1 /* 2 * Copyright (C) 1992 obz under the linux copyright 3 * 4 * Dynamic diacritical handling - aeb@cwi.nl - Dec 1993 5 * Dynamic keymap and string allocation - aeb@cwi.nl - May 1994 6 * Restrict VT switching via ioctl() - grif@cs.ucr.edu - Dec 1995 7 * Some code moved for less code duplication - Andi Kleen - Mar 1997 8 * Check put/get_user, cleanups - acme@conectiva.com.br - Jun 2001 9 */ 10 11 #include <linux/types.h> 12 #include <linux/errno.h> 13 #include <linux/sched/signal.h> 14 #include <linux/tty.h> 15 #include <linux/timer.h> 16 #include <linux/kernel.h> 17 #include <linux/compat.h> 18 #include <linux/module.h> 19 #include <linux/kd.h> 20 #include <linux/vt.h> 21 #include <linux/string.h> 22 #include <linux/slab.h> 23 #include <linux/major.h> 24 #include <linux/fs.h> 25 #include <linux/console.h> 26 #include <linux/consolemap.h> 27 #include <linux/signal.h> 28 #include <linux/suspend.h> 29 #include <linux/timex.h> 30 31 #include <asm/io.h> 32 #include <linux/uaccess.h> 33 34 #include <linux/kbd_kern.h> 35 #include <linux/vt_kern.h> 36 #include <linux/kbd_diacr.h> 37 #include <linux/selection.h> 38 39 char vt_dont_switch; 40 extern struct tty_driver *console_driver; 41 42 #define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count) 43 #define VT_BUSY(i) (VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons) 44 45 /* 46 * Console (vt and kd) routines, as defined by USL SVR4 manual, and by 47 * experimentation and study of X386 SYSV handling. 48 * 49 * One point of difference: SYSV vt's are /dev/vtX, which X >= 0, and 50 * /dev/console is a separate ttyp. Under Linux, /dev/tty0 is /dev/console, 51 * and the vc start at /dev/ttyX, X >= 1. We maintain that here, so we will 52 * always treat our set of vt as numbered 1..MAX_NR_CONSOLES (corresponding to 53 * ttys 0..MAX_NR_CONSOLES-1). Explicitly naming VT 0 is illegal, but using 54 * /dev/tty0 (fg_console) as a target is legal, since an implicit aliasing 55 * to the current console is done by the main ioctl code. 56 */ 57 58 #ifdef CONFIG_X86 59 #include <linux/syscalls.h> 60 #endif 61 62 static void complete_change_console(struct vc_data *vc); 63 64 /* 65 * User space VT_EVENT handlers 66 */ 67 68 struct vt_event_wait { 69 struct list_head list; 70 struct vt_event event; 71 int done; 72 }; 73 74 static LIST_HEAD(vt_events); 75 static DEFINE_SPINLOCK(vt_event_lock); 76 static DECLARE_WAIT_QUEUE_HEAD(vt_event_waitqueue); 77 78 /** 79 * vt_event_post 80 * @event: the event that occurred 81 * @old: old console 82 * @new: new console 83 * 84 * Post an VT event to interested VT handlers 85 */ 86 87 void vt_event_post(unsigned int event, unsigned int old, unsigned int new) 88 { 89 struct list_head *pos, *head; 90 unsigned long flags; 91 int wake = 0; 92 93 spin_lock_irqsave(&vt_event_lock, flags); 94 head = &vt_events; 95 96 list_for_each(pos, head) { 97 struct vt_event_wait *ve = list_entry(pos, 98 struct vt_event_wait, list); 99 if (!(ve->event.event & event)) 100 continue; 101 ve->event.event = event; 102 /* kernel view is consoles 0..n-1, user space view is 103 console 1..n with 0 meaning current, so we must bias */ 104 ve->event.oldev = old + 1; 105 ve->event.newev = new + 1; 106 wake = 1; 107 ve->done = 1; 108 } 109 spin_unlock_irqrestore(&vt_event_lock, flags); 110 if (wake) 111 wake_up_interruptible(&vt_event_waitqueue); 112 } 113 114 static void __vt_event_queue(struct vt_event_wait *vw) 115 { 116 unsigned long flags; 117 /* Prepare the event */ 118 INIT_LIST_HEAD(&vw->list); 119 vw->done = 0; 120 /* Queue our event */ 121 spin_lock_irqsave(&vt_event_lock, flags); 122 list_add(&vw->list, &vt_events); 123 spin_unlock_irqrestore(&vt_event_lock, flags); 124 } 125 126 static void __vt_event_wait(struct vt_event_wait *vw) 127 { 128 /* Wait for it to pass */ 129 wait_event_interruptible(vt_event_waitqueue, vw->done); 130 } 131 132 static void __vt_event_dequeue(struct vt_event_wait *vw) 133 { 134 unsigned long flags; 135 136 /* Dequeue it */ 137 spin_lock_irqsave(&vt_event_lock, flags); 138 list_del(&vw->list); 139 spin_unlock_irqrestore(&vt_event_lock, flags); 140 } 141 142 /** 143 * vt_event_wait - wait for an event 144 * @vw: our event 145 * 146 * Waits for an event to occur which completes our vt_event_wait 147 * structure. On return the structure has wv->done set to 1 for success 148 * or 0 if some event such as a signal ended the wait. 149 */ 150 151 static void vt_event_wait(struct vt_event_wait *vw) 152 { 153 __vt_event_queue(vw); 154 __vt_event_wait(vw); 155 __vt_event_dequeue(vw); 156 } 157 158 /** 159 * vt_event_wait_ioctl - event ioctl handler 160 * @arg: argument to ioctl 161 * 162 * Implement the VT_WAITEVENT ioctl using the VT event interface 163 */ 164 165 static int vt_event_wait_ioctl(struct vt_event __user *event) 166 { 167 struct vt_event_wait vw; 168 169 if (copy_from_user(&vw.event, event, sizeof(struct vt_event))) 170 return -EFAULT; 171 /* Highest supported event for now */ 172 if (vw.event.event & ~VT_MAX_EVENT) 173 return -EINVAL; 174 175 vt_event_wait(&vw); 176 /* If it occurred report it */ 177 if (vw.done) { 178 if (copy_to_user(event, &vw.event, sizeof(struct vt_event))) 179 return -EFAULT; 180 return 0; 181 } 182 return -EINTR; 183 } 184 185 /** 186 * vt_waitactive - active console wait 187 * @event: event code 188 * @n: new console 189 * 190 * Helper for event waits. Used to implement the legacy 191 * event waiting ioctls in terms of events 192 */ 193 194 int vt_waitactive(int n) 195 { 196 struct vt_event_wait vw; 197 do { 198 vw.event.event = VT_EVENT_SWITCH; 199 __vt_event_queue(&vw); 200 if (n == fg_console + 1) { 201 __vt_event_dequeue(&vw); 202 break; 203 } 204 __vt_event_wait(&vw); 205 __vt_event_dequeue(&vw); 206 if (vw.done == 0) 207 return -EINTR; 208 } while (vw.event.newev != n); 209 return 0; 210 } 211 212 /* 213 * these are the valid i/o ports we're allowed to change. they map all the 214 * video ports 215 */ 216 #define GPFIRST 0x3b4 217 #define GPLAST 0x3df 218 #define GPNUM (GPLAST - GPFIRST + 1) 219 220 221 222 static inline int 223 do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) 224 { 225 struct consolefontdesc cfdarg; 226 int i; 227 228 if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc))) 229 return -EFAULT; 230 231 switch (cmd) { 232 case PIO_FONTX: 233 if (!perm) 234 return -EPERM; 235 op->op = KD_FONT_OP_SET; 236 op->flags = KD_FONT_FLAG_OLD; 237 op->width = 8; 238 op->height = cfdarg.charheight; 239 op->charcount = cfdarg.charcount; 240 op->data = cfdarg.chardata; 241 return con_font_op(vc_cons[fg_console].d, op); 242 case GIO_FONTX: { 243 op->op = KD_FONT_OP_GET; 244 op->flags = KD_FONT_FLAG_OLD; 245 op->width = 8; 246 op->height = cfdarg.charheight; 247 op->charcount = cfdarg.charcount; 248 op->data = cfdarg.chardata; 249 i = con_font_op(vc_cons[fg_console].d, op); 250 if (i) 251 return i; 252 cfdarg.charheight = op->height; 253 cfdarg.charcount = op->charcount; 254 if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc))) 255 return -EFAULT; 256 return 0; 257 } 258 } 259 return -EINVAL; 260 } 261 262 static inline int 263 do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc) 264 { 265 struct unimapdesc tmp; 266 267 if (copy_from_user(&tmp, user_ud, sizeof tmp)) 268 return -EFAULT; 269 if (tmp.entries) 270 if (!access_ok(VERIFY_WRITE, tmp.entries, 271 tmp.entry_ct*sizeof(struct unipair))) 272 return -EFAULT; 273 switch (cmd) { 274 case PIO_UNIMAP: 275 if (!perm) 276 return -EPERM; 277 return con_set_unimap(vc, tmp.entry_ct, tmp.entries); 278 case GIO_UNIMAP: 279 if (!perm && fg_console != vc->vc_num) 280 return -EPERM; 281 return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp.entries); 282 } 283 return 0; 284 } 285 286 /* deallocate a single console, if possible (leave 0) */ 287 static int vt_disallocate(unsigned int vc_num) 288 { 289 struct vc_data *vc = NULL; 290 int ret = 0; 291 292 console_lock(); 293 if (VT_BUSY(vc_num)) 294 ret = -EBUSY; 295 else if (vc_num) 296 vc = vc_deallocate(vc_num); 297 console_unlock(); 298 299 if (vc && vc_num >= MIN_NR_CONSOLES) { 300 tty_port_destroy(&vc->port); 301 kfree(vc); 302 } 303 304 return ret; 305 } 306 307 /* deallocate all unused consoles, but leave 0 */ 308 static void vt_disallocate_all(void) 309 { 310 struct vc_data *vc[MAX_NR_CONSOLES]; 311 int i; 312 313 console_lock(); 314 for (i = 1; i < MAX_NR_CONSOLES; i++) 315 if (!VT_BUSY(i)) 316 vc[i] = vc_deallocate(i); 317 else 318 vc[i] = NULL; 319 console_unlock(); 320 321 for (i = 1; i < MAX_NR_CONSOLES; i++) { 322 if (vc[i] && i >= MIN_NR_CONSOLES) { 323 tty_port_destroy(&vc[i]->port); 324 kfree(vc[i]); 325 } 326 } 327 } 328 329 330 /* 331 * We handle the console-specific ioctl's here. We allow the 332 * capability to modify any console, not just the fg_console. 333 */ 334 int vt_ioctl(struct tty_struct *tty, 335 unsigned int cmd, unsigned long arg) 336 { 337 struct vc_data *vc = tty->driver_data; 338 struct console_font_op op; /* used in multiple places here */ 339 unsigned int console; 340 unsigned char ucval; 341 unsigned int uival; 342 void __user *up = (void __user *)arg; 343 int i, perm; 344 int ret = 0; 345 346 console = vc->vc_num; 347 348 349 if (!vc_cons_allocated(console)) { /* impossible? */ 350 ret = -ENOIOCTLCMD; 351 goto out; 352 } 353 354 355 /* 356 * To have permissions to do most of the vt ioctls, we either have 357 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG. 358 */ 359 perm = 0; 360 if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG)) 361 perm = 1; 362 363 switch (cmd) { 364 case TIOCLINUX: 365 ret = tioclinux(tty, arg); 366 break; 367 case KIOCSOUND: 368 if (!perm) 369 return -EPERM; 370 /* 371 * The use of PIT_TICK_RATE is historic, it used to be 372 * the platform-dependent CLOCK_TICK_RATE between 2.6.12 373 * and 2.6.36, which was a minor but unfortunate ABI 374 * change. kd_mksound is locked by the input layer. 375 */ 376 if (arg) 377 arg = PIT_TICK_RATE / arg; 378 kd_mksound(arg, 0); 379 break; 380 381 case KDMKTONE: 382 if (!perm) 383 return -EPERM; 384 { 385 unsigned int ticks, count; 386 387 /* 388 * Generate the tone for the appropriate number of ticks. 389 * If the time is zero, turn off sound ourselves. 390 */ 391 ticks = msecs_to_jiffies((arg >> 16) & 0xffff); 392 count = ticks ? (arg & 0xffff) : 0; 393 if (count) 394 count = PIT_TICK_RATE / count; 395 kd_mksound(count, ticks); 396 break; 397 } 398 399 case KDGKBTYPE: 400 /* 401 * this is naïve. 402 */ 403 ucval = KB_101; 404 ret = put_user(ucval, (char __user *)arg); 405 break; 406 407 /* 408 * These cannot be implemented on any machine that implements 409 * ioperm() in user level (such as Alpha PCs) or not at all. 410 * 411 * XXX: you should never use these, just call ioperm directly.. 412 */ 413 #ifdef CONFIG_X86 414 case KDADDIO: 415 case KDDELIO: 416 /* 417 * KDADDIO and KDDELIO may be able to add ports beyond what 418 * we reject here, but to be safe... 419 * 420 * These are locked internally via sys_ioperm 421 */ 422 if (arg < GPFIRST || arg > GPLAST) { 423 ret = -EINVAL; 424 break; 425 } 426 ret = sys_ioperm(arg, 1, (cmd == KDADDIO)) ? -ENXIO : 0; 427 break; 428 429 case KDENABIO: 430 case KDDISABIO: 431 ret = sys_ioperm(GPFIRST, GPNUM, 432 (cmd == KDENABIO)) ? -ENXIO : 0; 433 break; 434 #endif 435 436 /* Linux m68k/i386 interface for setting the keyboard delay/repeat rate */ 437 438 case KDKBDREP: 439 { 440 struct kbd_repeat kbrep; 441 442 if (!capable(CAP_SYS_TTY_CONFIG)) 443 return -EPERM; 444 445 if (copy_from_user(&kbrep, up, sizeof(struct kbd_repeat))) { 446 ret = -EFAULT; 447 break; 448 } 449 ret = kbd_rate(&kbrep); 450 if (ret) 451 break; 452 if (copy_to_user(up, &kbrep, sizeof(struct kbd_repeat))) 453 ret = -EFAULT; 454 break; 455 } 456 457 case KDSETMODE: 458 /* 459 * currently, setting the mode from KD_TEXT to KD_GRAPHICS 460 * doesn't do a whole lot. i'm not sure if it should do any 461 * restoration of modes or what... 462 * 463 * XXX It should at least call into the driver, fbdev's definitely 464 * need to restore their engine state. --BenH 465 */ 466 if (!perm) 467 return -EPERM; 468 switch (arg) { 469 case KD_GRAPHICS: 470 break; 471 case KD_TEXT0: 472 case KD_TEXT1: 473 arg = KD_TEXT; 474 case KD_TEXT: 475 break; 476 default: 477 ret = -EINVAL; 478 goto out; 479 } 480 /* FIXME: this needs the console lock extending */ 481 if (vc->vc_mode == (unsigned char) arg) 482 break; 483 vc->vc_mode = (unsigned char) arg; 484 if (console != fg_console) 485 break; 486 /* 487 * explicitly blank/unblank the screen if switching modes 488 */ 489 console_lock(); 490 if (arg == KD_TEXT) 491 do_unblank_screen(1); 492 else 493 do_blank_screen(1); 494 console_unlock(); 495 break; 496 497 case KDGETMODE: 498 uival = vc->vc_mode; 499 goto setint; 500 501 case KDMAPDISP: 502 case KDUNMAPDISP: 503 /* 504 * these work like a combination of mmap and KDENABIO. 505 * this could be easily finished. 506 */ 507 ret = -EINVAL; 508 break; 509 510 case KDSKBMODE: 511 if (!perm) 512 return -EPERM; 513 ret = vt_do_kdskbmode(console, arg); 514 if (ret == 0) 515 tty_ldisc_flush(tty); 516 break; 517 518 case KDGKBMODE: 519 uival = vt_do_kdgkbmode(console); 520 ret = put_user(uival, (int __user *)arg); 521 break; 522 523 /* this could be folded into KDSKBMODE, but for compatibility 524 reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */ 525 case KDSKBMETA: 526 ret = vt_do_kdskbmeta(console, arg); 527 break; 528 529 case KDGKBMETA: 530 /* FIXME: should review whether this is worth locking */ 531 uival = vt_do_kdgkbmeta(console); 532 setint: 533 ret = put_user(uival, (int __user *)arg); 534 break; 535 536 case KDGETKEYCODE: 537 case KDSETKEYCODE: 538 if(!capable(CAP_SYS_TTY_CONFIG)) 539 perm = 0; 540 ret = vt_do_kbkeycode_ioctl(cmd, up, perm); 541 break; 542 543 case KDGKBENT: 544 case KDSKBENT: 545 ret = vt_do_kdsk_ioctl(cmd, up, perm, console); 546 break; 547 548 case KDGKBSENT: 549 case KDSKBSENT: 550 ret = vt_do_kdgkb_ioctl(cmd, up, perm); 551 break; 552 553 /* Diacritical processing. Handled in keyboard.c as it has 554 to operate on the keyboard locks and structures */ 555 case KDGKBDIACR: 556 case KDGKBDIACRUC: 557 case KDSKBDIACR: 558 case KDSKBDIACRUC: 559 ret = vt_do_diacrit(cmd, up, perm); 560 break; 561 562 /* the ioctls below read/set the flags usually shown in the leds */ 563 /* don't use them - they will go away without warning */ 564 case KDGKBLED: 565 case KDSKBLED: 566 case KDGETLED: 567 case KDSETLED: 568 ret = vt_do_kdskled(console, cmd, arg, perm); 569 break; 570 571 /* 572 * A process can indicate its willingness to accept signals 573 * generated by pressing an appropriate key combination. 574 * Thus, one can have a daemon that e.g. spawns a new console 575 * upon a keypress and then changes to it. 576 * See also the kbrequest field of inittab(5). 577 */ 578 case KDSIGACCEPT: 579 { 580 if (!perm || !capable(CAP_KILL)) 581 return -EPERM; 582 if (!valid_signal(arg) || arg < 1 || arg == SIGKILL) 583 ret = -EINVAL; 584 else { 585 spin_lock_irq(&vt_spawn_con.lock); 586 put_pid(vt_spawn_con.pid); 587 vt_spawn_con.pid = get_pid(task_pid(current)); 588 vt_spawn_con.sig = arg; 589 spin_unlock_irq(&vt_spawn_con.lock); 590 } 591 break; 592 } 593 594 case VT_SETMODE: 595 { 596 struct vt_mode tmp; 597 598 if (!perm) 599 return -EPERM; 600 if (copy_from_user(&tmp, up, sizeof(struct vt_mode))) { 601 ret = -EFAULT; 602 goto out; 603 } 604 if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS) { 605 ret = -EINVAL; 606 goto out; 607 } 608 console_lock(); 609 vc->vt_mode = tmp; 610 /* the frsig is ignored, so we set it to 0 */ 611 vc->vt_mode.frsig = 0; 612 put_pid(vc->vt_pid); 613 vc->vt_pid = get_pid(task_pid(current)); 614 /* no switch is required -- saw@shade.msu.ru */ 615 vc->vt_newvt = -1; 616 console_unlock(); 617 break; 618 } 619 620 case VT_GETMODE: 621 { 622 struct vt_mode tmp; 623 int rc; 624 625 console_lock(); 626 memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode)); 627 console_unlock(); 628 629 rc = copy_to_user(up, &tmp, sizeof(struct vt_mode)); 630 if (rc) 631 ret = -EFAULT; 632 break; 633 } 634 635 /* 636 * Returns global vt state. Note that VT 0 is always open, since 637 * it's an alias for the current VT, and people can't use it here. 638 * We cannot return state for more than 16 VTs, since v_state is short. 639 */ 640 case VT_GETSTATE: 641 { 642 struct vt_stat __user *vtstat = up; 643 unsigned short state, mask; 644 645 /* Review: FIXME: Console lock ? */ 646 if (put_user(fg_console + 1, &vtstat->v_active)) 647 ret = -EFAULT; 648 else { 649 state = 1; /* /dev/tty0 is always open */ 650 for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask; 651 ++i, mask <<= 1) 652 if (VT_IS_IN_USE(i)) 653 state |= mask; 654 ret = put_user(state, &vtstat->v_state); 655 } 656 break; 657 } 658 659 /* 660 * Returns the first available (non-opened) console. 661 */ 662 case VT_OPENQRY: 663 /* FIXME: locking ? - but then this is a stupid API */ 664 for (i = 0; i < MAX_NR_CONSOLES; ++i) 665 if (! VT_IS_IN_USE(i)) 666 break; 667 uival = i < MAX_NR_CONSOLES ? (i+1) : -1; 668 goto setint; 669 670 /* 671 * ioctl(fd, VT_ACTIVATE, num) will cause us to switch to vt # num, 672 * with num >= 1 (switches to vt 0, our console, are not allowed, just 673 * to preserve sanity). 674 */ 675 case VT_ACTIVATE: 676 if (!perm) 677 return -EPERM; 678 if (arg == 0 || arg > MAX_NR_CONSOLES) 679 ret = -ENXIO; 680 else { 681 arg--; 682 console_lock(); 683 ret = vc_allocate(arg); 684 console_unlock(); 685 if (ret) 686 break; 687 set_console(arg); 688 } 689 break; 690 691 case VT_SETACTIVATE: 692 { 693 struct vt_setactivate vsa; 694 695 if (!perm) 696 return -EPERM; 697 698 if (copy_from_user(&vsa, (struct vt_setactivate __user *)arg, 699 sizeof(struct vt_setactivate))) { 700 ret = -EFAULT; 701 goto out; 702 } 703 if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) 704 ret = -ENXIO; 705 else { 706 vsa.console--; 707 console_lock(); 708 ret = vc_allocate(vsa.console); 709 if (ret == 0) { 710 struct vc_data *nvc; 711 /* This is safe providing we don't drop the 712 console sem between vc_allocate and 713 finishing referencing nvc */ 714 nvc = vc_cons[vsa.console].d; 715 nvc->vt_mode = vsa.mode; 716 nvc->vt_mode.frsig = 0; 717 put_pid(nvc->vt_pid); 718 nvc->vt_pid = get_pid(task_pid(current)); 719 } 720 console_unlock(); 721 if (ret) 722 break; 723 /* Commence switch and lock */ 724 /* Review set_console locks */ 725 set_console(vsa.console); 726 } 727 break; 728 } 729 730 /* 731 * wait until the specified VT has been activated 732 */ 733 case VT_WAITACTIVE: 734 if (!perm) 735 return -EPERM; 736 if (arg == 0 || arg > MAX_NR_CONSOLES) 737 ret = -ENXIO; 738 else 739 ret = vt_waitactive(arg); 740 break; 741 742 /* 743 * If a vt is under process control, the kernel will not switch to it 744 * immediately, but postpone the operation until the process calls this 745 * ioctl, allowing the switch to complete. 746 * 747 * According to the X sources this is the behavior: 748 * 0: pending switch-from not OK 749 * 1: pending switch-from OK 750 * 2: completed switch-to OK 751 */ 752 case VT_RELDISP: 753 if (!perm) 754 return -EPERM; 755 756 console_lock(); 757 if (vc->vt_mode.mode != VT_PROCESS) { 758 console_unlock(); 759 ret = -EINVAL; 760 break; 761 } 762 /* 763 * Switching-from response 764 */ 765 if (vc->vt_newvt >= 0) { 766 if (arg == 0) 767 /* 768 * Switch disallowed, so forget we were trying 769 * to do it. 770 */ 771 vc->vt_newvt = -1; 772 773 else { 774 /* 775 * The current vt has been released, so 776 * complete the switch. 777 */ 778 int newvt; 779 newvt = vc->vt_newvt; 780 vc->vt_newvt = -1; 781 ret = vc_allocate(newvt); 782 if (ret) { 783 console_unlock(); 784 break; 785 } 786 /* 787 * When we actually do the console switch, 788 * make sure we are atomic with respect to 789 * other console switches.. 790 */ 791 complete_change_console(vc_cons[newvt].d); 792 } 793 } else { 794 /* 795 * Switched-to response 796 */ 797 /* 798 * If it's just an ACK, ignore it 799 */ 800 if (arg != VT_ACKACQ) 801 ret = -EINVAL; 802 } 803 console_unlock(); 804 break; 805 806 /* 807 * Disallocate memory associated to VT (but leave VT1) 808 */ 809 case VT_DISALLOCATE: 810 if (arg > MAX_NR_CONSOLES) { 811 ret = -ENXIO; 812 break; 813 } 814 if (arg == 0) 815 vt_disallocate_all(); 816 else 817 ret = vt_disallocate(--arg); 818 break; 819 820 case VT_RESIZE: 821 { 822 struct vt_sizes __user *vtsizes = up; 823 struct vc_data *vc; 824 825 ushort ll,cc; 826 if (!perm) 827 return -EPERM; 828 if (get_user(ll, &vtsizes->v_rows) || 829 get_user(cc, &vtsizes->v_cols)) 830 ret = -EFAULT; 831 else { 832 console_lock(); 833 for (i = 0; i < MAX_NR_CONSOLES; i++) { 834 vc = vc_cons[i].d; 835 836 if (vc) { 837 vc->vc_resize_user = 1; 838 /* FIXME: review v tty lock */ 839 vc_resize(vc_cons[i].d, cc, ll); 840 } 841 } 842 console_unlock(); 843 } 844 break; 845 } 846 847 case VT_RESIZEX: 848 { 849 struct vt_consize __user *vtconsize = up; 850 ushort ll,cc,vlin,clin,vcol,ccol; 851 if (!perm) 852 return -EPERM; 853 if (!access_ok(VERIFY_READ, vtconsize, 854 sizeof(struct vt_consize))) { 855 ret = -EFAULT; 856 break; 857 } 858 /* FIXME: Should check the copies properly */ 859 __get_user(ll, &vtconsize->v_rows); 860 __get_user(cc, &vtconsize->v_cols); 861 __get_user(vlin, &vtconsize->v_vlin); 862 __get_user(clin, &vtconsize->v_clin); 863 __get_user(vcol, &vtconsize->v_vcol); 864 __get_user(ccol, &vtconsize->v_ccol); 865 vlin = vlin ? vlin : vc->vc_scan_lines; 866 if (clin) { 867 if (ll) { 868 if (ll != vlin/clin) { 869 /* Parameters don't add up */ 870 ret = -EINVAL; 871 break; 872 } 873 } else 874 ll = vlin/clin; 875 } 876 if (vcol && ccol) { 877 if (cc) { 878 if (cc != vcol/ccol) { 879 ret = -EINVAL; 880 break; 881 } 882 } else 883 cc = vcol/ccol; 884 } 885 886 if (clin > 32) { 887 ret = -EINVAL; 888 break; 889 } 890 891 for (i = 0; i < MAX_NR_CONSOLES; i++) { 892 if (!vc_cons[i].d) 893 continue; 894 console_lock(); 895 if (vlin) 896 vc_cons[i].d->vc_scan_lines = vlin; 897 if (clin) 898 vc_cons[i].d->vc_font.height = clin; 899 vc_cons[i].d->vc_resize_user = 1; 900 vc_resize(vc_cons[i].d, cc, ll); 901 console_unlock(); 902 } 903 break; 904 } 905 906 case PIO_FONT: { 907 if (!perm) 908 return -EPERM; 909 op.op = KD_FONT_OP_SET; 910 op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC; /* Compatibility */ 911 op.width = 8; 912 op.height = 0; 913 op.charcount = 256; 914 op.data = up; 915 ret = con_font_op(vc_cons[fg_console].d, &op); 916 break; 917 } 918 919 case GIO_FONT: { 920 op.op = KD_FONT_OP_GET; 921 op.flags = KD_FONT_FLAG_OLD; 922 op.width = 8; 923 op.height = 32; 924 op.charcount = 256; 925 op.data = up; 926 ret = con_font_op(vc_cons[fg_console].d, &op); 927 break; 928 } 929 930 case PIO_CMAP: 931 if (!perm) 932 ret = -EPERM; 933 else 934 ret = con_set_cmap(up); 935 break; 936 937 case GIO_CMAP: 938 ret = con_get_cmap(up); 939 break; 940 941 case PIO_FONTX: 942 case GIO_FONTX: 943 ret = do_fontx_ioctl(cmd, up, perm, &op); 944 break; 945 946 case PIO_FONTRESET: 947 { 948 if (!perm) 949 return -EPERM; 950 951 #ifdef BROKEN_GRAPHICS_PROGRAMS 952 /* With BROKEN_GRAPHICS_PROGRAMS defined, the default 953 font is not saved. */ 954 ret = -ENOSYS; 955 break; 956 #else 957 { 958 op.op = KD_FONT_OP_SET_DEFAULT; 959 op.data = NULL; 960 ret = con_font_op(vc_cons[fg_console].d, &op); 961 if (ret) 962 break; 963 console_lock(); 964 con_set_default_unimap(vc_cons[fg_console].d); 965 console_unlock(); 966 break; 967 } 968 #endif 969 } 970 971 case KDFONTOP: { 972 if (copy_from_user(&op, up, sizeof(op))) { 973 ret = -EFAULT; 974 break; 975 } 976 if (!perm && op.op != KD_FONT_OP_GET) 977 return -EPERM; 978 ret = con_font_op(vc, &op); 979 if (ret) 980 break; 981 if (copy_to_user(up, &op, sizeof(op))) 982 ret = -EFAULT; 983 break; 984 } 985 986 case PIO_SCRNMAP: 987 if (!perm) 988 ret = -EPERM; 989 else 990 ret = con_set_trans_old(up); 991 break; 992 993 case GIO_SCRNMAP: 994 ret = con_get_trans_old(up); 995 break; 996 997 case PIO_UNISCRNMAP: 998 if (!perm) 999 ret = -EPERM; 1000 else 1001 ret = con_set_trans_new(up); 1002 break; 1003 1004 case GIO_UNISCRNMAP: 1005 ret = con_get_trans_new(up); 1006 break; 1007 1008 case PIO_UNIMAPCLR: 1009 if (!perm) 1010 return -EPERM; 1011 con_clear_unimap(vc); 1012 break; 1013 1014 case PIO_UNIMAP: 1015 case GIO_UNIMAP: 1016 ret = do_unimap_ioctl(cmd, up, perm, vc); 1017 break; 1018 1019 case VT_LOCKSWITCH: 1020 if (!capable(CAP_SYS_TTY_CONFIG)) 1021 return -EPERM; 1022 vt_dont_switch = 1; 1023 break; 1024 case VT_UNLOCKSWITCH: 1025 if (!capable(CAP_SYS_TTY_CONFIG)) 1026 return -EPERM; 1027 vt_dont_switch = 0; 1028 break; 1029 case VT_GETHIFONTMASK: 1030 ret = put_user(vc->vc_hi_font_mask, 1031 (unsigned short __user *)arg); 1032 break; 1033 case VT_WAITEVENT: 1034 ret = vt_event_wait_ioctl((struct vt_event __user *)arg); 1035 break; 1036 default: 1037 ret = -ENOIOCTLCMD; 1038 } 1039 out: 1040 return ret; 1041 } 1042 1043 void reset_vc(struct vc_data *vc) 1044 { 1045 vc->vc_mode = KD_TEXT; 1046 vt_reset_unicode(vc->vc_num); 1047 vc->vt_mode.mode = VT_AUTO; 1048 vc->vt_mode.waitv = 0; 1049 vc->vt_mode.relsig = 0; 1050 vc->vt_mode.acqsig = 0; 1051 vc->vt_mode.frsig = 0; 1052 put_pid(vc->vt_pid); 1053 vc->vt_pid = NULL; 1054 vc->vt_newvt = -1; 1055 if (!in_interrupt()) /* Via keyboard.c:SAK() - akpm */ 1056 reset_palette(vc); 1057 } 1058 1059 void vc_SAK(struct work_struct *work) 1060 { 1061 struct vc *vc_con = 1062 container_of(work, struct vc, SAK_work); 1063 struct vc_data *vc; 1064 struct tty_struct *tty; 1065 1066 console_lock(); 1067 vc = vc_con->d; 1068 if (vc) { 1069 /* FIXME: review tty ref counting */ 1070 tty = vc->port.tty; 1071 /* 1072 * SAK should also work in all raw modes and reset 1073 * them properly. 1074 */ 1075 if (tty) 1076 __do_SAK(tty); 1077 reset_vc(vc); 1078 } 1079 console_unlock(); 1080 } 1081 1082 #ifdef CONFIG_COMPAT 1083 1084 struct compat_consolefontdesc { 1085 unsigned short charcount; /* characters in font (256 or 512) */ 1086 unsigned short charheight; /* scan lines per character (1-32) */ 1087 compat_caddr_t chardata; /* font data in expanded form */ 1088 }; 1089 1090 static inline int 1091 compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, 1092 int perm, struct console_font_op *op) 1093 { 1094 struct compat_consolefontdesc cfdarg; 1095 int i; 1096 1097 if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc))) 1098 return -EFAULT; 1099 1100 switch (cmd) { 1101 case PIO_FONTX: 1102 if (!perm) 1103 return -EPERM; 1104 op->op = KD_FONT_OP_SET; 1105 op->flags = KD_FONT_FLAG_OLD; 1106 op->width = 8; 1107 op->height = cfdarg.charheight; 1108 op->charcount = cfdarg.charcount; 1109 op->data = compat_ptr(cfdarg.chardata); 1110 return con_font_op(vc_cons[fg_console].d, op); 1111 case GIO_FONTX: 1112 op->op = KD_FONT_OP_GET; 1113 op->flags = KD_FONT_FLAG_OLD; 1114 op->width = 8; 1115 op->height = cfdarg.charheight; 1116 op->charcount = cfdarg.charcount; 1117 op->data = compat_ptr(cfdarg.chardata); 1118 i = con_font_op(vc_cons[fg_console].d, op); 1119 if (i) 1120 return i; 1121 cfdarg.charheight = op->height; 1122 cfdarg.charcount = op->charcount; 1123 if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc))) 1124 return -EFAULT; 1125 return 0; 1126 } 1127 return -EINVAL; 1128 } 1129 1130 struct compat_console_font_op { 1131 compat_uint_t op; /* operation code KD_FONT_OP_* */ 1132 compat_uint_t flags; /* KD_FONT_FLAG_* */ 1133 compat_uint_t width, height; /* font size */ 1134 compat_uint_t charcount; 1135 compat_caddr_t data; /* font data with height fixed to 32 */ 1136 }; 1137 1138 static inline int 1139 compat_kdfontop_ioctl(struct compat_console_font_op __user *fontop, 1140 int perm, struct console_font_op *op, struct vc_data *vc) 1141 { 1142 int i; 1143 1144 if (copy_from_user(op, fontop, sizeof(struct compat_console_font_op))) 1145 return -EFAULT; 1146 if (!perm && op->op != KD_FONT_OP_GET) 1147 return -EPERM; 1148 op->data = compat_ptr(((struct compat_console_font_op *)op)->data); 1149 i = con_font_op(vc, op); 1150 if (i) 1151 return i; 1152 ((struct compat_console_font_op *)op)->data = (unsigned long)op->data; 1153 if (copy_to_user(fontop, op, sizeof(struct compat_console_font_op))) 1154 return -EFAULT; 1155 return 0; 1156 } 1157 1158 struct compat_unimapdesc { 1159 unsigned short entry_ct; 1160 compat_caddr_t entries; 1161 }; 1162 1163 static inline int 1164 compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud, 1165 int perm, struct vc_data *vc) 1166 { 1167 struct compat_unimapdesc tmp; 1168 struct unipair __user *tmp_entries; 1169 1170 if (copy_from_user(&tmp, user_ud, sizeof tmp)) 1171 return -EFAULT; 1172 tmp_entries = compat_ptr(tmp.entries); 1173 if (tmp_entries) 1174 if (!access_ok(VERIFY_WRITE, tmp_entries, 1175 tmp.entry_ct*sizeof(struct unipair))) 1176 return -EFAULT; 1177 switch (cmd) { 1178 case PIO_UNIMAP: 1179 if (!perm) 1180 return -EPERM; 1181 return con_set_unimap(vc, tmp.entry_ct, tmp_entries); 1182 case GIO_UNIMAP: 1183 if (!perm && fg_console != vc->vc_num) 1184 return -EPERM; 1185 return con_get_unimap(vc, tmp.entry_ct, &(user_ud->entry_ct), tmp_entries); 1186 } 1187 return 0; 1188 } 1189 1190 long vt_compat_ioctl(struct tty_struct *tty, 1191 unsigned int cmd, unsigned long arg) 1192 { 1193 struct vc_data *vc = tty->driver_data; 1194 struct console_font_op op; /* used in multiple places here */ 1195 unsigned int console; 1196 void __user *up = (void __user *)arg; 1197 int perm; 1198 int ret = 0; 1199 1200 console = vc->vc_num; 1201 1202 if (!vc_cons_allocated(console)) { /* impossible? */ 1203 ret = -ENOIOCTLCMD; 1204 goto out; 1205 } 1206 1207 /* 1208 * To have permissions to do most of the vt ioctls, we either have 1209 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG. 1210 */ 1211 perm = 0; 1212 if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG)) 1213 perm = 1; 1214 1215 switch (cmd) { 1216 /* 1217 * these need special handlers for incompatible data structures 1218 */ 1219 case PIO_FONTX: 1220 case GIO_FONTX: 1221 ret = compat_fontx_ioctl(cmd, up, perm, &op); 1222 break; 1223 1224 case KDFONTOP: 1225 ret = compat_kdfontop_ioctl(up, perm, &op, vc); 1226 break; 1227 1228 case PIO_UNIMAP: 1229 case GIO_UNIMAP: 1230 ret = compat_unimap_ioctl(cmd, up, perm, vc); 1231 break; 1232 1233 /* 1234 * all these treat 'arg' as an integer 1235 */ 1236 case KIOCSOUND: 1237 case KDMKTONE: 1238 #ifdef CONFIG_X86 1239 case KDADDIO: 1240 case KDDELIO: 1241 #endif 1242 case KDSETMODE: 1243 case KDMAPDISP: 1244 case KDUNMAPDISP: 1245 case KDSKBMODE: 1246 case KDSKBMETA: 1247 case KDSKBLED: 1248 case KDSETLED: 1249 case KDSIGACCEPT: 1250 case VT_ACTIVATE: 1251 case VT_WAITACTIVE: 1252 case VT_RELDISP: 1253 case VT_DISALLOCATE: 1254 case VT_RESIZE: 1255 case VT_RESIZEX: 1256 goto fallback; 1257 1258 /* 1259 * the rest has a compatible data structure behind arg, 1260 * but we have to convert it to a proper 64 bit pointer. 1261 */ 1262 default: 1263 arg = (unsigned long)compat_ptr(arg); 1264 goto fallback; 1265 } 1266 out: 1267 return ret; 1268 1269 fallback: 1270 return vt_ioctl(tty, cmd, arg); 1271 } 1272 1273 1274 #endif /* CONFIG_COMPAT */ 1275 1276 1277 /* 1278 * Performs the back end of a vt switch. Called under the console 1279 * semaphore. 1280 */ 1281 static void complete_change_console(struct vc_data *vc) 1282 { 1283 unsigned char old_vc_mode; 1284 int old = fg_console; 1285 1286 last_console = fg_console; 1287 1288 /* 1289 * If we're switching, we could be going from KD_GRAPHICS to 1290 * KD_TEXT mode or vice versa, which means we need to blank or 1291 * unblank the screen later. 1292 */ 1293 old_vc_mode = vc_cons[fg_console].d->vc_mode; 1294 switch_screen(vc); 1295 1296 /* 1297 * This can't appear below a successful kill_pid(). If it did, 1298 * then the *blank_screen operation could occur while X, having 1299 * received acqsig, is waking up on another processor. This 1300 * condition can lead to overlapping accesses to the VGA range 1301 * and the framebuffer (causing system lockups). 1302 * 1303 * To account for this we duplicate this code below only if the 1304 * controlling process is gone and we've called reset_vc. 1305 */ 1306 if (old_vc_mode != vc->vc_mode) { 1307 if (vc->vc_mode == KD_TEXT) 1308 do_unblank_screen(1); 1309 else 1310 do_blank_screen(1); 1311 } 1312 1313 /* 1314 * If this new console is under process control, send it a signal 1315 * telling it that it has acquired. Also check if it has died and 1316 * clean up (similar to logic employed in change_console()) 1317 */ 1318 if (vc->vt_mode.mode == VT_PROCESS) { 1319 /* 1320 * Send the signal as privileged - kill_pid() will 1321 * tell us if the process has gone or something else 1322 * is awry 1323 */ 1324 if (kill_pid(vc->vt_pid, vc->vt_mode.acqsig, 1) != 0) { 1325 /* 1326 * The controlling process has died, so we revert back to 1327 * normal operation. In this case, we'll also change back 1328 * to KD_TEXT mode. I'm not sure if this is strictly correct 1329 * but it saves the agony when the X server dies and the screen 1330 * remains blanked due to KD_GRAPHICS! It would be nice to do 1331 * this outside of VT_PROCESS but there is no single process 1332 * to account for and tracking tty count may be undesirable. 1333 */ 1334 reset_vc(vc); 1335 1336 if (old_vc_mode != vc->vc_mode) { 1337 if (vc->vc_mode == KD_TEXT) 1338 do_unblank_screen(1); 1339 else 1340 do_blank_screen(1); 1341 } 1342 } 1343 } 1344 1345 /* 1346 * Wake anyone waiting for their VT to activate 1347 */ 1348 vt_event_post(VT_EVENT_SWITCH, old, vc->vc_num); 1349 return; 1350 } 1351 1352 /* 1353 * Performs the front-end of a vt switch 1354 */ 1355 void change_console(struct vc_data *new_vc) 1356 { 1357 struct vc_data *vc; 1358 1359 if (!new_vc || new_vc->vc_num == fg_console || vt_dont_switch) 1360 return; 1361 1362 /* 1363 * If this vt is in process mode, then we need to handshake with 1364 * that process before switching. Essentially, we store where that 1365 * vt wants to switch to and wait for it to tell us when it's done 1366 * (via VT_RELDISP ioctl). 1367 * 1368 * We also check to see if the controlling process still exists. 1369 * If it doesn't, we reset this vt to auto mode and continue. 1370 * This is a cheap way to track process control. The worst thing 1371 * that can happen is: we send a signal to a process, it dies, and 1372 * the switch gets "lost" waiting for a response; hopefully, the 1373 * user will try again, we'll detect the process is gone (unless 1374 * the user waits just the right amount of time :-) and revert the 1375 * vt to auto control. 1376 */ 1377 vc = vc_cons[fg_console].d; 1378 if (vc->vt_mode.mode == VT_PROCESS) { 1379 /* 1380 * Send the signal as privileged - kill_pid() will 1381 * tell us if the process has gone or something else 1382 * is awry. 1383 * 1384 * We need to set vt_newvt *before* sending the signal or we 1385 * have a race. 1386 */ 1387 vc->vt_newvt = new_vc->vc_num; 1388 if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) { 1389 /* 1390 * It worked. Mark the vt to switch to and 1391 * return. The process needs to send us a 1392 * VT_RELDISP ioctl to complete the switch. 1393 */ 1394 return; 1395 } 1396 1397 /* 1398 * The controlling process has died, so we revert back to 1399 * normal operation. In this case, we'll also change back 1400 * to KD_TEXT mode. I'm not sure if this is strictly correct 1401 * but it saves the agony when the X server dies and the screen 1402 * remains blanked due to KD_GRAPHICS! It would be nice to do 1403 * this outside of VT_PROCESS but there is no single process 1404 * to account for and tracking tty count may be undesirable. 1405 */ 1406 reset_vc(vc); 1407 1408 /* 1409 * Fall through to normal (VT_AUTO) handling of the switch... 1410 */ 1411 } 1412 1413 /* 1414 * Ignore all switches in KD_GRAPHICS+VT_AUTO mode 1415 */ 1416 if (vc->vc_mode == KD_GRAPHICS) 1417 return; 1418 1419 complete_change_console(new_vc); 1420 } 1421 1422 /* Perform a kernel triggered VT switch for suspend/resume */ 1423 1424 static int disable_vt_switch; 1425 1426 int vt_move_to_console(unsigned int vt, int alloc) 1427 { 1428 int prev; 1429 1430 console_lock(); 1431 /* Graphics mode - up to X */ 1432 if (disable_vt_switch) { 1433 console_unlock(); 1434 return 0; 1435 } 1436 prev = fg_console; 1437 1438 if (alloc && vc_allocate(vt)) { 1439 /* we can't have a free VC for now. Too bad, 1440 * we don't want to mess the screen for now. */ 1441 console_unlock(); 1442 return -ENOSPC; 1443 } 1444 1445 if (set_console(vt)) { 1446 /* 1447 * We're unable to switch to the SUSPEND_CONSOLE. 1448 * Let the calling function know so it can decide 1449 * what to do. 1450 */ 1451 console_unlock(); 1452 return -EIO; 1453 } 1454 console_unlock(); 1455 if (vt_waitactive(vt + 1)) { 1456 pr_debug("Suspend: Can't switch VCs."); 1457 return -EINTR; 1458 } 1459 return prev; 1460 } 1461 1462 /* 1463 * Normally during a suspend, we allocate a new console and switch to it. 1464 * When we resume, we switch back to the original console. This switch 1465 * can be slow, so on systems where the framebuffer can handle restoration 1466 * of video registers anyways, there's little point in doing the console 1467 * switch. This function allows you to disable it by passing it '0'. 1468 */ 1469 void pm_set_vt_switch(int do_switch) 1470 { 1471 console_lock(); 1472 disable_vt_switch = !do_switch; 1473 console_unlock(); 1474 } 1475 EXPORT_SYMBOL(pm_set_vt_switch); 1476