1 /* 2 * Copyright (C) 1992 obz under the linux copyright 3 * 4 * Dynamic diacritical handling - aeb@cwi.nl - Dec 1993 5 * Dynamic keymap and string allocation - aeb@cwi.nl - May 1994 6 * Restrict VT switching via ioctl() - grif@cs.ucr.edu - Dec 1995 7 * Some code moved for less code duplication - Andi Kleen - Mar 1997 8 * Check put/get_user, cleanups - acme@conectiva.com.br - Jun 2001 9 */ 10 11 #include <linux/types.h> 12 #include <linux/errno.h> 13 #include <linux/sched.h> 14 #include <linux/tty.h> 15 #include <linux/timer.h> 16 #include <linux/kernel.h> 17 #include <linux/compat.h> 18 #include <linux/module.h> 19 #include <linux/kd.h> 20 #include <linux/vt.h> 21 #include <linux/string.h> 22 #include <linux/slab.h> 23 #include <linux/major.h> 24 #include <linux/fs.h> 25 #include <linux/console.h> 26 #include <linux/consolemap.h> 27 #include <linux/signal.h> 28 #include <linux/timex.h> 29 30 #include <asm/io.h> 31 #include <asm/uaccess.h> 32 33 #include <linux/kbd_kern.h> 34 #include <linux/vt_kern.h> 35 #include <linux/kbd_diacr.h> 36 #include <linux/selection.h> 37 38 char vt_dont_switch; 39 extern struct tty_driver *console_driver; 40 41 #define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count) 42 #define VT_BUSY(i) (VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons) 43 44 /* 45 * Console (vt and kd) routines, as defined by USL SVR4 manual, and by 46 * experimentation and study of X386 SYSV handling. 47 * 48 * One point of difference: SYSV vt's are /dev/vtX, which X >= 0, and 49 * /dev/console is a separate ttyp. Under Linux, /dev/tty0 is /dev/console, 50 * and the vc start at /dev/ttyX, X >= 1. We maintain that here, so we will 51 * always treat our set of vt as numbered 1..MAX_NR_CONSOLES (corresponding to 52 * ttys 0..MAX_NR_CONSOLES-1). Explicitly naming VT 0 is illegal, but using 53 * /dev/tty0 (fg_console) as a target is legal, since an implicit aliasing 54 * to the current console is done by the main ioctl code. 55 */ 56 57 #ifdef CONFIG_X86 58 #include <linux/syscalls.h> 59 #endif 60 61 static void complete_change_console(struct vc_data *vc); 62 63 /* 64 * User space VT_EVENT handlers 65 */ 66 67 struct vt_event_wait { 68 struct list_head list; 69 struct vt_event event; 70 int done; 71 }; 72 73 static LIST_HEAD(vt_events); 74 static DEFINE_SPINLOCK(vt_event_lock); 75 static DECLARE_WAIT_QUEUE_HEAD(vt_event_waitqueue); 76 77 /** 78 * vt_event_post 79 * @event: the event that occurred 80 * @old: old console 81 * @new: new console 82 * 83 * Post an VT event to interested VT handlers 84 */ 85 86 void vt_event_post(unsigned int event, unsigned int old, unsigned int new) 87 { 88 struct list_head *pos, *head; 89 unsigned long flags; 90 int wake = 0; 91 92 spin_lock_irqsave(&vt_event_lock, flags); 93 head = &vt_events; 94 95 list_for_each(pos, head) { 96 struct vt_event_wait *ve = list_entry(pos, 97 struct vt_event_wait, list); 98 if (!(ve->event.event & event)) 99 continue; 100 ve->event.event = event; 101 /* kernel view is consoles 0..n-1, user space view is 102 console 1..n with 0 meaning current, so we must bias */ 103 ve->event.oldev = old + 1; 104 ve->event.newev = new + 1; 105 wake = 1; 106 ve->done = 1; 107 } 108 spin_unlock_irqrestore(&vt_event_lock, flags); 109 if (wake) 110 wake_up_interruptible(&vt_event_waitqueue); 111 } 112 113 /** 114 * vt_event_wait - wait for an event 115 * @vw: our event 116 * 117 * Waits for an event to occur which completes our vt_event_wait 118 * structure. On return the structure has wv->done set to 1 for success 119 * or 0 if some event such as a signal ended the wait. 120 */ 121 122 static void vt_event_wait(struct vt_event_wait *vw) 123 { 124 unsigned long flags; 125 /* Prepare the event */ 126 INIT_LIST_HEAD(&vw->list); 127 vw->done = 0; 128 /* Queue our event */ 129 spin_lock_irqsave(&vt_event_lock, flags); 130 list_add(&vw->list, &vt_events); 131 spin_unlock_irqrestore(&vt_event_lock, flags); 132 /* Wait for it to pass */ 133 wait_event_interruptible(vt_event_waitqueue, vw->done); 134 /* Dequeue it */ 135 spin_lock_irqsave(&vt_event_lock, flags); 136 list_del(&vw->list); 137 spin_unlock_irqrestore(&vt_event_lock, flags); 138 } 139 140 /** 141 * vt_event_wait_ioctl - event ioctl handler 142 * @arg: argument to ioctl 143 * 144 * Implement the VT_WAITEVENT ioctl using the VT event interface 145 */ 146 147 static int vt_event_wait_ioctl(struct vt_event __user *event) 148 { 149 struct vt_event_wait vw; 150 151 if (copy_from_user(&vw.event, event, sizeof(struct vt_event))) 152 return -EFAULT; 153 /* Highest supported event for now */ 154 if (vw.event.event & ~VT_MAX_EVENT) 155 return -EINVAL; 156 157 vt_event_wait(&vw); 158 /* If it occurred report it */ 159 if (vw.done) { 160 if (copy_to_user(event, &vw.event, sizeof(struct vt_event))) 161 return -EFAULT; 162 return 0; 163 } 164 return -EINTR; 165 } 166 167 /** 168 * vt_waitactive - active console wait 169 * @event: event code 170 * @n: new console 171 * 172 * Helper for event waits. Used to implement the legacy 173 * event waiting ioctls in terms of events 174 */ 175 176 int vt_waitactive(int n) 177 { 178 struct vt_event_wait vw; 179 do { 180 if (n == fg_console + 1) 181 break; 182 vw.event.event = VT_EVENT_SWITCH; 183 vt_event_wait(&vw); 184 if (vw.done == 0) 185 return -EINTR; 186 } while (vw.event.newev != n); 187 return 0; 188 } 189 190 /* 191 * these are the valid i/o ports we're allowed to change. they map all the 192 * video ports 193 */ 194 #define GPFIRST 0x3b4 195 #define GPLAST 0x3df 196 #define GPNUM (GPLAST - GPFIRST + 1) 197 198 199 200 static inline int 201 do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) 202 { 203 struct consolefontdesc cfdarg; 204 int i; 205 206 if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc))) 207 return -EFAULT; 208 209 switch (cmd) { 210 case PIO_FONTX: 211 if (!perm) 212 return -EPERM; 213 op->op = KD_FONT_OP_SET; 214 op->flags = KD_FONT_FLAG_OLD; 215 op->width = 8; 216 op->height = cfdarg.charheight; 217 op->charcount = cfdarg.charcount; 218 op->data = cfdarg.chardata; 219 return con_font_op(vc_cons[fg_console].d, op); 220 case GIO_FONTX: { 221 op->op = KD_FONT_OP_GET; 222 op->flags = KD_FONT_FLAG_OLD; 223 op->width = 8; 224 op->height = cfdarg.charheight; 225 op->charcount = cfdarg.charcount; 226 op->data = cfdarg.chardata; 227 i = con_font_op(vc_cons[fg_console].d, op); 228 if (i) 229 return i; 230 cfdarg.charheight = op->height; 231 cfdarg.charcount = op->charcount; 232 if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc))) 233 return -EFAULT; 234 return 0; 235 } 236 } 237 return -EINVAL; 238 } 239 240 static inline int 241 do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc) 242 { 243 struct unimapdesc tmp; 244 245 if (copy_from_user(&tmp, user_ud, sizeof tmp)) 246 return -EFAULT; 247 if (tmp.entries) 248 if (!access_ok(VERIFY_WRITE, tmp.entries, 249 tmp.entry_ct*sizeof(struct unipair))) 250 return -EFAULT; 251 switch (cmd) { 252 case PIO_UNIMAP: 253 if (!perm) 254 return -EPERM; 255 return con_set_unimap(vc, tmp.entry_ct, tmp.entries); 256 case GIO_UNIMAP: 257 if (!perm && fg_console != vc->vc_num) 258 return -EPERM; 259 return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp.entries); 260 } 261 return 0; 262 } 263 264 265 266 /* 267 * We handle the console-specific ioctl's here. We allow the 268 * capability to modify any console, not just the fg_console. 269 */ 270 int vt_ioctl(struct tty_struct *tty, 271 unsigned int cmd, unsigned long arg) 272 { 273 struct vc_data *vc = tty->driver_data; 274 struct console_font_op op; /* used in multiple places here */ 275 unsigned int console; 276 unsigned char ucval; 277 unsigned int uival; 278 void __user *up = (void __user *)arg; 279 int i, perm; 280 int ret = 0; 281 282 console = vc->vc_num; 283 284 285 if (!vc_cons_allocated(console)) { /* impossible? */ 286 ret = -ENOIOCTLCMD; 287 goto out; 288 } 289 290 291 /* 292 * To have permissions to do most of the vt ioctls, we either have 293 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG. 294 */ 295 perm = 0; 296 if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG)) 297 perm = 1; 298 299 switch (cmd) { 300 case TIOCLINUX: 301 ret = tioclinux(tty, arg); 302 break; 303 case KIOCSOUND: 304 if (!perm) 305 return -EPERM; 306 /* 307 * The use of PIT_TICK_RATE is historic, it used to be 308 * the platform-dependent CLOCK_TICK_RATE between 2.6.12 309 * and 2.6.36, which was a minor but unfortunate ABI 310 * change. kd_mksound is locked by the input layer. 311 */ 312 if (arg) 313 arg = PIT_TICK_RATE / arg; 314 kd_mksound(arg, 0); 315 break; 316 317 case KDMKTONE: 318 if (!perm) 319 return -EPERM; 320 { 321 unsigned int ticks, count; 322 323 /* 324 * Generate the tone for the appropriate number of ticks. 325 * If the time is zero, turn off sound ourselves. 326 */ 327 ticks = HZ * ((arg >> 16) & 0xffff) / 1000; 328 count = ticks ? (arg & 0xffff) : 0; 329 if (count) 330 count = PIT_TICK_RATE / count; 331 kd_mksound(count, ticks); 332 break; 333 } 334 335 case KDGKBTYPE: 336 /* 337 * this is naïve. 338 */ 339 ucval = KB_101; 340 ret = put_user(ucval, (char __user *)arg); 341 break; 342 343 /* 344 * These cannot be implemented on any machine that implements 345 * ioperm() in user level (such as Alpha PCs) or not at all. 346 * 347 * XXX: you should never use these, just call ioperm directly.. 348 */ 349 #ifdef CONFIG_X86 350 case KDADDIO: 351 case KDDELIO: 352 /* 353 * KDADDIO and KDDELIO may be able to add ports beyond what 354 * we reject here, but to be safe... 355 * 356 * These are locked internally via sys_ioperm 357 */ 358 if (arg < GPFIRST || arg > GPLAST) { 359 ret = -EINVAL; 360 break; 361 } 362 ret = sys_ioperm(arg, 1, (cmd == KDADDIO)) ? -ENXIO : 0; 363 break; 364 365 case KDENABIO: 366 case KDDISABIO: 367 ret = sys_ioperm(GPFIRST, GPNUM, 368 (cmd == KDENABIO)) ? -ENXIO : 0; 369 break; 370 #endif 371 372 /* Linux m68k/i386 interface for setting the keyboard delay/repeat rate */ 373 374 case KDKBDREP: 375 { 376 struct kbd_repeat kbrep; 377 378 if (!capable(CAP_SYS_TTY_CONFIG)) 379 return -EPERM; 380 381 if (copy_from_user(&kbrep, up, sizeof(struct kbd_repeat))) { 382 ret = -EFAULT; 383 break; 384 } 385 ret = kbd_rate(&kbrep); 386 if (ret) 387 break; 388 if (copy_to_user(up, &kbrep, sizeof(struct kbd_repeat))) 389 ret = -EFAULT; 390 break; 391 } 392 393 case KDSETMODE: 394 /* 395 * currently, setting the mode from KD_TEXT to KD_GRAPHICS 396 * doesn't do a whole lot. i'm not sure if it should do any 397 * restoration of modes or what... 398 * 399 * XXX It should at least call into the driver, fbdev's definitely 400 * need to restore their engine state. --BenH 401 */ 402 if (!perm) 403 return -EPERM; 404 switch (arg) { 405 case KD_GRAPHICS: 406 break; 407 case KD_TEXT0: 408 case KD_TEXT1: 409 arg = KD_TEXT; 410 case KD_TEXT: 411 break; 412 default: 413 ret = -EINVAL; 414 goto out; 415 } 416 /* FIXME: this needs the console lock extending */ 417 if (vc->vc_mode == (unsigned char) arg) 418 break; 419 vc->vc_mode = (unsigned char) arg; 420 if (console != fg_console) 421 break; 422 /* 423 * explicitly blank/unblank the screen if switching modes 424 */ 425 console_lock(); 426 if (arg == KD_TEXT) 427 do_unblank_screen(1); 428 else 429 do_blank_screen(1); 430 console_unlock(); 431 break; 432 433 case KDGETMODE: 434 uival = vc->vc_mode; 435 goto setint; 436 437 case KDMAPDISP: 438 case KDUNMAPDISP: 439 /* 440 * these work like a combination of mmap and KDENABIO. 441 * this could be easily finished. 442 */ 443 ret = -EINVAL; 444 break; 445 446 case KDSKBMODE: 447 if (!perm) 448 return -EPERM; 449 ret = vt_do_kdskbmode(console, arg); 450 if (ret == 0) 451 tty_ldisc_flush(tty); 452 break; 453 454 case KDGKBMODE: 455 uival = vt_do_kdgkbmode(console); 456 ret = put_user(uival, (int __user *)arg); 457 break; 458 459 /* this could be folded into KDSKBMODE, but for compatibility 460 reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */ 461 case KDSKBMETA: 462 ret = vt_do_kdskbmeta(console, arg); 463 break; 464 465 case KDGKBMETA: 466 /* FIXME: should review whether this is worth locking */ 467 uival = vt_do_kdgkbmeta(console); 468 setint: 469 ret = put_user(uival, (int __user *)arg); 470 break; 471 472 case KDGETKEYCODE: 473 case KDSETKEYCODE: 474 if(!capable(CAP_SYS_TTY_CONFIG)) 475 perm = 0; 476 ret = vt_do_kbkeycode_ioctl(cmd, up, perm); 477 break; 478 479 case KDGKBENT: 480 case KDSKBENT: 481 ret = vt_do_kdsk_ioctl(cmd, up, perm, console); 482 break; 483 484 case KDGKBSENT: 485 case KDSKBSENT: 486 ret = vt_do_kdgkb_ioctl(cmd, up, perm); 487 break; 488 489 /* Diacritical processing. Handled in keyboard.c as it has 490 to operate on the keyboard locks and structures */ 491 case KDGKBDIACR: 492 case KDGKBDIACRUC: 493 case KDSKBDIACR: 494 case KDSKBDIACRUC: 495 ret = vt_do_diacrit(cmd, up, perm); 496 break; 497 498 /* the ioctls below read/set the flags usually shown in the leds */ 499 /* don't use them - they will go away without warning */ 500 case KDGKBLED: 501 case KDSKBLED: 502 case KDGETLED: 503 case KDSETLED: 504 ret = vt_do_kdskled(console, cmd, arg, perm); 505 break; 506 507 /* 508 * A process can indicate its willingness to accept signals 509 * generated by pressing an appropriate key combination. 510 * Thus, one can have a daemon that e.g. spawns a new console 511 * upon a keypress and then changes to it. 512 * See also the kbrequest field of inittab(5). 513 */ 514 case KDSIGACCEPT: 515 { 516 if (!perm || !capable(CAP_KILL)) 517 return -EPERM; 518 if (!valid_signal(arg) || arg < 1 || arg == SIGKILL) 519 ret = -EINVAL; 520 else { 521 spin_lock_irq(&vt_spawn_con.lock); 522 put_pid(vt_spawn_con.pid); 523 vt_spawn_con.pid = get_pid(task_pid(current)); 524 vt_spawn_con.sig = arg; 525 spin_unlock_irq(&vt_spawn_con.lock); 526 } 527 break; 528 } 529 530 case VT_SETMODE: 531 { 532 struct vt_mode tmp; 533 534 if (!perm) 535 return -EPERM; 536 if (copy_from_user(&tmp, up, sizeof(struct vt_mode))) { 537 ret = -EFAULT; 538 goto out; 539 } 540 if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS) { 541 ret = -EINVAL; 542 goto out; 543 } 544 console_lock(); 545 vc->vt_mode = tmp; 546 /* the frsig is ignored, so we set it to 0 */ 547 vc->vt_mode.frsig = 0; 548 put_pid(vc->vt_pid); 549 vc->vt_pid = get_pid(task_pid(current)); 550 /* no switch is required -- saw@shade.msu.ru */ 551 vc->vt_newvt = -1; 552 console_unlock(); 553 break; 554 } 555 556 case VT_GETMODE: 557 { 558 struct vt_mode tmp; 559 int rc; 560 561 console_lock(); 562 memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode)); 563 console_unlock(); 564 565 rc = copy_to_user(up, &tmp, sizeof(struct vt_mode)); 566 if (rc) 567 ret = -EFAULT; 568 break; 569 } 570 571 /* 572 * Returns global vt state. Note that VT 0 is always open, since 573 * it's an alias for the current VT, and people can't use it here. 574 * We cannot return state for more than 16 VTs, since v_state is short. 575 */ 576 case VT_GETSTATE: 577 { 578 struct vt_stat __user *vtstat = up; 579 unsigned short state, mask; 580 581 /* Review: FIXME: Console lock ? */ 582 if (put_user(fg_console + 1, &vtstat->v_active)) 583 ret = -EFAULT; 584 else { 585 state = 1; /* /dev/tty0 is always open */ 586 for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask; 587 ++i, mask <<= 1) 588 if (VT_IS_IN_USE(i)) 589 state |= mask; 590 ret = put_user(state, &vtstat->v_state); 591 } 592 break; 593 } 594 595 /* 596 * Returns the first available (non-opened) console. 597 */ 598 case VT_OPENQRY: 599 /* FIXME: locking ? - but then this is a stupid API */ 600 for (i = 0; i < MAX_NR_CONSOLES; ++i) 601 if (! VT_IS_IN_USE(i)) 602 break; 603 uival = i < MAX_NR_CONSOLES ? (i+1) : -1; 604 goto setint; 605 606 /* 607 * ioctl(fd, VT_ACTIVATE, num) will cause us to switch to vt # num, 608 * with num >= 1 (switches to vt 0, our console, are not allowed, just 609 * to preserve sanity). 610 */ 611 case VT_ACTIVATE: 612 if (!perm) 613 return -EPERM; 614 if (arg == 0 || arg > MAX_NR_CONSOLES) 615 ret = -ENXIO; 616 else { 617 arg--; 618 console_lock(); 619 ret = vc_allocate(arg); 620 console_unlock(); 621 if (ret) 622 break; 623 set_console(arg); 624 } 625 break; 626 627 case VT_SETACTIVATE: 628 { 629 struct vt_setactivate vsa; 630 631 if (!perm) 632 return -EPERM; 633 634 if (copy_from_user(&vsa, (struct vt_setactivate __user *)arg, 635 sizeof(struct vt_setactivate))) { 636 ret = -EFAULT; 637 goto out; 638 } 639 if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) 640 ret = -ENXIO; 641 else { 642 vsa.console--; 643 console_lock(); 644 ret = vc_allocate(vsa.console); 645 if (ret == 0) { 646 struct vc_data *nvc; 647 /* This is safe providing we don't drop the 648 console sem between vc_allocate and 649 finishing referencing nvc */ 650 nvc = vc_cons[vsa.console].d; 651 nvc->vt_mode = vsa.mode; 652 nvc->vt_mode.frsig = 0; 653 put_pid(nvc->vt_pid); 654 nvc->vt_pid = get_pid(task_pid(current)); 655 } 656 console_unlock(); 657 if (ret) 658 break; 659 /* Commence switch and lock */ 660 /* Review set_console locks */ 661 set_console(vsa.console); 662 } 663 break; 664 } 665 666 /* 667 * wait until the specified VT has been activated 668 */ 669 case VT_WAITACTIVE: 670 if (!perm) 671 return -EPERM; 672 if (arg == 0 || arg > MAX_NR_CONSOLES) 673 ret = -ENXIO; 674 else 675 ret = vt_waitactive(arg); 676 break; 677 678 /* 679 * If a vt is under process control, the kernel will not switch to it 680 * immediately, but postpone the operation until the process calls this 681 * ioctl, allowing the switch to complete. 682 * 683 * According to the X sources this is the behavior: 684 * 0: pending switch-from not OK 685 * 1: pending switch-from OK 686 * 2: completed switch-to OK 687 */ 688 case VT_RELDISP: 689 if (!perm) 690 return -EPERM; 691 692 console_lock(); 693 if (vc->vt_mode.mode != VT_PROCESS) { 694 console_unlock(); 695 ret = -EINVAL; 696 break; 697 } 698 /* 699 * Switching-from response 700 */ 701 if (vc->vt_newvt >= 0) { 702 if (arg == 0) 703 /* 704 * Switch disallowed, so forget we were trying 705 * to do it. 706 */ 707 vc->vt_newvt = -1; 708 709 else { 710 /* 711 * The current vt has been released, so 712 * complete the switch. 713 */ 714 int newvt; 715 newvt = vc->vt_newvt; 716 vc->vt_newvt = -1; 717 ret = vc_allocate(newvt); 718 if (ret) { 719 console_unlock(); 720 break; 721 } 722 /* 723 * When we actually do the console switch, 724 * make sure we are atomic with respect to 725 * other console switches.. 726 */ 727 complete_change_console(vc_cons[newvt].d); 728 } 729 } else { 730 /* 731 * Switched-to response 732 */ 733 /* 734 * If it's just an ACK, ignore it 735 */ 736 if (arg != VT_ACKACQ) 737 ret = -EINVAL; 738 } 739 console_unlock(); 740 break; 741 742 /* 743 * Disallocate memory associated to VT (but leave VT1) 744 */ 745 case VT_DISALLOCATE: 746 if (arg > MAX_NR_CONSOLES) { 747 ret = -ENXIO; 748 break; 749 } 750 if (arg == 0) { 751 /* deallocate all unused consoles, but leave 0 */ 752 console_lock(); 753 for (i=1; i<MAX_NR_CONSOLES; i++) 754 if (! VT_BUSY(i)) 755 vc_deallocate(i); 756 console_unlock(); 757 } else { 758 /* deallocate a single console, if possible */ 759 arg--; 760 if (VT_BUSY(arg)) 761 ret = -EBUSY; 762 else if (arg) { /* leave 0 */ 763 console_lock(); 764 vc_deallocate(arg); 765 console_unlock(); 766 } 767 } 768 break; 769 770 case VT_RESIZE: 771 { 772 struct vt_sizes __user *vtsizes = up; 773 struct vc_data *vc; 774 775 ushort ll,cc; 776 if (!perm) 777 return -EPERM; 778 if (get_user(ll, &vtsizes->v_rows) || 779 get_user(cc, &vtsizes->v_cols)) 780 ret = -EFAULT; 781 else { 782 console_lock(); 783 for (i = 0; i < MAX_NR_CONSOLES; i++) { 784 vc = vc_cons[i].d; 785 786 if (vc) { 787 vc->vc_resize_user = 1; 788 /* FIXME: review v tty lock */ 789 vc_resize(vc_cons[i].d, cc, ll); 790 } 791 } 792 console_unlock(); 793 } 794 break; 795 } 796 797 case VT_RESIZEX: 798 { 799 struct vt_consize __user *vtconsize = up; 800 ushort ll,cc,vlin,clin,vcol,ccol; 801 if (!perm) 802 return -EPERM; 803 if (!access_ok(VERIFY_READ, vtconsize, 804 sizeof(struct vt_consize))) { 805 ret = -EFAULT; 806 break; 807 } 808 /* FIXME: Should check the copies properly */ 809 __get_user(ll, &vtconsize->v_rows); 810 __get_user(cc, &vtconsize->v_cols); 811 __get_user(vlin, &vtconsize->v_vlin); 812 __get_user(clin, &vtconsize->v_clin); 813 __get_user(vcol, &vtconsize->v_vcol); 814 __get_user(ccol, &vtconsize->v_ccol); 815 vlin = vlin ? vlin : vc->vc_scan_lines; 816 if (clin) { 817 if (ll) { 818 if (ll != vlin/clin) { 819 /* Parameters don't add up */ 820 ret = -EINVAL; 821 break; 822 } 823 } else 824 ll = vlin/clin; 825 } 826 if (vcol && ccol) { 827 if (cc) { 828 if (cc != vcol/ccol) { 829 ret = -EINVAL; 830 break; 831 } 832 } else 833 cc = vcol/ccol; 834 } 835 836 if (clin > 32) { 837 ret = -EINVAL; 838 break; 839 } 840 841 for (i = 0; i < MAX_NR_CONSOLES; i++) { 842 if (!vc_cons[i].d) 843 continue; 844 console_lock(); 845 if (vlin) 846 vc_cons[i].d->vc_scan_lines = vlin; 847 if (clin) 848 vc_cons[i].d->vc_font.height = clin; 849 vc_cons[i].d->vc_resize_user = 1; 850 vc_resize(vc_cons[i].d, cc, ll); 851 console_unlock(); 852 } 853 break; 854 } 855 856 case PIO_FONT: { 857 if (!perm) 858 return -EPERM; 859 op.op = KD_FONT_OP_SET; 860 op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC; /* Compatibility */ 861 op.width = 8; 862 op.height = 0; 863 op.charcount = 256; 864 op.data = up; 865 ret = con_font_op(vc_cons[fg_console].d, &op); 866 break; 867 } 868 869 case GIO_FONT: { 870 op.op = KD_FONT_OP_GET; 871 op.flags = KD_FONT_FLAG_OLD; 872 op.width = 8; 873 op.height = 32; 874 op.charcount = 256; 875 op.data = up; 876 ret = con_font_op(vc_cons[fg_console].d, &op); 877 break; 878 } 879 880 case PIO_CMAP: 881 if (!perm) 882 ret = -EPERM; 883 else 884 ret = con_set_cmap(up); 885 break; 886 887 case GIO_CMAP: 888 ret = con_get_cmap(up); 889 break; 890 891 case PIO_FONTX: 892 case GIO_FONTX: 893 ret = do_fontx_ioctl(cmd, up, perm, &op); 894 break; 895 896 case PIO_FONTRESET: 897 { 898 if (!perm) 899 return -EPERM; 900 901 #ifdef BROKEN_GRAPHICS_PROGRAMS 902 /* With BROKEN_GRAPHICS_PROGRAMS defined, the default 903 font is not saved. */ 904 ret = -ENOSYS; 905 break; 906 #else 907 { 908 op.op = KD_FONT_OP_SET_DEFAULT; 909 op.data = NULL; 910 ret = con_font_op(vc_cons[fg_console].d, &op); 911 if (ret) 912 break; 913 con_set_default_unimap(vc_cons[fg_console].d); 914 break; 915 } 916 #endif 917 } 918 919 case KDFONTOP: { 920 if (copy_from_user(&op, up, sizeof(op))) { 921 ret = -EFAULT; 922 break; 923 } 924 if (!perm && op.op != KD_FONT_OP_GET) 925 return -EPERM; 926 ret = con_font_op(vc, &op); 927 if (ret) 928 break; 929 if (copy_to_user(up, &op, sizeof(op))) 930 ret = -EFAULT; 931 break; 932 } 933 934 case PIO_SCRNMAP: 935 if (!perm) 936 ret = -EPERM; 937 else { 938 tty_lock(); 939 ret = con_set_trans_old(up); 940 tty_unlock(); 941 } 942 break; 943 944 case GIO_SCRNMAP: 945 tty_lock(); 946 ret = con_get_trans_old(up); 947 tty_unlock(); 948 break; 949 950 case PIO_UNISCRNMAP: 951 if (!perm) 952 ret = -EPERM; 953 else { 954 tty_lock(); 955 ret = con_set_trans_new(up); 956 tty_unlock(); 957 } 958 break; 959 960 case GIO_UNISCRNMAP: 961 tty_lock(); 962 ret = con_get_trans_new(up); 963 tty_unlock(); 964 break; 965 966 case PIO_UNIMAPCLR: 967 { struct unimapinit ui; 968 if (!perm) 969 return -EPERM; 970 ret = copy_from_user(&ui, up, sizeof(struct unimapinit)); 971 if (ret) 972 ret = -EFAULT; 973 else { 974 tty_lock(); 975 con_clear_unimap(vc, &ui); 976 tty_unlock(); 977 } 978 break; 979 } 980 981 case PIO_UNIMAP: 982 case GIO_UNIMAP: 983 tty_lock(); 984 ret = do_unimap_ioctl(cmd, up, perm, vc); 985 tty_unlock(); 986 break; 987 988 case VT_LOCKSWITCH: 989 if (!capable(CAP_SYS_TTY_CONFIG)) 990 return -EPERM; 991 vt_dont_switch = 1; 992 break; 993 case VT_UNLOCKSWITCH: 994 if (!capable(CAP_SYS_TTY_CONFIG)) 995 return -EPERM; 996 vt_dont_switch = 0; 997 break; 998 case VT_GETHIFONTMASK: 999 ret = put_user(vc->vc_hi_font_mask, 1000 (unsigned short __user *)arg); 1001 break; 1002 case VT_WAITEVENT: 1003 ret = vt_event_wait_ioctl((struct vt_event __user *)arg); 1004 break; 1005 default: 1006 ret = -ENOIOCTLCMD; 1007 } 1008 out: 1009 return ret; 1010 } 1011 1012 void reset_vc(struct vc_data *vc) 1013 { 1014 vc->vc_mode = KD_TEXT; 1015 vt_reset_unicode(vc->vc_num); 1016 vc->vt_mode.mode = VT_AUTO; 1017 vc->vt_mode.waitv = 0; 1018 vc->vt_mode.relsig = 0; 1019 vc->vt_mode.acqsig = 0; 1020 vc->vt_mode.frsig = 0; 1021 put_pid(vc->vt_pid); 1022 vc->vt_pid = NULL; 1023 vc->vt_newvt = -1; 1024 if (!in_interrupt()) /* Via keyboard.c:SAK() - akpm */ 1025 reset_palette(vc); 1026 } 1027 1028 void vc_SAK(struct work_struct *work) 1029 { 1030 struct vc *vc_con = 1031 container_of(work, struct vc, SAK_work); 1032 struct vc_data *vc; 1033 struct tty_struct *tty; 1034 1035 console_lock(); 1036 vc = vc_con->d; 1037 if (vc) { 1038 /* FIXME: review tty ref counting */ 1039 tty = vc->port.tty; 1040 /* 1041 * SAK should also work in all raw modes and reset 1042 * them properly. 1043 */ 1044 if (tty) 1045 __do_SAK(tty); 1046 reset_vc(vc); 1047 } 1048 console_unlock(); 1049 } 1050 1051 #ifdef CONFIG_COMPAT 1052 1053 struct compat_consolefontdesc { 1054 unsigned short charcount; /* characters in font (256 or 512) */ 1055 unsigned short charheight; /* scan lines per character (1-32) */ 1056 compat_caddr_t chardata; /* font data in expanded form */ 1057 }; 1058 1059 static inline int 1060 compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, 1061 int perm, struct console_font_op *op) 1062 { 1063 struct compat_consolefontdesc cfdarg; 1064 int i; 1065 1066 if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc))) 1067 return -EFAULT; 1068 1069 switch (cmd) { 1070 case PIO_FONTX: 1071 if (!perm) 1072 return -EPERM; 1073 op->op = KD_FONT_OP_SET; 1074 op->flags = KD_FONT_FLAG_OLD; 1075 op->width = 8; 1076 op->height = cfdarg.charheight; 1077 op->charcount = cfdarg.charcount; 1078 op->data = compat_ptr(cfdarg.chardata); 1079 return con_font_op(vc_cons[fg_console].d, op); 1080 case GIO_FONTX: 1081 op->op = KD_FONT_OP_GET; 1082 op->flags = KD_FONT_FLAG_OLD; 1083 op->width = 8; 1084 op->height = cfdarg.charheight; 1085 op->charcount = cfdarg.charcount; 1086 op->data = compat_ptr(cfdarg.chardata); 1087 i = con_font_op(vc_cons[fg_console].d, op); 1088 if (i) 1089 return i; 1090 cfdarg.charheight = op->height; 1091 cfdarg.charcount = op->charcount; 1092 if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc))) 1093 return -EFAULT; 1094 return 0; 1095 } 1096 return -EINVAL; 1097 } 1098 1099 struct compat_console_font_op { 1100 compat_uint_t op; /* operation code KD_FONT_OP_* */ 1101 compat_uint_t flags; /* KD_FONT_FLAG_* */ 1102 compat_uint_t width, height; /* font size */ 1103 compat_uint_t charcount; 1104 compat_caddr_t data; /* font data with height fixed to 32 */ 1105 }; 1106 1107 static inline int 1108 compat_kdfontop_ioctl(struct compat_console_font_op __user *fontop, 1109 int perm, struct console_font_op *op, struct vc_data *vc) 1110 { 1111 int i; 1112 1113 if (copy_from_user(op, fontop, sizeof(struct compat_console_font_op))) 1114 return -EFAULT; 1115 if (!perm && op->op != KD_FONT_OP_GET) 1116 return -EPERM; 1117 op->data = compat_ptr(((struct compat_console_font_op *)op)->data); 1118 i = con_font_op(vc, op); 1119 if (i) 1120 return i; 1121 ((struct compat_console_font_op *)op)->data = (unsigned long)op->data; 1122 if (copy_to_user(fontop, op, sizeof(struct compat_console_font_op))) 1123 return -EFAULT; 1124 return 0; 1125 } 1126 1127 struct compat_unimapdesc { 1128 unsigned short entry_ct; 1129 compat_caddr_t entries; 1130 }; 1131 1132 static inline int 1133 compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud, 1134 int perm, struct vc_data *vc) 1135 { 1136 struct compat_unimapdesc tmp; 1137 struct unipair __user *tmp_entries; 1138 1139 if (copy_from_user(&tmp, user_ud, sizeof tmp)) 1140 return -EFAULT; 1141 tmp_entries = compat_ptr(tmp.entries); 1142 if (tmp_entries) 1143 if (!access_ok(VERIFY_WRITE, tmp_entries, 1144 tmp.entry_ct*sizeof(struct unipair))) 1145 return -EFAULT; 1146 switch (cmd) { 1147 case PIO_UNIMAP: 1148 if (!perm) 1149 return -EPERM; 1150 return con_set_unimap(vc, tmp.entry_ct, tmp_entries); 1151 case GIO_UNIMAP: 1152 if (!perm && fg_console != vc->vc_num) 1153 return -EPERM; 1154 return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp_entries); 1155 } 1156 return 0; 1157 } 1158 1159 long vt_compat_ioctl(struct tty_struct *tty, 1160 unsigned int cmd, unsigned long arg) 1161 { 1162 struct vc_data *vc = tty->driver_data; 1163 struct console_font_op op; /* used in multiple places here */ 1164 unsigned int console; 1165 void __user *up = (void __user *)arg; 1166 int perm; 1167 int ret = 0; 1168 1169 console = vc->vc_num; 1170 1171 if (!vc_cons_allocated(console)) { /* impossible? */ 1172 ret = -ENOIOCTLCMD; 1173 goto out; 1174 } 1175 1176 /* 1177 * To have permissions to do most of the vt ioctls, we either have 1178 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG. 1179 */ 1180 perm = 0; 1181 if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG)) 1182 perm = 1; 1183 1184 switch (cmd) { 1185 /* 1186 * these need special handlers for incompatible data structures 1187 */ 1188 case PIO_FONTX: 1189 case GIO_FONTX: 1190 ret = compat_fontx_ioctl(cmd, up, perm, &op); 1191 break; 1192 1193 case KDFONTOP: 1194 ret = compat_kdfontop_ioctl(up, perm, &op, vc); 1195 break; 1196 1197 case PIO_UNIMAP: 1198 case GIO_UNIMAP: 1199 tty_lock(); 1200 ret = compat_unimap_ioctl(cmd, up, perm, vc); 1201 tty_unlock(); 1202 break; 1203 1204 /* 1205 * all these treat 'arg' as an integer 1206 */ 1207 case KIOCSOUND: 1208 case KDMKTONE: 1209 #ifdef CONFIG_X86 1210 case KDADDIO: 1211 case KDDELIO: 1212 #endif 1213 case KDSETMODE: 1214 case KDMAPDISP: 1215 case KDUNMAPDISP: 1216 case KDSKBMODE: 1217 case KDSKBMETA: 1218 case KDSKBLED: 1219 case KDSETLED: 1220 case KDSIGACCEPT: 1221 case VT_ACTIVATE: 1222 case VT_WAITACTIVE: 1223 case VT_RELDISP: 1224 case VT_DISALLOCATE: 1225 case VT_RESIZE: 1226 case VT_RESIZEX: 1227 goto fallback; 1228 1229 /* 1230 * the rest has a compatible data structure behind arg, 1231 * but we have to convert it to a proper 64 bit pointer. 1232 */ 1233 default: 1234 arg = (unsigned long)compat_ptr(arg); 1235 goto fallback; 1236 } 1237 out: 1238 return ret; 1239 1240 fallback: 1241 return vt_ioctl(tty, cmd, arg); 1242 } 1243 1244 1245 #endif /* CONFIG_COMPAT */ 1246 1247 1248 /* 1249 * Performs the back end of a vt switch. Called under the console 1250 * semaphore. 1251 */ 1252 static void complete_change_console(struct vc_data *vc) 1253 { 1254 unsigned char old_vc_mode; 1255 int old = fg_console; 1256 1257 last_console = fg_console; 1258 1259 /* 1260 * If we're switching, we could be going from KD_GRAPHICS to 1261 * KD_TEXT mode or vice versa, which means we need to blank or 1262 * unblank the screen later. 1263 */ 1264 old_vc_mode = vc_cons[fg_console].d->vc_mode; 1265 switch_screen(vc); 1266 1267 /* 1268 * This can't appear below a successful kill_pid(). If it did, 1269 * then the *blank_screen operation could occur while X, having 1270 * received acqsig, is waking up on another processor. This 1271 * condition can lead to overlapping accesses to the VGA range 1272 * and the framebuffer (causing system lockups). 1273 * 1274 * To account for this we duplicate this code below only if the 1275 * controlling process is gone and we've called reset_vc. 1276 */ 1277 if (old_vc_mode != vc->vc_mode) { 1278 if (vc->vc_mode == KD_TEXT) 1279 do_unblank_screen(1); 1280 else 1281 do_blank_screen(1); 1282 } 1283 1284 /* 1285 * If this new console is under process control, send it a signal 1286 * telling it that it has acquired. Also check if it has died and 1287 * clean up (similar to logic employed in change_console()) 1288 */ 1289 if (vc->vt_mode.mode == VT_PROCESS) { 1290 /* 1291 * Send the signal as privileged - kill_pid() will 1292 * tell us if the process has gone or something else 1293 * is awry 1294 */ 1295 if (kill_pid(vc->vt_pid, vc->vt_mode.acqsig, 1) != 0) { 1296 /* 1297 * The controlling process has died, so we revert back to 1298 * normal operation. In this case, we'll also change back 1299 * to KD_TEXT mode. I'm not sure if this is strictly correct 1300 * but it saves the agony when the X server dies and the screen 1301 * remains blanked due to KD_GRAPHICS! It would be nice to do 1302 * this outside of VT_PROCESS but there is no single process 1303 * to account for and tracking tty count may be undesirable. 1304 */ 1305 reset_vc(vc); 1306 1307 if (old_vc_mode != vc->vc_mode) { 1308 if (vc->vc_mode == KD_TEXT) 1309 do_unblank_screen(1); 1310 else 1311 do_blank_screen(1); 1312 } 1313 } 1314 } 1315 1316 /* 1317 * Wake anyone waiting for their VT to activate 1318 */ 1319 vt_event_post(VT_EVENT_SWITCH, old, vc->vc_num); 1320 return; 1321 } 1322 1323 /* 1324 * Performs the front-end of a vt switch 1325 */ 1326 void change_console(struct vc_data *new_vc) 1327 { 1328 struct vc_data *vc; 1329 1330 if (!new_vc || new_vc->vc_num == fg_console || vt_dont_switch) 1331 return; 1332 1333 /* 1334 * If this vt is in process mode, then we need to handshake with 1335 * that process before switching. Essentially, we store where that 1336 * vt wants to switch to and wait for it to tell us when it's done 1337 * (via VT_RELDISP ioctl). 1338 * 1339 * We also check to see if the controlling process still exists. 1340 * If it doesn't, we reset this vt to auto mode and continue. 1341 * This is a cheap way to track process control. The worst thing 1342 * that can happen is: we send a signal to a process, it dies, and 1343 * the switch gets "lost" waiting for a response; hopefully, the 1344 * user will try again, we'll detect the process is gone (unless 1345 * the user waits just the right amount of time :-) and revert the 1346 * vt to auto control. 1347 */ 1348 vc = vc_cons[fg_console].d; 1349 if (vc->vt_mode.mode == VT_PROCESS) { 1350 /* 1351 * Send the signal as privileged - kill_pid() will 1352 * tell us if the process has gone or something else 1353 * is awry. 1354 * 1355 * We need to set vt_newvt *before* sending the signal or we 1356 * have a race. 1357 */ 1358 vc->vt_newvt = new_vc->vc_num; 1359 if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) { 1360 /* 1361 * It worked. Mark the vt to switch to and 1362 * return. The process needs to send us a 1363 * VT_RELDISP ioctl to complete the switch. 1364 */ 1365 return; 1366 } 1367 1368 /* 1369 * The controlling process has died, so we revert back to 1370 * normal operation. In this case, we'll also change back 1371 * to KD_TEXT mode. I'm not sure if this is strictly correct 1372 * but it saves the agony when the X server dies and the screen 1373 * remains blanked due to KD_GRAPHICS! It would be nice to do 1374 * this outside of VT_PROCESS but there is no single process 1375 * to account for and tracking tty count may be undesirable. 1376 */ 1377 reset_vc(vc); 1378 1379 /* 1380 * Fall through to normal (VT_AUTO) handling of the switch... 1381 */ 1382 } 1383 1384 /* 1385 * Ignore all switches in KD_GRAPHICS+VT_AUTO mode 1386 */ 1387 if (vc->vc_mode == KD_GRAPHICS) 1388 return; 1389 1390 complete_change_console(new_vc); 1391 } 1392 1393 /* Perform a kernel triggered VT switch for suspend/resume */ 1394 1395 static int disable_vt_switch; 1396 1397 int vt_move_to_console(unsigned int vt, int alloc) 1398 { 1399 int prev; 1400 1401 console_lock(); 1402 /* Graphics mode - up to X */ 1403 if (disable_vt_switch) { 1404 console_unlock(); 1405 return 0; 1406 } 1407 prev = fg_console; 1408 1409 if (alloc && vc_allocate(vt)) { 1410 /* we can't have a free VC for now. Too bad, 1411 * we don't want to mess the screen for now. */ 1412 console_unlock(); 1413 return -ENOSPC; 1414 } 1415 1416 if (set_console(vt)) { 1417 /* 1418 * We're unable to switch to the SUSPEND_CONSOLE. 1419 * Let the calling function know so it can decide 1420 * what to do. 1421 */ 1422 console_unlock(); 1423 return -EIO; 1424 } 1425 console_unlock(); 1426 if (vt_waitactive(vt + 1)) { 1427 pr_debug("Suspend: Can't switch VCs."); 1428 return -EINTR; 1429 } 1430 return prev; 1431 } 1432 1433 /* 1434 * Normally during a suspend, we allocate a new console and switch to it. 1435 * When we resume, we switch back to the original console. This switch 1436 * can be slow, so on systems where the framebuffer can handle restoration 1437 * of video registers anyways, there's little point in doing the console 1438 * switch. This function allows you to disable it by passing it '0'. 1439 */ 1440 void pm_set_vt_switch(int do_switch) 1441 { 1442 console_lock(); 1443 disable_vt_switch = !do_switch; 1444 console_unlock(); 1445 } 1446 EXPORT_SYMBOL(pm_set_vt_switch); 1447