xref: /openbmc/linux/drivers/tty/vt/vt_ioctl.c (revision 4800cd83)
1 /*
2  *  linux/drivers/char/vt_ioctl.c
3  *
4  *  Copyright (C) 1992 obz under the linux copyright
5  *
6  *  Dynamic diacritical handling - aeb@cwi.nl - Dec 1993
7  *  Dynamic keymap and string allocation - aeb@cwi.nl - May 1994
8  *  Restrict VT switching via ioctl() - grif@cs.ucr.edu - Dec 1995
9  *  Some code moved for less code duplication - Andi Kleen - Mar 1997
10  *  Check put/get_user, cleanups - acme@conectiva.com.br - Jun 2001
11  */
12 
13 #include <linux/types.h>
14 #include <linux/errno.h>
15 #include <linux/sched.h>
16 #include <linux/tty.h>
17 #include <linux/timer.h>
18 #include <linux/kernel.h>
19 #include <linux/compat.h>
20 #include <linux/module.h>
21 #include <linux/kd.h>
22 #include <linux/vt.h>
23 #include <linux/string.h>
24 #include <linux/slab.h>
25 #include <linux/major.h>
26 #include <linux/fs.h>
27 #include <linux/console.h>
28 #include <linux/consolemap.h>
29 #include <linux/signal.h>
30 #include <linux/smp_lock.h>
31 #include <linux/timex.h>
32 
33 #include <asm/io.h>
34 #include <asm/uaccess.h>
35 
36 #include <linux/kbd_kern.h>
37 #include <linux/vt_kern.h>
38 #include <linux/kbd_diacr.h>
39 #include <linux/selection.h>
40 
41 char vt_dont_switch;
42 extern struct tty_driver *console_driver;
43 
44 #define VT_IS_IN_USE(i)	(console_driver->ttys[i] && console_driver->ttys[i]->count)
45 #define VT_BUSY(i)	(VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons)
46 
47 /*
48  * Console (vt and kd) routines, as defined by USL SVR4 manual, and by
49  * experimentation and study of X386 SYSV handling.
50  *
51  * One point of difference: SYSV vt's are /dev/vtX, which X >= 0, and
52  * /dev/console is a separate ttyp. Under Linux, /dev/tty0 is /dev/console,
53  * and the vc start at /dev/ttyX, X >= 1. We maintain that here, so we will
54  * always treat our set of vt as numbered 1..MAX_NR_CONSOLES (corresponding to
55  * ttys 0..MAX_NR_CONSOLES-1). Explicitly naming VT 0 is illegal, but using
56  * /dev/tty0 (fg_console) as a target is legal, since an implicit aliasing
57  * to the current console is done by the main ioctl code.
58  */
59 
60 #ifdef CONFIG_X86
61 #include <linux/syscalls.h>
62 #endif
63 
64 static void complete_change_console(struct vc_data *vc);
65 
66 /*
67  *	User space VT_EVENT handlers
68  */
69 
70 struct vt_event_wait {
71 	struct list_head list;
72 	struct vt_event event;
73 	int done;
74 };
75 
76 static LIST_HEAD(vt_events);
77 static DEFINE_SPINLOCK(vt_event_lock);
78 static DECLARE_WAIT_QUEUE_HEAD(vt_event_waitqueue);
79 
80 /**
81  *	vt_event_post
82  *	@event: the event that occurred
83  *	@old: old console
84  *	@new: new console
85  *
86  *	Post an VT event to interested VT handlers
87  */
88 
89 void vt_event_post(unsigned int event, unsigned int old, unsigned int new)
90 {
91 	struct list_head *pos, *head;
92 	unsigned long flags;
93 	int wake = 0;
94 
95 	spin_lock_irqsave(&vt_event_lock, flags);
96 	head = &vt_events;
97 
98 	list_for_each(pos, head) {
99 		struct vt_event_wait *ve = list_entry(pos,
100 						struct vt_event_wait, list);
101 		if (!(ve->event.event & event))
102 			continue;
103 		ve->event.event = event;
104 		/* kernel view is consoles 0..n-1, user space view is
105 		   console 1..n with 0 meaning current, so we must bias */
106 		ve->event.oldev = old + 1;
107 		ve->event.newev = new + 1;
108 		wake = 1;
109 		ve->done = 1;
110 	}
111 	spin_unlock_irqrestore(&vt_event_lock, flags);
112 	if (wake)
113 		wake_up_interruptible(&vt_event_waitqueue);
114 }
115 
116 /**
117  *	vt_event_wait		-	wait for an event
118  *	@vw: our event
119  *
120  *	Waits for an event to occur which completes our vt_event_wait
121  *	structure. On return the structure has wv->done set to 1 for success
122  *	or 0 if some event such as a signal ended the wait.
123  */
124 
125 static void vt_event_wait(struct vt_event_wait *vw)
126 {
127 	unsigned long flags;
128 	/* Prepare the event */
129 	INIT_LIST_HEAD(&vw->list);
130 	vw->done = 0;
131 	/* Queue our event */
132 	spin_lock_irqsave(&vt_event_lock, flags);
133 	list_add(&vw->list, &vt_events);
134 	spin_unlock_irqrestore(&vt_event_lock, flags);
135 	/* Wait for it to pass */
136 	wait_event_interruptible_tty(vt_event_waitqueue, vw->done);
137 	/* Dequeue it */
138 	spin_lock_irqsave(&vt_event_lock, flags);
139 	list_del(&vw->list);
140 	spin_unlock_irqrestore(&vt_event_lock, flags);
141 }
142 
143 /**
144  *	vt_event_wait_ioctl	-	event ioctl handler
145  *	@arg: argument to ioctl
146  *
147  *	Implement the VT_WAITEVENT ioctl using the VT event interface
148  */
149 
150 static int vt_event_wait_ioctl(struct vt_event __user *event)
151 {
152 	struct vt_event_wait vw;
153 
154 	if (copy_from_user(&vw.event, event, sizeof(struct vt_event)))
155 		return -EFAULT;
156 	/* Highest supported event for now */
157 	if (vw.event.event & ~VT_MAX_EVENT)
158 		return -EINVAL;
159 
160 	vt_event_wait(&vw);
161 	/* If it occurred report it */
162 	if (vw.done) {
163 		if (copy_to_user(event, &vw.event, sizeof(struct vt_event)))
164 			return -EFAULT;
165 		return 0;
166 	}
167 	return -EINTR;
168 }
169 
170 /**
171  *	vt_waitactive	-	active console wait
172  *	@event: event code
173  *	@n: new console
174  *
175  *	Helper for event waits. Used to implement the legacy
176  *	event waiting ioctls in terms of events
177  */
178 
179 int vt_waitactive(int n)
180 {
181 	struct vt_event_wait vw;
182 	do {
183 		if (n == fg_console + 1)
184 			break;
185 		vw.event.event = VT_EVENT_SWITCH;
186 		vt_event_wait(&vw);
187 		if (vw.done == 0)
188 			return -EINTR;
189 	} while (vw.event.newev != n);
190 	return 0;
191 }
192 
193 /*
194  * these are the valid i/o ports we're allowed to change. they map all the
195  * video ports
196  */
197 #define GPFIRST 0x3b4
198 #define GPLAST 0x3df
199 #define GPNUM (GPLAST - GPFIRST + 1)
200 
201 #define i (tmp.kb_index)
202 #define s (tmp.kb_table)
203 #define v (tmp.kb_value)
204 static inline int
205 do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_struct *kbd)
206 {
207 	struct kbentry tmp;
208 	ushort *key_map, val, ov;
209 
210 	if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
211 		return -EFAULT;
212 
213 	if (!capable(CAP_SYS_TTY_CONFIG))
214 		perm = 0;
215 
216 	switch (cmd) {
217 	case KDGKBENT:
218 		key_map = key_maps[s];
219 		if (key_map) {
220 		    val = U(key_map[i]);
221 		    if (kbd->kbdmode != VC_UNICODE && KTYP(val) >= NR_TYPES)
222 			val = K_HOLE;
223 		} else
224 		    val = (i ? K_HOLE : K_NOSUCHMAP);
225 		return put_user(val, &user_kbe->kb_value);
226 	case KDSKBENT:
227 		if (!perm)
228 			return -EPERM;
229 		if (!i && v == K_NOSUCHMAP) {
230 			/* deallocate map */
231 			key_map = key_maps[s];
232 			if (s && key_map) {
233 			    key_maps[s] = NULL;
234 			    if (key_map[0] == U(K_ALLOCATED)) {
235 					kfree(key_map);
236 					keymap_count--;
237 			    }
238 			}
239 			break;
240 		}
241 
242 		if (KTYP(v) < NR_TYPES) {
243 		    if (KVAL(v) > max_vals[KTYP(v)])
244 				return -EINVAL;
245 		} else
246 		    if (kbd->kbdmode != VC_UNICODE)
247 				return -EINVAL;
248 
249 		/* ++Geert: non-PC keyboards may generate keycode zero */
250 #if !defined(__mc68000__) && !defined(__powerpc__)
251 		/* assignment to entry 0 only tests validity of args */
252 		if (!i)
253 			break;
254 #endif
255 
256 		if (!(key_map = key_maps[s])) {
257 			int j;
258 
259 			if (keymap_count >= MAX_NR_OF_USER_KEYMAPS &&
260 			    !capable(CAP_SYS_RESOURCE))
261 				return -EPERM;
262 
263 			key_map = kmalloc(sizeof(plain_map),
264 						     GFP_KERNEL);
265 			if (!key_map)
266 				return -ENOMEM;
267 			key_maps[s] = key_map;
268 			key_map[0] = U(K_ALLOCATED);
269 			for (j = 1; j < NR_KEYS; j++)
270 				key_map[j] = U(K_HOLE);
271 			keymap_count++;
272 		}
273 		ov = U(key_map[i]);
274 		if (v == ov)
275 			break;	/* nothing to do */
276 		/*
277 		 * Attention Key.
278 		 */
279 		if (((ov == K_SAK) || (v == K_SAK)) && !capable(CAP_SYS_ADMIN))
280 			return -EPERM;
281 		key_map[i] = U(v);
282 		if (!s && (KTYP(ov) == KT_SHIFT || KTYP(v) == KT_SHIFT))
283 			compute_shiftstate();
284 		break;
285 	}
286 	return 0;
287 }
288 #undef i
289 #undef s
290 #undef v
291 
292 static inline int
293 do_kbkeycode_ioctl(int cmd, struct kbkeycode __user *user_kbkc, int perm)
294 {
295 	struct kbkeycode tmp;
296 	int kc = 0;
297 
298 	if (copy_from_user(&tmp, user_kbkc, sizeof(struct kbkeycode)))
299 		return -EFAULT;
300 	switch (cmd) {
301 	case KDGETKEYCODE:
302 		kc = getkeycode(tmp.scancode);
303 		if (kc >= 0)
304 			kc = put_user(kc, &user_kbkc->keycode);
305 		break;
306 	case KDSETKEYCODE:
307 		if (!perm)
308 			return -EPERM;
309 		kc = setkeycode(tmp.scancode, tmp.keycode);
310 		break;
311 	}
312 	return kc;
313 }
314 
315 static inline int
316 do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
317 {
318 	struct kbsentry *kbs;
319 	char *p;
320 	u_char *q;
321 	u_char __user *up;
322 	int sz;
323 	int delta;
324 	char *first_free, *fj, *fnw;
325 	int i, j, k;
326 	int ret;
327 
328 	if (!capable(CAP_SYS_TTY_CONFIG))
329 		perm = 0;
330 
331 	kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
332 	if (!kbs) {
333 		ret = -ENOMEM;
334 		goto reterr;
335 	}
336 
337 	/* we mostly copy too much here (512bytes), but who cares ;) */
338 	if (copy_from_user(kbs, user_kdgkb, sizeof(struct kbsentry))) {
339 		ret = -EFAULT;
340 		goto reterr;
341 	}
342 	kbs->kb_string[sizeof(kbs->kb_string)-1] = '\0';
343 	i = kbs->kb_func;
344 
345 	switch (cmd) {
346 	case KDGKBSENT:
347 		sz = sizeof(kbs->kb_string) - 1; /* sz should have been
348 						  a struct member */
349 		up = user_kdgkb->kb_string;
350 		p = func_table[i];
351 		if(p)
352 			for ( ; *p && sz; p++, sz--)
353 				if (put_user(*p, up++)) {
354 					ret = -EFAULT;
355 					goto reterr;
356 				}
357 		if (put_user('\0', up)) {
358 			ret = -EFAULT;
359 			goto reterr;
360 		}
361 		kfree(kbs);
362 		return ((p && *p) ? -EOVERFLOW : 0);
363 	case KDSKBSENT:
364 		if (!perm) {
365 			ret = -EPERM;
366 			goto reterr;
367 		}
368 
369 		q = func_table[i];
370 		first_free = funcbufptr + (funcbufsize - funcbufleft);
371 		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++)
372 			;
373 		if (j < MAX_NR_FUNC)
374 			fj = func_table[j];
375 		else
376 			fj = first_free;
377 
378 		delta = (q ? -strlen(q) : 1) + strlen(kbs->kb_string);
379 		if (delta <= funcbufleft) { 	/* it fits in current buf */
380 		    if (j < MAX_NR_FUNC) {
381 			memmove(fj + delta, fj, first_free - fj);
382 			for (k = j; k < MAX_NR_FUNC; k++)
383 			    if (func_table[k])
384 				func_table[k] += delta;
385 		    }
386 		    if (!q)
387 		      func_table[i] = fj;
388 		    funcbufleft -= delta;
389 		} else {			/* allocate a larger buffer */
390 		    sz = 256;
391 		    while (sz < funcbufsize - funcbufleft + delta)
392 		      sz <<= 1;
393 		    fnw = kmalloc(sz, GFP_KERNEL);
394 		    if(!fnw) {
395 		      ret = -ENOMEM;
396 		      goto reterr;
397 		    }
398 
399 		    if (!q)
400 		      func_table[i] = fj;
401 		    if (fj > funcbufptr)
402 			memmove(fnw, funcbufptr, fj - funcbufptr);
403 		    for (k = 0; k < j; k++)
404 		      if (func_table[k])
405 			func_table[k] = fnw + (func_table[k] - funcbufptr);
406 
407 		    if (first_free > fj) {
408 			memmove(fnw + (fj - funcbufptr) + delta, fj, first_free - fj);
409 			for (k = j; k < MAX_NR_FUNC; k++)
410 			  if (func_table[k])
411 			    func_table[k] = fnw + (func_table[k] - funcbufptr) + delta;
412 		    }
413 		    if (funcbufptr != func_buf)
414 		      kfree(funcbufptr);
415 		    funcbufptr = fnw;
416 		    funcbufleft = funcbufleft - delta + sz - funcbufsize;
417 		    funcbufsize = sz;
418 		}
419 		strcpy(func_table[i], kbs->kb_string);
420 		break;
421 	}
422 	ret = 0;
423 reterr:
424 	kfree(kbs);
425 	return ret;
426 }
427 
428 static inline int
429 do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op)
430 {
431 	struct consolefontdesc cfdarg;
432 	int i;
433 
434 	if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc)))
435 		return -EFAULT;
436 
437 	switch (cmd) {
438 	case PIO_FONTX:
439 		if (!perm)
440 			return -EPERM;
441 		op->op = KD_FONT_OP_SET;
442 		op->flags = KD_FONT_FLAG_OLD;
443 		op->width = 8;
444 		op->height = cfdarg.charheight;
445 		op->charcount = cfdarg.charcount;
446 		op->data = cfdarg.chardata;
447 		return con_font_op(vc_cons[fg_console].d, op);
448 	case GIO_FONTX: {
449 		op->op = KD_FONT_OP_GET;
450 		op->flags = KD_FONT_FLAG_OLD;
451 		op->width = 8;
452 		op->height = cfdarg.charheight;
453 		op->charcount = cfdarg.charcount;
454 		op->data = cfdarg.chardata;
455 		i = con_font_op(vc_cons[fg_console].d, op);
456 		if (i)
457 			return i;
458 		cfdarg.charheight = op->height;
459 		cfdarg.charcount = op->charcount;
460 		if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc)))
461 			return -EFAULT;
462 		return 0;
463 		}
464 	}
465 	return -EINVAL;
466 }
467 
468 static inline int
469 do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc)
470 {
471 	struct unimapdesc tmp;
472 
473 	if (copy_from_user(&tmp, user_ud, sizeof tmp))
474 		return -EFAULT;
475 	if (tmp.entries)
476 		if (!access_ok(VERIFY_WRITE, tmp.entries,
477 				tmp.entry_ct*sizeof(struct unipair)))
478 			return -EFAULT;
479 	switch (cmd) {
480 	case PIO_UNIMAP:
481 		if (!perm)
482 			return -EPERM;
483 		return con_set_unimap(vc, tmp.entry_ct, tmp.entries);
484 	case GIO_UNIMAP:
485 		if (!perm && fg_console != vc->vc_num)
486 			return -EPERM;
487 		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp.entries);
488 	}
489 	return 0;
490 }
491 
492 
493 
494 /*
495  * We handle the console-specific ioctl's here.  We allow the
496  * capability to modify any console, not just the fg_console.
497  */
498 int vt_ioctl(struct tty_struct *tty, struct file * file,
499 	     unsigned int cmd, unsigned long arg)
500 {
501 	struct vc_data *vc = tty->driver_data;
502 	struct console_font_op op;	/* used in multiple places here */
503 	struct kbd_struct * kbd;
504 	unsigned int console;
505 	unsigned char ucval;
506 	unsigned int uival;
507 	void __user *up = (void __user *)arg;
508 	int i, perm;
509 	int ret = 0;
510 
511 	console = vc->vc_num;
512 
513 	tty_lock();
514 
515 	if (!vc_cons_allocated(console)) { 	/* impossible? */
516 		ret = -ENOIOCTLCMD;
517 		goto out;
518 	}
519 
520 
521 	/*
522 	 * To have permissions to do most of the vt ioctls, we either have
523 	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
524 	 */
525 	perm = 0;
526 	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
527 		perm = 1;
528 
529 	kbd = kbd_table + console;
530 	switch (cmd) {
531 	case TIOCLINUX:
532 		ret = tioclinux(tty, arg);
533 		break;
534 	case KIOCSOUND:
535 		if (!perm)
536 			goto eperm;
537 		/*
538 		 * The use of PIT_TICK_RATE is historic, it used to be
539 		 * the platform-dependent CLOCK_TICK_RATE between 2.6.12
540 		 * and 2.6.36, which was a minor but unfortunate ABI
541 		 * change.
542 		 */
543 		if (arg)
544 			arg = PIT_TICK_RATE / arg;
545 		kd_mksound(arg, 0);
546 		break;
547 
548 	case KDMKTONE:
549 		if (!perm)
550 			goto eperm;
551 	{
552 		unsigned int ticks, count;
553 
554 		/*
555 		 * Generate the tone for the appropriate number of ticks.
556 		 * If the time is zero, turn off sound ourselves.
557 		 */
558 		ticks = HZ * ((arg >> 16) & 0xffff) / 1000;
559 		count = ticks ? (arg & 0xffff) : 0;
560 		if (count)
561 			count = PIT_TICK_RATE / count;
562 		kd_mksound(count, ticks);
563 		break;
564 	}
565 
566 	case KDGKBTYPE:
567 		/*
568 		 * this is naive.
569 		 */
570 		ucval = KB_101;
571 		goto setchar;
572 
573 		/*
574 		 * These cannot be implemented on any machine that implements
575 		 * ioperm() in user level (such as Alpha PCs) or not at all.
576 		 *
577 		 * XXX: you should never use these, just call ioperm directly..
578 		 */
579 #ifdef CONFIG_X86
580 	case KDADDIO:
581 	case KDDELIO:
582 		/*
583 		 * KDADDIO and KDDELIO may be able to add ports beyond what
584 		 * we reject here, but to be safe...
585 		 */
586 		if (arg < GPFIRST || arg > GPLAST) {
587 			ret = -EINVAL;
588 			break;
589 		}
590 		ret = sys_ioperm(arg, 1, (cmd == KDADDIO)) ? -ENXIO : 0;
591 		break;
592 
593 	case KDENABIO:
594 	case KDDISABIO:
595 		ret = sys_ioperm(GPFIRST, GPNUM,
596 				  (cmd == KDENABIO)) ? -ENXIO : 0;
597 		break;
598 #endif
599 
600 	/* Linux m68k/i386 interface for setting the keyboard delay/repeat rate */
601 
602 	case KDKBDREP:
603 	{
604 		struct kbd_repeat kbrep;
605 
606 		if (!capable(CAP_SYS_TTY_CONFIG))
607 			goto eperm;
608 
609 		if (copy_from_user(&kbrep, up, sizeof(struct kbd_repeat))) {
610 			ret =  -EFAULT;
611 			break;
612 		}
613 		ret = kbd_rate(&kbrep);
614 		if (ret)
615 			break;
616 		if (copy_to_user(up, &kbrep, sizeof(struct kbd_repeat)))
617 			ret = -EFAULT;
618 		break;
619 	}
620 
621 	case KDSETMODE:
622 		/*
623 		 * currently, setting the mode from KD_TEXT to KD_GRAPHICS
624 		 * doesn't do a whole lot. i'm not sure if it should do any
625 		 * restoration of modes or what...
626 		 *
627 		 * XXX It should at least call into the driver, fbdev's definitely
628 		 * need to restore their engine state. --BenH
629 		 */
630 		if (!perm)
631 			goto eperm;
632 		switch (arg) {
633 		case KD_GRAPHICS:
634 			break;
635 		case KD_TEXT0:
636 		case KD_TEXT1:
637 			arg = KD_TEXT;
638 		case KD_TEXT:
639 			break;
640 		default:
641 			ret = -EINVAL;
642 			goto out;
643 		}
644 		if (vc->vc_mode == (unsigned char) arg)
645 			break;
646 		vc->vc_mode = (unsigned char) arg;
647 		if (console != fg_console)
648 			break;
649 		/*
650 		 * explicitly blank/unblank the screen if switching modes
651 		 */
652 		console_lock();
653 		if (arg == KD_TEXT)
654 			do_unblank_screen(1);
655 		else
656 			do_blank_screen(1);
657 		console_unlock();
658 		break;
659 
660 	case KDGETMODE:
661 		uival = vc->vc_mode;
662 		goto setint;
663 
664 	case KDMAPDISP:
665 	case KDUNMAPDISP:
666 		/*
667 		 * these work like a combination of mmap and KDENABIO.
668 		 * this could be easily finished.
669 		 */
670 		ret = -EINVAL;
671 		break;
672 
673 	case KDSKBMODE:
674 		if (!perm)
675 			goto eperm;
676 		switch(arg) {
677 		  case K_RAW:
678 			kbd->kbdmode = VC_RAW;
679 			break;
680 		  case K_MEDIUMRAW:
681 			kbd->kbdmode = VC_MEDIUMRAW;
682 			break;
683 		  case K_XLATE:
684 			kbd->kbdmode = VC_XLATE;
685 			compute_shiftstate();
686 			break;
687 		  case K_UNICODE:
688 			kbd->kbdmode = VC_UNICODE;
689 			compute_shiftstate();
690 			break;
691 		  default:
692 			ret = -EINVAL;
693 			goto out;
694 		}
695 		tty_ldisc_flush(tty);
696 		break;
697 
698 	case KDGKBMODE:
699 		uival = ((kbd->kbdmode == VC_RAW) ? K_RAW :
700 				 (kbd->kbdmode == VC_MEDIUMRAW) ? K_MEDIUMRAW :
701 				 (kbd->kbdmode == VC_UNICODE) ? K_UNICODE :
702 				 K_XLATE);
703 		goto setint;
704 
705 	/* this could be folded into KDSKBMODE, but for compatibility
706 	   reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */
707 	case KDSKBMETA:
708 		switch(arg) {
709 		  case K_METABIT:
710 			clr_vc_kbd_mode(kbd, VC_META);
711 			break;
712 		  case K_ESCPREFIX:
713 			set_vc_kbd_mode(kbd, VC_META);
714 			break;
715 		  default:
716 			ret = -EINVAL;
717 		}
718 		break;
719 
720 	case KDGKBMETA:
721 		uival = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
722 	setint:
723 		ret = put_user(uival, (int __user *)arg);
724 		break;
725 
726 	case KDGETKEYCODE:
727 	case KDSETKEYCODE:
728 		if(!capable(CAP_SYS_TTY_CONFIG))
729 			perm = 0;
730 		ret = do_kbkeycode_ioctl(cmd, up, perm);
731 		break;
732 
733 	case KDGKBENT:
734 	case KDSKBENT:
735 		ret = do_kdsk_ioctl(cmd, up, perm, kbd);
736 		break;
737 
738 	case KDGKBSENT:
739 	case KDSKBSENT:
740 		ret = do_kdgkb_ioctl(cmd, up, perm);
741 		break;
742 
743 	case KDGKBDIACR:
744 	{
745 		struct kbdiacrs __user *a = up;
746 		struct kbdiacr diacr;
747 		int i;
748 
749 		if (put_user(accent_table_size, &a->kb_cnt)) {
750 			ret = -EFAULT;
751 			break;
752 		}
753 		for (i = 0; i < accent_table_size; i++) {
754 			diacr.diacr = conv_uni_to_8bit(accent_table[i].diacr);
755 			diacr.base = conv_uni_to_8bit(accent_table[i].base);
756 			diacr.result = conv_uni_to_8bit(accent_table[i].result);
757 			if (copy_to_user(a->kbdiacr + i, &diacr, sizeof(struct kbdiacr))) {
758 				ret = -EFAULT;
759 				break;
760 			}
761 		}
762 		break;
763 	}
764 	case KDGKBDIACRUC:
765 	{
766 		struct kbdiacrsuc __user *a = up;
767 
768 		if (put_user(accent_table_size, &a->kb_cnt))
769 			ret = -EFAULT;
770 		else if (copy_to_user(a->kbdiacruc, accent_table,
771 				accent_table_size*sizeof(struct kbdiacruc)))
772 			ret = -EFAULT;
773 		break;
774 	}
775 
776 	case KDSKBDIACR:
777 	{
778 		struct kbdiacrs __user *a = up;
779 		struct kbdiacr diacr;
780 		unsigned int ct;
781 		int i;
782 
783 		if (!perm)
784 			goto eperm;
785 		if (get_user(ct,&a->kb_cnt)) {
786 			ret = -EFAULT;
787 			break;
788 		}
789 		if (ct >= MAX_DIACR) {
790 			ret = -EINVAL;
791 			break;
792 		}
793 		accent_table_size = ct;
794 		for (i = 0; i < ct; i++) {
795 			if (copy_from_user(&diacr, a->kbdiacr + i, sizeof(struct kbdiacr))) {
796 				ret = -EFAULT;
797 				break;
798 			}
799 			accent_table[i].diacr = conv_8bit_to_uni(diacr.diacr);
800 			accent_table[i].base = conv_8bit_to_uni(diacr.base);
801 			accent_table[i].result = conv_8bit_to_uni(diacr.result);
802 		}
803 		break;
804 	}
805 
806 	case KDSKBDIACRUC:
807 	{
808 		struct kbdiacrsuc __user *a = up;
809 		unsigned int ct;
810 
811 		if (!perm)
812 			goto eperm;
813 		if (get_user(ct,&a->kb_cnt)) {
814 			ret = -EFAULT;
815 			break;
816 		}
817 		if (ct >= MAX_DIACR) {
818 			ret = -EINVAL;
819 			break;
820 		}
821 		accent_table_size = ct;
822 		if (copy_from_user(accent_table, a->kbdiacruc, ct*sizeof(struct kbdiacruc)))
823 			ret = -EFAULT;
824 		break;
825 	}
826 
827 	/* the ioctls below read/set the flags usually shown in the leds */
828 	/* don't use them - they will go away without warning */
829 	case KDGKBLED:
830 		ucval = kbd->ledflagstate | (kbd->default_ledflagstate << 4);
831 		goto setchar;
832 
833 	case KDSKBLED:
834 		if (!perm)
835 			goto eperm;
836 		if (arg & ~0x77) {
837 			ret = -EINVAL;
838 			break;
839 		}
840 		kbd->ledflagstate = (arg & 7);
841 		kbd->default_ledflagstate = ((arg >> 4) & 7);
842 		set_leds();
843 		break;
844 
845 	/* the ioctls below only set the lights, not the functions */
846 	/* for those, see KDGKBLED and KDSKBLED above */
847 	case KDGETLED:
848 		ucval = getledstate();
849 	setchar:
850 		ret = put_user(ucval, (char __user *)arg);
851 		break;
852 
853 	case KDSETLED:
854 		if (!perm)
855 			goto eperm;
856 		setledstate(kbd, arg);
857 		break;
858 
859 	/*
860 	 * A process can indicate its willingness to accept signals
861 	 * generated by pressing an appropriate key combination.
862 	 * Thus, one can have a daemon that e.g. spawns a new console
863 	 * upon a keypress and then changes to it.
864 	 * See also the kbrequest field of inittab(5).
865 	 */
866 	case KDSIGACCEPT:
867 	{
868 		if (!perm || !capable(CAP_KILL))
869 			goto eperm;
870 		if (!valid_signal(arg) || arg < 1 || arg == SIGKILL)
871 			ret = -EINVAL;
872 		else {
873 			spin_lock_irq(&vt_spawn_con.lock);
874 			put_pid(vt_spawn_con.pid);
875 			vt_spawn_con.pid = get_pid(task_pid(current));
876 			vt_spawn_con.sig = arg;
877 			spin_unlock_irq(&vt_spawn_con.lock);
878 		}
879 		break;
880 	}
881 
882 	case VT_SETMODE:
883 	{
884 		struct vt_mode tmp;
885 
886 		if (!perm)
887 			goto eperm;
888 		if (copy_from_user(&tmp, up, sizeof(struct vt_mode))) {
889 			ret = -EFAULT;
890 			goto out;
891 		}
892 		if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS) {
893 			ret = -EINVAL;
894 			goto out;
895 		}
896 		console_lock();
897 		vc->vt_mode = tmp;
898 		/* the frsig is ignored, so we set it to 0 */
899 		vc->vt_mode.frsig = 0;
900 		put_pid(vc->vt_pid);
901 		vc->vt_pid = get_pid(task_pid(current));
902 		/* no switch is required -- saw@shade.msu.ru */
903 		vc->vt_newvt = -1;
904 		console_unlock();
905 		break;
906 	}
907 
908 	case VT_GETMODE:
909 	{
910 		struct vt_mode tmp;
911 		int rc;
912 
913 		console_lock();
914 		memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode));
915 		console_unlock();
916 
917 		rc = copy_to_user(up, &tmp, sizeof(struct vt_mode));
918 		if (rc)
919 			ret = -EFAULT;
920 		break;
921 	}
922 
923 	/*
924 	 * Returns global vt state. Note that VT 0 is always open, since
925 	 * it's an alias for the current VT, and people can't use it here.
926 	 * We cannot return state for more than 16 VTs, since v_state is short.
927 	 */
928 	case VT_GETSTATE:
929 	{
930 		struct vt_stat __user *vtstat = up;
931 		unsigned short state, mask;
932 
933 		if (put_user(fg_console + 1, &vtstat->v_active))
934 			ret = -EFAULT;
935 		else {
936 			state = 1;	/* /dev/tty0 is always open */
937 			for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask;
938 							++i, mask <<= 1)
939 				if (VT_IS_IN_USE(i))
940 					state |= mask;
941 			ret = put_user(state, &vtstat->v_state);
942 		}
943 		break;
944 	}
945 
946 	/*
947 	 * Returns the first available (non-opened) console.
948 	 */
949 	case VT_OPENQRY:
950 		for (i = 0; i < MAX_NR_CONSOLES; ++i)
951 			if (! VT_IS_IN_USE(i))
952 				break;
953 		uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
954 		goto setint;
955 
956 	/*
957 	 * ioctl(fd, VT_ACTIVATE, num) will cause us to switch to vt # num,
958 	 * with num >= 1 (switches to vt 0, our console, are not allowed, just
959 	 * to preserve sanity).
960 	 */
961 	case VT_ACTIVATE:
962 		if (!perm)
963 			goto eperm;
964 		if (arg == 0 || arg > MAX_NR_CONSOLES)
965 			ret =  -ENXIO;
966 		else {
967 			arg--;
968 			console_lock();
969 			ret = vc_allocate(arg);
970 			console_unlock();
971 			if (ret)
972 				break;
973 			set_console(arg);
974 		}
975 		break;
976 
977 	case VT_SETACTIVATE:
978 	{
979 		struct vt_setactivate vsa;
980 
981 		if (!perm)
982 			goto eperm;
983 
984 		if (copy_from_user(&vsa, (struct vt_setactivate __user *)arg,
985 					sizeof(struct vt_setactivate))) {
986 			ret = -EFAULT;
987 			goto out;
988 		}
989 		if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
990 			ret = -ENXIO;
991 		else {
992 			vsa.console--;
993 			console_lock();
994 			ret = vc_allocate(vsa.console);
995 			if (ret == 0) {
996 				struct vc_data *nvc;
997 				/* This is safe providing we don't drop the
998 				   console sem between vc_allocate and
999 				   finishing referencing nvc */
1000 				nvc = vc_cons[vsa.console].d;
1001 				nvc->vt_mode = vsa.mode;
1002 				nvc->vt_mode.frsig = 0;
1003 				put_pid(nvc->vt_pid);
1004 				nvc->vt_pid = get_pid(task_pid(current));
1005 			}
1006 			console_unlock();
1007 			if (ret)
1008 				break;
1009 			/* Commence switch and lock */
1010 			set_console(arg);
1011 		}
1012 	}
1013 
1014 	/*
1015 	 * wait until the specified VT has been activated
1016 	 */
1017 	case VT_WAITACTIVE:
1018 		if (!perm)
1019 			goto eperm;
1020 		if (arg == 0 || arg > MAX_NR_CONSOLES)
1021 			ret = -ENXIO;
1022 		else
1023 			ret = vt_waitactive(arg);
1024 		break;
1025 
1026 	/*
1027 	 * If a vt is under process control, the kernel will not switch to it
1028 	 * immediately, but postpone the operation until the process calls this
1029 	 * ioctl, allowing the switch to complete.
1030 	 *
1031 	 * According to the X sources this is the behavior:
1032 	 *	0:	pending switch-from not OK
1033 	 *	1:	pending switch-from OK
1034 	 *	2:	completed switch-to OK
1035 	 */
1036 	case VT_RELDISP:
1037 		if (!perm)
1038 			goto eperm;
1039 
1040 		if (vc->vt_mode.mode != VT_PROCESS) {
1041 			ret = -EINVAL;
1042 			break;
1043 		}
1044 		/*
1045 		 * Switching-from response
1046 		 */
1047 		console_lock();
1048 		if (vc->vt_newvt >= 0) {
1049 			if (arg == 0)
1050 				/*
1051 				 * Switch disallowed, so forget we were trying
1052 				 * to do it.
1053 				 */
1054 				vc->vt_newvt = -1;
1055 
1056 			else {
1057 				/*
1058 				 * The current vt has been released, so
1059 				 * complete the switch.
1060 				 */
1061 				int newvt;
1062 				newvt = vc->vt_newvt;
1063 				vc->vt_newvt = -1;
1064 				ret = vc_allocate(newvt);
1065 				if (ret) {
1066 					console_unlock();
1067 					break;
1068 				}
1069 				/*
1070 				 * When we actually do the console switch,
1071 				 * make sure we are atomic with respect to
1072 				 * other console switches..
1073 				 */
1074 				complete_change_console(vc_cons[newvt].d);
1075 			}
1076 		} else {
1077 			/*
1078 			 * Switched-to response
1079 			 */
1080 			/*
1081 			 * If it's just an ACK, ignore it
1082 			 */
1083 			if (arg != VT_ACKACQ)
1084 				ret = -EINVAL;
1085 		}
1086 		console_unlock();
1087 		break;
1088 
1089 	 /*
1090 	  * Disallocate memory associated to VT (but leave VT1)
1091 	  */
1092 	 case VT_DISALLOCATE:
1093 		if (arg > MAX_NR_CONSOLES) {
1094 			ret = -ENXIO;
1095 			break;
1096 		}
1097 		if (arg == 0) {
1098 		    /* deallocate all unused consoles, but leave 0 */
1099 			console_lock();
1100 			for (i=1; i<MAX_NR_CONSOLES; i++)
1101 				if (! VT_BUSY(i))
1102 					vc_deallocate(i);
1103 			console_unlock();
1104 		} else {
1105 			/* deallocate a single console, if possible */
1106 			arg--;
1107 			if (VT_BUSY(arg))
1108 				ret = -EBUSY;
1109 			else if (arg) {			      /* leave 0 */
1110 				console_lock();
1111 				vc_deallocate(arg);
1112 				console_unlock();
1113 			}
1114 		}
1115 		break;
1116 
1117 	case VT_RESIZE:
1118 	{
1119 		struct vt_sizes __user *vtsizes = up;
1120 		struct vc_data *vc;
1121 
1122 		ushort ll,cc;
1123 		if (!perm)
1124 			goto eperm;
1125 		if (get_user(ll, &vtsizes->v_rows) ||
1126 		    get_user(cc, &vtsizes->v_cols))
1127 			ret = -EFAULT;
1128 		else {
1129 			console_lock();
1130 			for (i = 0; i < MAX_NR_CONSOLES; i++) {
1131 				vc = vc_cons[i].d;
1132 
1133 				if (vc) {
1134 					vc->vc_resize_user = 1;
1135 					vc_resize(vc_cons[i].d, cc, ll);
1136 				}
1137 			}
1138 			console_unlock();
1139 		}
1140 		break;
1141 	}
1142 
1143 	case VT_RESIZEX:
1144 	{
1145 		struct vt_consize __user *vtconsize = up;
1146 		ushort ll,cc,vlin,clin,vcol,ccol;
1147 		if (!perm)
1148 			goto eperm;
1149 		if (!access_ok(VERIFY_READ, vtconsize,
1150 				sizeof(struct vt_consize))) {
1151 			ret = -EFAULT;
1152 			break;
1153 		}
1154 		/* FIXME: Should check the copies properly */
1155 		__get_user(ll, &vtconsize->v_rows);
1156 		__get_user(cc, &vtconsize->v_cols);
1157 		__get_user(vlin, &vtconsize->v_vlin);
1158 		__get_user(clin, &vtconsize->v_clin);
1159 		__get_user(vcol, &vtconsize->v_vcol);
1160 		__get_user(ccol, &vtconsize->v_ccol);
1161 		vlin = vlin ? vlin : vc->vc_scan_lines;
1162 		if (clin) {
1163 			if (ll) {
1164 				if (ll != vlin/clin) {
1165 					/* Parameters don't add up */
1166 					ret = -EINVAL;
1167 					break;
1168 				}
1169 			} else
1170 				ll = vlin/clin;
1171 		}
1172 		if (vcol && ccol) {
1173 			if (cc) {
1174 				if (cc != vcol/ccol) {
1175 					ret = -EINVAL;
1176 					break;
1177 				}
1178 			} else
1179 				cc = vcol/ccol;
1180 		}
1181 
1182 		if (clin > 32) {
1183 			ret =  -EINVAL;
1184 			break;
1185 		}
1186 
1187 		for (i = 0; i < MAX_NR_CONSOLES; i++) {
1188 			if (!vc_cons[i].d)
1189 				continue;
1190 			console_lock();
1191 			if (vlin)
1192 				vc_cons[i].d->vc_scan_lines = vlin;
1193 			if (clin)
1194 				vc_cons[i].d->vc_font.height = clin;
1195 			vc_cons[i].d->vc_resize_user = 1;
1196 			vc_resize(vc_cons[i].d, cc, ll);
1197 			console_unlock();
1198 		}
1199 		break;
1200 	}
1201 
1202 	case PIO_FONT: {
1203 		if (!perm)
1204 			goto eperm;
1205 		op.op = KD_FONT_OP_SET;
1206 		op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC;	/* Compatibility */
1207 		op.width = 8;
1208 		op.height = 0;
1209 		op.charcount = 256;
1210 		op.data = up;
1211 		ret = con_font_op(vc_cons[fg_console].d, &op);
1212 		break;
1213 	}
1214 
1215 	case GIO_FONT: {
1216 		op.op = KD_FONT_OP_GET;
1217 		op.flags = KD_FONT_FLAG_OLD;
1218 		op.width = 8;
1219 		op.height = 32;
1220 		op.charcount = 256;
1221 		op.data = up;
1222 		ret = con_font_op(vc_cons[fg_console].d, &op);
1223 		break;
1224 	}
1225 
1226 	case PIO_CMAP:
1227                 if (!perm)
1228 			ret = -EPERM;
1229 		else
1230 	                ret = con_set_cmap(up);
1231 		break;
1232 
1233 	case GIO_CMAP:
1234                 ret = con_get_cmap(up);
1235 		break;
1236 
1237 	case PIO_FONTX:
1238 	case GIO_FONTX:
1239 		ret = do_fontx_ioctl(cmd, up, perm, &op);
1240 		break;
1241 
1242 	case PIO_FONTRESET:
1243 	{
1244 		if (!perm)
1245 			goto eperm;
1246 
1247 #ifdef BROKEN_GRAPHICS_PROGRAMS
1248 		/* With BROKEN_GRAPHICS_PROGRAMS defined, the default
1249 		   font is not saved. */
1250 		ret = -ENOSYS;
1251 		break;
1252 #else
1253 		{
1254 		op.op = KD_FONT_OP_SET_DEFAULT;
1255 		op.data = NULL;
1256 		ret = con_font_op(vc_cons[fg_console].d, &op);
1257 		if (ret)
1258 			break;
1259 		con_set_default_unimap(vc_cons[fg_console].d);
1260 		break;
1261 		}
1262 #endif
1263 	}
1264 
1265 	case KDFONTOP: {
1266 		if (copy_from_user(&op, up, sizeof(op))) {
1267 			ret = -EFAULT;
1268 			break;
1269 		}
1270 		if (!perm && op.op != KD_FONT_OP_GET)
1271 			goto eperm;
1272 		ret = con_font_op(vc, &op);
1273 		if (ret)
1274 			break;
1275 		if (copy_to_user(up, &op, sizeof(op)))
1276 			ret = -EFAULT;
1277 		break;
1278 	}
1279 
1280 	case PIO_SCRNMAP:
1281 		if (!perm)
1282 			ret = -EPERM;
1283 		else
1284 			ret = con_set_trans_old(up);
1285 		break;
1286 
1287 	case GIO_SCRNMAP:
1288 		ret = con_get_trans_old(up);
1289 		break;
1290 
1291 	case PIO_UNISCRNMAP:
1292 		if (!perm)
1293 			ret = -EPERM;
1294 		else
1295 			ret = con_set_trans_new(up);
1296 		break;
1297 
1298 	case GIO_UNISCRNMAP:
1299 		ret = con_get_trans_new(up);
1300 		break;
1301 
1302 	case PIO_UNIMAPCLR:
1303 	      { struct unimapinit ui;
1304 		if (!perm)
1305 			goto eperm;
1306 		ret = copy_from_user(&ui, up, sizeof(struct unimapinit));
1307 		if (ret)
1308 			ret = -EFAULT;
1309 		else
1310 			con_clear_unimap(vc, &ui);
1311 		break;
1312 	      }
1313 
1314 	case PIO_UNIMAP:
1315 	case GIO_UNIMAP:
1316 		ret = do_unimap_ioctl(cmd, up, perm, vc);
1317 		break;
1318 
1319 	case VT_LOCKSWITCH:
1320 		if (!capable(CAP_SYS_TTY_CONFIG))
1321 			goto eperm;
1322 		vt_dont_switch = 1;
1323 		break;
1324 	case VT_UNLOCKSWITCH:
1325 		if (!capable(CAP_SYS_TTY_CONFIG))
1326 			goto eperm;
1327 		vt_dont_switch = 0;
1328 		break;
1329 	case VT_GETHIFONTMASK:
1330 		ret = put_user(vc->vc_hi_font_mask,
1331 					(unsigned short __user *)arg);
1332 		break;
1333 	case VT_WAITEVENT:
1334 		ret = vt_event_wait_ioctl((struct vt_event __user *)arg);
1335 		break;
1336 	default:
1337 		ret = -ENOIOCTLCMD;
1338 	}
1339 out:
1340 	tty_unlock();
1341 	return ret;
1342 eperm:
1343 	ret = -EPERM;
1344 	goto out;
1345 }
1346 
1347 void reset_vc(struct vc_data *vc)
1348 {
1349 	vc->vc_mode = KD_TEXT;
1350 	kbd_table[vc->vc_num].kbdmode = default_utf8 ? VC_UNICODE : VC_XLATE;
1351 	vc->vt_mode.mode = VT_AUTO;
1352 	vc->vt_mode.waitv = 0;
1353 	vc->vt_mode.relsig = 0;
1354 	vc->vt_mode.acqsig = 0;
1355 	vc->vt_mode.frsig = 0;
1356 	put_pid(vc->vt_pid);
1357 	vc->vt_pid = NULL;
1358 	vc->vt_newvt = -1;
1359 	if (!in_interrupt())    /* Via keyboard.c:SAK() - akpm */
1360 		reset_palette(vc);
1361 }
1362 
1363 void vc_SAK(struct work_struct *work)
1364 {
1365 	struct vc *vc_con =
1366 		container_of(work, struct vc, SAK_work);
1367 	struct vc_data *vc;
1368 	struct tty_struct *tty;
1369 
1370 	console_lock();
1371 	vc = vc_con->d;
1372 	if (vc) {
1373 		tty = vc->port.tty;
1374 		/*
1375 		 * SAK should also work in all raw modes and reset
1376 		 * them properly.
1377 		 */
1378 		if (tty)
1379 			__do_SAK(tty);
1380 		reset_vc(vc);
1381 	}
1382 	console_unlock();
1383 }
1384 
1385 #ifdef CONFIG_COMPAT
1386 
1387 struct compat_consolefontdesc {
1388 	unsigned short charcount;       /* characters in font (256 or 512) */
1389 	unsigned short charheight;      /* scan lines per character (1-32) */
1390 	compat_caddr_t chardata;	/* font data in expanded form */
1391 };
1392 
1393 static inline int
1394 compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
1395 			 int perm, struct console_font_op *op)
1396 {
1397 	struct compat_consolefontdesc cfdarg;
1398 	int i;
1399 
1400 	if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc)))
1401 		return -EFAULT;
1402 
1403 	switch (cmd) {
1404 	case PIO_FONTX:
1405 		if (!perm)
1406 			return -EPERM;
1407 		op->op = KD_FONT_OP_SET;
1408 		op->flags = KD_FONT_FLAG_OLD;
1409 		op->width = 8;
1410 		op->height = cfdarg.charheight;
1411 		op->charcount = cfdarg.charcount;
1412 		op->data = compat_ptr(cfdarg.chardata);
1413 		return con_font_op(vc_cons[fg_console].d, op);
1414 	case GIO_FONTX:
1415 		op->op = KD_FONT_OP_GET;
1416 		op->flags = KD_FONT_FLAG_OLD;
1417 		op->width = 8;
1418 		op->height = cfdarg.charheight;
1419 		op->charcount = cfdarg.charcount;
1420 		op->data = compat_ptr(cfdarg.chardata);
1421 		i = con_font_op(vc_cons[fg_console].d, op);
1422 		if (i)
1423 			return i;
1424 		cfdarg.charheight = op->height;
1425 		cfdarg.charcount = op->charcount;
1426 		if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc)))
1427 			return -EFAULT;
1428 		return 0;
1429 	}
1430 	return -EINVAL;
1431 }
1432 
1433 struct compat_console_font_op {
1434 	compat_uint_t op;        /* operation code KD_FONT_OP_* */
1435 	compat_uint_t flags;     /* KD_FONT_FLAG_* */
1436 	compat_uint_t width, height;     /* font size */
1437 	compat_uint_t charcount;
1438 	compat_caddr_t data;    /* font data with height fixed to 32 */
1439 };
1440 
1441 static inline int
1442 compat_kdfontop_ioctl(struct compat_console_font_op __user *fontop,
1443 			 int perm, struct console_font_op *op, struct vc_data *vc)
1444 {
1445 	int i;
1446 
1447 	if (copy_from_user(op, fontop, sizeof(struct compat_console_font_op)))
1448 		return -EFAULT;
1449 	if (!perm && op->op != KD_FONT_OP_GET)
1450 		return -EPERM;
1451 	op->data = compat_ptr(((struct compat_console_font_op *)op)->data);
1452 	op->flags |= KD_FONT_FLAG_OLD;
1453 	i = con_font_op(vc, op);
1454 	if (i)
1455 		return i;
1456 	((struct compat_console_font_op *)op)->data = (unsigned long)op->data;
1457 	if (copy_to_user(fontop, op, sizeof(struct compat_console_font_op)))
1458 		return -EFAULT;
1459 	return 0;
1460 }
1461 
1462 struct compat_unimapdesc {
1463 	unsigned short entry_ct;
1464 	compat_caddr_t entries;
1465 };
1466 
1467 static inline int
1468 compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud,
1469 			 int perm, struct vc_data *vc)
1470 {
1471 	struct compat_unimapdesc tmp;
1472 	struct unipair __user *tmp_entries;
1473 
1474 	if (copy_from_user(&tmp, user_ud, sizeof tmp))
1475 		return -EFAULT;
1476 	tmp_entries = compat_ptr(tmp.entries);
1477 	if (tmp_entries)
1478 		if (!access_ok(VERIFY_WRITE, tmp_entries,
1479 				tmp.entry_ct*sizeof(struct unipair)))
1480 			return -EFAULT;
1481 	switch (cmd) {
1482 	case PIO_UNIMAP:
1483 		if (!perm)
1484 			return -EPERM;
1485 		return con_set_unimap(vc, tmp.entry_ct, tmp_entries);
1486 	case GIO_UNIMAP:
1487 		if (!perm && fg_console != vc->vc_num)
1488 			return -EPERM;
1489 		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp_entries);
1490 	}
1491 	return 0;
1492 }
1493 
1494 long vt_compat_ioctl(struct tty_struct *tty, struct file * file,
1495 	     unsigned int cmd, unsigned long arg)
1496 {
1497 	struct vc_data *vc = tty->driver_data;
1498 	struct console_font_op op;	/* used in multiple places here */
1499 	struct kbd_struct *kbd;
1500 	unsigned int console;
1501 	void __user *up = (void __user *)arg;
1502 	int perm;
1503 	int ret = 0;
1504 
1505 	console = vc->vc_num;
1506 
1507 	tty_lock();
1508 
1509 	if (!vc_cons_allocated(console)) { 	/* impossible? */
1510 		ret = -ENOIOCTLCMD;
1511 		goto out;
1512 	}
1513 
1514 	/*
1515 	 * To have permissions to do most of the vt ioctls, we either have
1516 	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
1517 	 */
1518 	perm = 0;
1519 	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
1520 		perm = 1;
1521 
1522 	kbd = kbd_table + console;
1523 	switch (cmd) {
1524 	/*
1525 	 * these need special handlers for incompatible data structures
1526 	 */
1527 	case PIO_FONTX:
1528 	case GIO_FONTX:
1529 		ret = compat_fontx_ioctl(cmd, up, perm, &op);
1530 		break;
1531 
1532 	case KDFONTOP:
1533 		ret = compat_kdfontop_ioctl(up, perm, &op, vc);
1534 		break;
1535 
1536 	case PIO_UNIMAP:
1537 	case GIO_UNIMAP:
1538 		ret = compat_unimap_ioctl(cmd, up, perm, vc);
1539 		break;
1540 
1541 	/*
1542 	 * all these treat 'arg' as an integer
1543 	 */
1544 	case KIOCSOUND:
1545 	case KDMKTONE:
1546 #ifdef CONFIG_X86
1547 	case KDADDIO:
1548 	case KDDELIO:
1549 #endif
1550 	case KDSETMODE:
1551 	case KDMAPDISP:
1552 	case KDUNMAPDISP:
1553 	case KDSKBMODE:
1554 	case KDSKBMETA:
1555 	case KDSKBLED:
1556 	case KDSETLED:
1557 	case KDSIGACCEPT:
1558 	case VT_ACTIVATE:
1559 	case VT_WAITACTIVE:
1560 	case VT_RELDISP:
1561 	case VT_DISALLOCATE:
1562 	case VT_RESIZE:
1563 	case VT_RESIZEX:
1564 		goto fallback;
1565 
1566 	/*
1567 	 * the rest has a compatible data structure behind arg,
1568 	 * but we have to convert it to a proper 64 bit pointer.
1569 	 */
1570 	default:
1571 		arg = (unsigned long)compat_ptr(arg);
1572 		goto fallback;
1573 	}
1574 out:
1575 	tty_unlock();
1576 	return ret;
1577 
1578 fallback:
1579 	tty_unlock();
1580 	return vt_ioctl(tty, file, cmd, arg);
1581 }
1582 
1583 
1584 #endif /* CONFIG_COMPAT */
1585 
1586 
1587 /*
1588  * Performs the back end of a vt switch. Called under the console
1589  * semaphore.
1590  */
1591 static void complete_change_console(struct vc_data *vc)
1592 {
1593 	unsigned char old_vc_mode;
1594 	int old = fg_console;
1595 
1596 	last_console = fg_console;
1597 
1598 	/*
1599 	 * If we're switching, we could be going from KD_GRAPHICS to
1600 	 * KD_TEXT mode or vice versa, which means we need to blank or
1601 	 * unblank the screen later.
1602 	 */
1603 	old_vc_mode = vc_cons[fg_console].d->vc_mode;
1604 	switch_screen(vc);
1605 
1606 	/*
1607 	 * This can't appear below a successful kill_pid().  If it did,
1608 	 * then the *blank_screen operation could occur while X, having
1609 	 * received acqsig, is waking up on another processor.  This
1610 	 * condition can lead to overlapping accesses to the VGA range
1611 	 * and the framebuffer (causing system lockups).
1612 	 *
1613 	 * To account for this we duplicate this code below only if the
1614 	 * controlling process is gone and we've called reset_vc.
1615 	 */
1616 	if (old_vc_mode != vc->vc_mode) {
1617 		if (vc->vc_mode == KD_TEXT)
1618 			do_unblank_screen(1);
1619 		else
1620 			do_blank_screen(1);
1621 	}
1622 
1623 	/*
1624 	 * If this new console is under process control, send it a signal
1625 	 * telling it that it has acquired. Also check if it has died and
1626 	 * clean up (similar to logic employed in change_console())
1627 	 */
1628 	if (vc->vt_mode.mode == VT_PROCESS) {
1629 		/*
1630 		 * Send the signal as privileged - kill_pid() will
1631 		 * tell us if the process has gone or something else
1632 		 * is awry
1633 		 */
1634 		if (kill_pid(vc->vt_pid, vc->vt_mode.acqsig, 1) != 0) {
1635 		/*
1636 		 * The controlling process has died, so we revert back to
1637 		 * normal operation. In this case, we'll also change back
1638 		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1639 		 * but it saves the agony when the X server dies and the screen
1640 		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1641 		 * this outside of VT_PROCESS but there is no single process
1642 		 * to account for and tracking tty count may be undesirable.
1643 		 */
1644 			reset_vc(vc);
1645 
1646 			if (old_vc_mode != vc->vc_mode) {
1647 				if (vc->vc_mode == KD_TEXT)
1648 					do_unblank_screen(1);
1649 				else
1650 					do_blank_screen(1);
1651 			}
1652 		}
1653 	}
1654 
1655 	/*
1656 	 * Wake anyone waiting for their VT to activate
1657 	 */
1658 	vt_event_post(VT_EVENT_SWITCH, old, vc->vc_num);
1659 	return;
1660 }
1661 
1662 /*
1663  * Performs the front-end of a vt switch
1664  */
1665 void change_console(struct vc_data *new_vc)
1666 {
1667 	struct vc_data *vc;
1668 
1669 	if (!new_vc || new_vc->vc_num == fg_console || vt_dont_switch)
1670 		return;
1671 
1672 	/*
1673 	 * If this vt is in process mode, then we need to handshake with
1674 	 * that process before switching. Essentially, we store where that
1675 	 * vt wants to switch to and wait for it to tell us when it's done
1676 	 * (via VT_RELDISP ioctl).
1677 	 *
1678 	 * We also check to see if the controlling process still exists.
1679 	 * If it doesn't, we reset this vt to auto mode and continue.
1680 	 * This is a cheap way to track process control. The worst thing
1681 	 * that can happen is: we send a signal to a process, it dies, and
1682 	 * the switch gets "lost" waiting for a response; hopefully, the
1683 	 * user will try again, we'll detect the process is gone (unless
1684 	 * the user waits just the right amount of time :-) and revert the
1685 	 * vt to auto control.
1686 	 */
1687 	vc = vc_cons[fg_console].d;
1688 	if (vc->vt_mode.mode == VT_PROCESS) {
1689 		/*
1690 		 * Send the signal as privileged - kill_pid() will
1691 		 * tell us if the process has gone or something else
1692 		 * is awry.
1693 		 *
1694 		 * We need to set vt_newvt *before* sending the signal or we
1695 		 * have a race.
1696 		 */
1697 		vc->vt_newvt = new_vc->vc_num;
1698 		if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) {
1699 			/*
1700 			 * It worked. Mark the vt to switch to and
1701 			 * return. The process needs to send us a
1702 			 * VT_RELDISP ioctl to complete the switch.
1703 			 */
1704 			return;
1705 		}
1706 
1707 		/*
1708 		 * The controlling process has died, so we revert back to
1709 		 * normal operation. In this case, we'll also change back
1710 		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1711 		 * but it saves the agony when the X server dies and the screen
1712 		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1713 		 * this outside of VT_PROCESS but there is no single process
1714 		 * to account for and tracking tty count may be undesirable.
1715 		 */
1716 		reset_vc(vc);
1717 
1718 		/*
1719 		 * Fall through to normal (VT_AUTO) handling of the switch...
1720 		 */
1721 	}
1722 
1723 	/*
1724 	 * Ignore all switches in KD_GRAPHICS+VT_AUTO mode
1725 	 */
1726 	if (vc->vc_mode == KD_GRAPHICS)
1727 		return;
1728 
1729 	complete_change_console(new_vc);
1730 }
1731 
1732 /* Perform a kernel triggered VT switch for suspend/resume */
1733 
1734 static int disable_vt_switch;
1735 
1736 int vt_move_to_console(unsigned int vt, int alloc)
1737 {
1738 	int prev;
1739 
1740 	console_lock();
1741 	/* Graphics mode - up to X */
1742 	if (disable_vt_switch) {
1743 		console_unlock();
1744 		return 0;
1745 	}
1746 	prev = fg_console;
1747 
1748 	if (alloc && vc_allocate(vt)) {
1749 		/* we can't have a free VC for now. Too bad,
1750 		 * we don't want to mess the screen for now. */
1751 		console_unlock();
1752 		return -ENOSPC;
1753 	}
1754 
1755 	if (set_console(vt)) {
1756 		/*
1757 		 * We're unable to switch to the SUSPEND_CONSOLE.
1758 		 * Let the calling function know so it can decide
1759 		 * what to do.
1760 		 */
1761 		console_unlock();
1762 		return -EIO;
1763 	}
1764 	console_unlock();
1765 	tty_lock();
1766 	if (vt_waitactive(vt + 1)) {
1767 		pr_debug("Suspend: Can't switch VCs.");
1768 		tty_unlock();
1769 		return -EINTR;
1770 	}
1771 	tty_unlock();
1772 	return prev;
1773 }
1774 
1775 /*
1776  * Normally during a suspend, we allocate a new console and switch to it.
1777  * When we resume, we switch back to the original console.  This switch
1778  * can be slow, so on systems where the framebuffer can handle restoration
1779  * of video registers anyways, there's little point in doing the console
1780  * switch.  This function allows you to disable it by passing it '0'.
1781  */
1782 void pm_set_vt_switch(int do_switch)
1783 {
1784 	console_lock();
1785 	disable_vt_switch = !do_switch;
1786 	console_unlock();
1787 }
1788 EXPORT_SYMBOL(pm_set_vt_switch);
1789