1/*	$NetBSD: tty.c,v 1.249.8.1 2012/03/19 23:23:10 riz Exp $	*/
2
3/*-
4 * Copyright (c) 2008 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29/*-
30 * Copyright (c) 1982, 1986, 1990, 1991, 1993
31 *	The Regents of the University of California.  All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 *    notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 *    notice, this list of conditions and the following disclaimer in the
45 *    documentation and/or other materials provided with the distribution.
46 * 3. Neither the name of the University nor the names of its contributors
47 *    may be used to endorse or promote products derived from this software
48 *    without specific prior written permission.
49 *
50 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60 * SUCH DAMAGE.
61 *
62 *	@(#)tty.c	8.13 (Berkeley) 1/9/95
63 */
64
65#include <sys/cdefs.h>
66__KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.249.8.1 2012/03/19 23:23:10 riz Exp $");
67
68#include <sys/param.h>
69#include <sys/systm.h>
70#include <sys/ioctl.h>
71#include <sys/proc.h>
72#define	TTYDEFCHARS
73#include <sys/tty.h>
74#undef	TTYDEFCHARS
75#include <sys/file.h>
76#include <sys/conf.h>
77#include <sys/cpu.h>
78#include <sys/dkstat.h>
79#include <sys/uio.h>
80#include <sys/kernel.h>
81#include <sys/vnode.h>
82#include <sys/syslog.h>
83#include <sys/kmem.h>
84#include <sys/signalvar.h>
85#include <sys/resourcevar.h>
86#include <sys/poll.h>
87#include <sys/kprintf.h>
88#include <sys/namei.h>
89#include <sys/sysctl.h>
90#include <sys/kauth.h>
91#include <sys/intr.h>
92#include <sys/ioctl_compat.h>
93#include <sys/module.h>
94#include <sys/bitops.h>
95
96static int	ttnread(struct tty *);
97static void	ttyblock(struct tty *);
98static void	ttyecho(int, struct tty *);
99static void	ttyrubo(struct tty *, int);
100static void	ttyprintf_nolock(struct tty *, const char *fmt, ...)
101    __attribute__((__format__(__printf__,2,3)));
102static int	proc_compare_wrapper(struct proc *, struct proc *);
103static void	ttysigintr(void *);
104
105/* Symbolic sleep message strings. */
106const char	ttclos[] = "ttycls";
107const char	ttopen[] = "ttyopn";
108const char	ttybg[] = "ttybg";
109const char	ttyin[] = "ttyin";
110const char	ttyout[] = "ttyout";
111
112/*
113 * Used to determine whether we still have a connection.  This is true in
114 * one of 3 cases:
115 * 1) We have carrier.
116 * 2) It's a locally attached terminal, and we are therefore ignoring carrier.
117 * 3) We're using a flow control mechanism that overloads the carrier signal.
118 */
119#define	CONNECTED(tp)	(ISSET(tp->t_state, TS_CARR_ON) ||	\
120			 ISSET(tp->t_cflag, CLOCAL | MDMBUF))
121
122/*
123 * Table with character classes and parity. The 8th bit indicates parity,
124 * the 7th bit indicates the character is an alphameric or underscore (for
125 * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126 * are 0 then the character needs no special processing on output; classes
127 * other than 0 might be translated or (not currently) require delays.
128 */
129#define	E	0x00	/* Even parity. */
130#define	O	0x80	/* Odd parity. */
131#define	PARITY(c)	(char_type[c] & O)
132
133#define	ALPHA	0x40	/* Alpha or underscore. */
134#define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135
136#define	CCLASSMASK	0x3f
137#define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138
139#define	BS	BACKSPACE
140#define	CC	CONTROL
141#define	CR	RETURN
142#define	NA	ORDINARY | ALPHA
143#define	NL	NEWLINE
144#define	NO	ORDINARY
145#define	TB	TAB
146#define	VT	VTAB
147
148unsigned char const char_type[] = {
149	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC,	/* bs - si */
151	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC,	/* dle - etb */
152	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* can - us */
153	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* sp - ' */
154	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO,	/* ( - / */
155	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* 0 - 7 */
156	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO,	/* 8 - ? */
157	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* @ - G */
158	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* H - O */
159	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* P - W */
160	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA,	/* X - _ */
161	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA,	/* ` - g */
162	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* h - o */
163	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA,	/* p - w */
164	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC,	/* x - del */
165	/*
166	 * Meta chars; should be settable per character set;
167	 * for now, treat them all as normal characters.
168	 */
169	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185};
186#undef	BS
187#undef	CC
188#undef	CR
189#undef	NA
190#undef	NL
191#undef	NO
192#undef	TB
193#undef	VT
194
195static struct ttylist_head tty_sigqueue = TAILQ_HEAD_INITIALIZER(tty_sigqueue);
196static void *tty_sigsih;
197
198struct ttylist_head ttylist = TAILQ_HEAD_INITIALIZER(ttylist);
199int tty_count;
200kmutex_t tty_lock;
201krwlock_t ttcompat_lock;
202int (*ttcompatvec)(struct tty *, u_long, void *, int, struct lwp *);
203
204uint64_t tk_cancc;
205uint64_t tk_nin;
206uint64_t tk_nout;
207uint64_t tk_rawcc;
208
209static kauth_listener_t tty_listener;
210
211#define	TTY_MINQSIZE	0x00400
212#define	TTY_MAXQSIZE	0x10000
213int tty_qsize = TTY_MINQSIZE;
214
215static int
216tty_get_qsize(int *qsize, int newsize)
217{
218	newsize = 1 << ilog2(newsize);	/* Make it a power of two */
219
220	if (newsize < TTY_MINQSIZE || newsize > TTY_MAXQSIZE)
221		return EINVAL;
222
223	*qsize = newsize;
224	return 0;
225}
226
227static int
228tty_set_qsize(struct tty *tp, int newsize)
229{
230	struct clist rawq, canq, outq;
231	struct clist orawq, ocanq, ooutq;
232
233	clalloc(&rawq, newsize, 1);
234	clalloc(&canq, newsize, 1);
235	clalloc(&outq, newsize, 0);
236
237	mutex_spin_enter(&tty_lock);
238
239	if (tp->t_outq.c_cc != 0) {
240		mutex_spin_exit(&tty_lock);
241		clfree(&rawq);
242		clfree(&canq);
243		clfree(&outq);
244		return EBUSY;
245	}
246
247	orawq = tp->t_rawq;
248	ocanq = tp->t_canq;
249	ooutq = tp->t_outq;
250
251	tp->t_qsize = newsize;
252	tp->t_rawq = rawq;
253	tp->t_canq = canq;
254	tp->t_outq = outq;
255
256	ttsetwater(tp);
257
258	mutex_spin_exit(&tty_lock);
259
260	clfree(&orawq);
261	clfree(&ocanq);
262	clfree(&ooutq);
263
264	return 0;
265}
266
267static int
268sysctl_kern_tty_qsize(SYSCTLFN_ARGS)
269{
270	int newsize;
271	int error;
272	struct sysctlnode node;
273	node = *rnode;
274	node.sysctl_data = &newsize;
275
276	newsize = tty_qsize;
277	error = sysctl_lookup(SYSCTLFN_CALL(&node));
278	if (error || newp == NULL)
279		return error;
280
281
282	return tty_get_qsize(&tty_qsize, newsize);
283}
284
285static void
286sysctl_kern_tty_setup(void)
287{
288	const struct sysctlnode *rnode, *cnode;
289	struct sysctllog *kern_tkstat_sysctllog, *kern_tty_sysctllog;
290
291	kern_tkstat_sysctllog = NULL;
292	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
293		       CTLFLAG_PERMANENT,
294		       CTLTYPE_NODE, "kern", NULL,
295		       NULL, 0, NULL, 0,
296		       CTL_KERN, CTL_EOL);
297	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
298		       CTLFLAG_PERMANENT,
299		       CTLTYPE_NODE, "tkstat",
300		       SYSCTL_DESCR("Number of characters sent and and "
301				    "received on ttys"),
302		       NULL, 0, NULL, 0,
303		       CTL_KERN, KERN_TKSTAT, CTL_EOL);
304
305	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
306		       CTLFLAG_PERMANENT,
307		       CTLTYPE_QUAD, "nin",
308		       SYSCTL_DESCR("Total number of tty input characters"),
309		       NULL, 0, &tk_nin, 0,
310		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NIN, CTL_EOL);
311	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
312		       CTLFLAG_PERMANENT,
313		       CTLTYPE_QUAD, "nout",
314		       SYSCTL_DESCR("Total number of tty output characters"),
315		       NULL, 0, &tk_nout, 0,
316		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_NOUT, CTL_EOL);
317	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
318		       CTLFLAG_PERMANENT,
319		       CTLTYPE_QUAD, "cancc",
320		       SYSCTL_DESCR("Number of canonical tty input characters"),
321		       NULL, 0, &tk_cancc, 0,
322		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_CANCC, CTL_EOL);
323	sysctl_createv(&kern_tkstat_sysctllog, 0, NULL, NULL,
324		       CTLFLAG_PERMANENT,
325		       CTLTYPE_QUAD, "rawcc",
326		       SYSCTL_DESCR("Number of raw tty input characters"),
327		       NULL, 0, &tk_rawcc, 0,
328		       CTL_KERN, KERN_TKSTAT, KERN_TKSTAT_RAWCC, CTL_EOL);
329
330	kern_tty_sysctllog = NULL;
331	sysctl_createv(&kern_tty_sysctllog, 0, NULL, &rnode,
332		       CTLFLAG_PERMANENT,
333		       CTLTYPE_NODE, "tty", NULL,
334		       NULL, 0, NULL, 0,
335		       CTL_KERN, CTL_CREATE, CTL_EOL);
336	sysctl_createv(&kern_tty_sysctllog, 0, &rnode, &cnode,
337		       CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
338		       CTLTYPE_INT, "qsize",
339		       SYSCTL_DESCR("TTY input and output queue size"),
340		       sysctl_kern_tty_qsize, 0, &tty_qsize, 0,
341		       CTL_CREATE, CTL_EOL);
342}
343
344int
345ttyopen(struct tty *tp, int dialout, int nonblock)
346{
347	int	error;
348
349	error = 0;
350
351	mutex_spin_enter(&tty_lock);
352
353	if (dialout) {
354		/*
355		 * If the device is already open for non-dialout, fail.
356		 * Otherwise, set TS_DIALOUT to block any pending non-dialout
357		 * opens.
358		 */
359		if (ISSET(tp->t_state, TS_ISOPEN) &&
360		    !ISSET(tp->t_state, TS_DIALOUT)) {
361			error = EBUSY;
362			goto out;
363		}
364		SET(tp->t_state, TS_DIALOUT);
365	} else {
366		if (!nonblock) {
367			/*
368			 * Wait for carrier.  Also wait for any dialout
369			 * processes to close the tty first.
370			 */
371			while (ISSET(tp->t_state, TS_DIALOUT) ||
372			       !CONNECTED(tp)) {
373				tp->t_wopen++;
374				error = ttysleep(tp, &tp->t_rawcv, true, 0);
375				tp->t_wopen--;
376				if (error)
377					goto out;
378			}
379		} else {
380			/*
381			 * Don't allow a non-blocking non-dialout open if the
382			 * device is already open for dialout.
383			 */
384			if (ISSET(tp->t_state, TS_DIALOUT)) {
385				error = EBUSY;
386				goto out;
387			}
388		}
389	}
390
391out:
392	mutex_spin_exit(&tty_lock);
393	return (error);
394}
395
396/*
397 * Initial open of tty, or (re)entry to standard tty line discipline.
398 */
399int
400ttylopen(dev_t device, struct tty *tp)
401{
402
403	mutex_spin_enter(&tty_lock);
404	tp->t_dev = device;
405	if (!ISSET(tp->t_state, TS_ISOPEN)) {
406		SET(tp->t_state, TS_ISOPEN);
407		memset(&tp->t_winsize, 0, sizeof(tp->t_winsize));
408		tp->t_flags = 0;
409	}
410	mutex_spin_exit(&tty_lock);
411	if (tp->t_qsize != tty_qsize)
412		tty_set_qsize(tp, tty_qsize);
413	return (0);
414}
415
416/*
417 * Handle close() on a tty line: flush and set to initial state,
418 * bumping generation number so that pending read/write calls
419 * can detect recycling of the tty.
420 */
421int
422ttyclose(struct tty *tp)
423{
424	extern struct tty *constty;	/* Temporary virtual console. */
425	struct session *sess;
426
427	mutex_spin_enter(&tty_lock);
428
429	if (constty == tp)
430		constty = NULL;
431
432	ttyflush(tp, FREAD | FWRITE);
433
434	tp->t_gen++;
435	tp->t_pgrp = NULL;
436	tp->t_state = 0;
437	sess = tp->t_session;
438	tp->t_session = NULL;
439
440	mutex_spin_exit(&tty_lock);
441
442	if (sess != NULL) {
443		mutex_enter(proc_lock);
444		/* Releases proc_lock. */
445		proc_sessrele(sess);
446	}
447	return (0);
448}
449
450#define	FLUSHQ(q) {							\
451	if ((q)->c_cc)							\
452		ndflush(q, (q)->c_cc);					\
453}
454
455/*
456 * This macro is used in canonical mode input processing, where a read
457 * request shall not return unless a 'line delimiter' ('\n') or 'break'
458 * (EOF, EOL, EOL2) character (or a signal) has been received. As EOL2
459 * is an extension to the POSIX.1 defined set of special characters,
460 * recognize it only if IEXTEN is set in the set of local flags.
461 */
462#define	TTBREAKC(c, lflg)						\
463	((c) == '\n' || (((c) == cc[VEOF] || (c) == cc[VEOL] ||		\
464	((c) == cc[VEOL2] && ISSET(lflg, IEXTEN))) && (c) != _POSIX_VDISABLE))
465
466
467
468/*
469 * ttyinput() helper.
470 * Call with the tty lock held.
471 */
472/* XXX static */ int
473ttyinput_wlock(int c, struct tty *tp)
474{
475	int	iflag, lflag, i, error;
476	u_char	*cc;
477
478	KASSERT(mutex_owned(&tty_lock));
479
480	/*
481	 * If input is pending take it first.
482	 */
483	lflag = tp->t_lflag;
484	if (ISSET(lflag, PENDIN))
485		ttypend(tp);
486	/*
487	 * Gather stats.
488	 */
489	if (ISSET(lflag, ICANON)) {
490		++tk_cancc;
491		++tp->t_cancc;
492	} else {
493		++tk_rawcc;
494		++tp->t_rawcc;
495	}
496	++tk_nin;
497
498	cc = tp->t_cc;
499
500	/*
501	 * Handle exceptional conditions (break, parity, framing).
502	 */
503	iflag = tp->t_iflag;
504	if ((error = (ISSET(c, TTY_ERRORMASK))) != 0) {
505		CLR(c, TTY_ERRORMASK);
506		if (ISSET(error, TTY_FE) && c == 0) {		/* Break. */
507			if (ISSET(iflag, IGNBRK))
508				return (0);
509			else if (ISSET(iflag, BRKINT)) {
510				ttyflush(tp, FREAD | FWRITE);
511				ttysig(tp, TTYSIG_PG1, SIGINT);
512				return (0);
513			} else if (ISSET(iflag, PARMRK))
514				goto parmrk;
515		} else if ((ISSET(error, TTY_PE) && ISSET(iflag, INPCK)) ||
516		    ISSET(error, TTY_FE)) {
517			if (ISSET(iflag, IGNPAR))
518				return (0);
519			else if (ISSET(iflag, PARMRK)) {
520 parmrk:			(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
521				(void)putc(0    | TTY_QUOTE, &tp->t_rawq);
522				(void)putc(c    | TTY_QUOTE, &tp->t_rawq);
523				return (0);
524			} else
525				c = 0;
526		}
527	} else if (c == 0377 &&
528	    ISSET(iflag, ISTRIP|IGNPAR|INPCK|PARMRK) == (INPCK|PARMRK)) {
529		/* "Escape" a valid character of '\377'. */
530		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
531		(void)putc(0377 | TTY_QUOTE, &tp->t_rawq);
532		goto endcase;
533	}
534
535	/*
536	 * In tandem mode, check high water mark.
537	 */
538	if (ISSET(iflag, IXOFF) || ISSET(tp->t_cflag, CHWFLOW))
539		ttyblock(tp);
540	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
541		CLR(c, 0x80);
542	if (!ISSET(lflag, EXTPROC)) {
543		/*
544		 * Check for literal nexting very first
545		 */
546		if (ISSET(tp->t_state, TS_LNCH)) {
547			SET(c, TTY_QUOTE);
548			CLR(tp->t_state, TS_LNCH);
549		}
550		/*
551		 * Scan for special characters.  This code
552		 * is really just a big case statement with
553		 * non-constant cases.  The bottom of the
554		 * case statement is labeled ``endcase'', so goto
555		 * it after a case match, or similar.
556		 */
557
558		/*
559		 * Control chars which aren't controlled
560		 * by ICANON, ISIG, or IXON.
561		 */
562		if (ISSET(lflag, IEXTEN)) {
563			if (CCEQ(cc[VLNEXT], c)) {
564				if (ISSET(lflag, ECHO)) {
565					if (ISSET(lflag, ECHOE)) {
566						(void)ttyoutput('^', tp);
567						(void)ttyoutput('\b', tp);
568					} else
569						ttyecho(c, tp);
570				}
571				SET(tp->t_state, TS_LNCH);
572				goto endcase;
573			}
574			if (CCEQ(cc[VDISCARD], c)) {
575				if (ISSET(lflag, FLUSHO))
576					CLR(tp->t_lflag, FLUSHO);
577				else {
578					ttyflush(tp, FWRITE);
579					ttyecho(c, tp);
580					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
581						ttyretype(tp);
582					SET(tp->t_lflag, FLUSHO);
583				}
584				goto startoutput;
585			}
586		}
587		/*
588		 * Signals.
589		 */
590		if (ISSET(lflag, ISIG)) {
591			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
592				if (!ISSET(lflag, NOFLSH))
593					ttyflush(tp, FREAD | FWRITE);
594				ttyecho(c, tp);
595				ttysig(tp, TTYSIG_PG1, CCEQ(cc[VINTR], c) ?
596				    SIGINT : SIGQUIT);
597				goto endcase;
598			}
599			if (CCEQ(cc[VSUSP], c)) {
600				if (!ISSET(lflag, NOFLSH))
601					ttyflush(tp, FREAD);
602				ttyecho(c, tp);
603				ttysig(tp, TTYSIG_PG1, SIGTSTP);
604				goto endcase;
605			}
606		}
607		/*
608		 * Handle start/stop characters.
609		 */
610		if (ISSET(iflag, IXON)) {
611			if (CCEQ(cc[VSTOP], c)) {
612				if (!ISSET(tp->t_state, TS_TTSTOP)) {
613					SET(tp->t_state, TS_TTSTOP);
614					cdev_stop(tp, 0);
615					return (0);
616				}
617				if (!CCEQ(cc[VSTART], c))
618					return (0);
619				/*
620				 * if VSTART == VSTOP then toggle
621				 */
622				goto endcase;
623			}
624			if (CCEQ(cc[VSTART], c))
625				goto restartoutput;
626		}
627		/*
628		 * IGNCR, ICRNL, & INLCR
629		 */
630		if (c == '\r') {
631			if (ISSET(iflag, IGNCR))
632				goto endcase;
633			else if (ISSET(iflag, ICRNL))
634				c = '\n';
635		} else if (c == '\n' && ISSET(iflag, INLCR))
636			c = '\r';
637	}
638	if (!ISSET(lflag, EXTPROC) && ISSET(lflag, ICANON)) {
639		/*
640		 * From here on down canonical mode character
641		 * processing takes place.
642		 */
643		/*
644		 * erase (^H / ^?)
645		 */
646		if (CCEQ(cc[VERASE], c)) {
647			if (tp->t_rawq.c_cc)
648				ttyrub(unputc(&tp->t_rawq), tp);
649			goto endcase;
650		}
651		/*
652		 * kill (^U)
653		 */
654		if (CCEQ(cc[VKILL], c)) {
655			if (ISSET(lflag, ECHOKE) &&
656			    tp->t_rawq.c_cc == tp->t_rocount &&
657			    !ISSET(lflag, ECHOPRT))
658				while (tp->t_rawq.c_cc)
659					ttyrub(unputc(&tp->t_rawq), tp);
660			else {
661				ttyecho(c, tp);
662				if (ISSET(lflag, ECHOK) ||
663				    ISSET(lflag, ECHOKE))
664					ttyecho('\n', tp);
665				FLUSHQ(&tp->t_rawq);
666				tp->t_rocount = 0;
667			}
668			CLR(tp->t_state, TS_LOCAL);
669			goto endcase;
670		}
671		/*
672		 * Extensions to the POSIX.1 GTI set of functions.
673		 */
674		if (ISSET(lflag, IEXTEN)) {
675			/*
676			 * word erase (^W)
677			 */
678			if (CCEQ(cc[VWERASE], c)) {
679				int alt = ISSET(lflag, ALTWERASE);
680				int ctype;
681
682				/*
683				 * erase whitespace
684				 */
685				while ((c = unputc(&tp->t_rawq)) == ' ' ||
686				    c == '\t')
687					ttyrub(c, tp);
688				if (c == -1)
689					goto endcase;
690				/*
691				 * erase last char of word and remember the
692				 * next chars type (for ALTWERASE)
693				 */
694				ttyrub(c, tp);
695				c = unputc(&tp->t_rawq);
696				if (c == -1)
697					goto endcase;
698				if (c == ' ' || c == '\t') {
699					(void)putc(c, &tp->t_rawq);
700					goto endcase;
701				}
702				ctype = ISALPHA(c);
703				/*
704				 * erase rest of word
705				 */
706				do {
707					ttyrub(c, tp);
708					c = unputc(&tp->t_rawq);
709					if (c == -1)
710						goto endcase;
711				} while (c != ' ' && c != '\t' &&
712				    (alt == 0 || ISALPHA(c) == ctype));
713				(void)putc(c, &tp->t_rawq);
714				goto endcase;
715			}
716			/*
717			 * reprint line (^R)
718			 */
719			if (CCEQ(cc[VREPRINT], c)) {
720				ttyretype(tp);
721				goto endcase;
722			}
723			/*
724			 * ^T - kernel info and generate SIGINFO
725			 */
726			if (CCEQ(cc[VSTATUS], c)) {
727				ttysig(tp, TTYSIG_PG1, SIGINFO);
728				goto endcase;
729			}
730		}
731	}
732	/*
733	 * Check for input buffer overflow
734	 */
735	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= TTYHOG) {
736		if (ISSET(iflag, IMAXBEL)) {
737			if (tp->t_outq.c_cc < tp->t_hiwat)
738				(void)ttyoutput(CTRL('g'), tp);
739		} else
740			ttyflush(tp, FREAD | FWRITE);
741		goto endcase;
742	}
743	/*
744	 * Put data char in q for user and
745	 * wakeup on seeing a line delimiter.
746	 */
747	if (putc(c, &tp->t_rawq) >= 0) {
748		if (!ISSET(lflag, ICANON)) {
749			ttwakeup(tp);
750			ttyecho(c, tp);
751			goto endcase;
752		}
753		if (TTBREAKC(c, lflag)) {
754			tp->t_rocount = 0;
755			catq(&tp->t_rawq, &tp->t_canq);
756			ttwakeup(tp);
757		} else if (tp->t_rocount++ == 0)
758			tp->t_rocol = tp->t_column;
759		if (ISSET(tp->t_state, TS_ERASE)) {
760			/*
761			 * end of prterase \.../
762			 */
763			CLR(tp->t_state, TS_ERASE);
764			(void)ttyoutput('/', tp);
765		}
766		i = tp->t_column;
767		ttyecho(c, tp);
768		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
769			/*
770			 * Place the cursor over the '^' of the ^D.
771			 */
772			i = min(2, tp->t_column - i);
773			while (i > 0) {
774				(void)ttyoutput('\b', tp);
775				i--;
776			}
777		}
778	}
779 endcase:
780	/*
781	 * IXANY means allow any character to restart output.
782	 */
783	if (ISSET(tp->t_state, TS_TTSTOP) &&
784	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
785		return (0);
786	}
787 restartoutput:
788	CLR(tp->t_lflag, FLUSHO);
789	CLR(tp->t_state, TS_TTSTOP);
790 startoutput:
791	return (ttstart(tp));
792}
793
794/*
795 * Process input of a single character received on a tty.
796 *
797 * XXX - this is a hack, all drivers must changed to acquire the
798 *	 lock before calling linesw->l_rint()
799 */
800int
801ttyinput(int c, struct tty *tp)
802{
803	int error;
804
805	/*
806	 * Unless the receiver is enabled, drop incoming data.
807	 */
808	if (!ISSET(tp->t_cflag, CREAD))
809		return (0);
810
811	mutex_spin_enter(&tty_lock);
812	error = ttyinput_wlock(c, tp);
813	mutex_spin_exit(&tty_lock);
814
815	return (error);
816}
817
818/*
819 * Output a single character on a tty, doing output processing
820 * as needed (expanding tabs, newline processing, etc.).
821 * Returns < 0 if succeeds, otherwise returns char to resend.
822 * Must be recursive.
823 *
824 * Call with tty lock held.
825 */
826int
827ttyoutput(int c, struct tty *tp)
828{
829	long	oflag;
830	int	col, notout;
831
832	KASSERT(mutex_owned(&tty_lock));
833
834	oflag = tp->t_oflag;
835	if (!ISSET(oflag, OPOST)) {
836		tk_nout++;
837		tp->t_outcc++;
838		if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
839			return (c);
840		return (-1);
841	}
842	/*
843	 * Do tab expansion if OXTABS is set.  Special case if we do external
844	 * processing, we don't do the tab expansion because we'll probably
845	 * get it wrong.  If tab expansion needs to be done, let it happen
846	 * externally.
847	 */
848	CLR(c, ~TTY_CHARMASK);
849	if (c == '\t' &&
850	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
851		c = 8 - (tp->t_column & 7);
852		if (ISSET(tp->t_lflag, FLUSHO)) {
853			notout = 0;
854		} else {
855			notout = b_to_q("        ", c, &tp->t_outq);
856			c -= notout;
857			tk_nout += c;
858			tp->t_outcc += c;
859		}
860		tp->t_column += c;
861		return (notout ? '\t' : -1);
862	}
863	if (c == CEOT && ISSET(oflag, ONOEOT))
864		return (-1);
865
866	/*
867	 * Newline translation: if ONLCR is set,
868	 * translate newline into "\r\n".
869	 */
870	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
871		tk_nout++;
872		tp->t_outcc++;
873		if (!ISSET(tp->t_lflag, FLUSHO) && putc('\r', &tp->t_outq))
874			return (c);
875	}
876	/* If OCRNL is set, translate "\r" into "\n". */
877	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
878		c = '\n';
879	/* If ONOCR is set, don't transmit CRs when on column 0. */
880	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0)
881		return (-1);
882
883	tk_nout++;
884	tp->t_outcc++;
885	if (!ISSET(tp->t_lflag, FLUSHO) && putc(c, &tp->t_outq))
886		return (c);
887
888	col = tp->t_column;
889	switch (CCLASS(c)) {
890	case BACKSPACE:
891		if (col > 0)
892			--col;
893		break;
894	case CONTROL:
895		break;
896	case NEWLINE:
897		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
898			col = 0;
899		break;
900	case RETURN:
901		col = 0;
902		break;
903	case ORDINARY:
904		++col;
905		break;
906	case TAB:
907		col = (col + 8) & ~7;
908		break;
909	}
910	tp->t_column = col;
911	return (-1);
912}
913
914/*
915 * Ioctls for all tty devices.  Called after line-discipline specific ioctl
916 * has been called to do discipline-specific functions and/or reject any
917 * of these ioctl commands.
918 */
919/* ARGSUSED */
920int
921ttioctl(struct tty *tp, u_long cmd, void *data, int flag, struct lwp *l)
922{
923	extern struct tty *constty;	/* Temporary virtual console. */
924	struct proc *p = l ? l->l_proc : NULL;
925	struct linesw	*lp;
926	int		s, error;
927	struct pathbuf *pb;
928	struct nameidata nd;
929	char		infobuf[200];
930
931	/* If the ioctl involves modification, hang if in the background. */
932	switch (cmd) {
933	case  TIOCFLUSH:
934	case  TIOCDRAIN:
935	case  TIOCSBRK:
936	case  TIOCCBRK:
937	case  TIOCSTART:
938	case  TIOCSETA:
939	case  TIOCSETD:
940	case  TIOCSLINED:
941	case  TIOCSETAF:
942	case  TIOCSETAW:
943#ifdef notdef
944	case  TIOCSPGRP:
945	case  FIOSETOWN:
946#endif
947	case  TIOCSTAT:
948	case  TIOCSTI:
949	case  TIOCSWINSZ:
950	case  TIOCSQSIZE:
951	case  TIOCLBIC:
952	case  TIOCLBIS:
953	case  TIOCLSET:
954	case  TIOCSETC:
955	case OTIOCSETD:
956	case  TIOCSETN:
957	case  TIOCSETP:
958	case  TIOCSLTC:
959		mutex_spin_enter(&tty_lock);
960		while (isbackground(curproc, tp) &&
961		    p->p_pgrp->pg_jobc && (p->p_lflag & PL_PPWAIT) == 0 &&
962		    !sigismasked(l, SIGTTOU)) {
963			mutex_spin_exit(&tty_lock);
964
965			mutex_enter(proc_lock);
966			pgsignal(p->p_pgrp, SIGTTOU, 1);
967			mutex_exit(proc_lock);
968
969			mutex_spin_enter(&tty_lock);
970			error = ttypause(tp, hz);
971			if (error) {
972				mutex_spin_exit(&tty_lock);
973				return (error);
974			}
975		}
976		mutex_spin_exit(&tty_lock);
977		break;
978	}
979
980	switch (cmd) {			/* Process the ioctl. */
981	case FIOASYNC:			/* set/clear async i/o */
982		mutex_spin_enter(&tty_lock);
983		if (*(int *)data)
984			SET(tp->t_state, TS_ASYNC);
985		else
986			CLR(tp->t_state, TS_ASYNC);
987		mutex_spin_exit(&tty_lock);
988		break;
989	case FIONBIO:			/* set/clear non-blocking i/o */
990		break;			/* XXX: delete. */
991	case FIONREAD:			/* get # bytes to read */
992		mutex_spin_enter(&tty_lock);
993		*(int *)data = ttnread(tp);
994		mutex_spin_exit(&tty_lock);
995		break;
996	case FIONWRITE:			/* get # bytes to written & unsent */
997		mutex_spin_enter(&tty_lock);
998		*(int *)data = tp->t_outq.c_cc;
999		mutex_spin_exit(&tty_lock);
1000		break;
1001	case FIONSPACE:			/* get # bytes to written & unsent */
1002		mutex_spin_enter(&tty_lock);
1003		*(int *)data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1004		mutex_spin_exit(&tty_lock);
1005		break;
1006	case TIOCEXCL:			/* set exclusive use of tty */
1007		mutex_spin_enter(&tty_lock);
1008		SET(tp->t_state, TS_XCLUDE);
1009		mutex_spin_exit(&tty_lock);
1010		break;
1011	case TIOCFLUSH: {		/* flush buffers */
1012		int flags = *(int *)data;
1013
1014		if (flags == 0)
1015			flags = FREAD | FWRITE;
1016		else
1017			flags &= FREAD | FWRITE;
1018		mutex_spin_enter(&tty_lock);
1019		ttyflush(tp, flags);
1020		mutex_spin_exit(&tty_lock);
1021		break;
1022	}
1023	case TIOCCONS:			/* become virtual console */
1024		if (*(int *)data) {
1025			if (constty && constty != tp &&
1026			    ISSET(constty->t_state, TS_CARR_ON | TS_ISOPEN) ==
1027			    (TS_CARR_ON | TS_ISOPEN))
1028				return EBUSY;
1029
1030			pb = pathbuf_create("/dev/console");
1031			if (pb == NULL) {
1032				return ENOMEM;
1033			}
1034			NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, pb);
1035			if ((error = namei(&nd)) != 0) {
1036				pathbuf_destroy(pb);
1037				return error;
1038			}
1039			error = VOP_ACCESS(nd.ni_vp, VREAD, l->l_cred);
1040			vput(nd.ni_vp);
1041			pathbuf_destroy(pb);
1042			if (error)
1043				return error;
1044
1045			constty = tp;
1046		} else if (tp == constty)
1047			constty = NULL;
1048		break;
1049	case TIOCDRAIN:			/* wait till output drained */
1050		if ((error = ttywait(tp)) != 0)
1051			return (error);
1052		break;
1053	case TIOCGETA: {		/* get termios struct */
1054		struct termios *t = (struct termios *)data;
1055
1056		memcpy(t, &tp->t_termios, sizeof(struct termios));
1057		break;
1058	}
1059	case TIOCGETD:			/* get line discipline (old) */
1060		*(int *)data = tp->t_linesw->l_no;
1061		break;
1062	case TIOCGLINED:		/* get line discipline (new) */
1063		(void)strncpy((char *)data, tp->t_linesw->l_name,
1064		    TTLINEDNAMELEN - 1);
1065		break;
1066	case TIOCGWINSZ:		/* get window size */
1067		*(struct winsize *)data = tp->t_winsize;
1068		break;
1069	case TIOCGQSIZE:
1070		*(int *)data = tp->t_qsize;
1071		break;
1072	case FIOGETOWN:
1073		mutex_enter(proc_lock);
1074		if (tp->t_session != NULL && !isctty(p, tp)) {
1075			mutex_exit(proc_lock);
1076			return (ENOTTY);
1077		}
1078		*(int *)data = tp->t_pgrp ? -tp->t_pgrp->pg_id : 0;
1079		mutex_exit(proc_lock);
1080		break;
1081	case TIOCGPGRP:			/* get pgrp of tty */
1082		mutex_enter(proc_lock);
1083		if (!isctty(p, tp)) {
1084			mutex_exit(proc_lock);
1085			return (ENOTTY);
1086		}
1087		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PGID;
1088		mutex_exit(proc_lock);
1089		break;
1090	case TIOCGSID:			/* get sid of tty */
1091		mutex_enter(proc_lock);
1092		if (!isctty(p, tp)) {
1093			mutex_exit(proc_lock);
1094			return (ENOTTY);
1095		}
1096		*(int *)data = tp->t_session->s_sid;
1097		mutex_exit(proc_lock);
1098		break;
1099#ifdef TIOCHPCL
1100	case TIOCHPCL:			/* hang up on last close */
1101		mutex_spin_enter(&tty_lock);
1102		SET(tp->t_cflag, HUPCL);
1103		mutex_spin_exit(&tty_lock);
1104		break;
1105#endif
1106	case TIOCNXCL:			/* reset exclusive use of tty */
1107		mutex_spin_enter(&tty_lock);
1108		CLR(tp->t_state, TS_XCLUDE);
1109		mutex_spin_exit(&tty_lock);
1110		break;
1111	case TIOCOUTQ:			/* output queue size */
1112		*(int *)data = tp->t_outq.c_cc;
1113		break;
1114	case TIOCSETA:			/* set termios struct */
1115	case TIOCSETAW:			/* drain output, set */
1116	case TIOCSETAF: {		/* drn out, fls in, set */
1117		struct termios *t = (struct termios *)data;
1118
1119		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1120			if ((error = ttywait(tp)) != 0)
1121				return (error);
1122
1123			if (cmd == TIOCSETAF) {
1124				mutex_spin_enter(&tty_lock);
1125				ttyflush(tp, FREAD);
1126				mutex_spin_exit(&tty_lock);
1127			}
1128		}
1129
1130		s = spltty();
1131		/*
1132		 * XXXSMP - some drivers call back on us from t_param(), so
1133		 *	    don't take the tty spin lock here.
1134		 *	    require t_param() to unlock upon callback?
1135		 */
1136		/* wanted here: mutex_spin_enter(&tty_lock); */
1137		if (!ISSET(t->c_cflag, CIGNORE)) {
1138			/*
1139			 * Set device hardware.
1140			 */
1141			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1142				/* wanted here: mutex_spin_exit(&tty_lock); */
1143				splx(s);
1144				return (error);
1145			} else {
1146				tp->t_cflag = t->c_cflag;
1147				tp->t_ispeed = t->c_ispeed;
1148				tp->t_ospeed = t->c_ospeed;
1149				if (t->c_ospeed == 0)
1150					ttysig(tp, TTYSIG_LEADER, SIGHUP);
1151			}
1152			ttsetwater(tp);
1153		}
1154
1155		/* delayed lock acquiring */
1156		mutex_spin_enter(&tty_lock);
1157		if (cmd != TIOCSETAF) {
1158			if (ISSET(t->c_lflag, ICANON) !=
1159			    ISSET(tp->t_lflag, ICANON)) {
1160				if (ISSET(t->c_lflag, ICANON)) {
1161					SET(tp->t_lflag, PENDIN);
1162					ttwakeup(tp);
1163				} else {
1164					struct clist tq;
1165
1166					catq(&tp->t_rawq, &tp->t_canq);
1167					tq = tp->t_rawq;
1168					tp->t_rawq = tp->t_canq;
1169					tp->t_canq = tq;
1170					CLR(tp->t_lflag, PENDIN);
1171				}
1172			}
1173		}
1174		tp->t_iflag = t->c_iflag;
1175		tp->t_oflag = t->c_oflag;
1176		/*
1177		 * Make the EXTPROC bit read only.
1178		 */
1179		if (ISSET(tp->t_lflag, EXTPROC))
1180			SET(t->c_lflag, EXTPROC);
1181		else
1182			CLR(t->c_lflag, EXTPROC);
1183		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1184		memcpy(tp->t_cc, t->c_cc, sizeof(t->c_cc));
1185		mutex_spin_exit(&tty_lock);
1186		splx(s);
1187		break;
1188	}
1189	case TIOCSETD:			/* set line discipline (old) */
1190		lp = ttyldisc_lookup_bynum(*(int *)data);
1191		goto setldisc;
1192
1193	case TIOCSLINED: {		/* set line discipline (new) */
1194		char *name = (char *)data;
1195		dev_t device;
1196
1197		/* Null terminate to prevent buffer overflow */
1198		name[TTLINEDNAMELEN - 1] = '\0';
1199		lp = ttyldisc_lookup(name);
1200 setldisc:
1201		if (lp == NULL)
1202			return (ENXIO);
1203
1204		if (lp != tp->t_linesw) {
1205			device = tp->t_dev;
1206			s = spltty();
1207			(*tp->t_linesw->l_close)(tp, flag);
1208			error = (*lp->l_open)(device, tp);
1209			if (error) {
1210				(void)(*tp->t_linesw->l_open)(device, tp);
1211				splx(s);
1212				ttyldisc_release(lp);
1213				return (error);
1214			}
1215			ttyldisc_release(tp->t_linesw);
1216			tp->t_linesw = lp;
1217			splx(s);
1218		} else {
1219			/* Drop extra reference. */
1220			ttyldisc_release(lp);
1221		}
1222		break;
1223	}
1224	case TIOCSTART:			/* start output, like ^Q */
1225		mutex_spin_enter(&tty_lock);
1226		if (ISSET(tp->t_state, TS_TTSTOP) ||
1227		    ISSET(tp->t_lflag, FLUSHO)) {
1228			CLR(tp->t_lflag, FLUSHO);
1229			CLR(tp->t_state, TS_TTSTOP);
1230			ttstart(tp);
1231		}
1232		mutex_spin_exit(&tty_lock);
1233		break;
1234	case TIOCSTI:			/* simulate terminal input */
1235		if (kauth_authorize_device_tty(l->l_cred, KAUTH_DEVICE_TTY_STI,
1236		    tp) != 0) {
1237			if (!ISSET(flag, FREAD))
1238				return (EPERM);
1239			if (!isctty(p, tp))
1240				return (EACCES);
1241		}
1242		(*tp->t_linesw->l_rint)(*(u_char *)data, tp);
1243		break;
1244	case TIOCSTOP:			/* stop output, like ^S */
1245	{
1246		mutex_spin_enter(&tty_lock);
1247		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1248			SET(tp->t_state, TS_TTSTOP);
1249			cdev_stop(tp, 0);
1250		}
1251		mutex_spin_exit(&tty_lock);
1252		break;
1253	}
1254	case TIOCSCTTY:			/* become controlling tty */
1255		mutex_enter(proc_lock);
1256		mutex_spin_enter(&tty_lock);
1257
1258		/* Session ctty vnode pointer set in vnode layer. */
1259		if (!SESS_LEADER(p) ||
1260		    ((p->p_session->s_ttyvp || tp->t_session) &&
1261		    (tp->t_session != p->p_session))) {
1262			mutex_spin_exit(&tty_lock);
1263			mutex_exit(proc_lock);
1264			return (EPERM);
1265		}
1266
1267		/*
1268		 * `p_session' acquires a reference.
1269		 * But note that if `t_session' is set at this point,
1270		 * it must equal `p_session', in which case the session
1271		 * already has the correct reference count.
1272		 */
1273		if (tp->t_session == NULL) {
1274			proc_sesshold(p->p_session);
1275		}
1276		tp->t_session = p->p_session;
1277		tp->t_pgrp = p->p_pgrp;
1278		p->p_session->s_ttyp = tp;
1279		p->p_lflag |= PL_CONTROLT;
1280		mutex_spin_exit(&tty_lock);
1281		mutex_exit(proc_lock);
1282		break;
1283	case FIOSETOWN: {		/* set pgrp of tty */
1284		pid_t pgid = *(pid_t *)data;
1285		struct pgrp *pgrp;
1286
1287		mutex_enter(proc_lock);
1288		if (tp->t_session != NULL && !isctty(p, tp)) {
1289			mutex_exit(proc_lock);
1290			return (ENOTTY);
1291		}
1292
1293		if (pgid < 0) {
1294			pgrp = pgrp_find(-pgid);
1295			if (pgrp == NULL) {
1296				mutex_exit(proc_lock);
1297				return (EINVAL);
1298			}
1299		} else {
1300			struct proc *p1;
1301			p1 = proc_find(pgid);
1302			if (!p1) {
1303				mutex_exit(proc_lock);
1304				return (ESRCH);
1305			}
1306			pgrp = p1->p_pgrp;
1307		}
1308
1309		if (pgrp->pg_session != p->p_session) {
1310			mutex_exit(proc_lock);
1311			return (EPERM);
1312		}
1313		mutex_spin_enter(&tty_lock);
1314		tp->t_pgrp = pgrp;
1315		mutex_spin_exit(&tty_lock);
1316		mutex_exit(proc_lock);
1317		break;
1318	}
1319	case TIOCSPGRP: {		/* set pgrp of tty */
1320		struct pgrp *pgrp;
1321		pid_t pgid = *(pid_t *)data;
1322
1323		if (pgid == NO_PGID)
1324			return EINVAL;
1325
1326		mutex_enter(proc_lock);
1327		if (!isctty(p, tp)) {
1328			mutex_exit(proc_lock);
1329			return (ENOTTY);
1330		}
1331		pgrp = pgrp_find(pgid);
1332		if (pgrp == NULL || pgrp->pg_session != p->p_session) {
1333			mutex_exit(proc_lock);
1334			return (EPERM);
1335		}
1336		mutex_spin_enter(&tty_lock);
1337		tp->t_pgrp = pgrp;
1338		mutex_spin_exit(&tty_lock);
1339		mutex_exit(proc_lock);
1340		break;
1341	}
1342	case TIOCSTAT:			/* get load avg stats */
1343		mutex_enter(proc_lock);
1344		ttygetinfo(tp, 0, infobuf, sizeof(infobuf));
1345		mutex_exit(proc_lock);
1346
1347		mutex_spin_enter(&tty_lock);
1348		ttyputinfo(tp, infobuf);
1349		mutex_spin_exit(&tty_lock);
1350		break;
1351	case TIOCSWINSZ:		/* set window size */
1352		mutex_spin_enter(&tty_lock);
1353		if (memcmp((void *)&tp->t_winsize, data,
1354		    sizeof(struct winsize))) {
1355			tp->t_winsize = *(struct winsize *)data;
1356			ttysig(tp, TTYSIG_PG1, SIGWINCH);
1357		}
1358		mutex_spin_exit(&tty_lock);
1359		break;
1360	case TIOCSQSIZE:
1361		if ((error = tty_get_qsize(&s, *(int *)data)) == 0 &&
1362		    s != tp->t_qsize)
1363			error = tty_set_qsize(tp, s);
1364		return error;
1365	default:
1366		/* We may have to load the compat module for this. */
1367		for (;;) {
1368			rw_enter(&ttcompat_lock, RW_READER);
1369			if (ttcompatvec != NULL) {
1370				break;
1371			}
1372			rw_exit(&ttcompat_lock);
1373			(void)module_autoload("compat", MODULE_CLASS_ANY);
1374			if (ttcompatvec == NULL) {
1375				return EPASSTHROUGH;
1376			}
1377		}
1378		error = (*ttcompatvec)(tp, cmd, data, flag, l);
1379		rw_exit(&ttcompat_lock);
1380		return error;
1381	}
1382	return (0);
1383}
1384
1385int
1386ttpoll(struct tty *tp, int events, struct lwp *l)
1387{
1388	int	revents;
1389
1390	revents = 0;
1391	mutex_spin_enter(&tty_lock);
1392	if (events & (POLLIN | POLLRDNORM))
1393		if (ttnread(tp) > 0)
1394			revents |= events & (POLLIN | POLLRDNORM);
1395
1396	if (events & (POLLOUT | POLLWRNORM))
1397		if (tp->t_outq.c_cc <= tp->t_lowat)
1398			revents |= events & (POLLOUT | POLLWRNORM);
1399
1400	if (events & POLLHUP)
1401		if (!CONNECTED(tp))
1402			revents |= POLLHUP;
1403
1404	if (revents == 0) {
1405		if (events & (POLLIN | POLLHUP | POLLRDNORM))
1406			selrecord(l, &tp->t_rsel);
1407
1408		if (events & (POLLOUT | POLLWRNORM))
1409			selrecord(l, &tp->t_wsel);
1410	}
1411
1412	mutex_spin_exit(&tty_lock);
1413
1414	return (revents);
1415}
1416
1417static void
1418filt_ttyrdetach(struct knote *kn)
1419{
1420	struct tty	*tp;
1421
1422	tp = kn->kn_hook;
1423	mutex_spin_enter(&tty_lock);
1424	SLIST_REMOVE(&tp->t_rsel.sel_klist, kn, knote, kn_selnext);
1425	mutex_spin_exit(&tty_lock);
1426}
1427
1428static int
1429filt_ttyread(struct knote *kn, long hint)
1430{
1431	struct tty	*tp;
1432
1433	tp = kn->kn_hook;
1434	if ((hint & NOTE_SUBMIT) == 0)
1435		mutex_spin_enter(&tty_lock);
1436	kn->kn_data = ttnread(tp);
1437	if ((hint & NOTE_SUBMIT) == 0)
1438		mutex_spin_exit(&tty_lock);
1439	return (kn->kn_data > 0);
1440}
1441
1442static void
1443filt_ttywdetach(struct knote *kn)
1444{
1445	struct tty	*tp;
1446
1447	tp = kn->kn_hook;
1448	mutex_spin_enter(&tty_lock);
1449	SLIST_REMOVE(&tp->t_wsel.sel_klist, kn, knote, kn_selnext);
1450	mutex_spin_exit(&tty_lock);
1451}
1452
1453static int
1454filt_ttywrite(struct knote *kn, long hint)
1455{
1456	struct tty	*tp;
1457	int		canwrite;
1458
1459	tp = kn->kn_hook;
1460	if ((hint & NOTE_SUBMIT) == 0)
1461		mutex_spin_enter(&tty_lock);
1462	kn->kn_data = tp->t_outq.c_cn - tp->t_outq.c_cc;
1463	canwrite = (tp->t_outq.c_cc <= tp->t_lowat) && CONNECTED(tp);
1464	if ((hint & NOTE_SUBMIT) == 0)
1465		mutex_spin_exit(&tty_lock);
1466	return (canwrite);
1467}
1468
1469static const struct filterops ttyread_filtops =
1470	{ 1, NULL, filt_ttyrdetach, filt_ttyread };
1471static const struct filterops ttywrite_filtops =
1472	{ 1, NULL, filt_ttywdetach, filt_ttywrite };
1473
1474int
1475ttykqfilter(dev_t dev, struct knote *kn)
1476{
1477	struct tty	*tp;
1478	struct klist	*klist;
1479
1480	if ((tp = cdev_tty(dev)) == NULL)
1481		return (ENXIO);
1482
1483	switch (kn->kn_filter) {
1484	case EVFILT_READ:
1485		klist = &tp->t_rsel.sel_klist;
1486		kn->kn_fop = &ttyread_filtops;
1487		break;
1488	case EVFILT_WRITE:
1489		klist = &tp->t_wsel.sel_klist;
1490		kn->kn_fop = &ttywrite_filtops;
1491		break;
1492	default:
1493		return EINVAL;
1494	}
1495
1496	kn->kn_hook = tp;
1497
1498	mutex_spin_enter(&tty_lock);
1499	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1500	mutex_spin_exit(&tty_lock);
1501
1502	return (0);
1503}
1504
1505/*
1506 * Find the number of chars ready to be read from this tty.
1507 * Call with the tty lock held.
1508 */
1509static int
1510ttnread(struct tty *tp)
1511{
1512	int	nread;
1513
1514	KASSERT(mutex_owned(&tty_lock));
1515
1516	if (ISSET(tp->t_lflag, PENDIN))
1517		ttypend(tp);
1518	nread = tp->t_canq.c_cc;
1519	if (!ISSET(tp->t_lflag, ICANON)) {
1520		nread += tp->t_rawq.c_cc;
1521		if (nread < tp->t_cc[VMIN] && !tp->t_cc[VTIME])
1522			nread = 0;
1523	}
1524	return (nread);
1525}
1526
1527/*
1528 * Wait for output to drain.
1529 */
1530int
1531ttywait(struct tty *tp)
1532{
1533	int	error;
1534
1535	error = 0;
1536
1537	mutex_spin_enter(&tty_lock);
1538	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1539	    CONNECTED(tp) && tp->t_oproc) {
1540		(*tp->t_oproc)(tp);
1541		error = ttysleep(tp, &tp->t_outcv, true, 0);
1542		if (error)
1543			break;
1544	}
1545	mutex_spin_exit(&tty_lock);
1546
1547	return (error);
1548}
1549
1550/*
1551 * Flush if successfully wait.
1552 */
1553int
1554ttywflush(struct tty *tp)
1555{
1556	int	error;
1557
1558	if ((error = ttywait(tp)) == 0) {
1559		mutex_spin_enter(&tty_lock);
1560		ttyflush(tp, FREAD);
1561		mutex_spin_exit(&tty_lock);
1562	}
1563	return (error);
1564}
1565
1566/*
1567 * Flush tty read and/or write queues, notifying anyone waiting.
1568 * Call with the tty lock held.
1569 */
1570void
1571ttyflush(struct tty *tp, int rw)
1572{
1573
1574	KASSERT(mutex_owned(&tty_lock));
1575
1576	if (rw & FREAD) {
1577		FLUSHQ(&tp->t_canq);
1578		FLUSHQ(&tp->t_rawq);
1579		tp->t_rocount = 0;
1580		tp->t_rocol = 0;
1581		CLR(tp->t_state, TS_LOCAL);
1582		ttwakeup(tp);
1583	}
1584	if (rw & FWRITE) {
1585		CLR(tp->t_state, TS_TTSTOP);
1586		cdev_stop(tp, rw);
1587		FLUSHQ(&tp->t_outq);
1588		cv_broadcast(&tp->t_outcv);
1589		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
1590	}
1591}
1592
1593/*
1594 * Copy in the default termios characters.
1595 */
1596void
1597ttychars(struct tty *tp)
1598{
1599
1600	memcpy(tp->t_cc, ttydefchars, sizeof(ttydefchars));
1601}
1602
1603/*
1604 * Send stop character on input overflow.
1605 * Call with the tty lock held.
1606 */
1607static void
1608ttyblock(struct tty *tp)
1609{
1610	int	total;
1611
1612	KASSERT(mutex_owned(&tty_lock));
1613
1614	total = tp->t_rawq.c_cc + tp->t_canq.c_cc;
1615	if (tp->t_rawq.c_cc > TTYHOG) {
1616		ttyflush(tp, FREAD | FWRITE);
1617		CLR(tp->t_state, TS_TBLOCK);
1618	}
1619	/*
1620	 * Block further input iff: current input > threshold
1621	 * AND input is available to user program.
1622	 */
1623	if (total >= TTYHOG / 2 &&
1624	    !ISSET(tp->t_state, TS_TBLOCK) &&
1625	    (!ISSET(tp->t_lflag, ICANON) || tp->t_canq.c_cc > 0)) {
1626		if (ISSET(tp->t_iflag, IXOFF) &&
1627		    tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1628		    putc(tp->t_cc[VSTOP], &tp->t_outq) == 0) {
1629			SET(tp->t_state, TS_TBLOCK);
1630			ttstart(tp);
1631		}
1632		/* Try to block remote output via hardware flow control. */
1633		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1634		    (*tp->t_hwiflow)(tp, 1) != 0)
1635			SET(tp->t_state, TS_TBLOCK);
1636	}
1637}
1638
1639/*
1640 * Delayed line discipline output
1641 */
1642void
1643ttrstrt(void *tp_arg)
1644{
1645	struct tty	*tp;
1646
1647#ifdef DIAGNOSTIC
1648	if (tp_arg == NULL)
1649		panic("ttrstrt");
1650#endif
1651	tp = tp_arg;
1652	mutex_spin_enter(&tty_lock);
1653
1654	CLR(tp->t_state, TS_TIMEOUT);
1655	ttstart(tp); /* XXX - Shouldn't this be tp->l_start(tp)? */
1656
1657	mutex_spin_exit(&tty_lock);
1658}
1659
1660/*
1661 * start a line discipline
1662 * Always call with tty lock held?
1663 */
1664int
1665ttstart(struct tty *tp)
1666{
1667
1668	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1669		(*tp->t_oproc)(tp);
1670	return (0);
1671}
1672
1673/*
1674 * "close" a line discipline
1675 */
1676int
1677ttylclose(struct tty *tp, int flag)
1678{
1679
1680	if (flag & FNONBLOCK) {
1681		mutex_spin_enter(&tty_lock);
1682		ttyflush(tp, FREAD | FWRITE);
1683		mutex_spin_exit(&tty_lock);
1684	} else
1685		ttywflush(tp);
1686	return (0);
1687}
1688
1689/*
1690 * Handle modem control transition on a tty.
1691 * Flag indicates new state of carrier.
1692 * Returns 0 if the line should be turned off, otherwise 1.
1693 */
1694int
1695ttymodem(struct tty *tp, int flag)
1696{
1697
1698	mutex_spin_enter(&tty_lock);
1699	if (flag == 0) {
1700		if (ISSET(tp->t_state, TS_CARR_ON)) {
1701			/*
1702			 * Lost carrier.
1703			 */
1704			CLR(tp->t_state, TS_CARR_ON);
1705			if (ISSET(tp->t_state, TS_ISOPEN) && !CONNECTED(tp)) {
1706				ttysig(tp, TTYSIG_LEADER, SIGHUP);
1707				ttyflush(tp, FREAD | FWRITE);
1708				mutex_spin_exit(&tty_lock);
1709				return (0);
1710			}
1711		}
1712	} else {
1713		if (!ISSET(tp->t_state, TS_CARR_ON)) {
1714			/*
1715			 * Carrier now on.
1716			 */
1717			SET(tp->t_state, TS_CARR_ON);
1718			ttwakeup(tp);
1719		}
1720	}
1721	mutex_spin_exit(&tty_lock);
1722
1723	return (1);
1724}
1725
1726/*
1727 * Default modem control routine (for other line disciplines).
1728 * Return argument flag, to turn off device on carrier drop.
1729 */
1730int
1731nullmodem(struct tty *tp, int flag)
1732{
1733
1734	mutex_spin_enter(&tty_lock);
1735	if (flag)
1736		SET(tp->t_state, TS_CARR_ON);
1737	else {
1738		CLR(tp->t_state, TS_CARR_ON);
1739		if (!CONNECTED(tp)) {
1740			ttysig(tp, TTYSIG_LEADER, SIGHUP);
1741			mutex_spin_exit(&tty_lock);
1742			return (0);
1743		}
1744	}
1745	mutex_spin_exit(&tty_lock);
1746
1747	return (1);
1748}
1749
1750/*
1751 * Reinput pending characters after state switch.
1752 */
1753void
1754ttypend(struct tty *tp)
1755{
1756	struct clist	tq;
1757	int		c;
1758
1759	KASSERT(mutex_owned(&tty_lock));
1760
1761	CLR(tp->t_lflag, PENDIN);
1762	SET(tp->t_state, TS_TYPEN);
1763	tq = tp->t_rawq;
1764	tp->t_rawq.c_cc = 0;
1765	tp->t_rawq.c_cf = tp->t_rawq.c_cl = 0;
1766	while ((c = getc(&tq)) >= 0)
1767		ttyinput_wlock(c, tp);
1768	CLR(tp->t_state, TS_TYPEN);
1769}
1770
1771/*
1772 * Process a read call on a tty device.
1773 */
1774int
1775ttread(struct tty *tp, struct uio *uio, int flag)
1776{
1777	struct clist	*qp;
1778	u_char		*cc;
1779	struct proc	*p;
1780	int		c, first, error, has_stime, last_cc;
1781	long		lflag, slp;
1782	struct timeval	now, stime;
1783
1784	if (uio->uio_resid == 0)
1785		return 0;
1786
1787	stime.tv_usec = 0;	/* XXX gcc */
1788	stime.tv_sec = 0;	/* XXX gcc */
1789
1790	cc = tp->t_cc;
1791	p = curproc;
1792	error = 0;
1793	has_stime = 0;
1794	last_cc = 0;
1795	slp = 0;
1796
1797 loop:
1798	mutex_spin_enter(&tty_lock);
1799	lflag = tp->t_lflag;
1800	/*
1801	 * take pending input first
1802	 */
1803	if (ISSET(lflag, PENDIN))
1804		ttypend(tp);
1805
1806	/*
1807	 * Hang process if it's in the background.
1808	 */
1809	if (isbackground(p, tp)) {
1810		if (sigismasked(curlwp, SIGTTIN) ||
1811		    p->p_lflag & PL_PPWAIT || p->p_pgrp->pg_jobc == 0) {
1812			mutex_spin_exit(&tty_lock);
1813			return (EIO);
1814		}
1815		mutex_spin_exit(&tty_lock);
1816
1817		mutex_enter(proc_lock);
1818		pgsignal(p->p_pgrp, SIGTTIN, 1);
1819		mutex_exit(proc_lock);
1820
1821		mutex_spin_enter(&tty_lock);
1822		error = ttypause(tp, hz);
1823		mutex_spin_exit(&tty_lock);
1824		if (error)
1825			return (error);
1826		goto loop;
1827	}
1828
1829	if (!ISSET(lflag, ICANON)) {
1830		int m = cc[VMIN];
1831		long t = cc[VTIME];
1832
1833		qp = &tp->t_rawq;
1834		/*
1835		 * Check each of the four combinations.
1836		 * (m > 0 && t == 0) is the normal read case.
1837		 * It should be fairly efficient, so we check that and its
1838		 * companion case (m == 0 && t == 0) first.
1839		 * For the other two cases, we compute the target sleep time
1840		 * into slp.
1841		 */
1842		if (t == 0) {
1843			if (qp->c_cc < m)
1844				goto sleep;
1845			goto read;
1846		}
1847		t *= hz;		/* time in deca-ticks */
1848/*
1849 * Time difference in deca-ticks, split division to avoid numeric overflow.
1850 * Ok for hz < ~200kHz
1851 */
1852#define	diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 10 * hz + \
1853			 ((t1).tv_usec - (t2).tv_usec) / 100 * hz / 1000)
1854		if (m > 0) {
1855			if (qp->c_cc <= 0)
1856				goto sleep;
1857			if (qp->c_cc >= m)
1858				goto read;
1859			if (!has_stime) {
1860				/* first character, start timer */
1861				has_stime = 1;
1862				getmicrotime(&stime);
1863				slp = t;
1864			} else if (qp->c_cc > last_cc) {
1865				/* got a character, restart timer */
1866				getmicrotime(&stime);
1867				slp = t;
1868			} else {
1869				/* nothing, check expiration */
1870				getmicrotime(&now);
1871				slp = t - diff(now, stime);
1872			}
1873		} else {	/* m == 0 */
1874			if (qp->c_cc > 0)
1875				goto read;
1876			if (!has_stime) {
1877				has_stime = 1;
1878				getmicrotime(&stime);
1879				slp = t;
1880			} else {
1881				getmicrotime(&now);
1882				slp = t - diff(now, stime);
1883			}
1884		}
1885		last_cc = qp->c_cc;
1886#undef diff
1887		if (slp > 0) {
1888			/*
1889			 * Convert deca-ticks back to ticks.
1890			 * Rounding down may make us wake up just short
1891			 * of the target, so we round up.
1892			 * Maybe we should do 'slp/10 + 1' because the
1893			 * first tick maybe almost immediate.
1894			 * However it is more useful for a program that sets
1895			 * VTIME=10 to wakeup every second not every 1.01
1896			 * seconds (if hz=100).
1897			 */
1898			slp = (slp + 9)/ 10;
1899			goto sleep;
1900		}
1901	} else if ((qp = &tp->t_canq)->c_cc <= 0) {
1902		int	carrier;
1903
1904 sleep:
1905		/*
1906		 * If there is no input, sleep on rawq
1907		 * awaiting hardware receipt and notification.
1908		 * If we have data, we don't need to check for carrier.
1909		 */
1910		carrier = CONNECTED(tp);
1911		if (!carrier && ISSET(tp->t_state, TS_ISOPEN)) {
1912			mutex_spin_exit(&tty_lock);
1913			return (0);	/* EOF */
1914		}
1915		if (!has_stime || slp <= 0) {
1916			if (flag & IO_NDELAY) {
1917				mutex_spin_exit(&tty_lock);
1918				return (EWOULDBLOCK);
1919			}
1920		}
1921		error = ttysleep(tp, &tp->t_rawcv, true, slp);
1922		mutex_spin_exit(&tty_lock);
1923		/* VMIN == 0: any quantity read satisfies */
1924		if (cc[VMIN] == 0 && error == EWOULDBLOCK)
1925			return (0);
1926		if (error && error != EWOULDBLOCK)
1927			return (error);
1928		goto loop;
1929	}
1930 read:
1931	mutex_spin_exit(&tty_lock);
1932
1933	/*
1934	 * Input present, check for input mapping and processing.
1935	 */
1936	first = 1;
1937	while ((c = getc(qp)) >= 0) {
1938		/*
1939		 * delayed suspend (^Y)
1940		 */
1941		if (CCEQ(cc[VDSUSP], c) &&
1942		    ISSET(lflag, IEXTEN|ISIG) == (IEXTEN|ISIG)) {
1943			mutex_spin_enter(&tty_lock);
1944			ttysig(tp, TTYSIG_PG1, SIGTSTP);
1945			if (first) {
1946				error = ttypause(tp, hz);
1947				mutex_spin_exit(&tty_lock);
1948				if (error)
1949					break;
1950				goto loop;
1951			} else
1952				mutex_spin_exit(&tty_lock);
1953			break;
1954		}
1955		/*
1956		 * Interpret EOF only in canonical mode.
1957		 */
1958		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1959			break;
1960		/*
1961		 * Give user character.
1962		 */
1963 		error = ureadc(c, uio);
1964		if (error)
1965			break;
1966 		if (uio->uio_resid == 0)
1967			break;
1968		/*
1969		 * In canonical mode check for a "break character"
1970		 * marking the end of a "line of input".
1971		 */
1972		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1973			break;
1974		first = 0;
1975	}
1976	/*
1977	 * Look to unblock output now that (presumably)
1978	 * the input queue has gone down.
1979	 */
1980	mutex_spin_enter(&tty_lock);
1981	if (ISSET(tp->t_state, TS_TBLOCK) && tp->t_rawq.c_cc < TTYHOG / 5) {
1982		if (ISSET(tp->t_iflag, IXOFF) &&
1983		    cc[VSTART] != _POSIX_VDISABLE &&
1984		    putc(cc[VSTART], &tp->t_outq) == 0) {
1985			CLR(tp->t_state, TS_TBLOCK);
1986			ttstart(tp);
1987		}
1988		/* Try to unblock remote output via hardware flow control. */
1989		if (ISSET(tp->t_cflag, CHWFLOW) && tp->t_hwiflow &&
1990		    (*tp->t_hwiflow)(tp, 0) != 0)
1991			CLR(tp->t_state, TS_TBLOCK);
1992	}
1993	mutex_spin_exit(&tty_lock);
1994
1995	return (error);
1996}
1997
1998/*
1999 * Check the output queue on tp for space for a kernel message (from uprintf
2000 * or tprintf).  Allow some space over the normal hiwater mark so we don't
2001 * lose messages due to normal flow control, but don't let the tty run amok.
2002 * Sleeps here are not interruptible, but we return prematurely if new signals
2003 * arrive.
2004 * Call with tty lock held.
2005 */
2006static int
2007ttycheckoutq_wlock(struct tty *tp, int wait)
2008{
2009	int	hiwat, error;
2010
2011	KASSERT(mutex_owned(&tty_lock));
2012
2013	hiwat = tp->t_hiwat;
2014	if (tp->t_outq.c_cc > hiwat + 200)
2015		while (tp->t_outq.c_cc > hiwat) {
2016			ttstart(tp);
2017			if (wait == 0)
2018				return (0);
2019			error = ttysleep(tp, &tp->t_outcv, true, hz);
2020			if (error == EINTR)
2021				wait = 0;
2022		}
2023
2024	return (1);
2025}
2026
2027int
2028ttycheckoutq(struct tty *tp, int wait)
2029{
2030	int	r;
2031
2032	mutex_spin_enter(&tty_lock);
2033	r = ttycheckoutq_wlock(tp, wait);
2034	mutex_spin_exit(&tty_lock);
2035
2036	return (r);
2037}
2038
2039/*
2040 * Process a write call on a tty device.
2041 */
2042int
2043ttwrite(struct tty *tp, struct uio *uio, int flag)
2044{
2045	u_char		*cp;
2046	struct proc	*p;
2047	int		cc, ce, i, hiwat, error;
2048	u_char		obuf[OBUFSIZ];
2049
2050	cp = NULL;
2051	hiwat = tp->t_hiwat;
2052	error = 0;
2053	cc = 0;
2054 loop:
2055	mutex_spin_enter(&tty_lock);
2056	if (!CONNECTED(tp)) {
2057		if (ISSET(tp->t_state, TS_ISOPEN)) {
2058			mutex_spin_exit(&tty_lock);
2059			return (EIO);
2060		} else if (flag & IO_NDELAY) {
2061			mutex_spin_exit(&tty_lock);
2062			error = EWOULDBLOCK;
2063			goto out;
2064		} else {
2065			/* Sleep awaiting carrier. */
2066			error = ttysleep(tp, &tp->t_rawcv, true, 0);
2067			mutex_spin_exit(&tty_lock);
2068			if (error)
2069				goto out;
2070			goto loop;
2071		}
2072	}
2073
2074	/*
2075	 * Hang the process if it's in the background.
2076	 */
2077	p = curproc;
2078	if (isbackground(p, tp) &&
2079	    ISSET(tp->t_lflag, TOSTOP) && (p->p_lflag & PL_PPWAIT) == 0 &&
2080	    !sigismasked(curlwp, SIGTTOU)) {
2081		if (p->p_pgrp->pg_jobc == 0) {
2082			error = EIO;
2083			mutex_spin_exit(&tty_lock);
2084			goto out;
2085		}
2086		mutex_spin_exit(&tty_lock);
2087
2088		mutex_enter(proc_lock);
2089		pgsignal(p->p_pgrp, SIGTTOU, 1);
2090		mutex_exit(proc_lock);
2091
2092		mutex_spin_enter(&tty_lock);
2093		error = ttypause(tp, hz);
2094		mutex_spin_exit(&tty_lock);
2095		if (error)
2096			goto out;
2097		goto loop;
2098	}
2099	mutex_spin_exit(&tty_lock);
2100
2101	/*
2102	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2103	 * output translation.  Keep track of high water mark, sleep on
2104	 * overflow awaiting device aid in acquiring new space.
2105	 */
2106	while (uio->uio_resid > 0 || cc > 0) {
2107		if (ISSET(tp->t_lflag, FLUSHO)) {
2108			uio->uio_resid = 0;
2109			return (0);
2110		}
2111		if (tp->t_outq.c_cc > hiwat)
2112			goto ovhiwat;
2113		/*
2114		 * Grab a hunk of data from the user, unless we have some
2115		 * leftover from last time.
2116		 */
2117		if (cc == 0) {
2118			cc = min(uio->uio_resid, OBUFSIZ);
2119			cp = obuf;
2120			error = uiomove(cp, cc, uio);
2121			if (error) {
2122				cc = 0;
2123				goto out;
2124			}
2125		}
2126		/*
2127		 * If nothing fancy need be done, grab those characters we
2128		 * can handle without any of ttyoutput's processing and
2129		 * just transfer them to the output q.  For those chars
2130		 * which require special processing (as indicated by the
2131		 * bits in char_type), call ttyoutput.  After processing
2132		 * a hunk of data, look for FLUSHO so ^O's will take effect
2133		 * immediately.
2134		 */
2135		mutex_spin_enter(&tty_lock);
2136		while (cc > 0) {
2137			if (!ISSET(tp->t_oflag, OPOST))
2138				ce = cc;
2139			else {
2140				ce = cc - scanc((u_int)cc, cp, char_type,
2141				    CCLASSMASK);
2142				/*
2143				 * If ce is zero, then we're processing
2144				 * a special character through ttyoutput.
2145				 */
2146				if (ce == 0) {
2147					tp->t_rocount = 0;
2148					if (ttyoutput(*cp, tp) >= 0) {
2149						/* out of space */
2150						mutex_spin_exit(&tty_lock);
2151						goto overfull;
2152					}
2153					cp++;
2154					cc--;
2155					if (ISSET(tp->t_lflag, FLUSHO) ||
2156					    tp->t_outq.c_cc > hiwat) {
2157						mutex_spin_exit(&tty_lock);
2158						goto ovhiwat;
2159					}
2160					continue;
2161				}
2162			}
2163			/*
2164			 * A bunch of normal characters have been found.
2165			 * Transfer them en masse to the output queue and
2166			 * continue processing at the top of the loop.
2167			 * If there are any further characters in this
2168			 * <= OBUFSIZ chunk, the first should be a character
2169			 * requiring special handling by ttyoutput.
2170			 */
2171			tp->t_rocount = 0;
2172			i = b_to_q(cp, ce, &tp->t_outq);
2173			ce -= i;
2174			tp->t_column += ce;
2175			cp += ce, cc -= ce, tk_nout += ce;
2176			tp->t_outcc += ce;
2177			if (i > 0) {
2178				/* out of space */
2179				mutex_spin_exit(&tty_lock);
2180				goto overfull;
2181			}
2182			if (ISSET(tp->t_lflag, FLUSHO) ||
2183			    tp->t_outq.c_cc > hiwat)
2184				break;
2185		}
2186		ttstart(tp);
2187		mutex_spin_exit(&tty_lock);
2188	}
2189
2190 out:
2191	/*
2192	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2193	 * offset and iov pointers have moved forward, but it doesn't matter
2194	 * (the call will either return short or restart with a new uio).
2195	 */
2196	uio->uio_resid += cc;
2197	return (error);
2198
2199 overfull:
2200	/*
2201	 * Since we are using ring buffers, if we can't insert any more into
2202	 * the output queue, we can assume the ring is full and that someone
2203	 * forgot to set the high water mark correctly.  We set it and then
2204	 * proceed as normal.
2205	 */
2206	hiwat = tp->t_outq.c_cc - 1;
2207
2208 ovhiwat:
2209	mutex_spin_enter(&tty_lock);
2210	ttstart(tp);
2211	/*
2212	 * This can only occur if FLUSHO is set in t_lflag,
2213	 * or if ttstart/oproc is synchronous (or very fast).
2214	 */
2215	if (tp->t_outq.c_cc <= hiwat) {
2216		mutex_spin_exit(&tty_lock);
2217		goto loop;
2218	}
2219	if (flag & IO_NDELAY) {
2220		mutex_spin_exit(&tty_lock);
2221		error = EWOULDBLOCK;
2222		goto out;
2223	}
2224	error = ttysleep(tp, &tp->t_outcv, true, 0);
2225	mutex_spin_exit(&tty_lock);
2226	if (error)
2227		goto out;
2228	goto loop;
2229}
2230
2231/*
2232 * Try to pull more output from the producer.  Return non-zero if
2233 * there is output ready to be sent.
2234 */
2235bool
2236ttypull(struct tty *tp)
2237{
2238
2239	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2240
2241	if (tp->t_outq.c_cc <= tp->t_lowat) {
2242		cv_broadcast(&tp->t_outcv);
2243		selnotify(&tp->t_wsel, 0, NOTE_SUBMIT);
2244	}
2245	return tp->t_outq.c_cc != 0;
2246}
2247
2248/*
2249 * Rubout one character from the rawq of tp
2250 * as cleanly as possible.
2251 * Called with tty lock held.
2252 */
2253void
2254ttyrub(int c, struct tty *tp)
2255{
2256	u_char	*cp;
2257	int	savecol, tabc;
2258
2259	KASSERT(mutex_owned(&tty_lock));
2260
2261	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2262		return;
2263	CLR(tp->t_lflag, FLUSHO);
2264	if (ISSET(tp->t_lflag, ECHOE)) {
2265		if (tp->t_rocount == 0) {
2266			/*
2267			 * Screwed by ttwrite; retype
2268			 */
2269			ttyretype(tp);
2270			return;
2271		}
2272		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2273			ttyrubo(tp, 2);
2274		else {
2275			CLR(c, ~TTY_CHARMASK);
2276			switch (CCLASS(c)) {
2277			case ORDINARY:
2278				ttyrubo(tp, 1);
2279				break;
2280			case BACKSPACE:
2281			case CONTROL:
2282			case NEWLINE:
2283			case RETURN:
2284			case VTAB:
2285				if (ISSET(tp->t_lflag, ECHOCTL))
2286					ttyrubo(tp, 2);
2287				break;
2288			case TAB:
2289				if (tp->t_rocount < tp->t_rawq.c_cc) {
2290					ttyretype(tp);
2291					return;
2292				}
2293				savecol = tp->t_column;
2294				SET(tp->t_state, TS_CNTTB);
2295				SET(tp->t_lflag, FLUSHO);
2296				tp->t_column = tp->t_rocol;
2297				for (cp = firstc(&tp->t_rawq, &tabc); cp;
2298				    cp = nextc(&tp->t_rawq, cp, &tabc))
2299					ttyecho(tabc, tp);
2300				CLR(tp->t_lflag, FLUSHO);
2301				CLR(tp->t_state, TS_CNTTB);
2302
2303				/* savecol will now be length of the tab. */
2304				savecol -= tp->t_column;
2305				tp->t_column += savecol;
2306				if (savecol > 8)
2307					savecol = 8;	/* overflow screw */
2308				while (--savecol >= 0)
2309					(void)ttyoutput('\b', tp);
2310				break;
2311			default:			/* XXX */
2312				(void)printf("ttyrub: would panic c = %d, "
2313				    "val = %d\n", c, CCLASS(c));
2314			}
2315		}
2316	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2317		if (!ISSET(tp->t_state, TS_ERASE)) {
2318			SET(tp->t_state, TS_ERASE);
2319			(void)ttyoutput('\\', tp);
2320		}
2321		ttyecho(c, tp);
2322	} else
2323		ttyecho(tp->t_cc[VERASE], tp);
2324	--tp->t_rocount;
2325}
2326
2327/*
2328 * Back over cnt characters, erasing them.
2329 * Called with tty lock held.
2330 */
2331static void
2332ttyrubo(struct tty *tp, int cnt)
2333{
2334
2335	KASSERT(mutex_owned(&tty_lock));
2336
2337	while (cnt-- > 0) {
2338		(void)ttyoutput('\b', tp);
2339		(void)ttyoutput(' ', tp);
2340		(void)ttyoutput('\b', tp);
2341	}
2342}
2343
2344/*
2345 * ttyretype --
2346 *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2347 *	been checked.
2348 *
2349 * Called with tty lock held.
2350 */
2351void
2352ttyretype(struct tty *tp)
2353{
2354	u_char	*cp;
2355	int	c;
2356
2357	KASSERT(mutex_owned(&tty_lock));
2358
2359	/* Echo the reprint character. */
2360	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2361		ttyecho(tp->t_cc[VREPRINT], tp);
2362
2363	(void)ttyoutput('\n', tp);
2364
2365	for (cp = firstc(&tp->t_canq, &c); cp; cp = nextc(&tp->t_canq, cp, &c))
2366		ttyecho(c, tp);
2367	for (cp = firstc(&tp->t_rawq, &c); cp; cp = nextc(&tp->t_rawq, cp, &c))
2368		ttyecho(c, tp);
2369	CLR(tp->t_state, TS_ERASE);
2370
2371	tp->t_rocount = tp->t_rawq.c_cc;
2372	tp->t_rocol = 0;
2373}
2374
2375/*
2376 * Echo a typed character to the terminal.
2377 * Called with tty lock held.
2378 */
2379static void
2380ttyecho(int c, struct tty *tp)
2381{
2382
2383	KASSERT(mutex_owned(&tty_lock));
2384
2385	if (!ISSET(tp->t_state, TS_CNTTB))
2386		CLR(tp->t_lflag, FLUSHO);
2387	if ((!ISSET(tp->t_lflag, ECHO) &&
2388	    (!ISSET(tp->t_lflag, ECHONL) || c != '\n')) ||
2389	    ISSET(tp->t_lflag, EXTPROC))
2390		return;
2391	if (((ISSET(tp->t_lflag, ECHOCTL) &&
2392	    (ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n')) ||
2393	    ISSET(c, TTY_CHARMASK) == 0177)) {
2394		(void)ttyoutput('^', tp);
2395		CLR(c, ~TTY_CHARMASK);
2396		if (c == 0177)
2397			c = '?';
2398		else
2399			c += 'A' - 1;
2400	}
2401	(void)ttyoutput(c, tp);
2402}
2403
2404/*
2405 * Wake up any readers on a tty.
2406 * Called with tty lock held.
2407 */
2408void
2409ttwakeup(struct tty *tp)
2410{
2411
2412	KASSERT(mutex_owned(&tty_lock));
2413
2414	selnotify(&tp->t_rsel, 0, NOTE_SUBMIT);
2415	if (ISSET(tp->t_state, TS_ASYNC))
2416		ttysig(tp, TTYSIG_PG2, SIGIO);
2417	cv_broadcast(&tp->t_rawcv);
2418}
2419
2420/*
2421 * Look up a code for a specified speed in a conversion table;
2422 * used by drivers to map software speed values to hardware parameters.
2423 */
2424int
2425ttspeedtab(int speed, const struct speedtab *table)
2426{
2427
2428	for (; table->sp_speed != -1; table++)
2429		if (table->sp_speed == speed)
2430			return (table->sp_code);
2431	return (-1);
2432}
2433
2434/*
2435 * Set tty hi and low water marks.
2436 *
2437 * Try to arrange the dynamics so there's about one second
2438 * from hi to low water.
2439 */
2440void
2441ttsetwater(struct tty *tp)
2442{
2443	int	cps, x;
2444
2445	/* XXX not yet KASSERT(mutex_owned(&tty_lock)); */
2446
2447#define	CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2448
2449	cps = tp->t_ospeed / 10;
2450	tp->t_lowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2451	x += cps;
2452	x = CLAMP(x, TTMAXHIWAT, TTMINHIWAT);
2453	tp->t_hiwat = roundup(x, TTROUND);
2454#undef	CLAMP
2455}
2456
2457/*
2458 * Prepare report on state of foreground process group.
2459 * Call with proc_lock held.
2460 */
2461void
2462ttygetinfo(struct tty *tp, int fromsig, char *buf, size_t bufsz)
2463{
2464	struct lwp	*l;
2465	struct proc	*p, *pick = NULL;
2466	struct timeval	utime, stime;
2467	int		tmp;
2468	fixpt_t		pctcpu = 0;
2469	const char	*msg;
2470	char		lmsg[100];
2471	long		rss;
2472
2473	KASSERT(mutex_owned(proc_lock));
2474
2475	*buf = '\0';
2476
2477	if (tp->t_session == NULL)
2478		msg = "not a controlling terminal\n";
2479	else if (tp->t_pgrp == NULL)
2480		msg = "no foreground process group\n";
2481	else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL)
2482		msg = "empty foreground process group\n";
2483	else {
2484		/* Pick interesting process. */
2485		for (; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2486			struct proc *oldpick;
2487
2488			if (pick == NULL) {
2489				pick = p;
2490				continue;
2491			}
2492			if (pick->p_lock < p->p_lock) {
2493				mutex_enter(pick->p_lock);
2494				mutex_enter(p->p_lock);
2495			} else if (pick->p_lock > p->p_lock) {
2496				mutex_enter(p->p_lock);
2497				mutex_enter(pick->p_lock);
2498			} else
2499				mutex_enter(p->p_lock);
2500			oldpick = pick;
2501			if (proc_compare_wrapper(pick, p))
2502				pick = p;
2503			mutex_exit(p->p_lock);
2504			if (p->p_lock != oldpick->p_lock)
2505				mutex_exit(oldpick->p_lock);
2506		}
2507		if (fromsig &&
2508		    (SIGACTION_PS(pick->p_sigacts, SIGINFO).sa_flags &
2509		    SA_NOKERNINFO))
2510			return;
2511		msg = NULL;
2512	}
2513
2514	/* Print load average. */
2515	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2516	snprintf(lmsg, sizeof(lmsg), "load: %d.%02d ", tmp / 100, tmp % 100);
2517	strlcat(buf, lmsg, bufsz);
2518
2519	if (pick == NULL) {
2520		strlcat(buf, msg, bufsz);
2521		return;
2522	}
2523
2524	snprintf(lmsg, sizeof(lmsg), " cmd: %s %d [", pick->p_comm,
2525	    pick->p_pid);
2526	strlcat(buf, lmsg, bufsz);
2527
2528	mutex_enter(pick->p_lock);
2529	LIST_FOREACH(l, &pick->p_lwps, l_sibling) {
2530		const char *lp;
2531		lwp_lock(l);
2532#ifdef LWP_PC
2533#define FMT_RUN "%#"PRIxVADDR
2534#define VAL_RUNNING (vaddr_t)LWP_PC(l)
2535#define VAL_RUNABLE (vaddr_t)LWP_PC(l)
2536#else
2537#define FMT_RUN "%s"
2538#define VAL_RUNNING "running"
2539#define VAL_RUNABLE "runnable"
2540#endif
2541		switch (l->l_stat) {
2542		case LSONPROC:
2543			snprintf(lmsg, sizeof(lmsg), FMT_RUN"/%d", VAL_RUNNING,
2544			    cpu_index(l->l_cpu));
2545			lp = lmsg;
2546			break;
2547		case LSRUN:
2548			snprintf(lmsg, sizeof(lmsg), FMT_RUN, VAL_RUNABLE);
2549			lp = lmsg;
2550			break;
2551		default:
2552			lp = l->l_wchan ? l->l_wmesg : "iowait";
2553			break;
2554		}
2555		strlcat(buf, lp, bufsz);
2556		strlcat(buf, LIST_NEXT(l, l_sibling) != NULL ? " " : "] ",
2557		    bufsz);
2558		pctcpu += l->l_pctcpu;
2559		lwp_unlock(l);
2560	}
2561	pctcpu += pick->p_pctcpu;
2562	calcru(pick, &utime, &stime, NULL, NULL);
2563	mutex_exit(pick->p_lock);
2564
2565	/* Round up and print user+system time, %CPU and RSS. */
2566	utime.tv_usec += 5000;
2567	if (utime.tv_usec >= 1000000) {
2568		utime.tv_sec += 1;
2569		utime.tv_usec -= 1000000;
2570	}
2571	stime.tv_usec += 5000;
2572	if (stime.tv_usec >= 1000000) {
2573		stime.tv_sec += 1;
2574		stime.tv_usec -= 1000000;
2575	}
2576#define	pgtok(a)	(((u_long) ((a) * PAGE_SIZE) / 1024))
2577	tmp = (pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2578	if (pick->p_stat == SIDL || P_ZOMBIE(pick))
2579		rss = 0;
2580	else
2581		rss = pgtok(vm_resident_count(pick->p_vmspace));
2582
2583	snprintf(lmsg, sizeof(lmsg), "%ld.%02ldu %ld.%02lds %d%% %ldk",
2584	    (long)utime.tv_sec, (long)utime.tv_usec / 10000,
2585	    (long)stime.tv_sec, (long)stime.tv_usec / 10000,
2586	    tmp / 100, rss);
2587	strlcat(buf, lmsg, bufsz);
2588}
2589
2590/*
2591 * Print report on state of foreground process group.
2592 * Call with tty_lock held.
2593 */
2594void
2595ttyputinfo(struct tty *tp, char *buf)
2596{
2597
2598	KASSERT(mutex_owned(&tty_lock));
2599
2600	if (ttycheckoutq_wlock(tp, 0) == 0)
2601		return;
2602	ttyprintf_nolock(tp, "%s\n", buf);
2603	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2604}
2605
2606/*
2607 * Returns 1 if p2 has a better chance being the active foreground process
2608 * in a terminal instead of p1.
2609 */
2610static int
2611proc_compare_wrapper(struct proc *p1, struct proc *p2)
2612{
2613	lwp_t *l1, *l2;
2614
2615	KASSERT(mutex_owned(p1->p_lock));
2616	KASSERT(mutex_owned(p2->p_lock));
2617
2618	if ((l1 = LIST_FIRST(&p1->p_lwps)) == NULL)
2619		return 1;
2620
2621	if ((l2 = LIST_FIRST(&p2->p_lwps)) == NULL)
2622		return 0;
2623
2624	return proc_compare(p1, l1, p2, l2);
2625}
2626
2627/*
2628 * Output char to tty; console putchar style.
2629 * Can be called with tty lock held through kprintf() machinery..
2630 */
2631int
2632tputchar(int c, int flags, struct tty *tp)
2633{
2634	int r = 0;
2635
2636	if ((flags & NOLOCK) == 0)
2637		mutex_spin_enter(&tty_lock);
2638	if (!CONNECTED(tp)) {
2639		r = -1;
2640		goto out;
2641	}
2642	if (c == '\n')
2643		(void)ttyoutput('\r', tp);
2644	(void)ttyoutput(c, tp);
2645	ttstart(tp);
2646out:
2647	if ((flags & NOLOCK) == 0)
2648		mutex_spin_exit(&tty_lock);
2649	return (r);
2650}
2651
2652/*
2653 * Sleep on chan, returning ERESTART if tty changed while we napped and
2654 * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by
2655 * cv_timedwait(_sig).
2656 * If the tty is revoked, restarting a pending call will redo validation done
2657 * at the start of the call.
2658 *
2659 * Must be called with the tty lock held.
2660 */
2661int
2662ttysleep(struct tty *tp, kcondvar_t *cv, bool catch, int timo)
2663{
2664	int	error;
2665	short	gen;
2666
2667	KASSERT(mutex_owned(&tty_lock));
2668
2669	gen = tp->t_gen;
2670	if (cv == NULL)
2671		error = kpause("ttypause", catch, timo, &tty_lock);
2672	else if (catch)
2673		error = cv_timedwait_sig(cv, &tty_lock, timo);
2674	else
2675		error = cv_timedwait(cv, &tty_lock, timo);
2676	if (error != 0)
2677		return (error);
2678	return (tp->t_gen == gen ? 0 : ERESTART);
2679}
2680
2681int
2682ttypause(struct tty *tp, int timo)
2683{
2684	int error;
2685
2686	error = ttysleep(tp, NULL, true, timo);
2687	if (error == EWOULDBLOCK)
2688		error = 0;
2689	return error;
2690}
2691
2692/*
2693 * Attach a tty to the tty list.
2694 *
2695 * This should be called ONLY once per real tty (including pty's).
2696 * eg, on the sparc, the keyboard and mouse have struct tty's that are
2697 * distinctly NOT usable as tty's, and thus should not be attached to
2698 * the ttylist.  This is why this call is not done from tty_alloc().
2699 *
2700 * Device drivers should attach tty's at a similar time that they are
2701 * allocated, or, for the case of statically allocated struct tty's
2702 * either in the attach or (first) open routine.
2703 */
2704void
2705tty_attach(struct tty *tp)
2706{
2707
2708	mutex_spin_enter(&tty_lock);
2709	TAILQ_INSERT_TAIL(&ttylist, tp, tty_link);
2710	++tty_count;
2711	mutex_spin_exit(&tty_lock);
2712}
2713
2714/*
2715 * Remove a tty from the tty list.
2716 */
2717void
2718tty_detach(struct tty *tp)
2719{
2720
2721	mutex_spin_enter(&tty_lock);
2722	--tty_count;
2723#ifdef DIAGNOSTIC
2724	if (tty_count < 0)
2725		panic("tty_detach: tty_count < 0");
2726#endif
2727	TAILQ_REMOVE(&ttylist, tp, tty_link);
2728	mutex_spin_exit(&tty_lock);
2729}
2730
2731/*
2732 * Allocate a tty structure and its associated buffers.
2733 */
2734struct tty *
2735tty_alloc(void)
2736{
2737	struct tty *tp;
2738	int i;
2739
2740	tp = kmem_zalloc(sizeof(*tp), KM_SLEEP);
2741	callout_init(&tp->t_rstrt_ch, 0);
2742	callout_setfunc(&tp->t_rstrt_ch, ttrstrt, tp);
2743	tp->t_qsize = tty_qsize;
2744	clalloc(&tp->t_rawq, tp->t_qsize, 1);
2745	cv_init(&tp->t_rawcv, "ttyraw");
2746	cv_init(&tp->t_rawcvf, "ttyrawf");
2747	clalloc(&tp->t_canq, tp->t_qsize, 1);
2748	cv_init(&tp->t_cancv, "ttycan");
2749	cv_init(&tp->t_cancvf, "ttycanf");
2750	/* output queue doesn't need quoting */
2751	clalloc(&tp->t_outq, tp->t_qsize, 0);
2752	cv_init(&tp->t_outcv, "ttyout");
2753	cv_init(&tp->t_outcvf, "ttyoutf");
2754	/* Set default line discipline. */
2755	tp->t_linesw = ttyldisc_default();
2756	tp->t_dev = NODEV;
2757	selinit(&tp->t_rsel);
2758	selinit(&tp->t_wsel);
2759	for (i = 0; i < TTYSIG_COUNT; i++)  {
2760		sigemptyset(&tp->t_sigs[i]);
2761	}
2762
2763	return tp;
2764}
2765
2766/*
2767 * Free a tty structure and its buffers.
2768 *
2769 * Be sure to call tty_detach() for any tty that has been
2770 * tty_attach()ed.
2771 */
2772void
2773tty_free(struct tty *tp)
2774{
2775	int i;
2776
2777	mutex_enter(proc_lock);
2778	mutex_enter(&tty_lock);
2779	for (i = 0; i < TTYSIG_COUNT; i++)
2780		sigemptyset(&tp->t_sigs[i]);
2781	if (tp->t_sigcount != 0)
2782		TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2783	mutex_exit(&tty_lock);
2784	mutex_exit(proc_lock);
2785
2786	callout_halt(&tp->t_rstrt_ch, NULL);
2787	callout_destroy(&tp->t_rstrt_ch);
2788	ttyldisc_release(tp->t_linesw);
2789	clfree(&tp->t_rawq);
2790	clfree(&tp->t_canq);
2791	clfree(&tp->t_outq);
2792	cv_destroy(&tp->t_rawcv);
2793	cv_destroy(&tp->t_rawcvf);
2794	cv_destroy(&tp->t_cancv);
2795	cv_destroy(&tp->t_cancvf);
2796	cv_destroy(&tp->t_outcv);
2797	cv_destroy(&tp->t_outcvf);
2798	seldestroy(&tp->t_rsel);
2799	seldestroy(&tp->t_wsel);
2800	kmem_free(tp, sizeof(*tp));
2801}
2802
2803/*
2804 * ttyprintf_nolock: send a message to a specific tty, without locking.
2805 *
2806 * => should be used only by tty driver or anything that knows the
2807 *    underlying tty will not be revoked(2)'d away.  [otherwise,
2808 *    use tprintf]
2809 */
2810static void
2811ttyprintf_nolock(struct tty *tp, const char *fmt, ...)
2812{
2813	va_list ap;
2814
2815	/* No mutex needed; going to process TTY. */
2816	va_start(ap, fmt);
2817	kprintf(fmt, TOTTY|NOLOCK, tp, NULL, ap);
2818	va_end(ap);
2819}
2820
2821static int
2822tty_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
2823    void *arg0, void *arg1, void *arg2, void *arg3)
2824{
2825	struct tty *tty;
2826	int result;
2827
2828	result = KAUTH_RESULT_DEFER;
2829
2830	if (action != KAUTH_DEVICE_TTY_OPEN)
2831		return result;
2832
2833	tty = arg0;
2834
2835	/* If it's not opened, we allow. */
2836	if ((tty->t_state & TS_ISOPEN) == 0)
2837		result = KAUTH_RESULT_ALLOW;
2838	else {
2839		/*
2840		 * If it's opened, we can only allow if it's not exclusively
2841		 * opened; otherwise, that's a privileged operation and we
2842		 * let the secmodel handle it.
2843		 */
2844		if ((tty->t_state & TS_XCLUDE) == 0)
2845			result = KAUTH_RESULT_ALLOW;
2846	}
2847
2848	return result;
2849}
2850
2851/*
2852 * Initialize the tty subsystem.
2853 */
2854void
2855tty_init(void)
2856{
2857
2858	mutex_init(&tty_lock, MUTEX_DEFAULT, IPL_VM);
2859	rw_init(&ttcompat_lock);
2860	tty_sigsih = softint_establish(SOFTINT_CLOCK, ttysigintr, NULL);
2861	KASSERT(tty_sigsih != NULL);
2862
2863	tty_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
2864	    tty_listener_cb, NULL);
2865
2866	sysctl_kern_tty_setup();
2867}
2868
2869/*
2870 * Send a signal from a tty to its process group or session leader.
2871 * Handoff to the target is deferred to a soft interrupt.
2872 */
2873void
2874ttysig(struct tty *tp, enum ttysigtype st, int sig)
2875{
2876	sigset_t *sp;
2877
2878	/* XXXSMP not yet KASSERT(mutex_owned(&tty_lock)); */
2879
2880	sp = &tp->t_sigs[st];
2881	if (sigismember(sp, sig))
2882		return;
2883	sigaddset(sp, sig);
2884	if (tp->t_sigcount++ == 0)
2885		TAILQ_INSERT_TAIL(&tty_sigqueue, tp, t_sigqueue);
2886	softint_schedule(tty_sigsih);
2887}
2888
2889/*
2890 * Deliver deferred signals from ttys.  Note that the process groups
2891 * and sessions associated with the ttys may have changed from when
2892 * the signal was originally sent, but in practice it should not matter.
2893 * For signals produced as a result of a syscall, the soft interrupt
2894 * will fire before the syscall returns to the user.
2895 */
2896static void
2897ttysigintr(void *cookie)
2898{
2899	struct tty *tp;
2900	enum ttysigtype st;
2901	struct pgrp *pgrp;
2902	struct session *sess;
2903	int sig, lflag;
2904	char infobuf[200];
2905
2906	mutex_enter(proc_lock);
2907	mutex_spin_enter(&tty_lock);
2908	while ((tp = TAILQ_FIRST(&tty_sigqueue)) != NULL) {
2909		KASSERT(tp->t_sigcount > 0);
2910		for (st = 0; st < TTYSIG_COUNT; st++) {
2911			if ((sig = firstsig(&tp->t_sigs[st])) != 0)
2912				break;
2913		}
2914		KASSERT(st < TTYSIG_COUNT);
2915		sigdelset(&tp->t_sigs[st], sig);
2916		if (--tp->t_sigcount == 0)
2917			TAILQ_REMOVE(&tty_sigqueue, tp, t_sigqueue);
2918		pgrp = tp->t_pgrp;
2919		sess = tp->t_session;
2920		lflag = tp->t_lflag;
2921		if  (sig == SIGINFO) {
2922			if (ISSET(tp->t_state, TS_SIGINFO)) {
2923				/* Via ioctl: ignore tty option. */
2924				tp->t_state &= ~TS_SIGINFO;
2925				lflag |= ISIG;
2926			}
2927			if (!ISSET(lflag, NOKERNINFO)) {
2928				mutex_spin_exit(&tty_lock);
2929				ttygetinfo(tp, 1, infobuf, sizeof(infobuf));
2930				mutex_spin_enter(&tty_lock);
2931				ttyputinfo(tp, infobuf);
2932			}
2933			if (!ISSET(lflag, ISIG))
2934				continue;
2935		}
2936		mutex_spin_exit(&tty_lock);
2937		KASSERT(sig != 0);
2938		switch (st) {
2939		case TTYSIG_PG1:
2940			if (pgrp != NULL)
2941				pgsignal(pgrp, sig, 1);
2942			break;
2943		case TTYSIG_PG2:
2944			if (pgrp != NULL)
2945				pgsignal(pgrp, sig, sess != NULL);
2946			break;
2947		case TTYSIG_LEADER:
2948			if (sess != NULL && sess->s_leader != NULL)
2949				psignal(sess->s_leader, sig);
2950			break;
2951		default:
2952			/* NOTREACHED */
2953			break;
2954		}
2955		mutex_spin_enter(&tty_lock);
2956	}
2957	mutex_spin_exit(&tty_lock);
2958	mutex_exit(proc_lock);
2959}
2960