vt_ioctl.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 *  Copyright (C) 1992 obz under the linux copyright
   4 *
   5 *  Dynamic diacritical handling - aeb@cwi.nl - Dec 1993
   6 *  Dynamic keymap and string allocation - aeb@cwi.nl - May 1994
   7 *  Restrict VT switching via ioctl() - grif@cs.ucr.edu - Dec 1995
   8 *  Some code moved for less code duplication - Andi Kleen - Mar 1997
   9 *  Check put/get_user, cleanups - acme@conectiva.com.br - Jun 2001
  10 */
  11
  12#include <linux/types.h>
  13#include <linux/errno.h>
  14#include <linux/sched/signal.h>
  15#include <linux/tty.h>
  16#include <linux/timer.h>
  17#include <linux/kernel.h>
  18#include <linux/compat.h>
  19#include <linux/module.h>
  20#include <linux/kd.h>
  21#include <linux/vt.h>
  22#include <linux/string.h>
  23#include <linux/slab.h>
  24#include <linux/major.h>
  25#include <linux/fs.h>
  26#include <linux/console.h>
  27#include <linux/consolemap.h>
  28#include <linux/signal.h>
  29#include <linux/suspend.h>
  30#include <linux/timex.h>
  31
  32#include <asm/io.h>
  33#include <linux/uaccess.h>
  34
  35#include <linux/nospec.h>
  36
  37#include <linux/kbd_kern.h>
  38#include <linux/vt_kern.h>
  39#include <linux/kbd_diacr.h>
  40#include <linux/selection.h>
  41
  42bool vt_dont_switch;
  43
  44static inline bool vt_in_use(unsigned int i)
  45{
  46	const struct vc_data *vc = vc_cons[i].d;
  47
  48	/*
  49	 * console_lock must be held to prevent the vc from being deallocated
  50	 * while we're checking whether it's in-use.
  51	 */
  52	WARN_CONSOLE_UNLOCKED();
  53
  54	return vc && kref_read(&vc->port.kref) > 1;
  55}
  56
  57static inline bool vt_busy(int i)
  58{
  59	if (vt_in_use(i))
  60		return true;
  61	if (i == fg_console)
  62		return true;
  63	if (vc_is_sel(vc_cons[i].d))
  64		return true;
  65
  66	return false;
  67}
  68
  69/*
  70 * Console (vt and kd) routines, as defined by USL SVR4 manual, and by
  71 * experimentation and study of X386 SYSV handling.
  72 *
  73 * One point of difference: SYSV vt's are /dev/vtX, which X >= 0, and
  74 * /dev/console is a separate ttyp. Under Linux, /dev/tty0 is /dev/console,
  75 * and the vc start at /dev/ttyX, X >= 1. We maintain that here, so we will
  76 * always treat our set of vt as numbered 1..MAX_NR_CONSOLES (corresponding to
  77 * ttys 0..MAX_NR_CONSOLES-1). Explicitly naming VT 0 is illegal, but using
  78 * /dev/tty0 (fg_console) as a target is legal, since an implicit aliasing
  79 * to the current console is done by the main ioctl code.
  80 */
  81
  82#ifdef CONFIG_X86
  83#include <asm/syscalls.h>
  84#endif
  85
  86static void complete_change_console(struct vc_data *vc);
  87
  88/*
  89 *	User space VT_EVENT handlers
  90 */
  91
  92struct vt_event_wait {
  93	struct list_head list;
  94	struct vt_event event;
  95	int done;
  96};
  97
  98static LIST_HEAD(vt_events);
  99static DEFINE_SPINLOCK(vt_event_lock);
 100static DECLARE_WAIT_QUEUE_HEAD(vt_event_waitqueue);
 101
 102/**
 103 *	vt_event_post
 104 *	@event: the event that occurred
 105 *	@old: old console
 106 *	@new: new console
 107 *
 108 *	Post an VT event to interested VT handlers
 109 */
 110
 111void vt_event_post(unsigned int event, unsigned int old, unsigned int new)
 112{
 113	struct list_head *pos, *head;
 114	unsigned long flags;
 115	int wake = 0;
 116
 117	spin_lock_irqsave(&vt_event_lock, flags);
 118	head = &vt_events;
 119
 120	list_for_each(pos, head) {
 121		struct vt_event_wait *ve = list_entry(pos,
 122						struct vt_event_wait, list);
 123		if (!(ve->event.event & event))
 124			continue;
 125		ve->event.event = event;
 126		/* kernel view is consoles 0..n-1, user space view is
 127		   console 1..n with 0 meaning current, so we must bias */
 128		ve->event.oldev = old + 1;
 129		ve->event.newev = new + 1;
 130		wake = 1;
 131		ve->done = 1;
 132	}
 133	spin_unlock_irqrestore(&vt_event_lock, flags);
 134	if (wake)
 135		wake_up_interruptible(&vt_event_waitqueue);
 136}
 137
 138static void __vt_event_queue(struct vt_event_wait *vw)
 139{
 140	unsigned long flags;
 141	/* Prepare the event */
 142	INIT_LIST_HEAD(&vw->list);
 143	vw->done = 0;
 144	/* Queue our event */
 145	spin_lock_irqsave(&vt_event_lock, flags);
 146	list_add(&vw->list, &vt_events);
 147	spin_unlock_irqrestore(&vt_event_lock, flags);
 148}
 149
 150static void __vt_event_wait(struct vt_event_wait *vw)
 151{
 152	/* Wait for it to pass */
 153	wait_event_interruptible(vt_event_waitqueue, vw->done);
 154}
 155
 156static void __vt_event_dequeue(struct vt_event_wait *vw)
 157{
 158	unsigned long flags;
 159
 160	/* Dequeue it */
 161	spin_lock_irqsave(&vt_event_lock, flags);
 162	list_del(&vw->list);
 163	spin_unlock_irqrestore(&vt_event_lock, flags);
 164}
 165
 166/**
 167 *	vt_event_wait		-	wait for an event
 168 *	@vw: our event
 169 *
 170 *	Waits for an event to occur which completes our vt_event_wait
 171 *	structure. On return the structure has wv->done set to 1 for success
 172 *	or 0 if some event such as a signal ended the wait.
 173 */
 174
 175static void vt_event_wait(struct vt_event_wait *vw)
 176{
 177	__vt_event_queue(vw);
 178	__vt_event_wait(vw);
 179	__vt_event_dequeue(vw);
 180}
 181
 182/**
 183 *	vt_event_wait_ioctl	-	event ioctl handler
 184 *	@event: argument to ioctl (the event)
 185 *
 186 *	Implement the VT_WAITEVENT ioctl using the VT event interface
 187 */
 188
 189static int vt_event_wait_ioctl(struct vt_event __user *event)
 190{
 191	struct vt_event_wait vw;
 192
 193	if (copy_from_user(&vw.event, event, sizeof(struct vt_event)))
 194		return -EFAULT;
 195	/* Highest supported event for now */
 196	if (vw.event.event & ~VT_MAX_EVENT)
 197		return -EINVAL;
 198
 199	vt_event_wait(&vw);
 200	/* If it occurred report it */
 201	if (vw.done) {
 202		if (copy_to_user(event, &vw.event, sizeof(struct vt_event)))
 203			return -EFAULT;
 204		return 0;
 205	}
 206	return -EINTR;
 207}
 208
 209/**
 210 *	vt_waitactive	-	active console wait
 211 *	@n: new console
 212 *
 213 *	Helper for event waits. Used to implement the legacy
 214 *	event waiting ioctls in terms of events
 215 */
 216
 217int vt_waitactive(int n)
 218{
 219	struct vt_event_wait vw;
 220	do {
 221		vw.event.event = VT_EVENT_SWITCH;
 222		__vt_event_queue(&vw);
 223		if (n == fg_console + 1) {
 224			__vt_event_dequeue(&vw);
 225			break;
 226		}
 227		__vt_event_wait(&vw);
 228		__vt_event_dequeue(&vw);
 229		if (vw.done == 0)
 230			return -EINTR;
 231	} while (vw.event.newev != n);
 232	return 0;
 233}
 234
 235/*
 236 * these are the valid i/o ports we're allowed to change. they map all the
 237 * video ports
 238 */
 239#define GPFIRST 0x3b4
 240#define GPLAST 0x3df
 241#define GPNUM (GPLAST - GPFIRST + 1)
 242
 243/*
 244 * currently, setting the mode from KD_TEXT to KD_GRAPHICS doesn't do a whole
 245 * lot. i'm not sure if it should do any restoration of modes or what...
 246 *
 247 * XXX It should at least call into the driver, fbdev's definitely need to
 248 * restore their engine state. --BenH
 249 *
 250 * Called with the console lock held.
 251 */
 252static int vt_kdsetmode(struct vc_data *vc, unsigned long mode)
 253{
 254	switch (mode) {
 255	case KD_GRAPHICS:
 256		break;
 257	case KD_TEXT0:
 258	case KD_TEXT1:
 259		mode = KD_TEXT;
 260		fallthrough;
 261	case KD_TEXT:
 262		break;
 263	default:
 264		return -EINVAL;
 265	}
 266
 267	if (vc->vc_mode == mode)
 268		return 0;
 269
 270	vc->vc_mode = mode;
 271	if (vc->vc_num != fg_console)
 272		return 0;
 273
 274	/* explicitly blank/unblank the screen if switching modes */
 275	if (mode == KD_TEXT)
 276		do_unblank_screen(1);
 277	else
 278		do_blank_screen(1);
 279
 280	return 0;
 281}
 282
 283static int vt_k_ioctl(struct tty_struct *tty, unsigned int cmd,
 284		unsigned long arg, bool perm)
 285{
 286	struct vc_data *vc = tty->driver_data;
 287	void __user *up = (void __user *)arg;
 288	unsigned int console = vc->vc_num;
 289	int ret;
 290
 291	switch (cmd) {
 292	case KIOCSOUND:
 293		if (!perm)
 294			return -EPERM;
 295		/*
 296		 * The use of PIT_TICK_RATE is historic, it used to be
 297		 * the platform-dependent CLOCK_TICK_RATE between 2.6.12
 298		 * and 2.6.36, which was a minor but unfortunate ABI
 299		 * change. kd_mksound is locked by the input layer.
 300		 */
 301		if (arg)
 302			arg = PIT_TICK_RATE / arg;
 303		kd_mksound(arg, 0);
 304		break;
 305
 306	case KDMKTONE:
 307		if (!perm)
 308			return -EPERM;
 309	{
 310		unsigned int ticks, count;
 311
 312		/*
 313		 * Generate the tone for the appropriate number of ticks.
 314		 * If the time is zero, turn off sound ourselves.
 315		 */
 316		ticks = msecs_to_jiffies((arg >> 16) & 0xffff);
 317		count = ticks ? (arg & 0xffff) : 0;
 318		if (count)
 319			count = PIT_TICK_RATE / count;
 320		kd_mksound(count, ticks);
 321		break;
 322	}
 323
 324	case KDGKBTYPE:
 325		/*
 326		 * this is naïve.
 327		 */
 328		return put_user(KB_101, (char __user *)arg);
 329
 330		/*
 331		 * These cannot be implemented on any machine that implements
 332		 * ioperm() in user level (such as Alpha PCs) or not at all.
 333		 *
 334		 * XXX: you should never use these, just call ioperm directly..
 335		 */
 336#ifdef CONFIG_X86
 337	case KDADDIO:
 338	case KDDELIO:
 339		/*
 340		 * KDADDIO and KDDELIO may be able to add ports beyond what
 341		 * we reject here, but to be safe...
 342		 *
 343		 * These are locked internally via sys_ioperm
 344		 */
 345		if (arg < GPFIRST || arg > GPLAST)
 346			return -EINVAL;
 347
 348		return ksys_ioperm(arg, 1, (cmd == KDADDIO)) ? -ENXIO : 0;
 349
 350	case KDENABIO:
 351	case KDDISABIO:
 352		return ksys_ioperm(GPFIRST, GPNUM,
 353				  (cmd == KDENABIO)) ? -ENXIO : 0;
 354#endif
 355
 356	/* Linux m68k/i386 interface for setting the keyboard delay/repeat rate */
 357
 358	case KDKBDREP:
 359	{
 360		struct kbd_repeat kbrep;
 361
 362		if (!capable(CAP_SYS_TTY_CONFIG))
 363			return -EPERM;
 364
 365		if (copy_from_user(&kbrep, up, sizeof(struct kbd_repeat)))
 366			return -EFAULT;
 367
 368		ret = kbd_rate(&kbrep);
 369		if (ret)
 370			return ret;
 371		if (copy_to_user(up, &kbrep, sizeof(struct kbd_repeat)))
 372			return -EFAULT;
 373		break;
 374	}
 375
 376	case KDSETMODE: {
 377		if (!perm)
 378			return -EPERM;
 379
 380		guard(console_lock)();
 381		return vt_kdsetmode(vc, arg);
 382	}
 383	case KDGETMODE:
 384		return put_user(vc->vc_mode, (int __user *)arg);
 385
 386	case KDMAPDISP:
 387	case KDUNMAPDISP:
 388		/*
 389		 * these work like a combination of mmap and KDENABIO.
 390		 * this could be easily finished.
 391		 */
 392		return -EINVAL;
 393
 394	case KDSKBMODE:
 395		if (!perm)
 396			return -EPERM;
 397		ret = vt_do_kdskbmode(console, arg);
 398		if (ret)
 399			return ret;
 400		tty_ldisc_flush(tty);
 401		break;
 402
 403	case KDGKBMODE:
 404		return put_user(vt_do_kdgkbmode(console), (int __user *)arg);
 405
 406	/* this could be folded into KDSKBMODE, but for compatibility
 407	   reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */
 408	case KDSKBMETA:
 409		return vt_do_kdskbmeta(console, arg);
 410
 411	case KDGKBMETA:
 412		/* FIXME: should review whether this is worth locking */
 413		return put_user(vt_do_kdgkbmeta(console), (int __user *)arg);
 414
 415	case KDGETKEYCODE:
 416	case KDSETKEYCODE:
 417		if(!capable(CAP_SYS_TTY_CONFIG))
 418			perm = 0;
 419		return vt_do_kbkeycode_ioctl(cmd, up, perm);
 420
 421	case KDGKBENT:
 422	case KDSKBENT:
 423		return vt_do_kdsk_ioctl(cmd, up, perm, console);
 424
 425	case KDGKBSENT:
 426	case KDSKBSENT:
 427		return vt_do_kdgkb_ioctl(cmd, up, perm);
 428
 429	/* Diacritical processing. Handled in keyboard.c as it has
 430	   to operate on the keyboard locks and structures */
 431	case KDGKBDIACR:
 432	case KDGKBDIACRUC:
 433	case KDSKBDIACR:
 434	case KDSKBDIACRUC:
 435		return vt_do_diacrit(cmd, up, perm);
 436
 437	/* the ioctls below read/set the flags usually shown in the leds */
 438	/* don't use them - they will go away without warning */
 439	case KDGKBLED:
 440	case KDSKBLED:
 441	case KDGETLED:
 442	case KDSETLED:
 443		return vt_do_kdskled(console, cmd, arg, perm);
 444
 445	/*
 446	 * A process can indicate its willingness to accept signals
 447	 * generated by pressing an appropriate key combination.
 448	 * Thus, one can have a daemon that e.g. spawns a new console
 449	 * upon a keypress and then changes to it.
 450	 * See also the kbrequest field of inittab(5).
 451	 */
 452	case KDSIGACCEPT:
 453		if (!perm || !capable(CAP_KILL))
 454			return -EPERM;
 455		if (!valid_signal(arg) || arg < 1 || arg == SIGKILL)
 456			return -EINVAL;
 457
 458		spin_lock_irq(&vt_spawn_con.lock);
 459		put_pid(vt_spawn_con.pid);
 460		vt_spawn_con.pid = get_pid(task_pid(current));
 461		vt_spawn_con.sig = arg;
 462		spin_unlock_irq(&vt_spawn_con.lock);
 463		break;
 464
 465	case KDFONTOP: {
 466		struct console_font_op op;
 467
 468		if (copy_from_user(&op, up, sizeof(op)))
 469			return -EFAULT;
 470		if (!perm && op.op != KD_FONT_OP_GET)
 471			return -EPERM;
 472		ret = con_font_op(vc, &op);
 473		if (ret)
 474			return ret;
 475		if (copy_to_user(up, &op, sizeof(op)))
 476			return -EFAULT;
 477		break;
 478	}
 479
 480	default:
 481		return -ENOIOCTLCMD;
 482	}
 483
 484	return 0;
 485}
 486
 487static inline int do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud,
 488		bool perm, struct vc_data *vc)
 489{
 490	struct unimapdesc tmp;
 491
 492	if (copy_from_user(&tmp, user_ud, sizeof tmp))
 493		return -EFAULT;
 494	switch (cmd) {
 495	case PIO_UNIMAP:
 496		if (!perm)
 497			return -EPERM;
 498		return con_set_unimap(vc, tmp.entry_ct, tmp.entries);
 499	case GIO_UNIMAP:
 500		if (!perm && fg_console != vc->vc_num)
 501			return -EPERM;
 502		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct),
 503				tmp.entries);
 504	}
 505	return 0;
 506}
 507
 508static int vt_io_ioctl(struct vc_data *vc, unsigned int cmd, void __user *up,
 509		bool perm)
 510{
 511	switch (cmd) {
 512	case PIO_CMAP:
 513		if (!perm)
 514			return -EPERM;
 515		return con_set_cmap(up);
 516
 517	case GIO_CMAP:
 518		return con_get_cmap(up);
 519
 520	case PIO_SCRNMAP:
 521		if (!perm)
 522			return -EPERM;
 523		return con_set_trans_old(up);
 524
 525	case GIO_SCRNMAP:
 526		return con_get_trans_old(up);
 527
 528	case PIO_UNISCRNMAP:
 529		if (!perm)
 530			return -EPERM;
 531		return con_set_trans_new(up);
 532
 533	case GIO_UNISCRNMAP:
 534		return con_get_trans_new(up);
 535
 536	case PIO_UNIMAPCLR:
 537		if (!perm)
 538			return -EPERM;
 539		con_clear_unimap(vc);
 540		break;
 541
 542	case PIO_UNIMAP:
 543	case GIO_UNIMAP:
 544		return do_unimap_ioctl(cmd, up, perm, vc);
 545
 546	default:
 547		return -ENOIOCTLCMD;
 548	}
 549
 550	return 0;
 551}
 552
 553static int vt_reldisp(struct vc_data *vc, unsigned int swtch)
 554{
 555	int newvt, ret;
 556
 557	if (vc->vt_mode.mode != VT_PROCESS)
 558		return -EINVAL;
 559
 560	/* Switched-to response */
 561	if (vc->vt_newvt < 0) {
 562		 /* If it's just an ACK, ignore it */
 563		return swtch == VT_ACKACQ ? 0 : -EINVAL;
 564	}
 565
 566	/* Switching-from response */
 567	if (swtch == 0) {
 568		/* Switch disallowed, so forget we were trying to do it. */
 569		vc->vt_newvt = -1;
 570		return 0;
 571	}
 572
 573	/* The current vt has been released, so complete the switch. */
 574	newvt = vc->vt_newvt;
 575	vc->vt_newvt = -1;
 576	ret = vc_allocate(newvt);
 577	if (ret)
 578		return ret;
 579
 580	/*
 581	 * When we actually do the console switch, make sure we are atomic with
 582	 * respect to other console switches..
 583	 */
 584	complete_change_console(vc_cons[newvt].d);
 585
 586	return 0;
 587}
 588
 589static int vt_setactivate(struct vt_setactivate __user *sa)
 590{
 591	struct vt_setactivate vsa;
 592	struct vc_data *nvc;
 593	int ret;
 594
 595	if (copy_from_user(&vsa, sa, sizeof(vsa)))
 596		return -EFAULT;
 597	if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
 598		return -ENXIO;
 599
 600	vsa.console--;
 601	vsa.console = array_index_nospec(vsa.console, MAX_NR_CONSOLES);
 602	scoped_guard(console_lock) {
 603		ret = vc_allocate(vsa.console);
 604		if (ret)
 605			return ret;
 606
 607		/*
 608		 * This is safe providing we don't drop the console sem between
 609		 * vc_allocate and finishing referencing nvc.
 610		 */
 611		nvc = vc_cons[vsa.console].d;
 612		nvc->vt_mode = vsa.mode;
 613		nvc->vt_mode.frsig = 0;
 614		put_pid(nvc->vt_pid);
 615		nvc->vt_pid = get_pid(task_pid(current));
 616	}
 617
 618	/* Commence switch and lock */
 619	/* Review set_console locks */
 620	set_console(vsa.console);
 621
 622	return 0;
 623}
 624
 625/* deallocate a single console, if possible (leave 0) */
 626static int vt_disallocate(unsigned int vc_num)
 627{
 628	struct vc_data *vc = NULL;
 629
 630	scoped_guard(console_lock) {
 631		if (vt_busy(vc_num))
 632			return -EBUSY;
 633		if (vc_num)
 634			vc = vc_deallocate(vc_num);
 635	}
 636
 637	if (vc && vc_num >= MIN_NR_CONSOLES)
 638		tty_port_put(&vc->port);
 639
 640	return 0;
 641}
 642
 643/* deallocate all unused consoles, but leave 0 */
 644static void vt_disallocate_all(void)
 645{
 646	struct vc_data *vc[MAX_NR_CONSOLES];
 647	int i;
 648
 649	scoped_guard(console_lock)
 650		for (i = 1; i < MAX_NR_CONSOLES; i++)
 651			if (!vt_busy(i))
 652				vc[i] = vc_deallocate(i);
 653			else
 654				vc[i] = NULL;
 655
 656	for (i = 1; i < MAX_NR_CONSOLES; i++) {
 657		if (vc[i] && i >= MIN_NR_CONSOLES)
 658			tty_port_put(&vc[i]->port);
 659	}
 660}
 661
 662static int vt_resizex(struct vc_data *vc, struct vt_consize __user *cs)
 663{
 664	struct vt_consize v;
 665	int i;
 666
 667	if (copy_from_user(&v, cs, sizeof(struct vt_consize)))
 668		return -EFAULT;
 669
 670	/* FIXME: Should check the copies properly */
 671	if (!v.v_vlin)
 672		v.v_vlin = vc->vc_scan_lines;
 673
 674	if (v.v_clin) {
 675		int rows = v.v_vlin / v.v_clin;
 676		if (v.v_rows != rows) {
 677			if (v.v_rows) /* Parameters don't add up */
 678				return -EINVAL;
 679			v.v_rows = rows;
 680		}
 681	}
 682
 683	if (v.v_vcol && v.v_ccol) {
 684		int cols = v.v_vcol / v.v_ccol;
 685		if (v.v_cols != cols) {
 686			if (v.v_cols)
 687				return -EINVAL;
 688			v.v_cols = cols;
 689		}
 690	}
 691
 692	if (v.v_clin > 32)
 693		return -EINVAL;
 694
 695	for (i = 0; i < MAX_NR_CONSOLES; i++) {
 696		struct vc_data *vcp;
 697
 698		if (!vc_cons[i].d)
 699			continue;
 700		guard(console_lock)();
 701		vcp = vc_cons[i].d;
 702		if (vcp) {
 703			int ret;
 704			int save_scan_lines = vcp->vc_scan_lines;
 705			int save_cell_height = vcp->vc_cell_height;
 706
 707			if (v.v_vlin)
 708				vcp->vc_scan_lines = v.v_vlin;
 709			if (v.v_clin)
 710				vcp->vc_cell_height = v.v_clin;
 711			ret = __vc_resize(vcp, v.v_cols, v.v_rows, true);
 712			if (ret) {
 713				vcp->vc_scan_lines = save_scan_lines;
 714				vcp->vc_cell_height = save_cell_height;
 715				return ret;
 716			}
 717		}
 718	}
 719
 720	return 0;
 721}
 722
 723/*
 724 * We handle the console-specific ioctl's here.  We allow the
 725 * capability to modify any console, not just the fg_console.
 726 */
 727int vt_ioctl(struct tty_struct *tty,
 728	     unsigned int cmd, unsigned long arg)
 729{
 730	struct vc_data *vc = tty->driver_data;
 731	void __user *up = (void __user *)arg;
 732	int i, perm;
 733	int ret;
 734
 735	/*
 736	 * To have permissions to do most of the vt ioctls, we either have
 737	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
 738	 */
 739	perm = 0;
 740	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
 741		perm = 1;
 742
 743	ret = vt_k_ioctl(tty, cmd, arg, perm);
 744	if (ret != -ENOIOCTLCMD)
 745		return ret;
 746
 747	ret = vt_io_ioctl(vc, cmd, up, perm);
 748	if (ret != -ENOIOCTLCMD)
 749		return ret;
 750
 751	switch (cmd) {
 752	case TIOCLINUX:
 753		return tioclinux(tty, arg);
 754	case VT_SETMODE:
 755	{
 756		struct vt_mode tmp;
 757
 758		if (!perm)
 759			return -EPERM;
 760		if (copy_from_user(&tmp, up, sizeof(struct vt_mode)))
 761			return -EFAULT;
 762		if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS)
 763			return -EINVAL;
 764
 765		guard(console_lock)();
 766		vc->vt_mode = tmp;
 767		/* the frsig is ignored, so we set it to 0 */
 768		vc->vt_mode.frsig = 0;
 769		put_pid(vc->vt_pid);
 770		vc->vt_pid = get_pid(task_pid(current));
 771		/* no switch is required -- saw@shade.msu.ru */
 772		vc->vt_newvt = -1;
 773		break;
 774	}
 775
 776	case VT_GETMODE:
 777	{
 778		struct vt_mode tmp;
 779		int rc;
 780
 781		scoped_guard(console_lock)
 782			memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode));
 783
 784		rc = copy_to_user(up, &tmp, sizeof(struct vt_mode));
 785		if (rc)
 786			return -EFAULT;
 787		break;
 788	}
 789
 790	/*
 791	 * Returns global vt state. Note that VT 0 is always open, since
 792	 * it's an alias for the current VT, and people can't use it here.
 793	 * We cannot return state for more than 16 VTs, since v_state is short.
 794	 */
 795	case VT_GETSTATE:
 796	{
 797		struct vt_stat __user *vtstat = up;
 798		unsigned short state, mask;
 799
 800		if (put_user(fg_console + 1, &vtstat->v_active))
 801			return -EFAULT;
 802
 803		state = 1;	/* /dev/tty0 is always open */
 804		scoped_guard(console_lock) /* required by vt_in_use() */
 805			for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask; ++i, mask <<= 1)
 806				if (vt_in_use(i))
 807					state |= mask;
 808		return put_user(state, &vtstat->v_state);
 809	}
 810
 811	/*
 812	 * Returns the first available (non-opened) console.
 813	 */
 814	case VT_OPENQRY:
 815		scoped_guard(console_lock) /* required by vt_in_use() */
 816			for (i = 0; i < MAX_NR_CONSOLES; ++i)
 817				if (!vt_in_use(i))
 818					break;
 819		i = i < MAX_NR_CONSOLES ? (i+1) : -1;
 820		return put_user(i, (int __user *)arg);
 821
 822	/*
 823	 * ioctl(fd, VT_ACTIVATE, num) will cause us to switch to vt # num,
 824	 * with num >= 1 (switches to vt 0, our console, are not allowed, just
 825	 * to preserve sanity).
 826	 */
 827	case VT_ACTIVATE:
 828		if (!perm)
 829			return -EPERM;
 830		if (arg == 0 || arg > MAX_NR_CONSOLES)
 831			return -ENXIO;
 832
 833		arg--;
 834		arg = array_index_nospec(arg, MAX_NR_CONSOLES);
 835		scoped_guard(console_lock) {
 836			ret = vc_allocate(arg);
 837			if (ret)
 838				return ret;
 839		}
 840		set_console(arg);
 841		break;
 842
 843	case VT_SETACTIVATE:
 844		if (!perm)
 845			return -EPERM;
 846
 847		return vt_setactivate(up);
 848
 849	/*
 850	 * wait until the specified VT has been activated
 851	 */
 852	case VT_WAITACTIVE:
 853		if (!perm)
 854			return -EPERM;
 855		if (arg == 0 || arg > MAX_NR_CONSOLES)
 856			return -ENXIO;
 857		return vt_waitactive(arg);
 858
 859	/*
 860	 * If a vt is under process control, the kernel will not switch to it
 861	 * immediately, but postpone the operation until the process calls this
 862	 * ioctl, allowing the switch to complete.
 863	 *
 864	 * According to the X sources this is the behavior:
 865	 *	0:	pending switch-from not OK
 866	 *	1:	pending switch-from OK
 867	 *	2:	completed switch-to OK
 868	 */
 869	case VT_RELDISP:
 870	{
 871		if (!perm)
 872			return -EPERM;
 873
 874		guard(console_lock)();
 875		return vt_reldisp(vc, arg);
 876	}
 877
 878	 /*
 879	  * Disallocate memory associated to VT (but leave VT1)
 880	  */
 881	 case VT_DISALLOCATE:
 882		if (arg > MAX_NR_CONSOLES)
 883			return -ENXIO;
 884
 885		if (arg == 0) {
 886			vt_disallocate_all();
 887			break;
 888		}
 889
 890		arg = array_index_nospec(arg - 1, MAX_NR_CONSOLES);
 891		return vt_disallocate(arg);
 892
 893	case VT_RESIZE:
 894	{
 895		struct vt_sizes __user *vtsizes = up;
 896		struct vc_data *vc;
 897		ushort ll,cc;
 898
 899		if (!perm)
 900			return -EPERM;
 901		if (get_user(ll, &vtsizes->v_rows) ||
 902		    get_user(cc, &vtsizes->v_cols))
 903			return -EFAULT;
 904
 905		guard(console_lock)();
 906		for (i = 0; i < MAX_NR_CONSOLES; i++) {
 907			vc = vc_cons[i].d;
 908
 909			if (vc) {
 910				/* FIXME: review v tty lock */
 911				ret = __vc_resize(vc_cons[i].d, cc, ll, true);
 912				if (ret)
 913					return ret;
 914			}
 915		}
 916		break;
 917	}
 918
 919	case VT_RESIZEX:
 920		if (!perm)
 921			return -EPERM;
 922
 923		return vt_resizex(vc, up);
 924
 925	case VT_LOCKSWITCH:
 926		if (!capable(CAP_SYS_TTY_CONFIG))
 927			return -EPERM;
 928		vt_dont_switch = true;
 929		break;
 930	case VT_UNLOCKSWITCH:
 931		if (!capable(CAP_SYS_TTY_CONFIG))
 932			return -EPERM;
 933		vt_dont_switch = false;
 934		break;
 935	case VT_GETHIFONTMASK:
 936		return put_user(vc->vc_hi_font_mask,
 937					(unsigned short __user *)arg);
 938	case VT_WAITEVENT:
 939		return vt_event_wait_ioctl((struct vt_event __user *)arg);
 940
 941	case VT_GETCONSIZECSRPOS:
 942	{
 943		struct vt_consizecsrpos concsr;
 944
 945		console_lock();
 946		concsr.con_cols = vc->vc_cols;
 947		concsr.con_rows = vc->vc_rows;
 948		concsr.csr_col = vc->state.x;
 949		concsr.csr_row = vc->state.y;
 950		console_unlock();
 951		if (copy_to_user(up, &concsr, sizeof(concsr)))
 952			return -EFAULT;
 953		return 0;
 954	}
 955
 956	default:
 957		return -ENOIOCTLCMD;
 958	}
 959
 960	return 0;
 961}
 962
 963void reset_vc(struct vc_data *vc)
 964{
 965	vc->vc_mode = KD_TEXT;
 966	vt_reset_unicode(vc->vc_num);
 967	vc->vt_mode.mode = VT_AUTO;
 968	vc->vt_mode.waitv = 0;
 969	vc->vt_mode.relsig = 0;
 970	vc->vt_mode.acqsig = 0;
 971	vc->vt_mode.frsig = 0;
 972	put_pid(vc->vt_pid);
 973	vc->vt_pid = NULL;
 974	vc->vt_newvt = -1;
 975	reset_palette(vc);
 976}
 977
 978void vc_SAK(struct work_struct *work)
 979{
 980	struct vc *vc_con =
 981		container_of(work, struct vc, SAK_work);
 982	struct vc_data *vc;
 983	struct tty_struct *tty;
 984
 985	guard(console_lock)();
 986	vc = vc_con->d;
 987	if (!vc)
 988		return;
 989
 990	/* FIXME: review tty ref counting */
 991	tty = vc->port.tty;
 992	/* SAK should also work in all raw modes and reset them properly. */
 993	if (tty)
 994		__do_SAK(tty);
 995	reset_vc(vc);
 996}
 997
 998#ifdef CONFIG_COMPAT
 999
1000struct compat_console_font_op {
1001	compat_uint_t op;        /* operation code KD_FONT_OP_* */
1002	compat_uint_t flags;     /* KD_FONT_FLAG_* */
1003	compat_uint_t width, height;     /* font size */
1004	compat_uint_t charcount;
1005	compat_caddr_t data;    /* font data with height fixed to 32 */
1006};
1007
1008static inline int
1009compat_kdfontop_ioctl(struct compat_console_font_op __user *fontop,
1010			 int perm, struct console_font_op *op, struct vc_data *vc)
1011{
1012	int i;
1013
1014	if (copy_from_user(op, fontop, sizeof(struct compat_console_font_op)))
1015		return -EFAULT;
1016	if (!perm && op->op != KD_FONT_OP_GET)
1017		return -EPERM;
1018	op->data = compat_ptr(((struct compat_console_font_op *)op)->data);
1019	i = con_font_op(vc, op);
1020	if (i)
1021		return i;
1022	((struct compat_console_font_op *)op)->data = (unsigned long)op->data;
1023	if (copy_to_user(fontop, op, sizeof(struct compat_console_font_op)))
1024		return -EFAULT;
1025	return 0;
1026}
1027
1028struct compat_unimapdesc {
1029	unsigned short entry_ct;
1030	compat_caddr_t entries;
1031};
1032
1033static inline int
1034compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud,
1035			 int perm, struct vc_data *vc)
1036{
1037	struct compat_unimapdesc tmp;
1038	struct unipair __user *tmp_entries;
1039
1040	if (copy_from_user(&tmp, user_ud, sizeof tmp))
1041		return -EFAULT;
1042	tmp_entries = compat_ptr(tmp.entries);
1043	switch (cmd) {
1044	case PIO_UNIMAP:
1045		if (!perm)
1046			return -EPERM;
1047		return con_set_unimap(vc, tmp.entry_ct, tmp_entries);
1048	case GIO_UNIMAP:
1049		if (!perm && fg_console != vc->vc_num)
1050			return -EPERM;
1051		return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp_entries);
1052	}
1053	return 0;
1054}
1055
1056long vt_compat_ioctl(struct tty_struct *tty,
1057	     unsigned int cmd, unsigned long arg)
1058{
1059	struct vc_data *vc = tty->driver_data;
1060	struct console_font_op op;	/* used in multiple places here */
1061	void __user *up = compat_ptr(arg);
1062	int perm;
1063
1064	/*
1065	 * To have permissions to do most of the vt ioctls, we either have
1066	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
1067	 */
1068	perm = 0;
1069	if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
1070		perm = 1;
1071
1072	switch (cmd) {
1073	/*
1074	 * these need special handlers for incompatible data structures
1075	 */
1076
1077	case KDFONTOP:
1078		return compat_kdfontop_ioctl(up, perm, &op, vc);
1079
1080	case PIO_UNIMAP:
1081	case GIO_UNIMAP:
1082		return compat_unimap_ioctl(cmd, up, perm, vc);
1083
1084	/*
1085	 * all these treat 'arg' as an integer
1086	 */
1087	case KIOCSOUND:
1088	case KDMKTONE:
1089#ifdef CONFIG_X86
1090	case KDADDIO:
1091	case KDDELIO:
1092#endif
1093	case KDSETMODE:
1094	case KDMAPDISP:
1095	case KDUNMAPDISP:
1096	case KDSKBMODE:
1097	case KDSKBMETA:
1098	case KDSKBLED:
1099	case KDSETLED:
1100	case KDSIGACCEPT:
1101	case VT_ACTIVATE:
1102	case VT_WAITACTIVE:
1103	case VT_RELDISP:
1104	case VT_DISALLOCATE:
1105		return vt_ioctl(tty, cmd, arg);
1106
1107	/*
1108	 * the rest has a compatible data structure behind arg,
1109	 * but we have to convert it to a proper 64 bit pointer.
1110	 */
1111	default:
1112		return vt_ioctl(tty, cmd, (unsigned long)up);
1113	}
1114}
1115
1116
1117#endif /* CONFIG_COMPAT */
1118
1119
1120/*
1121 * Performs the back end of a vt switch. Called under the console
1122 * semaphore.
1123 */
1124static void complete_change_console(struct vc_data *vc)
1125{
1126	unsigned char old_vc_mode;
1127	int old = fg_console;
1128
1129	last_console = fg_console;
1130
1131	/*
1132	 * If we're switching, we could be going from KD_GRAPHICS to
1133	 * KD_TEXT mode or vice versa, which means we need to blank or
1134	 * unblank the screen later.
1135	 */
1136	old_vc_mode = vc_cons[fg_console].d->vc_mode;
1137	switch_screen(vc);
1138
1139	/*
1140	 * This can't appear below a successful kill_pid().  If it did,
1141	 * then the *blank_screen operation could occur while X, having
1142	 * received acqsig, is waking up on another processor.  This
1143	 * condition can lead to overlapping accesses to the VGA range
1144	 * and the framebuffer (causing system lockups).
1145	 *
1146	 * To account for this we duplicate this code below only if the
1147	 * controlling process is gone and we've called reset_vc.
1148	 */
1149	if (old_vc_mode != vc->vc_mode) {
1150		if (vc->vc_mode == KD_TEXT)
1151			do_unblank_screen(1);
1152		else
1153			do_blank_screen(1);
1154	}
1155
1156	/*
1157	 * If this new console is under process control, send it a signal
1158	 * telling it that it has acquired. Also check if it has died and
1159	 * clean up (similar to logic employed in change_console())
1160	 */
1161	if (vc->vt_mode.mode == VT_PROCESS) {
1162		/*
1163		 * Send the signal as privileged - kill_pid() will
1164		 * tell us if the process has gone or something else
1165		 * is awry
1166		 */
1167		if (kill_pid(vc->vt_pid, vc->vt_mode.acqsig, 1) != 0) {
1168		/*
1169		 * The controlling process has died, so we revert back to
1170		 * normal operation. In this case, we'll also change back
1171		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1172		 * but it saves the agony when the X server dies and the screen
1173		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1174		 * this outside of VT_PROCESS but there is no single process
1175		 * to account for and tracking tty count may be undesirable.
1176		 */
1177			reset_vc(vc);
1178
1179			if (old_vc_mode != vc->vc_mode) {
1180				if (vc->vc_mode == KD_TEXT)
1181					do_unblank_screen(1);
1182				else
1183					do_blank_screen(1);
1184			}
1185		}
1186	}
1187
1188	/*
1189	 * Wake anyone waiting for their VT to activate
1190	 */
1191	vt_event_post(VT_EVENT_SWITCH, old, vc->vc_num);
1192	return;
1193}
1194
1195/*
1196 * Performs the front-end of a vt switch
1197 */
1198void change_console(struct vc_data *new_vc)
1199{
1200	struct vc_data *vc;
1201
1202	if (!new_vc || new_vc->vc_num == fg_console || vt_dont_switch)
1203		return;
1204
1205	/*
1206	 * If this vt is in process mode, then we need to handshake with
1207	 * that process before switching. Essentially, we store where that
1208	 * vt wants to switch to and wait for it to tell us when it's done
1209	 * (via VT_RELDISP ioctl).
1210	 *
1211	 * We also check to see if the controlling process still exists.
1212	 * If it doesn't, we reset this vt to auto mode and continue.
1213	 * This is a cheap way to track process control. The worst thing
1214	 * that can happen is: we send a signal to a process, it dies, and
1215	 * the switch gets "lost" waiting for a response; hopefully, the
1216	 * user will try again, we'll detect the process is gone (unless
1217	 * the user waits just the right amount of time :-) and revert the
1218	 * vt to auto control.
1219	 */
1220	vc = vc_cons[fg_console].d;
1221	if (vc->vt_mode.mode == VT_PROCESS) {
1222		/*
1223		 * Send the signal as privileged - kill_pid() will
1224		 * tell us if the process has gone or something else
1225		 * is awry.
1226		 *
1227		 * We need to set vt_newvt *before* sending the signal or we
1228		 * have a race.
1229		 */
1230		vc->vt_newvt = new_vc->vc_num;
1231		if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) {
1232			/*
1233			 * It worked. Mark the vt to switch to and
1234			 * return. The process needs to send us a
1235			 * VT_RELDISP ioctl to complete the switch.
1236			 */
1237			return;
1238		}
1239
1240		/*
1241		 * The controlling process has died, so we revert back to
1242		 * normal operation. In this case, we'll also change back
1243		 * to KD_TEXT mode. I'm not sure if this is strictly correct
1244		 * but it saves the agony when the X server dies and the screen
1245		 * remains blanked due to KD_GRAPHICS! It would be nice to do
1246		 * this outside of VT_PROCESS but there is no single process
1247		 * to account for and tracking tty count may be undesirable.
1248		 */
1249		reset_vc(vc);
1250
1251		/*
1252		 * Fall through to normal (VT_AUTO) handling of the switch...
1253		 */
1254	}
1255
1256	/*
1257	 * Ignore all switches in KD_GRAPHICS+VT_AUTO mode
1258	 */
1259	if (vc->vc_mode == KD_GRAPHICS)
1260		return;
1261
1262	complete_change_console(new_vc);
1263}
1264
1265/* Perform a kernel triggered VT switch for suspend/resume */
1266
1267static int disable_vt_switch;
1268
1269int vt_move_to_console(unsigned int vt, int alloc)
1270{
1271	int prev;
1272
1273	scoped_guard(console_lock) {
1274		/* Graphics mode - up to X */
1275		if (disable_vt_switch)
1276			return 0;
1277
1278		prev = fg_console;
1279
1280		if (alloc && vc_allocate(vt)) {
1281			/*
1282			 * We can't have a free VC for now. Too bad, we don't want to mess the
1283			 * screen for now.
1284			 */
1285			return -ENOSPC;
1286		}
1287
1288		if (set_console(vt)) {
1289			/*
1290			 * We're unable to switch to the SUSPEND_CONSOLE. Let the calling function
1291			 * know so it can decide what to do.
1292			 */
1293			return -EIO;
1294		}
1295	}
1296	if (vt_waitactive(vt + 1)) {
1297		pr_debug("Suspend: Can't switch VCs.");
1298		return -EINTR;
1299	}
1300	return prev;
1301}
1302
1303/*
1304 * Normally during a suspend, we allocate a new console and switch to it.
1305 * When we resume, we switch back to the original console.  This switch
1306 * can be slow, so on systems where the framebuffer can handle restoration
1307 * of video registers anyways, there's little point in doing the console
1308 * switch.  This function allows you to disable it by passing it '0'.
1309 */
1310void pm_set_vt_switch(int do_switch)
1311{
1312	guard(console_lock)();
1313	disable_vt_switch = !do_switch;
1314}
1315EXPORT_SYMBOL(pm_set_vt_switch);