xref: /dragonfly/sys/kern/tty.c (revision fcf53d9b)
1 /*-
2  * (MPSAFE)
3  *
4  * Copyright (c) 1982, 1986, 1990, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by the University of
23  *	California, Berkeley and its contributors.
24  * 4. Neither the name of the University nor the names of its contributors
25  *    may be used to endorse or promote products derived from this software
26  *    without specific prior written permission.
27  *
28  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
29  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
32  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38  * SUCH DAMAGE.
39  *
40  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
41  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
42  * $DragonFly: src/sys/kern/tty.c,v 1.46 2008/09/10 09:50:09 y0netan1 Exp $
43  */
44 
45 /*
46  * MPSAFE NOTE:
47  * Almost all functions in this file are acquiring the tty token due to their
48  * access and modifications of the 'tp' (struct tty) objects.
49  */
50 
51 /*-
52  * TODO:
53  *	o Fix races for sending the start char in ttyflush().
54  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
55  *	  With luck, there will be MIN chars before select() returns().
56  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
57  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
58  *	  FIONREAD.
59  *	o Do the new sio locking stuff here and use it to avoid special
60  *	  case for EXTPROC?
61  *	o Lock PENDIN too?
62  *	o Move EXTPROC and/or PENDIN to t_state?
63  *	o Wrap most of ttioctl in spltty/splx.
64  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
65  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
66  *	o Don't allow certain termios flags to affect disciplines other
67  *	  than TTYDISC.  Cancel their effects before switch disciplines
68  *	  and ignore them if they are set while we are in another
69  *	  discipline.
70  *	o Now that historical speed conversions are handled here, don't
71  *	  do them in drivers.
72  *	o Check for TS_CARR_ON being set while everything is closed and not
73  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
74  *	  so it would live until the next open even if carrier drops.
75  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
76  *	  only when _all_ openers leave open().
77  */
78 
79 #include "opt_compat.h"
80 #include "opt_uconsole.h"
81 
82 #include <sys/param.h>
83 #include <sys/systm.h>
84 #include <sys/filio.h>
85 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
86 #include <sys/ioctl_compat.h>
87 #endif
88 #include <sys/proc.h>
89 #include <sys/priv.h>
90 #define	TTYDEFCHARS
91 #include <sys/tty.h>
92 #include <sys/clist.h>
93 #undef	TTYDEFCHARS
94 #include <sys/fcntl.h>
95 #include <sys/conf.h>
96 #include <sys/dkstat.h>
97 #include <sys/kernel.h>
98 #include <sys/vnode.h>
99 #include <sys/signalvar.h>
100 #include <sys/signal2.h>
101 #include <sys/resourcevar.h>
102 #include <sys/malloc.h>
103 #include <sys/filedesc.h>
104 #include <sys/sysctl.h>
105 #include <sys/thread2.h>
106 
107 #include <vm/vm.h>
108 #include <sys/lock.h>
109 #include <vm/pmap.h>
110 #include <vm/vm_map.h>
111 
112 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
113 
114 static int	proc_compare (struct proc *p1, struct proc *p2);
115 static int	ttnread (struct tty *tp);
116 static void	ttyecho (int c, struct tty *tp);
117 static int	ttyoutput (int c, struct tty *tp);
118 static void	ttypend (struct tty *tp);
119 static void	ttyretype (struct tty *tp);
120 static void	ttyrub (int c, struct tty *tp);
121 static void	ttyrubo (struct tty *tp, int cnt);
122 static void	ttyunblock (struct tty *tp);
123 static int	ttywflush (struct tty *tp);
124 static int	filt_ttyread (struct knote *kn, long hint);
125 static void 	filt_ttyrdetach (struct knote *kn);
126 static int	filt_ttywrite (struct knote *kn, long hint);
127 static void 	filt_ttywdetach (struct knote *kn);
128 
129 /*
130  * Table with character classes and parity. The 8th bit indicates parity,
131  * the 7th bit indicates the character is an alphameric or underscore (for
132  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
133  * are 0 then the character needs no special processing on output; classes
134  * other than 0 might be translated or (not currently) require delays.
135  */
136 #define	E	0x00	/* Even parity. */
137 #define	O	0x80	/* Odd parity. */
138 #define	PARITY(c)	(char_type[c] & O)
139 
140 #define	ALPHA	0x40	/* Alpha or underscore. */
141 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
142 
143 #define	CCLASSMASK	0x3f
144 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
145 
146 #define	BS	BACKSPACE
147 #define	CC	CONTROL
148 #define	CR	RETURN
149 #define	NA	ORDINARY | ALPHA
150 #define	NL	NEWLINE
151 #define	NO	ORDINARY
152 #define	TB	TAB
153 #define	VT	VTAB
154 
155 static u_char const char_type[] = {
156 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
157 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
158 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
159 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
160 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
161 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
162 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
163 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
164 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
165 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
166 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
167 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
168 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
169 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
170 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
171 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
172 	/*
173 	 * Meta chars; should be settable per character set;
174 	 * for now, treat them all as normal characters.
175 	 */
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
186 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
187 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
188 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
189 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
190 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
191 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
192 };
193 #undef	BS
194 #undef	CC
195 #undef	CR
196 #undef	NA
197 #undef	NL
198 #undef	NO
199 #undef	TB
200 #undef	VT
201 
202 /* Macros to clear/set/test flags. */
203 #define	SET(t, f)	(t) |= (f)
204 #define	CLR(t, f)	(t) &= ~(f)
205 #define	ISSET(t, f)	((t) & (f))
206 
207 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
208 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
209 
210 uint64_t tk_nin;
211 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
212     "LU", "TTY input statistic");
213 uint64_t tk_nout;
214 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
215     "LU", "TTY output statistic");
216 uint64_t tk_rawcc;
217 
218 /*
219  * list of struct tty where pstat(8) can pick it up with sysctl
220  */
221 static TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
222 
223 /*
224  * Initial open of tty, or (re)entry to standard tty line discipline.
225  */
226 int
227 ttyopen(cdev_t device, struct tty *tp)
228 {
229 	crit_enter();
230 	lwkt_gettoken(&tty_token);
231 	tp->t_dev = device;
232 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
233 		SET(tp->t_state, TS_ISOPEN);
234 		if (ISSET(tp->t_cflag, CLOCAL)) {
235 			SET(tp->t_state, TS_CONNECTED);
236 		}
237 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
238 	}
239 	ttsetwater(tp);
240 	lwkt_reltoken(&tty_token);
241 	crit_exit();
242 	return (0);
243 }
244 
245 /*
246  * Handle close() on a tty line: flush and set to initial state,
247  * bumping generation number so that pending read/write calls
248  * can detect recycling of the tty.
249  *
250  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
251  * and l_close() should have flushed, but we repeat the spltty() and
252  * the flush in case there are buggy callers.
253  */
254 int
255 ttyclose(struct tty *tp)
256 {
257 	crit_enter();
258 	lwkt_gettoken(&tty_token);
259 	funsetown(&tp->t_sigio);
260 	if (constty == tp)
261 		constty = NULL;
262 
263 	ttyflush(tp, FREAD | FWRITE);
264 	clist_free_cblocks(&tp->t_canq);
265 	clist_free_cblocks(&tp->t_outq);
266 	clist_free_cblocks(&tp->t_rawq);
267 
268 	tp->t_gen++;
269 	tp->t_line = TTYDISC;
270 	ttyclearsession(tp);
271 	tp->t_state &= TS_REGISTERED;	/* clear all bits except */
272 	lwkt_reltoken(&tty_token);
273 	crit_exit();
274 	return (0);
275 }
276 
277 /*
278  * Disassociate the tty from its session.  Traditionally this has only been
279  * a half-close, meaning that the session was still allowed to point at the
280  * tty (resulting in the tty in the ps command showing something like 'p0-'),
281  * even though the tty is no longer pointing at the session.
282  *
283  * The half close seems to be useful only for 'ps' output but there is as
284  * yet no reason to remove the feature.  The full-close code is currently
285  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
286  */
287 void
288 ttyclearsession(struct tty *tp)
289 {
290 	struct session *sp;
291 	struct pgrp *opgrp;
292 
293 	lwkt_gettoken(&tty_token);
294 	opgrp = tp->t_pgrp;
295 	tp->t_pgrp = NULL;
296 	if (opgrp) {
297 		pgrel(opgrp);
298 		opgrp = NULL;
299 	}
300 
301 	if ((sp = tp->t_session) != NULL) {
302 		tp->t_session = NULL;
303 #ifdef TTY_DO_FULL_CLOSE
304 		/* FULL CLOSE (not yet) */
305 		if (sp->s_ttyp == tp) {
306 			sp->s_ttyp = NULL;
307 			ttyunhold(tp);
308 		} else {
309 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
310 				"%p/%p\n", sp->s_ttyp, tp);
311 		}
312 #endif
313 	}
314 	lwkt_reltoken(&tty_token);
315 }
316 
317 /*
318  * Release the tty vnode association for a session.  This is the
319  * 'other half' of the close.  Because multiple opens of /dev/tty
320  * only generate a single open to the actual tty, the file modes
321  * are locked to FREAD|FWRITE.
322  *
323  * If dorevoke is non-zero, the session is also revoked.  We have to
324  * close the vnode if VCTTYISOPEN is set.
325  */
326 void
327 ttyclosesession(struct session *sp, int dorevoke)
328 {
329 	struct vnode *vp;
330 
331 	lwkt_gettoken(&tty_token);
332 retry:
333 	/*
334 	 * There may not be a controlling terminal or it may have been closed
335 	 * out from under us.
336 	 */
337 	if ((vp = sp->s_ttyvp) == NULL) {
338 		lwkt_reltoken(&tty_token);
339 		return;
340 	}
341 
342 	/*
343 	 * We need a lock if we have to close or revoke.
344 	 */
345 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
346 		vhold(vp);
347 		if (vn_lock(vp, LK_EXCLUSIVE|LK_RETRY)) {
348 			vdrop(vp);
349 			goto retry;
350 		}
351 
352 		/*
353 		 * Retry if the vnode was ripped out from under us
354 		 */
355 		if (vp != sp->s_ttyvp) {
356 			vn_unlock(vp);
357 			vdrop(vp);
358 			goto retry;
359 		}
360 
361 		/*
362 		 * Close and revoke as needed
363 		 */
364 		sp->s_ttyvp = NULL;
365 		if (vp->v_flag & VCTTYISOPEN) {
366 			vclrflags(vp, VCTTYISOPEN);
367 			VOP_CLOSE(vp, FREAD|FWRITE);
368 		}
369 		vn_unlock(vp);
370 		if (dorevoke)
371 			vrevoke(vp, proc0.p_ucred);
372 		vdrop(vp);
373 	} else {
374 		sp->s_ttyvp = NULL;
375 	}
376 	vrele(vp);
377 	lwkt_reltoken(&tty_token);
378 }
379 
380 #define	FLUSHQ(q) {							\
381 	if ((q)->c_cc)							\
382 		ndflush(q, (q)->c_cc);					\
383 }
384 
385 /* Is 'c' a line delimiter ("break" character)? */
386 #define	TTBREAKC(c, lflag)							\
387 	((c) == '\n' || (((c) == cc[VEOF] ||				\
388 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
389 	 (c) != _POSIX_VDISABLE))
390 
391 /*
392  * Process input of a single character received on a tty.
393  */
394 int
395 ttyinput(int c, struct tty *tp)
396 {
397 	tcflag_t iflag, lflag;
398 	cc_t *cc;
399 	int i, err;
400 
401 	lwkt_gettoken(&tty_token);
402 	/*
403 	 * If input is pending take it first.
404 	 */
405 	lflag = tp->t_lflag;
406 	if (ISSET(lflag, PENDIN))
407 		ttypend(tp);
408 	/*
409 	 * Gather stats.
410 	 */
411 	if (ISSET(lflag, ICANON))
412 		++tp->t_cancc;
413 	else
414 		++tp->t_rawcc;
415 	++tk_nin;
416 
417 	/*
418 	 * Block further input iff:
419 	 * current input > threshold AND input is available to user program
420 	 * AND input flow control is enabled and not yet invoked.
421 	 * The 3 is slop for PARMRK.
422 	 */
423 	iflag = tp->t_iflag;
424 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
425 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
426 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
427 	    !ISSET(tp->t_state, TS_TBLOCK))
428 		ttyblock(tp);
429 
430 	/* Handle exceptional conditions (break, parity, framing). */
431 	cc = tp->t_cc;
432 	err = (ISSET(c, TTY_ERRORMASK));
433 	if (err) {
434 		CLR(c, TTY_ERRORMASK);
435 		if (ISSET(err, TTY_BI)) {
436 			if (ISSET(iflag, IGNBRK)) {
437 				lwkt_reltoken(&tty_token);
438 				return (0);
439 			}
440 			if (ISSET(iflag, BRKINT)) {
441 				ttyflush(tp, FREAD | FWRITE);
442 				pgsignal(tp->t_pgrp, SIGINT, 1);
443 				goto endcase;
444 			}
445 			if (ISSET(iflag, PARMRK))
446 				goto parmrk;
447 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
448 			|| ISSET(err, TTY_FE)) {
449 			if (ISSET(iflag, IGNPAR)) {
450 				lwkt_reltoken(&tty_token);
451 				return (0);
452 			}
453 			else if (ISSET(iflag, PARMRK)) {
454 parmrk:
455 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
456 				    MAX_INPUT - 3)
457 					goto input_overflow;
458 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
459 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
460 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
461 				goto endcase;
462 			} else
463 				c = 0;
464 		}
465 	}
466 
467 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
468 		CLR(c, 0x80);
469 	if (!ISSET(lflag, EXTPROC)) {
470 		/*
471 		 * Check for literal nexting very first
472 		 */
473 		if (ISSET(tp->t_state, TS_LNCH)) {
474 			SET(c, TTY_QUOTE);
475 			CLR(tp->t_state, TS_LNCH);
476 		}
477 		/*
478 		 * Scan for special characters.  This code
479 		 * is really just a big case statement with
480 		 * non-constant cases.  The bottom of the
481 		 * case statement is labeled ``endcase'', so goto
482 		 * it after a case match, or similar.
483 		 */
484 
485 		/*
486 		 * Control chars which aren't controlled
487 		 * by ICANON, ISIG, or IXON.
488 		 */
489 		if (ISSET(lflag, IEXTEN)) {
490 			if (CCEQ(cc[VLNEXT], c)) {
491 				if (ISSET(lflag, ECHO)) {
492 					if (ISSET(lflag, ECHOE)) {
493 						(void)ttyoutput('^', tp);
494 						(void)ttyoutput('\b', tp);
495 					} else
496 						ttyecho(c, tp);
497 				}
498 				SET(tp->t_state, TS_LNCH);
499 				goto endcase;
500 			}
501 			if (CCEQ(cc[VDISCARD], c)) {
502 				if (ISSET(lflag, FLUSHO))
503 					CLR(tp->t_lflag, FLUSHO);
504 				else {
505 					ttyflush(tp, FWRITE);
506 					ttyecho(c, tp);
507 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
508 						ttyretype(tp);
509 					SET(tp->t_lflag, FLUSHO);
510 				}
511 				goto startoutput;
512 			}
513 		}
514 		/*
515 		 * Signals.
516 		 */
517 		if (ISSET(lflag, ISIG)) {
518 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
519 				if (!ISSET(lflag, NOFLSH))
520 					ttyflush(tp, FREAD | FWRITE);
521 				ttyecho(c, tp);
522 				pgsignal(tp->t_pgrp,
523 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
524 				goto endcase;
525 			}
526 			if (CCEQ(cc[VSUSP], c)) {
527 				if (!ISSET(lflag, NOFLSH))
528 					ttyflush(tp, FREAD);
529 				ttyecho(c, tp);
530 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
531 				goto endcase;
532 			}
533 		}
534 		/*
535 		 * Handle start/stop characters.
536 		 */
537 		if (ISSET(iflag, IXON)) {
538 			if (CCEQ(cc[VSTOP], c)) {
539 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
540 					SET(tp->t_state, TS_TTSTOP);
541 					(*tp->t_stop)(tp, 0);
542 					lwkt_reltoken(&tty_token);
543 					return (0);
544 				}
545 				if (!CCEQ(cc[VSTART], c)) {
546 					lwkt_reltoken(&tty_token);
547 					return (0);
548 				}
549 				/*
550 				 * if VSTART == VSTOP then toggle
551 				 */
552 				goto endcase;
553 			}
554 			if (CCEQ(cc[VSTART], c))
555 				goto restartoutput;
556 		}
557 		/*
558 		 * IGNCR, ICRNL, & INLCR
559 		 */
560 		if (c == '\r') {
561 			if (ISSET(iflag, IGNCR)) {
562 				lwkt_reltoken(&tty_token);
563 				return (0);
564 			}
565 			else if (ISSET(iflag, ICRNL))
566 				c = '\n';
567 		} else if (c == '\n' && ISSET(iflag, INLCR))
568 			c = '\r';
569 	}
570 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
571 		/*
572 		 * From here on down canonical mode character
573 		 * processing takes place.
574 		 */
575 		/*
576 		 * erase or erase2 (^H / ^?)
577 		 */
578 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
579 			if (tp->t_rawq.c_cc)
580 				ttyrub(clist_unputc(&tp->t_rawq), tp);
581 			goto endcase;
582 		}
583 		/*
584 		 * kill (^U)
585 		 */
586 		if (CCEQ(cc[VKILL], c)) {
587 			if (ISSET(lflag, ECHOKE) &&
588 			    tp->t_rawq.c_cc == tp->t_rocount &&
589 			    !ISSET(lflag, ECHOPRT))
590 				while (tp->t_rawq.c_cc)
591 					ttyrub(clist_unputc(&tp->t_rawq), tp);
592 			else {
593 				ttyecho(c, tp);
594 				if (ISSET(lflag, ECHOK) ||
595 				    ISSET(lflag, ECHOKE))
596 					ttyecho('\n', tp);
597 				FLUSHQ(&tp->t_rawq);
598 				tp->t_rocount = 0;
599 			}
600 			CLR(tp->t_state, TS_LOCAL);
601 			goto endcase;
602 		}
603 		/*
604 		 * word erase (^W)
605 		 */
606 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
607 			int ctype;
608 
609 			/*
610 			 * erase whitespace
611 			 */
612 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
613 				ttyrub(c, tp);
614 			if (c == -1)
615 				goto endcase;
616 			/*
617 			 * erase last char of word and remember the
618 			 * next chars type (for ALTWERASE)
619 			 */
620 			ttyrub(c, tp);
621 			c = clist_unputc(&tp->t_rawq);
622 			if (c == -1)
623 				goto endcase;
624 			if (c == ' ' || c == '\t') {
625 				clist_putc(c, &tp->t_rawq);
626 				goto endcase;
627 			}
628 			ctype = ISALPHA(c);
629 			/*
630 			 * erase rest of word
631 			 */
632 			do {
633 				ttyrub(c, tp);
634 				c = clist_unputc(&tp->t_rawq);
635 				if (c == -1)
636 					goto endcase;
637 			} while (c != ' ' && c != '\t' &&
638 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
639 			clist_putc(c, &tp->t_rawq);
640 			goto endcase;
641 		}
642 		/*
643 		 * reprint line (^R)
644 		 */
645 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
646 			ttyretype(tp);
647 			goto endcase;
648 		}
649 		/*
650 		 * ^T - kernel info and generate SIGINFO
651 		 */
652 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
653 			if (ISSET(lflag, ISIG))
654 				pgsignal(tp->t_pgrp, SIGINFO, 1);
655 			if (!ISSET(lflag, NOKERNINFO))
656 				ttyinfo(tp);
657 			goto endcase;
658 		}
659 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
660 			if (ISSET(lflag, ISIG))
661 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
662 			goto endcase;
663 		}
664 	}
665 	/*
666 	 * Check for input buffer overflow
667 	 */
668 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
669 input_overflow:
670 		if (ISSET(iflag, IMAXBEL)) {
671 			if (tp->t_outq.c_cc < tp->t_ohiwat)
672 				(void)ttyoutput(CTRL('g'), tp);
673 		}
674 		goto endcase;
675 	}
676 
677 	if (   c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP)
678 	     && ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR))
679 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
680 
681 	/*
682 	 * Put data char in q for user and
683 	 * wakeup on seeing a line delimiter.
684 	 */
685 	if (clist_putc(c, &tp->t_rawq) >= 0) {
686 		if (!ISSET(lflag, ICANON)) {
687 			ttwakeup(tp);
688 			ttyecho(c, tp);
689 			goto endcase;
690 		}
691 		if (TTBREAKC(c, lflag)) {
692 			tp->t_rocount = 0;
693 			catq(&tp->t_rawq, &tp->t_canq);
694 			ttwakeup(tp);
695 		} else if (tp->t_rocount++ == 0)
696 			tp->t_rocol = tp->t_column;
697 		if (ISSET(tp->t_state, TS_ERASE)) {
698 			/*
699 			 * end of prterase \.../
700 			 */
701 			CLR(tp->t_state, TS_ERASE);
702 			(void)ttyoutput('/', tp);
703 		}
704 		i = tp->t_column;
705 		ttyecho(c, tp);
706 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
707 			/*
708 			 * Place the cursor over the '^' of the ^D.
709 			 */
710 			i = imin(2, tp->t_column - i);
711 			while (i > 0) {
712 				(void)ttyoutput('\b', tp);
713 				i--;
714 			}
715 		}
716 	}
717 endcase:
718 	/*
719 	 * IXANY means allow any character to restart output.
720 	 */
721 	if (ISSET(tp->t_state, TS_TTSTOP) &&
722 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
723 		lwkt_reltoken(&tty_token);
724 		return (0);
725 	}
726 restartoutput:
727 	CLR(tp->t_lflag, FLUSHO);
728 	CLR(tp->t_state, TS_TTSTOP);
729 startoutput:
730 	lwkt_reltoken(&tty_token);
731 	return (ttstart(tp));
732 }
733 
734 /*
735  * Output a single character on a tty, doing output processing
736  * as needed (expanding tabs, newline processing, etc.).
737  * Returns < 0 if succeeds, otherwise returns char to resend.
738  * Must be recursive.
739  */
740 static int
741 ttyoutput(int c, struct tty *tp)
742 {
743 	tcflag_t oflag;
744 	int col;
745 
746 	lwkt_gettoken(&tty_token);
747 	oflag = tp->t_oflag;
748 	if (!ISSET(oflag, OPOST)) {
749 		if (ISSET(tp->t_lflag, FLUSHO)) {
750 			lwkt_reltoken(&tty_token);
751 			return (-1);
752 		}
753 		if (clist_putc(c, &tp->t_outq)) {
754 			lwkt_reltoken(&tty_token);
755 			return (c);
756 		}
757 		tk_nout++;
758 		tp->t_outcc++;
759 		lwkt_reltoken(&tty_token);
760 		return (-1);
761 	}
762 	/*
763 	 * Do tab expansion if OXTABS is set.  Special case if we external
764 	 * processing, we don't do the tab expansion because we'll probably
765 	 * get it wrong.  If tab expansion needs to be done, let it happen
766 	 * externally.
767 	 */
768 	CLR(c, ~TTY_CHARMASK);
769 	if (c == '\t' &&
770 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
771 		c = 8 - (tp->t_column & 7);
772 		if (!ISSET(tp->t_lflag, FLUSHO)) {
773 			crit_enter();		/* Don't interrupt tabs. */
774 			c -= b_to_q("        ", c, &tp->t_outq);
775 			tk_nout += c;
776 			tp->t_outcc += c;
777 			crit_exit();
778 		}
779 		tp->t_column += c;
780 		lwkt_reltoken(&tty_token);
781 		return (c ? -1 : '\t');
782 	}
783 	if (c == CEOT && ISSET(oflag, ONOEOT)) {
784 		lwkt_reltoken(&tty_token);
785 		return (-1);
786 	}
787 
788 	/*
789 	 * Newline translation: if ONLCR is set,
790 	 * translate newline into "\r\n".
791 	 */
792 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
793 		tk_nout++;
794 		tp->t_outcc++;
795 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq)) {
796 			lwkt_reltoken(&tty_token);
797 			return (c);
798 		}
799 	}
800 	/* If OCRNL is set, translate "\r" into "\n". */
801 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
802 		c = '\n';
803 	/* If ONOCR is set, don't transmit CRs when on column 0. */
804 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0) {
805 		lwkt_reltoken(&tty_token);
806 		return (-1);
807 	}
808 
809 	tk_nout++;
810 	tp->t_outcc++;
811 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq)) {
812 		lwkt_reltoken(&tty_token);
813 		return (c);
814 	}
815 
816 	col = tp->t_column;
817 	switch (CCLASS(c)) {
818 	case BACKSPACE:
819 		if (col > 0)
820 			--col;
821 		break;
822 	case CONTROL:
823 		break;
824 	case NEWLINE:
825 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
826 			col = 0;
827 		break;
828 	case RETURN:
829 		col = 0;
830 		break;
831 	case ORDINARY:
832 		++col;
833 		break;
834 	case TAB:
835 		col = (col + 8) & ~7;
836 		break;
837 	}
838 	tp->t_column = col;
839 	lwkt_reltoken(&tty_token);
840 	return (-1);
841 }
842 
843 /*
844  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
845  * has been called to do discipline-specific functions and/or reject any
846  * of these ioctl commands.
847  */
848 /* ARGSUSED */
849 int
850 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
851 {
852 	struct thread *td = curthread;
853 	struct lwp *lp = td->td_lwp;
854 	struct proc *p = td->td_proc;
855 	struct pgrp *opgrp;
856 	struct tty *otp;
857 	int error;
858 
859 	KKASSERT(p);
860 	lwkt_gettoken(&tty_token);
861 	lwkt_gettoken(&proc_token);
862 
863 	/* If the ioctl involves modification, hang if in the background. */
864 	switch (cmd) {
865 	case  TIOCCBRK:
866 	case  TIOCCONS:
867 	case  TIOCDRAIN:
868 	case  TIOCEXCL:
869 	case  TIOCFLUSH:
870 #ifdef TIOCHPCL
871 	case  TIOCHPCL:
872 #endif
873 	case  TIOCNXCL:
874 	case  TIOCSBRK:
875 	case  TIOCSCTTY:
876 	case  TIOCSDRAINWAIT:
877 	case  TIOCSETA:
878 	case  TIOCSETAF:
879 	case  TIOCSETAW:
880 	case  TIOCSETD:
881 	case  TIOCSPGRP:
882 	case  TIOCSTART:
883 	case  TIOCSTAT:
884 	case  TIOCSTI:
885 	case  TIOCSTOP:
886 	case  TIOCSWINSZ:
887 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
888 	case  TIOCLBIC:
889 	case  TIOCLBIS:
890 	case  TIOCLSET:
891 	case  TIOCSETC:
892 	case OTIOCSETD:
893 	case  TIOCSETN:
894 	case  TIOCSETP:
895 	case  TIOCSLTC:
896 #endif
897 		while (isbackground(p, tp) && !(p->p_flag & P_PPWAIT) &&
898 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
899 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
900 			if (p->p_pgrp->pg_jobc == 0) {
901 				lwkt_reltoken(&proc_token);
902 				lwkt_reltoken(&tty_token);
903 				return (EIO);
904 			}
905 			pgsignal(p->p_pgrp, SIGTTOU, 1);
906 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
907 					 0);
908 			if (error) {
909 				lwkt_reltoken(&proc_token);
910 				lwkt_reltoken(&tty_token);
911 				return (error);
912 			}
913 		}
914 		break;
915 	}
916 
917 	switch (cmd) {			/* Process the ioctl. */
918 	case FIOASYNC:			/* set/clear async i/o */
919 		crit_enter();
920 		if (*(int *)data)
921 			SET(tp->t_state, TS_ASYNC);
922 		else
923 			CLR(tp->t_state, TS_ASYNC);
924 		crit_exit();
925 		break;
926 	case FIONREAD:			/* get # bytes to read */
927 		crit_enter();
928 		*(int *)data = ttnread(tp);
929 		crit_exit();
930 		break;
931 
932 	case FIOSETOWN:
933 		/*
934 		 * Policy -- Don't allow FIOSETOWN on someone else's
935 		 *           controlling tty
936 		 */
937 		if (tp->t_session != NULL && !isctty(p, tp)) {
938 			lwkt_reltoken(&proc_token);
939 			lwkt_reltoken(&tty_token);
940 			return (ENOTTY);
941 		}
942 
943 		error = fsetown(*(int *)data, &tp->t_sigio);
944 		if (error) {
945 			lwkt_reltoken(&proc_token);
946 			lwkt_reltoken(&tty_token);
947 			return (error);
948 		}
949 		break;
950 	case FIOGETOWN:
951 		if (tp->t_session != NULL && !isctty(p, tp)) {
952 			lwkt_reltoken(&proc_token);
953 			lwkt_reltoken(&tty_token);
954 			return (ENOTTY);
955 		}
956 		*(int *)data = fgetown(&tp->t_sigio);
957 		break;
958 
959 	case TIOCEXCL:			/* set exclusive use of tty */
960 		crit_enter();
961 		SET(tp->t_state, TS_XCLUDE);
962 		crit_exit();
963 		break;
964 	case TIOCFLUSH: {		/* flush buffers */
965 		int flags = *(int *)data;
966 
967 		if (flags == 0)
968 			flags = FREAD | FWRITE;
969 		else
970 			flags &= FREAD | FWRITE;
971 		ttyflush(tp, flags);
972 		break;
973 	}
974 	case TIOCCONS:			/* become virtual console */
975 		if (*(int *)data) {
976 			if (constty && constty != tp &&
977 			    ISSET(constty->t_state, TS_CONNECTED)) {
978 				lwkt_reltoken(&proc_token);
979 				lwkt_reltoken(&tty_token);
980 				return (EBUSY);
981 			}
982 #ifndef	UCONSOLE
983 			if ((error = priv_check(td, PRIV_ROOT)) != 0) {
984 				lwkt_reltoken(&proc_token);
985 				lwkt_reltoken(&tty_token);
986 				return (error);
987 			}
988 #endif
989 			constty = tp;
990 		} else if (tp == constty)
991 			constty = NULL;
992 		break;
993 	case TIOCDRAIN:			/* wait till output drained */
994 		error = ttywait(tp);
995 		if (error) {
996 			lwkt_reltoken(&proc_token);
997 			lwkt_reltoken(&tty_token);
998 			return (error);
999 		}
1000 		break;
1001 	case TIOCGETA: {		/* get termios struct */
1002 		struct termios *t = (struct termios *)data;
1003 
1004 		bcopy(&tp->t_termios, t, sizeof(struct termios));
1005 		break;
1006 	}
1007 	case TIOCGETD:			/* get line discipline */
1008 		*(int *)data = tp->t_line;
1009 		break;
1010 	case TIOCGWINSZ:		/* get window size */
1011 		*(struct winsize *)data = tp->t_winsize;
1012 		break;
1013 	case TIOCGPGRP:			/* get pgrp of tty */
1014 		if (!isctty(p, tp)) {
1015 			lwkt_reltoken(&proc_token);
1016 			lwkt_reltoken(&tty_token);
1017 			return (ENOTTY);
1018 		}
1019 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1020 		break;
1021 	case TIOCGSID:                  /* get sid of tty */
1022 		if (!isctty(p, tp)) {
1023 			lwkt_reltoken(&proc_token);
1024 			lwkt_reltoken(&tty_token);
1025 			return (ENOTTY);
1026 		}
1027 		*(int *)data = tp->t_session->s_sid;
1028 		break;
1029 #ifdef TIOCHPCL
1030 	case TIOCHPCL:			/* hang up on last close */
1031 		crit_enter();
1032 		SET(tp->t_cflag, HUPCL);
1033 		crit_exit();
1034 		break;
1035 #endif
1036 	case TIOCNXCL:			/* reset exclusive use of tty */
1037 		crit_enter();
1038 		CLR(tp->t_state, TS_XCLUDE);
1039 		crit_exit();
1040 		break;
1041 	case TIOCOUTQ:			/* output queue size */
1042 		*(int *)data = tp->t_outq.c_cc;
1043 		break;
1044 	case TIOCSETA:			/* set termios struct */
1045 	case TIOCSETAW:			/* drain output, set */
1046 	case TIOCSETAF: {		/* drn out, fls in, set */
1047 		struct termios *t = (struct termios *)data;
1048 
1049 		if (t->c_ispeed == 0)
1050 			t->c_ispeed = t->c_ospeed;
1051 		if (t->c_ispeed == 0)
1052 			t->c_ispeed = tp->t_ospeed;
1053 		if (t->c_ispeed == 0) {
1054 			lwkt_reltoken(&proc_token);
1055 			lwkt_reltoken(&tty_token);
1056 			return (EINVAL);
1057 		}
1058 		crit_enter();
1059 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1060 			error = ttywait(tp);
1061 			if (error) {
1062 				crit_exit();
1063 				lwkt_reltoken(&proc_token);
1064 				lwkt_reltoken(&tty_token);
1065 				return (error);
1066 			}
1067 			if (cmd == TIOCSETAF)
1068 				ttyflush(tp, FREAD);
1069 		}
1070 		if (!ISSET(t->c_cflag, CIGNORE)) {
1071 			/*
1072 			 * Set device hardware.
1073 			 */
1074 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1075 				crit_exit();
1076 				lwkt_reltoken(&proc_token);
1077 				lwkt_reltoken(&tty_token);
1078 				return (error);
1079 			}
1080 			if (ISSET(t->c_cflag, CLOCAL) &&
1081 			    !ISSET(tp->t_cflag, CLOCAL)) {
1082 				/*
1083 				 * XXX disconnections would be too hard to
1084 				 * get rid of without this kludge.  The only
1085 				 * way to get rid of controlling terminals
1086 				 * is to exit from the session leader.
1087 				 */
1088 				CLR(tp->t_state, TS_ZOMBIE);
1089 
1090 				wakeup(TSA_CARR_ON(tp));
1091 				ttwakeup(tp);
1092 				ttwwakeup(tp);
1093 			}
1094 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1095 			     ISSET(t->c_cflag, CLOCAL)) &&
1096 			    !ISSET(tp->t_state, TS_ZOMBIE))
1097 				SET(tp->t_state, TS_CONNECTED);
1098 			else
1099 				CLR(tp->t_state, TS_CONNECTED);
1100 			tp->t_cflag = t->c_cflag;
1101 			tp->t_ispeed = t->c_ispeed;
1102 			if (t->c_ospeed != 0)
1103 				tp->t_ospeed = t->c_ospeed;
1104 			ttsetwater(tp);
1105 		}
1106 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1107 		    cmd != TIOCSETAF) {
1108 			if (ISSET(t->c_lflag, ICANON))
1109 				SET(tp->t_lflag, PENDIN);
1110 			else {
1111 				/*
1112 				 * XXX we really shouldn't allow toggling
1113 				 * ICANON while we're in a non-termios line
1114 				 * discipline.  Now we have to worry about
1115 				 * panicing for a null queue.
1116 				 */
1117 				if (tp->t_canq.c_cbreserved > 0 &&
1118 				    tp->t_rawq.c_cbreserved > 0) {
1119 					catq(&tp->t_rawq, &tp->t_canq);
1120 					/*
1121 					 * XXX the queue limits may be
1122 					 * different, so the old queue
1123 					 * swapping method no longer works.
1124 					 */
1125 					catq(&tp->t_canq, &tp->t_rawq);
1126 				}
1127 				CLR(tp->t_lflag, PENDIN);
1128 			}
1129 			ttwakeup(tp);
1130 		}
1131 		tp->t_iflag = t->c_iflag;
1132 		tp->t_oflag = t->c_oflag;
1133 		/*
1134 		 * Make the EXTPROC bit read only.
1135 		 */
1136 		if (ISSET(tp->t_lflag, EXTPROC))
1137 			SET(t->c_lflag, EXTPROC);
1138 		else
1139 			CLR(t->c_lflag, EXTPROC);
1140 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1141 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1142 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1143 			ttwakeup(tp);
1144 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1145 		crit_exit();
1146 		break;
1147 	}
1148 	case TIOCSETD: {		/* set line discipline */
1149 		int t = *(int *)data;
1150 		cdev_t device = tp->t_dev;
1151 
1152 		if ((u_int)t >= nlinesw) {
1153 			lwkt_reltoken(&proc_token);
1154 			lwkt_reltoken(&tty_token);
1155 			return (ENXIO);
1156 		}
1157 		if (t != tp->t_line) {
1158 			crit_enter();
1159 			(*linesw[tp->t_line].l_close)(tp, flag);
1160 			error = (*linesw[t].l_open)(device, tp);
1161 			if (error) {
1162 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1163 				crit_exit();
1164 				lwkt_reltoken(&proc_token);
1165 				lwkt_reltoken(&tty_token);
1166 				return (error);
1167 			}
1168 			tp->t_line = t;
1169 			crit_exit();
1170 		}
1171 		break;
1172 	}
1173 	case TIOCSTART:			/* start output, like ^Q */
1174 		crit_enter();
1175 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1176 		    ISSET(tp->t_lflag, FLUSHO)) {
1177 			CLR(tp->t_lflag, FLUSHO);
1178 			CLR(tp->t_state, TS_TTSTOP);
1179 			ttstart(tp);
1180 		}
1181 		crit_exit();
1182 		break;
1183 	case TIOCSTI:			/* simulate terminal input */
1184 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT)) {
1185 			lwkt_reltoken(&proc_token);
1186 			lwkt_reltoken(&tty_token);
1187 			return (EPERM);
1188 		}
1189 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT)) {
1190 			lwkt_reltoken(&proc_token);
1191 			lwkt_reltoken(&tty_token);
1192 			return (EACCES);
1193 		}
1194 		crit_enter();
1195 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1196 		crit_exit();
1197 		break;
1198 	case TIOCSTOP:			/* stop output, like ^S */
1199 		crit_enter();
1200 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1201 			SET(tp->t_state, TS_TTSTOP);
1202 			(*tp->t_stop)(tp, 0);
1203 		}
1204 		crit_exit();
1205 		break;
1206 	case TIOCSCTTY:			/* become controlling tty */
1207 		/* Session ctty vnode pointer set in vnode layer. */
1208 		if (!SESS_LEADER(p) ||
1209 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1210 		    (tp->t_session != p->p_session))) {
1211 			lwkt_reltoken(&proc_token);
1212 			lwkt_reltoken(&tty_token);
1213 			return (EPERM);
1214 		}
1215 		ttyhold(tp);
1216 		tp->t_session = p->p_session;
1217 		opgrp = tp->t_pgrp;
1218 		pgref(p->p_pgrp);
1219 		tp->t_pgrp = p->p_pgrp;
1220 		otp = p->p_session->s_ttyp;
1221 		p->p_session->s_ttyp = tp;
1222 		p->p_flag |= P_CONTROLT;
1223 		if (otp)
1224 			ttyunhold(otp);
1225 		if (opgrp) {
1226 			pgrel(opgrp);
1227 			opgrp = NULL;
1228 		}
1229 		break;
1230 	case TIOCSPGRP: {		/* set pgrp of tty */
1231 		pid_t pgid = *(int *)data;
1232 
1233 		if (!isctty(p, tp)) {
1234 			lwkt_reltoken(&proc_token);
1235 			lwkt_reltoken(&tty_token);
1236 			return (ENOTTY);
1237 		}
1238 		else if (pgid < 1 || pgid > PID_MAX) {
1239 			lwkt_reltoken(&proc_token);
1240 			lwkt_reltoken(&tty_token);
1241 			return (EINVAL);
1242 		} else {
1243 			struct pgrp *pgrp = pgfind(pgid);
1244 			if (pgrp == NULL || pgrp->pg_session != p->p_session) {
1245 				if (pgrp)
1246 					pgrel(pgrp);
1247 				lwkt_reltoken(&proc_token);
1248 				lwkt_reltoken(&tty_token);
1249 				return (EPERM);
1250 			}
1251 			opgrp = tp->t_pgrp;
1252 			tp->t_pgrp = pgrp;
1253 			if (opgrp) {
1254 				pgrel(opgrp);
1255 				opgrp = NULL;
1256 			}
1257 		}
1258 		break;
1259 	}
1260 	case TIOCSTAT:			/* simulate control-T */
1261 		crit_enter();
1262 		ttyinfo(tp);
1263 		crit_exit();
1264 		break;
1265 	case TIOCSWINSZ:		/* set window size */
1266 		if (bcmp((caddr_t)&tp->t_winsize, data,
1267 		    sizeof (struct winsize))) {
1268 			tp->t_winsize = *(struct winsize *)data;
1269 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1270 		}
1271 		break;
1272 	case TIOCSDRAINWAIT:
1273 		error = priv_check(td, PRIV_ROOT);
1274 		if (error) {
1275 			lwkt_reltoken(&proc_token);
1276 			lwkt_reltoken(&tty_token);
1277 			return (error);
1278 		}
1279 		tp->t_timeout = *(int *)data * hz;
1280 		wakeup(TSA_OCOMPLETE(tp));
1281 		wakeup(TSA_OLOWAT(tp));
1282 		break;
1283 	case TIOCGDRAINWAIT:
1284 		*(int *)data = tp->t_timeout / hz;
1285 		break;
1286 	default:
1287 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
1288 		lwkt_reltoken(&proc_token);
1289 		lwkt_reltoken(&tty_token);
1290 		return (ttcompat(tp, cmd, data, flag));
1291 #else
1292 		lwkt_reltoken(&proc_token);
1293 		lwkt_reltoken(&tty_token);
1294 		return (ENOIOCTL);
1295 #endif
1296 	}
1297 	lwkt_reltoken(&proc_token);
1298 	lwkt_reltoken(&tty_token);
1299 	return (0);
1300 }
1301 
1302 static struct filterops ttyread_filtops =
1303 	{ FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ttyrdetach, filt_ttyread };
1304 static struct filterops ttywrite_filtops =
1305 	{ FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ttywdetach, filt_ttywrite };
1306 
1307 int
1308 ttykqfilter(struct dev_kqfilter_args *ap)
1309 {
1310 	cdev_t dev = ap->a_head.a_dev;
1311 	struct knote *kn = ap->a_kn;
1312 	struct tty *tp = dev->si_tty;
1313 	struct klist *klist;
1314 
1315 	ap->a_result = 0;
1316 
1317 	lwkt_gettoken(&tty_token);
1318 	switch (kn->kn_filter) {
1319 	case EVFILT_READ:
1320 		klist = &tp->t_rkq.ki_note;
1321 		kn->kn_fop = &ttyread_filtops;
1322 		break;
1323 	case EVFILT_WRITE:
1324 		klist = &tp->t_wkq.ki_note;
1325 		kn->kn_fop = &ttywrite_filtops;
1326 		break;
1327 	default:
1328 		ap->a_result = EOPNOTSUPP;
1329 		lwkt_reltoken(&tty_token);
1330 		return (0);
1331 	}
1332 	lwkt_reltoken(&tty_token);
1333 	kn->kn_hook = (caddr_t)dev;
1334 	knote_insert(klist, kn);
1335 
1336 	return (0);
1337 }
1338 
1339 static void
1340 filt_ttyrdetach(struct knote *kn)
1341 {
1342 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1343 
1344 	lwkt_gettoken(&tty_token);
1345 	knote_remove(&tp->t_rkq.ki_note, kn);
1346 	lwkt_reltoken(&tty_token);
1347 }
1348 
1349 static int
1350 filt_ttyread(struct knote *kn, long hint)
1351 {
1352 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1353 
1354 	lwkt_gettoken(&tty_token);
1355 	kn->kn_data = ttnread(tp);
1356 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1357 		kn->kn_flags |= EV_EOF;
1358 		lwkt_reltoken(&tty_token);
1359 		return (1);
1360 	}
1361 	lwkt_reltoken(&tty_token);
1362 	return (kn->kn_data > 0);
1363 }
1364 
1365 static void
1366 filt_ttywdetach(struct knote *kn)
1367 {
1368 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1369 
1370 	lwkt_gettoken(&tty_token);
1371 	knote_remove(&tp->t_wkq.ki_note, kn);
1372 	lwkt_reltoken(&tty_token);
1373 }
1374 
1375 static int
1376 filt_ttywrite(struct knote *kn, long hint)
1377 {
1378 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1379 	int ret;
1380 
1381 	lwkt_gettoken(&tty_token);
1382 	kn->kn_data = tp->t_outq.c_cc;
1383 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1384 		lwkt_reltoken(&tty_token);
1385 		return (1);
1386 	}
1387 	ret = (kn->kn_data <= tp->t_olowat &&
1388 	    ISSET(tp->t_state, TS_CONNECTED));
1389 	lwkt_reltoken(&tty_token);
1390 	return ret;
1391 }
1392 
1393 /*
1394  * Must be called while in a critical section.
1395  * NOTE: tty_token must be held.
1396  */
1397 static int
1398 ttnread(struct tty *tp)
1399 {
1400 	int nread;
1401 
1402 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
1403 	if (ISSET(tp->t_lflag, PENDIN))
1404 		ttypend(tp);
1405 	nread = tp->t_canq.c_cc;
1406 	if (!ISSET(tp->t_lflag, ICANON)) {
1407 		nread += tp->t_rawq.c_cc;
1408 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1409 			nread = 0;
1410 	}
1411 	return (nread);
1412 }
1413 
1414 /*
1415  * Wait for output to drain.
1416  */
1417 int
1418 ttywait(struct tty *tp)
1419 {
1420 	int error;
1421 
1422 	error = 0;
1423 	crit_enter();
1424 	lwkt_gettoken(&tty_token);
1425 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1426 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1427 		(*tp->t_oproc)(tp);
1428 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1429 		    ISSET(tp->t_state, TS_CONNECTED)) {
1430 			SET(tp->t_state, TS_SO_OCOMPLETE);
1431 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1432 					 PCATCH, "ttywai",
1433 					 tp->t_timeout);
1434 			if (error) {
1435 				if (error == EWOULDBLOCK)
1436 					error = EIO;
1437 				break;
1438 			}
1439 		} else
1440 			break;
1441 	}
1442 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1443 		error = EIO;
1444 	lwkt_reltoken(&tty_token);
1445 	crit_exit();
1446 	return (error);
1447 }
1448 
1449 /*
1450  * Flush if successfully wait.
1451  */
1452 static int
1453 ttywflush(struct tty *tp)
1454 {
1455 	int error;
1456 
1457 	if ((error = ttywait(tp)) == 0)
1458 		ttyflush(tp, FREAD);
1459 	return (error);
1460 }
1461 
1462 /*
1463  * Flush tty read and/or write queues, notifying anyone waiting.
1464  */
1465 void
1466 ttyflush(struct tty *tp, int rw)
1467 {
1468 	crit_enter();
1469 	lwkt_gettoken(&tty_token);
1470 #if 0
1471 again:
1472 #endif
1473 	if (rw & FWRITE) {
1474 		FLUSHQ(&tp->t_outq);
1475 		CLR(tp->t_state, TS_TTSTOP);
1476 	}
1477 	(*tp->t_stop)(tp, rw);
1478 	if (rw & FREAD) {
1479 		FLUSHQ(&tp->t_canq);
1480 		FLUSHQ(&tp->t_rawq);
1481 		CLR(tp->t_lflag, PENDIN);
1482 		tp->t_rocount = 0;
1483 		tp->t_rocol = 0;
1484 		CLR(tp->t_state, TS_LOCAL);
1485 		ttwakeup(tp);
1486 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1487 			if (rw & FWRITE)
1488 				FLUSHQ(&tp->t_outq);
1489 			ttyunblock(tp);
1490 
1491 			/*
1492 			 * Don't let leave any state that might clobber the
1493 			 * next line discipline (although we should do more
1494 			 * to send the START char).  Not clearing the state
1495 			 * may have caused the "putc to a clist with no
1496 			 * reserved cblocks" panic/kprintf.
1497 			 */
1498 			CLR(tp->t_state, TS_TBLOCK);
1499 
1500 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1501 			if (ISSET(tp->t_iflag, IXOFF)) {
1502 				/*
1503 				 * XXX wait a bit in the hope that the stop
1504 				 * character (if any) will go out.  Waiting
1505 				 * isn't good since it allows races.  This
1506 				 * will be fixed when the stop character is
1507 				 * put in a special queue.  Don't bother with
1508 				 * the checks in ttywait() since the timeout
1509 				 * will save us.
1510 				 */
1511 				SET(tp->t_state, TS_SO_OCOMPLETE);
1512 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1513 					 "ttyfls", hz / 10);
1514 				/*
1515 				 * Don't try sending the stop character again.
1516 				 */
1517 				CLR(tp->t_state, TS_TBLOCK);
1518 				goto again;
1519 			}
1520 #endif
1521 		}
1522 	}
1523 	if (rw & FWRITE) {
1524 		FLUSHQ(&tp->t_outq);
1525 		ttwwakeup(tp);
1526 	}
1527 	lwkt_reltoken(&tty_token);
1528 	crit_exit();
1529 }
1530 
1531 /*
1532  * Copy in the default termios characters.
1533  */
1534 void
1535 termioschars(struct termios *t)
1536 {
1537 	lwkt_gettoken(&tty_token);
1538 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1539 	lwkt_reltoken(&tty_token);
1540 }
1541 
1542 /*
1543  * Old interface.
1544  */
1545 void
1546 ttychars(struct tty *tp)
1547 {
1548 	lwkt_gettoken(&tty_token);
1549 	termioschars(&tp->t_termios);
1550 	lwkt_reltoken(&tty_token);
1551 }
1552 
1553 /*
1554  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1555  * on our input flow control bit and propagate the changes to the driver.
1556  * XXX the stop character should be put in a special high priority queue.
1557  */
1558 void
1559 ttyblock(struct tty *tp)
1560 {
1561 	lwkt_gettoken(&tty_token);
1562 	SET(tp->t_state, TS_TBLOCK);
1563 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1564 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1565 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1566 	ttstart(tp);
1567 	lwkt_reltoken(&tty_token);
1568 }
1569 
1570 /*
1571  * Handle input low water.  Send start character for the IXOFF case.  Turn
1572  * off our input flow control bit and propagate the changes to the driver.
1573  * XXX the start character should be put in a special high priority queue.
1574  */
1575 static void
1576 ttyunblock(struct tty *tp)
1577 {
1578 	lwkt_gettoken(&tty_token);
1579 	CLR(tp->t_state, TS_TBLOCK);
1580 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1581 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1582 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1583 	ttstart(tp);
1584 	lwkt_reltoken(&tty_token);
1585 }
1586 
1587 #ifdef notyet
1588 /* Not used by any current (i386) drivers. */
1589 /*
1590  * Restart after an inter-char delay.
1591  */
1592 void
1593 ttrstrt(void *tp_arg)
1594 {
1595 	struct tty *tp;
1596 
1597 	KASSERT(tp_arg != NULL, ("ttrstrt"));
1598 
1599 	tp = tp_arg;
1600 	crit_enter();
1601 	lwkt_gettoken(&tty_token);
1602 	CLR(tp->t_state, TS_TIMEOUT);
1603 	ttstart(tp);
1604 	lwkt_reltoken(&tty_token);
1605 	crit_exit();
1606 }
1607 #endif
1608 
1609 int
1610 ttstart(struct tty *tp)
1611 {
1612 	lwkt_gettoken(&tty_token);
1613 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1614 		(*tp->t_oproc)(tp);
1615 	lwkt_reltoken(&tty_token);
1616 	return (0);
1617 }
1618 
1619 /*
1620  * "close" a line discipline
1621  */
1622 int
1623 ttylclose(struct tty *tp, int flag)
1624 {
1625 	lwkt_gettoken(&tty_token);
1626 	if (flag & FNONBLOCK || ttywflush(tp))
1627 		ttyflush(tp, FREAD | FWRITE);
1628 	lwkt_reltoken(&tty_token);
1629 	return (0);
1630 }
1631 
1632 void
1633 ttyhold(struct tty *tp)
1634 {
1635 	++tp->t_refs;
1636 }
1637 
1638 void
1639 ttyunhold(struct tty *tp)
1640 {
1641 	if (tp->t_unhold)
1642 		tp->t_unhold(tp);
1643 	else
1644 		--tp->t_refs;
1645 }
1646 
1647 /*
1648  * Handle modem control transition on a tty.
1649  * Flag indicates new state of carrier.
1650  * Returns 0 if the line should be turned off, otherwise 1.
1651  */
1652 int
1653 ttymodem(struct tty *tp, int flag)
1654 {
1655 	lwkt_gettoken(&tty_token);
1656 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1657 		/*
1658 		 * MDMBUF: do flow control according to carrier flag
1659 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1660 		 * works if IXON and IXANY are clear.
1661 		 */
1662 		if (flag) {
1663 			CLR(tp->t_state, TS_CAR_OFLOW);
1664 			CLR(tp->t_state, TS_TTSTOP);
1665 			ttstart(tp);
1666 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1667 			SET(tp->t_state, TS_CAR_OFLOW);
1668 			SET(tp->t_state, TS_TTSTOP);
1669 			(*tp->t_stop)(tp, 0);
1670 		}
1671 	} else if (flag == 0) {
1672 		/*
1673 		 * Lost carrier.
1674 		 */
1675 		CLR(tp->t_state, TS_CARR_ON);
1676 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1677 		    !ISSET(tp->t_cflag, CLOCAL)) {
1678 			SET(tp->t_state, TS_ZOMBIE);
1679 			CLR(tp->t_state, TS_CONNECTED);
1680 			if (tp->t_session && tp->t_session->s_leader)
1681 				ksignal(tp->t_session->s_leader, SIGHUP);
1682 			ttyflush(tp, FREAD | FWRITE);
1683 			lwkt_reltoken(&tty_token);
1684 			return (0);
1685 		}
1686 	} else {
1687 		/*
1688 		 * Carrier now on.
1689 		 */
1690 		SET(tp->t_state, TS_CARR_ON);
1691 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1692 			SET(tp->t_state, TS_CONNECTED);
1693 		wakeup(TSA_CARR_ON(tp));
1694 		ttwakeup(tp);
1695 		ttwwakeup(tp);
1696 	}
1697 	lwkt_reltoken(&tty_token);
1698 	return (1);
1699 }
1700 
1701 /*
1702  * Reinput pending characters after state switch
1703  * call from a critical section.
1704  */
1705 static void
1706 ttypend(struct tty *tp)
1707 {
1708 	struct clist tq;
1709 	int c;
1710 
1711 	lwkt_gettoken(&tty_token);
1712 	CLR(tp->t_lflag, PENDIN);
1713 	SET(tp->t_state, TS_TYPEN);
1714 	/*
1715 	 * XXX this assumes too much about clist internals.  It may even
1716 	 * fail if the cblock slush pool is empty.  We can't allocate more
1717 	 * cblocks here because we are called from an interrupt handler
1718 	 * and clist_alloc_cblocks() can wait.
1719 	 */
1720 	tq = tp->t_rawq;
1721 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1722 	tp->t_rawq.c_cbmax = tq.c_cbmax;
1723 	tp->t_rawq.c_cbreserved = tq.c_cbreserved;
1724 	while ((c = clist_getc(&tq)) >= 0)
1725 		ttyinput(c, tp);
1726 	CLR(tp->t_state, TS_TYPEN);
1727 	lwkt_reltoken(&tty_token);
1728 }
1729 
1730 /*
1731  * Process a read call on a tty device.
1732  */
1733 int
1734 ttread(struct tty *tp, struct uio *uio, int flag)
1735 {
1736 	struct clist *qp;
1737 	int c;
1738 	tcflag_t lflag;
1739 	cc_t *cc = tp->t_cc;
1740 	struct proc *pp;
1741 	struct lwp *lp;
1742 	int first, error = 0;
1743 	int has_stime = 0, last_cc = 0;
1744 	long slp = 0;		/* XXX this should be renamed `timo'. */
1745 	struct timeval stime;
1746 
1747 	lp = curthread->td_lwp;
1748 	stime.tv_sec = 0;	/* fix compiler warnings */
1749 	stime.tv_usec = 0;
1750 
1751 	lwkt_gettoken(&tty_token);
1752 loop:
1753 	crit_enter();
1754 	lflag = tp->t_lflag;
1755 	/*
1756 	 * take pending input first
1757 	 */
1758 	if (ISSET(lflag, PENDIN)) {
1759 		ttypend(tp);
1760 		splz();		/* reduce latency */
1761 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1762 	}
1763 
1764 	/*
1765 	 * Hang process if it's in the background.
1766 	 */
1767 	lwkt_gettoken(&proc_token);
1768 	if ((pp = curproc) && isbackground(pp, tp)) {
1769 		crit_exit();
1770 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1771 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1772 		    (pp->p_flag & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0) {
1773 			lwkt_reltoken(&proc_token);
1774 			lwkt_reltoken(&tty_token);
1775 			return (EIO);
1776 		}
1777 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1778 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1779 		if (error) {
1780 			lwkt_reltoken(&proc_token);
1781 			lwkt_reltoken(&tty_token);
1782 			return (error);
1783 		}
1784 		lwkt_reltoken(&proc_token);
1785 		goto loop;
1786 	}
1787 	lwkt_reltoken(&proc_token);
1788 
1789 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1790 		crit_exit();
1791 		lwkt_reltoken(&tty_token);
1792 		return (0);	/* EOF */
1793 	}
1794 
1795 	/*
1796 	 * If canonical, use the canonical queue,
1797 	 * else use the raw queue.
1798 	 *
1799 	 * (should get rid of clists...)
1800 	 */
1801 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1802 
1803 	if (flag & IO_NDELAY) {
1804 		if (qp->c_cc > 0)
1805 			goto read;
1806 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1807 			crit_exit();
1808 			lwkt_reltoken(&tty_token);
1809 			return (0);
1810 		}
1811 		crit_exit();
1812 		lwkt_reltoken(&tty_token);
1813 		return (EWOULDBLOCK);
1814 	}
1815 	if (!ISSET(lflag, ICANON)) {
1816 		int m = cc[VMIN];
1817 		long t = cc[VTIME];
1818 		struct timeval timecopy;
1819 
1820 		/*
1821 		 * Check each of the four combinations.
1822 		 * (m > 0 && t == 0) is the normal read case.
1823 		 * It should be fairly efficient, so we check that and its
1824 		 * companion case (m == 0 && t == 0) first.
1825 		 * For the other two cases, we compute the target sleep time
1826 		 * into slp.
1827 		 */
1828 		if (t == 0) {
1829 			if (qp->c_cc < m)
1830 				goto sleep;
1831 			if (qp->c_cc > 0)
1832 				goto read;
1833 
1834 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1835 			crit_exit();
1836 			lwkt_reltoken(&tty_token);
1837 			return (0);
1838 		}
1839 		t *= 100000;		/* time in us */
1840 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1841 			 ((t1).tv_usec - (t2).tv_usec))
1842 		if (m > 0) {
1843 			if (qp->c_cc <= 0)
1844 				goto sleep;
1845 			if (qp->c_cc >= m)
1846 				goto read;
1847 			getmicrotime(&timecopy);
1848 			if (has_stime == 0) {
1849 				/* first character, start timer */
1850 				has_stime = 1;
1851 				stime = timecopy;
1852 				slp = t;
1853 			} else if (qp->c_cc > last_cc) {
1854 				/* got a character, restart timer */
1855 				stime = timecopy;
1856 				slp = t;
1857 			} else {
1858 				/* nothing, check expiration */
1859 				slp = t - diff(timecopy, stime);
1860 				if (slp <= 0)
1861 					goto read;
1862 			}
1863 			last_cc = qp->c_cc;
1864 		} else {	/* m == 0 */
1865 			if (qp->c_cc > 0)
1866 				goto read;
1867 			getmicrotime(&timecopy);
1868 			if (has_stime == 0) {
1869 				has_stime = 1;
1870 				stime = timecopy;
1871 				slp = t;
1872 			} else {
1873 				slp = t - diff(timecopy, stime);
1874 				if (slp <= 0) {
1875 					/* Timed out, but 0 is enough input. */
1876 					crit_exit();
1877 					lwkt_reltoken(&tty_token);
1878 					return (0);
1879 				}
1880 			}
1881 		}
1882 #undef diff
1883 		/*
1884 		 * Rounding down may make us wake up just short
1885 		 * of the target, so we round up.
1886 		 * The formula is ceiling(slp * hz/1000000).
1887 		 * 32-bit arithmetic is enough for hz < 169.
1888 		 * XXX see tvtohz() for how to avoid overflow if hz
1889 		 * is large (divide by `tick' and/or arrange to
1890 		 * use tvtohz() if hz is large).
1891 		 */
1892 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1893 		goto sleep;
1894 	}
1895 	if (qp->c_cc <= 0) {
1896 sleep:
1897 		/*
1898 		 * There is no input, or not enough input and we can block.
1899 		 */
1900 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1901 				 ISSET(tp->t_state, TS_CONNECTED) ?
1902 				 "ttyin" : "ttyhup", (int)slp);
1903 		crit_exit();
1904 		if (error == EWOULDBLOCK)
1905 			error = 0;
1906 		else if (error) {
1907 			lwkt_reltoken(&tty_token);
1908 			return (error);
1909 		}
1910 		/*
1911 		 * XXX what happens if another process eats some input
1912 		 * while we are asleep (not just here)?  It would be
1913 		 * safest to detect changes and reset our state variables
1914 		 * (has_stime and last_cc).
1915 		 */
1916 		slp = 0;
1917 		goto loop;
1918 	}
1919 read:
1920 	crit_exit();
1921 	/*
1922 	 * Input present, check for input mapping and processing.
1923 	 */
1924 	first = 1;
1925 	if (ISSET(lflag, ICANON | ISIG))
1926 		goto slowcase;
1927 	for (;;) {
1928 		char ibuf[IBUFSIZ];
1929 		int icc;
1930 
1931 		icc = (int)szmin(uio->uio_resid, IBUFSIZ);
1932 		icc = q_to_b(qp, ibuf, icc);
1933 		if (icc <= 0) {
1934 			if (first)
1935 				goto loop;
1936 			break;
1937 		}
1938 		error = uiomove(ibuf, (size_t)icc, uio);
1939 		/*
1940 		 * XXX if there was an error then we should ungetc() the
1941 		 * unmoved chars and reduce icc here.
1942 		 */
1943 		if (error)
1944 			break;
1945  		if (uio->uio_resid == 0)
1946 			break;
1947 		first = 0;
1948 	}
1949 	goto out;
1950 slowcase:
1951 	for (;;) {
1952 		c = clist_getc(qp);
1953 		if (c < 0) {
1954 			if (first)
1955 				goto loop;
1956 			break;
1957 		}
1958 		/*
1959 		 * delayed suspend (^Y)
1960 		 */
1961 		if (CCEQ(cc[VDSUSP], c) &&
1962 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1963 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1964 			if (first) {
1965 				error = ttysleep(tp, &lbolt, PCATCH,
1966 						 "ttybg3", 0);
1967 				if (error)
1968 					break;
1969 				goto loop;
1970 			}
1971 			break;
1972 		}
1973 		/*
1974 		 * Interpret EOF only in canonical mode.
1975 		 */
1976 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1977 			break;
1978 		/*
1979 		 * Give user character.
1980 		 */
1981  		error = ureadc(c, uio);
1982 		if (error)
1983 			/* XXX should ungetc(c, qp). */
1984 			break;
1985  		if (uio->uio_resid == 0)
1986 			break;
1987 		/*
1988 		 * In canonical mode check for a "break character"
1989 		 * marking the end of a "line of input".
1990 		 */
1991 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1992 			break;
1993 		first = 0;
1994 	}
1995 
1996 out:
1997 	/*
1998 	 * Look to unblock input now that (presumably)
1999 	 * the input queue has gone down.
2000 	 */
2001 	crit_enter();
2002 	if (ISSET(tp->t_state, TS_TBLOCK) &&
2003 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat)
2004 		ttyunblock(tp);
2005 	crit_exit();
2006 
2007 	lwkt_reltoken(&tty_token);
2008 	return (error);
2009 }
2010 
2011 /*
2012  * Check the output queue on tp for space for a kernel message (from uprintf
2013  * or tprintf).  Allow some space over the normal hiwater mark so we don't
2014  * lose messages due to normal flow control, but don't let the tty run amok.
2015  * Sleeps here are not interruptible, but we return prematurely if new signals
2016  * arrive.
2017  */
2018 int
2019 ttycheckoutq(struct tty *tp, int wait)
2020 {
2021 	struct lwp *lp = curthread->td_lwp;
2022 	int hiwat;
2023 	sigset_t oldset, newset;
2024 
2025 	lwkt_gettoken(&tty_token);
2026 	hiwat = tp->t_ohiwat;
2027 	SIGEMPTYSET(oldset);
2028 	SIGEMPTYSET(newset);
2029 	crit_enter();
2030 	if (wait)
2031 		oldset = lwp_sigpend(lp);
2032 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
2033 		while (tp->t_outq.c_cc > hiwat) {
2034 			ttstart(tp);
2035 			if (tp->t_outq.c_cc <= hiwat)
2036 				break;
2037 			if (wait)
2038 				newset = lwp_sigpend(lp);
2039 			if (!wait || SIGSETNEQ(oldset, newset)) {
2040 				crit_exit();
2041 				lwkt_reltoken(&tty_token);
2042 				return (0);
2043 			}
2044 			SET(tp->t_state, TS_SO_OLOWAT);
2045 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
2046 		}
2047 	}
2048 	crit_exit();
2049 	lwkt_reltoken(&tty_token);
2050 	return (1);
2051 }
2052 
2053 /*
2054  * Process a write call on a tty device.
2055  */
2056 int
2057 ttwrite(struct tty *tp, struct uio *uio, int flag)
2058 {
2059 	char *cp = NULL;
2060 	int cc, ce;
2061 	struct proc *pp;
2062 	struct lwp *lp;
2063 	int i, hiwat, error;
2064 	size_t cnt;
2065 
2066 	char obuf[OBUFSIZ];
2067 
2068 	lwkt_gettoken(&tty_token);
2069 	lp = curthread->td_lwp;
2070 	hiwat = tp->t_ohiwat;
2071 	cnt = uio->uio_resid;
2072 	error = 0;
2073 	cc = 0;
2074 loop:
2075 	crit_enter();
2076 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2077 		crit_exit();
2078 		if (uio->uio_resid == cnt)
2079 			error = EIO;
2080 		goto out;
2081 	}
2082 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2083 		if (flag & IO_NDELAY) {
2084 			crit_exit();
2085 			error = EWOULDBLOCK;
2086 			goto out;
2087 		}
2088 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
2089 		crit_exit();
2090 		if (error)
2091 			goto out;
2092 		goto loop;
2093 	}
2094 	crit_exit();
2095 
2096 	/*
2097 	 * Hang the process if it's in the background.
2098 	 */
2099 	lwkt_gettoken(&proc_token);
2100 	if ((pp = curproc) && isbackground(pp, tp) &&
2101 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flag & P_PPWAIT) &&
2102 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
2103 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
2104 		if (pp->p_pgrp->pg_jobc == 0) {
2105 			error = EIO;
2106 			lwkt_reltoken(&proc_token);
2107 			goto out;
2108 		}
2109 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
2110 		lwkt_reltoken(&proc_token);
2111 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
2112 		if (error)
2113 			goto out;
2114 		goto loop;
2115 	}
2116 	lwkt_reltoken(&proc_token);
2117 	/*
2118 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2119 	 * output translation.  Keep track of high water mark, sleep on
2120 	 * overflow awaiting device aid in acquiring new space.
2121 	 */
2122 	while (uio->uio_resid > 0 || cc > 0) {
2123 		if (ISSET(tp->t_lflag, FLUSHO)) {
2124 			uio->uio_resid = 0;
2125 			lwkt_reltoken(&tty_token);
2126 			return (0);
2127 		}
2128 		if (tp->t_outq.c_cc > hiwat)
2129 			goto ovhiwat;
2130 		/*
2131 		 * Grab a hunk of data from the user, unless we have some
2132 		 * leftover from last time.
2133 		 */
2134 		if (cc == 0) {
2135 			cc = szmin(uio->uio_resid, OBUFSIZ);
2136 			cp = obuf;
2137 			error = uiomove(cp, (size_t)cc, uio);
2138 			if (error) {
2139 				cc = 0;
2140 				break;
2141 			}
2142 		}
2143 		/*
2144 		 * If nothing fancy need be done, grab those characters we
2145 		 * can handle without any of ttyoutput's processing and
2146 		 * just transfer them to the output q.  For those chars
2147 		 * which require special processing (as indicated by the
2148 		 * bits in char_type), call ttyoutput.  After processing
2149 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2150 		 * immediately.
2151 		 */
2152 		while (cc > 0) {
2153 			if (!ISSET(tp->t_oflag, OPOST))
2154 				ce = cc;
2155 			else {
2156 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2157 						char_type, CCLASSMASK);
2158 				/*
2159 				 * If ce is zero, then we're processing
2160 				 * a special character through ttyoutput.
2161 				 */
2162 				if (ce == 0) {
2163 					tp->t_rocount = 0;
2164 					if (ttyoutput(*cp, tp) >= 0) {
2165 						/* No Clists, wait a bit. */
2166 						ttstart(tp);
2167 						if (flag & IO_NDELAY) {
2168 							error = EWOULDBLOCK;
2169 							goto out;
2170 						}
2171 						error = ttysleep(tp, &lbolt,
2172 								 PCATCH,
2173 								 "ttybf1", 0);
2174 						if (error)
2175 							goto out;
2176 						goto loop;
2177 					}
2178 					cp++;
2179 					cc--;
2180 					if (ISSET(tp->t_lflag, FLUSHO) ||
2181 					    tp->t_outq.c_cc > hiwat)
2182 						goto ovhiwat;
2183 					continue;
2184 				}
2185 			}
2186 			/*
2187 			 * A bunch of normal characters have been found.
2188 			 * Transfer them en masse to the output queue and
2189 			 * continue processing at the top of the loop.
2190 			 * If there are any further characters in this
2191 			 * <= OBUFSIZ chunk, the first should be a character
2192 			 * requiring special handling by ttyoutput.
2193 			 */
2194 			tp->t_rocount = 0;
2195 			i = b_to_q(cp, ce, &tp->t_outq);
2196 			ce -= i;
2197 			tp->t_column += ce;
2198 			cp += ce, cc -= ce, tk_nout += ce;
2199 			tp->t_outcc += ce;
2200 			if (i > 0) {
2201 				/* No Clists, wait a bit. */
2202 				ttstart(tp);
2203 				if (flag & IO_NDELAY) {
2204 					error = EWOULDBLOCK;
2205 					goto out;
2206 				}
2207 				error = ttysleep(tp, &lbolt, PCATCH,
2208 						 "ttybf2", 0);
2209 				if (error)
2210 					goto out;
2211 				goto loop;
2212 			}
2213 			if (ISSET(tp->t_lflag, FLUSHO) ||
2214 			    tp->t_outq.c_cc > hiwat)
2215 				break;
2216 		}
2217 		ttstart(tp);
2218 	}
2219 out:
2220 	/*
2221 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2222 	 * offset and iov pointers have moved forward, but it doesn't matter
2223 	 * (the call will either return short or restart with a new uio).
2224 	 */
2225 	uio->uio_resid += cc;
2226 	lwkt_reltoken(&tty_token);
2227 	return (error);
2228 
2229 ovhiwat:
2230 	ttstart(tp);
2231 	crit_enter();
2232 	/*
2233 	 * This can only occur if FLUSHO is set in t_lflag,
2234 	 * or if ttstart/oproc is synchronous (or very fast).
2235 	 */
2236 	if (tp->t_outq.c_cc <= hiwat) {
2237 		crit_exit();
2238 		goto loop;
2239 	}
2240 	if (flag & IO_NDELAY) {
2241 		crit_exit();
2242 		uio->uio_resid += cc;
2243 		lwkt_reltoken(&tty_token);
2244 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2245 	}
2246 	SET(tp->t_state, TS_SO_OLOWAT);
2247 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2248 	crit_exit();
2249 	if (error == EWOULDBLOCK)
2250 		error = EIO;
2251 	if (error)
2252 		goto out;
2253 	goto loop;
2254 }
2255 
2256 /*
2257  * Rubout one character from the rawq of tp
2258  * as cleanly as possible.
2259  * NOTE: Must be called with tty_token held
2260  */
2261 static void
2262 ttyrub(int c, struct tty *tp)
2263 {
2264 	char *cp;
2265 	int savecol;
2266 	int tabc;
2267 
2268 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
2269 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2270 		return;
2271 	CLR(tp->t_lflag, FLUSHO);
2272 	if (ISSET(tp->t_lflag, ECHOE)) {
2273 		if (tp->t_rocount == 0) {
2274 			/*
2275 			 * Screwed by ttwrite; retype
2276 			 */
2277 			ttyretype(tp);
2278 			return;
2279 		}
2280 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2281 			ttyrubo(tp, 2);
2282 		else {
2283 			CLR(c, ~TTY_CHARMASK);
2284 			switch (CCLASS(c)) {
2285 			case ORDINARY:
2286 				ttyrubo(tp, 1);
2287 				break;
2288 			case BACKSPACE:
2289 			case CONTROL:
2290 			case NEWLINE:
2291 			case RETURN:
2292 			case VTAB:
2293 				if (ISSET(tp->t_lflag, ECHOCTL))
2294 					ttyrubo(tp, 2);
2295 				break;
2296 			case TAB:
2297 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2298 					ttyretype(tp);
2299 					return;
2300 				}
2301 				crit_enter();
2302 				savecol = tp->t_column;
2303 				SET(tp->t_state, TS_CNTTB);
2304 				SET(tp->t_lflag, FLUSHO);
2305 				tp->t_column = tp->t_rocol;
2306 				cp = tp->t_rawq.c_cf;
2307 				if (cp)
2308 					tabc = *cp;	/* XXX FIX NEXTC */
2309 				for (; cp; cp = nextc(&tp->t_rawq, cp, &tabc))
2310 					ttyecho(tabc, tp);
2311 				CLR(tp->t_lflag, FLUSHO);
2312 				CLR(tp->t_state, TS_CNTTB);
2313 				crit_exit();
2314 
2315 				/* savecol will now be length of the tab. */
2316 				savecol -= tp->t_column;
2317 				tp->t_column += savecol;
2318 				if (savecol > 8)
2319 					savecol = 8;	/* overflow screw */
2320 				while (--savecol >= 0)
2321 					(void)ttyoutput('\b', tp);
2322 				break;
2323 			default:			/* XXX */
2324 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2325 				(void)kprintf(PANICSTR, c, CCLASS(c));
2326 #ifdef notdef
2327 				panic(PANICSTR, c, CCLASS(c));
2328 #endif
2329 			}
2330 		}
2331 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2332 		if (!ISSET(tp->t_state, TS_ERASE)) {
2333 			SET(tp->t_state, TS_ERASE);
2334 			(void)ttyoutput('\\', tp);
2335 		}
2336 		ttyecho(c, tp);
2337 	} else {
2338 		ttyecho(tp->t_cc[VERASE], tp);
2339 		/*
2340 		 * This code may be executed not only when an ERASE key
2341 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2342 		 * So, I didn't think it was worthwhile to pass the extra
2343 		 * information (which would need an extra parameter,
2344 		 * changing every call) needed to distinguish the ERASE2
2345 		 * case from the ERASE.
2346 		 */
2347 	}
2348 	--tp->t_rocount;
2349 }
2350 
2351 /*
2352  * Back over cnt characters, erasing them.
2353  * NOTE: Must be called with tty_token held
2354  */
2355 static void
2356 ttyrubo(struct tty *tp, int cnt)
2357 {
2358 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
2359 	while (cnt-- > 0) {
2360 		(void)ttyoutput('\b', tp);
2361 		(void)ttyoutput(' ', tp);
2362 		(void)ttyoutput('\b', tp);
2363 	}
2364 }
2365 
2366 /*
2367  * ttyretype --
2368  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2369  *	been checked.
2370  * NOTE: Must be called with tty_token held
2371  */
2372 static void
2373 ttyretype(struct tty *tp)
2374 {
2375 	char *cp;
2376 	int c;
2377 
2378 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
2379 	/* Echo the reprint character. */
2380 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2381 		ttyecho(tp->t_cc[VREPRINT], tp);
2382 
2383 	(void)ttyoutput('\n', tp);
2384 
2385 	/*
2386 	 * XXX
2387 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2388 	 * BIT OF FIRST CHAR.
2389 	 */
2390 	crit_enter();
2391 	for (cp = tp->t_canq.c_cf, c = (cp != NULL ? *cp : 0);
2392 	    cp != NULL; cp = nextc(&tp->t_canq, cp, &c))
2393 		ttyecho(c, tp);
2394 	for (cp = tp->t_rawq.c_cf, c = (cp != NULL ? *cp : 0);
2395 	    cp != NULL; cp = nextc(&tp->t_rawq, cp, &c))
2396 		ttyecho(c, tp);
2397 	CLR(tp->t_state, TS_ERASE);
2398 	crit_exit();
2399 
2400 	tp->t_rocount = tp->t_rawq.c_cc;
2401 	tp->t_rocol = 0;
2402 }
2403 
2404 /*
2405  * Echo a typed character to the terminal.
2406  * NOTE: Must be called with tty_token held
2407  */
2408 static void
2409 ttyecho(int c, struct tty *tp)
2410 {
2411 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
2412 
2413 	if (!ISSET(tp->t_state, TS_CNTTB))
2414 		CLR(tp->t_lflag, FLUSHO);
2415 	if ((!ISSET(tp->t_lflag, ECHO) &&
2416 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2417 	    ISSET(tp->t_lflag, EXTPROC))
2418 		return;
2419 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2420 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2421 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2422 		(void)ttyoutput('^', tp);
2423 		CLR(c, ~TTY_CHARMASK);
2424 		if (c == 0177)
2425 			c = '?';
2426 		else
2427 			c += 'A' - 1;
2428 	}
2429 	(void)ttyoutput(c, tp);
2430 }
2431 
2432 /*
2433  * Wake up any readers on a tty.
2434  */
2435 void
2436 ttwakeup(struct tty *tp)
2437 {
2438 	lwkt_gettoken(&tty_token);
2439 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2440 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2441 	wakeup(TSA_HUP_OR_INPUT(tp));
2442 	KNOTE(&tp->t_rkq.ki_note, 0);
2443 	lwkt_reltoken(&tty_token);
2444 }
2445 
2446 /*
2447  * Wake up any writers on a tty.
2448  */
2449 void
2450 ttwwakeup(struct tty *tp)
2451 {
2452 	lwkt_gettoken(&tty_token);
2453 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2454 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2455 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2456 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2457 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2458 		wakeup(TSA_OCOMPLETE(tp));
2459 	}
2460 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2461 	    tp->t_outq.c_cc <= tp->t_olowat) {
2462 		CLR(tp->t_state, TS_SO_OLOWAT);
2463 		wakeup(TSA_OLOWAT(tp));
2464 	}
2465 	KNOTE(&tp->t_wkq.ki_note, 0);
2466 	lwkt_reltoken(&tty_token);
2467 }
2468 
2469 /*
2470  * Look up a code for a specified speed in a conversion table;
2471  * used by drivers to map software speed values to hardware parameters.
2472  * No requirements
2473  */
2474 int
2475 ttspeedtab(int speed, struct speedtab *table)
2476 {
2477 
2478 	for ( ; table->sp_speed != -1; table++)
2479 		if (table->sp_speed == speed)
2480 			return (table->sp_code);
2481 	return (-1);
2482 }
2483 
2484 /*
2485  * Set input and output watermarks and buffer sizes.  For input, the
2486  * high watermark is about one second's worth of input above empty, the
2487  * low watermark is slightly below high water, and the buffer size is a
2488  * driver-dependent amount above high water.  For output, the watermarks
2489  * are near the ends of the buffer, with about 1 second's worth of input
2490  * between them.  All this only applies to the standard line discipline.
2491  */
2492 void
2493 ttsetwater(struct tty *tp)
2494 {
2495 	int cps, ttmaxhiwat, x;
2496 
2497 	lwkt_gettoken(&tty_token);
2498 	/* Input. */
2499 	clist_alloc_cblocks(&tp->t_canq, TTYHOG, 512);
2500 	switch (tp->t_ispeedwat) {
2501 	case (speed_t)-1:
2502 		cps = tp->t_ispeed / 10;
2503 		break;
2504 	case 0:
2505 		/*
2506 		 * This case is for old drivers that don't know about
2507 		 * t_ispeedwat.  Arrange for them to get the old buffer
2508 		 * sizes and watermarks.
2509 		 */
2510 		cps = TTYHOG - 2 * 256;
2511 		tp->t_ififosize = 2 * 2048;
2512 		break;
2513 	default:
2514 		cps = tp->t_ispeedwat / 10;
2515 		break;
2516 	}
2517 	tp->t_ihiwat = cps;
2518 	tp->t_ilowat = 7 * cps / 8;
2519 	x = cps + tp->t_ififosize;
2520 	clist_alloc_cblocks(&tp->t_rawq, x, x);
2521 
2522 	/* Output. */
2523 	switch (tp->t_ospeedwat) {
2524 	case (speed_t)-1:
2525 		cps = tp->t_ospeed / 10;
2526 		ttmaxhiwat = 2 * TTMAXHIWAT;
2527 		break;
2528 	case 0:
2529 		cps = tp->t_ospeed / 10;
2530 		ttmaxhiwat = TTMAXHIWAT;
2531 		break;
2532 	default:
2533 		cps = tp->t_ospeedwat / 10;
2534 		ttmaxhiwat = 8 * TTMAXHIWAT;
2535 		break;
2536 	}
2537 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2538 	tp->t_olowat = x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2539 	x += cps;
2540 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);	/* XXX clamps are too magic */
2541 	tp->t_ohiwat = roundup(x, CBSIZE);	/* XXX for compat */
2542 	x = imax(tp->t_ohiwat, TTMAXHIWAT);	/* XXX for compat/safety */
2543 	x += OBUFSIZ + 100;
2544 	clist_alloc_cblocks(&tp->t_outq, x, x);
2545 #undef	CLAMP
2546 	lwkt_reltoken(&tty_token);
2547 }
2548 
2549 /*
2550  * Report on state of foreground process group.
2551  */
2552 void
2553 ttyinfo(struct tty *tp)
2554 {
2555 	struct proc *p, *pick;
2556 	struct lwp *lp;
2557 	struct rusage ru;
2558 	int tmp;
2559 
2560 	if (ttycheckoutq(tp,0) == 0)
2561 		return;
2562 
2563 	lwkt_gettoken(&tty_token);
2564 	lwkt_gettoken(&proc_token);
2565 	/*
2566 	 * We always print the load average, then figure out what else to
2567 	 * print based on the state of the current process group.
2568 	 */
2569 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2570 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2571 
2572 	if (tp->t_session == NULL) {
2573 		ttyprintf(tp, "not a controlling terminal\n");
2574 	} else if (tp->t_pgrp == NULL) {
2575 		ttyprintf(tp, "no foreground process group\n");
2576 	} else if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL) {
2577 		ttyprintf(tp, "empty foreground process group\n");
2578 	} else {
2579 		/*
2580 		 * Pick an interesting process.  Note that certain elements,
2581 		 * in particular the wmesg, require a critical section for
2582 		 * safe access (YYY and we are still not MP safe).
2583 		 *
2584 		 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2585 		 */
2586 		char buf[64];
2587 		const char *str;
2588 		long vmsz;
2589 		int pctcpu;
2590 
2591 		crit_enter();
2592 
2593 		/* XXX lwp should compare lwps */
2594 
2595 		for (pick = NULL; p != NULL; p = LIST_NEXT(p, p_pglist)) {
2596 			if (proc_compare(pick, p))
2597 				pick = p;
2598 		}
2599 
2600 		/* XXX lwp */
2601 		lp = FIRST_LWP_IN_PROC(pick);
2602 		if (lp == NULL) {
2603 			ttyprintf(tp, "foreground process without lwp\n");
2604 			tp->t_rocount = 0;
2605 			crit_exit();
2606 			lwkt_reltoken(&proc_token);
2607 			lwkt_reltoken(&tty_token);
2608 			return;
2609 		}
2610 
2611 		/*
2612 		 * Figure out what wait/process-state message, and command
2613 		 * buffer to present
2614 		 */
2615 		/*
2616 		 * XXX lwp This is a horrible mixture.  We need to rework this
2617 		 * as soon as lwps have their own runnable status.
2618 		 */
2619 		if (pick->p_flag & P_WEXIT)
2620 			str = "exiting";
2621 		else if (lp->lwp_stat == LSRUN)
2622 			str = "running";
2623 		else if (pick->p_stat == SIDL)
2624 			str = "spawning";
2625 		else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2626 			str = lp->lwp_wmesg;
2627 		else
2628 			str = "iowait";
2629 
2630 		ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2631 			pick->p_comm, pick->p_pid, str);
2632 
2633 		/*
2634 		 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2635 		 * 'pick' becomes invalid the moment we exit the critical
2636 		 * section.
2637 		 */
2638 		if (lp->lwp_thread && (pick->p_flag & P_SWAPPEDOUT) == 0)
2639 			calcru_proc(pick, &ru);
2640 
2641 		pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2642 
2643 		if (pick->p_stat == SIDL || pick->p_stat == SZOMB)
2644 		    vmsz = 0;
2645 		else
2646 		    vmsz = pgtok(vmspace_resident_count(pick->p_vmspace));
2647 
2648 		crit_exit();
2649 
2650 		/*
2651 		 * Dump the output
2652 		 */
2653 		ttyprintf(tp, " %s ", buf);
2654 		ttyprintf(tp, "%ld.%02ldu ",
2655 			ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2656 		ttyprintf(tp, "%ld.%02lds ",
2657 			ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2658 		ttyprintf(tp, "%d%% %ldk\n", pctcpu / 100, vmsz);
2659 	}
2660 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2661 	lwkt_reltoken(&proc_token);
2662 	lwkt_reltoken(&tty_token);
2663 }
2664 
2665 /*
2666  * Returns 1 if p2 is "better" than p1
2667  *
2668  * The algorithm for picking the "interesting" process is thus:
2669  *
2670  *	1) Only foreground processes are eligible - implied.
2671  *	2) Runnable processes are favored over anything else.  The runner
2672  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2673  *	   broken by picking the highest pid.
2674  *	3) The sleeper with the shortest sleep time is next.  With ties,
2675  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2676  *	4) Further ties are broken by picking the highest pid.
2677  *
2678  * NOTE: must be called with proc_token held.
2679  */
2680 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2681 #define TESTAB(a, b)    ((a)<<1 | (b))
2682 #define ONLYA   2
2683 #define ONLYB   1
2684 #define BOTH    3
2685 
2686 static int
2687 proc_compare(struct proc *p1, struct proc *p2)
2688 {
2689 	struct lwp *lp1, *lp2;
2690 
2691 	ASSERT_LWKT_TOKEN_HELD(&proc_token);
2692 
2693 	if (p1 == NULL)
2694 		return (1);
2695 
2696 	/*
2697  	 * weed out zombies
2698 	 */
2699 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2700 	case ONLYA:
2701 		return (1);
2702 	case ONLYB:
2703 		return (0);
2704 	case BOTH:
2705 		return (p2->p_pid > p1->p_pid); /* tie - return highest pid */
2706 	}
2707 
2708 	/* XXX lwp */
2709 	lp1 = FIRST_LWP_IN_PROC(p1);
2710 	lp2 = FIRST_LWP_IN_PROC(p2);
2711 
2712 	/*
2713 	 * see if at least one of them is runnable
2714 	 */
2715 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2716 	case ONLYA:
2717 		return (0);
2718 	case ONLYB:
2719 		return (1);
2720 	case BOTH:
2721 		/*
2722 		 * tie - favor one with highest recent cpu utilization
2723 		 */
2724 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2725 			return (1);
2726 		if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2727 			return (0);
2728 		return (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2729 	}
2730 	/*
2731 	 * pick the one with the smallest sleep time
2732 	 */
2733 	if (lp2->lwp_slptime > lp1->lwp_slptime)
2734 		return (0);
2735 	if (lp1->lwp_slptime > lp2->lwp_slptime)
2736 		return (1);
2737 	/*
2738 	 * favor one sleeping in a non-interruptible sleep
2739 	 */
2740 	if (lp1->lwp_flag & LWP_SINTR && (lp2->lwp_flag & LWP_SINTR) == 0)
2741 		return (1);
2742 	if (lp2->lwp_flag & LWP_SINTR && (lp1->lwp_flag & LWP_SINTR) == 0)
2743 		return (0);
2744 	return (p2->p_pid > p1->p_pid);		/* tie - return highest pid */
2745 }
2746 
2747 /*
2748  * Output char to tty; console putchar style.
2749  */
2750 int
2751 tputchar(int c, struct tty *tp)
2752 {
2753 	crit_enter();
2754 	lwkt_gettoken(&tty_token);
2755 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2756 		lwkt_reltoken(&tty_token);
2757 		crit_exit();
2758 		return (-1);
2759 	}
2760 	if (c == '\n')
2761 		(void)ttyoutput('\r', tp);
2762 	(void)ttyoutput(c, tp);
2763 	ttstart(tp);
2764 	lwkt_reltoken(&tty_token);
2765 	crit_exit();
2766 	return (0);
2767 }
2768 
2769 /*
2770  * Sleep on chan, returning ERESTART if tty changed while we napped and
2771  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2772  * the tty is revoked, restarting a pending call will redo validation done
2773  * at the start of the call.
2774  */
2775 int
2776 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2777 {
2778 	int error;
2779 	int gen;
2780 
2781 	gen = tp->t_gen;
2782 	error = tsleep(chan, slpflags, wmesg, timo);
2783 	if (error)
2784 		return (error);
2785 	return (tp->t_gen == gen ? 0 : ERESTART);
2786 }
2787 
2788 /*
2789  * Revoke a tty.
2790  *
2791  * We bump the gen to force any ttysleep()'s to return with ERESTART
2792  * and flush the tty.  The related fp's should already have been
2793  * replaced so the tty will close when the last references on the
2794  * original fp's go away.
2795  */
2796 int
2797 ttyrevoke(struct dev_revoke_args *ap)
2798 {
2799 	struct tty *tp;
2800 
2801 	lwkt_gettoken(&tty_token);
2802 	tp = ap->a_head.a_dev->si_tty;
2803 	tp->t_gen++;
2804 	ttyflush(tp, FREAD | FWRITE);
2805 	wakeup(TSA_CARR_ON(tp));
2806 	ttwakeup(tp);
2807 	ttwwakeup(tp);
2808 	lwkt_reltoken(&tty_token);
2809 	return (0);
2810 }
2811 
2812 /*
2813  * Allocate a tty struct.  Clists in the struct will be allocated by
2814  * ttyopen().
2815  */
2816 struct tty *
2817 ttymalloc(struct tty *tp)
2818 {
2819 
2820 	if (tp) {
2821 		return(tp);
2822 	}
2823 	tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2824 	ttyregister(tp);
2825         return (tp);
2826 }
2827 
2828 void
2829 ttyunregister(struct tty *tp)
2830 {
2831 	lwkt_gettoken(&tty_token);
2832 	KKASSERT(ISSET(tp->t_state, TS_REGISTERED));
2833 	CLR(tp->t_state, TS_REGISTERED);
2834 	TAILQ_REMOVE(&tty_list, tp, t_list);
2835 	lwkt_reltoken(&tty_token);
2836 }
2837 
2838 void
2839 ttyregister(struct tty *tp)
2840 {
2841 	lwkt_gettoken(&tty_token);
2842 	KKASSERT(!ISSET(tp->t_state, TS_REGISTERED));
2843 	SET(tp->t_state, TS_REGISTERED);
2844 	TAILQ_INSERT_HEAD(&tty_list, tp, t_list);
2845 	lwkt_reltoken(&tty_token);
2846 }
2847 
2848 static int
2849 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2850 {
2851 	int error;
2852 	struct tty *tp;
2853 	struct tty t;
2854 	struct tty marker;
2855 
2856 	bzero(&marker, sizeof(marker));
2857 	marker.t_state = TS_MARKER;
2858 	error = 0;
2859 
2860 	lwkt_gettoken(&tty_token);
2861 
2862 	TAILQ_INSERT_HEAD(&tty_list, &marker, t_list);
2863 	while ((tp = TAILQ_NEXT(&marker, t_list)) != NULL) {
2864 		TAILQ_REMOVE(&tty_list, &marker, t_list);
2865 		TAILQ_INSERT_AFTER(&tty_list, tp, &marker, t_list);
2866 		if (tp->t_state & TS_MARKER)
2867 			continue;
2868 		t = *tp;
2869 		if (t.t_dev)
2870 			t.t_dev = (cdev_t)(uintptr_t)dev2udev(t.t_dev);
2871 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2872 		if (error)
2873 			break;
2874 	}
2875 	TAILQ_REMOVE(&tty_list, &marker, t_list);
2876 	lwkt_reltoken(&tty_token);
2877 	return (error);
2878 }
2879 
2880 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2881 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2882 
2883 void
2884 nottystop(struct tty *tp, int rw)
2885 {
2886 	return;
2887 }
2888 
2889 int
2890 ttyread(struct dev_read_args *ap)
2891 {
2892 	struct tty *tp;
2893 	int ret;
2894 
2895 	tp = ap->a_head.a_dev->si_tty;
2896 	if (tp == NULL)
2897 		return (ENODEV);
2898 	lwkt_gettoken(&tty_token);
2899 	ret = ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2900 	lwkt_reltoken(&tty_token);
2901 
2902 	return ret;
2903 }
2904 
2905 int
2906 ttywrite(struct dev_write_args *ap)
2907 {
2908 	struct tty *tp;
2909 	int ret;
2910 
2911 	tp = ap->a_head.a_dev->si_tty;
2912 	if (tp == NULL)
2913 		return (ENODEV);
2914 	lwkt_gettoken(&tty_token);
2915 	ret = ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2916 	lwkt_reltoken(&tty_token);
2917 
2918 	return ret;
2919 }
2920