xref: /dragonfly/sys/kern/tty.c (revision e0eb7cf0)
1 /*-
2  * (MPSAFE)
3  *
4  * Copyright (c) 1982, 1986, 1990, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
37  * $FreeBSD: src/sys/kern/tty.c,v 1.129.2.5 2002/03/11 01:32:31 dd Exp $
38  */
39 
40 /*
41  * MPSAFE NOTE:
42  * Almost all functions in this file are acquiring the tty token due to their
43  * access and modifications of the 'tp' (struct tty) objects.
44  */
45 
46 /*-
47  * TODO:
48  *	o Fix races for sending the start char in ttyflush().
49  *	o Handle inter-byte timeout for "MIN > 0, TIME > 0" in ttyselect().
50  *	  With luck, there will be MIN chars before select() returns().
51  *	o Handle CLOCAL consistently for ptys.  Perhaps disallow setting it.
52  *	o Don't allow input in TS_ZOMBIE case.  It would be visible through
53  *	  FIONREAD.
54  *	o Do the new sio locking stuff here and use it to avoid special
55  *	  case for EXTPROC?
56  *	o Lock PENDIN too?
57  *	o Move EXTPROC and/or PENDIN to t_state?
58  *	o Wrap most of ttioctl in spltty/splx.
59  *	o Implement TIOCNOTTY or remove it from <sys/ioctl.h>.
60  *	o Send STOP if IXOFF is toggled off while TS_TBLOCK is set.
61  *	o Don't allow certain termios flags to affect disciplines other
62  *	  than TTYDISC.  Cancel their effects before switch disciplines
63  *	  and ignore them if they are set while we are in another
64  *	  discipline.
65  *	o Now that historical speed conversions are handled here, don't
66  *	  do them in drivers.
67  *	o Check for TS_CARR_ON being set while everything is closed and not
68  *	  waiting for carrier.  TS_CARR_ON isn't cleared if nothing is open,
69  *	  so it would live until the next open even if carrier drops.
70  *	o Restore TS_WOPEN since it is useful in pstat.  It must be cleared
71  *	  only when _all_ openers leave open().
72  */
73 
74 #include "opt_uconsole.h"
75 
76 #include <sys/param.h>
77 #include <sys/systm.h>
78 #include <sys/uio.h>
79 #include <sys/filio.h>
80 #include <sys/malloc.h>
81 #include <sys/proc.h>
82 #include <sys/priv.h>
83 #include <sys/tty.h>
84 #define	TTYDEFCHARS
85 #include <sys/ttydefaults.h>	/* for ttydefchars, CEOT */
86 #undef	TTYDEFCHARS
87 #include <sys/fcntl.h>
88 #include <sys/conf.h>
89 #include <sys/dkstat.h>
90 #include <sys/kernel.h>
91 #include <sys/vnode.h>
92 #include <sys/signalvar.h>
93 #include <sys/signal2.h>
94 #include <sys/resourcevar.h>
95 #include <sys/filedesc.h>
96 #include <sys/sysctl.h>
97 #include <sys/thread2.h>
98 
99 #include <vm/vm.h>
100 #include <sys/lock.h>
101 #include <vm/pmap.h>
102 #include <vm/vm_map.h>
103 #include <vm/vm_extern.h>
104 
105 MALLOC_DEFINE(M_TTYS, "ttys", "tty data structures");
106 
107 static int	proc_compare (struct proc *p1, struct proc *p2);
108 static int	ttnread (struct tty *tp);
109 static void	ttyecho (int c, struct tty *tp);
110 static int	ttyoutput (int c, struct tty *tp);
111 static void	ttypend (struct tty *tp);
112 static void	ttyretype (struct tty *tp);
113 static void	ttyrub (int c, struct tty *tp);
114 static void	ttyrubo (struct tty *tp, int cnt);
115 static void	ttyunblock (struct tty *tp);
116 static int	ttywflush (struct tty *tp);
117 static int	filt_ttyread (struct knote *kn, long hint);
118 static void 	filt_ttyrdetach (struct knote *kn);
119 static int	filt_ttywrite (struct knote *kn, long hint);
120 static void 	filt_ttywdetach (struct knote *kn);
121 
122 /*
123  * Table with character classes and parity. The 8th bit indicates parity,
124  * the 7th bit indicates the character is an alphameric or underscore (for
125  * ALTWERASE), and the low 6 bits indicate delay type.  If the low 6 bits
126  * are 0 then the character needs no special processing on output; classes
127  * other than 0 might be translated or (not currently) require delays.
128  */
129 #define	E	0x00	/* Even parity. */
130 #define	O	0x80	/* Odd parity. */
131 #define	PARITY(c)	(char_type[c] & O)
132 
133 #define	ALPHA	0x40	/* Alpha or underscore. */
134 #define	ISALPHA(c)	(char_type[(c) & TTY_CHARMASK] & ALPHA)
135 
136 #define	CCLASSMASK	0x3f
137 #define	CCLASS(c)	(char_type[c] & CCLASSMASK)
138 
139 #define	BS	BACKSPACE
140 #define	CC	CONTROL
141 #define	CR	RETURN
142 #define	NA	ORDINARY | ALPHA
143 #define	NL	NEWLINE
144 #define	NO	ORDINARY
145 #define	TB	TAB
146 #define	VT	VTAB
147 
148 static u_char const char_type[] = {
149 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC,	/* nul - bel */
150 	O|BS, E|TB, E|NL, O|CC, E|VT, O|CR, O|CC, E|CC, /* bs - si */
151 	O|CC, E|CC, E|CC, O|CC, E|CC, O|CC, O|CC, E|CC, /* dle - etb */
152 	E|CC, O|CC, O|CC, E|CC, O|CC, E|CC, E|CC, O|CC, /* can - us */
153 	O|NO, E|NO, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* sp - ' */
154 	E|NO, O|NO, O|NO, E|NO, O|NO, E|NO, E|NO, O|NO, /* ( - / */
155 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* 0 - 7 */
156 	O|NA, E|NA, E|NO, O|NO, E|NO, O|NO, O|NO, E|NO, /* 8 - ? */
157 	O|NO, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* @ - G */
158 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* H - O */
159 	E|NA, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* P - W */
160 	O|NA, E|NA, E|NA, O|NO, E|NO, O|NO, O|NO, O|NA, /* X - _ */
161 	E|NO, O|NA, O|NA, E|NA, O|NA, E|NA, E|NA, O|NA, /* ` - g */
162 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* h - o */
163 	O|NA, E|NA, E|NA, O|NA, E|NA, O|NA, O|NA, E|NA, /* p - w */
164 	E|NA, O|NA, O|NA, E|NO, O|NO, E|NO, E|NO, O|CC, /* x - del */
165 	/*
166 	 * Meta chars; should be settable per character set;
167 	 * for now, treat them all as normal characters.
168 	 */
169 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
170 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
171 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
172 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
173 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
174 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
175 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
176 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
177 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
178 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
179 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
180 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
181 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
182 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
183 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
184 	NA,   NA,   NA,   NA,   NA,   NA,   NA,   NA,
185 };
186 #undef	BS
187 #undef	CC
188 #undef	CR
189 #undef	NA
190 #undef	NL
191 #undef	NO
192 #undef	TB
193 #undef	VT
194 
195 /* Macros to clear/set/test flags. */
196 #define	SET(t, f)	(t) |= (f)
197 #define	CLR(t, f)	(t) &= ~(f)
198 #define	ISSET(t, f)	((t) & (f))
199 
200 #undef MAX_INPUT		/* XXX wrong in <sys/syslimits.h> */
201 #define	MAX_INPUT	TTYHOG	/* XXX limit is usually larger for !ICANON */
202 
203 uint64_t tk_nin;
204 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nin, CTLFLAG_RD, &tk_nin, sizeof(tk_nin),
205     "LU", "TTY input statistic");
206 uint64_t tk_nout;
207 SYSCTL_OPAQUE(_kern, OID_AUTO, tk_nout, CTLFLAG_RD, &tk_nout, sizeof(tk_nout),
208     "LU", "TTY output statistic");
209 uint64_t tk_rawcc;
210 
211 /*
212  * list of struct tty where pstat(8) can pick it up with sysctl
213  */
214 static TAILQ_HEAD(, tty) tty_list = TAILQ_HEAD_INITIALIZER(tty_list);
215 
216 /*
217  * Initial open of tty, or (re)entry to standard tty line discipline.
218  */
219 int
220 ttyopen(cdev_t device, struct tty *tp)
221 {
222 	lwkt_gettoken(&tp->t_token);
223 	tp->t_dev = device;
224 	if (!ISSET(tp->t_state, TS_ISOPEN)) {
225 		SET(tp->t_state, TS_ISOPEN);
226 		if (ISSET(tp->t_cflag, CLOCAL)) {
227 			SET(tp->t_state, TS_CONNECTED);
228 		}
229 		bzero(&tp->t_winsize, sizeof(tp->t_winsize));
230 	}
231 	ttsetwater(tp);
232 	lwkt_reltoken(&tp->t_token);
233 
234 	return (0);
235 }
236 
237 /*
238  * Handle close() on a tty line: flush and set to initial state,
239  * bumping generation number so that pending read/write calls
240  * can detect recycling of the tty.
241  *
242  * XXX our caller should have done `spltty(); l_close(); ttyclose();'
243  * and l_close() should have flushed, but we repeat the spltty() and
244  * the flush in case there are buggy callers.
245  */
246 int
247 ttyclose(struct tty *tp)
248 {
249 	lwkt_gettoken(&tp->t_token);
250 	funsetown(&tp->t_sigio);
251 	if (constty == tp)
252 		constty = NULL;
253 
254 	ttyflush(tp, FREAD | FWRITE);
255 	clist_free_cblocks(&tp->t_canq);
256 	clist_free_cblocks(&tp->t_outq);
257 	clist_free_cblocks(&tp->t_rawq);
258 
259 	tp->t_gen++;
260 	tp->t_line = TTYDISC;
261 	ttyclearsession(tp);
262 	tp->t_state &= TS_REGISTERED;	/* clear all bits except */
263 	lwkt_reltoken(&tp->t_token);
264 
265 	return (0);
266 }
267 
268 /*
269  * Disassociate the tty from its session.  Traditionally this has only been
270  * a half-close, meaning that the session was still allowed to point at the
271  * tty (resulting in the tty in the ps command showing something like 'p0-'),
272  * even though the tty is no longer pointing at the session.
273  *
274  * The half close seems to be useful only for 'ps' output but there is as
275  * yet no reason to remove the feature.  The full-close code is currently
276  * #if 0'd out.  See also sess_rele() in kern/kern_proc.c.
277  */
278 void
279 ttyclearsession(struct tty *tp)
280 {
281 	struct session *sp;
282 	struct procglob *prg;
283 	struct pgrp *opgrp;
284 
285 	lwkt_gettoken(&tp->t_token);
286 	opgrp = tp->t_pgrp;
287 	tp->t_pgrp = NULL;
288 	if (opgrp) {
289 		pgrel(opgrp);
290 		opgrp = NULL;
291 	}
292 
293 again:
294 	if ((sp = tp->t_session) != NULL) {
295 		prg = sp->s_prg;
296 		lwkt_gettoken(&prg->proc_token);
297 		if (sp != tp->t_session) {
298 			lwkt_reltoken(&prg->proc_token);
299 			goto again;
300 		}
301 		tp->t_session = NULL;
302 
303 #ifdef TTY_DO_FULL_CLOSE
304 		/* FULL CLOSE (not yet) */
305 		if (sp->s_ttyp == tp) {
306 			sp->s_ttyp = NULL;
307 			ttyunhold(tp);
308 		} else {
309 			kprintf("ttyclearsession: warning: sp->s_ttyp != tp "
310 				"%p/%p\n", sp->s_ttyp, tp);
311 		}
312 #endif
313 		lwkt_reltoken(&prg->proc_token);
314 	}
315 	lwkt_reltoken(&tp->t_token);
316 }
317 
318 /*
319  * Release the tty vnode association for a session.  This is the
320  * 'other half' of the close.  Because multiple opens of /dev/tty
321  * only generate a single open to the actual tty, the file modes
322  * are locked to FREAD|FWRITE.
323  *
324  * If dorevoke is non-zero, the session is also revoked.  We have to
325  * close the vnode if VCTTYISOPEN is set.
326  */
327 void
328 ttyclosesession(struct session *sp, int dorevoke)
329 {
330 	struct vnode *vp;
331 	struct procglob *prg;
332 
333 	prg = sp->s_prg;
334 	lwkt_gettoken(&prg->proc_token);
335 retry:
336 	/*
337 	 * There may not be a controlling terminal or it may have been closed
338 	 * out from under us.
339 	 */
340 	if ((vp = sp->s_ttyvp) == NULL) {
341 		lwkt_reltoken(&prg->proc_token);
342 		return;
343 	}
344 
345 	/*
346 	 * We need a lock if we have to close or revoke.
347 	 */
348 	if ((vp->v_flag & VCTTYISOPEN) || dorevoke) {
349 		vhold(vp);
350 		if (vn_lock(vp, LK_EXCLUSIVE | LK_RETRY | LK_FAILRECLAIM)) {
351 			vdrop(vp);
352 			goto retry;
353 		}
354 
355 		/*
356 		 * Retry if the vnode was ripped out from under us
357 		 */
358 		if (vp != sp->s_ttyvp) {
359 			vn_unlock(vp);
360 			vdrop(vp);
361 			goto retry;
362 		}
363 
364 		/*
365 		 * Close and revoke as needed
366 		 */
367 		sp->s_ttyvp = NULL;
368 		if (vp->v_flag & VCTTYISOPEN) {
369 			vclrflags(vp, VCTTYISOPEN);
370 			VOP_CLOSE(vp, FREAD|FWRITE, NULL);
371 		}
372 		vn_unlock(vp);
373 		if (dorevoke)
374 			vrevoke(vp, proc0.p_ucred);
375 		vdrop(vp);
376 	} else {
377 		sp->s_ttyvp = NULL;
378 	}
379 	vrele(vp);
380 	lwkt_reltoken(&prg->proc_token);
381 }
382 
383 #define	FLUSHQ(q) {							\
384 	if ((q)->c_cc)							\
385 		ndflush(q, (q)->c_cc);					\
386 }
387 
388 /* Is 'c' a line delimiter ("break" character)? */
389 #define	TTBREAKC(c, lflag)							\
390 	((c) == '\n' || (((c) == cc[VEOF] ||				\
391 	  (c) == cc[VEOL] || ((c) == cc[VEOL2] && lflag & IEXTEN)) &&	\
392 	 (c) != _POSIX_VDISABLE))
393 
394 /*
395  * Process input of a single character received on a tty.
396  */
397 int
398 ttyinput(int c, struct tty *tp)
399 {
400 	tcflag_t iflag, lflag;
401 	cc_t *cc;
402 	int i, err;
403 
404 	lwkt_gettoken(&tp->t_token);
405 	/*
406 	 * If input is pending take it first.
407 	 */
408 	lflag = tp->t_lflag;
409 	if (ISSET(lflag, PENDIN))
410 		ttypend(tp);
411 	/*
412 	 * Gather stats.
413 	 */
414 	if (ISSET(lflag, ICANON))
415 		++tp->t_cancc;
416 	else
417 		++tp->t_rawcc;
418 	++tk_nin;
419 
420 	/*
421 	 * Block further input iff:
422 	 * current input > threshold AND input is available to user program
423 	 * AND input flow control is enabled and not yet invoked.
424 	 * The 3 is slop for PARMRK.
425 	 */
426 	iflag = tp->t_iflag;
427 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc > tp->t_ihiwat - 3 &&
428 	    (!ISSET(lflag, ICANON) || tp->t_canq.c_cc != 0) &&
429 	    (ISSET(tp->t_cflag, CRTS_IFLOW) || ISSET(iflag, IXOFF)) &&
430 	    !ISSET(tp->t_state, TS_TBLOCK))
431 		ttyblock(tp);
432 
433 	/* Handle exceptional conditions (break, parity, framing). */
434 	cc = tp->t_cc;
435 	err = (ISSET(c, TTY_ERRORMASK));
436 	if (err) {
437 		CLR(c, TTY_ERRORMASK);
438 		if (ISSET(err, TTY_BI)) {
439 			if (ISSET(iflag, IGNBRK)) {
440 				lwkt_reltoken(&tp->t_token);
441 				return (0);
442 			}
443 			if (ISSET(iflag, BRKINT)) {
444 				ttyflush(tp, FREAD | FWRITE);
445 				pgsignal(tp->t_pgrp, SIGINT, 1);
446 				goto endcase;
447 			}
448 			if (ISSET(iflag, PARMRK))
449 				goto parmrk;
450 		} else if ((ISSET(err, TTY_PE) && ISSET(iflag, INPCK))
451 			|| ISSET(err, TTY_FE)) {
452 			if (ISSET(iflag, IGNPAR)) {
453 				lwkt_reltoken(&tp->t_token);
454 				return (0);
455 			}
456 			else if (ISSET(iflag, PARMRK)) {
457 parmrk:
458 				if (tp->t_rawq.c_cc + tp->t_canq.c_cc >
459 				    MAX_INPUT - 3)
460 					goto input_overflow;
461 				clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
462 				clist_putc(0 | TTY_QUOTE, &tp->t_rawq);
463 				clist_putc(c | TTY_QUOTE, &tp->t_rawq);
464 				goto endcase;
465 			} else
466 				c = 0;
467 		}
468 	}
469 
470 	if (!ISSET(tp->t_state, TS_TYPEN) && ISSET(iflag, ISTRIP))
471 		CLR(c, 0x80);
472 	if (!ISSET(lflag, EXTPROC)) {
473 		/*
474 		 * Check for literal nexting very first
475 		 */
476 		if (ISSET(tp->t_state, TS_LNCH)) {
477 			SET(c, TTY_QUOTE);
478 			CLR(tp->t_state, TS_LNCH);
479 		}
480 		/*
481 		 * Scan for special characters.  This code
482 		 * is really just a big case statement with
483 		 * non-constant cases.  The bottom of the
484 		 * case statement is labeled ``endcase'', so goto
485 		 * it after a case match, or similar.
486 		 */
487 
488 		/*
489 		 * Control chars which aren't controlled
490 		 * by ICANON, ISIG, or IXON.
491 		 */
492 		if (ISSET(lflag, IEXTEN)) {
493 			if (CCEQ(cc[VLNEXT], c)) {
494 				if (ISSET(lflag, ECHO)) {
495 					if (ISSET(lflag, ECHOE)) {
496 						(void)ttyoutput('^', tp);
497 						(void)ttyoutput('\b', tp);
498 					} else
499 						ttyecho(c, tp);
500 				}
501 				SET(tp->t_state, TS_LNCH);
502 				goto endcase;
503 			}
504 			if (CCEQ(cc[VDISCARD], c)) {
505 				if (ISSET(lflag, FLUSHO))
506 					CLR(tp->t_lflag, FLUSHO);
507 				else {
508 					ttyflush(tp, FWRITE);
509 					ttyecho(c, tp);
510 					if (tp->t_rawq.c_cc + tp->t_canq.c_cc)
511 						ttyretype(tp);
512 					SET(tp->t_lflag, FLUSHO);
513 				}
514 				goto startoutput;
515 			}
516 		}
517 		/*
518 		 * Signals.
519 		 */
520 		if (ISSET(lflag, ISIG)) {
521 			if (CCEQ(cc[VINTR], c) || CCEQ(cc[VQUIT], c)) {
522 				if (!ISSET(lflag, NOFLSH))
523 					ttyflush(tp, FREAD | FWRITE);
524 				ttyecho(c, tp);
525 				pgsignal(tp->t_pgrp,
526 				    CCEQ(cc[VINTR], c) ? SIGINT : SIGQUIT, 1);
527 				goto endcase;
528 			}
529 			if (CCEQ(cc[VSUSP], c)) {
530 				if (!ISSET(lflag, NOFLSH))
531 					ttyflush(tp, FREAD);
532 				ttyecho(c, tp);
533 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
534 				goto endcase;
535 			}
536 		}
537 		/*
538 		 * Handle start/stop characters.
539 		 */
540 		if (ISSET(iflag, IXON)) {
541 			if (CCEQ(cc[VSTOP], c)) {
542 				if (!ISSET(tp->t_state, TS_TTSTOP)) {
543 					SET(tp->t_state, TS_TTSTOP);
544 					(*tp->t_stop)(tp, 0);
545 					lwkt_reltoken(&tp->t_token);
546 					return (0);
547 				}
548 				if (!CCEQ(cc[VSTART], c)) {
549 					lwkt_reltoken(&tp->t_token);
550 					return (0);
551 				}
552 				/*
553 				 * if VSTART == VSTOP then toggle
554 				 */
555 				goto endcase;
556 			}
557 			if (CCEQ(cc[VSTART], c))
558 				goto restartoutput;
559 		}
560 		/*
561 		 * IGNCR, ICRNL, & INLCR
562 		 */
563 		if (c == '\r') {
564 			if (ISSET(iflag, IGNCR)) {
565 				lwkt_reltoken(&tp->t_token);
566 				return (0);
567 			}
568 			else if (ISSET(iflag, ICRNL))
569 				c = '\n';
570 		} else if (c == '\n' && ISSET(iflag, INLCR))
571 			c = '\r';
572 	}
573 	if (!ISSET(tp->t_lflag, EXTPROC) && ISSET(lflag, ICANON)) {
574 		/*
575 		 * From here on down canonical mode character
576 		 * processing takes place.
577 		 */
578 		/*
579 		 * erase or erase2 (^H / ^?)
580 		 */
581 		if (CCEQ(cc[VERASE], c) || CCEQ(cc[VERASE2], c) ) {
582 			if (tp->t_rawq.c_cc)
583 				ttyrub(clist_unputc(&tp->t_rawq), tp);
584 			goto endcase;
585 		}
586 		/*
587 		 * kill (^U)
588 		 */
589 		if (CCEQ(cc[VKILL], c)) {
590 			if (ISSET(lflag, ECHOKE) &&
591 			    tp->t_rawq.c_cc == tp->t_rocount &&
592 			    !ISSET(lflag, ECHOPRT))
593 				while (tp->t_rawq.c_cc)
594 					ttyrub(clist_unputc(&tp->t_rawq), tp);
595 			else {
596 				ttyecho(c, tp);
597 				if (ISSET(lflag, ECHOK) ||
598 				    ISSET(lflag, ECHOKE))
599 					ttyecho('\n', tp);
600 				FLUSHQ(&tp->t_rawq);
601 				tp->t_rocount = 0;
602 			}
603 			CLR(tp->t_state, TS_LOCAL);
604 			goto endcase;
605 		}
606 		/*
607 		 * word erase (^W)
608 		 */
609 		if (CCEQ(cc[VWERASE], c) && ISSET(lflag, IEXTEN)) {
610 			int ctype;
611 
612 			/*
613 			 * erase whitespace
614 			 */
615 			while ((c = clist_unputc(&tp->t_rawq)) == ' ' || c == '\t')
616 				ttyrub(c, tp);
617 			if (c == -1)
618 				goto endcase;
619 			/*
620 			 * erase last char of word and remember the
621 			 * next chars type (for ALTWERASE)
622 			 */
623 			ttyrub(c, tp);
624 			c = clist_unputc(&tp->t_rawq);
625 			if (c == -1)
626 				goto endcase;
627 			if (c == ' ' || c == '\t') {
628 				clist_putc(c, &tp->t_rawq);
629 				goto endcase;
630 			}
631 			ctype = ISALPHA(c);
632 			/*
633 			 * erase rest of word
634 			 */
635 			do {
636 				ttyrub(c, tp);
637 				c = clist_unputc(&tp->t_rawq);
638 				if (c == -1)
639 					goto endcase;
640 			} while (c != ' ' && c != '\t' &&
641 			    (!ISSET(lflag, ALTWERASE) || ISALPHA(c) == ctype));
642 			clist_putc(c, &tp->t_rawq);
643 			goto endcase;
644 		}
645 		/*
646 		 * reprint line (^R)
647 		 */
648 		if (CCEQ(cc[VREPRINT], c) && ISSET(lflag, IEXTEN)) {
649 			ttyretype(tp);
650 			goto endcase;
651 		}
652 		/*
653 		 * ^T - kernel info and generate SIGINFO
654 		 */
655 		if (CCEQ(cc[VSTATUS], c) && ISSET(lflag, IEXTEN)) {
656 			if (ISSET(lflag, ISIG))
657 				pgsignal(tp->t_pgrp, SIGINFO, 1);
658 			if (!ISSET(lflag, NOKERNINFO))
659 				ttyinfo(tp);
660 			goto endcase;
661 		}
662 		if (CCEQ(cc[VCHECKPT], c) && ISSET(lflag, IEXTEN)) {
663 			if (ISSET(lflag, ISIG))
664 				pgsignal(tp->t_pgrp, SIGCKPT, 1);
665 			goto endcase;
666 		}
667 	}
668 	/*
669 	 * Check for input buffer overflow
670 	 */
671 	if (tp->t_rawq.c_cc + tp->t_canq.c_cc >= MAX_INPUT) {
672 input_overflow:
673 		if (ISSET(iflag, IMAXBEL)) {
674 			if (tp->t_outq.c_cc < tp->t_ohiwat)
675 				(void)ttyoutput(CTRL('g'), tp);
676 		}
677 		goto endcase;
678 	}
679 
680 	if (c == 0377 && ISSET(iflag, PARMRK) && !ISSET(iflag, ISTRIP) &&
681 	    ISSET(iflag, IGNBRK|IGNPAR) != (IGNBRK|IGNPAR)) {
682 		clist_putc(0377 | TTY_QUOTE, &tp->t_rawq);
683 	}
684 
685 	/*
686 	 * Put data char in q for user and
687 	 * wakeup on seeing a line delimiter.
688 	 */
689 	if (clist_putc(c, &tp->t_rawq) >= 0) {
690 		if (!ISSET(lflag, ICANON)) {
691 			ttwakeup(tp);
692 			ttyecho(c, tp);
693 			goto endcase;
694 		}
695 		if (TTBREAKC(c, lflag)) {
696 			tp->t_rocount = 0;
697 			clist_catq(&tp->t_rawq, &tp->t_canq);
698 			ttwakeup(tp);
699 		} else if (tp->t_rocount++ == 0)
700 			tp->t_rocol = tp->t_column;
701 		if (ISSET(tp->t_state, TS_ERASE)) {
702 			/*
703 			 * end of prterase \.../
704 			 */
705 			CLR(tp->t_state, TS_ERASE);
706 			(void)ttyoutput('/', tp);
707 		}
708 		i = tp->t_column;
709 		ttyecho(c, tp);
710 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ECHO)) {
711 			/*
712 			 * Place the cursor over the '^' of the ^D.
713 			 */
714 			i = imin(2, tp->t_column - i);
715 			while (i > 0) {
716 				(void)ttyoutput('\b', tp);
717 				i--;
718 			}
719 		}
720 	}
721 endcase:
722 	/*
723 	 * IXANY means allow any character to restart output.
724 	 */
725 	if (ISSET(tp->t_state, TS_TTSTOP) &&
726 	    !ISSET(iflag, IXANY) && cc[VSTART] != cc[VSTOP]) {
727 		lwkt_reltoken(&tp->t_token);
728 		return (0);
729 	}
730 restartoutput:
731 	CLR(tp->t_lflag, FLUSHO);
732 	CLR(tp->t_state, TS_TTSTOP);
733 startoutput:
734 	lwkt_reltoken(&tp->t_token);
735 	return (ttstart(tp));
736 }
737 
738 /*
739  * Output a single character on a tty, doing output processing
740  * as needed (expanding tabs, newline processing, etc.).
741  * Returns < 0 if succeeds, otherwise returns char to resend.
742  * Must be recursive.
743  */
744 static int
745 ttyoutput(int c, struct tty *tp)
746 {
747 	tcflag_t oflag;
748 	int col;
749 
750 	lwkt_gettoken(&tp->t_token);
751 	oflag = tp->t_oflag;
752 	if (!ISSET(oflag, OPOST)) {
753 		if (ISSET(tp->t_lflag, FLUSHO)) {
754 			lwkt_reltoken(&tp->t_token);
755 			return (-1);
756 		}
757 		if (clist_putc(c, &tp->t_outq)) {
758 			lwkt_reltoken(&tp->t_token);
759 			return (c);
760 		}
761 		tk_nout++;
762 		tp->t_outcc++;
763 		lwkt_reltoken(&tp->t_token);
764 		return (-1);
765 	}
766 	/*
767 	 * Do tab expansion if OXTABS aka TAB3 is set.  Special case if we
768 	 * external processing, we don't do the tab expansion because we'll
769 	 * probably get it wrong.  If tab expansion needs to be done, let
770 	 * it happen externally.
771 	 */
772 	CLR(c, ~TTY_CHARMASK);
773 	if (c == '\t' &&
774 	    ISSET(oflag, OXTABS) && !ISSET(tp->t_lflag, EXTPROC)) {
775 		c = 8 - (tp->t_column & 7);
776 		if (!ISSET(tp->t_lflag, FLUSHO)) {
777 			c -= clist_btoq("        ", c, &tp->t_outq);
778 			tk_nout += c;
779 			tp->t_outcc += c;
780 		}
781 		tp->t_column += c;
782 		lwkt_reltoken(&tp->t_token);
783 		return (c ? -1 : '\t');
784 	}
785 	if (c == CEOT && ISSET(oflag, ONOEOT)) {
786 		lwkt_reltoken(&tp->t_token);
787 		return (-1);
788 	}
789 
790 	/*
791 	 * Newline translation: if ONLCR is set,
792 	 * translate newline into "\r\n".
793 	 */
794 	if (c == '\n' && ISSET(tp->t_oflag, ONLCR)) {
795 		tk_nout++;
796 		tp->t_outcc++;
797 		if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc('\r', &tp->t_outq)) {
798 			lwkt_reltoken(&tp->t_token);
799 			return (c);
800 		}
801 	}
802 	/* If OCRNL is set, translate "\r" into "\n". */
803 	else if (c == '\r' && ISSET(tp->t_oflag, OCRNL))
804 		c = '\n';
805 	/* If ONOCR is set, don't transmit CRs when on column 0. */
806 	else if (c == '\r' && ISSET(tp->t_oflag, ONOCR) && tp->t_column == 0) {
807 		lwkt_reltoken(&tp->t_token);
808 		return (-1);
809 	}
810 
811 	tk_nout++;
812 	tp->t_outcc++;
813 	if (!ISSET(tp->t_lflag, FLUSHO) && clist_putc(c, &tp->t_outq)) {
814 		lwkt_reltoken(&tp->t_token);
815 		return (c);
816 	}
817 
818 	col = tp->t_column;
819 	switch (CCLASS(c)) {
820 	case BACKSPACE:
821 		if (col > 0)
822 			--col;
823 		break;
824 	case CONTROL:
825 		break;
826 	case NEWLINE:
827 		if (ISSET(tp->t_oflag, ONLCR | ONLRET))
828 			col = 0;
829 		break;
830 	case RETURN:
831 		col = 0;
832 		break;
833 	case ORDINARY:
834 		++col;
835 		break;
836 	case TAB:
837 		col = (col + 8) & ~7;
838 		break;
839 	}
840 	tp->t_column = col;
841 	lwkt_reltoken(&tp->t_token);
842 
843 	return (-1);
844 }
845 
846 /*
847  * Ioctls for all tty devices.  Called after line-discipline specific ioctl
848  * has been called to do discipline-specific functions and/or reject any
849  * of these ioctl commands.
850  */
851 /* ARGSUSED */
852 int
853 ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
854 {
855 	struct thread *td = curthread;
856 	struct lwp *lp = td->td_lwp;
857 	struct proc *p = td->td_proc;
858 	struct pgrp *opgrp;
859 	struct tty *otp;
860 	int error;
861 
862 	KKASSERT(p);
863 	lwkt_gettoken(&tp->t_token);
864 	lwkt_gettoken(&p->p_token);
865 
866 	/* If the ioctl involves modification, hang if in the background. */
867 	switch (cmd) {
868 	case  TIOCCBRK:
869 	case  TIOCCONS:
870 	case  TIOCDRAIN:
871 	case  TIOCEXCL:
872 	case  TIOCFLUSH:
873 #ifdef TIOCHPCL
874 	case  TIOCHPCL:
875 #endif
876 	case  TIOCNXCL:
877 	case  TIOCSBRK:
878 	case  TIOCSCTTY:
879 	case  TIOCSDRAINWAIT:
880 	case  TIOCSETA:
881 	case  TIOCSETAF:
882 	case  TIOCSETAW:
883 	case  TIOCSETD:
884 	case  TIOCSPGRP:
885 	case  TIOCSTART:
886 	case  TIOCSTAT:
887 	case  TIOCSTI:
888 	case  TIOCSTOP:
889 	case  TIOCSWINSZ:
890 		while (isbackground(p, tp) && !(p->p_flags & P_PPWAIT) &&
891 		    !SIGISMEMBER(p->p_sigignore, SIGTTOU) &&
892 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
893 			if (p->p_pgrp->pg_jobc == 0) {
894 				lwkt_reltoken(&p->p_token);
895 				lwkt_reltoken(&tp->t_token);
896 				return (EIO);
897 			}
898 			pgsignal(p->p_pgrp, SIGTTOU, 1);
899 			error = ttysleep(tp, &lbolt, PCATCH, "ttybg1",
900 					 0);
901 			if (error) {
902 				lwkt_reltoken(&p->p_token);
903 				lwkt_reltoken(&tp->t_token);
904 				return (error);
905 			}
906 		}
907 		break;
908 	}
909 
910 	switch (cmd) {			/* Process the ioctl. */
911 	case FIOASYNC:			/* set/clear async i/o */
912 		if (*(int *)data)
913 			SET(tp->t_state, TS_ASYNC);
914 		else
915 			CLR(tp->t_state, TS_ASYNC);
916 		break;
917 	case FIONREAD:			/* get # bytes to read */
918 		*(int *)data = ttnread(tp);
919 		break;
920 
921 	case FIOSETOWN:
922 		/*
923 		 * Policy -- Don't allow FIOSETOWN on someone else's
924 		 *           controlling tty
925 		 */
926 		if (tp->t_session != NULL && !isctty(p, tp)) {
927 			lwkt_reltoken(&p->p_token);
928 			lwkt_reltoken(&tp->t_token);
929 			return (ENOTTY);
930 		}
931 
932 		error = fsetown(*(int *)data, &tp->t_sigio);
933 		if (error) {
934 			lwkt_reltoken(&p->p_token);
935 			lwkt_reltoken(&tp->t_token);
936 			return (error);
937 		}
938 		break;
939 	case FIOGETOWN:
940 		if (tp->t_session != NULL && !isctty(p, tp)) {
941 			lwkt_reltoken(&p->p_token);
942 			lwkt_reltoken(&tp->t_token);
943 			return (ENOTTY);
944 		}
945 		*(int *)data = fgetown(&tp->t_sigio);
946 		break;
947 
948 	case TIOCEXCL:			/* set exclusive use of tty */
949 		SET(tp->t_state, TS_XCLUDE);
950 		break;
951 	case TIOCFLUSH: {		/* flush buffers */
952 		int flags = *(int *)data;
953 
954 		if (flags == 0)
955 			flags = FREAD | FWRITE;
956 		else
957 			flags &= FREAD | FWRITE;
958 		ttyflush(tp, flags);
959 		break;
960 	}
961 	case TIOCCONS:			/* become virtual console */
962 		if (*(int *)data) {
963 			if (constty && constty != tp &&
964 			    ISSET(constty->t_state, TS_CONNECTED)) {
965 				lwkt_reltoken(&p->p_token);
966 				lwkt_reltoken(&tp->t_token);
967 				return (EBUSY);
968 			}
969 #ifndef	UCONSOLE
970 			if ((error = priv_check(td, PRIV_ROOT)) != 0) {
971 				lwkt_reltoken(&p->p_token);
972 				lwkt_reltoken(&tp->t_token);
973 				return (error);
974 			}
975 #endif
976 			constty = tp;
977 		} else if (tp == constty)
978 			constty = NULL;
979 		break;
980 	case TIOCDRAIN:			/* wait till output drained */
981 		error = ttywait(tp);
982 		if (error) {
983 			lwkt_reltoken(&p->p_token);
984 			lwkt_reltoken(&tp->t_token);
985 			return (error);
986 		}
987 		break;
988 	case TIOCGETA: {		/* get termios struct */
989 		struct termios *t = (struct termios *)data;
990 
991 		bcopy(&tp->t_termios, t, sizeof(struct termios));
992 		break;
993 	}
994 	case TIOCGETD:			/* get line discipline */
995 		*(int *)data = tp->t_line;
996 		break;
997 	case TIOCGWINSZ:		/* get window size */
998 		*(struct winsize *)data = tp->t_winsize;
999 		break;
1000 	case TIOCGPGRP:			/* get pgrp of tty */
1001 		if (!isctty(p, tp)) {
1002 			lwkt_reltoken(&p->p_token);
1003 			lwkt_reltoken(&tp->t_token);
1004 			return (ENOTTY);
1005 		}
1006 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
1007 		break;
1008 	case TIOCGSID:                  /* get sid of tty */
1009 		if (!isctty(p, tp)) {
1010 			lwkt_reltoken(&p->p_token);
1011 			lwkt_reltoken(&tp->t_token);
1012 			return (ENOTTY);
1013 		}
1014 		*(int *)data = tp->t_session->s_sid;
1015 		break;
1016 #ifdef TIOCHPCL
1017 	case TIOCHPCL:			/* hang up on last close */
1018 		SET(tp->t_cflag, HUPCL);
1019 		break;
1020 #endif
1021 	case TIOCNXCL:			/* reset exclusive use of tty */
1022 		CLR(tp->t_state, TS_XCLUDE);
1023 		break;
1024 	case TIOCOUTQ:			/* output queue size */
1025 		*(int *)data = tp->t_outq.c_cc;
1026 		break;
1027 	case TIOCSETA:			/* set termios struct */
1028 	case TIOCSETAW:			/* drain output, set */
1029 	case TIOCSETAF: {		/* drn out, fls in, set */
1030 		struct termios *t = (struct termios *)data;
1031 
1032 		if (t->c_ispeed == 0)
1033 			t->c_ispeed = t->c_ospeed;
1034 		if (t->c_ispeed == 0)
1035 			t->c_ispeed = tp->t_ospeed;
1036 		if (t->c_ispeed == 0) {
1037 			lwkt_reltoken(&p->p_token);
1038 			lwkt_reltoken(&tp->t_token);
1039 			return (EINVAL);
1040 		}
1041 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
1042 			error = ttywait(tp);
1043 			if (error) {
1044 				lwkt_reltoken(&p->p_token);
1045 				lwkt_reltoken(&tp->t_token);
1046 				return (error);
1047 			}
1048 			if (cmd == TIOCSETAF)
1049 				ttyflush(tp, FREAD);
1050 		}
1051 		if (!ISSET(t->c_cflag, CIGNORE)) {
1052 			/*
1053 			 * Set device hardware.
1054 			 */
1055 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
1056 				lwkt_reltoken(&p->p_token);
1057 				lwkt_reltoken(&tp->t_token);
1058 				return (error);
1059 			}
1060 			if (ISSET(t->c_cflag, CLOCAL) &&
1061 			    !ISSET(tp->t_cflag, CLOCAL)) {
1062 				/*
1063 				 * XXX disconnections would be too hard to
1064 				 * get rid of without this kludge.  The only
1065 				 * way to get rid of controlling terminals
1066 				 * is to exit from the session leader.
1067 				 */
1068 				CLR(tp->t_state, TS_ZOMBIE);
1069 
1070 				wakeup(TSA_CARR_ON(tp));
1071 				ttwakeup(tp);
1072 				ttwwakeup(tp);
1073 			}
1074 			if ((ISSET(tp->t_state, TS_CARR_ON) ||
1075 			     ISSET(t->c_cflag, CLOCAL)) &&
1076 			    !ISSET(tp->t_state, TS_ZOMBIE))
1077 				SET(tp->t_state, TS_CONNECTED);
1078 			else
1079 				CLR(tp->t_state, TS_CONNECTED);
1080 			tp->t_cflag = t->c_cflag;
1081 			tp->t_ispeed = t->c_ispeed;
1082 			if (t->c_ospeed != 0)
1083 				tp->t_ospeed = t->c_ospeed;
1084 			ttsetwater(tp);
1085 		}
1086 		if (ISSET(t->c_lflag, ICANON) != ISSET(tp->t_lflag, ICANON) &&
1087 		    cmd != TIOCSETAF) {
1088 			if (ISSET(t->c_lflag, ICANON))
1089 				SET(tp->t_lflag, PENDIN);
1090 			else {
1091 				/*
1092 				 * XXX we really shouldn't allow toggling
1093 				 * ICANON while we're in a non-termios line
1094 				 * discipline.  Now we have to worry about
1095 				 * panicing for a null queue.
1096 				 */
1097 				if (tp->t_canq.c_ccmax > 0 &&
1098 				    tp->t_rawq.c_ccmax > 0) {
1099 					clist_catq(&tp->t_rawq, &tp->t_canq);
1100 					/*
1101 					 * XXX the queue limits may be
1102 					 * different, so the old queue
1103 					 * swapping method no longer works.
1104 					 */
1105 					clist_catq(&tp->t_canq, &tp->t_rawq);
1106 				}
1107 				CLR(tp->t_lflag, PENDIN);
1108 			}
1109 			ttwakeup(tp);
1110 		}
1111 		tp->t_iflag = t->c_iflag;
1112 		tp->t_oflag = t->c_oflag;
1113 		/*
1114 		 * Make the EXTPROC bit read only.
1115 		 */
1116 		if (ISSET(tp->t_lflag, EXTPROC))
1117 			SET(t->c_lflag, EXTPROC);
1118 		else
1119 			CLR(t->c_lflag, EXTPROC);
1120 		tp->t_lflag = t->c_lflag | ISSET(tp->t_lflag, PENDIN);
1121 		if (t->c_cc[VMIN] != tp->t_cc[VMIN] ||
1122 		    t->c_cc[VTIME] != tp->t_cc[VTIME])
1123 			ttwakeup(tp);
1124 		bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1125 		break;
1126 	}
1127 	case TIOCSETD: {		/* set line discipline */
1128 		int t = *(int *)data;
1129 		cdev_t device = tp->t_dev;
1130 
1131 		if ((u_int)t >= nlinesw) {
1132 			lwkt_reltoken(&p->p_token);
1133 			lwkt_reltoken(&tp->t_token);
1134 			return (ENXIO);
1135 		}
1136 		if (t != tp->t_line) {
1137 			(*linesw[tp->t_line].l_close)(tp, flag);
1138 			error = (*linesw[t].l_open)(device, tp);
1139 			if (error) {
1140 				(void)(*linesw[tp->t_line].l_open)(device, tp);
1141 				lwkt_reltoken(&p->p_token);
1142 				lwkt_reltoken(&tp->t_token);
1143 				return (error);
1144 			}
1145 			tp->t_line = t;
1146 		}
1147 		break;
1148 	}
1149 	case TIOCSTART:			/* start output, like ^Q */
1150 		if (ISSET(tp->t_state, TS_TTSTOP) ||
1151 		    ISSET(tp->t_lflag, FLUSHO)) {
1152 			CLR(tp->t_lflag, FLUSHO);
1153 			CLR(tp->t_state, TS_TTSTOP);
1154 			ttstart(tp);
1155 		}
1156 		break;
1157 	case TIOCSTI:			/* simulate terminal input */
1158 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT)) {
1159 			lwkt_reltoken(&p->p_token);
1160 			lwkt_reltoken(&tp->t_token);
1161 			return (EPERM);
1162 		}
1163 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT)) {
1164 			lwkt_reltoken(&p->p_token);
1165 			lwkt_reltoken(&tp->t_token);
1166 			return (EACCES);
1167 		}
1168 		(*linesw[tp->t_line].l_rint)(*(u_char *)data, tp);
1169 		break;
1170 	case TIOCSTOP:			/* stop output, like ^S */
1171 		if (!ISSET(tp->t_state, TS_TTSTOP)) {
1172 			SET(tp->t_state, TS_TTSTOP);
1173 			(*tp->t_stop)(tp, 0);
1174 		}
1175 		break;
1176 	case TIOCSCTTY:			/* become controlling tty */
1177 		/* Session ctty vnode pointer set in vnode layer. */
1178 		if (!SESS_LEADER(p) ||
1179 		    ((p->p_session->s_ttyvp || tp->t_session) &&
1180 		    (tp->t_session != p->p_session))) {
1181 			lwkt_reltoken(&p->p_token);
1182 			lwkt_reltoken(&tp->t_token);
1183 			return (EPERM);
1184 		}
1185 		ttyhold(tp);
1186 		tp->t_session = p->p_session;
1187 		opgrp = tp->t_pgrp;
1188 		pgref(p->p_pgrp);
1189 		tp->t_pgrp = p->p_pgrp;
1190 		otp = p->p_session->s_ttyp;
1191 		p->p_session->s_ttyp = tp;
1192 		p->p_flags |= P_CONTROLT;
1193 		if (otp)
1194 			ttyunhold(otp);
1195 		if (opgrp) {
1196 			pgrel(opgrp);
1197 			opgrp = NULL;
1198 		}
1199 		break;
1200 	case TIOCSPGRP: {		/* set pgrp of tty */
1201 		pid_t pgid = *(int *)data;
1202 
1203 		if (!isctty(p, tp)) {
1204 			lwkt_reltoken(&p->p_token);
1205 			lwkt_reltoken(&tp->t_token);
1206 			return (ENOTTY);
1207 		}
1208 		else if (pgid < 1 || pgid > PID_MAX) {
1209 			lwkt_reltoken(&p->p_token);
1210 			lwkt_reltoken(&tp->t_token);
1211 			return (EINVAL);
1212 		} else {
1213 			struct pgrp *pgrp = pgfind(pgid);
1214 			if (pgrp == NULL || pgrp->pg_session != p->p_session) {
1215 				if (pgrp)
1216 					pgrel(pgrp);
1217 				lwkt_reltoken(&p->p_token);
1218 				lwkt_reltoken(&tp->t_token);
1219 				return (EPERM);
1220 			}
1221 			opgrp = tp->t_pgrp;
1222 			tp->t_pgrp = pgrp;
1223 			if (opgrp) {
1224 				pgrel(opgrp);
1225 				opgrp = NULL;
1226 			}
1227 		}
1228 		break;
1229 	}
1230 	case TIOCSTAT:			/* simulate control-T */
1231 		ttyinfo(tp);
1232 		break;
1233 	case TIOCSWINSZ:		/* set window size */
1234 		if (bcmp((caddr_t)&tp->t_winsize, data,
1235 		    sizeof (struct winsize))) {
1236 			tp->t_winsize = *(struct winsize *)data;
1237 			pgsignal(tp->t_pgrp, SIGWINCH, 1);
1238 		}
1239 		break;
1240 	case TIOCSDRAINWAIT:
1241 		error = priv_check(td, PRIV_ROOT);
1242 		if (error) {
1243 			lwkt_reltoken(&p->p_token);
1244 			lwkt_reltoken(&tp->t_token);
1245 			return (error);
1246 		}
1247 		tp->t_timeout = *(int *)data * hz;
1248 		wakeup(TSA_OCOMPLETE(tp));
1249 		wakeup(TSA_OLOWAT(tp));
1250 		break;
1251 	case TIOCGDRAINWAIT:
1252 		*(int *)data = tp->t_timeout / hz;
1253 		break;
1254 	default:
1255 		lwkt_reltoken(&p->p_token);
1256 		lwkt_reltoken(&tp->t_token);
1257 		return (ENOIOCTL);
1258 	}
1259 	lwkt_reltoken(&p->p_token);
1260 	lwkt_reltoken(&tp->t_token);
1261 	return (0);
1262 }
1263 
1264 static struct filterops ttyread_filtops =
1265 	{ FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ttyrdetach, filt_ttyread };
1266 static struct filterops ttywrite_filtops =
1267 	{ FILTEROP_ISFD|FILTEROP_MPSAFE, NULL, filt_ttywdetach, filt_ttywrite };
1268 
1269 int
1270 ttykqfilter(struct dev_kqfilter_args *ap)
1271 {
1272 	cdev_t dev = ap->a_head.a_dev;
1273 	struct knote *kn = ap->a_kn;
1274 	struct tty *tp = dev->si_tty;
1275 	struct klist *klist;
1276 
1277 	ap->a_result = 0;
1278 
1279 	lwkt_gettoken(&tp->t_token);
1280 	switch (kn->kn_filter) {
1281 	case EVFILT_READ:
1282 		klist = &tp->t_rkq.ki_note;
1283 		kn->kn_fop = &ttyread_filtops;
1284 		break;
1285 	case EVFILT_WRITE:
1286 		klist = &tp->t_wkq.ki_note;
1287 		kn->kn_fop = &ttywrite_filtops;
1288 		break;
1289 	default:
1290 		ap->a_result = EOPNOTSUPP;
1291 		lwkt_reltoken(&tp->t_token);
1292 		return (0);
1293 	}
1294 	lwkt_reltoken(&tp->t_token);
1295 	kn->kn_hook = (caddr_t)dev;
1296 	knote_insert(klist, kn);
1297 
1298 	return (0);
1299 }
1300 
1301 static void
1302 filt_ttyrdetach(struct knote *kn)
1303 {
1304 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1305 
1306 	lwkt_gettoken(&tp->t_token);
1307 	knote_remove(&tp->t_rkq.ki_note, kn);
1308 	lwkt_reltoken(&tp->t_token);
1309 }
1310 
1311 static int
1312 filt_ttyread(struct knote *kn, long hint)
1313 {
1314 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1315 
1316 	lwkt_gettoken(&tp->t_token);
1317 	kn->kn_data = ttnread(tp);
1318 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1319 		kn->kn_flags |= (EV_EOF | EV_NODATA);
1320 		lwkt_reltoken(&tp->t_token);
1321 		return (1);
1322 	}
1323 	lwkt_reltoken(&tp->t_token);
1324 	return (kn->kn_data > 0);
1325 }
1326 
1327 static void
1328 filt_ttywdetach(struct knote *kn)
1329 {
1330 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1331 
1332 	lwkt_gettoken(&tp->t_token);
1333 	knote_remove(&tp->t_wkq.ki_note, kn);
1334 	lwkt_reltoken(&tp->t_token);
1335 }
1336 
1337 static int
1338 filt_ttywrite(struct knote *kn, long hint)
1339 {
1340 	struct tty *tp = ((cdev_t)kn->kn_hook)->si_tty;
1341 	int ret;
1342 
1343 	lwkt_gettoken(&tp->t_token);
1344 	kn->kn_data = tp->t_outq.c_cc;
1345 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1346 		lwkt_reltoken(&tp->t_token);
1347 		return (1);
1348 	}
1349 	ret = (kn->kn_data <= tp->t_olowat &&
1350 	    ISSET(tp->t_state, TS_CONNECTED));
1351 	lwkt_reltoken(&tp->t_token);
1352 	return ret;
1353 }
1354 
1355 /*
1356  * NOTE: tp->t_token must be held.
1357  */
1358 static int
1359 ttnread(struct tty *tp)
1360 {
1361 	int nread;
1362 
1363 	ASSERT_LWKT_TOKEN_HELD(&tp->t_token);
1364 	if (ISSET(tp->t_lflag, PENDIN))
1365 		ttypend(tp);
1366 	nread = tp->t_canq.c_cc;
1367 	if (!ISSET(tp->t_lflag, ICANON)) {
1368 		nread += tp->t_rawq.c_cc;
1369 		if (nread < tp->t_cc[VMIN] && tp->t_cc[VTIME] == 0)
1370 			nread = 0;
1371 	}
1372 	return (nread);
1373 }
1374 
1375 /*
1376  * Wait for output to drain.
1377  */
1378 int
1379 ttywait(struct tty *tp)
1380 {
1381 	int error;
1382 
1383 	error = 0;
1384 	lwkt_gettoken(&tp->t_token);
1385 	while ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1386 	       ISSET(tp->t_state, TS_CONNECTED) && tp->t_oproc) {
1387 		(*tp->t_oproc)(tp);
1388 		if ((tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)) &&
1389 		    ISSET(tp->t_state, TS_CONNECTED)) {
1390 			SET(tp->t_state, TS_SO_OCOMPLETE);
1391 			error = ttysleep(tp, TSA_OCOMPLETE(tp),
1392 					 PCATCH, "ttywai",
1393 					 tp->t_timeout);
1394 			if (error) {
1395 				if (error == EWOULDBLOCK)
1396 					error = EIO;
1397 				break;
1398 			}
1399 		} else
1400 			break;
1401 	}
1402 	if (!error && (tp->t_outq.c_cc || ISSET(tp->t_state, TS_BUSY)))
1403 		error = EIO;
1404 	lwkt_reltoken(&tp->t_token);
1405 
1406 	return (error);
1407 }
1408 
1409 /*
1410  * Flush if successfully wait.
1411  */
1412 static int
1413 ttywflush(struct tty *tp)
1414 {
1415 	int error;
1416 
1417 	if ((error = ttywait(tp)) == 0)
1418 		ttyflush(tp, FREAD);
1419 	return (error);
1420 }
1421 
1422 /*
1423  * Flush tty read and/or write queues, notifying anyone waiting.
1424  */
1425 void
1426 ttyflush(struct tty *tp, int rw)
1427 {
1428 	lwkt_gettoken(&tp->t_token);
1429 #if 0
1430 again:
1431 #endif
1432 	if (rw & FWRITE) {
1433 		FLUSHQ(&tp->t_outq);
1434 		CLR(tp->t_state, TS_TTSTOP);
1435 	}
1436 	(*tp->t_stop)(tp, rw);
1437 	if (rw & FREAD) {
1438 		FLUSHQ(&tp->t_canq);
1439 		FLUSHQ(&tp->t_rawq);
1440 		CLR(tp->t_lflag, PENDIN);
1441 		tp->t_rocount = 0;
1442 		tp->t_rocol = 0;
1443 		CLR(tp->t_state, TS_LOCAL);
1444 		ttwakeup(tp);
1445 		if (ISSET(tp->t_state, TS_TBLOCK)) {
1446 			if (rw & FWRITE)
1447 				FLUSHQ(&tp->t_outq);
1448 			ttyunblock(tp);
1449 
1450 			/*
1451 			 * Don't let leave any state that might clobber the
1452 			 * next line discipline (although we should do more
1453 			 * to send the START char).  Not clearing the state
1454 			 * may have caused the "putc to a clist with no
1455 			 * reserved cblocks" panic/kprintf.
1456 			 */
1457 			CLR(tp->t_state, TS_TBLOCK);
1458 
1459 #if 0 /* forget it, sleeping isn't always safe and we don't know when it is */
1460 			if (ISSET(tp->t_iflag, IXOFF)) {
1461 				/*
1462 				 * XXX wait a bit in the hope that the stop
1463 				 * character (if any) will go out.  Waiting
1464 				 * isn't good since it allows races.  This
1465 				 * will be fixed when the stop character is
1466 				 * put in a special queue.  Don't bother with
1467 				 * the checks in ttywait() since the timeout
1468 				 * will save us.
1469 				 */
1470 				SET(tp->t_state, TS_SO_OCOMPLETE);
1471 				ttysleep(tp, TSA_OCOMPLETE(tp), 0,
1472 					 "ttyfls", hz / 10);
1473 				/*
1474 				 * Don't try sending the stop character again.
1475 				 */
1476 				CLR(tp->t_state, TS_TBLOCK);
1477 				goto again;
1478 			}
1479 #endif
1480 		}
1481 	}
1482 	if (rw & FWRITE) {
1483 		FLUSHQ(&tp->t_outq);
1484 		ttwwakeup(tp);
1485 	}
1486 	lwkt_reltoken(&tp->t_token);
1487 }
1488 
1489 /*
1490  * Copy in the default termios characters.
1491  */
1492 void
1493 termioschars(struct termios *t)
1494 {
1495 	bcopy(ttydefchars, t->c_cc, sizeof t->c_cc);
1496 }
1497 
1498 /*
1499  * Old interface.
1500  */
1501 void
1502 ttychars(struct tty *tp)
1503 {
1504 	lwkt_gettoken(&tp->t_token);
1505 	termioschars(&tp->t_termios);
1506 	lwkt_reltoken(&tp->t_token);
1507 }
1508 
1509 /*
1510  * Handle input high water.  Send stop character for the IXOFF case.  Turn
1511  * on our input flow control bit and propagate the changes to the driver.
1512  * XXX the stop character should be put in a special high priority queue.
1513  */
1514 void
1515 ttyblock(struct tty *tp)
1516 {
1517 	lwkt_gettoken(&tp->t_token);
1518 	SET(tp->t_state, TS_TBLOCK);
1519 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTOP] != _POSIX_VDISABLE &&
1520 	    clist_putc(tp->t_cc[VSTOP], &tp->t_outq) != 0)
1521 		CLR(tp->t_state, TS_TBLOCK);	/* try again later */
1522 	ttstart(tp);
1523 	lwkt_reltoken(&tp->t_token);
1524 }
1525 
1526 /*
1527  * Handle input low water.  Send start character for the IXOFF case.  Turn
1528  * off our input flow control bit and propagate the changes to the driver.
1529  * XXX the start character should be put in a special high priority queue.
1530  */
1531 static void
1532 ttyunblock(struct tty *tp)
1533 {
1534 	lwkt_gettoken(&tp->t_token);
1535 	CLR(tp->t_state, TS_TBLOCK);
1536 	if (ISSET(tp->t_iflag, IXOFF) && tp->t_cc[VSTART] != _POSIX_VDISABLE &&
1537 	    clist_putc(tp->t_cc[VSTART], &tp->t_outq) != 0)
1538 		SET(tp->t_state, TS_TBLOCK);	/* try again later */
1539 	ttstart(tp);
1540 	lwkt_reltoken(&tp->t_token);
1541 }
1542 
1543 int
1544 ttstart(struct tty *tp)
1545 {
1546 	lwkt_gettoken(&tp->t_token);
1547 	if (tp->t_oproc != NULL)	/* XXX: Kludge for pty. */
1548 		(*tp->t_oproc)(tp);
1549 	lwkt_reltoken(&tp->t_token);
1550 	return (0);
1551 }
1552 
1553 /*
1554  * "close" a line discipline
1555  */
1556 int
1557 ttylclose(struct tty *tp, int flag)
1558 {
1559 	lwkt_gettoken(&tp->t_token);
1560 	if (flag & FNONBLOCK || ttywflush(tp))
1561 		ttyflush(tp, FREAD | FWRITE);
1562 	lwkt_reltoken(&tp->t_token);
1563 	return (0);
1564 }
1565 
1566 void
1567 ttyhold(struct tty *tp)
1568 {
1569 	lwkt_gettoken(&tp->t_token);
1570 	++tp->t_refs;
1571 	lwkt_reltoken(&tp->t_token);
1572 }
1573 
1574 void
1575 ttyunhold(struct tty *tp)
1576 {
1577 	lwkt_gettoken(&tp->t_token);
1578 	if (tp->t_unhold)
1579 		tp->t_unhold(tp);
1580 	else
1581 		--tp->t_refs;
1582 	lwkt_reltoken(&tp->t_token);
1583 }
1584 
1585 /*
1586  * Handle modem control transition on a tty.
1587  * Flag indicates new state of carrier.
1588  * Returns 0 if the line should be turned off, otherwise 1.
1589  */
1590 int
1591 ttymodem(struct tty *tp, int flag)
1592 {
1593 	lwkt_gettoken(&tp->t_token);
1594 	if (ISSET(tp->t_state, TS_CARR_ON) && ISSET(tp->t_cflag, MDMBUF)) {
1595 		/*
1596 		 * MDMBUF: do flow control according to carrier flag
1597 		 * XXX TS_CAR_OFLOW doesn't do anything yet.  TS_TTSTOP
1598 		 * works if IXON and IXANY are clear.
1599 		 */
1600 		if (flag) {
1601 			CLR(tp->t_state, TS_CAR_OFLOW);
1602 			CLR(tp->t_state, TS_TTSTOP);
1603 			ttstart(tp);
1604 		} else if (!ISSET(tp->t_state, TS_CAR_OFLOW)) {
1605 			SET(tp->t_state, TS_CAR_OFLOW);
1606 			SET(tp->t_state, TS_TTSTOP);
1607 			(*tp->t_stop)(tp, 0);
1608 		}
1609 	} else if (flag == 0) {
1610 		/*
1611 		 * Lost carrier.
1612 		 */
1613 		CLR(tp->t_state, TS_CARR_ON);
1614 		if (ISSET(tp->t_state, TS_ISOPEN) &&
1615 		    !ISSET(tp->t_cflag, CLOCAL)) {
1616 			SET(tp->t_state, TS_ZOMBIE);
1617 			CLR(tp->t_state, TS_CONNECTED);
1618 			if (tp->t_session && tp->t_session->s_leader)
1619 				ksignal(tp->t_session->s_leader, SIGHUP);
1620 			ttyflush(tp, FREAD | FWRITE);
1621 			lwkt_reltoken(&tp->t_token);
1622 			return (0);
1623 		}
1624 	} else {
1625 		/*
1626 		 * Carrier now on.
1627 		 */
1628 		SET(tp->t_state, TS_CARR_ON);
1629 		if (!ISSET(tp->t_state, TS_ZOMBIE))
1630 			SET(tp->t_state, TS_CONNECTED);
1631 		wakeup(TSA_CARR_ON(tp));
1632 		ttwakeup(tp);
1633 		ttwwakeup(tp);
1634 	}
1635 	lwkt_reltoken(&tp->t_token);
1636 	return (1);
1637 }
1638 
1639 /*
1640  * Reinput pending characters after state switch
1641  */
1642 static void
1643 ttypend(struct tty *tp)
1644 {
1645 	struct clist tq;
1646 	int c;
1647 
1648 	lwkt_gettoken(&tp->t_token);
1649 	CLR(tp->t_lflag, PENDIN);
1650 	SET(tp->t_state, TS_TYPEN);
1651 	/*
1652 	 * XXX this assumes too much about clist internals.  It may even
1653 	 * fail if the cblock slush pool is empty.  We can't allocate more
1654 	 * cblocks here because we are called from an interrupt handler
1655 	 * and clist_alloc_cblocks() can wait.
1656 	 */
1657 	tq = tp->t_rawq;
1658 	bzero(&tp->t_rawq, sizeof tp->t_rawq);
1659 	clist_alloc_cblocks(&tp->t_rawq, tq.c_ccmax);
1660 	while ((c = clist_getc(&tq)) >= 0)
1661 		ttyinput(c, tp);
1662 	CLR(tp->t_state, TS_TYPEN);
1663 	clist_free_cblocks(&tq);
1664 	lwkt_reltoken(&tp->t_token);
1665 }
1666 
1667 /*
1668  * Process a read call on a tty device.
1669  */
1670 int
1671 ttread(struct tty *tp, struct uio *uio, int flag)
1672 {
1673 	struct clist *qp;
1674 	int c;
1675 	tcflag_t lflag;
1676 	cc_t *cc = tp->t_cc;
1677 	struct proc *pp;
1678 	struct lwp *lp;
1679 	int first, error = 0;
1680 	int has_stime = 0, last_cc = 0;
1681 	long slp = 0;		/* XXX this should be renamed `timo'. */
1682 	struct timeval stime;
1683 
1684 	lp = curthread->td_lwp;
1685 	stime.tv_sec = 0;	/* fix compiler warnings */
1686 	stime.tv_usec = 0;
1687 
1688 	lwkt_gettoken(&tp->t_token);
1689 loop:
1690 	lflag = tp->t_lflag;
1691 	/*
1692 	 * take pending input first
1693 	 */
1694 	if (ISSET(lflag, PENDIN)) {
1695 		ttypend(tp);
1696 		splz();		/* reduce latency */
1697 		lflag = tp->t_lflag;	/* XXX ttypend() clobbers it */
1698 	}
1699 
1700 	/*
1701 	 * Hang process if it's in the background.
1702 	 */
1703 	if ((pp = curproc) != NULL)
1704 		lwkt_gettoken(&pp->p_token);
1705 	if (pp && isbackground(pp, tp)) {
1706 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
1707 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
1708 		    (pp->p_flags & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0) {
1709 			lwkt_reltoken(&pp->p_token);
1710 			lwkt_reltoken(&tp->t_token);
1711 			return (EIO);
1712 		}
1713 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
1714 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
1715 		if (error) {
1716 			lwkt_reltoken(&pp->p_token);
1717 			lwkt_reltoken(&tp->t_token);
1718 			return (error);
1719 		}
1720 		lwkt_reltoken(&pp->p_token);
1721 		goto loop;
1722 	}
1723 	if (pp)
1724 		lwkt_reltoken(&pp->p_token);
1725 
1726 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
1727 		lwkt_reltoken(&tp->t_token);
1728 		return (0);	/* EOF */
1729 	}
1730 
1731 	/*
1732 	 * If canonical, use the canonical queue,
1733 	 * else use the raw queue.
1734 	 *
1735 	 * (should get rid of clists...)
1736 	 */
1737 	qp = ISSET(lflag, ICANON) ? &tp->t_canq : &tp->t_rawq;
1738 
1739 	if (flag & IO_NDELAY) {
1740 		if (qp->c_cc > 0)
1741 			goto read;
1742 		if (!ISSET(lflag, ICANON) && cc[VMIN] == 0) {
1743 			lwkt_reltoken(&tp->t_token);
1744 			return (0);
1745 		}
1746 		lwkt_reltoken(&tp->t_token);
1747 		return (EWOULDBLOCK);
1748 	}
1749 	if (!ISSET(lflag, ICANON)) {
1750 		int m = cc[VMIN];
1751 		long t = cc[VTIME];
1752 		struct timeval timecopy;
1753 
1754 		/*
1755 		 * Check each of the four combinations.
1756 		 * (m > 0 && t == 0) is the normal read case.
1757 		 * It should be fairly efficient, so we check that and its
1758 		 * companion case (m == 0 && t == 0) first.
1759 		 * For the other two cases, we compute the target sleep time
1760 		 * into slp.
1761 		 */
1762 		if (t == 0) {
1763 			if (qp->c_cc < m)
1764 				goto sleep;
1765 			if (qp->c_cc > 0)
1766 				goto read;
1767 
1768 			/* m, t and qp->c_cc are all 0.  0 is enough input. */
1769 			lwkt_reltoken(&tp->t_token);
1770 			return (0);
1771 		}
1772 		t *= 100000;		/* time in us */
1773 #define diff(t1, t2) (((t1).tv_sec - (t2).tv_sec) * 1000000 + \
1774 			 ((t1).tv_usec - (t2).tv_usec))
1775 		if (m > 0) {
1776 			if (qp->c_cc <= 0)
1777 				goto sleep;
1778 			if (qp->c_cc >= m)
1779 				goto read;
1780 			getmicrotime(&timecopy);
1781 			if (has_stime == 0) {
1782 				/* first character, start timer */
1783 				has_stime = 1;
1784 				stime = timecopy;
1785 				slp = t;
1786 			} else if (qp->c_cc > last_cc) {
1787 				/* got a character, restart timer */
1788 				stime = timecopy;
1789 				slp = t;
1790 			} else {
1791 				/* nothing, check expiration */
1792 				slp = t - diff(timecopy, stime);
1793 				if (slp <= 0)
1794 					goto read;
1795 			}
1796 			last_cc = qp->c_cc;
1797 		} else {	/* m == 0 */
1798 			if (qp->c_cc > 0)
1799 				goto read;
1800 			getmicrotime(&timecopy);
1801 			if (has_stime == 0) {
1802 				has_stime = 1;
1803 				stime = timecopy;
1804 				slp = t;
1805 			} else {
1806 				slp = t - diff(timecopy, stime);
1807 				if (slp <= 0) {
1808 					/* Timed out, but 0 is enough input. */
1809 					lwkt_reltoken(&tp->t_token);
1810 					return (0);
1811 				}
1812 			}
1813 		}
1814 #undef diff
1815 		/*
1816 		 * Rounding down may make us wake up just short
1817 		 * of the target, so we round up.
1818 		 * The formula is ceiling(slp * hz/1000000).
1819 		 * 32-bit arithmetic is enough for hz < 169.
1820 		 * XXX see tvtohz() for how to avoid overflow if hz
1821 		 * is large (divide by `tick' and/or arrange to
1822 		 * use tvtohz() if hz is large).
1823 		 */
1824 		slp = (long) (((u_long)slp * hz) + 999999) / 1000000;
1825 		goto sleep;
1826 	}
1827 	if (qp->c_cc <= 0) {
1828 sleep:
1829 		/*
1830 		 * There is no input, or not enough input and we can block.
1831 		 */
1832 		error = ttysleep(tp, TSA_HUP_OR_INPUT(tp), PCATCH,
1833 				 ISSET(tp->t_state, TS_CONNECTED) ?
1834 				 "ttyin" : "ttyhup", (int)slp);
1835 		if (error == EWOULDBLOCK)
1836 			error = 0;
1837 		else if (error) {
1838 			lwkt_reltoken(&tp->t_token);
1839 			return (error);
1840 		}
1841 		/*
1842 		 * XXX what happens if another process eats some input
1843 		 * while we are asleep (not just here)?  It would be
1844 		 * safest to detect changes and reset our state variables
1845 		 * (has_stime and last_cc).
1846 		 */
1847 		slp = 0;
1848 		goto loop;
1849 	}
1850 read:
1851 	/*
1852 	 * Input present, check for input mapping and processing.
1853 	 */
1854 	first = 1;
1855 	if (ISSET(lflag, ICANON | ISIG))
1856 		goto slowcase;
1857 	for (;;) {
1858 		char ibuf[IBUFSIZ];
1859 		int icc;
1860 
1861 		icc = (int)szmin(uio->uio_resid, IBUFSIZ);
1862 		icc = clist_qtob(qp, ibuf, icc);
1863 		if (icc <= 0) {
1864 			if (first)
1865 				goto loop;
1866 			break;
1867 		}
1868 		error = uiomove(ibuf, (size_t)icc, uio);
1869 		/*
1870 		 * XXX if there was an error then we should ungetc() the
1871 		 * unmoved chars and reduce icc here.
1872 		 */
1873 		if (error)
1874 			break;
1875 		if (uio->uio_resid == 0)
1876 			break;
1877 		first = 0;
1878 	}
1879 	goto out;
1880 slowcase:
1881 	for (;;) {
1882 		c = clist_getc(qp);
1883 		if (c < 0) {
1884 			if (first)
1885 				goto loop;
1886 			break;
1887 		}
1888 		/*
1889 		 * delayed suspend (^Y)
1890 		 */
1891 		if (CCEQ(cc[VDSUSP], c) &&
1892 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
1893 			pgsignal(tp->t_pgrp, SIGTSTP, 1);
1894 			if (first) {
1895 				error = ttysleep(tp, &lbolt, PCATCH,
1896 						 "ttybg3", 0);
1897 				if (error)
1898 					break;
1899 				goto loop;
1900 			}
1901 			break;
1902 		}
1903 		/*
1904 		 * Interpret EOF only in canonical mode.
1905 		 */
1906 		if (CCEQ(cc[VEOF], c) && ISSET(lflag, ICANON))
1907 			break;
1908 		/*
1909 		 * Give user character.
1910 		 */
1911 		error = ureadc(c, uio);
1912 		if (error)
1913 			/* XXX should ungetc(c, qp). */
1914 			break;
1915 		if (uio->uio_resid == 0)
1916 			break;
1917 		/*
1918 		 * In canonical mode check for a "break character"
1919 		 * marking the end of a "line of input".
1920 		 */
1921 		if (ISSET(lflag, ICANON) && TTBREAKC(c, lflag))
1922 			break;
1923 		first = 0;
1924 	}
1925 
1926 out:
1927 	/*
1928 	 * Look to unblock input now that (presumably)
1929 	 * the input queue has gone down.
1930 	 */
1931 	if (ISSET(tp->t_state, TS_TBLOCK) &&
1932 	    tp->t_rawq.c_cc + tp->t_canq.c_cc <= tp->t_ilowat) {
1933 		ttyunblock(tp);
1934 	}
1935 
1936 	lwkt_reltoken(&tp->t_token);
1937 	return (error);
1938 }
1939 
1940 /*
1941  * Check the output queue on tp for space for a kernel message (from uprintf
1942  * or tprintf).  Allow some space over the normal hiwater mark so we don't
1943  * lose messages due to normal flow control, but don't let the tty run amok.
1944  * Sleeps here are not interruptible, but we return prematurely if new signals
1945  * arrive.
1946  */
1947 int
1948 ttycheckoutq(struct tty *tp, int wait)
1949 {
1950 	struct lwp *lp = curthread->td_lwp;
1951 	int hiwat;
1952 	sigset_t oldset, newset;
1953 
1954 	lwkt_gettoken(&tp->t_token);
1955 	hiwat = tp->t_ohiwat;
1956 	SIGEMPTYSET(oldset);
1957 	SIGEMPTYSET(newset);
1958 	if (wait)
1959 		oldset = lwp_sigpend(lp);
1960 	if (tp->t_outq.c_cc > hiwat + OBUFSIZ + 100) {
1961 		while (tp->t_outq.c_cc > hiwat) {
1962 			ttstart(tp);
1963 			if (tp->t_outq.c_cc <= hiwat)
1964 				break;
1965 			if (wait)
1966 				newset = lwp_sigpend(lp);
1967 			if (!wait || SIGSETNEQ(oldset, newset)) {
1968 				lwkt_reltoken(&tp->t_token);
1969 				return (0);
1970 			}
1971 			SET(tp->t_state, TS_SO_OLOWAT);
1972 			tsleep(TSA_OLOWAT(tp), 0, "ttoutq", hz);
1973 		}
1974 	}
1975 	lwkt_reltoken(&tp->t_token);
1976 	return (1);
1977 }
1978 
1979 /*
1980  * Process a write call on a tty device.
1981  */
1982 int
1983 ttwrite(struct tty *tp, struct uio *uio, int flag)
1984 {
1985 	char *cp = NULL;
1986 	int cc, ce;
1987 	struct proc *pp;
1988 	struct lwp *lp;
1989 	int i, hiwat, error;
1990 	size_t cnt;
1991 
1992 	char obuf[OBUFSIZ];
1993 
1994 	lwkt_gettoken(&tp->t_token);
1995 	lp = curthread->td_lwp;
1996 	hiwat = tp->t_ohiwat;
1997 	cnt = uio->uio_resid;
1998 	error = 0;
1999 	cc = 0;
2000 loop:
2001 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
2002 		if (uio->uio_resid == cnt)
2003 			error = EIO;
2004 		goto out;
2005 	}
2006 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2007 		if (flag & IO_NDELAY) {
2008 			error = EWOULDBLOCK;
2009 			goto out;
2010 		}
2011 		error = ttysleep(tp, TSA_CARR_ON(tp), PCATCH, "ttydcd", 0);
2012 		if (error)
2013 			goto out;
2014 		goto loop;
2015 	}
2016 
2017 	/*
2018 	 * Hang the process if it's in the background.
2019 	 */
2020 	if ((pp = curproc) != NULL)
2021 		lwkt_gettoken(&pp->p_token);
2022 	if (pp && isbackground(pp, tp) &&
2023 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flags & P_PPWAIT) &&
2024 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
2025 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
2026 		if (pp->p_pgrp->pg_jobc == 0) {
2027 			error = EIO;
2028 			lwkt_reltoken(&pp->p_token);
2029 			goto out;
2030 		}
2031 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
2032 		lwkt_reltoken(&pp->p_token);
2033 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
2034 		if (error)
2035 			goto out;
2036 		goto loop;
2037 	}
2038 	if (pp)
2039 		lwkt_reltoken(&pp->p_token);
2040 	/*
2041 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
2042 	 * output translation.  Keep track of high water mark, sleep on
2043 	 * overflow awaiting device aid in acquiring new space.
2044 	 */
2045 	while (uio->uio_resid > 0 || cc > 0) {
2046 		if (ISSET(tp->t_lflag, FLUSHO)) {
2047 			uio->uio_resid = 0;
2048 			lwkt_reltoken(&tp->t_token);
2049 			return (0);
2050 		}
2051 		if (tp->t_outq.c_cc > hiwat)
2052 			goto ovhiwat;
2053 		/*
2054 		 * Grab a hunk of data from the user, unless we have some
2055 		 * leftover from last time.
2056 		 */
2057 		if (cc == 0) {
2058 			cc = szmin(uio->uio_resid, OBUFSIZ);
2059 			cp = obuf;
2060 			error = uiomove(cp, (size_t)cc, uio);
2061 			if (error) {
2062 				cc = 0;
2063 				break;
2064 			}
2065 		}
2066 		/*
2067 		 * If nothing fancy need be done, grab those characters we
2068 		 * can handle without any of ttyoutput's processing and
2069 		 * just transfer them to the output q.  For those chars
2070 		 * which require special processing (as indicated by the
2071 		 * bits in char_type), call ttyoutput.  After processing
2072 		 * a hunk of data, look for FLUSHO so ^O's will take effect
2073 		 * immediately.
2074 		 */
2075 		while (cc > 0) {
2076 			if (!ISSET(tp->t_oflag, OPOST))
2077 				ce = cc;
2078 			else {
2079 				ce = cc - scanc((u_int)cc, (u_char *)cp,
2080 						char_type, CCLASSMASK);
2081 				/*
2082 				 * If ce is zero, then we're processing
2083 				 * a special character through ttyoutput.
2084 				 */
2085 				if (ce == 0) {
2086 					tp->t_rocount = 0;
2087 					if (ttyoutput(*cp, tp) >= 0) {
2088 						/* No Clists, wait a bit. */
2089 						ttstart(tp);
2090 						if (flag & IO_NDELAY) {
2091 							error = EWOULDBLOCK;
2092 							goto out;
2093 						}
2094 						error = ttysleep(tp, &lbolt,
2095 								 PCATCH,
2096 								 "ttybf1", 0);
2097 						if (error)
2098 							goto out;
2099 						goto loop;
2100 					}
2101 					cp++;
2102 					cc--;
2103 					if (ISSET(tp->t_lflag, FLUSHO) ||
2104 					    tp->t_outq.c_cc > hiwat)
2105 						goto ovhiwat;
2106 					continue;
2107 				}
2108 			}
2109 			/*
2110 			 * A bunch of normal characters have been found.
2111 			 * Transfer them en masse to the output queue and
2112 			 * continue processing at the top of the loop.
2113 			 * If there are any further characters in this
2114 			 * <= OBUFSIZ chunk, the first should be a character
2115 			 * requiring special handling by ttyoutput.
2116 			 */
2117 			tp->t_rocount = 0;
2118 			i = clist_btoq(cp, ce, &tp->t_outq);
2119 			ce -= i;
2120 			tp->t_column += ce;
2121 			cp += ce, cc -= ce, tk_nout += ce;
2122 			tp->t_outcc += ce;
2123 			if (i > 0) {
2124 				/* No Clists, wait a bit. */
2125 				ttstart(tp);
2126 				if (flag & IO_NDELAY) {
2127 					error = EWOULDBLOCK;
2128 					goto out;
2129 				}
2130 				error = ttysleep(tp, &lbolt, PCATCH,
2131 						 "ttybf2", 0);
2132 				if (error)
2133 					goto out;
2134 				goto loop;
2135 			}
2136 			if (ISSET(tp->t_lflag, FLUSHO) ||
2137 			    tp->t_outq.c_cc > hiwat)
2138 				break;
2139 		}
2140 		ttstart(tp);
2141 	}
2142 out:
2143 	/*
2144 	 * If cc is nonzero, we leave the uio structure inconsistent, as the
2145 	 * offset and iov pointers have moved forward, but it doesn't matter
2146 	 * (the call will either return short or restart with a new uio).
2147 	 */
2148 	uio->uio_resid += cc;
2149 	lwkt_reltoken(&tp->t_token);
2150 	return (error);
2151 
2152 ovhiwat:
2153 	ttstart(tp);
2154 	/*
2155 	 * This can only occur if FLUSHO is set in t_lflag,
2156 	 * or if ttstart/oproc is synchronous (or very fast).
2157 	 */
2158 	if (tp->t_outq.c_cc <= hiwat) {
2159 		goto loop;
2160 	}
2161 	if (flag & IO_NDELAY) {
2162 		uio->uio_resid += cc;
2163 		lwkt_reltoken(&tp->t_token);
2164 		return (uio->uio_resid == cnt ? EWOULDBLOCK : 0);
2165 	}
2166 	SET(tp->t_state, TS_SO_OLOWAT);
2167 	error = ttysleep(tp, TSA_OLOWAT(tp), PCATCH, "ttywri", tp->t_timeout);
2168 	if (error == EWOULDBLOCK)
2169 		error = EIO;
2170 	if (error)
2171 		goto out;
2172 	goto loop;
2173 }
2174 
2175 /*
2176  * Rubout one character from the rawq of tp
2177  * as cleanly as possible.
2178  * NOTE: Must be called with tp->t_token held
2179  */
2180 static void
2181 ttyrub(int c, struct tty *tp)
2182 {
2183 	void *cp;
2184 	int savecol;
2185 	int tabc;
2186 
2187 	ASSERT_LWKT_TOKEN_HELD(&tp->t_token);
2188 	if (!ISSET(tp->t_lflag, ECHO) || ISSET(tp->t_lflag, EXTPROC))
2189 		return;
2190 	CLR(tp->t_lflag, FLUSHO);
2191 	if (ISSET(tp->t_lflag, ECHOE)) {
2192 		if (tp->t_rocount == 0) {
2193 			/*
2194 			 * Screwed by ttwrite; retype
2195 			 */
2196 			ttyretype(tp);
2197 			return;
2198 		}
2199 		if (c == ('\t' | TTY_QUOTE) || c == ('\n' | TTY_QUOTE))
2200 			ttyrubo(tp, 2);
2201 		else {
2202 			CLR(c, ~TTY_CHARMASK);
2203 			switch (CCLASS(c)) {
2204 			case ORDINARY:
2205 				ttyrubo(tp, 1);
2206 				break;
2207 			case BACKSPACE:
2208 			case CONTROL:
2209 			case NEWLINE:
2210 			case RETURN:
2211 			case VTAB:
2212 				if (ISSET(tp->t_lflag, ECHOCTL))
2213 					ttyrubo(tp, 2);
2214 				break;
2215 			case TAB:
2216 				if (tp->t_rocount < tp->t_rawq.c_cc) {
2217 					ttyretype(tp);
2218 					return;
2219 				}
2220 				savecol = tp->t_column;
2221 				SET(tp->t_state, TS_CNTTB);
2222 				SET(tp->t_lflag, FLUSHO);
2223 				tp->t_column = tp->t_rocol;
2224 
2225 				cp = clist_nextc(&tp->t_rawq, NULL, &tabc);
2226 				while (cp) {
2227 					ttyecho(tabc, tp);
2228 					cp = clist_nextc(&tp->t_rawq,
2229 							 cp, &tabc);
2230 				}
2231 				CLR(tp->t_lflag, FLUSHO);
2232 				CLR(tp->t_state, TS_CNTTB);
2233 
2234 				/* savecol will now be length of the tab. */
2235 				savecol -= tp->t_column;
2236 				tp->t_column += savecol;
2237 				if (savecol > 8)
2238 					savecol = 8;	/* overflow screw */
2239 				while (--savecol >= 0)
2240 					(void)ttyoutput('\b', tp);
2241 				break;
2242 			default:			/* XXX */
2243 #define	PANICSTR	"ttyrub: would panic c = %d, val = %d\n"
2244 				(void)kprintf(PANICSTR, c, CCLASS(c));
2245 #ifdef notdef
2246 				panic(PANICSTR, c, CCLASS(c));
2247 #endif
2248 			}
2249 		}
2250 	} else if (ISSET(tp->t_lflag, ECHOPRT)) {
2251 		if (!ISSET(tp->t_state, TS_ERASE)) {
2252 			SET(tp->t_state, TS_ERASE);
2253 			(void)ttyoutput('\\', tp);
2254 		}
2255 		ttyecho(c, tp);
2256 	} else {
2257 		ttyecho(tp->t_cc[VERASE], tp);
2258 		/*
2259 		 * This code may be executed not only when an ERASE key
2260 		 * is pressed, but also when ^U (KILL) or ^W (WERASE) are.
2261 		 * So, I didn't think it was worthwhile to pass the extra
2262 		 * information (which would need an extra parameter,
2263 		 * changing every call) needed to distinguish the ERASE2
2264 		 * case from the ERASE.
2265 		 */
2266 	}
2267 	--tp->t_rocount;
2268 }
2269 
2270 /*
2271  * Back over cnt characters, erasing them.
2272  * NOTE: Must be called with tp->t_token held
2273  */
2274 static void
2275 ttyrubo(struct tty *tp, int cnt)
2276 {
2277 	ASSERT_LWKT_TOKEN_HELD(&tp->t_token);
2278 	while (cnt-- > 0) {
2279 		(void)ttyoutput('\b', tp);
2280 		(void)ttyoutput(' ', tp);
2281 		(void)ttyoutput('\b', tp);
2282 	}
2283 }
2284 
2285 /*
2286  * ttyretype --
2287  *	Reprint the rawq line.  Note, it is assumed that c_cc has already
2288  *	been checked.
2289  * NOTE: Must be called with tp->t_token held
2290  */
2291 static void
2292 ttyretype(struct tty *tp)
2293 {
2294 	void *cp;
2295 	int c;
2296 
2297 	ASSERT_LWKT_TOKEN_HELD(&tp->t_token);
2298 	/* Echo the reprint character. */
2299 	if (tp->t_cc[VREPRINT] != _POSIX_VDISABLE)
2300 		ttyecho(tp->t_cc[VREPRINT], tp);
2301 
2302 	(void)ttyoutput('\n', tp);
2303 
2304 	/*
2305 	 * XXX
2306 	 * FIX: NEXTC IS BROKEN - DOESN'T CHECK QUOTE
2307 	 * BIT OF FIRST CHAR.
2308 	 */
2309 	cp = clist_nextc(&tp->t_canq, NULL, &c);
2310 	while (cp) {
2311 		ttyecho(c, tp);
2312 		cp = clist_nextc(&tp->t_canq, cp, &c);
2313 	}
2314 	cp = clist_nextc(&tp->t_rawq, NULL, &c);
2315 	while (cp) {
2316 		ttyecho(c, tp);
2317 		cp = clist_nextc(&tp->t_rawq, cp, &c);
2318 	}
2319 	CLR(tp->t_state, TS_ERASE);
2320 
2321 	tp->t_rocount = tp->t_rawq.c_cc;
2322 	tp->t_rocol = 0;
2323 }
2324 
2325 /*
2326  * Echo a typed character to the terminal.
2327  * NOTE: Must be called with tp->t_token held
2328  */
2329 static void
2330 ttyecho(int c, struct tty *tp)
2331 {
2332 	ASSERT_LWKT_TOKEN_HELD(&tp->t_token);
2333 
2334 	if (!ISSET(tp->t_state, TS_CNTTB))
2335 		CLR(tp->t_lflag, FLUSHO);
2336 	if ((!ISSET(tp->t_lflag, ECHO) &&
2337 	     (c != '\n' || !ISSET(tp->t_lflag, ECHONL))) ||
2338 	    ISSET(tp->t_lflag, EXTPROC))
2339 		return;
2340 	if (ISSET(tp->t_lflag, ECHOCTL) &&
2341 	    ((ISSET(c, TTY_CHARMASK) <= 037 && c != '\t' && c != '\n') ||
2342 	    ISSET(c, TTY_CHARMASK) == 0177)) {
2343 		(void)ttyoutput('^', tp);
2344 		CLR(c, ~TTY_CHARMASK);
2345 		if (c == 0177)
2346 			c = '?';
2347 		else
2348 			c += 'A' - 1;
2349 	}
2350 	(void)ttyoutput(c, tp);
2351 }
2352 
2353 /*
2354  * Wake up any readers on a tty.
2355  */
2356 void
2357 ttwakeup(struct tty *tp)
2358 {
2359 	lwkt_gettoken(&tp->t_token);
2360 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2361 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2362 	wakeup(TSA_HUP_OR_INPUT(tp));
2363 	KNOTE(&tp->t_rkq.ki_note, 0);
2364 	lwkt_reltoken(&tp->t_token);
2365 }
2366 
2367 /*
2368  * Wake up any writers on a tty.
2369  */
2370 void
2371 ttwwakeup(struct tty *tp)
2372 {
2373 	lwkt_gettoken(&tp->t_token);
2374 	if (ISSET(tp->t_state, TS_ASYNC) && tp->t_sigio != NULL)
2375 		pgsigio(tp->t_sigio, SIGIO, (tp->t_session != NULL));
2376 	if (ISSET(tp->t_state, TS_BUSY | TS_SO_OCOMPLETE) ==
2377 	    TS_SO_OCOMPLETE && tp->t_outq.c_cc == 0) {
2378 		CLR(tp->t_state, TS_SO_OCOMPLETE);
2379 		wakeup(TSA_OCOMPLETE(tp));
2380 	}
2381 	if (ISSET(tp->t_state, TS_SO_OLOWAT) &&
2382 	    tp->t_outq.c_cc <= tp->t_olowat) {
2383 		CLR(tp->t_state, TS_SO_OLOWAT);
2384 		wakeup(TSA_OLOWAT(tp));
2385 	}
2386 	KNOTE(&tp->t_wkq.ki_note, 0);
2387 	lwkt_reltoken(&tp->t_token);
2388 }
2389 
2390 /*
2391  * Look up a code for a specified speed in a conversion table;
2392  * used by drivers to map software speed values to hardware parameters.
2393  * No requirements
2394  */
2395 int
2396 ttspeedtab(int speed, struct speedtab *table)
2397 {
2398 
2399 	for ( ; table->sp_speed != -1; table++)
2400 		if (table->sp_speed == speed)
2401 			return (table->sp_code);
2402 	return (-1);
2403 }
2404 
2405 /*
2406  * Set input and output watermarks and buffer sizes.  For input, the
2407  * high watermark is about one second's worth of input above empty, the
2408  * low watermark is slightly below high water, and the buffer size is a
2409  * driver-dependent amount above high water.  For output, the watermarks
2410  * are near the ends of the buffer, with about 1 second's worth of input
2411  * between them.  All this only applies to the standard line discipline.
2412  */
2413 #define CLAMP(x, h, l)	((x) > h ? h : ((x) < l) ? l : (x))
2414 
2415 void
2416 ttsetwater(struct tty *tp)
2417 {
2418 	int ttmaxhiwat;		/* maximum high water mark */
2419 	int cps;		/* characters per second */
2420 	int x;
2421 
2422 	lwkt_gettoken(&tp->t_token);
2423 
2424 	/*
2425 	 * Input side.
2426 	 *
2427 	 * Calculate nominal low and high water marks, leave a little
2428 	 * room to absorb flow control latencies.
2429 	 */
2430 	clist_alloc_cblocks(&tp->t_canq, TTYHOG);
2431 
2432 	switch (tp->t_ispeedwat) {
2433 	case (speed_t)-1:
2434 		cps = tp->t_ispeed / 10;
2435 		break;
2436 	case 0:
2437 		/*
2438 		 * This case is for old drivers that don't know about
2439 		 * t_ispeedwat.  Arrange for them to get the old buffer
2440 		 * sizes and watermarks.
2441 		 */
2442 		cps = TTYHOG - 2 * 256;
2443 		tp->t_ififosize = 2 * 2048;
2444 		break;
2445 	default:
2446 		cps = tp->t_ispeedwat / 10;
2447 		break;
2448 	}
2449 	tp->t_ihiwat = cps;
2450 	tp->t_ilowat = 7 * cps / 8;
2451 	x = cps + tp->t_ififosize;
2452 	clist_alloc_cblocks(&tp->t_rawq, x);
2453 
2454 	/*
2455 	 * Output side.
2456 	 *
2457 	 * Calculate nominal low and high water marks, and make the
2458 	 * actual buffer just a tad larger to absorb flow control latencies.
2459 	 */
2460 	switch (tp->t_ospeedwat) {
2461 	case (speed_t)-1:
2462 		cps = tp->t_ospeed / 10;
2463 		ttmaxhiwat = 2 * TTMAXHIWAT;
2464 		break;
2465 	case 0:
2466 		cps = tp->t_ospeed / 10;
2467 		ttmaxhiwat = TTMAXHIWAT;
2468 		break;
2469 	default:
2470 		cps = tp->t_ospeedwat / 10;
2471 		ttmaxhiwat = 8 * TTMAXHIWAT;
2472 		break;
2473 	}
2474 
2475 	x = CLAMP(cps / 2, TTMAXLOWAT, TTMINLOWAT);
2476 	tp->t_olowat = x;
2477 
2478 	x += cps;
2479 	x = CLAMP(x, ttmaxhiwat, TTMINHIWAT);
2480 	tp->t_ohiwat = x;
2481 
2482 	x = imax(tp->t_ohiwat, TTMAXHIWAT);
2483 	x += OBUFSIZ + 100;
2484 	clist_alloc_cblocks(&tp->t_outq, x);
2485 
2486 	lwkt_reltoken(&tp->t_token);
2487 }
2488 
2489 #undef	CLAMP
2490 
2491 /*
2492  * Report on state of foreground process group.
2493  */
2494 void
2495 ttyinfo(struct tty *tp)
2496 {
2497 	struct pgrp *pgrp;
2498 	struct proc *p, *pick;
2499 	struct lwp *lp;
2500 	struct rusage ru;
2501 	char buf[64];
2502 	const char *str;
2503 	struct vmspace *vm;
2504 	long vmsz;
2505 	int pctcpu;
2506 	int tmp;
2507 
2508 	if (ttycheckoutq(tp,0) == 0)
2509 		return;
2510 
2511 	lwkt_gettoken(&tp->t_token);
2512 
2513 	/*
2514 	 * We always print the load average, then figure out what else to
2515 	 * print based on the state of the current process group.
2516 	 */
2517 	tmp = (averunnable.ldavg[0] * 100 + FSCALE / 2) >> FSHIFT;
2518 	ttyprintf(tp, "load: %d.%02d ", tmp / 100, tmp % 100);
2519 
2520 	if (tp->t_session == NULL) {
2521 		ttyprintf(tp, "not a controlling terminal\n");
2522 		goto done2;
2523 	}
2524 	if ((pgrp = tp->t_pgrp) == NULL) {
2525 		ttyprintf(tp, "no foreground process group\n");
2526 		goto done2;
2527 	}
2528 
2529 	/*
2530 	 * Pick an interesting process.  Note that certain elements,
2531 	 * in particular the wmesg.
2532 	 *
2533 	 * NOTE: lwp_wmesg is lwp_thread->td_wmesg.
2534 	 */
2535 	pgref(pgrp);
2536 	lwkt_gettoken(&pgrp->pg_token);
2537 
2538 	pick = NULL;
2539 	for (p = LIST_FIRST(&pgrp->pg_members);
2540 	     p != NULL;
2541 	     p = LIST_NEXT(p, p_pglist)) {
2542 		PHOLD(p);
2543 		if (proc_compare(pick, p)) {
2544 			if (pick)
2545 				PRELE(pick);
2546 			pick = p;
2547 		} else {
2548 			PRELE(p);
2549 		}
2550 	}
2551 	if (pick == NULL) {
2552 		ttyprintf(tp, "empty foreground process group\n");
2553 		goto done1;
2554 	}
2555 
2556 	/*
2557 	 * Pick an interesting LWP (XXX)
2558 	 *
2559 	 * pick is held.
2560 	 */
2561 	lp = FIRST_LWP_IN_PROC(pick);
2562 	if (lp == NULL) {
2563 		PRELE(pick);
2564 		ttyprintf(tp, "foreground process without lwp\n");
2565 		goto done1;
2566 	}
2567 
2568 	/*
2569 	 * Figure out what wait/process-state message, and command
2570 	 * buffer to present
2571 	 */
2572 	/*
2573 	 * XXX lwp This is a horrible mixture.  We need to rework this
2574 	 * as soon as lwps have their own runnable status.
2575 	 */
2576 	LWPHOLD(lp);
2577 	if (pick->p_flags & P_WEXIT)
2578 		str = "exiting";
2579 	else if (lp->lwp_stat == LSRUN)
2580 		str = "running";
2581 	else if (pick->p_stat == SIDL)
2582 		str = "spawning";
2583 	else if (lp->lwp_wmesg)	/* lwp_thread must not be NULL */
2584 		str = lp->lwp_wmesg;
2585 	else
2586 		str = "iowait";
2587 
2588 	ksnprintf(buf, sizeof(buf), "cmd: %s %d [%s]",
2589 		  pick->p_comm, pick->p_pid, str);
2590 
2591 	/*
2592 	 * Calculate cpu usage, percent cpu, and cmsz.  Note that
2593 	 * 'pick' becomes invalid the moment we release the token.
2594 	 */
2595 	if (lp->lwp_thread)
2596 		calcru_proc(pick, &ru);
2597 
2598 	pctcpu = (lp->lwp_pctcpu * 10000 + FSCALE / 2) >> FSHIFT;
2599 
2600 	LWPRELE(lp);
2601 
2602 	/*
2603 	 * NOTE: vmspace should be protected from destruction by the
2604 	 *	 combination of pg_token and the fact that we are not
2605 	 *	 flagged as a zombie.
2606 	 */
2607 	if (pick->p_stat == SIDL || pick->p_stat == SZOMB) {
2608 		vmsz = 0;
2609 	} else if ((vm = pick->p_vmspace) == NULL) {
2610 		vmsz = 0;
2611 	} else {
2612 		vmspace_hold(vm);
2613 		vmsz = pgtok(vmspace_resident_count(vm));
2614 		vmspace_drop(vm);
2615 	}
2616 	PRELE(pick);
2617 
2618 	/*
2619 	 * Dump the output
2620 	 */
2621 	ttyprintf(tp, " %s ",
2622 		  buf);
2623 	ttyprintf(tp, "%ld.%02ldu ",
2624 		  ru.ru_utime.tv_sec, ru.ru_utime.tv_usec / 10000);
2625 	ttyprintf(tp, "%ld.%02lds ",
2626 		  ru.ru_stime.tv_sec, ru.ru_stime.tv_usec / 10000);
2627 	ttyprintf(tp, "%d%% %ldk\n",
2628 		  pctcpu / 100, vmsz);
2629 
2630 done1:
2631 	lwkt_reltoken(&pgrp->pg_token);
2632 	pgrel(pgrp);
2633 done2:
2634 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
2635 	lwkt_reltoken(&tp->t_token);
2636 }
2637 
2638 /*
2639  * Returns 1 if p2 is "better" than p1
2640  *
2641  * The algorithm for picking the "interesting" process is thus:
2642  *
2643  *	1) Only foreground processes are eligible - implied.
2644  *	2) Runnable processes are favored over anything else.  The runner
2645  *	   with the highest cpu utilization is picked (p_cpticks).  Ties are
2646  *	   broken by picking the highest pid.
2647  *	3) The sleeper with the shortest sleep time is next.  With ties,
2648  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
2649  *	4) Further ties are broken by picking the highest pid.
2650  *
2651  * NOTE: must be called with p1 and p2 held.
2652  */
2653 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
2654 #define TESTAB(a, b)    ((a)<<1 | (b))
2655 #define ONLYA   2
2656 #define ONLYB   1
2657 #define BOTH    3
2658 
2659 static int
2660 proc_compare(struct proc *p1, struct proc *p2)
2661 {
2662 	struct lwp *lp1, *lp2;
2663 	int res;
2664 
2665 	if (p1 == NULL)
2666 		return (1);
2667 	if (lwkt_trytoken(&p1->p_token) == 0)
2668 		return (1);
2669 	if (lwkt_trytoken(&p2->p_token) == 0) {
2670 		lwkt_reltoken(&p1->p_token);
2671 		return (0);
2672 	}
2673 
2674 	/*
2675  	 * weed out zombies
2676 	 */
2677 	switch (TESTAB(p1->p_stat == SZOMB, p2->p_stat == SZOMB)) {
2678 	case ONLYA:
2679 		res = 1;
2680 		goto done;
2681 	case ONLYB:
2682 		res = 0;
2683 		goto done;
2684 	case BOTH:
2685 		res = (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2686 		goto done;
2687 	default:
2688 		break;
2689 	}
2690 
2691 	/* XXX choose the best lwp? */
2692 	lp1 = FIRST_LWP_IN_PROC(p1);
2693 	lp2 = FIRST_LWP_IN_PROC(p2);
2694 
2695 	/*
2696 	 * Favor one with LWPs verses one that has none (is exiting).
2697 	 */
2698 	if (lp1 == NULL) {
2699 		res = 1;
2700 		goto done;
2701 	}
2702 	if (lp2 == NULL) {
2703 		res = 0;
2704 		goto done;
2705 	}
2706 
2707 	/*
2708 	 * see if at least one of them is runnable
2709 	 */
2710 	switch (TESTAB(ISRUN(lp1), ISRUN(lp2))) {
2711 	case ONLYA:
2712 		res = 0;
2713 		goto done;
2714 	case ONLYB:
2715 		res = 1;
2716 		goto done;
2717 	case BOTH:
2718 		/*
2719 		 * tie - favor one with highest recent cpu utilization
2720 		 */
2721 		if (lp2->lwp_cpticks > lp1->lwp_cpticks)
2722 			res = 1;
2723 		else if (lp1->lwp_cpticks > lp2->lwp_cpticks)
2724 			res = 0;
2725 		else
2726 			res = (p2->p_pid > p1->p_pid); /* tie - ret highest */
2727 		goto done;
2728 	default:
2729 		break;
2730 	}
2731 
2732 	/*
2733 	 * Pick the one with the smallest sleep time
2734 	 */
2735 	if (lp2->lwp_slptime > lp1->lwp_slptime) {
2736 		res = 0;
2737 		goto done;
2738 	}
2739 	if (lp1->lwp_slptime > lp2->lwp_slptime) {
2740 		res = 1;
2741 		goto done;
2742 	}
2743 
2744 	/*
2745 	 * Favor one sleeping in a non-interruptible sleep
2746 	 */
2747 	if ((lp1->lwp_flags & LWP_SINTR) && (lp2->lwp_flags & LWP_SINTR) == 0)
2748 		res = 1;
2749 	else
2750 	if ((lp2->lwp_flags & LWP_SINTR) && (lp1->lwp_flags & LWP_SINTR) == 0)
2751 		res = 0;
2752 	else
2753 		res = (p2->p_pid > p1->p_pid);	/* tie - return highest pid */
2754 	/* fall through */
2755 
2756 done:
2757 	lwkt_reltoken(&p2->p_token);
2758 	lwkt_reltoken(&p1->p_token);
2759 	return (res);
2760 }
2761 
2762 /*
2763  * Output char to tty; console putchar style.
2764  */
2765 int
2766 tputchar(int c, struct tty *tp)
2767 {
2768 	lwkt_gettoken(&tp->t_token);
2769 	if (!ISSET(tp->t_state, TS_CONNECTED)) {
2770 		lwkt_reltoken(&tp->t_token);
2771 		return (-1);
2772 	}
2773 	if (c == '\n')
2774 		(void)ttyoutput('\r', tp);
2775 	(void)ttyoutput(c, tp);
2776 	ttstart(tp);
2777 	lwkt_reltoken(&tp->t_token);
2778 
2779 	return (0);
2780 }
2781 
2782 /*
2783  * Sleep on chan, returning ERESTART if tty changed while we napped and
2784  * returning any errors (e.g. EINTR/EWOULDBLOCK) reported by tsleep.  If
2785  * the tty is revoked, restarting a pending call will redo validation done
2786  * at the start of the call.
2787  */
2788 int
2789 ttysleep(struct tty *tp, void *chan, int slpflags, char *wmesg, int timo)
2790 {
2791 	int error;
2792 	int gen;
2793 
2794 	gen = tp->t_gen;
2795 	error = tsleep(chan, slpflags, wmesg, timo);
2796 	if (error)
2797 		return (error);
2798 	return (tp->t_gen == gen ? 0 : ERESTART);
2799 }
2800 
2801 /*
2802  * Revoke a tty.
2803  *
2804  * We bump the gen to force any ttysleep()'s to return with ERESTART
2805  * and flush the tty.  The related fp's should already have been
2806  * replaced so the tty will close when the last references on the
2807  * original fp's go away.
2808  */
2809 int
2810 ttyrevoke(struct dev_revoke_args *ap)
2811 {
2812 	struct tty *tp;
2813 
2814 	tp = ap->a_head.a_dev->si_tty;
2815 	lwkt_gettoken(&tp->t_token);
2816 	tp->t_gen++;
2817 	ttyflush(tp, FREAD | FWRITE);
2818 	wakeup(TSA_CARR_ON(tp));
2819 	ttwakeup(tp);
2820 	ttwwakeup(tp);
2821 	lwkt_reltoken(&tp->t_token);
2822 
2823 	return (0);
2824 }
2825 
2826 /*
2827  * Allocate a tty struct.  Clists in the struct will be allocated by
2828  * ttyopen().  The tty itself is protected by tp->t_token.  tty_token
2829  * is primarily used to interlock the NULL test and for registration.
2830  *
2831  * by convention, once allocated, tty structures are never freed.  This
2832  * saves us from numerous release race scenarios that can occur due to the
2833  * token being embedded in the tty structure.
2834  */
2835 struct tty *
2836 ttymalloc(struct tty **tpp)
2837 {
2838 	struct tty *tp;
2839 
2840 	if ((tp = *tpp) == NULL) {
2841 		tp = kmalloc(sizeof *tp, M_TTYS, M_WAITOK|M_ZERO);
2842 		lwkt_gettoken(&tty_token);
2843 		if (*tpp == NULL) {	/* recheck after blocking kmalloc */
2844 			*tpp = tp;
2845 			ttyinit(tp);
2846 			ttyregister(tp);
2847 		} else {
2848 			kfree(tp, M_TTYS);
2849 		}
2850 		lwkt_reltoken(&tty_token);
2851 	}
2852         return (tp);
2853 }
2854 
2855 /*
2856  * Caller must hold tp->t_token
2857  */
2858 void
2859 ttyunregister(struct tty *tp)
2860 {
2861 	lwkt_gettoken(&tty_token);
2862 	if (ISSET(tp->t_state, TS_REGISTERED)) {
2863 		CLR(tp->t_state, TS_REGISTERED);
2864 		TAILQ_REMOVE(&tty_list, tp, t_list);
2865 	}
2866 	lwkt_reltoken(&tty_token);
2867 }
2868 
2869 void
2870 ttyinit(struct tty *tp)
2871 {
2872 	lwkt_token_init(&tp->t_token, "tp");
2873 }
2874 
2875 void
2876 ttyregister(struct tty *tp)
2877 {
2878 	lwkt_gettoken(&tty_token);
2879 	if (!ISSET(tp->t_state, TS_REGISTERED)) {
2880 		SET(tp->t_state, TS_REGISTERED);
2881 		TAILQ_INSERT_HEAD(&tty_list, tp, t_list);
2882 	}
2883 	lwkt_reltoken(&tty_token);
2884 }
2885 
2886 static int
2887 sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
2888 {
2889 	int error;
2890 	struct tty *tp;
2891 	struct tty t;
2892 	struct tty marker;
2893 
2894 	bzero(&marker, sizeof(marker));
2895 	marker.t_state = TS_MARKER;
2896 	error = 0;
2897 
2898 	lwkt_gettoken(&tty_token);
2899 
2900 	TAILQ_INSERT_HEAD(&tty_list, &marker, t_list);
2901 	while ((tp = TAILQ_NEXT(&marker, t_list)) != NULL) {
2902 		TAILQ_REMOVE(&tty_list, &marker, t_list);
2903 		TAILQ_INSERT_AFTER(&tty_list, tp, &marker, t_list);
2904 		if (tp->t_state & TS_MARKER)
2905 			continue;
2906 		t = *tp;
2907 		if (t.t_dev)
2908 			t.t_dev = (cdev_t)(uintptr_t)devid_from_dev(t.t_dev);
2909 		error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));
2910 		if (error)
2911 			break;
2912 	}
2913 	TAILQ_REMOVE(&tty_list, &marker, t_list);
2914 	lwkt_reltoken(&tty_token);
2915 	return (error);
2916 }
2917 
2918 SYSCTL_PROC(_kern, OID_AUTO, ttys, CTLTYPE_OPAQUE|CTLFLAG_RD,
2919 	0, 0, sysctl_kern_ttys, "S,tty", "All struct ttys");
2920 
2921 void
2922 nottystop(struct tty *tp, int rw)
2923 {
2924 	return;
2925 }
2926 
2927 int
2928 ttyread(struct dev_read_args *ap)
2929 {
2930 	struct tty *tp;
2931 	int ret;
2932 
2933 	tp = ap->a_head.a_dev->si_tty;
2934 	if (tp == NULL)
2935 		return (ENODEV);
2936 	lwkt_gettoken(&tp->t_token);
2937 	ret = ((*linesw[tp->t_line].l_read)(tp, ap->a_uio, ap->a_ioflag));
2938 	lwkt_reltoken(&tp->t_token);
2939 
2940 	return ret;
2941 }
2942 
2943 int
2944 ttywrite(struct dev_write_args *ap)
2945 {
2946 	struct tty *tp;
2947 	int ret;
2948 
2949 	tp = ap->a_head.a_dev->si_tty;
2950 	if (tp == NULL)
2951 		return (ENODEV);
2952 	lwkt_gettoken(&tp->t_token);
2953 	ret = ((*linesw[tp->t_line].l_write)(tp, ap->a_uio, ap->a_ioflag));
2954 	lwkt_reltoken(&tp->t_token);
2955 
2956 	return ret;
2957 }
2958