vt_ioctl.c revision 247ff8e610cb63c015de19191db9666754c2ed79
1/*
2 *  Copyright (C) 1992 obz under the linux copyright
3 *
4 *  Dynamic diacritical handling - aeb@cwi.nl - Dec 1993
5 *  Dynamic keymap and string allocation - aeb@cwi.nl - May 1994
6 *  Restrict VT switching via ioctl() - grif@cs.ucr.edu - Dec 1995
7 *  Some code moved for less code duplication - Andi Kleen - Mar 1997
8 *  Check put/get_user, cleanups - acme@conectiva.com.br - Jun 2001
9 */
10
11#include <linux/types.h>
12#include <linux/errno.h>
13#include <linux/sched.h>
14#include <linux/tty.h>
15#include <linux/timer.h>
16#include <linux/kernel.h>
17#include <linux/compat.h>
18#include <linux/module.h>
19#include <linux/kd.h>
20#include <linux/vt.h>
21#include <linux/string.h>
22#include <linux/slab.h>
23#include <linux/major.h>
24#include <linux/fs.h>
25#include <linux/console.h>
26#include <linux/consolemap.h>
27#include <linux/signal.h>
28#include <linux/timex.h>
29
30#include <asm/io.h>
31#include <asm/uaccess.h>
32
33#include <linux/kbd_kern.h>
34#include <linux/vt_kern.h>
35#include <linux/kbd_diacr.h>
36#include <linux/selection.h>
37
38char vt_dont_switch;
39extern struct tty_driver *console_driver;
40
41#define VT_IS_IN_USE(i)	(console_driver->ttys[i] && console_driver->ttys[i]->count)
42#define VT_BUSY(i)	(VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons)
43
44/*
45 * Console (vt and kd) routines, as defined by USL SVR4 manual, and by
46 * experimentation and study of X386 SYSV handling.
47 *
48 * One point of difference: SYSV vt's are /dev/vtX, which X >= 0, and
49 * /dev/console is a separate ttyp. Under Linux, /dev/tty0 is /dev/console,
50 * and the vc start at /dev/ttyX, X >= 1. We maintain that here, so we will
51 * always treat our set of vt as numbered 1..MAX_NR_CONSOLES (corresponding to
52 * ttys 0..MAX_NR_CONSOLES-1). Explicitly naming VT 0 is illegal, but using
53 * /dev/tty0 (fg_console) as a target is legal, since an implicit aliasing
54 * to the current console is done by the main ioctl code.
55 */
56
57#ifdef CONFIG_X86
58#include <linux/syscalls.h>
59#endif
60
61static void complete_change_console(struct vc_data *vc);
62
63/*
64 *	User space VT_EVENT handlers
65 */
66
67struct vt_event_wait {
68	struct list_head list;
69	struct vt_event event;
70	int done;
71};
72
73static LIST_HEAD(vt_events);
74static DEFINE_SPINLOCK(vt_event_lock);
75static DECLARE_WAIT_QUEUE_HEAD(vt_event_waitqueue);
76
77/**
78 *	vt_event_post
79 *	@event: the event that occurred
80 *	@old: old console
81 *	@new: new console
82 *
83 *	Post an VT event to interested VT handlers
84 */
85
86void vt_event_post(unsigned int event, unsigned int old, unsigned int new)
87{
88	struct list_head *pos, *head;
89	unsigned long flags;
90	int wake = 0;
91
92	spin_lock_irqsave(&vt_event_lock, flags);
93	head = &vt_events;
94
95	list_for_each(pos, head) {
96		struct vt_event_wait *ve = list_entry(pos,
97						struct vt_event_wait, list);
98		if (!(ve->event.event & event))
99			continue;
100		ve->event.event = event;
101		/* kernel view is consoles 0..n-1, user space view is
102		   console 1..n with 0 meaning current, so we must bias */
103		ve->event.oldev = old + 1;
104		ve->event.newev = new + 1;
105		wake = 1;
106		ve->done = 1;
107	}
108	spin_unlock_irqrestore(&vt_event_lock, flags);
109	if (wake)
110		wake_up_interruptible(&vt_event_waitqueue);
111}
112
113/**
114 *	vt_event_wait		-	wait for an event
115 *	@vw: our event
116 *
117 *	Waits for an event to occur which completes our vt_event_wait
118 *	structure. On return the structure has wv->done set to 1 for success
119 *	or 0 if some event such as a signal ended the wait.
120 */
121
122static void vt_event_wait(struct vt_event_wait *vw)
123{
124	unsigned long flags;
125	/* Prepare the event */
126	INIT_LIST_HEAD(&vw->list);
127	vw->done = 0;
128	/* Queue our event */
129	spin_lock_irqsave(&vt_event_lock, flags);
130	list_add(&vw->list, &vt_events);
131	spin_unlock_irqrestore(&vt_event_lock, flags);
132	/* Wait for it to pass */
133	wait_event_interruptible_tty(vt_event_waitqueue, vw->done);
134	/* Dequeue it */
135	spin_lock_irqsave(&vt_event_lock, flags);
136	list_del(&vw->list);
137	spin_unlock_irqrestore(&vt_event_lock, flags);
138}
139
140/**
141 *	vt_event_wait_ioctl	-	event ioctl handler
142 *	@arg: argument to ioctl
143 *
144 *	Implement the VT_WAITEVENT ioctl using the VT event interface
145 */
146
147static int vt_event_wait_ioctl(struct vt_event __user *event)
148{
149	struct vt_event_wait vw;
150
151	if (copy_from_user(&vw.event, event, sizeof(struct vt_event)))
152		return -EFAULT;
153	/* Highest supported event for now */
154	if (vw.event.event & ~VT_MAX_EVENT)
155		return -EINVAL;
156
157	vt_event_wait(&vw);
158	/* If it occurred report it */
159	if (vw.done) {
160		if (copy_to_user(event, &vw.event, sizeof(struct vt_event)))
161			return -EFAULT;
162		return 0;
163	}
164	return -EINTR;
165}
166
167/**
168 *	vt_waitactive	-	active console wait
169 *	@event: event code
170 *	@n: new console
171 *
172 *	Helper for event waits. Used to implement the legacy
173 *	event waiting ioctls in terms of events
174 */
175
176int vt_waitactive(int n)
177{
178	struct vt_event_wait vw;
179	do {
180		if (n == fg_console + 1)
181			break;
182		vw.event.event = VT_EVENT_SWITCH;
183		vt_event_wait(&vw);
184		if (vw.done == 0)
185			return -EINTR;
186	} while (vw.event.newev != n);
187	return 0;
188}
189
190/*
191 * these are the valid i/o ports we're allowed to change. they map all the
192 * video ports
193 */
194#define GPFIRST 0x3b4
195#define GPLAST 0x3df
196#define GPNUM (GPLAST - GPFIRST + 1)
197
198#define i (tmp.kb_index)
199#define s (tmp.kb_table)
200#define v (tmp.kb_value)
201static inline int
202do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_struct *kbd)
203{
204	struct kbentry tmp;
205	ushort *key_map, val, ov;
206
207	if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
208		return -EFAULT;
209
210	if (!capable(CAP_SYS_TTY_CONFIG))
211		perm = 0;
212
213	switch (cmd) {
214	case KDGKBENT:
215		key_map = key_maps[s];
216		if (key_map) {
217		    val = U(key_map[i]);
218		    if (kbd->kbdmode != VC_UNICODE && KTYP(val) >= NR_TYPES)
219			val = K_HOLE;
220		} else
221		    val = (i ? K_HOLE : K_NOSUCHMAP);
222		return put_user(val, &user_kbe->kb_value);
223	case KDSKBENT:
224		if (!perm)
225			return -EPERM;
226		if (!i && v == K_NOSUCHMAP) {
227			/* deallocate map */
228			key_map = key_maps[s];
229			if (s && key_map) {
230			    key_maps[s] = NULL;
231			    if (key_map[0] == U(K_ALLOCATED)) {
232					kfree(key_map);
233					keymap_count--;
234			    }
235			}
236			break;
237		}
238
239		if (KTYP(v) < NR_TYPES) {
240		    if (KVAL(v) > max_vals[KTYP(v)])
241				return -EINVAL;
242		} else
243		    if (kbd->kbdmode != VC_UNICODE)
244				return -EINVAL;
245
246		/* ++Geert: non-PC keyboards may generate keycode zero */
247#if !defined(__mc68000__) && !defined(__powerpc__)
248		/* assignment to entry 0 only tests validity of args */
249		if (!i)
250			break;
251#endif
252
253		if (!(key_map = key_maps[s])) {
254			int j;
255
256			if (keymap_count >= MAX_NR_OF_USER_KEYMAPS &&
257			    !capable(CAP_SYS_RESOURCE))
258				return -EPERM;
259
260			key_map = kmalloc(sizeof(plain_map),
261						     GFP_KERNEL);
262			if (!key_map)
263				return -ENOMEM;
264			key_maps[s] = key_map;
265			key_map[0] = U(K_ALLOCATED);
266			for (j = 1; j < NR_KEYS; j++)
267				key_map[j] = U(K_HOLE);
268			keymap_count++;
269		}
270		ov = U(key_map[i]);
271		if (v == ov)
272			break;	/* nothing to do */
273		/*
274		 * Attention Key.
275		 */
276		if (((ov == K_SAK) || (v == K_SAK)) && !capable(CAP_SYS_ADMIN))
277			return -EPERM;
278		key_map[i] = U(v);
279		if (!s && (KTYP(ov) == KT_SHIFT || KTYP(v) == KT_SHIFT))
280			compute_shiftstate();
281		break;
282	}
283	return 0;
284}
285#undef i
286#undef s
287#undef v
288
289static inline int
290do_kbkeycode_ioctl(int cmd, struct kbkeycode __user *user_kbkc, int perm)
291{
292	struct kbkeycode tmp;
293	int kc = 0;
294
295	if (copy_from_user(&tmp, user_kbkc, sizeof(struct kbkeycode)))
296		return -EFAULT;
297	switch (cmd) {
298	case KDGETKEYCODE:
299		kc = getkeycode(tmp.scancode);
300		if (kc >= 0)
301			kc = put_user(kc, &user_kbkc->keycode);
302		break;
303	case KDSETKEYCODE:
304		if (!perm)
305			return -EPERM;
306		kc = setkeycode(tmp.scancode, tmp.keycode);
307		break;
308	}
309	return kc;
310}
311
312static inline int
313do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
314{
315	struct kbsentry *kbs;
316	char *p;
317	u_char *q;
318	u_char __user *up;
319	int sz;
320	int delta;
321	char *first_free, *fj, *fnw;
322	int i, j, k;
323	int ret;
324
325	if (!capable(CAP_SYS_TTY_CONFIG))
326		perm = 0;
327
328	kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
329	if (!kbs) {
330		ret = -ENOMEM;
331		goto reterr;
332	}
333
334	/* we mostly copy too much here (512bytes), but who cares ;) */
335	if (copy_from_user(kbs, user_kdgkb, sizeof(struct kbsentry))) {
336		ret = -EFAULT;
337		goto reterr;
338	}
339	kbs->kb_string[sizeof(kbs->kb_string)-1] = '\0';
340	i = kbs->kb_func;
341
342	switch (cmd) {
343	case KDGKBSENT:
344		sz = sizeof(kbs->kb_string) - 1; /* sz should have been
345						  a struct member */
346		up = user_kdgkb->kb_string;
347		p = func_table[i];
348		if(p)
349			for ( ; *p && sz; p++, sz--)
350				if (put_user(*p, up++)) {
351					ret = -EFAULT;
352					goto reterr;
353				}
354		if (put_user('\0', up)) {
355			ret = -EFAULT;
356			goto reterr;
357		}
358		kfree(kbs);
359		return ((p && *p) ? -EOVERFLOW : 0);
360	case KDSKBSENT:
361		if (!perm) {
362			ret = -EPERM;
363			goto reterr;
364		}
365
366		q = func_table[i];
367		first_free = funcbufptr + (funcbufsize - funcbufleft);
368		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++)
369			;
370		if (j < MAX_NR_FUNC)
371			fj = func_table[j];
372		else
373			fj = first_free;
374
375		delta = (q ? -strlen(q) : 1) + strlen(kbs->kb_string);
376		if (delta <= funcbufleft) { 	/* it fits in current buf */
377		    if (j < MAX_NR_FUNC) {
378			memmove(fj + delta, fj, first_free - fj);
379			for (k = j; k < MAX_NR_FUNC; k++)
380			    if (func_table[k])
381				func_table[k] += delta;
382		    }
383		    if (!q)
384		      func_table[i] = fj;
385		    funcbufleft -= delta;
386		} else {			/* allocate a larger buffer */
387		    sz = 256;
388		    while (sz < funcbufsize - funcbufleft + delta)
389		      sz <<= 1;
390		    fnw = kmalloc(sz, GFP_KERNEL);
391		    if(!fnw) {
392		      ret = -ENOMEM;
393		      goto reterr;
394		    }
395
396		    if (!q)
397		      func_table[i] = fj;
398		    if (fj > funcbufptr)
399			memmove(fnw, funcbufptr, fj - funcbufptr);
400		    for (k = 0; k < j; k++)
401		      if (func_table[k])
402			func_table[k] = fnw + (func_table[k] - funcbufptr);
403
404		    if (first_free > fj) {
405			memmove(fnw + (fj - funcbufptr) + delta, fj, first_free - fj);
406			for (k = j; k < MAX_NR_FUNC; k++)
407			  if (func_table[k])
408			    func_table[k] = fnw + (func_table[k] - funcbufptr) + delta;
409		    }
410		    if (funcbufptr != func_buf)
411		      kfree(funcbufptr);
412		    funcbufptr = fnw;
413		    funcbufleft = funcbufleft - delta + sz - funcbufsize;
414		    funcbufsize = sz;
415		}
416		strcpy(func_table[i], kbs->kb_string);
417		break;
418	}
419	ret = 0;
420reterr:
421	kfree(kbs);
422	return ret;
423}
424
425static inline int
426do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op)
427{
428	struct consolefontdesc cfdarg;
429	int i;
430
431	if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc)))
432		return -EFAULT;
433
434	switch (cmd) {
435	case PIO_FONTX:
436		if (!perm)
437			return -EPERM;
438		op->op = KD_FONT_OP_SET;
439		op->flags = KD_FONT_FLAG_OLD;
440		op->width = 8;
441		op->height = cfdarg.charheight;
442		op->charcount = cfdarg.charcount;
443		op->data = cfdarg.chardata;
444		return con_font_op(vc_cons[fg_console].d, op);
445	case GIO_FONTX: {
446		op->op = KD_FONT_OP_GET;
447		op->flags = KD_FONT_FLAG_OLD;
448		op->width = 8;
449		op->height = cfdarg.charheight;
450		op->charcount = cfdarg.charcount;
451		op->data = cfdarg.chardata;
452		i = con_font_op(vc_cons[fg_console].d, op);
453		if (i)
454			return i;
455		cfdarg.charheight = op->height;
456		cfdarg.charcount = op->charcount;
457		if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc)))
458			return -EFAULT;
459		return 0;
460		}
461	}
462	return -EINVAL;
463}
464
465static inline int
466do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc)
467{
468	struct unimapdesc tmp;
469
470	if (copy_from_user(&tmp, user_ud, sizeof tmp))
471		return -EFAULT;
472	if (tmp.entries)
473		if (!access_ok(VERIFY_WRITE, tmp.entries,
474				tmp.entry_ct*sizeof(struct unipair)))
475			return -EFAULT;
476	switch (cmd) {
477	case PIO_UNIMAP:
478		if (!perm)
479			return -EPERM;
480		return con_set_unimap(vc, tmp.entry_ct, tmp.entries);
481	case GIO_UNIMAP:
482		if (!perm && fg_console != vc->vc_num)
483			return -EPERM;
484		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp.entries);
485	}
486	return 0;
487}
488
489
490
491/*
492 * We handle the console-specific ioctl's here.  We allow the
493 * capability to modify any console, not just the fg_console.
494 */
495int vt_ioctl(struct tty_struct *tty,
496	     unsigned int cmd, unsigned long arg)
497{
498	struct vc_data *vc = tty->driver_data;
499	struct console_font_op op;	/* used in multiple places here */
500	struct kbd_struct * kbd;
501	unsigned int console;
502	unsigned char ucval;
503	unsigned int uival;
504	void __user *up = (void __user *)arg;
505	int i, perm;
506	int ret = 0;
507
508	console = vc->vc_num;
509
510	tty_lock();
511
512	if (!vc_cons_allocated(console)) { 	/* impossible? */
513		ret = -ENOIOCTLCMD;
514		goto out;
515	}
516
517
518	/*
519	 * To have permissions to do most of the vt ioctls, we either have
520	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
521	 */
522	perm = 0;
523	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
524		perm = 1;
525
526	kbd = kbd_table + console;
527	switch (cmd) {
528	case TIOCLINUX:
529		ret = tioclinux(tty, arg);
530		break;
531	case KIOCSOUND:
532		if (!perm)
533			goto eperm;
534		/*
535		 * The use of PIT_TICK_RATE is historic, it used to be
536		 * the platform-dependent CLOCK_TICK_RATE between 2.6.12
537		 * and 2.6.36, which was a minor but unfortunate ABI
538		 * change.
539		 */
540		if (arg)
541			arg = PIT_TICK_RATE / arg;
542		kd_mksound(arg, 0);
543		break;
544
545	case KDMKTONE:
546		if (!perm)
547			goto eperm;
548	{
549		unsigned int ticks, count;
550
551		/*
552		 * Generate the tone for the appropriate number of ticks.
553		 * If the time is zero, turn off sound ourselves.
554		 */
555		ticks = HZ * ((arg >> 16) & 0xffff) / 1000;
556		count = ticks ? (arg & 0xffff) : 0;
557		if (count)
558			count = PIT_TICK_RATE / count;
559		kd_mksound(count, ticks);
560		break;
561	}
562
563	case KDGKBTYPE:
564		/*
565		 * this is naive.
566		 */
567		ucval = KB_101;
568		goto setchar;
569
570		/*
571		 * These cannot be implemented on any machine that implements
572		 * ioperm() in user level (such as Alpha PCs) or not at all.
573		 *
574		 * XXX: you should never use these, just call ioperm directly..
575		 */
576#ifdef CONFIG_X86
577	case KDADDIO:
578	case KDDELIO:
579		/*
580		 * KDADDIO and KDDELIO may be able to add ports beyond what
581		 * we reject here, but to be safe...
582		 */
583		if (arg < GPFIRST || arg > GPLAST) {
584			ret = -EINVAL;
585			break;
586		}
587		ret = sys_ioperm(arg, 1, (cmd == KDADDIO)) ? -ENXIO : 0;
588		break;
589
590	case KDENABIO:
591	case KDDISABIO:
592		ret = sys_ioperm(GPFIRST, GPNUM,
593				  (cmd == KDENABIO)) ? -ENXIO : 0;
594		break;
595#endif
596
597	/* Linux m68k/i386 interface for setting the keyboard delay/repeat rate */
598
599	case KDKBDREP:
600	{
601		struct kbd_repeat kbrep;
602
603		if (!capable(CAP_SYS_TTY_CONFIG))
604			goto eperm;
605
606		if (copy_from_user(&kbrep, up, sizeof(struct kbd_repeat))) {
607			ret =  -EFAULT;
608			break;
609		}
610		ret = kbd_rate(&kbrep);
611		if (ret)
612			break;
613		if (copy_to_user(up, &kbrep, sizeof(struct kbd_repeat)))
614			ret = -EFAULT;
615		break;
616	}
617
618	case KDSETMODE:
619		/*
620		 * currently, setting the mode from KD_TEXT to KD_GRAPHICS
621		 * doesn't do a whole lot. i'm not sure if it should do any
622		 * restoration of modes or what...
623		 *
624		 * XXX It should at least call into the driver, fbdev's definitely
625		 * need to restore their engine state. --BenH
626		 */
627		if (!perm)
628			goto eperm;
629		switch (arg) {
630		case KD_GRAPHICS:
631			break;
632		case KD_TEXT0:
633		case KD_TEXT1:
634			arg = KD_TEXT;
635		case KD_TEXT:
636			break;
637		default:
638			ret = -EINVAL;
639			goto out;
640		}
641		if (vc->vc_mode == (unsigned char) arg)
642			break;
643		vc->vc_mode = (unsigned char) arg;
644		if (console != fg_console)
645			break;
646		/*
647		 * explicitly blank/unblank the screen if switching modes
648		 */
649		console_lock();
650		if (arg == KD_TEXT)
651			do_unblank_screen(1);
652		else
653			do_blank_screen(1);
654		console_unlock();
655		break;
656
657	case KDGETMODE:
658		uival = vc->vc_mode;
659		goto setint;
660
661	case KDMAPDISP:
662	case KDUNMAPDISP:
663		/*
664		 * these work like a combination of mmap and KDENABIO.
665		 * this could be easily finished.
666		 */
667		ret = -EINVAL;
668		break;
669
670	case KDSKBMODE:
671		if (!perm)
672			goto eperm;
673		switch(arg) {
674		  case K_RAW:
675			kbd->kbdmode = VC_RAW;
676			break;
677		  case K_MEDIUMRAW:
678			kbd->kbdmode = VC_MEDIUMRAW;
679			break;
680		  case K_XLATE:
681			kbd->kbdmode = VC_XLATE;
682			compute_shiftstate();
683			break;
684		  case K_UNICODE:
685			kbd->kbdmode = VC_UNICODE;
686			compute_shiftstate();
687			break;
688		  case K_OFF:
689			kbd->kbdmode = VC_OFF;
690			break;
691		  default:
692			ret = -EINVAL;
693			goto out;
694		}
695		tty_ldisc_flush(tty);
696		break;
697
698	case KDGKBMODE:
699		switch (kbd->kbdmode) {
700		case VC_RAW:
701			uival = K_RAW;
702			break;
703		case VC_MEDIUMRAW:
704			uival = K_MEDIUMRAW;
705			break;
706		case VC_UNICODE:
707			uival = K_UNICODE;
708			break;
709		case VC_OFF:
710			uival = K_OFF;
711			break;
712		default:
713			uival = K_XLATE;
714			break;
715		}
716		goto setint;
717
718	/* this could be folded into KDSKBMODE, but for compatibility
719	   reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */
720	case KDSKBMETA:
721		switch(arg) {
722		  case K_METABIT:
723			clr_vc_kbd_mode(kbd, VC_META);
724			break;
725		  case K_ESCPREFIX:
726			set_vc_kbd_mode(kbd, VC_META);
727			break;
728		  default:
729			ret = -EINVAL;
730		}
731		break;
732
733	case KDGKBMETA:
734		uival = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
735	setint:
736		ret = put_user(uival, (int __user *)arg);
737		break;
738
739	case KDGETKEYCODE:
740	case KDSETKEYCODE:
741		if(!capable(CAP_SYS_TTY_CONFIG))
742			perm = 0;
743		ret = do_kbkeycode_ioctl(cmd, up, perm);
744		break;
745
746	case KDGKBENT:
747	case KDSKBENT:
748		ret = do_kdsk_ioctl(cmd, up, perm, kbd);
749		break;
750
751	case KDGKBSENT:
752	case KDSKBSENT:
753		ret = do_kdgkb_ioctl(cmd, up, perm);
754		break;
755
756	/* Diacritical processing. Handled in keyboard.c as it has
757	   to operate on the keyboard locks and structures */
758	case KDGKBDIACR:
759	case KDGKBDIACRUC:
760	case KDSKBDIACR:
761	case KDSKBDIACRUC:
762		ret = vt_do_diacrit(cmd, up, perm);
763		break;
764
765	/* the ioctls below read/set the flags usually shown in the leds */
766	/* don't use them - they will go away without warning */
767	case KDGKBLED:
768		ucval = kbd->ledflagstate | (kbd->default_ledflagstate << 4);
769		goto setchar;
770
771	case KDSKBLED:
772		if (!perm)
773			goto eperm;
774		if (arg & ~0x77) {
775			ret = -EINVAL;
776			break;
777		}
778		kbd->ledflagstate = (arg & 7);
779		kbd->default_ledflagstate = ((arg >> 4) & 7);
780		set_leds();
781		break;
782
783	/* the ioctls below only set the lights, not the functions */
784	/* for those, see KDGKBLED and KDSKBLED above */
785	case KDGETLED:
786		ucval = getledstate();
787	setchar:
788		ret = put_user(ucval, (char __user *)arg);
789		break;
790
791	case KDSETLED:
792		if (!perm)
793			goto eperm;
794		setledstate(kbd, arg);
795		break;
796
797	/*
798	 * A process can indicate its willingness to accept signals
799	 * generated by pressing an appropriate key combination.
800	 * Thus, one can have a daemon that e.g. spawns a new console
801	 * upon a keypress and then changes to it.
802	 * See also the kbrequest field of inittab(5).
803	 */
804	case KDSIGACCEPT:
805	{
806		if (!perm || !capable(CAP_KILL))
807			goto eperm;
808		if (!valid_signal(arg) || arg < 1 || arg == SIGKILL)
809			ret = -EINVAL;
810		else {
811			spin_lock_irq(&vt_spawn_con.lock);
812			put_pid(vt_spawn_con.pid);
813			vt_spawn_con.pid = get_pid(task_pid(current));
814			vt_spawn_con.sig = arg;
815			spin_unlock_irq(&vt_spawn_con.lock);
816		}
817		break;
818	}
819
820	case VT_SETMODE:
821	{
822		struct vt_mode tmp;
823
824		if (!perm)
825			goto eperm;
826		if (copy_from_user(&tmp, up, sizeof(struct vt_mode))) {
827			ret = -EFAULT;
828			goto out;
829		}
830		if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS) {
831			ret = -EINVAL;
832			goto out;
833		}
834		console_lock();
835		vc->vt_mode = tmp;
836		/* the frsig is ignored, so we set it to 0 */
837		vc->vt_mode.frsig = 0;
838		put_pid(vc->vt_pid);
839		vc->vt_pid = get_pid(task_pid(current));
840		/* no switch is required -- saw@shade.msu.ru */
841		vc->vt_newvt = -1;
842		console_unlock();
843		break;
844	}
845
846	case VT_GETMODE:
847	{
848		struct vt_mode tmp;
849		int rc;
850
851		console_lock();
852		memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode));
853		console_unlock();
854
855		rc = copy_to_user(up, &tmp, sizeof(struct vt_mode));
856		if (rc)
857			ret = -EFAULT;
858		break;
859	}
860
861	/*
862	 * Returns global vt state. Note that VT 0 is always open, since
863	 * it's an alias for the current VT, and people can't use it here.
864	 * We cannot return state for more than 16 VTs, since v_state is short.
865	 */
866	case VT_GETSTATE:
867	{
868		struct vt_stat __user *vtstat = up;
869		unsigned short state, mask;
870
871		if (put_user(fg_console + 1, &vtstat->v_active))
872			ret = -EFAULT;
873		else {
874			state = 1;	/* /dev/tty0 is always open */
875			for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask;
876							++i, mask <<= 1)
877				if (VT_IS_IN_USE(i))
878					state |= mask;
879			ret = put_user(state, &vtstat->v_state);
880		}
881		break;
882	}
883
884	/*
885	 * Returns the first available (non-opened) console.
886	 */
887	case VT_OPENQRY:
888		for (i = 0; i < MAX_NR_CONSOLES; ++i)
889			if (! VT_IS_IN_USE(i))
890				break;
891		uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
892		goto setint;
893
894	/*
895	 * ioctl(fd, VT_ACTIVATE, num) will cause us to switch to vt # num,
896	 * with num >= 1 (switches to vt 0, our console, are not allowed, just
897	 * to preserve sanity).
898	 */
899	case VT_ACTIVATE:
900		if (!perm)
901			goto eperm;
902		if (arg == 0 || arg > MAX_NR_CONSOLES)
903			ret =  -ENXIO;
904		else {
905			arg--;
906			console_lock();
907			ret = vc_allocate(arg);
908			console_unlock();
909			if (ret)
910				break;
911			set_console(arg);
912		}
913		break;
914
915	case VT_SETACTIVATE:
916	{
917		struct vt_setactivate vsa;
918
919		if (!perm)
920			goto eperm;
921
922		if (copy_from_user(&vsa, (struct vt_setactivate __user *)arg,
923					sizeof(struct vt_setactivate))) {
924			ret = -EFAULT;
925			goto out;
926		}
927		if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
928			ret = -ENXIO;
929		else {
930			vsa.console--;
931			console_lock();
932			ret = vc_allocate(vsa.console);
933			if (ret == 0) {
934				struct vc_data *nvc;
935				/* This is safe providing we don't drop the
936				   console sem between vc_allocate and
937				   finishing referencing nvc */
938				nvc = vc_cons[vsa.console].d;
939				nvc->vt_mode = vsa.mode;
940				nvc->vt_mode.frsig = 0;
941				put_pid(nvc->vt_pid);
942				nvc->vt_pid = get_pid(task_pid(current));
943			}
944			console_unlock();
945			if (ret)
946				break;
947			/* Commence switch and lock */
948			set_console(vsa.console);
949		}
950		break;
951	}
952
953	/*
954	 * wait until the specified VT has been activated
955	 */
956	case VT_WAITACTIVE:
957		if (!perm)
958			goto eperm;
959		if (arg == 0 || arg > MAX_NR_CONSOLES)
960			ret = -ENXIO;
961		else
962			ret = vt_waitactive(arg);
963		break;
964
965	/*
966	 * If a vt is under process control, the kernel will not switch to it
967	 * immediately, but postpone the operation until the process calls this
968	 * ioctl, allowing the switch to complete.
969	 *
970	 * According to the X sources this is the behavior:
971	 *	0:	pending switch-from not OK
972	 *	1:	pending switch-from OK
973	 *	2:	completed switch-to OK
974	 */
975	case VT_RELDISP:
976		if (!perm)
977			goto eperm;
978
979		if (vc->vt_mode.mode != VT_PROCESS) {
980			ret = -EINVAL;
981			break;
982		}
983		/*
984		 * Switching-from response
985		 */
986		console_lock();
987		if (vc->vt_newvt >= 0) {
988			if (arg == 0)
989				/*
990				 * Switch disallowed, so forget we were trying
991				 * to do it.
992				 */
993				vc->vt_newvt = -1;
994
995			else {
996				/*
997				 * The current vt has been released, so
998				 * complete the switch.
999				 */
1000				int newvt;
1001				newvt = vc->vt_newvt;
1002				vc->vt_newvt = -1;
1003				ret = vc_allocate(newvt);
1004				if (ret) {
1005					console_unlock();
1006					break;
1007				}
1008				/*
1009				 * When we actually do the console switch,
1010				 * make sure we are atomic with respect to
1011				 * other console switches..
1012				 */
1013				complete_change_console(vc_cons[newvt].d);
1014			}
1015		} else {
1016			/*
1017			 * Switched-to response
1018			 */
1019			/*
1020			 * If it's just an ACK, ignore it
1021			 */
1022			if (arg != VT_ACKACQ)
1023				ret = -EINVAL;
1024		}
1025		console_unlock();
1026		break;
1027
1028	 /*
1029	  * Disallocate memory associated to VT (but leave VT1)
1030	  */
1031	 case VT_DISALLOCATE:
1032		if (arg > MAX_NR_CONSOLES) {
1033			ret = -ENXIO;
1034			break;
1035		}
1036		if (arg == 0) {
1037		    /* deallocate all unused consoles, but leave 0 */
1038			console_lock();
1039			for (i=1; i<MAX_NR_CONSOLES; i++)
1040				if (! VT_BUSY(i))
1041					vc_deallocate(i);
1042			console_unlock();
1043		} else {
1044			/* deallocate a single console, if possible */
1045			arg--;
1046			if (VT_BUSY(arg))
1047				ret = -EBUSY;
1048			else if (arg) {			      /* leave 0 */
1049				console_lock();
1050				vc_deallocate(arg);
1051				console_unlock();
1052			}
1053		}
1054		break;
1055
1056	case VT_RESIZE:
1057	{
1058		struct vt_sizes __user *vtsizes = up;
1059		struct vc_data *vc;
1060
1061		ushort ll,cc;
1062		if (!perm)
1063			goto eperm;
1064		if (get_user(ll, &vtsizes->v_rows) ||
1065		    get_user(cc, &vtsizes->v_cols))
1066			ret = -EFAULT;
1067		else {
1068			console_lock();
1069			for (i = 0; i < MAX_NR_CONSOLES; i++) {
1070				vc = vc_cons[i].d;
1071
1072				if (vc) {
1073					vc->vc_resize_user = 1;
1074					vc_resize(vc_cons[i].d, cc, ll);
1075				}
1076			}
1077			console_unlock();
1078		}
1079		break;
1080	}
1081
1082	case VT_RESIZEX:
1083	{
1084		struct vt_consize __user *vtconsize = up;
1085		ushort ll,cc,vlin,clin,vcol,ccol;
1086		if (!perm)
1087			goto eperm;
1088		if (!access_ok(VERIFY_READ, vtconsize,
1089				sizeof(struct vt_consize))) {
1090			ret = -EFAULT;
1091			break;
1092		}
1093		/* FIXME: Should check the copies properly */
1094		__get_user(ll, &vtconsize->v_rows);
1095		__get_user(cc, &vtconsize->v_cols);
1096		__get_user(vlin, &vtconsize->v_vlin);
1097		__get_user(clin, &vtconsize->v_clin);
1098		__get_user(vcol, &vtconsize->v_vcol);
1099		__get_user(ccol, &vtconsize->v_ccol);
1100		vlin = vlin ? vlin : vc->vc_scan_lines;
1101		if (clin) {
1102			if (ll) {
1103				if (ll != vlin/clin) {
1104					/* Parameters don't add up */
1105					ret = -EINVAL;
1106					break;
1107				}
1108			} else
1109				ll = vlin/clin;
1110		}
1111		if (vcol && ccol) {
1112			if (cc) {
1113				if (cc != vcol/ccol) {
1114					ret = -EINVAL;
1115					break;
1116				}
1117			} else
1118				cc = vcol/ccol;
1119		}
1120
1121		if (clin > 32) {
1122			ret =  -EINVAL;
1123			break;
1124		}
1125
1126		for (i = 0; i < MAX_NR_CONSOLES; i++) {
1127			if (!vc_cons[i].d)
1128				continue;
1129			console_lock();
1130			if (vlin)
1131				vc_cons[i].d->vc_scan_lines = vlin;
1132			if (clin)
1133				vc_cons[i].d->vc_font.height = clin;
1134			vc_cons[i].d->vc_resize_user = 1;
1135			vc_resize(vc_cons[i].d, cc, ll);
1136			console_unlock();
1137		}
1138		break;
1139	}
1140
1141	case PIO_FONT: {
1142		if (!perm)
1143			goto eperm;
1144		op.op = KD_FONT_OP_SET;
1145		op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC;	/* Compatibility */
1146		op.width = 8;
1147		op.height = 0;
1148		op.charcount = 256;
1149		op.data = up;
1150		ret = con_font_op(vc_cons[fg_console].d, &op);
1151		break;
1152	}
1153
1154	case GIO_FONT: {
1155		op.op = KD_FONT_OP_GET;
1156		op.flags = KD_FONT_FLAG_OLD;
1157		op.width = 8;
1158		op.height = 32;
1159		op.charcount = 256;
1160		op.data = up;
1161		ret = con_font_op(vc_cons[fg_console].d, &op);
1162		break;
1163	}
1164
1165	case PIO_CMAP:
1166                if (!perm)
1167			ret = -EPERM;
1168		else
1169	                ret = con_set_cmap(up);
1170		break;
1171
1172	case GIO_CMAP:
1173                ret = con_get_cmap(up);
1174		break;
1175
1176	case PIO_FONTX:
1177	case GIO_FONTX:
1178		ret = do_fontx_ioctl(cmd, up, perm, &op);
1179		break;
1180
1181	case PIO_FONTRESET:
1182	{
1183		if (!perm)
1184			goto eperm;
1185
1186#ifdef BROKEN_GRAPHICS_PROGRAMS
1187		/* With BROKEN_GRAPHICS_PROGRAMS defined, the default
1188		   font is not saved. */
1189		ret = -ENOSYS;
1190		break;
1191#else
1192		{
1193		op.op = KD_FONT_OP_SET_DEFAULT;
1194		op.data = NULL;
1195		ret = con_font_op(vc_cons[fg_console].d, &op);
1196		if (ret)
1197			break;
1198		con_set_default_unimap(vc_cons[fg_console].d);
1199		break;
1200		}
1201#endif
1202	}
1203
1204	case KDFONTOP: {
1205		if (copy_from_user(&op, up, sizeof(op))) {
1206			ret = -EFAULT;
1207			break;
1208		}
1209		if (!perm && op.op != KD_FONT_OP_GET)
1210			goto eperm;
1211		ret = con_font_op(vc, &op);
1212		if (ret)
1213			break;
1214		if (copy_to_user(up, &op, sizeof(op)))
1215			ret = -EFAULT;
1216		break;
1217	}
1218
1219	case PIO_SCRNMAP:
1220		if (!perm)
1221			ret = -EPERM;
1222		else
1223			ret = con_set_trans_old(up);
1224		break;
1225
1226	case GIO_SCRNMAP:
1227		ret = con_get_trans_old(up);
1228		break;
1229
1230	case PIO_UNISCRNMAP:
1231		if (!perm)
1232			ret = -EPERM;
1233		else
1234			ret = con_set_trans_new(up);
1235		break;
1236
1237	case GIO_UNISCRNMAP:
1238		ret = con_get_trans_new(up);
1239		break;
1240
1241	case PIO_UNIMAPCLR:
1242	      { struct unimapinit ui;
1243		if (!perm)
1244			goto eperm;
1245		ret = copy_from_user(&ui, up, sizeof(struct unimapinit));
1246		if (ret)
1247			ret = -EFAULT;
1248		else
1249			con_clear_unimap(vc, &ui);
1250		break;
1251	      }
1252
1253	case PIO_UNIMAP:
1254	case GIO_UNIMAP:
1255		ret = do_unimap_ioctl(cmd, up, perm, vc);
1256		break;
1257
1258	case VT_LOCKSWITCH:
1259		if (!capable(CAP_SYS_TTY_CONFIG))
1260			goto eperm;
1261		vt_dont_switch = 1;
1262		break;
1263	case VT_UNLOCKSWITCH:
1264		if (!capable(CAP_SYS_TTY_CONFIG))
1265			goto eperm;
1266		vt_dont_switch = 0;
1267		break;
1268	case VT_GETHIFONTMASK:
1269		ret = put_user(vc->vc_hi_font_mask,
1270					(unsigned short __user *)arg);
1271		break;
1272	case VT_WAITEVENT:
1273		ret = vt_event_wait_ioctl((struct vt_event __user *)arg);
1274		break;
1275	default:
1276		ret = -ENOIOCTLCMD;
1277	}
1278out:
1279	tty_unlock();
1280	return ret;
1281eperm:
1282	ret = -EPERM;
1283	goto out;
1284}
1285
1286void reset_vc(struct vc_data *vc)
1287{
1288	vc->vc_mode = KD_TEXT;
1289	kbd_table[vc->vc_num].kbdmode = default_utf8 ? VC_UNICODE : VC_XLATE;
1290	vc->vt_mode.mode = VT_AUTO;
1291	vc->vt_mode.waitv = 0;
1292	vc->vt_mode.relsig = 0;
1293	vc->vt_mode.acqsig = 0;
1294	vc->vt_mode.frsig = 0;
1295	put_pid(vc->vt_pid);
1296	vc->vt_pid = NULL;
1297	vc->vt_newvt = -1;
1298	if (!in_interrupt())    /* Via keyboard.c:SAK() - akpm */
1299		reset_palette(vc);
1300}
1301
1302void vc_SAK(struct work_struct *work)
1303{
1304	struct vc *vc_con =
1305		container_of(work, struct vc, SAK_work);
1306	struct vc_data *vc;
1307	struct tty_struct *tty;
1308
1309	console_lock();
1310	vc = vc_con->d;
1311	if (vc) {
1312		tty = vc->port.tty;
1313		/*
1314		 * SAK should also work in all raw modes and reset
1315		 * them properly.
1316		 */
1317		if (tty)
1318			__do_SAK(tty);
1319		reset_vc(vc);
1320	}
1321	console_unlock();
1322}
1323
1324#ifdef CONFIG_COMPAT
1325
1326struct compat_consolefontdesc {
1327	unsigned short charcount;       /* characters in font (256 or 512) */
1328	unsigned short charheight;      /* scan lines per character (1-32) */
1329	compat_caddr_t chardata;	/* font data in expanded form */
1330};
1331
1332static inline int
1333compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
1334			 int perm, struct console_font_op *op)
1335{
1336	struct compat_consolefontdesc cfdarg;
1337	int i;
1338
1339	if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc)))
1340		return -EFAULT;
1341
1342	switch (cmd) {
1343	case PIO_FONTX:
1344		if (!perm)
1345			return -EPERM;
1346		op->op = KD_FONT_OP_SET;
1347		op->flags = KD_FONT_FLAG_OLD;
1348		op->width = 8;
1349		op->height = cfdarg.charheight;
1350		op->charcount = cfdarg.charcount;
1351		op->data = compat_ptr(cfdarg.chardata);
1352		return con_font_op(vc_cons[fg_console].d, op);
1353	case GIO_FONTX:
1354		op->op = KD_FONT_OP_GET;
1355		op->flags = KD_FONT_FLAG_OLD;
1356		op->width = 8;
1357		op->height = cfdarg.charheight;
1358		op->charcount = cfdarg.charcount;
1359		op->data = compat_ptr(cfdarg.chardata);
1360		i = con_font_op(vc_cons[fg_console].d, op);
1361		if (i)
1362			return i;
1363		cfdarg.charheight = op->height;
1364		cfdarg.charcount = op->charcount;
1365		if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc)))
1366			return -EFAULT;
1367		return 0;
1368	}
1369	return -EINVAL;
1370}
1371
1372struct compat_console_font_op {
1373	compat_uint_t op;        /* operation code KD_FONT_OP_* */
1374	compat_uint_t flags;     /* KD_FONT_FLAG_* */
1375	compat_uint_t width, height;     /* font size */
1376	compat_uint_t charcount;
1377	compat_caddr_t data;    /* font data with height fixed to 32 */
1378};
1379
1380static inline int
1381compat_kdfontop_ioctl(struct compat_console_font_op __user *fontop,
1382			 int perm, struct console_font_op *op, struct vc_data *vc)
1383{
1384	int i;
1385
1386	if (copy_from_user(op, fontop, sizeof(struct compat_console_font_op)))
1387		return -EFAULT;
1388	if (!perm && op->op != KD_FONT_OP_GET)
1389		return -EPERM;
1390	op->data = compat_ptr(((struct compat_console_font_op *)op)->data);
1391	i = con_font_op(vc, op);
1392	if (i)
1393		return i;
1394	((struct compat_console_font_op *)op)->data = (unsigned long)op->data;
1395	if (copy_to_user(fontop, op, sizeof(struct compat_console_font_op)))
1396		return -EFAULT;
1397	return 0;
1398}
1399
1400struct compat_unimapdesc {
1401	unsigned short entry_ct;
1402	compat_caddr_t entries;
1403};
1404
1405static inline int
1406compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud,
1407			 int perm, struct vc_data *vc)
1408{
1409	struct compat_unimapdesc tmp;
1410	struct unipair __user *tmp_entries;
1411
1412	if (copy_from_user(&tmp, user_ud, sizeof tmp))
1413		return -EFAULT;
1414	tmp_entries = compat_ptr(tmp.entries);
1415	if (tmp_entries)
1416		if (!access_ok(VERIFY_WRITE, tmp_entries,
1417				tmp.entry_ct*sizeof(struct unipair)))
1418			return -EFAULT;
1419	switch (cmd) {
1420	case PIO_UNIMAP:
1421		if (!perm)
1422			return -EPERM;
1423		return con_set_unimap(vc, tmp.entry_ct, tmp_entries);
1424	case GIO_UNIMAP:
1425		if (!perm && fg_console != vc->vc_num)
1426			return -EPERM;
1427		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp_entries);
1428	}
1429	return 0;
1430}
1431
1432long vt_compat_ioctl(struct tty_struct *tty,
1433	     unsigned int cmd, unsigned long arg)
1434{
1435	struct vc_data *vc = tty->driver_data;
1436	struct console_font_op op;	/* used in multiple places here */
1437	unsigned int console;
1438	void __user *up = (void __user *)arg;
1439	int perm;
1440	int ret = 0;
1441
1442	console = vc->vc_num;
1443
1444	tty_lock();
1445
1446	if (!vc_cons_allocated(console)) { 	/* impossible? */
1447		ret = -ENOIOCTLCMD;
1448		goto out;
1449	}
1450
1451	/*
1452	 * To have permissions to do most of the vt ioctls, we either have
1453	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
1454	 */
1455	perm = 0;
1456	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
1457		perm = 1;
1458
1459	switch (cmd) {
1460	/*
1461	 * these need special handlers for incompatible data structures
1462	 */
1463	case PIO_FONTX:
1464	case GIO_FONTX:
1465		ret = compat_fontx_ioctl(cmd, up, perm, &op);
1466		break;
1467
1468	case KDFONTOP:
1469		ret = compat_kdfontop_ioctl(up, perm, &op, vc);
1470		break;
1471
1472	case PIO_UNIMAP:
1473	case GIO_UNIMAP:
1474		ret = compat_unimap_ioctl(cmd, up, perm, vc);
1475		break;
1476
1477	/*
1478	 * all these treat 'arg' as an integer
1479	 */
1480	case KIOCSOUND:
1481	case KDMKTONE:
1482#ifdef CONFIG_X86
1483	case KDADDIO:
1484	case KDDELIO:
1485#endif
1486	case KDSETMODE:
1487	case KDMAPDISP:
1488	case KDUNMAPDISP:
1489	case KDSKBMODE:
1490	case KDSKBMETA:
1491	case KDSKBLED:
1492	case KDSETLED:
1493	case KDSIGACCEPT:
1494	case VT_ACTIVATE:
1495	case VT_WAITACTIVE:
1496	case VT_RELDISP:
1497	case VT_DISALLOCATE:
1498	case VT_RESIZE:
1499	case VT_RESIZEX:
1500		goto fallback;
1501
1502	/*
1503	 * the rest has a compatible data structure behind arg,
1504	 * but we have to convert it to a proper 64 bit pointer.
1505	 */
1506	default:
1507		arg = (unsigned long)compat_ptr(arg);
1508		goto fallback;
1509	}
1510out:
1511	tty_unlock();
1512	return ret;
1513
1514fallback:
1515	tty_unlock();
1516	return vt_ioctl(tty, cmd, arg);
1517}
1518
1519
1520#endif /* CONFIG_COMPAT */
1521
1522
1523/*
1524 * Performs the back end of a vt switch. Called under the console
1525 * semaphore.
1526 */
1527static void complete_change_console(struct vc_data *vc)
1528{
1529	unsigned char old_vc_mode;
1530	int old = fg_console;
1531
1532	last_console = fg_console;
1533
1534	/*
1535	 * If we're switching, we could be going from KD_GRAPHICS to
1536	 * KD_TEXT mode or vice versa, which means we need to blank or
1537	 * unblank the screen later.
1538	 */
1539	old_vc_mode = vc_cons[fg_console].d->vc_mode;
1540	switch_screen(vc);
1541
1542	/*
1543	 * This can't appear below a successful kill_pid().  If it did,
1544	 * then the *blank_screen operation could occur while X, having
1545	 * received acqsig, is waking up on another processor.  This
1546	 * condition can lead to overlapping accesses to the VGA range
1547	 * and the framebuffer (causing system lockups).
1548	 *
1549	 * To account for this we duplicate this code below only if the
1550	 * controlling process is gone and we've called reset_vc.
1551	 */
1552	if (old_vc_mode != vc->vc_mode) {
1553		if (vc->vc_mode == KD_TEXT)
1554			do_unblank_screen(1);
1555		else
1556			do_blank_screen(1);
1557	}
1558
1559	/*
1560	 * If this new console is under process control, send it a signal
1561	 * telling it that it has acquired. Also check if it has died and
1562	 * clean up (similar to logic employed in change_console())
1563	 */
1564	if (vc->vt_mode.mode == VT_PROCESS) {
1565		/*
1566		 * Send the signal as privileged - kill_pid() will
1567		 * tell us if the process has gone or something else
1568		 * is awry
1569		 */
1570		if (kill_pid(vc->vt_pid, vc->vt_mode.acqsig, 1) != 0) {
1571		/*
1572		 * The controlling process has died, so we revert back to
1573		 * normal operation. In this case, we'll also change back
1574		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1575		 * but it saves the agony when the X server dies and the screen
1576		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1577		 * this outside of VT_PROCESS but there is no single process
1578		 * to account for and tracking tty count may be undesirable.
1579		 */
1580			reset_vc(vc);
1581
1582			if (old_vc_mode != vc->vc_mode) {
1583				if (vc->vc_mode == KD_TEXT)
1584					do_unblank_screen(1);
1585				else
1586					do_blank_screen(1);
1587			}
1588		}
1589	}
1590
1591	/*
1592	 * Wake anyone waiting for their VT to activate
1593	 */
1594	vt_event_post(VT_EVENT_SWITCH, old, vc->vc_num);
1595	return;
1596}
1597
1598/*
1599 * Performs the front-end of a vt switch
1600 */
1601void change_console(struct vc_data *new_vc)
1602{
1603	struct vc_data *vc;
1604
1605	if (!new_vc || new_vc->vc_num == fg_console || vt_dont_switch)
1606		return;
1607
1608	/*
1609	 * If this vt is in process mode, then we need to handshake with
1610	 * that process before switching. Essentially, we store where that
1611	 * vt wants to switch to and wait for it to tell us when it's done
1612	 * (via VT_RELDISP ioctl).
1613	 *
1614	 * We also check to see if the controlling process still exists.
1615	 * If it doesn't, we reset this vt to auto mode and continue.
1616	 * This is a cheap way to track process control. The worst thing
1617	 * that can happen is: we send a signal to a process, it dies, and
1618	 * the switch gets "lost" waiting for a response; hopefully, the
1619	 * user will try again, we'll detect the process is gone (unless
1620	 * the user waits just the right amount of time :-) and revert the
1621	 * vt to auto control.
1622	 */
1623	vc = vc_cons[fg_console].d;
1624	if (vc->vt_mode.mode == VT_PROCESS) {
1625		/*
1626		 * Send the signal as privileged - kill_pid() will
1627		 * tell us if the process has gone or something else
1628		 * is awry.
1629		 *
1630		 * We need to set vt_newvt *before* sending the signal or we
1631		 * have a race.
1632		 */
1633		vc->vt_newvt = new_vc->vc_num;
1634		if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) {
1635			/*
1636			 * It worked. Mark the vt to switch to and
1637			 * return. The process needs to send us a
1638			 * VT_RELDISP ioctl to complete the switch.
1639			 */
1640			return;
1641		}
1642
1643		/*
1644		 * The controlling process has died, so we revert back to
1645		 * normal operation. In this case, we'll also change back
1646		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1647		 * but it saves the agony when the X server dies and the screen
1648		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1649		 * this outside of VT_PROCESS but there is no single process
1650		 * to account for and tracking tty count may be undesirable.
1651		 */
1652		reset_vc(vc);
1653
1654		/*
1655		 * Fall through to normal (VT_AUTO) handling of the switch...
1656		 */
1657	}
1658
1659	/*
1660	 * Ignore all switches in KD_GRAPHICS+VT_AUTO mode
1661	 */
1662	if (vc->vc_mode == KD_GRAPHICS)
1663		return;
1664
1665	complete_change_console(new_vc);
1666}
1667
1668/* Perform a kernel triggered VT switch for suspend/resume */
1669
1670static int disable_vt_switch;
1671
1672int vt_move_to_console(unsigned int vt, int alloc)
1673{
1674	int prev;
1675
1676	console_lock();
1677	/* Graphics mode - up to X */
1678	if (disable_vt_switch) {
1679		console_unlock();
1680		return 0;
1681	}
1682	prev = fg_console;
1683
1684	if (alloc && vc_allocate(vt)) {
1685		/* we can't have a free VC for now. Too bad,
1686		 * we don't want to mess the screen for now. */
1687		console_unlock();
1688		return -ENOSPC;
1689	}
1690
1691	if (set_console(vt)) {
1692		/*
1693		 * We're unable to switch to the SUSPEND_CONSOLE.
1694		 * Let the calling function know so it can decide
1695		 * what to do.
1696		 */
1697		console_unlock();
1698		return -EIO;
1699	}
1700	console_unlock();
1701	tty_lock();
1702	if (vt_waitactive(vt + 1)) {
1703		pr_debug("Suspend: Can't switch VCs.");
1704		tty_unlock();
1705		return -EINTR;
1706	}
1707	tty_unlock();
1708	return prev;
1709}
1710
1711/*
1712 * Normally during a suspend, we allocate a new console and switch to it.
1713 * When we resume, we switch back to the original console.  This switch
1714 * can be slow, so on systems where the framebuffer can handle restoration
1715 * of video registers anyways, there's little point in doing the console
1716 * switch.  This function allows you to disable it by passing it '0'.
1717 */
1718void pm_set_vt_switch(int do_switch)
1719{
1720	console_lock();
1721	disable_vt_switch = !do_switch;
1722	console_unlock();
1723}
1724EXPORT_SYMBOL(pm_set_vt_switch);
1725