Linux Audio

Check our new training course

Embedded Linux training

Mar 10-20, 2025, special US time zones
Register
Loading...
v6.8
   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 *  Copyright (C) 1992 obz under the linux copyright
   4 *
   5 *  Dynamic diacritical handling - aeb@cwi.nl - Dec 1993
   6 *  Dynamic keymap and string allocation - aeb@cwi.nl - May 1994
   7 *  Restrict VT switching via ioctl() - grif@cs.ucr.edu - Dec 1995
   8 *  Some code moved for less code duplication - Andi Kleen - Mar 1997
   9 *  Check put/get_user, cleanups - acme@conectiva.com.br - Jun 2001
  10 */
  11
  12#include <linux/types.h>
  13#include <linux/errno.h>
  14#include <linux/sched/signal.h>
  15#include <linux/tty.h>
  16#include <linux/timer.h>
  17#include <linux/kernel.h>
  18#include <linux/compat.h>
  19#include <linux/module.h>
  20#include <linux/kd.h>
  21#include <linux/vt.h>
  22#include <linux/string.h>
  23#include <linux/slab.h>
  24#include <linux/major.h>
  25#include <linux/fs.h>
  26#include <linux/console.h>
  27#include <linux/consolemap.h>
  28#include <linux/signal.h>
  29#include <linux/suspend.h>
  30#include <linux/timex.h>
  31
  32#include <asm/io.h>
  33#include <linux/uaccess.h>
  34
  35#include <linux/nospec.h>
  36
  37#include <linux/kbd_kern.h>
  38#include <linux/vt_kern.h>
  39#include <linux/kbd_diacr.h>
  40#include <linux/selection.h>
  41
  42bool vt_dont_switch;
  43
  44static inline bool vt_in_use(unsigned int i)
  45{
  46	const struct vc_data *vc = vc_cons[i].d;
  47
  48	/*
  49	 * console_lock must be held to prevent the vc from being deallocated
  50	 * while we're checking whether it's in-use.
  51	 */
  52	WARN_CONSOLE_UNLOCKED();
  53
  54	return vc && kref_read(&vc->port.kref) > 1;
  55}
  56
  57static inline bool vt_busy(int i)
  58{
  59	if (vt_in_use(i))
  60		return true;
  61	if (i == fg_console)
  62		return true;
  63	if (vc_is_sel(vc_cons[i].d))
  64		return true;
  65
  66	return false;
  67}
  68
  69/*
  70 * Console (vt and kd) routines, as defined by USL SVR4 manual, and by
  71 * experimentation and study of X386 SYSV handling.
  72 *
  73 * One point of difference: SYSV vt's are /dev/vtX, which X >= 0, and
  74 * /dev/console is a separate ttyp. Under Linux, /dev/tty0 is /dev/console,
  75 * and the vc start at /dev/ttyX, X >= 1. We maintain that here, so we will
  76 * always treat our set of vt as numbered 1..MAX_NR_CONSOLES (corresponding to
  77 * ttys 0..MAX_NR_CONSOLES-1). Explicitly naming VT 0 is illegal, but using
  78 * /dev/tty0 (fg_console) as a target is legal, since an implicit aliasing
  79 * to the current console is done by the main ioctl code.
  80 */
  81
  82#ifdef CONFIG_X86
  83#include <asm/syscalls.h>
  84#endif
  85
  86static void complete_change_console(struct vc_data *vc);
  87
  88/*
  89 *	User space VT_EVENT handlers
  90 */
  91
  92struct vt_event_wait {
  93	struct list_head list;
  94	struct vt_event event;
  95	int done;
  96};
  97
  98static LIST_HEAD(vt_events);
  99static DEFINE_SPINLOCK(vt_event_lock);
 100static DECLARE_WAIT_QUEUE_HEAD(vt_event_waitqueue);
 101
 102/**
 103 *	vt_event_post
 104 *	@event: the event that occurred
 105 *	@old: old console
 106 *	@new: new console
 107 *
 108 *	Post an VT event to interested VT handlers
 109 */
 110
 111void vt_event_post(unsigned int event, unsigned int old, unsigned int new)
 112{
 113	struct list_head *pos, *head;
 114	unsigned long flags;
 115	int wake = 0;
 116
 117	spin_lock_irqsave(&vt_event_lock, flags);
 118	head = &vt_events;
 119
 120	list_for_each(pos, head) {
 121		struct vt_event_wait *ve = list_entry(pos,
 122						struct vt_event_wait, list);
 123		if (!(ve->event.event & event))
 124			continue;
 125		ve->event.event = event;
 126		/* kernel view is consoles 0..n-1, user space view is
 127		   console 1..n with 0 meaning current, so we must bias */
 128		ve->event.oldev = old + 1;
 129		ve->event.newev = new + 1;
 130		wake = 1;
 131		ve->done = 1;
 132	}
 133	spin_unlock_irqrestore(&vt_event_lock, flags);
 134	if (wake)
 135		wake_up_interruptible(&vt_event_waitqueue);
 136}
 137
 138static void __vt_event_queue(struct vt_event_wait *vw)
 139{
 140	unsigned long flags;
 141	/* Prepare the event */
 142	INIT_LIST_HEAD(&vw->list);
 143	vw->done = 0;
 144	/* Queue our event */
 145	spin_lock_irqsave(&vt_event_lock, flags);
 146	list_add(&vw->list, &vt_events);
 147	spin_unlock_irqrestore(&vt_event_lock, flags);
 148}
 149
 150static void __vt_event_wait(struct vt_event_wait *vw)
 151{
 152	/* Wait for it to pass */
 153	wait_event_interruptible(vt_event_waitqueue, vw->done);
 154}
 155
 156static void __vt_event_dequeue(struct vt_event_wait *vw)
 157{
 158	unsigned long flags;
 159
 160	/* Dequeue it */
 161	spin_lock_irqsave(&vt_event_lock, flags);
 162	list_del(&vw->list);
 163	spin_unlock_irqrestore(&vt_event_lock, flags);
 164}
 165
 166/**
 167 *	vt_event_wait		-	wait for an event
 168 *	@vw: our event
 169 *
 170 *	Waits for an event to occur which completes our vt_event_wait
 171 *	structure. On return the structure has wv->done set to 1 for success
 172 *	or 0 if some event such as a signal ended the wait.
 173 */
 174
 175static void vt_event_wait(struct vt_event_wait *vw)
 176{
 177	__vt_event_queue(vw);
 178	__vt_event_wait(vw);
 179	__vt_event_dequeue(vw);
 180}
 181
 182/**
 183 *	vt_event_wait_ioctl	-	event ioctl handler
 184 *	@event: argument to ioctl (the event)
 185 *
 186 *	Implement the VT_WAITEVENT ioctl using the VT event interface
 187 */
 188
 189static int vt_event_wait_ioctl(struct vt_event __user *event)
 190{
 191	struct vt_event_wait vw;
 192
 193	if (copy_from_user(&vw.event, event, sizeof(struct vt_event)))
 194		return -EFAULT;
 195	/* Highest supported event for now */
 196	if (vw.event.event & ~VT_MAX_EVENT)
 197		return -EINVAL;
 198
 199	vt_event_wait(&vw);
 200	/* If it occurred report it */
 201	if (vw.done) {
 202		if (copy_to_user(event, &vw.event, sizeof(struct vt_event)))
 203			return -EFAULT;
 204		return 0;
 205	}
 206	return -EINTR;
 207}
 208
 209/**
 210 *	vt_waitactive	-	active console wait
 
 211 *	@n: new console
 212 *
 213 *	Helper for event waits. Used to implement the legacy
 214 *	event waiting ioctls in terms of events
 215 */
 216
 217int vt_waitactive(int n)
 218{
 219	struct vt_event_wait vw;
 220	do {
 221		vw.event.event = VT_EVENT_SWITCH;
 222		__vt_event_queue(&vw);
 223		if (n == fg_console + 1) {
 224			__vt_event_dequeue(&vw);
 225			break;
 226		}
 227		__vt_event_wait(&vw);
 228		__vt_event_dequeue(&vw);
 229		if (vw.done == 0)
 230			return -EINTR;
 231	} while (vw.event.newev != n);
 232	return 0;
 233}
 234
 235/*
 236 * these are the valid i/o ports we're allowed to change. they map all the
 237 * video ports
 238 */
 239#define GPFIRST 0x3b4
 240#define GPLAST 0x3df
 241#define GPNUM (GPLAST - GPFIRST + 1)
 242
 243/*
 244 * currently, setting the mode from KD_TEXT to KD_GRAPHICS doesn't do a whole
 245 * lot. i'm not sure if it should do any restoration of modes or what...
 246 *
 247 * XXX It should at least call into the driver, fbdev's definitely need to
 248 * restore their engine state. --BenH
 249 *
 250 * Called with the console lock held.
 251 */
 252static int vt_kdsetmode(struct vc_data *vc, unsigned long mode)
 253{
 254	switch (mode) {
 255	case KD_GRAPHICS:
 256		break;
 257	case KD_TEXT0:
 258	case KD_TEXT1:
 259		mode = KD_TEXT;
 260		fallthrough;
 261	case KD_TEXT:
 262		break;
 263	default:
 264		return -EINVAL;
 265	}
 266
 267	if (vc->vc_mode == mode)
 268		return 0;
 269
 270	vc->vc_mode = mode;
 271	if (vc->vc_num != fg_console)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 272		return 0;
 
 
 
 
 273
 274	/* explicitly blank/unblank the screen if switching modes */
 275	if (mode == KD_TEXT)
 276		do_unblank_screen(1);
 277	else
 278		do_blank_screen(1);
 279
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 280	return 0;
 281}
 282
 283static int vt_k_ioctl(struct tty_struct *tty, unsigned int cmd,
 284		unsigned long arg, bool perm)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 285{
 286	struct vc_data *vc = tty->driver_data;
 
 
 
 
 287	void __user *up = (void __user *)arg;
 288	unsigned int console = vc->vc_num;
 289	int ret;
 
 
 
 290
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 291	switch (cmd) {
 
 
 
 292	case KIOCSOUND:
 293		if (!perm)
 294			return -EPERM;
 295		/*
 296		 * The use of PIT_TICK_RATE is historic, it used to be
 297		 * the platform-dependent CLOCK_TICK_RATE between 2.6.12
 298		 * and 2.6.36, which was a minor but unfortunate ABI
 299		 * change. kd_mksound is locked by the input layer.
 300		 */
 301		if (arg)
 302			arg = PIT_TICK_RATE / arg;
 303		kd_mksound(arg, 0);
 304		break;
 305
 306	case KDMKTONE:
 307		if (!perm)
 308			return -EPERM;
 309	{
 310		unsigned int ticks, count;
 311
 312		/*
 313		 * Generate the tone for the appropriate number of ticks.
 314		 * If the time is zero, turn off sound ourselves.
 315		 */
 316		ticks = msecs_to_jiffies((arg >> 16) & 0xffff);
 317		count = ticks ? (arg & 0xffff) : 0;
 318		if (count)
 319			count = PIT_TICK_RATE / count;
 320		kd_mksound(count, ticks);
 321		break;
 322	}
 323
 324	case KDGKBTYPE:
 325		/*
 326		 * this is naïve.
 327		 */
 328		return put_user(KB_101, (char __user *)arg);
 
 
 329
 330		/*
 331		 * These cannot be implemented on any machine that implements
 332		 * ioperm() in user level (such as Alpha PCs) or not at all.
 333		 *
 334		 * XXX: you should never use these, just call ioperm directly..
 335		 */
 336#ifdef CONFIG_X86
 337	case KDADDIO:
 338	case KDDELIO:
 339		/*
 340		 * KDADDIO and KDDELIO may be able to add ports beyond what
 341		 * we reject here, but to be safe...
 342		 *
 343		 * These are locked internally via sys_ioperm
 344		 */
 345		if (arg < GPFIRST || arg > GPLAST)
 346			return -EINVAL;
 347
 348		return ksys_ioperm(arg, 1, (cmd == KDADDIO)) ? -ENXIO : 0;
 
 
 349
 350	case KDENABIO:
 351	case KDDISABIO:
 352		return ksys_ioperm(GPFIRST, GPNUM,
 353				  (cmd == KDENABIO)) ? -ENXIO : 0;
 
 354#endif
 355
 356	/* Linux m68k/i386 interface for setting the keyboard delay/repeat rate */
 357
 358	case KDKBDREP:
 359	{
 360		struct kbd_repeat kbrep;
 361
 362		if (!capable(CAP_SYS_TTY_CONFIG))
 363			return -EPERM;
 364
 365		if (copy_from_user(&kbrep, up, sizeof(struct kbd_repeat)))
 366			return -EFAULT;
 367
 
 368		ret = kbd_rate(&kbrep);
 369		if (ret)
 370			return ret;
 371		if (copy_to_user(up, &kbrep, sizeof(struct kbd_repeat)))
 372			return -EFAULT;
 373		break;
 374	}
 375
 376	case KDSETMODE:
 
 
 
 
 
 
 
 
 377		if (!perm)
 378			return -EPERM;
 379
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 380		console_lock();
 381		ret = vt_kdsetmode(vc, arg);
 
 
 
 382		console_unlock();
 383		return ret;
 384
 385	case KDGETMODE:
 386		return put_user(vc->vc_mode, (int __user *)arg);
 
 387
 388	case KDMAPDISP:
 389	case KDUNMAPDISP:
 390		/*
 391		 * these work like a combination of mmap and KDENABIO.
 392		 * this could be easily finished.
 393		 */
 394		return -EINVAL;
 
 395
 396	case KDSKBMODE:
 397		if (!perm)
 398			return -EPERM;
 399		ret = vt_do_kdskbmode(console, arg);
 400		if (ret)
 401			return ret;
 402		tty_ldisc_flush(tty);
 403		break;
 404
 405	case KDGKBMODE:
 406		return put_user(vt_do_kdgkbmode(console), (int __user *)arg);
 
 
 407
 408	/* this could be folded into KDSKBMODE, but for compatibility
 409	   reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */
 410	case KDSKBMETA:
 411		return vt_do_kdskbmeta(console, arg);
 
 412
 413	case KDGKBMETA:
 414		/* FIXME: should review whether this is worth locking */
 415		return put_user(vt_do_kdgkbmeta(console), (int __user *)arg);
 
 
 
 416
 417	case KDGETKEYCODE:
 418	case KDSETKEYCODE:
 419		if(!capable(CAP_SYS_TTY_CONFIG))
 420			perm = 0;
 421		return vt_do_kbkeycode_ioctl(cmd, up, perm);
 
 422
 423	case KDGKBENT:
 424	case KDSKBENT:
 425		return vt_do_kdsk_ioctl(cmd, up, perm, console);
 
 426
 427	case KDGKBSENT:
 428	case KDSKBSENT:
 429		return vt_do_kdgkb_ioctl(cmd, up, perm);
 
 430
 431	/* Diacritical processing. Handled in keyboard.c as it has
 432	   to operate on the keyboard locks and structures */
 433	case KDGKBDIACR:
 434	case KDGKBDIACRUC:
 435	case KDSKBDIACR:
 436	case KDSKBDIACRUC:
 437		return vt_do_diacrit(cmd, up, perm);
 
 438
 439	/* the ioctls below read/set the flags usually shown in the leds */
 440	/* don't use them - they will go away without warning */
 441	case KDGKBLED:
 442	case KDSKBLED:
 443	case KDGETLED:
 444	case KDSETLED:
 445		return vt_do_kdskled(console, cmd, arg, perm);
 
 446
 447	/*
 448	 * A process can indicate its willingness to accept signals
 449	 * generated by pressing an appropriate key combination.
 450	 * Thus, one can have a daemon that e.g. spawns a new console
 451	 * upon a keypress and then changes to it.
 452	 * See also the kbrequest field of inittab(5).
 453	 */
 454	case KDSIGACCEPT:
 
 455		if (!perm || !capable(CAP_KILL))
 456			return -EPERM;
 457		if (!valid_signal(arg) || arg < 1 || arg == SIGKILL)
 458			return -EINVAL;
 459
 460		spin_lock_irq(&vt_spawn_con.lock);
 461		put_pid(vt_spawn_con.pid);
 462		vt_spawn_con.pid = get_pid(task_pid(current));
 463		vt_spawn_con.sig = arg;
 464		spin_unlock_irq(&vt_spawn_con.lock);
 465		break;
 466
 467	case KDFONTOP: {
 468		struct console_font_op op;
 469
 470		if (copy_from_user(&op, up, sizeof(op)))
 471			return -EFAULT;
 472		if (!perm && op.op != KD_FONT_OP_GET)
 473			return -EPERM;
 474		ret = con_font_op(vc, &op);
 475		if (ret)
 476			return ret;
 477		if (copy_to_user(up, &op, sizeof(op)))
 478			return -EFAULT;
 479		break;
 480	}
 481
 482	default:
 483		return -ENOIOCTLCMD;
 484	}
 485
 486	return 0;
 487}
 488
 489static inline int do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud,
 490		bool perm, struct vc_data *vc)
 491{
 492	struct unimapdesc tmp;
 493
 494	if (copy_from_user(&tmp, user_ud, sizeof tmp))
 495		return -EFAULT;
 496	switch (cmd) {
 497	case PIO_UNIMAP:
 498		if (!perm)
 499			return -EPERM;
 500		return con_set_unimap(vc, tmp.entry_ct, tmp.entries);
 501	case GIO_UNIMAP:
 502		if (!perm && fg_console != vc->vc_num)
 503			return -EPERM;
 504		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct),
 505				tmp.entries);
 506	}
 507	return 0;
 508}
 509
 510static int vt_io_ioctl(struct vc_data *vc, unsigned int cmd, void __user *up,
 511		bool perm)
 512{
 513	switch (cmd) {
 514	case PIO_CMAP:
 515		if (!perm)
 516			return -EPERM;
 517		return con_set_cmap(up);
 518
 519	case GIO_CMAP:
 520		return con_get_cmap(up);
 521
 522	case PIO_SCRNMAP:
 523		if (!perm)
 524			return -EPERM;
 525		return con_set_trans_old(up);
 526
 527	case GIO_SCRNMAP:
 528		return con_get_trans_old(up);
 529
 530	case PIO_UNISCRNMAP:
 531		if (!perm)
 532			return -EPERM;
 533		return con_set_trans_new(up);
 534
 535	case GIO_UNISCRNMAP:
 536		return con_get_trans_new(up);
 537
 538	case PIO_UNIMAPCLR:
 539		if (!perm)
 540			return -EPERM;
 541		con_clear_unimap(vc);
 542		break;
 543
 544	case PIO_UNIMAP:
 545	case GIO_UNIMAP:
 546		return do_unimap_ioctl(cmd, up, perm, vc);
 547
 548	default:
 549		return -ENOIOCTLCMD;
 550	}
 551
 552	return 0;
 553}
 554
 555static int vt_reldisp(struct vc_data *vc, unsigned int swtch)
 556{
 557	int newvt, ret;
 558
 559	if (vc->vt_mode.mode != VT_PROCESS)
 560		return -EINVAL;
 561
 562	/* Switched-to response */
 563	if (vc->vt_newvt < 0) {
 564		 /* If it's just an ACK, ignore it */
 565		return swtch == VT_ACKACQ ? 0 : -EINVAL;
 566	}
 567
 568	/* Switching-from response */
 569	if (swtch == 0) {
 570		/* Switch disallowed, so forget we were trying to do it. */
 571		vc->vt_newvt = -1;
 572		return 0;
 573	}
 574
 575	/* The current vt has been released, so complete the switch. */
 576	newvt = vc->vt_newvt;
 577	vc->vt_newvt = -1;
 578	ret = vc_allocate(newvt);
 579	if (ret)
 580		return ret;
 581
 582	/*
 583	 * When we actually do the console switch, make sure we are atomic with
 584	 * respect to other console switches..
 585	 */
 586	complete_change_console(vc_cons[newvt].d);
 587
 588	return 0;
 589}
 590
 591static int vt_setactivate(struct vt_setactivate __user *sa)
 592{
 593	struct vt_setactivate vsa;
 594	struct vc_data *nvc;
 595	int ret;
 596
 597	if (copy_from_user(&vsa, sa, sizeof(vsa)))
 598		return -EFAULT;
 599	if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
 600		return -ENXIO;
 601
 602	vsa.console--;
 603	vsa.console = array_index_nospec(vsa.console, MAX_NR_CONSOLES);
 604	console_lock();
 605	ret = vc_allocate(vsa.console);
 606	if (ret) {
 607		console_unlock();
 608		return ret;
 609	}
 610
 611	/*
 612	 * This is safe providing we don't drop the console sem between
 613	 * vc_allocate and finishing referencing nvc.
 614	 */
 615	nvc = vc_cons[vsa.console].d;
 616	nvc->vt_mode = vsa.mode;
 617	nvc->vt_mode.frsig = 0;
 618	put_pid(nvc->vt_pid);
 619	nvc->vt_pid = get_pid(task_pid(current));
 620	console_unlock();
 621
 622	/* Commence switch and lock */
 623	/* Review set_console locks */
 624	set_console(vsa.console);
 625
 626	return 0;
 627}
 628
 629/* deallocate a single console, if possible (leave 0) */
 630static int vt_disallocate(unsigned int vc_num)
 631{
 632	struct vc_data *vc = NULL;
 633	int ret = 0;
 634
 635	console_lock();
 636	if (vt_busy(vc_num))
 637		ret = -EBUSY;
 638	else if (vc_num)
 639		vc = vc_deallocate(vc_num);
 640	console_unlock();
 641
 642	if (vc && vc_num >= MIN_NR_CONSOLES)
 643		tty_port_put(&vc->port);
 644
 645	return ret;
 646}
 647
 648/* deallocate all unused consoles, but leave 0 */
 649static void vt_disallocate_all(void)
 650{
 651	struct vc_data *vc[MAX_NR_CONSOLES];
 652	int i;
 653
 654	console_lock();
 655	for (i = 1; i < MAX_NR_CONSOLES; i++)
 656		if (!vt_busy(i))
 657			vc[i] = vc_deallocate(i);
 658		else
 659			vc[i] = NULL;
 660	console_unlock();
 661
 662	for (i = 1; i < MAX_NR_CONSOLES; i++) {
 663		if (vc[i] && i >= MIN_NR_CONSOLES)
 664			tty_port_put(&vc[i]->port);
 665	}
 666}
 667
 668static int vt_resizex(struct vc_data *vc, struct vt_consize __user *cs)
 669{
 670	struct vt_consize v;
 671	int i;
 672
 673	if (copy_from_user(&v, cs, sizeof(struct vt_consize)))
 674		return -EFAULT;
 675
 676	/* FIXME: Should check the copies properly */
 677	if (!v.v_vlin)
 678		v.v_vlin = vc->vc_scan_lines;
 679
 680	if (v.v_clin) {
 681		int rows = v.v_vlin / v.v_clin;
 682		if (v.v_rows != rows) {
 683			if (v.v_rows) /* Parameters don't add up */
 684				return -EINVAL;
 685			v.v_rows = rows;
 686		}
 687	}
 688
 689	if (v.v_vcol && v.v_ccol) {
 690		int cols = v.v_vcol / v.v_ccol;
 691		if (v.v_cols != cols) {
 692			if (v.v_cols)
 693				return -EINVAL;
 694			v.v_cols = cols;
 695		}
 
 696	}
 697
 698	if (v.v_clin > 32)
 699		return -EINVAL;
 700
 701	for (i = 0; i < MAX_NR_CONSOLES; i++) {
 702		struct vc_data *vcp;
 703
 704		if (!vc_cons[i].d)
 705			continue;
 706		console_lock();
 707		vcp = vc_cons[i].d;
 708		if (vcp) {
 709			int ret;
 710			int save_scan_lines = vcp->vc_scan_lines;
 711			int save_cell_height = vcp->vc_cell_height;
 712
 713			if (v.v_vlin)
 714				vcp->vc_scan_lines = v.v_vlin;
 715			if (v.v_clin)
 716				vcp->vc_cell_height = v.v_clin;
 717			vcp->vc_resize_user = 1;
 718			ret = vc_resize(vcp, v.v_cols, v.v_rows);
 719			if (ret) {
 720				vcp->vc_scan_lines = save_scan_lines;
 721				vcp->vc_cell_height = save_cell_height;
 722				console_unlock();
 723				return ret;
 724			}
 725		}
 726		console_unlock();
 727	}
 728
 729	return 0;
 730}
 731
 732/*
 733 * We handle the console-specific ioctl's here.  We allow the
 734 * capability to modify any console, not just the fg_console.
 735 */
 736int vt_ioctl(struct tty_struct *tty,
 737	     unsigned int cmd, unsigned long arg)
 738{
 739	struct vc_data *vc = tty->driver_data;
 740	void __user *up = (void __user *)arg;
 741	int i, perm;
 742	int ret;
 743
 744	/*
 745	 * To have permissions to do most of the vt ioctls, we either have
 746	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
 747	 */
 748	perm = 0;
 749	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
 750		perm = 1;
 751
 752	ret = vt_k_ioctl(tty, cmd, arg, perm);
 753	if (ret != -ENOIOCTLCMD)
 754		return ret;
 755
 756	ret = vt_io_ioctl(vc, cmd, up, perm);
 757	if (ret != -ENOIOCTLCMD)
 758		return ret;
 759
 760	switch (cmd) {
 761	case TIOCLINUX:
 762		return tioclinux(tty, arg);
 763	case VT_SETMODE:
 764	{
 765		struct vt_mode tmp;
 766
 767		if (!perm)
 768			return -EPERM;
 769		if (copy_from_user(&tmp, up, sizeof(struct vt_mode)))
 770			return -EFAULT;
 771		if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS)
 772			return -EINVAL;
 773
 
 
 
 774		console_lock();
 775		vc->vt_mode = tmp;
 776		/* the frsig is ignored, so we set it to 0 */
 777		vc->vt_mode.frsig = 0;
 778		put_pid(vc->vt_pid);
 779		vc->vt_pid = get_pid(task_pid(current));
 780		/* no switch is required -- saw@shade.msu.ru */
 781		vc->vt_newvt = -1;
 782		console_unlock();
 783		break;
 784	}
 785
 786	case VT_GETMODE:
 787	{
 788		struct vt_mode tmp;
 789		int rc;
 790
 791		console_lock();
 792		memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode));
 793		console_unlock();
 794
 795		rc = copy_to_user(up, &tmp, sizeof(struct vt_mode));
 796		if (rc)
 797			return -EFAULT;
 798		break;
 799	}
 800
 801	/*
 802	 * Returns global vt state. Note that VT 0 is always open, since
 803	 * it's an alias for the current VT, and people can't use it here.
 804	 * We cannot return state for more than 16 VTs, since v_state is short.
 805	 */
 806	case VT_GETSTATE:
 807	{
 808		struct vt_stat __user *vtstat = up;
 809		unsigned short state, mask;
 810
 
 811		if (put_user(fg_console + 1, &vtstat->v_active))
 812			return -EFAULT;
 813
 814		state = 1;	/* /dev/tty0 is always open */
 815		console_lock(); /* required by vt_in_use() */
 816		for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask;
 817				++i, mask <<= 1)
 818			if (vt_in_use(i))
 819				state |= mask;
 820		console_unlock();
 821		return put_user(state, &vtstat->v_state);
 822	}
 823
 824	/*
 825	 * Returns the first available (non-opened) console.
 826	 */
 827	case VT_OPENQRY:
 828		console_lock(); /* required by vt_in_use() */
 829		for (i = 0; i < MAX_NR_CONSOLES; ++i)
 830			if (!vt_in_use(i))
 831				break;
 832		console_unlock();
 833		i = i < MAX_NR_CONSOLES ? (i+1) : -1;
 834		return put_user(i, (int __user *)arg);
 835
 836	/*
 837	 * ioctl(fd, VT_ACTIVATE, num) will cause us to switch to vt # num,
 838	 * with num >= 1 (switches to vt 0, our console, are not allowed, just
 839	 * to preserve sanity).
 840	 */
 841	case VT_ACTIVATE:
 842		if (!perm)
 843			return -EPERM;
 844		if (arg == 0 || arg > MAX_NR_CONSOLES)
 845			return -ENXIO;
 846
 847		arg--;
 848		arg = array_index_nospec(arg, MAX_NR_CONSOLES);
 849		console_lock();
 850		ret = vc_allocate(arg);
 851		console_unlock();
 852		if (ret)
 853			return ret;
 854		set_console(arg);
 855		break;
 856
 857	case VT_SETACTIVATE:
 
 
 
 858		if (!perm)
 859			return -EPERM;
 860
 861		return vt_setactivate(up);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 862
 863	/*
 864	 * wait until the specified VT has been activated
 865	 */
 866	case VT_WAITACTIVE:
 867		if (!perm)
 868			return -EPERM;
 869		if (arg == 0 || arg > MAX_NR_CONSOLES)
 870			return -ENXIO;
 871		return vt_waitactive(arg);
 
 
 872
 873	/*
 874	 * If a vt is under process control, the kernel will not switch to it
 875	 * immediately, but postpone the operation until the process calls this
 876	 * ioctl, allowing the switch to complete.
 877	 *
 878	 * According to the X sources this is the behavior:
 879	 *	0:	pending switch-from not OK
 880	 *	1:	pending switch-from OK
 881	 *	2:	completed switch-to OK
 882	 */
 883	case VT_RELDISP:
 884		if (!perm)
 885			return -EPERM;
 886
 887		console_lock();
 888		ret = vt_reldisp(vc, arg);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 889		console_unlock();
 890
 891		return ret;
 892
 893
 894	 /*
 895	  * Disallocate memory associated to VT (but leave VT1)
 896	  */
 897	 case VT_DISALLOCATE:
 898		if (arg > MAX_NR_CONSOLES)
 899			return -ENXIO;
 900
 901		if (arg == 0) {
 902			vt_disallocate_all();
 903			break;
 904		}
 905
 906		arg = array_index_nospec(arg - 1, MAX_NR_CONSOLES);
 907		return vt_disallocate(arg);
 
 
 908
 909	case VT_RESIZE:
 910	{
 911		struct vt_sizes __user *vtsizes = up;
 912		struct vc_data *vc;
 913		ushort ll,cc;
 914
 
 915		if (!perm)
 916			return -EPERM;
 917		if (get_user(ll, &vtsizes->v_rows) ||
 918		    get_user(cc, &vtsizes->v_cols))
 919			return -EFAULT;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 920
 921		console_lock();
 922		for (i = 0; i < MAX_NR_CONSOLES; i++) {
 923			vc = vc_cons[i].d;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 924
 925			if (vc) {
 926				vc->vc_resize_user = 1;
 927				/* FIXME: review v tty lock */
 928				vc_resize(vc_cons[i].d, cc, ll);
 929			}
 
 
 
 
 
 
 
 
 
 
 
 930		}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 931		console_unlock();
 932		break;
 
 
 933	}
 934
 935	case VT_RESIZEX:
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 936		if (!perm)
 937			return -EPERM;
 
 
 
 
 
 
 
 938
 939		return vt_resizex(vc, up);
 
 
 
 940
 941	case VT_LOCKSWITCH:
 942		if (!capable(CAP_SYS_TTY_CONFIG))
 943			return -EPERM;
 944		vt_dont_switch = true;
 945		break;
 946	case VT_UNLOCKSWITCH:
 947		if (!capable(CAP_SYS_TTY_CONFIG))
 948			return -EPERM;
 949		vt_dont_switch = false;
 950		break;
 951	case VT_GETHIFONTMASK:
 952		return put_user(vc->vc_hi_font_mask,
 953					(unsigned short __user *)arg);
 
 954	case VT_WAITEVENT:
 955		return vt_event_wait_ioctl((struct vt_event __user *)arg);
 
 956	default:
 957		return -ENOIOCTLCMD;
 958	}
 959
 960	return 0;
 961}
 962
 963void reset_vc(struct vc_data *vc)
 964{
 965	vc->vc_mode = KD_TEXT;
 966	vt_reset_unicode(vc->vc_num);
 967	vc->vt_mode.mode = VT_AUTO;
 968	vc->vt_mode.waitv = 0;
 969	vc->vt_mode.relsig = 0;
 970	vc->vt_mode.acqsig = 0;
 971	vc->vt_mode.frsig = 0;
 972	put_pid(vc->vt_pid);
 973	vc->vt_pid = NULL;
 974	vc->vt_newvt = -1;
 975	reset_palette(vc);
 
 976}
 977
 978void vc_SAK(struct work_struct *work)
 979{
 980	struct vc *vc_con =
 981		container_of(work, struct vc, SAK_work);
 982	struct vc_data *vc;
 983	struct tty_struct *tty;
 984
 985	console_lock();
 986	vc = vc_con->d;
 987	if (vc) {
 988		/* FIXME: review tty ref counting */
 989		tty = vc->port.tty;
 990		/*
 991		 * SAK should also work in all raw modes and reset
 992		 * them properly.
 993		 */
 994		if (tty)
 995			__do_SAK(tty);
 996		reset_vc(vc);
 997	}
 998	console_unlock();
 999}
1000
1001#ifdef CONFIG_COMPAT
1002
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1003struct compat_console_font_op {
1004	compat_uint_t op;        /* operation code KD_FONT_OP_* */
1005	compat_uint_t flags;     /* KD_FONT_FLAG_* */
1006	compat_uint_t width, height;     /* font size */
1007	compat_uint_t charcount;
1008	compat_caddr_t data;    /* font data with height fixed to 32 */
1009};
1010
1011static inline int
1012compat_kdfontop_ioctl(struct compat_console_font_op __user *fontop,
1013			 int perm, struct console_font_op *op, struct vc_data *vc)
1014{
1015	int i;
1016
1017	if (copy_from_user(op, fontop, sizeof(struct compat_console_font_op)))
1018		return -EFAULT;
1019	if (!perm && op->op != KD_FONT_OP_GET)
1020		return -EPERM;
1021	op->data = compat_ptr(((struct compat_console_font_op *)op)->data);
1022	i = con_font_op(vc, op);
1023	if (i)
1024		return i;
1025	((struct compat_console_font_op *)op)->data = (unsigned long)op->data;
1026	if (copy_to_user(fontop, op, sizeof(struct compat_console_font_op)))
1027		return -EFAULT;
1028	return 0;
1029}
1030
1031struct compat_unimapdesc {
1032	unsigned short entry_ct;
1033	compat_caddr_t entries;
1034};
1035
1036static inline int
1037compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud,
1038			 int perm, struct vc_data *vc)
1039{
1040	struct compat_unimapdesc tmp;
1041	struct unipair __user *tmp_entries;
1042
1043	if (copy_from_user(&tmp, user_ud, sizeof tmp))
1044		return -EFAULT;
1045	tmp_entries = compat_ptr(tmp.entries);
 
 
 
 
1046	switch (cmd) {
1047	case PIO_UNIMAP:
1048		if (!perm)
1049			return -EPERM;
1050		return con_set_unimap(vc, tmp.entry_ct, tmp_entries);
1051	case GIO_UNIMAP:
1052		if (!perm && fg_console != vc->vc_num)
1053			return -EPERM;
1054		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp_entries);
1055	}
1056	return 0;
1057}
1058
1059long vt_compat_ioctl(struct tty_struct *tty,
1060	     unsigned int cmd, unsigned long arg)
1061{
1062	struct vc_data *vc = tty->driver_data;
1063	struct console_font_op op;	/* used in multiple places here */
1064	void __user *up = compat_ptr(arg);
 
1065	int perm;
 
 
 
 
 
 
 
 
1066
1067	/*
1068	 * To have permissions to do most of the vt ioctls, we either have
1069	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
1070	 */
1071	perm = 0;
1072	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
1073		perm = 1;
1074
1075	switch (cmd) {
1076	/*
1077	 * these need special handlers for incompatible data structures
1078	 */
 
 
 
 
1079
1080	case KDFONTOP:
1081		return compat_kdfontop_ioctl(up, perm, &op, vc);
 
1082
1083	case PIO_UNIMAP:
1084	case GIO_UNIMAP:
1085		return compat_unimap_ioctl(cmd, up, perm, vc);
 
1086
1087	/*
1088	 * all these treat 'arg' as an integer
1089	 */
1090	case KIOCSOUND:
1091	case KDMKTONE:
1092#ifdef CONFIG_X86
1093	case KDADDIO:
1094	case KDDELIO:
1095#endif
1096	case KDSETMODE:
1097	case KDMAPDISP:
1098	case KDUNMAPDISP:
1099	case KDSKBMODE:
1100	case KDSKBMETA:
1101	case KDSKBLED:
1102	case KDSETLED:
1103	case KDSIGACCEPT:
1104	case VT_ACTIVATE:
1105	case VT_WAITACTIVE:
1106	case VT_RELDISP:
1107	case VT_DISALLOCATE:
1108	case VT_RESIZE:
1109	case VT_RESIZEX:
1110		return vt_ioctl(tty, cmd, arg);
1111
1112	/*
1113	 * the rest has a compatible data structure behind arg,
1114	 * but we have to convert it to a proper 64 bit pointer.
1115	 */
1116	default:
1117		return vt_ioctl(tty, cmd, (unsigned long)up);
 
1118	}
 
 
 
 
 
1119}
1120
1121
1122#endif /* CONFIG_COMPAT */
1123
1124
1125/*
1126 * Performs the back end of a vt switch. Called under the console
1127 * semaphore.
1128 */
1129static void complete_change_console(struct vc_data *vc)
1130{
1131	unsigned char old_vc_mode;
1132	int old = fg_console;
1133
1134	last_console = fg_console;
1135
1136	/*
1137	 * If we're switching, we could be going from KD_GRAPHICS to
1138	 * KD_TEXT mode or vice versa, which means we need to blank or
1139	 * unblank the screen later.
1140	 */
1141	old_vc_mode = vc_cons[fg_console].d->vc_mode;
1142	switch_screen(vc);
1143
1144	/*
1145	 * This can't appear below a successful kill_pid().  If it did,
1146	 * then the *blank_screen operation could occur while X, having
1147	 * received acqsig, is waking up on another processor.  This
1148	 * condition can lead to overlapping accesses to the VGA range
1149	 * and the framebuffer (causing system lockups).
1150	 *
1151	 * To account for this we duplicate this code below only if the
1152	 * controlling process is gone and we've called reset_vc.
1153	 */
1154	if (old_vc_mode != vc->vc_mode) {
1155		if (vc->vc_mode == KD_TEXT)
1156			do_unblank_screen(1);
1157		else
1158			do_blank_screen(1);
1159	}
1160
1161	/*
1162	 * If this new console is under process control, send it a signal
1163	 * telling it that it has acquired. Also check if it has died and
1164	 * clean up (similar to logic employed in change_console())
1165	 */
1166	if (vc->vt_mode.mode == VT_PROCESS) {
1167		/*
1168		 * Send the signal as privileged - kill_pid() will
1169		 * tell us if the process has gone or something else
1170		 * is awry
1171		 */
1172		if (kill_pid(vc->vt_pid, vc->vt_mode.acqsig, 1) != 0) {
1173		/*
1174		 * The controlling process has died, so we revert back to
1175		 * normal operation. In this case, we'll also change back
1176		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1177		 * but it saves the agony when the X server dies and the screen
1178		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1179		 * this outside of VT_PROCESS but there is no single process
1180		 * to account for and tracking tty count may be undesirable.
1181		 */
1182			reset_vc(vc);
1183
1184			if (old_vc_mode != vc->vc_mode) {
1185				if (vc->vc_mode == KD_TEXT)
1186					do_unblank_screen(1);
1187				else
1188					do_blank_screen(1);
1189			}
1190		}
1191	}
1192
1193	/*
1194	 * Wake anyone waiting for their VT to activate
1195	 */
1196	vt_event_post(VT_EVENT_SWITCH, old, vc->vc_num);
1197	return;
1198}
1199
1200/*
1201 * Performs the front-end of a vt switch
1202 */
1203void change_console(struct vc_data *new_vc)
1204{
1205	struct vc_data *vc;
1206
1207	if (!new_vc || new_vc->vc_num == fg_console || vt_dont_switch)
1208		return;
1209
1210	/*
1211	 * If this vt is in process mode, then we need to handshake with
1212	 * that process before switching. Essentially, we store where that
1213	 * vt wants to switch to and wait for it to tell us when it's done
1214	 * (via VT_RELDISP ioctl).
1215	 *
1216	 * We also check to see if the controlling process still exists.
1217	 * If it doesn't, we reset this vt to auto mode and continue.
1218	 * This is a cheap way to track process control. The worst thing
1219	 * that can happen is: we send a signal to a process, it dies, and
1220	 * the switch gets "lost" waiting for a response; hopefully, the
1221	 * user will try again, we'll detect the process is gone (unless
1222	 * the user waits just the right amount of time :-) and revert the
1223	 * vt to auto control.
1224	 */
1225	vc = vc_cons[fg_console].d;
1226	if (vc->vt_mode.mode == VT_PROCESS) {
1227		/*
1228		 * Send the signal as privileged - kill_pid() will
1229		 * tell us if the process has gone or something else
1230		 * is awry.
1231		 *
1232		 * We need to set vt_newvt *before* sending the signal or we
1233		 * have a race.
1234		 */
1235		vc->vt_newvt = new_vc->vc_num;
1236		if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) {
1237			/*
1238			 * It worked. Mark the vt to switch to and
1239			 * return. The process needs to send us a
1240			 * VT_RELDISP ioctl to complete the switch.
1241			 */
1242			return;
1243		}
1244
1245		/*
1246		 * The controlling process has died, so we revert back to
1247		 * normal operation. In this case, we'll also change back
1248		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1249		 * but it saves the agony when the X server dies and the screen
1250		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1251		 * this outside of VT_PROCESS but there is no single process
1252		 * to account for and tracking tty count may be undesirable.
1253		 */
1254		reset_vc(vc);
1255
1256		/*
1257		 * Fall through to normal (VT_AUTO) handling of the switch...
1258		 */
1259	}
1260
1261	/*
1262	 * Ignore all switches in KD_GRAPHICS+VT_AUTO mode
1263	 */
1264	if (vc->vc_mode == KD_GRAPHICS)
1265		return;
1266
1267	complete_change_console(new_vc);
1268}
1269
1270/* Perform a kernel triggered VT switch for suspend/resume */
1271
1272static int disable_vt_switch;
1273
1274int vt_move_to_console(unsigned int vt, int alloc)
1275{
1276	int prev;
1277
1278	console_lock();
1279	/* Graphics mode - up to X */
1280	if (disable_vt_switch) {
1281		console_unlock();
1282		return 0;
1283	}
1284	prev = fg_console;
1285
1286	if (alloc && vc_allocate(vt)) {
1287		/* we can't have a free VC for now. Too bad,
1288		 * we don't want to mess the screen for now. */
1289		console_unlock();
1290		return -ENOSPC;
1291	}
1292
1293	if (set_console(vt)) {
1294		/*
1295		 * We're unable to switch to the SUSPEND_CONSOLE.
1296		 * Let the calling function know so it can decide
1297		 * what to do.
1298		 */
1299		console_unlock();
1300		return -EIO;
1301	}
1302	console_unlock();
1303	if (vt_waitactive(vt + 1)) {
1304		pr_debug("Suspend: Can't switch VCs.");
1305		return -EINTR;
1306	}
1307	return prev;
1308}
1309
1310/*
1311 * Normally during a suspend, we allocate a new console and switch to it.
1312 * When we resume, we switch back to the original console.  This switch
1313 * can be slow, so on systems where the framebuffer can handle restoration
1314 * of video registers anyways, there's little point in doing the console
1315 * switch.  This function allows you to disable it by passing it '0'.
1316 */
1317void pm_set_vt_switch(int do_switch)
1318{
1319	console_lock();
1320	disable_vt_switch = !do_switch;
1321	console_unlock();
1322}
1323EXPORT_SYMBOL(pm_set_vt_switch);
v3.15
 
   1/*
   2 *  Copyright (C) 1992 obz under the linux copyright
   3 *
   4 *  Dynamic diacritical handling - aeb@cwi.nl - Dec 1993
   5 *  Dynamic keymap and string allocation - aeb@cwi.nl - May 1994
   6 *  Restrict VT switching via ioctl() - grif@cs.ucr.edu - Dec 1995
   7 *  Some code moved for less code duplication - Andi Kleen - Mar 1997
   8 *  Check put/get_user, cleanups - acme@conectiva.com.br - Jun 2001
   9 */
  10
  11#include <linux/types.h>
  12#include <linux/errno.h>
  13#include <linux/sched.h>
  14#include <linux/tty.h>
  15#include <linux/timer.h>
  16#include <linux/kernel.h>
  17#include <linux/compat.h>
  18#include <linux/module.h>
  19#include <linux/kd.h>
  20#include <linux/vt.h>
  21#include <linux/string.h>
  22#include <linux/slab.h>
  23#include <linux/major.h>
  24#include <linux/fs.h>
  25#include <linux/console.h>
  26#include <linux/consolemap.h>
  27#include <linux/signal.h>
  28#include <linux/suspend.h>
  29#include <linux/timex.h>
  30
  31#include <asm/io.h>
  32#include <asm/uaccess.h>
 
 
  33
  34#include <linux/kbd_kern.h>
  35#include <linux/vt_kern.h>
  36#include <linux/kbd_diacr.h>
  37#include <linux/selection.h>
  38
  39char vt_dont_switch;
  40extern struct tty_driver *console_driver;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  41
  42#define VT_IS_IN_USE(i)	(console_driver->ttys[i] && console_driver->ttys[i]->count)
  43#define VT_BUSY(i)	(VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons)
  44
  45/*
  46 * Console (vt and kd) routines, as defined by USL SVR4 manual, and by
  47 * experimentation and study of X386 SYSV handling.
  48 *
  49 * One point of difference: SYSV vt's are /dev/vtX, which X >= 0, and
  50 * /dev/console is a separate ttyp. Under Linux, /dev/tty0 is /dev/console,
  51 * and the vc start at /dev/ttyX, X >= 1. We maintain that here, so we will
  52 * always treat our set of vt as numbered 1..MAX_NR_CONSOLES (corresponding to
  53 * ttys 0..MAX_NR_CONSOLES-1). Explicitly naming VT 0 is illegal, but using
  54 * /dev/tty0 (fg_console) as a target is legal, since an implicit aliasing
  55 * to the current console is done by the main ioctl code.
  56 */
  57
  58#ifdef CONFIG_X86
  59#include <linux/syscalls.h>
  60#endif
  61
  62static void complete_change_console(struct vc_data *vc);
  63
  64/*
  65 *	User space VT_EVENT handlers
  66 */
  67
  68struct vt_event_wait {
  69	struct list_head list;
  70	struct vt_event event;
  71	int done;
  72};
  73
  74static LIST_HEAD(vt_events);
  75static DEFINE_SPINLOCK(vt_event_lock);
  76static DECLARE_WAIT_QUEUE_HEAD(vt_event_waitqueue);
  77
  78/**
  79 *	vt_event_post
  80 *	@event: the event that occurred
  81 *	@old: old console
  82 *	@new: new console
  83 *
  84 *	Post an VT event to interested VT handlers
  85 */
  86
  87void vt_event_post(unsigned int event, unsigned int old, unsigned int new)
  88{
  89	struct list_head *pos, *head;
  90	unsigned long flags;
  91	int wake = 0;
  92
  93	spin_lock_irqsave(&vt_event_lock, flags);
  94	head = &vt_events;
  95
  96	list_for_each(pos, head) {
  97		struct vt_event_wait *ve = list_entry(pos,
  98						struct vt_event_wait, list);
  99		if (!(ve->event.event & event))
 100			continue;
 101		ve->event.event = event;
 102		/* kernel view is consoles 0..n-1, user space view is
 103		   console 1..n with 0 meaning current, so we must bias */
 104		ve->event.oldev = old + 1;
 105		ve->event.newev = new + 1;
 106		wake = 1;
 107		ve->done = 1;
 108	}
 109	spin_unlock_irqrestore(&vt_event_lock, flags);
 110	if (wake)
 111		wake_up_interruptible(&vt_event_waitqueue);
 112}
 113
 114static void __vt_event_queue(struct vt_event_wait *vw)
 115{
 116	unsigned long flags;
 117	/* Prepare the event */
 118	INIT_LIST_HEAD(&vw->list);
 119	vw->done = 0;
 120	/* Queue our event */
 121	spin_lock_irqsave(&vt_event_lock, flags);
 122	list_add(&vw->list, &vt_events);
 123	spin_unlock_irqrestore(&vt_event_lock, flags);
 124}
 125
 126static void __vt_event_wait(struct vt_event_wait *vw)
 127{
 128	/* Wait for it to pass */
 129	wait_event_interruptible(vt_event_waitqueue, vw->done);
 130}
 131
 132static void __vt_event_dequeue(struct vt_event_wait *vw)
 133{
 134	unsigned long flags;
 135
 136	/* Dequeue it */
 137	spin_lock_irqsave(&vt_event_lock, flags);
 138	list_del(&vw->list);
 139	spin_unlock_irqrestore(&vt_event_lock, flags);
 140}
 141
 142/**
 143 *	vt_event_wait		-	wait for an event
 144 *	@vw: our event
 145 *
 146 *	Waits for an event to occur which completes our vt_event_wait
 147 *	structure. On return the structure has wv->done set to 1 for success
 148 *	or 0 if some event such as a signal ended the wait.
 149 */
 150
 151static void vt_event_wait(struct vt_event_wait *vw)
 152{
 153	__vt_event_queue(vw);
 154	__vt_event_wait(vw);
 155	__vt_event_dequeue(vw);
 156}
 157
 158/**
 159 *	vt_event_wait_ioctl	-	event ioctl handler
 160 *	@arg: argument to ioctl
 161 *
 162 *	Implement the VT_WAITEVENT ioctl using the VT event interface
 163 */
 164
 165static int vt_event_wait_ioctl(struct vt_event __user *event)
 166{
 167	struct vt_event_wait vw;
 168
 169	if (copy_from_user(&vw.event, event, sizeof(struct vt_event)))
 170		return -EFAULT;
 171	/* Highest supported event for now */
 172	if (vw.event.event & ~VT_MAX_EVENT)
 173		return -EINVAL;
 174
 175	vt_event_wait(&vw);
 176	/* If it occurred report it */
 177	if (vw.done) {
 178		if (copy_to_user(event, &vw.event, sizeof(struct vt_event)))
 179			return -EFAULT;
 180		return 0;
 181	}
 182	return -EINTR;
 183}
 184
 185/**
 186 *	vt_waitactive	-	active console wait
 187 *	@event: event code
 188 *	@n: new console
 189 *
 190 *	Helper for event waits. Used to implement the legacy
 191 *	event waiting ioctls in terms of events
 192 */
 193
 194int vt_waitactive(int n)
 195{
 196	struct vt_event_wait vw;
 197	do {
 198		vw.event.event = VT_EVENT_SWITCH;
 199		__vt_event_queue(&vw);
 200		if (n == fg_console + 1) {
 201			__vt_event_dequeue(&vw);
 202			break;
 203		}
 204		__vt_event_wait(&vw);
 205		__vt_event_dequeue(&vw);
 206		if (vw.done == 0)
 207			return -EINTR;
 208	} while (vw.event.newev != n);
 209	return 0;
 210}
 211
 212/*
 213 * these are the valid i/o ports we're allowed to change. they map all the
 214 * video ports
 215 */
 216#define GPFIRST 0x3b4
 217#define GPLAST 0x3df
 218#define GPNUM (GPLAST - GPFIRST + 1)
 219
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 220
 
 
 221
 222static inline int 
 223do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op)
 224{
 225	struct consolefontdesc cfdarg;
 226	int i;
 227
 228	if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc))) 
 229		return -EFAULT;
 230 	
 231	switch (cmd) {
 232	case PIO_FONTX:
 233		if (!perm)
 234			return -EPERM;
 235		op->op = KD_FONT_OP_SET;
 236		op->flags = KD_FONT_FLAG_OLD;
 237		op->width = 8;
 238		op->height = cfdarg.charheight;
 239		op->charcount = cfdarg.charcount;
 240		op->data = cfdarg.chardata;
 241		return con_font_op(vc_cons[fg_console].d, op);
 242	case GIO_FONTX: {
 243		op->op = KD_FONT_OP_GET;
 244		op->flags = KD_FONT_FLAG_OLD;
 245		op->width = 8;
 246		op->height = cfdarg.charheight;
 247		op->charcount = cfdarg.charcount;
 248		op->data = cfdarg.chardata;
 249		i = con_font_op(vc_cons[fg_console].d, op);
 250		if (i)
 251			return i;
 252		cfdarg.charheight = op->height;
 253		cfdarg.charcount = op->charcount;
 254		if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc)))
 255			return -EFAULT;
 256		return 0;
 257		}
 258	}
 259	return -EINVAL;
 260}
 261
 262static inline int 
 263do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc)
 264{
 265	struct unimapdesc tmp;
 
 266
 267	if (copy_from_user(&tmp, user_ud, sizeof tmp))
 268		return -EFAULT;
 269	if (tmp.entries)
 270		if (!access_ok(VERIFY_WRITE, tmp.entries,
 271				tmp.entry_ct*sizeof(struct unipair)))
 272			return -EFAULT;
 273	switch (cmd) {
 274	case PIO_UNIMAP:
 275		if (!perm)
 276			return -EPERM;
 277		return con_set_unimap(vc, tmp.entry_ct, tmp.entries);
 278	case GIO_UNIMAP:
 279		if (!perm && fg_console != vc->vc_num)
 280			return -EPERM;
 281		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp.entries);
 282	}
 283	return 0;
 284}
 285
 286/* deallocate a single console, if possible (leave 0) */
 287static int vt_disallocate(unsigned int vc_num)
 288{
 289	struct vc_data *vc = NULL;
 290	int ret = 0;
 291
 292	console_lock();
 293	if (VT_BUSY(vc_num))
 294		ret = -EBUSY;
 295	else if (vc_num)
 296		vc = vc_deallocate(vc_num);
 297	console_unlock();
 298
 299	if (vc && vc_num >= MIN_NR_CONSOLES) {
 300		tty_port_destroy(&vc->port);
 301		kfree(vc);
 302	}
 303
 304	return ret;
 305}
 306
 307/* deallocate all unused consoles, but leave 0 */
 308static void vt_disallocate_all(void)
 309{
 310	struct vc_data *vc[MAX_NR_CONSOLES];
 311	int i;
 312
 313	console_lock();
 314	for (i = 1; i < MAX_NR_CONSOLES; i++)
 315		if (!VT_BUSY(i))
 316			vc[i] = vc_deallocate(i);
 317		else
 318			vc[i] = NULL;
 319	console_unlock();
 320
 321	for (i = 1; i < MAX_NR_CONSOLES; i++) {
 322		if (vc[i] && i >= MIN_NR_CONSOLES) {
 323			tty_port_destroy(&vc[i]->port);
 324			kfree(vc[i]);
 325		}
 326	}
 327}
 328
 329
 330/*
 331 * We handle the console-specific ioctl's here.  We allow the
 332 * capability to modify any console, not just the fg_console. 
 333 */
 334int vt_ioctl(struct tty_struct *tty,
 335	     unsigned int cmd, unsigned long arg)
 336{
 337	struct vc_data *vc = tty->driver_data;
 338	struct console_font_op op;	/* used in multiple places here */
 339	unsigned int console;
 340	unsigned char ucval;
 341	unsigned int uival;
 342	void __user *up = (void __user *)arg;
 343	int i, perm;
 344	int ret = 0;
 345
 346	console = vc->vc_num;
 347
 348
 349	if (!vc_cons_allocated(console)) { 	/* impossible? */
 350		ret = -ENOIOCTLCMD;
 351		goto out;
 352	}
 353
 354
 355	/*
 356	 * To have permissions to do most of the vt ioctls, we either have
 357	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
 358	 */
 359	perm = 0;
 360	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
 361		perm = 1;
 362 
 363	switch (cmd) {
 364	case TIOCLINUX:
 365		ret = tioclinux(tty, arg);
 366		break;
 367	case KIOCSOUND:
 368		if (!perm)
 369			return -EPERM;
 370		/*
 371		 * The use of PIT_TICK_RATE is historic, it used to be
 372		 * the platform-dependent CLOCK_TICK_RATE between 2.6.12
 373		 * and 2.6.36, which was a minor but unfortunate ABI
 374		 * change. kd_mksound is locked by the input layer.
 375		 */
 376		if (arg)
 377			arg = PIT_TICK_RATE / arg;
 378		kd_mksound(arg, 0);
 379		break;
 380
 381	case KDMKTONE:
 382		if (!perm)
 383			return -EPERM;
 384	{
 385		unsigned int ticks, count;
 386		
 387		/*
 388		 * Generate the tone for the appropriate number of ticks.
 389		 * If the time is zero, turn off sound ourselves.
 390		 */
 391		ticks = HZ * ((arg >> 16) & 0xffff) / 1000;
 392		count = ticks ? (arg & 0xffff) : 0;
 393		if (count)
 394			count = PIT_TICK_RATE / count;
 395		kd_mksound(count, ticks);
 396		break;
 397	}
 398
 399	case KDGKBTYPE:
 400		/*
 401		 * this is naïve.
 402		 */
 403		ucval = KB_101;
 404		ret = put_user(ucval, (char __user *)arg);
 405		break;
 406
 407		/*
 408		 * These cannot be implemented on any machine that implements
 409		 * ioperm() in user level (such as Alpha PCs) or not at all.
 410		 *
 411		 * XXX: you should never use these, just call ioperm directly..
 412		 */
 413#ifdef CONFIG_X86
 414	case KDADDIO:
 415	case KDDELIO:
 416		/*
 417		 * KDADDIO and KDDELIO may be able to add ports beyond what
 418		 * we reject here, but to be safe...
 419		 *
 420		 * These are locked internally via sys_ioperm
 421		 */
 422		if (arg < GPFIRST || arg > GPLAST) {
 423			ret = -EINVAL;
 424			break;
 425		}
 426		ret = sys_ioperm(arg, 1, (cmd == KDADDIO)) ? -ENXIO : 0;
 427		break;
 428
 429	case KDENABIO:
 430	case KDDISABIO:
 431		ret = sys_ioperm(GPFIRST, GPNUM,
 432				  (cmd == KDENABIO)) ? -ENXIO : 0;
 433		break;
 434#endif
 435
 436	/* Linux m68k/i386 interface for setting the keyboard delay/repeat rate */
 437		
 438	case KDKBDREP:
 439	{
 440		struct kbd_repeat kbrep;
 441		
 442		if (!capable(CAP_SYS_TTY_CONFIG))
 443			return -EPERM;
 444
 445		if (copy_from_user(&kbrep, up, sizeof(struct kbd_repeat))) {
 446			ret =  -EFAULT;
 447			break;
 448		}
 449		ret = kbd_rate(&kbrep);
 450		if (ret)
 451			break;
 452		if (copy_to_user(up, &kbrep, sizeof(struct kbd_repeat)))
 453			ret = -EFAULT;
 454		break;
 455	}
 456
 457	case KDSETMODE:
 458		/*
 459		 * currently, setting the mode from KD_TEXT to KD_GRAPHICS
 460		 * doesn't do a whole lot. i'm not sure if it should do any
 461		 * restoration of modes or what...
 462		 *
 463		 * XXX It should at least call into the driver, fbdev's definitely
 464		 * need to restore their engine state. --BenH
 465		 */
 466		if (!perm)
 467			return -EPERM;
 468		switch (arg) {
 469		case KD_GRAPHICS:
 470			break;
 471		case KD_TEXT0:
 472		case KD_TEXT1:
 473			arg = KD_TEXT;
 474		case KD_TEXT:
 475			break;
 476		default:
 477			ret = -EINVAL;
 478			goto out;
 479		}
 480		/* FIXME: this needs the console lock extending */
 481		if (vc->vc_mode == (unsigned char) arg)
 482			break;
 483		vc->vc_mode = (unsigned char) arg;
 484		if (console != fg_console)
 485			break;
 486		/*
 487		 * explicitly blank/unblank the screen if switching modes
 488		 */
 489		console_lock();
 490		if (arg == KD_TEXT)
 491			do_unblank_screen(1);
 492		else
 493			do_blank_screen(1);
 494		console_unlock();
 495		break;
 496
 497	case KDGETMODE:
 498		uival = vc->vc_mode;
 499		goto setint;
 500
 501	case KDMAPDISP:
 502	case KDUNMAPDISP:
 503		/*
 504		 * these work like a combination of mmap and KDENABIO.
 505		 * this could be easily finished.
 506		 */
 507		ret = -EINVAL;
 508		break;
 509
 510	case KDSKBMODE:
 511		if (!perm)
 512			return -EPERM;
 513		ret = vt_do_kdskbmode(console, arg);
 514		if (ret == 0)
 515			tty_ldisc_flush(tty);
 
 516		break;
 517
 518	case KDGKBMODE:
 519		uival = vt_do_kdgkbmode(console);
 520		ret = put_user(uival, (int __user *)arg);
 521		break;
 522
 523	/* this could be folded into KDSKBMODE, but for compatibility
 524	   reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */
 525	case KDSKBMETA:
 526		ret = vt_do_kdskbmeta(console, arg);
 527		break;
 528
 529	case KDGKBMETA:
 530		/* FIXME: should review whether this is worth locking */
 531		uival = vt_do_kdgkbmeta(console);
 532	setint:
 533		ret = put_user(uival, (int __user *)arg);
 534		break;
 535
 536	case KDGETKEYCODE:
 537	case KDSETKEYCODE:
 538		if(!capable(CAP_SYS_TTY_CONFIG))
 539			perm = 0;
 540		ret = vt_do_kbkeycode_ioctl(cmd, up, perm);
 541		break;
 542
 543	case KDGKBENT:
 544	case KDSKBENT:
 545		ret = vt_do_kdsk_ioctl(cmd, up, perm, console);
 546		break;
 547
 548	case KDGKBSENT:
 549	case KDSKBSENT:
 550		ret = vt_do_kdgkb_ioctl(cmd, up, perm);
 551		break;
 552
 553	/* Diacritical processing. Handled in keyboard.c as it has
 554	   to operate on the keyboard locks and structures */
 555	case KDGKBDIACR:
 556	case KDGKBDIACRUC:
 557	case KDSKBDIACR:
 558	case KDSKBDIACRUC:
 559		ret = vt_do_diacrit(cmd, up, perm);
 560		break;
 561
 562	/* the ioctls below read/set the flags usually shown in the leds */
 563	/* don't use them - they will go away without warning */
 564	case KDGKBLED:
 565	case KDSKBLED:
 566	case KDGETLED:
 567	case KDSETLED:
 568		ret = vt_do_kdskled(console, cmd, arg, perm);
 569		break;
 570
 571	/*
 572	 * A process can indicate its willingness to accept signals
 573	 * generated by pressing an appropriate key combination.
 574	 * Thus, one can have a daemon that e.g. spawns a new console
 575	 * upon a keypress and then changes to it.
 576	 * See also the kbrequest field of inittab(5).
 577	 */
 578	case KDSIGACCEPT:
 579	{
 580		if (!perm || !capable(CAP_KILL))
 581			return -EPERM;
 582		if (!valid_signal(arg) || arg < 1 || arg == SIGKILL)
 583			ret = -EINVAL;
 584		else {
 585			spin_lock_irq(&vt_spawn_con.lock);
 586			put_pid(vt_spawn_con.pid);
 587			vt_spawn_con.pid = get_pid(task_pid(current));
 588			vt_spawn_con.sig = arg;
 589			spin_unlock_irq(&vt_spawn_con.lock);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 590		}
 591		break;
 592	}
 593
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 594	case VT_SETMODE:
 595	{
 596		struct vt_mode tmp;
 597
 598		if (!perm)
 599			return -EPERM;
 600		if (copy_from_user(&tmp, up, sizeof(struct vt_mode))) {
 601			ret = -EFAULT;
 602			goto out;
 603		}
 604		if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS) {
 605			ret = -EINVAL;
 606			goto out;
 607		}
 608		console_lock();
 609		vc->vt_mode = tmp;
 610		/* the frsig is ignored, so we set it to 0 */
 611		vc->vt_mode.frsig = 0;
 612		put_pid(vc->vt_pid);
 613		vc->vt_pid = get_pid(task_pid(current));
 614		/* no switch is required -- saw@shade.msu.ru */
 615		vc->vt_newvt = -1;
 616		console_unlock();
 617		break;
 618	}
 619
 620	case VT_GETMODE:
 621	{
 622		struct vt_mode tmp;
 623		int rc;
 624
 625		console_lock();
 626		memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode));
 627		console_unlock();
 628
 629		rc = copy_to_user(up, &tmp, sizeof(struct vt_mode));
 630		if (rc)
 631			ret = -EFAULT;
 632		break;
 633	}
 634
 635	/*
 636	 * Returns global vt state. Note that VT 0 is always open, since
 637	 * it's an alias for the current VT, and people can't use it here.
 638	 * We cannot return state for more than 16 VTs, since v_state is short.
 639	 */
 640	case VT_GETSTATE:
 641	{
 642		struct vt_stat __user *vtstat = up;
 643		unsigned short state, mask;
 644
 645		/* Review: FIXME: Console lock ? */
 646		if (put_user(fg_console + 1, &vtstat->v_active))
 647			ret = -EFAULT;
 648		else {
 649			state = 1;	/* /dev/tty0 is always open */
 650			for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask;
 651							++i, mask <<= 1)
 652				if (VT_IS_IN_USE(i))
 653					state |= mask;
 654			ret = put_user(state, &vtstat->v_state);
 655		}
 656		break;
 657	}
 658
 659	/*
 660	 * Returns the first available (non-opened) console.
 661	 */
 662	case VT_OPENQRY:
 663		/* FIXME: locking ? - but then this is a stupid API */
 664		for (i = 0; i < MAX_NR_CONSOLES; ++i)
 665			if (! VT_IS_IN_USE(i))
 666				break;
 667		uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
 668		goto setint;		 
 
 669
 670	/*
 671	 * ioctl(fd, VT_ACTIVATE, num) will cause us to switch to vt # num,
 672	 * with num >= 1 (switches to vt 0, our console, are not allowed, just
 673	 * to preserve sanity).
 674	 */
 675	case VT_ACTIVATE:
 676		if (!perm)
 677			return -EPERM;
 678		if (arg == 0 || arg > MAX_NR_CONSOLES)
 679			ret =  -ENXIO;
 680		else {
 681			arg--;
 682			console_lock();
 683			ret = vc_allocate(arg);
 684			console_unlock();
 685			if (ret)
 686				break;
 687			set_console(arg);
 688		}
 689		break;
 690
 691	case VT_SETACTIVATE:
 692	{
 693		struct vt_setactivate vsa;
 694
 695		if (!perm)
 696			return -EPERM;
 697
 698		if (copy_from_user(&vsa, (struct vt_setactivate __user *)arg,
 699					sizeof(struct vt_setactivate))) {
 700			ret = -EFAULT;
 701			goto out;
 702		}
 703		if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
 704			ret = -ENXIO;
 705		else {
 706			vsa.console--;
 707			console_lock();
 708			ret = vc_allocate(vsa.console);
 709			if (ret == 0) {
 710				struct vc_data *nvc;
 711				/* This is safe providing we don't drop the
 712				   console sem between vc_allocate and
 713				   finishing referencing nvc */
 714				nvc = vc_cons[vsa.console].d;
 715				nvc->vt_mode = vsa.mode;
 716				nvc->vt_mode.frsig = 0;
 717				put_pid(nvc->vt_pid);
 718				nvc->vt_pid = get_pid(task_pid(current));
 719			}
 720			console_unlock();
 721			if (ret)
 722				break;
 723			/* Commence switch and lock */
 724			/* Review set_console locks */
 725			set_console(vsa.console);
 726		}
 727		break;
 728	}
 729
 730	/*
 731	 * wait until the specified VT has been activated
 732	 */
 733	case VT_WAITACTIVE:
 734		if (!perm)
 735			return -EPERM;
 736		if (arg == 0 || arg > MAX_NR_CONSOLES)
 737			ret = -ENXIO;
 738		else
 739			ret = vt_waitactive(arg);
 740		break;
 741
 742	/*
 743	 * If a vt is under process control, the kernel will not switch to it
 744	 * immediately, but postpone the operation until the process calls this
 745	 * ioctl, allowing the switch to complete.
 746	 *
 747	 * According to the X sources this is the behavior:
 748	 *	0:	pending switch-from not OK
 749	 *	1:	pending switch-from OK
 750	 *	2:	completed switch-to OK
 751	 */
 752	case VT_RELDISP:
 753		if (!perm)
 754			return -EPERM;
 755
 756		console_lock();
 757		if (vc->vt_mode.mode != VT_PROCESS) {
 758			console_unlock();
 759			ret = -EINVAL;
 760			break;
 761		}
 762		/*
 763		 * Switching-from response
 764		 */
 765		if (vc->vt_newvt >= 0) {
 766			if (arg == 0)
 767				/*
 768				 * Switch disallowed, so forget we were trying
 769				 * to do it.
 770				 */
 771				vc->vt_newvt = -1;
 772
 773			else {
 774				/*
 775				 * The current vt has been released, so
 776				 * complete the switch.
 777				 */
 778				int newvt;
 779				newvt = vc->vt_newvt;
 780				vc->vt_newvt = -1;
 781				ret = vc_allocate(newvt);
 782				if (ret) {
 783					console_unlock();
 784					break;
 785				}
 786				/*
 787				 * When we actually do the console switch,
 788				 * make sure we are atomic with respect to
 789				 * other console switches..
 790				 */
 791				complete_change_console(vc_cons[newvt].d);
 792			}
 793		} else {
 794			/*
 795			 * Switched-to response
 796			 */
 797			/*
 798			 * If it's just an ACK, ignore it
 799			 */
 800			if (arg != VT_ACKACQ)
 801				ret = -EINVAL;
 802		}
 803		console_unlock();
 804		break;
 
 
 805
 806	 /*
 807	  * Disallocate memory associated to VT (but leave VT1)
 808	  */
 809	 case VT_DISALLOCATE:
 810		if (arg > MAX_NR_CONSOLES) {
 811			ret = -ENXIO;
 
 
 
 812			break;
 813		}
 814		if (arg == 0)
 815			vt_disallocate_all();
 816		else
 817			ret = vt_disallocate(--arg);
 818		break;
 819
 820	case VT_RESIZE:
 821	{
 822		struct vt_sizes __user *vtsizes = up;
 823		struct vc_data *vc;
 
 824
 825		ushort ll,cc;
 826		if (!perm)
 827			return -EPERM;
 828		if (get_user(ll, &vtsizes->v_rows) ||
 829		    get_user(cc, &vtsizes->v_cols))
 830			ret = -EFAULT;
 831		else {
 832			console_lock();
 833			for (i = 0; i < MAX_NR_CONSOLES; i++) {
 834				vc = vc_cons[i].d;
 835
 836				if (vc) {
 837					vc->vc_resize_user = 1;
 838					/* FIXME: review v tty lock */
 839					vc_resize(vc_cons[i].d, cc, ll);
 840				}
 841			}
 842			console_unlock();
 843		}
 844		break;
 845	}
 846
 847	case VT_RESIZEX:
 848	{
 849		struct vt_consize __user *vtconsize = up;
 850		ushort ll,cc,vlin,clin,vcol,ccol;
 851		if (!perm)
 852			return -EPERM;
 853		if (!access_ok(VERIFY_READ, vtconsize,
 854				sizeof(struct vt_consize))) {
 855			ret = -EFAULT;
 856			break;
 857		}
 858		/* FIXME: Should check the copies properly */
 859		__get_user(ll, &vtconsize->v_rows);
 860		__get_user(cc, &vtconsize->v_cols);
 861		__get_user(vlin, &vtconsize->v_vlin);
 862		__get_user(clin, &vtconsize->v_clin);
 863		__get_user(vcol, &vtconsize->v_vcol);
 864		__get_user(ccol, &vtconsize->v_ccol);
 865		vlin = vlin ? vlin : vc->vc_scan_lines;
 866		if (clin) {
 867			if (ll) {
 868				if (ll != vlin/clin) {
 869					/* Parameters don't add up */
 870					ret = -EINVAL;
 871					break;
 872				}
 873			} else 
 874				ll = vlin/clin;
 875		}
 876		if (vcol && ccol) {
 877			if (cc) {
 878				if (cc != vcol/ccol) {
 879					ret = -EINVAL;
 880					break;
 881				}
 882			} else
 883				cc = vcol/ccol;
 884		}
 885
 886		if (clin > 32) {
 887			ret =  -EINVAL;
 888			break;
 889		}
 890		    
 891		for (i = 0; i < MAX_NR_CONSOLES; i++) {
 892			if (!vc_cons[i].d)
 893				continue;
 894			console_lock();
 895			if (vlin)
 896				vc_cons[i].d->vc_scan_lines = vlin;
 897			if (clin)
 898				vc_cons[i].d->vc_font.height = clin;
 899			vc_cons[i].d->vc_resize_user = 1;
 900			vc_resize(vc_cons[i].d, cc, ll);
 901			console_unlock();
 902		}
 903		break;
 904	}
 905
 906	case PIO_FONT: {
 907		if (!perm)
 908			return -EPERM;
 909		op.op = KD_FONT_OP_SET;
 910		op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC;	/* Compatibility */
 911		op.width = 8;
 912		op.height = 0;
 913		op.charcount = 256;
 914		op.data = up;
 915		ret = con_font_op(vc_cons[fg_console].d, &op);
 916		break;
 917	}
 918
 919	case GIO_FONT: {
 920		op.op = KD_FONT_OP_GET;
 921		op.flags = KD_FONT_FLAG_OLD;
 922		op.width = 8;
 923		op.height = 32;
 924		op.charcount = 256;
 925		op.data = up;
 926		ret = con_font_op(vc_cons[fg_console].d, &op);
 927		break;
 928	}
 929
 930	case PIO_CMAP:
 931                if (!perm)
 932			ret = -EPERM;
 933		else
 934	                ret = con_set_cmap(up);
 935		break;
 936
 937	case GIO_CMAP:
 938                ret = con_get_cmap(up);
 939		break;
 940
 941	case PIO_FONTX:
 942	case GIO_FONTX:
 943		ret = do_fontx_ioctl(cmd, up, perm, &op);
 944		break;
 945
 946	case PIO_FONTRESET:
 947	{
 948		if (!perm)
 949			return -EPERM;
 950
 951#ifdef BROKEN_GRAPHICS_PROGRAMS
 952		/* With BROKEN_GRAPHICS_PROGRAMS defined, the default
 953		   font is not saved. */
 954		ret = -ENOSYS;
 955		break;
 956#else
 957		{
 958		op.op = KD_FONT_OP_SET_DEFAULT;
 959		op.data = NULL;
 960		ret = con_font_op(vc_cons[fg_console].d, &op);
 961		if (ret)
 962			break;
 963		console_lock();
 964		con_set_default_unimap(vc_cons[fg_console].d);
 965		console_unlock();
 966		break;
 967		}
 968#endif
 969	}
 970
 971	case KDFONTOP: {
 972		if (copy_from_user(&op, up, sizeof(op))) {
 973			ret = -EFAULT;
 974			break;
 975		}
 976		if (!perm && op.op != KD_FONT_OP_GET)
 977			return -EPERM;
 978		ret = con_font_op(vc, &op);
 979		if (ret)
 980			break;
 981		if (copy_to_user(up, &op, sizeof(op)))
 982			ret = -EFAULT;
 983		break;
 984	}
 985
 986	case PIO_SCRNMAP:
 987		if (!perm)
 988			ret = -EPERM;
 989		else
 990			ret = con_set_trans_old(up);
 991		break;
 992
 993	case GIO_SCRNMAP:
 994		ret = con_get_trans_old(up);
 995		break;
 996
 997	case PIO_UNISCRNMAP:
 998		if (!perm)
 999			ret = -EPERM;
1000		else
1001			ret = con_set_trans_new(up);
1002		break;
1003
1004	case GIO_UNISCRNMAP:
1005		ret = con_get_trans_new(up);
1006		break;
1007
1008	case PIO_UNIMAPCLR:
1009	      { struct unimapinit ui;
1010		if (!perm)
1011			return -EPERM;
1012		ret = copy_from_user(&ui, up, sizeof(struct unimapinit));
1013		if (ret)
1014			ret = -EFAULT;
1015		else
1016			con_clear_unimap(vc, &ui);
1017		break;
1018	      }
1019
1020	case PIO_UNIMAP:
1021	case GIO_UNIMAP:
1022		ret = do_unimap_ioctl(cmd, up, perm, vc);
1023		break;
1024
1025	case VT_LOCKSWITCH:
1026		if (!capable(CAP_SYS_TTY_CONFIG))
1027			return -EPERM;
1028		vt_dont_switch = 1;
1029		break;
1030	case VT_UNLOCKSWITCH:
1031		if (!capable(CAP_SYS_TTY_CONFIG))
1032			return -EPERM;
1033		vt_dont_switch = 0;
1034		break;
1035	case VT_GETHIFONTMASK:
1036		ret = put_user(vc->vc_hi_font_mask,
1037					(unsigned short __user *)arg);
1038		break;
1039	case VT_WAITEVENT:
1040		ret = vt_event_wait_ioctl((struct vt_event __user *)arg);
1041		break;
1042	default:
1043		ret = -ENOIOCTLCMD;
1044	}
1045out:
1046	return ret;
1047}
1048
1049void reset_vc(struct vc_data *vc)
1050{
1051	vc->vc_mode = KD_TEXT;
1052	vt_reset_unicode(vc->vc_num);
1053	vc->vt_mode.mode = VT_AUTO;
1054	vc->vt_mode.waitv = 0;
1055	vc->vt_mode.relsig = 0;
1056	vc->vt_mode.acqsig = 0;
1057	vc->vt_mode.frsig = 0;
1058	put_pid(vc->vt_pid);
1059	vc->vt_pid = NULL;
1060	vc->vt_newvt = -1;
1061	if (!in_interrupt())    /* Via keyboard.c:SAK() - akpm */
1062		reset_palette(vc);
1063}
1064
1065void vc_SAK(struct work_struct *work)
1066{
1067	struct vc *vc_con =
1068		container_of(work, struct vc, SAK_work);
1069	struct vc_data *vc;
1070	struct tty_struct *tty;
1071
1072	console_lock();
1073	vc = vc_con->d;
1074	if (vc) {
1075		/* FIXME: review tty ref counting */
1076		tty = vc->port.tty;
1077		/*
1078		 * SAK should also work in all raw modes and reset
1079		 * them properly.
1080		 */
1081		if (tty)
1082			__do_SAK(tty);
1083		reset_vc(vc);
1084	}
1085	console_unlock();
1086}
1087
1088#ifdef CONFIG_COMPAT
1089
1090struct compat_consolefontdesc {
1091	unsigned short charcount;       /* characters in font (256 or 512) */
1092	unsigned short charheight;      /* scan lines per character (1-32) */
1093	compat_caddr_t chardata;	/* font data in expanded form */
1094};
1095
1096static inline int
1097compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
1098			 int perm, struct console_font_op *op)
1099{
1100	struct compat_consolefontdesc cfdarg;
1101	int i;
1102
1103	if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc)))
1104		return -EFAULT;
1105
1106	switch (cmd) {
1107	case PIO_FONTX:
1108		if (!perm)
1109			return -EPERM;
1110		op->op = KD_FONT_OP_SET;
1111		op->flags = KD_FONT_FLAG_OLD;
1112		op->width = 8;
1113		op->height = cfdarg.charheight;
1114		op->charcount = cfdarg.charcount;
1115		op->data = compat_ptr(cfdarg.chardata);
1116		return con_font_op(vc_cons[fg_console].d, op);
1117	case GIO_FONTX:
1118		op->op = KD_FONT_OP_GET;
1119		op->flags = KD_FONT_FLAG_OLD;
1120		op->width = 8;
1121		op->height = cfdarg.charheight;
1122		op->charcount = cfdarg.charcount;
1123		op->data = compat_ptr(cfdarg.chardata);
1124		i = con_font_op(vc_cons[fg_console].d, op);
1125		if (i)
1126			return i;
1127		cfdarg.charheight = op->height;
1128		cfdarg.charcount = op->charcount;
1129		if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc)))
1130			return -EFAULT;
1131		return 0;
1132	}
1133	return -EINVAL;
1134}
1135
1136struct compat_console_font_op {
1137	compat_uint_t op;        /* operation code KD_FONT_OP_* */
1138	compat_uint_t flags;     /* KD_FONT_FLAG_* */
1139	compat_uint_t width, height;     /* font size */
1140	compat_uint_t charcount;
1141	compat_caddr_t data;    /* font data with height fixed to 32 */
1142};
1143
1144static inline int
1145compat_kdfontop_ioctl(struct compat_console_font_op __user *fontop,
1146			 int perm, struct console_font_op *op, struct vc_data *vc)
1147{
1148	int i;
1149
1150	if (copy_from_user(op, fontop, sizeof(struct compat_console_font_op)))
1151		return -EFAULT;
1152	if (!perm && op->op != KD_FONT_OP_GET)
1153		return -EPERM;
1154	op->data = compat_ptr(((struct compat_console_font_op *)op)->data);
1155	i = con_font_op(vc, op);
1156	if (i)
1157		return i;
1158	((struct compat_console_font_op *)op)->data = (unsigned long)op->data;
1159	if (copy_to_user(fontop, op, sizeof(struct compat_console_font_op)))
1160		return -EFAULT;
1161	return 0;
1162}
1163
1164struct compat_unimapdesc {
1165	unsigned short entry_ct;
1166	compat_caddr_t entries;
1167};
1168
1169static inline int
1170compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud,
1171			 int perm, struct vc_data *vc)
1172{
1173	struct compat_unimapdesc tmp;
1174	struct unipair __user *tmp_entries;
1175
1176	if (copy_from_user(&tmp, user_ud, sizeof tmp))
1177		return -EFAULT;
1178	tmp_entries = compat_ptr(tmp.entries);
1179	if (tmp_entries)
1180		if (!access_ok(VERIFY_WRITE, tmp_entries,
1181				tmp.entry_ct*sizeof(struct unipair)))
1182			return -EFAULT;
1183	switch (cmd) {
1184	case PIO_UNIMAP:
1185		if (!perm)
1186			return -EPERM;
1187		return con_set_unimap(vc, tmp.entry_ct, tmp_entries);
1188	case GIO_UNIMAP:
1189		if (!perm && fg_console != vc->vc_num)
1190			return -EPERM;
1191		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp_entries);
1192	}
1193	return 0;
1194}
1195
1196long vt_compat_ioctl(struct tty_struct *tty,
1197	     unsigned int cmd, unsigned long arg)
1198{
1199	struct vc_data *vc = tty->driver_data;
1200	struct console_font_op op;	/* used in multiple places here */
1201	unsigned int console;
1202	void __user *up = (void __user *)arg;
1203	int perm;
1204	int ret = 0;
1205
1206	console = vc->vc_num;
1207
1208	if (!vc_cons_allocated(console)) { 	/* impossible? */
1209		ret = -ENOIOCTLCMD;
1210		goto out;
1211	}
1212
1213	/*
1214	 * To have permissions to do most of the vt ioctls, we either have
1215	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
1216	 */
1217	perm = 0;
1218	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
1219		perm = 1;
1220
1221	switch (cmd) {
1222	/*
1223	 * these need special handlers for incompatible data structures
1224	 */
1225	case PIO_FONTX:
1226	case GIO_FONTX:
1227		ret = compat_fontx_ioctl(cmd, up, perm, &op);
1228		break;
1229
1230	case KDFONTOP:
1231		ret = compat_kdfontop_ioctl(up, perm, &op, vc);
1232		break;
1233
1234	case PIO_UNIMAP:
1235	case GIO_UNIMAP:
1236		ret = compat_unimap_ioctl(cmd, up, perm, vc);
1237		break;
1238
1239	/*
1240	 * all these treat 'arg' as an integer
1241	 */
1242	case KIOCSOUND:
1243	case KDMKTONE:
1244#ifdef CONFIG_X86
1245	case KDADDIO:
1246	case KDDELIO:
1247#endif
1248	case KDSETMODE:
1249	case KDMAPDISP:
1250	case KDUNMAPDISP:
1251	case KDSKBMODE:
1252	case KDSKBMETA:
1253	case KDSKBLED:
1254	case KDSETLED:
1255	case KDSIGACCEPT:
1256	case VT_ACTIVATE:
1257	case VT_WAITACTIVE:
1258	case VT_RELDISP:
1259	case VT_DISALLOCATE:
1260	case VT_RESIZE:
1261	case VT_RESIZEX:
1262		goto fallback;
1263
1264	/*
1265	 * the rest has a compatible data structure behind arg,
1266	 * but we have to convert it to a proper 64 bit pointer.
1267	 */
1268	default:
1269		arg = (unsigned long)compat_ptr(arg);
1270		goto fallback;
1271	}
1272out:
1273	return ret;
1274
1275fallback:
1276	return vt_ioctl(tty, cmd, arg);
1277}
1278
1279
1280#endif /* CONFIG_COMPAT */
1281
1282
1283/*
1284 * Performs the back end of a vt switch. Called under the console
1285 * semaphore.
1286 */
1287static void complete_change_console(struct vc_data *vc)
1288{
1289	unsigned char old_vc_mode;
1290	int old = fg_console;
1291
1292	last_console = fg_console;
1293
1294	/*
1295	 * If we're switching, we could be going from KD_GRAPHICS to
1296	 * KD_TEXT mode or vice versa, which means we need to blank or
1297	 * unblank the screen later.
1298	 */
1299	old_vc_mode = vc_cons[fg_console].d->vc_mode;
1300	switch_screen(vc);
1301
1302	/*
1303	 * This can't appear below a successful kill_pid().  If it did,
1304	 * then the *blank_screen operation could occur while X, having
1305	 * received acqsig, is waking up on another processor.  This
1306	 * condition can lead to overlapping accesses to the VGA range
1307	 * and the framebuffer (causing system lockups).
1308	 *
1309	 * To account for this we duplicate this code below only if the
1310	 * controlling process is gone and we've called reset_vc.
1311	 */
1312	if (old_vc_mode != vc->vc_mode) {
1313		if (vc->vc_mode == KD_TEXT)
1314			do_unblank_screen(1);
1315		else
1316			do_blank_screen(1);
1317	}
1318
1319	/*
1320	 * If this new console is under process control, send it a signal
1321	 * telling it that it has acquired. Also check if it has died and
1322	 * clean up (similar to logic employed in change_console())
1323	 */
1324	if (vc->vt_mode.mode == VT_PROCESS) {
1325		/*
1326		 * Send the signal as privileged - kill_pid() will
1327		 * tell us if the process has gone or something else
1328		 * is awry
1329		 */
1330		if (kill_pid(vc->vt_pid, vc->vt_mode.acqsig, 1) != 0) {
1331		/*
1332		 * The controlling process has died, so we revert back to
1333		 * normal operation. In this case, we'll also change back
1334		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1335		 * but it saves the agony when the X server dies and the screen
1336		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1337		 * this outside of VT_PROCESS but there is no single process
1338		 * to account for and tracking tty count may be undesirable.
1339		 */
1340			reset_vc(vc);
1341
1342			if (old_vc_mode != vc->vc_mode) {
1343				if (vc->vc_mode == KD_TEXT)
1344					do_unblank_screen(1);
1345				else
1346					do_blank_screen(1);
1347			}
1348		}
1349	}
1350
1351	/*
1352	 * Wake anyone waiting for their VT to activate
1353	 */
1354	vt_event_post(VT_EVENT_SWITCH, old, vc->vc_num);
1355	return;
1356}
1357
1358/*
1359 * Performs the front-end of a vt switch
1360 */
1361void change_console(struct vc_data *new_vc)
1362{
1363	struct vc_data *vc;
1364
1365	if (!new_vc || new_vc->vc_num == fg_console || vt_dont_switch)
1366		return;
1367
1368	/*
1369	 * If this vt is in process mode, then we need to handshake with
1370	 * that process before switching. Essentially, we store where that
1371	 * vt wants to switch to and wait for it to tell us when it's done
1372	 * (via VT_RELDISP ioctl).
1373	 *
1374	 * We also check to see if the controlling process still exists.
1375	 * If it doesn't, we reset this vt to auto mode and continue.
1376	 * This is a cheap way to track process control. The worst thing
1377	 * that can happen is: we send a signal to a process, it dies, and
1378	 * the switch gets "lost" waiting for a response; hopefully, the
1379	 * user will try again, we'll detect the process is gone (unless
1380	 * the user waits just the right amount of time :-) and revert the
1381	 * vt to auto control.
1382	 */
1383	vc = vc_cons[fg_console].d;
1384	if (vc->vt_mode.mode == VT_PROCESS) {
1385		/*
1386		 * Send the signal as privileged - kill_pid() will
1387		 * tell us if the process has gone or something else
1388		 * is awry.
1389		 *
1390		 * We need to set vt_newvt *before* sending the signal or we
1391		 * have a race.
1392		 */
1393		vc->vt_newvt = new_vc->vc_num;
1394		if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) {
1395			/*
1396			 * It worked. Mark the vt to switch to and
1397			 * return. The process needs to send us a
1398			 * VT_RELDISP ioctl to complete the switch.
1399			 */
1400			return;
1401		}
1402
1403		/*
1404		 * The controlling process has died, so we revert back to
1405		 * normal operation. In this case, we'll also change back
1406		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1407		 * but it saves the agony when the X server dies and the screen
1408		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1409		 * this outside of VT_PROCESS but there is no single process
1410		 * to account for and tracking tty count may be undesirable.
1411		 */
1412		reset_vc(vc);
1413
1414		/*
1415		 * Fall through to normal (VT_AUTO) handling of the switch...
1416		 */
1417	}
1418
1419	/*
1420	 * Ignore all switches in KD_GRAPHICS+VT_AUTO mode
1421	 */
1422	if (vc->vc_mode == KD_GRAPHICS)
1423		return;
1424
1425	complete_change_console(new_vc);
1426}
1427
1428/* Perform a kernel triggered VT switch for suspend/resume */
1429
1430static int disable_vt_switch;
1431
1432int vt_move_to_console(unsigned int vt, int alloc)
1433{
1434	int prev;
1435
1436	console_lock();
1437	/* Graphics mode - up to X */
1438	if (disable_vt_switch) {
1439		console_unlock();
1440		return 0;
1441	}
1442	prev = fg_console;
1443
1444	if (alloc && vc_allocate(vt)) {
1445		/* we can't have a free VC for now. Too bad,
1446		 * we don't want to mess the screen for now. */
1447		console_unlock();
1448		return -ENOSPC;
1449	}
1450
1451	if (set_console(vt)) {
1452		/*
1453		 * We're unable to switch to the SUSPEND_CONSOLE.
1454		 * Let the calling function know so it can decide
1455		 * what to do.
1456		 */
1457		console_unlock();
1458		return -EIO;
1459	}
1460	console_unlock();
1461	if (vt_waitactive(vt + 1)) {
1462		pr_debug("Suspend: Can't switch VCs.");
1463		return -EINTR;
1464	}
1465	return prev;
1466}
1467
1468/*
1469 * Normally during a suspend, we allocate a new console and switch to it.
1470 * When we resume, we switch back to the original console.  This switch
1471 * can be slow, so on systems where the framebuffer can handle restoration
1472 * of video registers anyways, there's little point in doing the console
1473 * switch.  This function allows you to disable it by passing it '0'.
1474 */
1475void pm_set_vt_switch(int do_switch)
1476{
1477	console_lock();
1478	disable_vt_switch = !do_switch;
1479	console_unlock();
1480}
1481EXPORT_SYMBOL(pm_set_vt_switch);