1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Provide access to virtual console memory.
4 * /dev/vcs: the screen as it is being viewed right now (possibly scrolled)
5 * /dev/vcsN: the screen of /dev/ttyN (1 <= N <= 63)
6 * [minor: N]
7 *
8 * /dev/vcsaN: idem, but including attributes, and prefixed with
9 * the 4 bytes lines,columns,x,y (as screendump used to give).
10 * Attribute/character pair is in native endianity.
11 * [minor: N+128]
12 *
13 * /dev/vcsuN: similar to /dev/vcsaN but using 4-byte unicode values
14 * instead of 1-byte screen glyph values.
15 * [minor: N+64]
16 *
17 * /dev/vcsuaN: same idea as /dev/vcsaN for unicode (not yet implemented).
18 *
19 * This replaces screendump and part of selection, so that the system
20 * administrator can control access using file system permissions.
21 *
22 * aeb@cwi.nl - efter Friedas begravelse - 950211
23 *
24 * machek@k332.feld.cvut.cz - modified not to send characters to wrong console
25 * - fixed some fatal off-by-one bugs (0-- no longer == -1 -> looping and looping and looping...)
26 * - making it shorter - scr_readw are macros which expand in PRETTY long code
27 */
28
29 #include <linux/kernel.h>
30 #include <linux/major.h>
31 #include <linux/errno.h>
32 #include <linux/export.h>
33 #include <linux/tty.h>
34 #include <linux/interrupt.h>
35 #include <linux/mm.h>
36 #include <linux/init.h>
37 #include <linux/vt_kern.h>
38 #include <linux/selection.h>
39 #include <linux/kbd_kern.h>
40 #include <linux/console.h>
41 #include <linux/device.h>
42 #include <linux/sched.h>
43 #include <linux/fs.h>
44 #include <linux/poll.h>
45 #include <linux/signal.h>
46 #include <linux/slab.h>
47 #include <linux/notifier.h>
48
49 #include <linux/uaccess.h>
50 #include <asm/byteorder.h>
51 #include <asm/unaligned.h>
52
53 #undef attr
54 #undef org
55 #undef addr
56 #define HEADER_SIZE 4
57
58 #define CON_BUF_SIZE (CONFIG_BASE_SMALL ? 256 : PAGE_SIZE)
59
60 /*
61 * Our minor space:
62 *
63 * 0 ... 63 glyph mode without attributes
64 * 64 ... 127 unicode mode without attributes
65 * 128 ... 191 glyph mode with attributes
66 * 192 ... 255 unused (reserved for unicode with attributes)
67 *
68 * This relies on MAX_NR_CONSOLES being <= 63, meaning 63 actual consoles
69 * with minors 0, 64, 128 and 192 being proxies for the foreground console.
70 */
71 #if MAX_NR_CONSOLES > 63
72 #warning "/dev/vcs* devices may not accommodate more than 63 consoles"
73 #endif
74
75 #define console(inode) (iminor(inode) & 63)
76 #define use_unicode(inode) (iminor(inode) & 64)
77 #define use_attributes(inode) (iminor(inode) & 128)
78
79
80 struct vcs_poll_data {
81 struct notifier_block notifier;
82 unsigned int cons_num;
83 int event;
84 wait_queue_head_t waitq;
85 struct fasync_struct *fasync;
86 };
87
88 static int
vcs_notifier(struct notifier_block * nb,unsigned long code,void * _param)89 vcs_notifier(struct notifier_block *nb, unsigned long code, void *_param)
90 {
91 struct vt_notifier_param *param = _param;
92 struct vc_data *vc = param->vc;
93 struct vcs_poll_data *poll =
94 container_of(nb, struct vcs_poll_data, notifier);
95 int currcons = poll->cons_num;
96 int fa_band;
97
98 switch (code) {
99 case VT_UPDATE:
100 fa_band = POLL_PRI;
101 break;
102 case VT_DEALLOCATE:
103 fa_band = POLL_HUP;
104 break;
105 default:
106 return NOTIFY_DONE;
107 }
108
109 if (currcons == 0)
110 currcons = fg_console;
111 else
112 currcons--;
113 if (currcons != vc->vc_num)
114 return NOTIFY_DONE;
115
116 poll->event = code;
117 wake_up_interruptible(&poll->waitq);
118 kill_fasync(&poll->fasync, SIGIO, fa_band);
119 return NOTIFY_OK;
120 }
121
122 static void
vcs_poll_data_free(struct vcs_poll_data * poll)123 vcs_poll_data_free(struct vcs_poll_data *poll)
124 {
125 unregister_vt_notifier(&poll->notifier);
126 kfree(poll);
127 }
128
129 static struct vcs_poll_data *
vcs_poll_data_get(struct file * file)130 vcs_poll_data_get(struct file *file)
131 {
132 struct vcs_poll_data *poll = file->private_data, *kill = NULL;
133
134 if (poll)
135 return poll;
136
137 poll = kzalloc(sizeof(*poll), GFP_KERNEL);
138 if (!poll)
139 return NULL;
140 poll->cons_num = console(file_inode(file));
141 init_waitqueue_head(&poll->waitq);
142 poll->notifier.notifier_call = vcs_notifier;
143 /*
144 * In order not to lose any update event, we must pretend one might
145 * have occurred before we have a chance to register our notifier.
146 * This is also how user space has come to detect which kernels
147 * support POLLPRI on /dev/vcs* devices i.e. using poll() with
148 * POLLPRI and a zero timeout.
149 */
150 poll->event = VT_UPDATE;
151
152 if (register_vt_notifier(&poll->notifier) != 0) {
153 kfree(poll);
154 return NULL;
155 }
156
157 /*
158 * This code may be called either through ->poll() or ->fasync().
159 * If we have two threads using the same file descriptor, they could
160 * both enter this function, both notice that the structure hasn't
161 * been allocated yet and go ahead allocating it in parallel, but
162 * only one of them must survive and be shared otherwise we'd leak
163 * memory with a dangling notifier callback.
164 */
165 spin_lock(&file->f_lock);
166 if (!file->private_data) {
167 file->private_data = poll;
168 } else {
169 /* someone else raced ahead of us */
170 kill = poll;
171 poll = file->private_data;
172 }
173 spin_unlock(&file->f_lock);
174 if (kill)
175 vcs_poll_data_free(kill);
176
177 return poll;
178 }
179
180 /*
181 * Returns VC for inode.
182 * Must be called with console_lock.
183 */
184 static struct vc_data*
vcs_vc(struct inode * inode,int * viewed)185 vcs_vc(struct inode *inode, int *viewed)
186 {
187 unsigned int currcons = console(inode);
188
189 WARN_CONSOLE_UNLOCKED();
190
191 if (currcons == 0) {
192 currcons = fg_console;
193 if (viewed)
194 *viewed = 1;
195 } else {
196 currcons--;
197 if (viewed)
198 *viewed = 0;
199 }
200 return vc_cons[currcons].d;
201 }
202
203 /**
204 * vcs_size -- return size for a VC in @vc
205 * @vc: which VC
206 * @attr: does it use attributes?
207 * @unicode: is it unicode?
208 *
209 * Must be called with console_lock.
210 */
vcs_size(const struct vc_data * vc,bool attr,bool unicode)211 static int vcs_size(const struct vc_data *vc, bool attr, bool unicode)
212 {
213 int size;
214
215 WARN_CONSOLE_UNLOCKED();
216
217 size = vc->vc_rows * vc->vc_cols;
218
219 if (attr) {
220 if (unicode)
221 return -EOPNOTSUPP;
222
223 size = 2 * size + HEADER_SIZE;
224 } else if (unicode)
225 size *= 4;
226
227 return size;
228 }
229
vcs_lseek(struct file * file,loff_t offset,int orig)230 static loff_t vcs_lseek(struct file *file, loff_t offset, int orig)
231 {
232 struct inode *inode = file_inode(file);
233 struct vc_data *vc;
234 int size;
235
236 console_lock();
237 vc = vcs_vc(inode, NULL);
238 if (!vc) {
239 console_unlock();
240 return -ENXIO;
241 }
242
243 size = vcs_size(vc, use_attributes(inode), use_unicode(inode));
244 console_unlock();
245 if (size < 0)
246 return size;
247 return fixed_size_llseek(file, offset, orig, size);
248 }
249
250
251 static ssize_t
vcs_read(struct file * file,char __user * buf,size_t count,loff_t * ppos)252 vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
253 {
254 struct inode *inode = file_inode(file);
255 struct vc_data *vc;
256 struct vcs_poll_data *poll;
257 long pos, read;
258 int attr, uni_mode, row, col, maxcol, viewed;
259 unsigned short *org = NULL;
260 ssize_t ret;
261 char *con_buf;
262
263 con_buf = (char *) __get_free_page(GFP_KERNEL);
264 if (!con_buf)
265 return -ENOMEM;
266
267 pos = *ppos;
268
269 /* Select the proper current console and verify
270 * sanity of the situation under the console lock.
271 */
272 console_lock();
273
274 uni_mode = use_unicode(inode);
275 attr = use_attributes(inode);
276
277 ret = -EINVAL;
278 if (pos < 0)
279 goto unlock_out;
280 /* we enforce 32-bit alignment for pos and count in unicode mode */
281 if (uni_mode && (pos | count) & 3)
282 goto unlock_out;
283
284 poll = file->private_data;
285 if (count && poll)
286 poll->event = 0;
287 read = 0;
288 ret = 0;
289 while (count) {
290 char *con_buf0, *con_buf_start;
291 long this_round, size;
292 ssize_t orig_count;
293 long p = pos;
294
295 vc = vcs_vc(inode, &viewed);
296 if (!vc) {
297 ret = -ENXIO;
298 break;
299 }
300
301 /* Check whether we are above size each round,
302 * as copy_to_user at the end of this loop
303 * could sleep.
304 */
305 size = vcs_size(vc, attr, uni_mode);
306 if (size < 0) {
307 ret = size;
308 break;
309 }
310 if (pos >= size)
311 break;
312 if (count > size - pos)
313 count = size - pos;
314
315 this_round = count;
316 if (this_round > CON_BUF_SIZE)
317 this_round = CON_BUF_SIZE;
318
319 /* Perform the whole read into the local con_buf.
320 * Then we can drop the console spinlock and safely
321 * attempt to move it to userspace.
322 */
323
324 con_buf_start = con_buf0 = con_buf;
325 orig_count = this_round;
326 maxcol = vc->vc_cols;
327 if (uni_mode) {
328 unsigned int nr;
329
330 ret = vc_uniscr_check(vc);
331 if (ret)
332 break;
333 p /= 4;
334 row = p / vc->vc_cols;
335 col = p % maxcol;
336 nr = maxcol - col;
337 do {
338 if (nr > this_round/4)
339 nr = this_round/4;
340 vc_uniscr_copy_line(vc, con_buf0, viewed,
341 row, col, nr);
342 con_buf0 += nr * 4;
343 this_round -= nr * 4;
344 row++;
345 col = 0;
346 nr = maxcol;
347 } while (this_round);
348 } else if (!attr) {
349 org = screen_pos(vc, p, viewed);
350 col = p % maxcol;
351 p += maxcol - col;
352 while (this_round-- > 0) {
353 *con_buf0++ = (vcs_scr_readw(vc, org++) & 0xff);
354 if (++col == maxcol) {
355 org = screen_pos(vc, p, viewed);
356 col = 0;
357 p += maxcol;
358 }
359 }
360 } else {
361 if (p < HEADER_SIZE) {
362 size_t tmp_count;
363
364 /* clamp header values if they don't fit */
365 con_buf0[0] = min(vc->vc_rows, 0xFFu);
366 con_buf0[1] = min(vc->vc_cols, 0xFFu);
367 getconsxy(vc, con_buf0 + 2);
368
369 con_buf_start += p;
370 this_round += p;
371 if (this_round > CON_BUF_SIZE) {
372 this_round = CON_BUF_SIZE;
373 orig_count = this_round - p;
374 }
375
376 tmp_count = HEADER_SIZE;
377 if (tmp_count > this_round)
378 tmp_count = this_round;
379
380 /* Advance state pointers and move on. */
381 this_round -= tmp_count;
382 p = HEADER_SIZE;
383 con_buf0 = con_buf + HEADER_SIZE;
384 /* If this_round >= 0, then p is even... */
385 } else if (p & 1) {
386 /* Skip first byte for output if start address is odd
387 * Update region sizes up/down depending on free
388 * space in buffer.
389 */
390 con_buf_start++;
391 if (this_round < CON_BUF_SIZE)
392 this_round++;
393 else
394 orig_count--;
395 }
396 if (this_round > 0) {
397 unsigned short *tmp_buf = (unsigned short *)con_buf0;
398
399 p -= HEADER_SIZE;
400 p /= 2;
401 col = p % maxcol;
402
403 org = screen_pos(vc, p, viewed);
404 p += maxcol - col;
405
406 /* Buffer has even length, so we can always copy
407 * character + attribute. We do not copy last byte
408 * to userspace if this_round is odd.
409 */
410 this_round = (this_round + 1) >> 1;
411
412 while (this_round) {
413 *tmp_buf++ = vcs_scr_readw(vc, org++);
414 this_round --;
415 if (++col == maxcol) {
416 org = screen_pos(vc, p, viewed);
417 col = 0;
418 p += maxcol;
419 }
420 }
421 }
422 }
423
424 /* Finally, release the console semaphore while we push
425 * all the data to userspace from our temporary buffer.
426 *
427 * AKPM: Even though it's a semaphore, we should drop it because
428 * the pagefault handling code may want to call printk().
429 */
430
431 console_unlock();
432 ret = copy_to_user(buf, con_buf_start, orig_count);
433 console_lock();
434
435 if (ret) {
436 read += (orig_count - ret);
437 ret = -EFAULT;
438 break;
439 }
440 buf += orig_count;
441 pos += orig_count;
442 read += orig_count;
443 count -= orig_count;
444 }
445 *ppos += read;
446 if (read)
447 ret = read;
448 unlock_out:
449 console_unlock();
450 free_page((unsigned long) con_buf);
451 return ret;
452 }
453
454 static ssize_t
vcs_write(struct file * file,const char __user * buf,size_t count,loff_t * ppos)455 vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
456 {
457 struct inode *inode = file_inode(file);
458 struct vc_data *vc;
459 long pos;
460 long attr, size, written;
461 char *con_buf0;
462 int col, maxcol, viewed;
463 u16 *org0 = NULL, *org = NULL;
464 size_t ret;
465 char *con_buf;
466
467 if (use_unicode(inode))
468 return -EOPNOTSUPP;
469
470 con_buf = (char *) __get_free_page(GFP_KERNEL);
471 if (!con_buf)
472 return -ENOMEM;
473
474 pos = *ppos;
475
476 /* Select the proper current console and verify
477 * sanity of the situation under the console lock.
478 */
479 console_lock();
480
481 attr = use_attributes(inode);
482 ret = -ENXIO;
483 vc = vcs_vc(inode, &viewed);
484 if (!vc)
485 goto unlock_out;
486
487 size = vcs_size(vc, attr, false);
488 if (size < 0) {
489 ret = size;
490 goto unlock_out;
491 }
492 ret = -EINVAL;
493 if (pos < 0 || pos > size)
494 goto unlock_out;
495 if (count > size - pos)
496 count = size - pos;
497 written = 0;
498 while (count) {
499 long this_round = count;
500 size_t orig_count;
501 long p;
502
503 if (this_round > CON_BUF_SIZE)
504 this_round = CON_BUF_SIZE;
505
506 /* Temporarily drop the console lock so that we can read
507 * in the write data from userspace safely.
508 */
509 console_unlock();
510 ret = copy_from_user(con_buf, buf, this_round);
511 console_lock();
512
513 if (ret) {
514 this_round -= ret;
515 if (!this_round) {
516 /* Abort loop if no data were copied. Otherwise
517 * fail with -EFAULT.
518 */
519 if (written)
520 break;
521 ret = -EFAULT;
522 goto unlock_out;
523 }
524 }
525
526 /* The vc might have been freed or vcs_size might have changed
527 * while we slept to grab the user buffer, so recheck.
528 * Return data written up to now on failure.
529 */
530 vc = vcs_vc(inode, &viewed);
531 if (!vc) {
532 if (written)
533 break;
534 ret = -ENXIO;
535 goto unlock_out;
536 }
537 size = vcs_size(vc, attr, false);
538 if (size < 0) {
539 if (written)
540 break;
541 ret = size;
542 goto unlock_out;
543 }
544 if (pos >= size)
545 break;
546 if (this_round > size - pos)
547 this_round = size - pos;
548
549 /* OK, now actually push the write to the console
550 * under the lock using the local kernel buffer.
551 */
552
553 con_buf0 = con_buf;
554 orig_count = this_round;
555 maxcol = vc->vc_cols;
556 p = pos;
557 if (!attr) {
558 org0 = org = screen_pos(vc, p, viewed);
559 col = p % maxcol;
560 p += maxcol - col;
561
562 while (this_round > 0) {
563 unsigned char c = *con_buf0++;
564
565 this_round--;
566 vcs_scr_writew(vc,
567 (vcs_scr_readw(vc, org) & 0xff00) | c, org);
568 org++;
569 if (++col == maxcol) {
570 org = screen_pos(vc, p, viewed);
571 col = 0;
572 p += maxcol;
573 }
574 }
575 } else {
576 if (p < HEADER_SIZE) {
577 char header[HEADER_SIZE];
578
579 getconsxy(vc, header + 2);
580 while (p < HEADER_SIZE && this_round > 0) {
581 this_round--;
582 header[p++] = *con_buf0++;
583 }
584 if (!viewed)
585 putconsxy(vc, header + 2);
586 }
587 p -= HEADER_SIZE;
588 col = (p/2) % maxcol;
589 if (this_round > 0) {
590 org0 = org = screen_pos(vc, p/2, viewed);
591 if ((p & 1) && this_round > 0) {
592 char c;
593
594 this_round--;
595 c = *con_buf0++;
596 #ifdef __BIG_ENDIAN
597 vcs_scr_writew(vc, c |
598 (vcs_scr_readw(vc, org) & 0xff00), org);
599 #else
600 vcs_scr_writew(vc, (c << 8) |
601 (vcs_scr_readw(vc, org) & 0xff), org);
602 #endif
603 org++;
604 p++;
605 if (++col == maxcol) {
606 org = screen_pos(vc, p/2, viewed);
607 col = 0;
608 }
609 }
610 p /= 2;
611 p += maxcol - col;
612 }
613 while (this_round > 1) {
614 unsigned short w;
615
616 w = get_unaligned(((unsigned short *)con_buf0));
617 vcs_scr_writew(vc, w, org++);
618 con_buf0 += 2;
619 this_round -= 2;
620 if (++col == maxcol) {
621 org = screen_pos(vc, p, viewed);
622 col = 0;
623 p += maxcol;
624 }
625 }
626 if (this_round > 0) {
627 unsigned char c;
628
629 c = *con_buf0++;
630 #ifdef __BIG_ENDIAN
631 vcs_scr_writew(vc, (vcs_scr_readw(vc, org) & 0xff) | (c << 8), org);
632 #else
633 vcs_scr_writew(vc, (vcs_scr_readw(vc, org) & 0xff00) | c, org);
634 #endif
635 }
636 }
637 count -= orig_count;
638 written += orig_count;
639 buf += orig_count;
640 pos += orig_count;
641 if (org0)
642 update_region(vc, (unsigned long)(org0), org - org0);
643 }
644 *ppos += written;
645 ret = written;
646 if (written)
647 vcs_scr_updated(vc);
648
649 unlock_out:
650 console_unlock();
651 free_page((unsigned long) con_buf);
652 return ret;
653 }
654
655 static __poll_t
vcs_poll(struct file * file,poll_table * wait)656 vcs_poll(struct file *file, poll_table *wait)
657 {
658 struct vcs_poll_data *poll = vcs_poll_data_get(file);
659 __poll_t ret = DEFAULT_POLLMASK|EPOLLERR;
660
661 if (poll) {
662 poll_wait(file, &poll->waitq, wait);
663 switch (poll->event) {
664 case VT_UPDATE:
665 ret = DEFAULT_POLLMASK|EPOLLPRI;
666 break;
667 case VT_DEALLOCATE:
668 ret = DEFAULT_POLLMASK|EPOLLHUP|EPOLLERR;
669 break;
670 case 0:
671 ret = DEFAULT_POLLMASK;
672 break;
673 }
674 }
675 return ret;
676 }
677
678 static int
vcs_fasync(int fd,struct file * file,int on)679 vcs_fasync(int fd, struct file *file, int on)
680 {
681 struct vcs_poll_data *poll = file->private_data;
682
683 if (!poll) {
684 /* don't allocate anything if all we want is disable fasync */
685 if (!on)
686 return 0;
687 poll = vcs_poll_data_get(file);
688 if (!poll)
689 return -ENOMEM;
690 }
691
692 return fasync_helper(fd, file, on, &poll->fasync);
693 }
694
695 static int
vcs_open(struct inode * inode,struct file * filp)696 vcs_open(struct inode *inode, struct file *filp)
697 {
698 unsigned int currcons = console(inode);
699 bool attr = use_attributes(inode);
700 bool uni_mode = use_unicode(inode);
701 int ret = 0;
702
703 /* we currently don't support attributes in unicode mode */
704 if (attr && uni_mode)
705 return -EOPNOTSUPP;
706
707 console_lock();
708 if(currcons && !vc_cons_allocated(currcons-1))
709 ret = -ENXIO;
710 console_unlock();
711 return ret;
712 }
713
vcs_release(struct inode * inode,struct file * file)714 static int vcs_release(struct inode *inode, struct file *file)
715 {
716 struct vcs_poll_data *poll = file->private_data;
717
718 if (poll)
719 vcs_poll_data_free(poll);
720 return 0;
721 }
722
723 static const struct file_operations vcs_fops = {
724 .llseek = vcs_lseek,
725 .read = vcs_read,
726 .write = vcs_write,
727 .poll = vcs_poll,
728 .fasync = vcs_fasync,
729 .open = vcs_open,
730 .release = vcs_release,
731 };
732
733 static struct class *vc_class;
734
vcs_make_sysfs(int index)735 void vcs_make_sysfs(int index)
736 {
737 device_create(vc_class, NULL, MKDEV(VCS_MAJOR, index + 1), NULL,
738 "vcs%u", index + 1);
739 device_create(vc_class, NULL, MKDEV(VCS_MAJOR, index + 65), NULL,
740 "vcsu%u", index + 1);
741 device_create(vc_class, NULL, MKDEV(VCS_MAJOR, index + 129), NULL,
742 "vcsa%u", index + 1);
743 }
744
vcs_remove_sysfs(int index)745 void vcs_remove_sysfs(int index)
746 {
747 device_destroy(vc_class, MKDEV(VCS_MAJOR, index + 1));
748 device_destroy(vc_class, MKDEV(VCS_MAJOR, index + 65));
749 device_destroy(vc_class, MKDEV(VCS_MAJOR, index + 129));
750 }
751
vcs_init(void)752 int __init vcs_init(void)
753 {
754 unsigned int i;
755
756 if (register_chrdev(VCS_MAJOR, "vcs", &vcs_fops))
757 panic("unable to get major %d for vcs device", VCS_MAJOR);
758 vc_class = class_create(THIS_MODULE, "vc");
759
760 device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 0), NULL, "vcs");
761 device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 64), NULL, "vcsu");
762 device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 128), NULL, "vcsa");
763 for (i = 0; i < MIN_NR_CONSOLES; i++)
764 vcs_make_sysfs(i);
765 return 0;
766 }
767