COMPAT_60 */
106 
107 static int	ttnread(struct tty *);
108 static void	ttyblock(struct tty *);
109 static void	ttyecho(int, struct tty *);
110 static void	ttyrubo(struct tty *, int);
111 static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
112     __printflike(2, 3);
113 static int	proc_compare_wrapper(struct proc *, struct proc *);
114 static void	ttysigintr(void *);
115 
116 /* Symbolic sleep message strings. */
117 const char	ttclos[] = "ttycls";
118 const char	ttopen[] = "ttyopn";
119 const char	ttybg[] = "ttybg";
120 const char	ttyin[] = "ttyin";
121 const char	ttyout[] = "ttyout";
122 
123 /*
124  * Used to determine whether we still have a connection.  This is true in
125  * one of 3 cases:
126  * 1) We have carrier.
127  * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
128  * 3) We're using a flow control mechanism that overloads the carrier signal.
129  */
130 #define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
131 			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
132 
133 /*
134  * Table with character classes and parity. The 8th bit indicates parity,
135  * the 7th bit indicates the character is an alphameric or underscore (for
136  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
137  * are 0 then the character needs no special processing on output; classes
138  * other than 0 might be translated or (not currently) require delays.
139  */
140 #define	E	0x00	/* Even parity. */
141 #define	O	0x80	/* Odd parity. */
142 #define	PARITY(c)	(char_type[c] & O)
143 
144 #define	ALPHA	0x40	/* Alpha or underscore. */
145 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
146 
147 #define	CCLASSMASK	0x3f
148 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
149 
150 #define	BS	BACKSPACE
151 #define	CC	CONTROL
152 #define	CR	RETURN
153 #define	NA	ORDINARY | ALPHA
154 #define	NL	NEWLINE
155 #define	NO	ORDINARY
156 #define	TB	TAB
157 #define	VT	VTAB
158 
159 unsigned char const char_type[] = {
160 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
161 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
162 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
163 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
164 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
165 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
166 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
167 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
168 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
169 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
170 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
171 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
172 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
173 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
174 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
175 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
176 	/*
177 	 * Meta chars; should be settable per character set;
178 	 * for now, treat them all as normal characters.
179 	 */
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
186 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
187 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
188 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
189 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
190 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
191 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
192 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
193 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
194 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
195 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
196 };
197 #undef	BS
198 #undef	CC
199 #undef	CR
200 #undef	NA
201 #undef	NL
202 #undef	NO
203 #undef	TB
204 #undef	VT
205 
206 static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
207 static void *tty_sigsih;
208 
209 struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
210 int tty_count;
211 kmutex_t tty_lock;
212 
213 struct ptm_pty *ptm = NULL;
214 
215 uint64_t tk_cancc;
216 uint64_t tk_nin;
217 uint64_t tk_nout;
218 uint64_t tk_rawcc;
219 
220 static kauth_listener_t tty_listener;
221 
222 #define	TTY_MINQSIZE	0x00400
223 #define	TTY_MAXQSIZE	0x10000
224 int tty_qsize = TTY_MINQSIZE;
225 
226 static int
227 tty_get_qsize(int *qsize, int newsize)
228 {
229 	newsize = 1 << ilog2(newsize);	/* Make it a power of two */
230 
231 	if (newsize < TTY_MINQSIZE || newsize > TTY_MAXQSIZE)
232 		return EINVAL;
233 
234 	*qsize = newsize;
235 	return 0;
236 }
237 
238 static int
239 tty_set_qsize(struct tty *tp, int newsize)
240 {
241 	struct clist rawq, canq, outq;
242 	struct clist orawq, ocanq, ooutq;
243 
244 	clalloc(&rawq, newsize, 1);
245 	clalloc(&canq, newsize, 1);
246 	clalloc(&outq, newsize, 0);
247 
248 	mutex_spin_enter(&tty_lock);
249 
250 	if (tp->t_outq.c_cc != 0) {
251 		mutex_spin_exit(&tty_lock);
252 		clfree(&rawq);
253 		clfree(&canq);
254 		clfree(&outq);
255 		return EBUSY;
256 	}
257 
258 	orawq = tp->t_rawq;
259 	ocanq = tp->t_canq;
260 	ooutq = tp->t_outq;
261 
262 	tp->t_qsize = newsize;
263 	tp->t_rawq = rawq;
264 	tp->t_canq = canq;
265 	tp->t_outq = outq;
266 
267 	ttsetwater(tp);
268 
269 	mutex_spin_exit(&tty_lock);
270 
271 	clfree(&orawq);
272 	clfree(&ocanq);
273 	clfree(&ooutq);
274 
275 	return 0;
276 }
277 
278 static int
279 sysctl_kern_tty_qsize(SYSCTLFN_ARGS)
280 {
281 	int newsize;
282 	int error;
283 	struct sysctlnode node;
284 	node = *rnode;
285 	node.sysctl_data = &newsize;
286 
287 	newsize = tty_qsize;
288 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
289 	if (error || newp == NULL)
290 		return error;
291 
292 
293 	return tty_get_qsize(&tty_qsize, newsize);
294 }
295 
296 static void
297 sysctl_kern_tty_setup(void)
298 {
299 	const struct sysctlnode *rnode, *cnode;
300 
301 	sysctl_createv(NULL, 0, NULL, NULL,
302 		       CTLFLAG_PERMANENT,
303 		       CTLTYPE_NODE, "tkstat",
304 		       SYSCTL_DESCR("Number of characters sent and received "
305 				    "on ttys"),
306 		       NULL, 0, NULL, 0,
307 		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
308 
309 	sysctl_createv(NULL, 0, NULL, NULL,
310 		       CTLFLAG_PERMANENT,
311 		       CTLTYPE_QUAD, "nin",
312 		       SYSCTL_DESCR("Total number of tty input characters"),
313 		       NULL, 0, &tk_nin, 0,
314 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
315 	sysctl_createv(NULL, 0, NULL, NULL,
316 		       CTLFLAG_PERMANENT,
317 		       CTLTYPE_QUAD, "nout",
318 		       SYSCTL_DESCR("Total number of tty output characters"),
319 		       NULL, 0, &tk_nout, 0,
320 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
321 	sysctl_createv(NULL, 0, NULL, NULL,
322 		       CTLFLAG_PERMANENT,
323 		       CTLTYPE_QUAD, "cancc",
324 		       SYSCTL_DESCR("Number of canonical tty input characters"),
325 		       NULL, 0, &tk_cancc, 0,
326 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
327 	sysctl_createv(NULL, 0, NULL, NULL,
328 		       CTLFLAG_PERMANENT,
329 		       CTLTYPE_QUAD, "rawcc",
330 		       SYSCTL_DESCR("Number of raw tty input characters"),
331 		       NULL, 0, &tk_rawcc, 0,
332 		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
333 
334 	sysctl_createv(NULL, 0, NULL, &rnode,
335 		       CTLFLAG_PERMANENT,
336 		       CTLTYPE_NODE, "tty", NULL,
337 		       NULL, 0, NULL, 0,
338 		       CTL_KERN, CTL_CREATE, CTL_EOL);
339 	sysctl_createv(NULL, 0, &rnode, &cnode,
340 		       CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
341 		       CTLTYPE_INT, "qsize",
342 		       SYSCTL_DESCR("TTY input and output queue size"),
343 		       sysctl_kern_tty_qsize, 0, &tty_qsize, 0,
344 		       CTL_CREATE, CTL_EOL);
345 }
346 
347 int
348 ttyopen(struct tty *tp, int dialout, int nonblock)
349 {
350 	int	error;
351 
352 	error = 0;
353 
354 	mutex_spin_enter(&tty_lock);
355 
356 	if (dialout) {
357 		/*
358 		 * If the device is already open for non-dialout, fail.
359 		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
360 		 * opens.
361 		 */
362 		if (ISSET(tp->t_state, TS_ISOPEN) &&
363 		    !ISSET(tp->t_state, TS_DIALOUT)) {
364 			error = EBUSY;
365 			goto out;
366 		}
367 		SET(tp->t_state, TS_DIALOUT);
368 	} else {
369 		if (!nonblock) {
370 			/*
371 			 * Wait for carrier.  Also wait for any dialout
372 			 * processes to close the tty first.
373 			 */
374 			while (ISSET(tp->t_state, TS_DIALOUT) ||
375 			       !CONNECTED(tp)) {
376 				tp->t_wopen++;
377 				error = ttysleep(tp, &tp->t_rawcv, true, 0);
378 				tp->t_wopen--;
379 				if (error)
380 					goto out;
381 			}
382 		} else {
383 			/*
384 			 * Don't allow a non-blocking non-dialout open if the
385 			 * device is already open for dialout.
386 			 */
387 			if (ISSET(tp->t_state, TS_DIALOUT)) {
388 				error = EBUSY;
389 				goto out;
390 			}
391 		}
392 	}
393 
394 out:
395 	mutex_spin_exit(&tty_lock);
396 	return (error);
397 }
398 
399 /*
400  * Initial open of tty, or (re)entry to standard tty line discipline.
401  */
402 int
403 ttylopen(dev_t device, struct tty *tp)
404 {
405 
406 	mutex_spin_enter(&tty_lock);
407 	tp->t_dev = device;
408 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
409 		SET(tp->t_state, TS_ISOPEN);
410 		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
411 		tp->t_flags = 0;
412 	}
413 	mutex_spin_exit(&tty_lock);
414 	if (tp->t_qsize != tty_qsize)
415 		tty_set_qsize(tp, tty_qsize);
416 	return (0);
417 }
418 
419 /*
420  * Handle close() on a tty line: flush and set to initial state,
421  * bumping generation number so that pending read/write calls
422  * can detect recycling of the tty.
423  */
424 int
425 ttyclose(struct tty *tp)
426 {
427 	extern struct tty *constty;	/* Temporary virtual console. */
428 	struct session *sess;
429 
430 	mutex_spin_enter(&tty_lock);
431 
432 	if (constty == tp)
433 		constty = NULL;
434 
435 	ttyflush(tp, FREAD | FWRITE);
436 
437 	tp->t_gen++;
438 	tp->t_pgrp = NULL;
439 	tp->t_state = 0;
440 	sess = tp->t_session;
441 	tp->t_session = NULL;
442 
443 	mutex_spin_exit(&tty_lock);
444 
445 	if (sess != NULL) {
446 		mutex_enter(&proc_lock);
447 		/* Releases proc_lock. */
448 		proc_sessrele(sess);
449 	}
450 	return (0);
451 }
452 
453 #define	FLUSHQ(q) {							\
454 	if ((q)->c_cc)							\
455 		ndflush(q, (q)->c_cc);					\
456 }
457 
458 /*
459  * This macro is used in canonical mode input processing, where a read
460  * request shall not return unless a 'line delimiter' ('\n') or 'break'
461  * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
462  * is an extension to the POSIX.1 defined set of special characters,
463  * recognize it only if IEXTEN is set in the set of local flags.
464  */
465 #define	TTBREAKC(c, lflg)						\
466 	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
467 	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
468 
469 
470 
471 /*
472  * ttyinput() helper.
473  * Call with the tty lock held.
474  */
475 /* XXX static */ int
476 ttyinput_wlock(int c, struct tty *tp)
477 {
478 	int	iflag, lflag, i, error;
479 	u_char	*cc;
480 
481 	KASSERT(mutex_owned(&tty_lock));
482 
483 	/*
484 	 * If input is pending take it first.
485 	 */
486 	lflag = tp->t_lflag;
487 	if (ISSET(lflag, PENDIN))
488 		ttypend(tp);
489 	/*
490 	 * Gather stats.
491 	 */
492 	if (ISSET(lflag, ICANON)) {
493 		++tk_cancc;
494 		++tp->t_cancc;
495 	} else {
496 		++tk_rawcc;
497 		++tp->t_rawcc;
498 	}
499 	++tk_nin;
500 
501 	cc = tp->t_cc;
502 
503 	/*
504 	 * Handle exceptional conditions (break, parity, framing).
505 	 */
506 	iflag = tp->t_iflag;
507 	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
508 		CLR(c, TTY_ERRORMASK);
509 		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
510 			if (ISSET(iflag, IGNBRK))
511 				return (0);
512 			else if (ISSET(iflag, BRKINT)) {
513 				ttyflush(tp, FREAD | FWRITE);
514 				ttysig(tp, TTYSIG_PG1, SIGINT);
515 				return (0);
516 			} else if (ISSET(iflag, PARMRK))
517 				goto parmrk;
518 		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
519 		    ISSET(error, TTY_FE)) {
520 			if (ISSET(iflag, IGNPAR))
521 				return (0);
522 			else if (ISSET(iflag, PARMRK)) {
523  parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
524 				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
525 				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
526 				return (0);
527 			} else
528 				c = 0;
529 		}
530 	} else if (c == 0377 &&
531 	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
532 		/* "Escape" a valid character of '\377'. */
533 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
534 		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
535 		goto endcase;
536 	}
537 
538 	/*
539 	 * In tandem mode, check high water mark.
540 	 */
541 	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
542 		ttyblock(tp);
543 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
544 		CLR(c, 0x80);
545 	if (!ISSET(lflag, EXTPROC)) {
546 		/*
547 		 * Check for literal nexting very first
548 		 */
549 		if (ISSET(tp->t_state, TS_LNCH)) {
550 			SET(c, TTY_QUOTE);
551 			CLR(tp->t_state, TS_LNCH);
552 		}
553 		/*
554 		 * Scan for special characters.  This code
555 		 * is really just a big case statement with
556 		 * non-constant cases.  The bottom of the
557 		 * case statement is labeled ``endcase'', so goto
558 		 * it after a case match, or similar.
559 		 */
560 
561 		/*
562 		 * Control chars which aren't controlled
563 		 * by ICANON, ISIG, or IXON.
564 		 */
565 		if (ISSET(lflag, IEXTEN)) {
566 			if (CCEQ(cc[VLNEXT], c)) {
567 				if (ISSET(lflag, ECHO)) {
568 					if (ISSET(lflag, ECHOE)) {
569 						(void)ttyoutput('^', tp);
570 						(void)ttyoutput('\b', tp);
571 					} else
572 						ttyecho(c, tp);
573 				}
574 				SET(tp->t_state, TS_LNCH);
575 				goto endcase;
576 			}
577 			if (CCEQ(cc[VDISCARD], c)) {
578 				if (ISSET(lflag, FLUSHO))
579 					CLR(tp->t_lflag, FLUSHO);
580 				else {
581 					ttyflush(tp, FWRITE);
582 					ttyecho(c, tp);
583 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
584 						ttyretype(tp);
585 					SET(tp->t_lflag, FLUSHO);
586 				}
587 				goto startoutput;
588 			}
589 		}
590 		/*
591 		 * Signals.
592 		 */
593 		if (ISSET(lflag, ISIG)) {
594 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
595 				if (!ISSET(lflag, NOFLSH))
596 					ttyflush(tp, FREAD | FWRITE);
597 				ttyecho(c, tp);
598 				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
599 				    SIGINT : SIGQUIT);
600 				goto endcase;
601 			}
602 			if (CCEQ(cc[VSUSP], c)) {
603 				if (!ISSET(lflag, NOFLSH))
604 					ttyflush(tp, FREAD);
605 				ttyecho(c, tp);
606 				ttysig(tp, TTYSIG_PG1, SIGTSTP);
607 				goto endcase;
608 			}
609 		}
610 		/*
611 		 * Handle start/stop characters.
612 		 */
613 		if (ISSET(iflag, IXON)) {
614 			if (CCEQ(cc[VSTOP], c)) {
615 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
616 					SET(tp->t_state, TS_TTSTOP);
617 					cdev_stop(tp, 0);
618 					return (0);
619 				}
620 				if (!CCEQ(cc[VSTART], c))
621 					return (0);
622 				/*
623 				 * if VSTART == VSTOP then toggle
624 				 */
625 				goto endcase;
626 			}
627 			if (CCEQ(cc[VSTART], c))
628 				goto restartoutput;
629 		}
630 		/*
631 		 * IGNCR, ICRNL, & INLCR
632 		 */
633 		if (c == '\r') {
634 			if (ISSET(iflag, IGNCR))
635 				goto endcase;
636 			else if (ISSET(iflag, ICRNL))
637 				c = '\n';
638 		} else if (c == '\n' && ISSET(iflag, INLCR))
639 			c = '\r';
640 	}
641 	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
642 		/*
643 		 * From here on down canonical mode character
644 		 * processing takes place.
645 		 */
646 		/*
647 		 * erase (^H / ^?)
648 		 */
649 		if (CCEQ(cc[VERASE], c)) {
650 			if (tp->t_rawq.c_cc)
651 				ttyrub(unputc(&tp->t_rawq), tp);
652 			goto endcase;
653 		}
654 		/*
655 		 * kill (^U)
656 		 */
657 		if (CCEQ(cc[VKILL], c)) {
658 			if (ISSET(lflag, ECHOKE) &&
659 			    tp->t_rawq.c_cc == tp->t_rocount &&
660 			    !ISSET(lflag, ECHOPRT))
661 				while (tp->t_rawq.c_cc)
662 					ttyrub(unputc(&tp->t_rawq), tp);
663 			else {
664 				ttyecho(c, tp);
665 				if (ISSET(lflag, ECHOK) ||
666 				    ISSET(lflag, ECHOKE))
667 					ttyecho('\n', tp);
668 				FLUSHQ(&tp->t_rawq);
669 				tp->t_rocount = 0;
670 			}
671 			CLR(tp->t_state, TS_LOCAL);
672 			goto endcase;
673 		}
674 		/*
675 		 * Extensions to the POSIX.1 GTI set of functions.
676 		 */
677 		if (ISSET(lflag, IEXTEN)) {
678 			/*
679 			 * word erase (^W)
680 			 */
681 			if (CCEQ(cc[VWERASE], c)) {
682 				int alt = ISSET(lflag, ALTWERASE);
683 				int ctype;
684 
685 				/*
686 				 * erase whitespace
687 				 */
688 				while ((c = unputc(&tp->t_rawq)) == ' ' ||
689 				    c == '\t')
690 					ttyrub(c, tp);
691 				if (c == -1)
692 					goto endcase;
693 				/*
694 				 * erase last char of word and remember the
695 				 * next chars type (for ALTWERASE)
696 				 */
697 				ttyrub(c, tp);
698 				c = unputc(&tp->t_rawq);
699 				if (c == -1)
700 					goto endcase;
701 				if (c == ' ' || c == '\t') {
702 					(void)putc(c, &tp->t_rawq);
703 					goto endcase;
704 				}
705 				ctype = ISALPHA(c);
706 				/*
707 				 * erase rest of word
708 				 */
709 				do {
710 					ttyrub(c, tp);
711 					c = unputc(&tp->t_rawq);
712 					if (c == -1)
713 						goto endcase;
714 				} while (c != ' ' && c != '\t' &&
715 				    (alt == 0 || ISALPHA(c) == ctype));
716 				(void)putc(c, &tp->t_rawq);
717 				goto endcase;
718 			}
719 			/*
720 			 * reprint line (^R)
721 			 */
722 			if (CCEQ(cc[VREPRINT], c)) {
723 				ttyretype(tp);
724 				goto endcase;
725 			}
726 			/*
727 			 * ^T - kernel info and generate SIGINFO
728 			 */
729 			if (CCEQ(cc[VSTATUS], c)) {
730 				ttysig(tp, TTYSIG_PG1, SIGINFO);
731 				goto endcase;
732 			}
733 		}
734 	}
735 	/*
736 	 * Check for input buffer overflow
737 	 */
738 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
739 		if (ISSET(iflag, IMAXBEL)) {
740 			if (tp->t_outq.c_cc < tp->t_hiwat)
741 				(void)ttyoutput(CTRL('g'), tp);
742 		} else
743 			ttyflush(tp, FREAD | FWRITE);
744 		goto endcase;
745 	}
746 	/*
747 	 * Put data char in q for user and
748 	 * wakeup on seeing a line delimiter.
749 	 */
750 	if (putc(c, &tp->t_rawq) >= 0) {
751 		if (!ISSET(lflag, ICANON)) {
752 			ttwakeup(tp);
753 			ttyecho(c, tp);
754 			goto endcase;
755 		}
756 		if (TTBREAKC(c, lflag)) {
757 			tp->t_rocount = 0;
758 			catq(&tp->t_rawq, &tp->t_canq);
759 			ttwakeup(tp);
760 		} else if (tp->t_rocount++ == 0)
761 			tp->t_rocol = tp->t_column;
762 		if (ISSET(tp->t_state, TS_ERASE)) {
763 			/*
764 			 * end of prterase \.../
765 			 */
766 			CLR(tp->t_state, TS_ERASE);
767 			(void)ttyoutput('/', tp);
768 		}
769 		i = tp->t_column;
770 		ttyecho(c, tp);
771 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
772 			/*
773 			 * Place the cursor over the '^' of the ^D.
774 			 */
775 			i = uimin(2, tp->t_column - i);
776 			while (i > 0) {
777 				(void)ttyoutput('\b', tp);
778 				i--;
779 			}
780 		}
781 	}
782  endcase:
783 	/*
784 	 * IXANY means allow any character to restart output.
785 	 */
786 	if (ISSET(tp->t_state, TS_TTSTOP) &&
787 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
788 		return (0);
789 	}
790  restartoutput:
791 	CLR(tp->t_lflag, FLUSHO);
792 	CLR(tp->t_state, TS_TTSTOP);
793  startoutput:
794 	return (ttstart(tp));
795 }
796 
797 /*
798  * Process input of a single character received on a tty.
799  *
800  * XXX - this is a hack, all drivers must changed to acquire the
801  *	 lock before calling linesw->l_rint()
802  */
803 int
804 ttyinput(int c, struct tty *tp)
805 {
806 	int error;
807 
808 	/*
809 	 * Unless the receiver is enabled, drop incoming data.
810 	 */
811 	if (!ISSET(tp->t_cflag, CREAD))
812 		return (0);
813 
814 	mutex_spin_enter(&tty_lock);
815 	error = ttyinput_wlock(c, tp);
816 	mutex_spin_exit(&tty_lock);
817 
818 	return (error);
819 }
820 
821 /*
822  * Output a single character on a tty, doing output processing
823  * as needed (expanding tabs, newline processing, etc.).
824  * Returns < 0 if succeeds, otherwise returns char to resend.
825  * Must be recursive.
826  *
827  * Call with tty lock held.
828  */
829 int
830 ttyoutput(int c, struct tty *tp)
831 {
832 	long	oflag;
833 	int	col, notout;
834 
835 	KASSERT(mutex_owned(&tty_lock));
836 
837 	oflag = tp->t_oflag;
838 	if (!ISSET(oflag, OPOST)) {
839 		tk_nout++;
840 		tp->t_outcc++;
841 		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
842 			return (c);
843 		return (-1);
844 	}
845 	/*
846 	 * Do tab expansion if OXTABS is set.  Special case if we do external
847 	 * processing, we don't do the tab expansion because we'll probably
848 	 * get it wrong.  If tab expansion needs to be done, let it happen
849 	 * externally.
850 	 */
851 	CLR(c, ~TTY_CHARMASK);
852 	if (c == '\t' &&
853 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
854 		c = 8 - (tp->t_column & 7);
855 		if (ISSET(tp->t_lflag, FLUSHO)) {
856 			notout = 0;
857 		} else {
858 			notout = b_to_q("        ", c, &tp->t_outq);
859 			c -= notout;
860 			tk_nout += c;
861 			tp->t_outcc += c;
862 		}
863 		tp->t_column += c;
864 		return (notout ? '\t' : -1);
865 	}
866 	if (c == CEOT && ISSET(oflag, ONOEOT))
867 		return (-1);
868 
869 	/*
870 	 * Newline translation: if ONLCR is set,
871 	 * translate newline into "\r\n".
872 	 */
873 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
874 		tk_nout++;
875 		tp->t_outcc++;
876 		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
877 			return (c);
878 	}
879 	/* If OCRNL is set, translate "\r" into "\n". */
880 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
881 		c = '\n';
882 	/* If ONOCR is set, don't transmit CRs when on column 0. */
883 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
884 		return (-1);
885 
886 	tk_nout++;
887 	tp->t_outcc++;
888 	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
889 		return (c);
890 
891 	col = tp->t_column;
892 	switch (CCLASS(c)) {
893 	case BACKSPACE:
894 		if (col > 0)
895 			--col;
896 		break;
897 	case CONTROL:
898 		break;
899 	case NEWLINE:
900 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
901 			col = 0;
902 		break;
903 	case RETURN:
904 		col = 0;
905 		break;
906 	case ORDINARY:
907 		++col;
908 		break;
909 	case TAB:
910 		col = (col + 8) & ~7;
911 		break;
912 	}
913 	tp->t_column = col;
914 	return (-1);
915 }
916 
917 /*
918  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
919  * has been called to do discipline-specific functions and/or reject any
920  * of these ioctl commands.
921  */
922 /* ARGSUSED */
923 int
924 ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
925 {
926 	extern struct tty *constty;	/* Temporary virtual console. */
927 	struct proc *p;
928 	struct linesw	*lp;
929 	int		s, error;
930 	struct pathbuf *pb;
931 	struct nameidata nd;
932 	char		infobuf[200];
933 
934 	KASSERT(l != NULL);
935 	p = l->l_proc;
936 
937 	/* If the ioctl involves modification, hang if in the background. */
938 	switch (cmd) {
939 	case  TIOCFLUSH:
940 	case  TIOCDRAIN:
941 	case  TIOCSBRK:
942 	case  TIOCCBRK:
943 	case  TIOCSTART:
944 	case  TIOCSETA:
945 	case  TIOCSETD:
946 	case  TIOCSLINED:
947 	case  TIOCSETAF:
948 	case  TIOCSETAW:
949 #ifdef notdef
950 	case  TIOCSPGRP:
951 	case  FIOSETOWN:
952 #endif
953 	case  TIOCSTAT:
954 	case  TIOCSTI:
955 	case  TIOCSWINSZ:
956 	case  TIOCSQSIZE:
957 	case  TIOCLBIC:
958 	case  TIOCLBIS:
959 	case  TIOCLSET:
960 	case  TIOCSETC:
961 	case OTIOCSETD:
962 	case  TIOCSETN:
963 	case  TIOCSETP:
964 	case  TIOCSLTC:
965 		mutex_spin_enter(&tty_lock);
966 		while (isbackground(curproc, tp) &&
967 		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
968 		    !sigismasked(l, SIGTTOU)) {
969 			mutex_spin_exit(&tty_lock);
970 
971 			mutex_enter(&proc_lock);
972 			pgsignal(p->p_pgrp, SIGTTOU, 1);
973 			mutex_exit(&proc_lock);
974 
975 			mutex_spin_enter(&tty_lock);
976 			error = ttypause(tp, hz);
977 			if (error) {
978 				mutex_spin_exit(&tty_lock);
979 				return (error);
980 			}
981 		}
982 		mutex_spin_exit(&tty_lock);
983 		break;
984 	}
985 
986 	switch (cmd) {			/* Process the ioctl. */
987 	case FIOASYNC:			/* set/clear async i/o */
988 		mutex_spin_enter(&tty_lock);
989 		if (*(int *)data)
990 			SET(tp->t_state, TS_ASYNC);
991 		else
992 			CLR(tp->t_state, TS_ASYNC);
993 		mutex_spin_exit(&tty_lock);
994 		break;
995 	case FIONBIO:			/* set/clear non-blocking i/o */
996 		break;			/* XXX: delete. */
997 	case FIONREAD:			/* get # bytes to read */
998 		mutex_spin_enter(&tty_lock);
999 		*(int *)data = ttnread(tp);
1000 		mutex_spin_exit(&tty_lock);
1001 		break;
1002 	case FIONWRITE:			/* get # bytes to written & unsent */
1003 		mutex_spin_enter(&tty_lock);
1004 		*(int *)data = tp->t_outq.c_cc;
1005 		mutex_spin_exit(&tty_lock);
1006 		break;
1007 	case FIONSPACE:			/* get # bytes to written & unsent */
1008 		mutex_spin_enter(&tty_lock);
1009 		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1010 		mutex_spin_exit(&tty_lock);
1011 		break;
1012 	case TIOCEXCL:			/* set exclusive use of tty */
1013 		mutex_spin_enter(&tty_lock);
1014 		SET(tp->t_state, TS_XCLUDE);
1015 		mutex_spin_exit(&tty_lock);
1016 		break;
1017 	case TIOCFLUSH: {		/* flush buffers */
1018 		int flags = *(int *)data;
1019 
1020 		if (flags == 0)
1021 			flags = FREAD | FWRITE;
1022 		else
1023 			flags &= FREAD | FWRITE;
1024 		mutex_spin_enter(&tty_lock);
1025 		ttyflush(tp, flags);
1026 		mutex_spin_exit(&tty_lock);
1027 		break;
1028 	}
1029 	case TIOCCONS:			/* become virtual console */
1030 		if (*(int *)data) {
1031 			if (constty && constty != tp &&
1032 			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
1033 			    (TS_CARR_ON | TS_ISOPEN))
1034 				return EBUSY;
1035 
1036 			pb = pathbuf_create("/dev/console");
1037 			if (pb == NULL) {
1038 				return ENOMEM;
1039 			}
1040 			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, pb);
1041 			if ((error = namei(&nd)) != 0) {
1042 				pathbuf_destroy(pb);
1043 				return error;
1044 			}
1045 			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
1046 			vput(nd.ni_vp);
1047 			pathbuf_destroy(pb);
1048 			if (error)
1049 				return error;
1050 
1051 			constty = tp;
1052 		} else if (tp == constty)
1053 			constty = NULL;
1054 		break;
1055 	case TIOCDRAIN:			/* wait till output drained */
1056 		if ((error = ttywait(tp)) != 0)
1057 			return (error);
1058 		break;
1059 	case TIOCGETA: {		/* get termios struct */
1060 		struct termios *t = (struct termios *)data;
1061 
1062 		memcpy(t, &tp->t_termios, sizeof(struct termios));
1063 		break;
1064 	}
1065 	case TIOCGETD:			/* get line discipline (old) */
1066 		*(int *)data = tp->t_linesw->l_no;
1067 		break;
1068 	case TIOCGLINED:		/* get line discipline (new) */
1069 		(void)strncpy((char *)data, tp->t_linesw->l_name,
1070 		    TTLINEDNAMELEN - 1);
1071 		break;
1072 	case TIOCGWINSZ:		/* get window size */
1073 		*(struct winsize *)data = tp->t_winsize;
1074 		break;
1075 	case TIOCGQSIZE:
1076 		*(int *)data = tp->t_qsize;
1077 		break;
1078 	case FIOGETOWN:
1079 		mutex_enter(&proc_lock);
1080 		if (tp->t_session != NULL && !isctty(p, tp)) {
1081 			mutex_exit(&proc_lock);
1082 			return (ENOTTY);
1083 		}
1084 		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
1085 		mutex_exit(&proc_lock);
1086 		break;
1087 	case TIOCGPGRP:			/* get pgrp of tty */
1088 		mutex_enter(&proc_lock);
1089 		if (!isctty(p, tp)) {
1090 			mutex_exit(&proc_lock);
1091 			return (ENOTTY);
1092 		}
1093 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
1094 		mutex_exit(&proc_lock);
1095 		break;
1096 	case TIOCGSID:			/* get sid of tty */
1097 		mutex_enter(&proc_lock);
1098 		if (!isctty(p, tp)) {
1099 			mutex_exit(&proc_lock);
1100 			return (ENOTTY);
1101 		}
1102 		*(int *)data = tp->t_session->s_sid;
1103 		mutex_exit(&proc_lock);
1104 		break;
1105 #ifdef TIOCHPCL
1106 	case TIOCHPCL:			/* hang up on last close */
1107 		mutex_spin_enter(&tty_lock);
1108 		SET(tp->t_cflag, HUPCL);
1109 		mutex_spin_exit(&tty_lock);
1110 		break;
1111 #endif
1112 	case TIOCNXCL:			/* reset exclusive use of tty */
1113 		mutex_spin_enter(&tty_lock);
1114 		CLR(tp->t_state, TS_XCLUDE);
1115 		mutex_spin_exit(&tty_lock);
1116 		break;
1117 	case TIOCOUTQ:			/* output queue size */
1118 		*(int *)data = tp->t_outq.c_cc;
1119 		break;
1120 	case TIOCSETA:			/* set termios struct */
1121 	case TIOCSETAW:			/* drain output, set */
1122 	case TIOCSETAF: {		/* drn out, fls in, set */
1123 		struct termios *t = (struct termios *)data;
1124 
1125 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1126 			if ((error = ttywait(tp)) != 0)
1127 				return (error);
1128 
1129 			if (cmd == TIOCSETAF) {
1130 				mutex_spin_enter(&tty_lock);
1131 				ttyflush(tp, FREAD);
1132 				mutex_spin_exit(&tty_lock);
1133 			}
1134 		}
1135 
1136 		s = spltty();
1137 		/*
1138 		 * XXXSMP - some drivers call back on us from t_param(), so
1139 		 *	    don't take the tty spin lock here.
1140 		 *	    require t_param() to unlock upon callback?
1141 		 */
1142 		/* wanted here: mutex_spin_enter(&tty_lock); */
1143 		if (!ISSET(t->c_cflag, CIGNORE)) {
1144 			/*
1145 			 * Set device hardware.
1146 			 */
1147 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1148 				/* wanted here: mutex_spin_exit(&tty_lock); */
1149 				splx(s);
1150 				return (error);
1151 			} else {
1152 				tp->t_cflag = t->c_cflag;
1153 				tp->t_ispeed = t->c_ispeed;
1154 				tp->t_ospeed = t->c_ospeed;
1155 				if (t->c_ospeed == 0)
1156 					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1157 			}
1158 			ttsetwater(tp);
1159 		}
1160 
1161 		/* delayed lock acquiring */
1162 		mutex_spin_enter(&tty_lock);
1163 		if (cmd != TIOCSETAF) {
1164 			if (ISSET(t->c_lflag, ICANON) !=
1165 			    ISSET(tp->t_lflag, ICANON)) {
1166 				if (ISSET(t->c_lflag, ICANON)) {
1167 					SET(tp->t_lflag, PENDIN);
1168 					ttwakeup(tp);
1169 				} else {
1170 					struct clist tq;
1171 
1172 					catq(&tp->t_rawq, &tp->t_canq);
1173 					tq = tp->t_rawq;
1174 					tp->t_rawq = tp->t_canq;
1175 					tp->t_canq = tq;
1176 					CLR(tp->t_lflag, PENDIN);
1177 				}
1178 			}
1179 		}
1180 		tp->t_iflag = t->c_iflag;
1181 		tp->t_oflag = t->c_oflag;
1182 		/*
1183 		 * Make the EXTPROC bit read only.
1184 		 */
1185 		if (ISSET(tp->t_lflag, EXTPROC))
1186 			SET(t->c_lflag, EXTPROC);
1187 		else
1188 			CLR(t->c_lflag, EXTPROC);
1189 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1190 		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1191 		mutex_spin_exit(&tty_lock);
1192 		splx(s);
1193 		break;
1194 	}
1195 	case TIOCSETD:			/* set line discipline (old) */
1196 		lp = ttyldisc_lookup_bynum(*(int *)data);
1197 		goto setldisc;
1198 
1199 	case TIOCSLINED: {		/* set line discipline (new) */
1200 		char *name = (char *)data;
1201 		dev_t device;
1202 
1203 		/* Null terminate to prevent buffer overflow */
1204 		name[TTLINEDNAMELEN - 1] = '\0';
1205 		lp = ttyldisc_lookup(name);
1206  setldisc:
1207 		if (lp == NULL)
1208 			return (ENXIO);
1209 
1210 		if (lp != tp->t_linesw) {
1211 			device = tp->t_dev;
1212 			s = spltty();
1213 			(*tp->t_linesw->l_close)(tp, flag);
1214 			error = (*lp->l_open)(device, tp);
1215 			if (error) {
1216 				(void)(*tp->t_linesw->l_open)(device, tp);
1217 				splx(s);
1218 				ttyldisc_release(lp);
1219 				return (error);
1220 			}
1221 			ttyldisc_release(tp->t_linesw);
1222 			tp->t_linesw = lp;
1223 			splx(s);
1224 		} else {
1225 			/* Drop extra reference. */
1226 			ttyldisc_release(lp);
1227 		}
1228 		break;
1229 	}
1230 	case TIOCSTART:			/* start output, like ^Q */
1231 		mutex_spin_enter(&tty_lock);
1232 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1233 		    ISSET(tp->t_lflag, FLUSHO)) {
1234 			CLR(tp->t_lflag, FLUSHO);
1235 			CLR(tp->t_state, TS_TTSTOP);
1236 			ttstart(tp);
1237 		}
1238 		mutex_spin_exit(&tty_lock);
1239 		break;
1240 	case TIOCSTI:			/* simulate terminal input */
1241 		if ((error = kauth_authorize_device_tty(l->l_cred,
1242 		    KAUTH_DEVICE_TTY_STI, tp)) != 0) {
1243 			if (!ISSET(flag, FREAD))
1244 				return EPERM;
1245 			if (!isctty(p, tp))
1246 				return EACCES;
1247 			if (tp->t_session->s_leader->p_cred != p->p_cred)
1248 				return error;
1249 		}
1250 		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1251 		break;
1252 	case TIOCSTOP:			/* stop output, like ^S */
1253 	{
1254 		mutex_spin_enter(&tty_lock);
1255 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1256 			SET(tp->t_state, TS_TTSTOP);
1257 			cdev_stop(tp, 0);
1258 		}
1259 		mutex_spin_exit(&tty_lock);
1260 		break;
1261 	}
1262 	case TIOCSCTTY:			/* become controlling tty */
1263 		mutex_enter(&proc_lock);
1264 		mutex_spin_enter(&tty_lock);
1265 
1266 		/* Session ctty vnode pointer set in vnode layer. */
1267 		if (!SESS_LEADER(p) ||
1268 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1269 		    (tp->t_session != p->p_session))) {
1270 			mutex_spin_exit(&tty_lock);
1271 			mutex_exit(&proc_lock);
1272 			return (EPERM);
1273 		}
1274 
1275 		/*
1276 		 * `p_session' acquires a reference.
1277 		 * But note that if `t_session' is set at this point,
1278 		 * it must equal `p_session', in which case the session
1279 		 * already has the correct reference count.
1280 		 */
1281 		if (tp->t_session == NULL) {
1282 			proc_sesshold(p->p_session);
1283 		}
1284 		tp->t_session = p->p_session;
1285 		tp->t_pgrp = p->p_pgrp;
1286 		p->p_session->s_ttyp = tp;
1287 		p->p_lflag |= PL_CONTROLT;
1288 		mutex_spin_exit(&tty_lock);
1289 		mutex_exit(&proc_lock);
1290 		break;
1291 	case FIOSETOWN: {		/* set pgrp of tty */
1292 		pid_t pgid = *(pid_t *)data;
1293 		struct pgrp *pgrp;
1294 
1295 		mutex_enter(&proc_lock);
1296 		if (tp->t_session != NULL && !isctty(p, tp)) {
1297 			mutex_exit(&proc_lock);
1298 			return (ENOTTY);
1299 		}
1300 
1301 		if (pgid < 0) {
1302 			pgrp = pgrp_find(-pgid);
1303 			if (pgrp == NULL) {
1304 				mutex_exit(&proc_lock);
1305 				return (EINVAL);
1306 			}
1307 		} else {
1308 			struct proc *p1;
1309 			p1 = proc_find(pgid);
1310 			if (!p1) {
1311 				mutex_exit(&proc_lock);
1312 				return (ESRCH);
1313 			}
1314 			pgrp = p1->p_pgrp;
1315 		}
1316 
1317 		if (pgrp->pg_session != p->p_session) {
1318 			mutex_exit(&proc_lock);
1319 			return (EPERM);
1320 		}
1321 		mutex_spin_enter(&tty_lock);
1322 		tp->t_pgrp = pgrp;
1323 		mutex_spin_exit(&tty_lock);
1324 		mutex_exit(&proc_lock);
1325 		break;
1326 	}
1327 	case TIOCSPGRP: {		/* set pgrp of tty */
1328 		struct pgrp *pgrp;
1329 		pid_t pgid = *(pid_t *)data;
1330 
1331 		if (pgid == NO_PGID)
1332 			return EINVAL;
1333 
1334 		mutex_enter(&proc_lock);
1335 		if (!isctty(p, tp)) {
1336 			mutex_exit(&proc_lock);
1337 			return (ENOTTY);
1338 		}
1339 		pgrp = pgrp_find(pgid);
1340 		if (pgrp == NULL || pgrp->pg_session != p->p_session) {
1341 			mutex_exit(&proc_lock);
1342 			return (EPERM);
1343 		}
1344 		mutex_spin_enter(&tty_lock);
1345 		tp->t_pgrp = pgrp;
1346 		mutex_spin_exit(&tty_lock);
1347 		mutex_exit(&proc_lock);
1348 		break;
1349 	}
1350 	case TIOCSTAT:			/* get load avg stats */
1351 		mutex_enter(&proc_lock);
1352 		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1353 		mutex_exit(&proc_lock);
1354 
1355 		mutex_spin_enter(&tty_lock);
1356 		ttyputinfo(tp, infobuf);
1357 		mutex_spin_exit(&tty_lock);
1358 		break;
1359 	case TIOCSWINSZ:		/* set window size */
1360 		mutex_spin_enter(&tty_lock);
1361 		if (memcmp((void *)&tp->t_winsize, data,
1362 		    sizeof(struct winsize))) {
1363 			tp->t_winsize = *(struct winsize *)data;
1364 			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1365 		}
1366 		mutex_spin_exit(&tty_lock);
1367 		break;
1368 	case TIOCSQSIZE:
1369 		if ((error = tty_get_qsize(&s, *(int *)data)) == 0 &&
1370 		    s != tp->t_qsize)
1371 			error = tty_set_qsize(tp, s);
1372 		return error;
1373 
1374 	case TIOCSBRK:
1375 	case TIOCCBRK:
1376 	case TIOCSDTR:
1377 	case TIOCCDTR:
1378 	case TIOCSFLAGS:
1379 	case TIOCGFLAGS:
1380 	case TIOCMSET:
1381 	case TIOCMGET:
1382 	case TIOCMBIS:
1383 	case TIOCMBIC:
1384 		/* Handled by the driver layer */
1385 		return EPASSTHROUGH;
1386 
1387 	case TIOCEXT:
1388 	case TIOCPTSNAME:
1389 	case TIOCGRANTPT:
1390 	case TIOCPKT:
1391 	case TIOCUCNTL:
1392 	case TIOCREMOTE:
1393 	case TIOCSIG:
1394 		/* for ptys */
1395 		return EPASSTHROUGH;
1396 
1397 	default:
1398 		/* Pass through various console ioctls */
1399 		switch (IOCGROUP(cmd)) {
1400 		case 'c':	/* syscons console */
1401 		case 'v':	/* usl console, video - where one letter */
1402 		case 'K':	/* usl console, keyboard - aint enough */
1403 		case 'V':	/* pcvt compat */
1404 		case 'W':	/* wscons console */
1405 			return EPASSTHROUGH;
1406 		default:
1407 			break;
1408 		}
1409 
1410 		/* We may have to load the compat_60 module for this. */
1411 		(void)module_autoload("compat_60", MODULE_CLASS_EXEC);
1412 		MODULE_HOOK_CALL(tty_ttioctl_60_hook,
1413 		    (tp, cmd, data, flag, l), enosys(), error);
1414 		if (error != EPASSTHROUGH)
1415 			return error;
1416 
1417 		/* We may have to load the compat_43 module for this. */
1418 		(void)module_autoload("compat_43", MODULE_CLASS_EXEC);
1419 		MODULE_HOOK_CALL(tty_ttioctl_43_hook,
1420 		    (tp, cmd, data, flag, l), enosys(), error);
1421 		return error;
1422 	}
1423 	return (0);
1424 }
1425 
1426 int
1427 ttpoll(struct tty *tp, int events, struct lwp *l)
1428 {
1429 	int	revents;
1430 
1431 	revents = 0;
1432 	mutex_spin_enter(&tty_lock);
1433 	if (events & (POLLIN | POLLRDNORM))
1434 		if (ttnread(tp) > 0)
1435 			revents |= events & (POLLIN | POLLRDNORM);
1436 
1437 	if (events & (POLLOUT | POLLWRNORM))
1438 		if (tp->t_outq.c_cc <= tp->t_lowat)
1439 			revents |= events & (POLLOUT | POLLWRNORM);
1440 
1441 	if (events & POLLHUP)
1442 		if (!CONNECTED(tp))
1443 			revents |= POLLHUP;
1444 
1445 	if (revents == 0) {
1446 		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1447 			selrecord(l, &tp->t_rsel);
1448 
1449 		if (events & (POLLOUT | POLLWRNORM))
1450 			selrecord(l, &tp->t_wsel);
1451 	}
1452 
1453 	mutex_spin_exit(&tty_lock);
1454 
1455 	return (revents);
1456 }
1457 
1458 static void
1459 filt_ttyrdetach(struct knote *kn)
1460 {
1461 	struct tty	*tp;
1462 
1463 	tp = kn->kn_hook;
1464 	mutex_spin_enter(&tty_lock);
1465 	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1466 	mutex_spin_exit(&tty_lock);
1467 }
1468 
1469 static int
1470 filt_ttyread(struct knote *kn, long hint)
1471 {
1472 	struct tty	*tp;
1473 
1474 	tp = kn->kn_hook;
1475 	if ((hint & NOTE_SUBMIT) == 0)
1476 		mutex_spin_enter(&tty_lock);
1477 	kn->kn_data = ttnread(tp);
1478 	if ((hint & NOTE_SUBMIT) == 0)
1479 		mutex_spin_exit(&tty_lock);
1480 	return (kn->kn_data > 0);
1481 }
1482 
1483 static void
1484 filt_ttywdetach(struct knote *kn)
1485 {
1486 	struct tty	*tp;
1487 
1488 	tp = kn->kn_hook;
1489 	mutex_spin_enter(&tty_lock);
1490 	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1491 	mutex_spin_exit(&tty_lock);
1492 }
1493 
1494 static int
1495 filt_ttywrite(struct knote *kn, long hint)
1496 {
1497 	struct tty	*tp;
1498 	int		canwrite;
1499 
1500 	tp = kn->kn_hook;
1501 	if ((hint & NOTE_SUBMIT) == 0)
1502 		mutex_spin_enter(&tty_lock);
1503 	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1504 	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1505 	if ((hint & NOTE_SUBMIT) == 0)
1506 		mutex_spin_exit(&tty_lock);
1507 	return (canwrite);
1508 }
1509 
1510 static const struct filterops ttyread_filtops = {
1511 	.f_isfd = 1,
1512 	.f_attach = NULL,
1513 	.f_detach = filt_ttyrdetach,
1514 	.f_event = filt_ttyread,
1515 };
1516 
1517 static const struct filterops ttywrite_filtops = {
1518 	.f_isfd = 1,
1519 	.f_attach = NULL,
1520 	.f_detach = filt_ttywdetach,
1521 	.f_event = filt_ttywrite,
1522 };
1523 
1524 int
1525 ttykqfilter(dev_t dev, struct knote *kn)
1526 {
1527 	struct tty	*tp;
1528 	struct klist	*klist;
1529 
1530 	if ((tp = cdev_tty(dev)) == NULL)
1531 		return (ENXIO);
1532 
1533 	switch (kn->kn_filter) {
1534 	case EVFILT_READ:
1535 		klist = &tp->t_rsel.sel_klist;
1536 		kn->kn_fop = &ttyread_filtops;
1537 		break;
1538 	case EVFILT_WRITE:
1539 		klist = &tp->t_wsel.sel_klist;
1540 		kn->kn_fop = &ttywrite_filtops;
1541 		break;
1542 	default:
1543 		return EINVAL;
1544 	}
1545 
1546 	kn->kn_hook = tp;
1547 
1548 	mutex_spin_enter(&tty_lock);
1549 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1550 	mutex_spin_exit(&tty_lock);
1551 
1552 	return (0);
1553 }
1554 
1555 /*
1556  * Find the number of chars ready to be read from this tty.
1557  * Call with the tty lock held.
1558  */
1559 static int
1560 ttnread(struct tty *tp)
1561 {
1562 	int	nread;
1563 
1564 	KASSERT(mutex_owned(&tty_lock));
1565 
1566 	if (ISSET(tp->t_lflag, PENDIN))
1567 		ttypend(tp);
1568 	nread = tp->t_canq.c_cc;
1569 	if (!ISSET(tp->t_lflag, ICANON)) {
1570 		nread += tp->t_rawq.c_cc;
1571 		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1572 			nread = 0;
1573 	}
1574 	return (nread);
1575 }
1576 
1577 /*
1578  * Wait for output to drain, or if this times out, flush it.
1579  */
1580 static int
1581 ttywait_timo(struct tty *tp, int timo)
1582 {
1583 	int	error;
1584 
1585 	error = 0;
1586 
1587 	mutex_spin_enter(&tty_lock);
1588 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1589 	    CONNECTED(tp) && tp->t_oproc) {
1590 		(*tp->t_oproc)(tp);
1591 		error = ttysleep(tp, &tp->t_outcv, true, timo);
1592 		if (error == EWOULDBLOCK)
1593 			ttyflush(tp, FWRITE);
1594 		if (error)
1595 			break;
1596 	}
1597 	mutex_spin_exit(&tty_lock);
1598 
1599 	return (error);
1600 }
1601 
1602 /*
1603  * Wait for output to drain.
1604  */
1605 int
1606 ttywait(struct tty *tp)
1607 {
1608 	return ttywait_timo(tp, 0);
1609 }
1610 
1611 /*
1612  * Flush if successfully wait.
1613  */
1614 int
1615 ttywflush(struct tty *tp)
1616 {
1617 	int	error;
1618 
1619 	error = ttywait_timo(tp, 5 * hz);
1620 	if (error == 0 || error == EWOULDBLOCK) {
1621 		mutex_spin_enter(&tty_lock);
1622 		ttyflush(tp, FREAD);
1623 		mutex_spin_exit(&tty_lock);
1624 	}
1625 	return (error);
1626 }
1627 
1628 /*
1629  * Flush tty read and/or write queues, notifying anyone waiting.
1630  * Call with the tty lock held.
1631  */
1632 void
1633 ttyflush(struct tty *tp, int rw)
1634 {
1635 
1636 	KASSERT(mutex_owned(&tty_lock));
1637 
1638 	if (rw & FREAD) {
1639 		FLUSHQ(&tp->t_canq);
1640 		FLUSHQ(&tp->t_rawq);
1641 		tp->t_rocount = 0;
1642 		tp->t_rocol = 0;
1643 		CLR(tp->t_state, TS_LOCAL);
1644 		ttwakeup(tp);
1645 	}
1646 	if (rw & FWRITE) {
1647 		CLR(tp->t_state, TS_TTSTOP);
1648 		cdev_stop(tp, rw);
1649 		FLUSHQ(&tp->t_outq);
1650 		cv_broadcast(&tp->t_outcv);
1651 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1652 	}
1653 }
1654 
1655 /*
1656  * Copy in the default termios characters.
1657  */
1658 void
1659 ttychars(struct tty *tp)
1660 {
1661 
1662 	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1663 }
1664 
1665 /*
1666  * Send stop character on input overflow.
1667  * Call with the tty lock held.
1668  */
1669 static void
1670 ttyblock(struct tty *tp)
1671 {
1672 	int	total;
1673 
1674 	KASSERT(mutex_owned(&tty_lock));
1675 
1676 	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1677 	if (tp->t_rawq.c_cc > TTYHOG) {
1678 		ttyflush(tp, FREAD | FWRITE);
1679 		CLR(tp->t_state, TS_TBLOCK);
1680 	}
1681 	/*
1682 	 * Block further input iff: current input > threshold
1683 	 * AND input is available to user program.
1684 	 */
1685 	if (total >= TTYHOG / 2 &&
1686 	    !ISSET(tp->t_state, TS_TBLOCK) &&
1687 	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1688 		if (ISSET(tp->t_iflag, IXOFF) &&
1689 		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1690 		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1691 			SET(tp->t_state, TS_TBLOCK);
1692 			ttstart(tp);
1693 		}
1694 		/* Try to block remote output via hardware flow control. */
1695 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1696 		    (*tp->t_hwiflow)(tp, 1) != 0)
1697 			SET(tp->t_state, TS_TBLOCK);
1698 	}
1699 }
1700 
1701 /*
1702  * Delayed line discipline output
1703  */
1704 void
1705 ttrstrt(void *tp_arg)
1706 {
1707 	struct tty	*tp;
1708 
1709 #ifdef DIAGNOSTIC
1710 	if (tp_arg == NULL)
1711 		panic("ttrstrt");
1712 #endif
1713 	tp = tp_arg;
1714 	mutex_spin_enter(&tty_lock);
1715 
1716 	CLR(tp->t_state, TS_TIMEOUT);
1717 	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1718 
1719 	mutex_spin_exit(&tty_lock);
1720 }
1721 
1722 /*
1723  * start a line discipline
1724  * Always call with tty lock held?
1725  */
1726 int
1727 ttstart(struct tty *tp)
1728 {
1729 
1730 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1731 		(*tp->t_oproc)(tp);
1732 	return (0);
1733 }
1734 
1735 /*
1736  * "close" a line discipline
1737  */
1738 int
1739 ttylclose(struct tty *tp, int flag)
1740 {
1741 
1742 	if (flag & FNONBLOCK) {
1743 		mutex_spin_enter(&tty_lock);
1744 		ttyflush(tp, FREAD | FWRITE);
1745 		mutex_spin_exit(&tty_lock);
1746 	} else
1747 		ttywflush(tp);
1748 	return (0);
1749 }
1750 
1751 /*
1752  * Handle modem control transition on a tty.
1753  * Flag indicates new state of carrier.
1754  * Returns 0 if the line should be turned off, otherwise 1.
1755  */
1756 int
1757 ttymodem(struct tty *tp, int flag)
1758 {
1759 
1760 	mutex_spin_enter(&tty_lock);
1761 	if (flag == 0) {
1762 		if (ISSET(tp->t_state, TS_CARR_ON)) {
1763 			/*
1764 			 * Lost carrier.
1765 			 */
1766 			CLR(tp->t_state, TS_CARR_ON);
1767 			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1768 				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1769 				ttyflush(tp, FREAD | FWRITE);
1770 				mutex_spin_exit(&tty_lock);
1771 				return (0);
1772 			}
1773 		}
1774 	} else {
1775 		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1776 			/*
1777 			 * Carrier now on.
1778 			 */
1779 			SET(tp->t_state, TS_CARR_ON);
1780 			ttwakeup(tp);
1781 		}
1782 	}
1783 	mutex_spin_exit(&tty_lock);
1784 
1785 	return (1);
1786 }
1787 
1788 /*
1789  * Default modem control routine (for other line disciplines).
1790  * Return argument flag, to turn off device on carrier drop.
1791  */
1792 int
1793 nullmodem(struct tty *tp, int flag)
1794 {
1795 
1796 	mutex_spin_enter(&tty_lock);
1797 	if (flag)
1798 		SET(tp->t_state, TS_CARR_ON);
1799 	else {
1800 		CLR(tp->t_state, TS_CARR_ON);
1801 		if (!CONNECTED(tp)) {
1802 			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1803 			mutex_spin_exit(&tty_lock);
1804 			return (0);
1805 		}
1806 	}
1807 	mutex_spin_exit(&tty_lock);
1808 
1809 	return (1);
1810 }
1811 
1812 /*
1813  * Reinput pending characters after state switch.
1814  */
1815 void
1816 ttypend(struct tty *tp)
1817 {
1818 	struct clist	tq;
1819 	int		c;
1820 
1821 	KASSERT(mutex_owned(&tty_lock));
1822 
1823 	CLR(tp->t_lflag, PENDIN);
1824 	SET(tp->t_state, TS_TYPEN);
1825 	tq = tp->t_rawq;
1826 	tp->t_rawq.c_cc = 0;
1827 	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1828 	while ((c = getc(&tq)) >= 0)
1829 		ttyinput_wlock(c, tp);
1830 	CLR(tp->t_state, TS_TYPEN);
1831 }
1832 
1833 /*
1834  * Process a read call on a tty device.
1835  */
1836 int
1837 ttread(struct tty *tp, struct uio *uio, int flag)
1838 {
1839 	struct clist	*qp;
1840 	u_char		*cc;
1841 	struct proc	*p;
1842 	int		c, first, error, has_stime, last_cc;
1843 	long		lflag, slp;
1844 	struct timeval	now, stime;
1845 
1846 	if (uio->uio_resid == 0)
1847 		return 0;
1848 
1849 	stime.tv_usec = 0;	/* XXX gcc */
1850 	stime.tv_sec = 0;	/* XXX gcc */
1851 
1852 	cc = tp->t_cc;
1853 	p = curproc;
1854 	error = 0;
1855 	has_stime = 0;
1856 	last_cc = 0;
1857 	slp = 0;
1858 
1859  loop:
1860 	mutex_spin_enter(&tty_lock);
1861 	lflag = tp->t_lflag;
1862 	/*
1863 	 * take pending input first
1864 	 */
1865 	if (ISSET(lflag, PENDIN))
1866 		ttypend(tp);
1867 
1868 	/*
1869 	 * Hang process if it's in the background.
1870 	 */
1871 	if (isbackground(p, tp)) {
1872 		if (sigismasked(curlwp, SIGTTIN) ||
1873 		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1874 			mutex_spin_exit(&tty_lock);
1875 			return (EIO);
1876 		}
1877 		mutex_spin_exit(&tty_lock);
1878 
1879 		mutex_enter(&proc_lock);
1880 		pgsignal(p->p_pgrp, SIGTTIN, 1);
1881 		mutex_exit(&proc_lock);
1882 
1883 		mutex_spin_enter(&tty_lock);
1884 		error = ttypause(tp, hz);
1885 		mutex_spin_exit(&tty_lock);
1886 		if (error)
1887 			return (error);
1888 		goto loop;
1889 	}
1890 
1891 	if (!ISSET(lflag, ICANON)) {
1892 		int m = cc[VMIN];
1893 		long t = cc[VTIME];
1894 
1895 		qp = &tp->t_rawq;
1896 		/*
1897 		 * Check each of the four combinations.
1898 		 * (m > 0 && t == 0) is the normal read case.
1899 		 * It should be fairly efficient, so we check that and its
1900 		 * companion case (m == 0 && t == 0) first.
1901 		 * For the other two cases, we compute the target sleep time
1902 		 * into slp.
1903 		 */
1904 		if (t == 0) {
1905 			if (qp->c_cc < m)
1906 				goto sleep;
1907 			goto read;
1908 		}
1909 		t *= hz;		/* time in deca-ticks */
1910 /*
1911  * Time difference in deca-ticks, split division to avoid numeric overflow.
1912  * Ok for hz < ~200kHz
1913  */
1914 #define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1915 			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1916 		if (m > 0) {
1917 			if (qp->c_cc <= 0)
1918 				goto sleep;
1919 			if (qp->c_cc >= m)
1920 				goto read;
1921 			if (!has_stime) {
1922 				/* first character, start timer */
1923 				has_stime = 1;
1924 				getmicrotime(&stime);
1925 				slp = t;
1926 			} else if (qp->c_cc > last_cc) {
1927 				/* got a character, restart timer */
1928 				getmicrotime(&stime);
1929 				slp = t;
1930 			} else {
1931 				/* nothing, check expiration */
1932 				getmicrotime(&now);
1933 				slp = t - diff(now, stime);
1934 			}
1935 		} else {	/* m == 0 */
1936 			if (qp->c_cc > 0)
1937 				goto read;
1938 			if (!has_stime) {
1939 				has_stime = 1;
1940 				getmicrotime(&stime);
1941 				slp = t;
1942 			} else {
1943 				getmicrotime(&now);
1944 				slp = t - diff(now, stime);
1945 			}
1946 		}
1947 		last_cc = qp->c_cc;
1948 #undef diff
1949 		if (slp > 0) {
1950 			/*
1951 			 * Convert deca-ticks back to ticks.
1952 			 * Rounding down may make us wake up just short
1953 			 * of the target, so we round up.
1954 			 * Maybe we should do 'slp/10 + 1' because the
1955 			 * first tick maybe almost immediate.
1956 			 * However it is more useful for a program that sets
1957 			 * VTIME=10 to wakeup every second not every 1.01
1958 			 * seconds (if hz=100).
1959 			 */
1960 			slp = (slp + 9)/ 10;
1961 			goto sleep;
1962 		}
1963 	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1964 		int	carrier;
1965 
1966  sleep:
1967 		/*
1968 		 * If there is no input, sleep on rawq
1969 		 * awaiting hardware receipt and notification.
1970 		 * If we have data, we don't need to check for carrier.
1971 		 */
1972 		carrier = CONNECTED(tp);
1973 		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1974 			mutex_spin_exit(&tty_lock);
1975 			return (0);	/* EOF */
1976 		}
1977 		if (!has_stime || slp <= 0) {
1978 			if (flag & IO_NDELAY) {
1979 				mutex_spin_exit(&tty_lock);
1980 				return (EWOULDBLOCK);
1981 			}
1982 		}
1983 		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1984 		mutex_spin_exit(&tty_lock);
1985 		/* VMIN == 0: any quantity read satisfies */
1986 		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1987 			return (0);
1988 		if (error && error != EWOULDBLOCK)
1989 			return (error);
1990 		goto loop;
1991 	}
1992  read:
1993 
1994 	/*
1995 	 * Input present, check for input mapping and processing.
1996 	 */
1997 	first = 1;
1998 	while ((c = getc(qp)) >= 0) {
1999 		/*
2000 		 * delayed suspend (^Y)
2001 		 */
2002 		if (CCEQ(cc[VDSUSP], c) &&
2003 		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
2004 			ttysig(tp, TTYSIG_PG1, SIGTSTP);
2005 			if (first) {
2006 				error = ttypause(tp, hz);
2007 				if (error)
2008 					break;
2009 				mutex_spin_exit(&tty_lock);
2010 				goto loop;
2011 			}
2012 			break;
2013 		}
2014 		/*
2015 		 * Interpret EOF only in canonical mode.
2016 		 */
2017 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
2018 			break;
2019 		/*
2020 		 * Give user character.
2021 		 */
2022 		mutex_spin_exit(&tty_lock);
2023  		error = ureadc(c, uio);
2024 		mutex_spin_enter(&tty_lock);
2025 		if (error)
2026 			break;
2027  		if (uio->uio_resid == 0)
2028 			break;
2029 		/*
2030 		 * In canonical mode check for a "break character"
2031 		 * marking the end of a "line of input".
2032 		 */
2033 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
2034 			break;
2035 		first = 0;
2036 	}
2037 
2038 	/*
2039 	 * Look to unblock output now that (presumably)
2040 	 * the input queue has gone down.
2041 	 */
2042 	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
2043 		if (ISSET(tp->t_iflag, IXOFF) &&
2044 		    cc[VSTART] != _POSIX_VDISABLE &&
2045 		    putc(cc[VSTART], &tp->t_outq) == 0) {
2046 			CLR(tp->t_state, TS_TBLOCK);
2047 			ttstart(tp);
2048 		}
2049 		/* Try to unblock remote output via hardware flow control. */
2050 		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
2051 		    (*tp->t_hwiflow)(tp, 0) != 0)
2052 			CLR(tp->t_state, TS_TBLOCK);
2053 	}
2054 	mutex_spin_exit(&tty_lock);
2055 
2056 	return (error);
2057 }
2058 
2059 /*
2060  * Check the output queue on tp for space for a kernel message (from uprintf
2061  * or tprintf).  Allow some space over the normal hiwater mark so we don't
2062  * lose messages due to normal flow control, but don't let the tty run amok.
2063  * Sleeps here are not interruptible, but we return prematurely if new signals
2064  * arrive.
2065  * Call with tty lock held.
2066  */
2067 static int
2068 ttycheckoutq_wlock(struct tty *tp, int wait)
2069 {
2070 	int	hiwat, error;
2071 
2072 	KASSERT(mutex_owned(&tty_lock));
2073 
2074 	hiwat = tp->t_hiwat;
2075 	if (tp->t_outq.c_cc > hiwat + 200)
2076 		while (tp->t_outq.c_cc > hiwat) {
2077 			ttstart(tp);
2078 			if (wait == 0)
2079 				return (0);
2080 			error = ttysleep(tp, &tp->t_outcv, true, hz);
2081 			if (error == EINTR)
2082 				wait = 0;
2083 		}
2084 
2085 	return (1);
2086 }
2087 
2088 int
2089 ttycheckoutq(struct tty *tp, int wait)
2090 {
2091 	int	r;
2092 
2093 	mutex_spin_enter(&tty_lock);
2094 	r = ttycheckoutq_wlock(tp, wait);
2095 	mutex_spin_exit(&tty_lock);
2096 
2097 	return (r);
2098 }
2099 
2100 /*
2101  * Process a write call on a tty device.
2102  */
2103 int
2104 ttwrite(struct tty *tp, struct uio *uio, int flag)
2105 {
2106 	u_char		*cp;
2107 	struct proc	*p;
2108 	int		cc, ce, i, hiwat, error;
2109 	u_char		obuf[OBUFSIZ];
2110 
2111 	cp = NULL;
2112 	hiwat = tp->t_hiwat;
2113 	error = 0;
2114 	cc = 0;
2115  loop:
2116 	mutex_spin_enter(&tty_lock);
2117 	if (!CONNECTED(tp)) {
2118 		if (ISSET(tp->t_state, TS_ISOPEN)) {
2119 			mutex_spin_exit(&tty_lock);
2120 			return (EIO);
2121 		} else if (flag & IO_NDELAY) {
2122 			mutex_spin_exit(&tty_lock);
2123 			error = EWOULDBLOCK;
2124 			goto out;
2125 		} else {
2126 			/* Sleep awaiting carrier. */
2127 			error = ttysleep(tp, &tp->t_rawcv, true, 0);
2128 			mutex_spin_exit(&tty_lock);
2129 			if (error)
2130 				goto out;
2131 			goto loop;
2132 		}
2133 	}
2134 
2135 	/*
2136 	 * Hang the process if it's in the background.
2137 	 */
2138 	p = curproc;
2139 	if (isbackground(p, tp) &&
2140 	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
2141 	    !sigismasked(curlwp, SIGTTOU)) {
2142 		if (p->p_pgrp->pg_jobc == 0) {
2143 			error = EIO;
2144 			mutex_spin_exit(&tty_lock);
2145 			goto out;
2146 		}
2147 		mutex_spin_exit(&tty_lock);
2148 
2149 		mutex_enter(&proc_lock);
2150 		pgsignal(p->p_pgrp, SIGTTOU, 1);
2151 		mutex_exit(&proc_lock);
2152 
2153 		mutex_spin_enter(&tty_lock);
2154 		error = ttypause(tp, hz);
2155 		mutex_spin_exit(&tty_lock);
2156 		if (error)
2157 			goto out;
2158 		goto loop;
2159 	}
2160 	mutex_spin_exit(&tty_lock);
2161 
2162 	/*
2163 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2164 	 * output translation.  Keep track of high water mark, sleep on
2165 	 * overflow awaiting device aid in acquiring new space.
2166 	 */
2167 	while (uio->uio_resid > 0 || cc > 0) {
2168 		if (ISSET(tp->t_lflag, FLUSHO)) {
2169 			uio->uio_resid = 0;
2170 			return (0);
2171 		}
2172 		if (tp->t_outq.c_cc > hiwat)
2173 			goto ovhiwat;
2174 		/*
2175 		 * Grab a hunk of data from the user, unless we have some
2176 		 * leftover from last time.
2177 		 */
2178 		if (cc == 0) {
2179 			cc = uimin(uio->uio_resid, OBUFSIZ);
2180 			cp = obuf;
2181 			error = uiomove(cp, cc, uio);
2182 			if (error) {
2183 				cc = 0;
2184 				goto out;
2185 			}
2186 		}
2187 		/*
2188 		 * If nothing fancy need be done, grab those characters we
2189 		 * can handle without any of ttyoutput's processing and
2190 		 * just transfer them to the output q.  For those chars
2191 		 * which require special processing (as indicated by the
2192 		 * bits in char_type), call ttyoutput.  After processing
2193 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2194 		 * immediately.
2195 		 */
2196 		mutex_spin_enter(&tty_lock);
2197 		while (cc > 0) {
2198 			if (!ISSET(tp->t_oflag, OPOST))
2199 				ce = cc;
2200 			else {
2201 				ce = cc - scanc((u_int)cc, cp, char_type,
2202 				    CCLASSMASK);
2203 				/*
2204 				 * If ce is zero, then we're processing
2205 				 * a special character through ttyoutput.
2206 				 */
2207 				if (ce == 0) {
2208 					tp->t_rocount = 0;
2209 					if (ttyoutput(*cp, tp) >= 0) {
2210 						/* out of space */
2211 						mutex_spin_exit(&tty_lock);
2212 						goto overfull;
2213 					}
2214 					cp++;
2215 					cc--;
2216 					if (ISSET(tp->t_lflag, FLUSHO) ||
2217 					    tp->t_outq.c_cc > hiwat) {
2218 						mutex_spin_exit(&tty_lock);
2219 						goto ovhiwat;
2220 					}
2221 					continue;
2222 				}
2223 			}
2224 			/*
2225 			 * A bunch of normal characters have been found.
2226 			 * Transfer them en masse to the output queue and
2227 			 * continue processing at the top of the loop.
2228 			 * If there are any further characters in this
2229 			 * <= OBUFSIZ chunk, the first should be a character
2230 			 * requiring special handling by ttyoutput.
2231 			 */
2232 			tp->t_rocount = 0;
2233 			i = b_to_q(cp, ce, &tp->t_outq);
2234 			ce -= i;
2235 			tp->t_column += ce;
2236 			cp += ce, cc -= ce, tk_nout += ce;
2237 			tp->t_outcc += ce;
2238 			if (i > 0) {
2239 				/* out of space */
2240 				mutex_spin_exit(&tty_lock);
2241 				goto overfull;
2242 			}
2243 			if (ISSET(tp->t_lflag, FLUSHO) ||
2244 			    tp->t_outq.c_cc > hiwat)
2245 				break;
2246 		}
2247 		ttstart(tp);
2248 		mutex_spin_exit(&tty_lock);
2249 	}
2250 
2251  out:
2252 	/*
2253 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2254 	 * offset and iov pointers have moved forward, but it doesn't matter
2255 	 * (the call will either return short or restart with a new uio).
2256 	 */
2257 	uio->uio_resid += cc;
2258 	return (error);
2259 
2260  overfull:
2261 	/*
2262 	 * Since we are using ring buffers, if we can't insert any more into
2263 	 * the output queue, we can assume the ring is full and that someone
2264 	 * forgot to set the high water mark correctly.  We set it and then
2265 	 * proceed as normal.
2266 	 */
2267 	hiwat = tp->t_outq.c_cc - 1;
2268 
2269  ovhiwat:
2270 	mutex_spin_enter(&tty_lock);
2271 	ttstart(tp);
2272 	/*
2273 	 * This can only occur if FLUSHO is set in t_lflag,
2274 	 * or if ttstart/oproc is synchronous (or very fast).
2275 	 */
2276 	if (tp->t_outq.c_cc <= hiwat) {
2277 		mutex_spin_exit(&tty_lock);
2278 		goto loop;
2279 	}
2280 	if (flag & IO_NDELAY) {
2281 		mutex_spin_exit(&tty_lock);
2282 		error = EWOULDBLOCK;
2283 		goto out;
2284 	}
2285 	error = ttysleep(tp, &tp->t_outcv, true, 0);
2286 	mutex_spin_exit(&tty_lock);
2287 	if (error)
2288 		goto out;
2289 	goto loop;
2290 }
2291 
2292 /*
2293  * Try to pull more output from the producer.  Return non-zero if
2294  * there is output ready to be sent.
2295  */
2296 bool
2297 ttypull(struct tty *tp)
2298 {
2299 
2300 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2301 
2302 	if (tp->t_outq.c_cc <= tp->t_lowat) {
2303 		cv_broadcast(&tp->t_outcv);
2304 		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2305 	}
2306 	return tp->t_outq.c_cc != 0;
2307 }
2308 
2309 /*
2310  * Rubout one character from the rawq of tp
2311  * as cleanly as possible.
2312  * Called with tty lock held.
2313  */
2314 void
2315 ttyrub(int c, struct tty *tp)
2316 {
2317 	u_char	*cp;
2318 	int	savecol, tabc;
2319 
2320 	KASSERT(mutex_owned(&tty_lock));
2321 
2322 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2323 		return;
2324 	CLR(tp->t_lflag, FLUSHO);
2325 	if (ISSET(tp->t_lflag, ECHOE)) {
2326 		if (tp->t_rocount == 0) {
2327 			/*
2328 			 * Screwed by ttwrite; retype
2329 			 */
2330 			ttyretype(tp);
2331 			return;
2332 		}
2333 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2334 			ttyrubo(tp, 2);
2335 		else {
2336 			CLR(c, ~TTY_CHARMASK);
2337 			switch (CCLASS(c)) {
2338 			case ORDINARY:
2339 				ttyrubo(tp, 1);
2340 				break;
2341 			case BACKSPACE:
2342 			case CONTROL:
2343 			case NEWLINE:
2344 			case RETURN:
2345 			case VTAB:
2346 				if (ISSET(tp->t_lflag, ECHOCTL))
2347 					ttyrubo(tp, 2);
2348 				break;
2349 			case TAB:
2350 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2351 					ttyretype(tp);
2352 					return;
2353 				}
2354 				savecol = tp->t_column;
2355 				SET(tp->t_state, TS_CNTTB);
2356 				SET(tp->t_lflag, FLUSHO);
2357 				tp->t_column = tp->t_rocol;
2358 				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2359 				    cp = nextc(&tp->t_rawq, cp, &tabc))
2360 					ttyecho(tabc, tp);
2361 				CLR(tp->t_lflag, FLUSHO);
2362 				CLR(tp->t_state, TS_CNTTB);
2363 
2364 				/* savecol will now be length of the tab. */
2365 				savecol -= tp->t_column;
2366 				tp->t_column += savecol;
2367 				if (savecol > 8)
2368 					savecol = 8;	/* overflow screw */
2369 				while (--savecol >= 0)
2370 					(void)ttyoutput('\b', tp);
2371 				break;
2372 			default:			/* XXX */
2373 				(void)printf("ttyrub: would panic c = %d, "
2374 				    "val = %d\n", c, CCLASS(c));
2375 			}
2376 		}
2377 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2378 		if (!ISSET(tp->t_state, TS_ERASE)) {
2379 			SET(tp->t_state, TS_ERASE);
2380 			(void)ttyoutput('\\', tp);
2381 		}
2382 		ttyecho(c, tp);
2383 	} else
2384 		ttyecho(tp->t_cc[VERASE], tp);
2385 	--tp->t_rocount;
2386 }
2387 
2388 /*
2389  * Back over cnt characters, erasing them.
2390  * Called with tty lock held.
2391  */
2392 static void
2393 ttyrubo(struct tty *tp, int cnt)
2394 {
2395 
2396 	KASSERT(mutex_owned(&tty_lock));
2397 
2398 	while (cnt-- > 0) {
2399 		(void)ttyoutput('\b', tp);
2400 		(void)ttyoutput(' ', tp);
2401 		(void)ttyoutput('\b', tp);
2402 	}
2403 }
2404 
2405 /*
2406  * ttyretype --
2407  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2408  *	been checked.
2409  *
2410  * Called with tty lock held.
2411  */
2412 void
2413 ttyretype(struct tty *tp)
2414 {
2415 	u_char	*cp;
2416 	int	c;
2417 
2418 	KASSERT(mutex_owned(&tty_lock));
2419 
2420 	/* Echo the reprint character. */
2421 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2422 		ttyecho(tp->t_cc[VREPRINT], tp);
2423 
2424 	(void)ttyoutput('\n', tp);
2425 
2426 	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2427 		ttyecho(c, tp);
2428 	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2429 		ttyecho(c, tp);
2430 	CLR(tp->t_state, TS_ERASE);
2431 
2432 	tp->t_rocount = tp->t_rawq.c_cc;
2433 	tp->t_rocol = 0;
2434 }
2435 
2436 /*
2437  * Echo a typed character to the terminal.
2438  * Called with tty lock held.
2439  */
2440 static void
2441 ttyecho(int c, struct tty *tp)
2442 {
2443 
2444 	KASSERT(mutex_owned(&tty_lock));
2445 
2446 	if (!ISSET(tp->t_state, TS_CNTTB))
2447 		CLR(tp->t_lflag, FLUSHO);
2448 	if ((!ISSET(tp->t_lflag, ECHO) &&
2449 	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2450 	    ISSET(tp->t_lflag, EXTPROC))
2451 		return;
2452 	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2453 	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2454 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2455 		(void)ttyoutput('^', tp);
2456 		CLR(c, ~TTY_CHARMASK);
2457 		if (c == 0177)
2458 			c = '?';
2459 		else
2460 			c += 'A' - 1;
2461 	}
2462 	(void)ttyoutput(c, tp);
2463 }
2464 
2465 /*
2466  * Wake up any readers on a tty.
2467  * Called with tty lock held.
2468  */
2469 void
2470 ttwakeup(struct tty *tp)
2471 {
2472 
2473 	KASSERT(mutex_owned(&tty_lock));
2474 
2475 	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2476 	if (ISSET(tp->t_state, TS_ASYNC))
2477 		ttysig(tp, TTYSIG_PG2, SIGIO);
2478 	cv_broadcast(&tp->t_rawcv);
2479 }
2480 
2481 /*
2482  * Look up a code for a specified speed in a conversion table;
2483  * used by drivers to map software speed values to hardware parameters.
2484  */
2485 int
2486 ttspeedtab(int speed, const struct speedtab *table)
2487 {
2488 
2489 	for (; table->sp_speed != -1; table++)
2490 		if (table->sp_speed == speed)
2491 			return (table->sp_code);
2492 	return (-1);
2493 }
2494 
2495 /*
2496  * Set tty hi and low water marks.
2497  *
2498  * Try to arrange the dynamics so there's about one second
2499  * from hi to low water.
2500  */
2501 void
2502 ttsetwater(struct tty *tp)
2503 {
2504 	int	cps, x;
2505 
2506 	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2507 
2508 #define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2509 
2510 	cps = tp->t_ospeed / 10;
2511 	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2512 	x += cps;
2513 	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2514 	tp->t_hiwat = roundup(x, TTROUND);
2515 #undef	CLAMP
2516 }
2517 
2518 /*
2519  * Prepare report on state of foreground process group.
2520  * Call with &proc_lock held.
2521  */
2522 void
2523 ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2524 {
2525 	struct lwp	*l;
2526 	struct proc	*p, *pick = NULL;
2527 	struct timeval	utime, stime;
2528 	int		tmp;
2529 	fixpt_t		pctcpu = 0;
2530 	const char	*msg = NULL;
2531 	char		lmsg[100];
2532 	long		rss;
2533 	bool		again = false;
2534 
2535 	KASSERT(mutex_owned(&proc_lock));
2536 
2537 	*buf = '\0';
2538 
2539  retry:
2540 	if (tp->t_session == NULL)
2541 		msg = "not a controlling terminal\n";
2542 	else if (tp->t_pgrp == NULL)
2543 		msg = "no foreground process group\n";
2544 	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2545 		msg = "empty foreground process group\n";
2546 	else {
2547 		/* Pick interesting process. */
2548 		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2549 			struct proc *oldpick;
2550 
2551 			if (pick == NULL) {
2552 				pick = p;
2553 				continue;
2554 			}
2555 			if (pick->p_lock < p->p_lock) {
2556 				mutex_enter(pick->p_lock);
2557 				mutex_enter(p->p_lock);
2558 			} else if (pick->p_lock > p->p_lock) {
2559 				mutex_enter(p->p_lock);
2560 				mutex_enter(pick->p_lock);
2561 			} else
2562 				mutex_enter(p->p_lock);
2563 			oldpick = pick;
2564 			if (proc_compare_wrapper(pick, p))
2565 				pick = p;
2566 			mutex_exit(p->p_lock);
2567 			if (p->p_lock != oldpick->p_lock)
2568 				mutex_exit(oldpick->p_lock);
2569 		}
2570 
2571 		if (pick != NULL) {
2572 			mutex_enter(pick->p_lock);
2573 			if (P_ZOMBIE(pick)) {
2574 				mutex_exit(pick->p_lock);
2575 				pick = NULL;
2576 				if (!again) {
2577 					again = true;
2578 					goto retry;
2579 				}
2580 				msg = "found only zombie processes\n";
2581 			}
2582 			if (pick && fromsig &&
2583 			    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2584 			    SA_NOKERNINFO)) {
2585 				mutex_exit(pick->p_lock);
2586 				return;
2587 			}
2588 		}
2589 	}
2590 
2591 	/* Print load average. */
2592 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2593 	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2594 	strlcat(buf, lmsg, bufsz);
2595 
2596 	if (pick == NULL) {
2597 		strlcat(buf, msg, bufsz);
2598 		return;
2599 	}
2600 
2601 	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2602 	    pick->p_pid);
2603 	strlcat(buf, lmsg, bufsz);
2604 
2605 	KASSERT(mutex_owned(pick->p_lock));
2606 	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2607 		const char *lp;
2608 		lwp_lock(l);
2609 #ifdef LWP_PC
2610 #define FMT_RUN "%#"PRIxVADDR
2611 #define VAL_RUNNING (vaddr_t)LWP_PC(l)
2612 #define VAL_RUNABLE (vaddr_t)LWP_PC(l)
2613 #else
2614 #define FMT_RUN "%s"
2615 #define VAL_RUNNING "running"
2616 #define VAL_RUNABLE "runnable"
2617 #endif
2618 		switch (l->l_stat) {
2619 		case LSONPROC:
2620 			snprintf(lmsg, sizeof(lmsg), FMT_RUN"/%d", VAL_RUNNING,
2621 			    cpu_index(l->l_cpu));
2622 			lp = lmsg;
2623 			break;
2624 		case LSRUN:
2625 			snprintf(lmsg, sizeof(lmsg), FMT_RUN, VAL_RUNABLE);
2626 			lp = lmsg;
2627 			break;
2628 		default:
2629 			lp = l->l_wchan ? l->l_wmesg : "iowait";
2630 			break;
2631 		}
2632 		strlcat(buf, lp, bufsz);
2633 		strlcat(buf, LIST_NEXT(l, l_sibling) != NULL ? " " : "] ",
2634 		    bufsz);
2635 		pctcpu += l->l_pctcpu;
2636 		lwp_unlock(l);
2637 	}
2638 	pctcpu += pick->p_pctcpu;
2639 	calcru(pick, &utime, &stime, NULL, NULL);
2640 	mutex_exit(pick->p_lock);
2641 
2642 	/* Round up and print user+system time, %CPU and RSS. */
2643 	utime.tv_usec += 5000;
2644 	if (utime.tv_usec >= 1000000) {
2645 		utime.tv_sec += 1;
2646 		utime.tv_usec -= 1000000;
2647 	}
2648 	stime.tv_usec += 5000;
2649 	if (stime.tv_usec >= 1000000) {
2650 		stime.tv_sec += 1;
2651 		stime.tv_usec -= 1000000;
2652 	}
2653 #define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2654 	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2655 	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2656 		rss = 0;
2657 	else
2658 		rss = pgtok(vm_resident_count(pick->p_vmspace));
2659 
2660 	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2661 	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2662 	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2663 	    tmp / 100, rss);
2664 	strlcat(buf, lmsg, bufsz);
2665 }
2666 
2667 /*
2668  * Print report on state of foreground process group.
2669  * Call with tty_lock held.
2670  */
2671 void
2672 ttyputinfo(struct tty *tp, char *buf)
2673 {
2674 
2675 	KASSERT(mutex_owned(&tty_lock));
2676 
2677 	if (ttycheckoutq_wlock(tp, 0) == 0)
2678 		return;
2679 	ttyprintf_nolock(tp, "%s\n", buf);
2680 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2681 }
2682 
2683 /*
2684  * Returns 1 if p2 has a better chance being the active foreground process
2685  * in a terminal instead of p1.
2686  */
2687 static int
2688 proc_compare_wrapper(struct proc *p1, struct proc *p2)
2689 {
2690 	lwp_t *l1, *l2;
2691 
2692 	KASSERT(mutex_owned(p1->p_lock));
2693 	KASSERT(mutex_owned(p2->p_lock));
2694 
2695 	l1 = LIST_FIRST(&p1->p_lwps);
2696 	l2 = LIST_FIRST(&p2->p_lwps);
2697 
2698 	return proc_compare(p1, l1, p2, l2);
2699 }
2700 
2701 /*
2702  * Output char to tty; console putchar style.
2703  * Can be called with tty lock held through kprintf() machinery..
2704  */
2705 int
2706 tputchar(int c, int flags, struct tty *tp)
2707 {
2708 	int r = 0;
2709 
2710 	if ((flags & NOLOCK) == 0)
2711 		mutex_spin_enter(&tty_lock);
2712 	if (!CONNECTED(tp)) {
2713 		r = -1;
2714 		goto out;
2715 	}
2716 	if (c == '\n')
2717 		(void)ttyoutput('\r', tp);
2718 	(void)ttyoutput(c, tp);
2719 	ttstart(tp);
2720 out:
2721 	if ((flags & NOLOCK) == 0)
2722 		mutex_spin_exit(&tty_lock);
2723 	return (r);
2724 }
2725 
2726 /*
2727  * Sleep on chan, returning ERESTART if tty changed while we napped and
2728  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by
2729  * cv_timedwait(_sig).
2730  * If the tty is revoked, restarting a pending call will redo validation done
2731  * at the start of the call.
2732  *
2733  * Must be called with the tty lock held.
2734  */
2735 int
2736 ttysleep(struct tty *tp, kcondvar_t *cv, bool catch_p, int timo)
2737 {
2738 	int	error;
2739 	short	gen;
2740 
2741 	KASSERT(mutex_owned(&tty_lock));
2742 
2743 	gen = tp->t_gen;
2744 	if (cv == NULL)
2745 		error = kpause("ttypause", catch_p, timo, &tty_lock);
2746 	else if (catch_p)
2747 		error = cv_timedwait_sig(cv, &tty_lock, timo);
2748 	else
2749 		error = cv_timedwait(cv, &tty_lock, timo);
2750 	if (error != 0)
2751 		return (error);
2752 	return (tp->t_gen == gen ? 0 : ERESTART);
2753 }
2754 
2755 int
2756 ttypause(struct tty *tp, int timo)
2757 {
2758 	int error;
2759 
2760 	error = ttysleep(tp, NULL, true, timo);
2761 	if (error == EWOULDBLOCK)
2762 		error = 0;
2763 	return error;
2764 }
2765 
2766 /*
2767  * Attach a tty to the tty list.
2768  *
2769  * This should be called ONLY once per real tty (including pty's).
2770  * eg, on the sparc, the keyboard and mouse have struct tty's that are
2771  * distinctly NOT usable as tty's, and thus should not be attached to
2772  * the ttylist.  This is why this call is not done from tty_alloc().
2773  *
2774  * Device drivers should attach tty's at a similar time that they are
2775  * allocated, or, for the case of statically allocated struct tty's
2776  * either in the attach or (first) open routine.
2777  */
2778 void
2779 tty_attach(struct tty *tp)
2780 {
2781 
2782 	mutex_spin_enter(&tty_lock);
2783 	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2784 	++tty_count;
2785 	mutex_spin_exit(&tty_lock);
2786 }
2787 
2788 /*
2789  * Remove a tty from the tty list.
2790  */
2791 void
2792 tty_detach(struct tty *tp)
2793 {
2794 
2795 	mutex_spin_enter(&tty_lock);
2796 	--tty_count;
2797 #ifdef DIAGNOSTIC
2798 	if (tty_count < 0)
2799 		panic("tty_detach: tty_count < 0");
2800 #endif
2801 	TAILQ_REMOVE(&ttylist, tp, tty_link);
2802 	mutex_spin_exit(&tty_lock);
2803 }
2804 
2805 /*
2806  * Allocate a tty structure and its associated buffers.
2807  */
2808 struct tty *
2809 tty_alloc(void)
2810 {
2811 	struct tty *tp;
2812 	int i;
2813 
2814 	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2815 	callout_init(&tp->t_rstrt_ch, 0);
2816 	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2817 	tp->t_qsize = tty_qsize;
2818 	clalloc(&tp->t_rawq, tp->t_qsize, 1);
2819 	cv_init(&tp->t_rawcv, "ttyraw");
2820 	cv_init(&tp->t_rawcvf, "ttyrawf");
2821 	clalloc(&tp->t_canq, tp->t_qsize, 1);
2822 	cv_init(&tp->t_cancv, "ttycan");
2823 	cv_init(&tp->t_cancvf, "ttycanf");
2824 	/* output queue doesn't need quoting */
2825 	clalloc(&tp->t_outq, tp->t_qsize, 0);
2826 	cv_init(&tp->t_outcv, "ttyout");
2827 	cv_init(&tp->t_outcvf, "ttyoutf");
2828 	/* Set default line discipline. */
2829 	tp->t_linesw = ttyldisc_default();
2830 	tp->t_dev = NODEV;
2831 	selinit(&tp->t_rsel);
2832 	selinit(&tp->t_wsel);
2833 	for (i = 0; i < TTYSIG_COUNT; i++)  {
2834 		sigemptyset(&tp->t_sigs[i]);
2835 	}
2836 
2837 	return tp;
2838 }
2839 
2840 /*
2841  * Free a tty structure and its buffers.
2842  *
2843  * Be sure to call tty_detach() for any tty that has been
2844  * tty_attach()ed.
2845  */
2846 void
2847 tty_free(struct tty *tp)
2848 {
2849 	int i;
2850 
2851 	mutex_enter(&proc_lock);
2852 	mutex_enter(&tty_lock);
2853 	for (i = 0; i < TTYSIG_COUNT; i++)
2854 		sigemptyset(&tp->t_sigs[i]);
2855 	if (tp->t_sigcount != 0)
2856 		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2857 	mutex_exit(&tty_lock);
2858 	mutex_exit(&proc_lock);
2859 
2860 	callout_halt(&tp->t_rstrt_ch, NULL);
2861 	callout_destroy(&tp->t_rstrt_ch);
2862 	ttyldisc_release(tp->t_linesw);
2863 	clfree(&tp->t_rawq);
2864 	clfree(&tp->t_canq);
2865 	clfree(&tp->t_outq);
2866 	cv_destroy(&tp->t_rawcv);
2867 	cv_destroy(&tp->t_rawcvf);
2868 	cv_destroy(&tp->t_cancv);
2869 	cv_destroy(&tp->t_cancvf);
2870 	cv_destroy(&tp->t_outcv);
2871 	cv_destroy(&tp->t_outcvf);
2872 	seldestroy(&tp->t_rsel);
2873 	seldestroy(&tp->t_wsel);
2874 	kmem_free(tp, sizeof(*tp));
2875 }
2876 
2877 /*
2878  * ttyprintf_nolock: send a message to a specific tty, without locking.
2879  *
2880  * => should be used only by tty driver or anything that knows the
2881  *    underlying tty will not be revoked(2)'d away.  [otherwise,
2882  *    use tprintf]
2883  */
2884 static void
2885 ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2886 {
2887 	va_list ap;
2888 
2889 	/* No mutex needed; going to process TTY. */
2890 	va_start(ap, fmt);
2891 	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2892 	va_end(ap);
2893 }
2894 
2895 static int
2896 tty_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
2897     void *arg0, void *arg1, void *arg2, void *arg3)
2898 {
2899 	struct tty *tty;
2900 	int result;
2901 
2902 	result = KAUTH_RESULT_DEFER;
2903 
2904 	if (action != KAUTH_DEVICE_TTY_OPEN)
2905 		return result;
2906 
2907 	tty = arg0;
2908 
2909 	/* If it's not opened, we allow. */
2910 	if ((tty->t_state & TS_ISOPEN) == 0)
2911 		result = KAUTH_RESULT_ALLOW;
2912 	else {
2913 		/*
2914 		 * If it's opened, we can only allow if it's not exclusively
2915 		 * opened; otherwise, that's a privileged operation and we
2916 		 * let the secmodel handle it.
2917 		 */
2918 		if ((tty->t_state & TS_XCLUDE) == 0)
2919 			result = KAUTH_RESULT_ALLOW;
2920 	}
2921 
2922 	return result;
2923 }
2924 
2925 /*
2926  * Initialize the tty subsystem.
2927  */
2928 void
2929 tty_init(void)
2930 {
2931 
2932 	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2933 	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2934 	KASSERT(tty_sigsih != NULL);
2935 
2936 	tty_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
2937 	    tty_listener_cb, NULL);
2938 
2939 	sysctl_kern_tty_setup();
2940 }
2941 
2942 /*
2943  * Send a signal from a tty to its process group or session leader.
2944  * Handoff to the target is deferred to a soft interrupt.
2945  */
2946 void
2947 ttysig(struct tty *tp, enum ttysigtype st, int sig)
2948 {
2949 	sigset_t *sp;
2950 
2951 	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2952 
2953 	sp = &tp->t_sigs[st];
2954 	if (sigismember(sp, sig))
2955 		return;
2956 	sigaddset(sp, sig);
2957 	if (tp->t_sigcount++ == 0)
2958 		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2959 	softint_schedule(tty_sigsih);
2960 }
2961 
2962 /*
2963  * Deliver deferred signals from ttys.  Note that the process groups
2964  * and sessions associated with the ttys may have changed from when
2965  * the signal was originally sent, but in practice it should not matter.
2966  * For signals produced as a result of a syscall, the soft interrupt
2967  * will fire before the syscall returns to the user.
2968  */
2969 static void
2970 ttysigintr(void *cookie)
2971 {
2972 	struct tty *tp;
2973 	enum ttysigtype st;
2974 	struct pgrp *pgrp;
2975 	struct session *sess;
2976 	int sig, lflag;
2977 	char infobuf[200];
2978 
2979 	mutex_enter(&proc_lock);
2980 	mutex_spin_enter(&tty_lock);
2981 	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2982 		KASSERT(tp->t_sigcount > 0);
2983 		for (st = TTYSIG_PG1; st < TTYSIG_COUNT; st++) {
2984 			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2985 				break;
2986 		}
2987 		KASSERT(st < TTYSIG_COUNT);
2988 		sigdelset(&tp->t_sigs[st], sig);
2989 		if (--tp->t_sigcount == 0)
2990 			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2991 		pgrp = tp->t_pgrp;
2992 		sess = tp->t_session;
2993 		lflag = tp->t_lflag;
2994 		if (sig == SIGINFO) {
2995 			if (ISSET(tp->t_state, TS_SIGINFO)) {
2996 				/* Via ioctl: ignore tty option. */
2997 				tp->t_state &= ~TS_SIGINFO;
2998 				lflag |= ISIG;
2999 			}
3000 			if (!ISSET(lflag, NOKERNINFO)) {
3001 				mutex_spin_exit(&tty_lock);
3002 				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
3003 				mutex_spin_enter(&tty_lock);
3004 				ttyputinfo(tp, infobuf);
3005 			}
3006 			if (!ISSET(lflag, ISIG))
3007 				continue;
3008 		}
3009 		mutex_spin_exit(&tty_lock);
3010 		KASSERT(sig != 0);
3011 		switch (st) {
3012 		case TTYSIG_PG1:
3013 			if (pgrp != NULL)
3014 				pgsignal(pgrp, sig, 1);
3015 			break;
3016 		case TTYSIG_PG2:
3017 			if (pgrp != NULL)
3018 				pgsignal(pgrp, sig, sess != NULL);
3019 			break;
3020 		case TTYSIG_LEADER:
3021 			if (sess != NULL && sess->s_leader != NULL)
3022 				psignal(sess->s_leader, sig);
3023 			break;
3024 		default:
3025 			/* NOTREACHED */
3026 			break;
3027 		}
3028 		mutex_spin_enter(&tty_lock);
3029 	}
3030 	mutex_spin_exit(&tty_lock);
3031 	mutex_exit(&proc_lock);
3032 }
3033 
3034 unsigned char
3035 tty_getctrlchar(struct tty *tp, unsigned which)
3036 {
3037 	KASSERT(which < NCCS);
3038 	return tp->t_cc[which];
3039 }
3040 
3041 void
3042 tty_setctrlchar(struct tty *tp, unsigned which, unsigned char val)
3043 {
3044 	KASSERT(which < NCCS);
3045 	tp->t_cc[which] = val;
3046 }
3047 
3048 int
3049 tty_try_xonxoff(struct tty *tp, unsigned char c)
3050 {
3051     const struct cdevsw *cdev;
3052 
3053     if (tp->t_iflag & IXON) {
3054 	if (c == tp->t_cc[VSTOP] && tp->t_cc[VSTOP] != _POSIX_VDISABLE) {
3055 	    if ((tp->t_state & TS_TTSTOP) == 0) {
3056 		tp->t_state |= TS_TTSTOP;
3057 		cdev = cdevsw_lookup(tp->t_dev);
3058 		if (cdev != NULL)
3059 			(*cdev->d_stop)(tp, 0);
3060 	    }
3061 	    return 0;
3062 	}
3063 	if (c == tp->t_cc[VSTART] && tp->t_cc[VSTART] != _POSIX_VDISABLE) {
3064 	    tp->t_state &= ~TS_TTSTOP;
3065 	    if (tp->t_oproc != NULL) {
3066 	        mutex_spin_enter(&tty_lock);	/* XXX */
3067 		(*tp->t_oproc)(tp);
3068 	        mutex_spin_exit(&tty_lock);	/* XXX */
3069 	    }
3070 	    return 0;
3071 	}
3072     }
3073     return EAGAIN;
3074 }
3075