2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* linux/drivers/video/vgacon.c -- Low level VGA based console driver
|
|
|
|
*
|
|
|
|
* Created 28 Sep 1997 by Geert Uytterhoeven
|
|
|
|
*
|
|
|
|
* Rewritten by Martin Mares <mj@ucw.cz>, July 1998
|
|
|
|
*
|
|
|
|
* This file is based on the old console.c, vga.c and vesa_blank.c drivers.
|
|
|
|
*
|
|
|
|
* Copyright (C) 1991, 1992 Linus Torvalds
|
|
|
|
* 1995 Jay Estabrook
|
|
|
|
*
|
|
|
|
* User definable mapping table and font loading by Eugene G. Crosser,
|
|
|
|
* <crosser@average.org>
|
|
|
|
*
|
|
|
|
* Improved loadable font/UTF-8 support by H. Peter Anvin
|
|
|
|
* Feb-Sep 1995 <peter.anvin@linux.org>
|
|
|
|
*
|
|
|
|
* Colour palette handling, by Simon Tatham
|
|
|
|
* 17-Jun-95 <sgt20@cam.ac.uk>
|
|
|
|
*
|
|
|
|
* if 512 char mode is already enabled don't re-enable it,
|
|
|
|
* because it causes screen to flicker, by Mitja Horvat
|
|
|
|
* 5-May-96 <mitja.horvat@guest.arnes.si>
|
|
|
|
*
|
|
|
|
* Use 2 outw instead of 4 outb_p to reduce erroneous text
|
|
|
|
* flashing on RHS of screen during heavy console scrolling .
|
|
|
|
* Oct 1996, Paul Gortmaker.
|
|
|
|
*
|
|
|
|
*
|
|
|
|
* This file is subject to the terms and conditions of the GNU General Public
|
|
|
|
* License. See the file COPYING in the main directory of this archive for
|
|
|
|
* more details.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/types.h>
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/console.h>
|
|
|
|
#include <linux/string.h>
|
|
|
|
#include <linux/kd.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/vt_kern.h>
|
2013-06-27 04:07:39 +04:00
|
|
|
#include <linux/sched.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
#include <linux/selection.h>
|
|
|
|
#include <linux/spinlock.h>
|
|
|
|
#include <linux/ioport.h>
|
|
|
|
#include <linux/init.h>
|
2006-07-10 15:44:13 +04:00
|
|
|
#include <linux/screen_info.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
#include <video/vga.h>
|
|
|
|
#include <asm/io.h>
|
|
|
|
|
2009-07-25 18:17:02 +04:00
|
|
|
static DEFINE_RAW_SPINLOCK(vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
static int cursor_size_lastfrom;
|
|
|
|
static int cursor_size_lastto;
|
2006-01-08 12:02:36 +03:00
|
|
|
static u32 vgacon_xres;
|
|
|
|
static u32 vgacon_yres;
|
2014-10-14 15:53:49 +04:00
|
|
|
static struct vgastate vgastate;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
#define BLANK 0x0020
|
|
|
|
|
2006-01-08 12:02:36 +03:00
|
|
|
#define VGA_FONTWIDTH 8 /* VGA does not support fontwidths != 8 */
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* Interface used by the world
|
|
|
|
*/
|
|
|
|
|
|
|
|
static const char *vgacon_startup(void);
|
|
|
|
static void vgacon_init(struct vc_data *c, int init);
|
|
|
|
static void vgacon_deinit(struct vc_data *c);
|
|
|
|
static void vgacon_cursor(struct vc_data *c, int mode);
|
|
|
|
static int vgacon_switch(struct vc_data *c);
|
|
|
|
static int vgacon_blank(struct vc_data *c, int blank, int mode_switch);
|
2016-06-23 14:34:26 +03:00
|
|
|
static void vgacon_scrolldelta(struct vc_data *c, int lines);
|
2005-04-17 02:20:36 +04:00
|
|
|
static int vgacon_set_origin(struct vc_data *c);
|
|
|
|
static void vgacon_save_screen(struct vc_data *c);
|
|
|
|
static void vgacon_invert_region(struct vc_data *c, u16 * p, int count);
|
2022-06-07 13:49:12 +03:00
|
|
|
static struct uni_pagedict *vgacon_uni_pagedir;
|
2014-05-13 14:09:27 +04:00
|
|
|
static int vgacon_refcount;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
/* Description of the hardware situation */
|
2006-12-08 13:40:29 +03:00
|
|
|
static unsigned long vga_vram_base __read_mostly; /* Base of video memory */
|
|
|
|
static unsigned long vga_vram_end __read_mostly; /* End of video memory */
|
|
|
|
static unsigned int vga_vram_size __read_mostly; /* Size of video memory */
|
|
|
|
static u16 vga_video_port_reg __read_mostly; /* Video register select port */
|
|
|
|
static u16 vga_video_port_val __read_mostly; /* Video register value port */
|
|
|
|
static unsigned int vga_video_num_columns; /* Number of text columns */
|
|
|
|
static unsigned int vga_video_num_lines; /* Number of text lines */
|
2016-10-03 12:18:38 +03:00
|
|
|
static bool vga_can_do_color; /* Do we support colors? */
|
2006-12-08 13:40:29 +03:00
|
|
|
static unsigned int vga_default_font_height __read_mostly; /* Height of default screen font */
|
|
|
|
static unsigned char vga_video_type __read_mostly; /* Card type */
|
2005-04-17 02:20:36 +04:00
|
|
|
static int vga_vesa_blanked;
|
2016-10-03 12:18:38 +03:00
|
|
|
static bool vga_palette_blanked;
|
|
|
|
static bool vga_is_gfx;
|
|
|
|
static bool vga_512_chars;
|
2005-04-17 02:20:36 +04:00
|
|
|
static int vga_video_font_height;
|
2006-12-08 13:40:29 +03:00
|
|
|
static int vga_scan_lines __read_mostly;
|
2021-03-02 09:21:34 +03:00
|
|
|
static unsigned int vga_rolled_over; /* last vc_origin offset before wrap */
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2016-10-03 12:18:38 +03:00
|
|
|
static bool vga_hardscroll_enabled;
|
|
|
|
static bool vga_hardscroll_user_enable = true;
|
2008-11-08 01:05:41 +03:00
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
static int __init no_scroll(char *str)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Disabling scrollback is required for the Braillex ib80-piezo
|
|
|
|
* Braille reader made by F.H. Papenmeier (Germany).
|
|
|
|
* Use the "no-scroll" bootflag.
|
|
|
|
*/
|
2016-10-03 12:18:38 +03:00
|
|
|
vga_hardscroll_user_enable = vga_hardscroll_enabled = false;
|
2005-04-17 02:20:36 +04:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
__setup("no-scroll", no_scroll);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* By replacing the four outb_p with two back to back outw, we can reduce
|
|
|
|
* the window of opportunity to see text mislocated to the RHS of the
|
|
|
|
* console during heavy scrolling activity. However there is the remote
|
|
|
|
* possibility that some pre-dinosaur hardware won't like the back to back
|
|
|
|
* I/O. Since the Xservers get away with it, we should be able to as well.
|
|
|
|
*/
|
|
|
|
static inline void write_vga(unsigned char reg, unsigned int val)
|
|
|
|
{
|
|
|
|
unsigned int v1, v2;
|
|
|
|
unsigned long flags;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* ddprintk might set the console position from interrupt
|
|
|
|
* handlers, thus the write has to be IRQ-atomic.
|
|
|
|
*/
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irqsave(&vga_lock, flags);
|
2005-04-17 02:20:36 +04:00
|
|
|
v1 = reg + (val & 0xff00);
|
|
|
|
v2 = reg + 1 + ((val << 8) & 0xff00);
|
|
|
|
outw(v1, vga_video_port_reg);
|
|
|
|
outw(v2, vga_video_port_reg);
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irqrestore(&vga_lock, flags);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
2006-03-27 13:17:20 +04:00
|
|
|
static inline void vga_set_mem_top(struct vc_data *c)
|
|
|
|
{
|
|
|
|
write_vga(12, (c->vc_visible_origin - vga_vram_base) / 2);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void vgacon_restore_screen(struct vc_data *c)
|
|
|
|
{
|
|
|
|
if (c->vc_origin != c->vc_visible_origin)
|
|
|
|
vgacon_scrolldelta(c, 0);
|
|
|
|
}
|
|
|
|
|
2016-06-23 14:34:26 +03:00
|
|
|
static void vgacon_scrolldelta(struct vc_data *c, int lines)
|
2006-03-27 13:17:20 +04:00
|
|
|
{
|
2016-10-03 12:18:35 +03:00
|
|
|
vc_scrolldelta_helper(c, lines, vga_rolled_over, (void *)vga_vram_base,
|
|
|
|
vga_vram_size);
|
2006-03-27 13:17:20 +04:00
|
|
|
vga_set_mem_top(c);
|
|
|
|
}
|
2017-01-13 23:07:56 +03:00
|
|
|
|
[PATCH] Detaching fbcon: fix vgacon to allow retaking of the console
One of the limitations of the framebuffer console system is its inablity to
unload or detach itself from the console layer. And once it loads, it also
locks in framebuffer drivers preventing their unload. Although the con2fbmap
utility does provide a means to unload individual drivers, it requires that at
least one framebuffer driver is loaded for use by fbcon.
With this change, it is possible to detach fbcon from the console layer. If it
is detached, it will reattach the boot console driver (which is permanently
loaded) back to the console layer so the system can continue to work. As a
consequence, fbcon will also decrement its reference count of individual
framebuffer drivers, allowing all of these drivers to be unloaded even if
fbcon is still loaded.
Unless you use drivers that restores the display to text mode (rivafb and
i810fb, for example), detaching fbcon does require assistance from userspace
tools (ie, vbetools) for text mode to be restored completely. Without the
help of these tools, fbcon will leave the VGA console corrupted. The methods
that can be used will be described in Documentation/fb/fbcon.txt.
Because the vt layer also increments the module reference count for each
console driver, fbcon cannot be directly unloaded. It must be detached first
prior to unload.
Similarly, fbcon can be reattached to the console layer without having to
reload the module. A nice feature if fbcon is compiled statically.
Attaching and detaching fbcon is done via sysfs attributes. A class device
entry for fbcon is created in /sys/class/graphics. The two attributes that
controls this feature are detach and attach. Two other attributes that are
piggybacked under /sys/class/graphics/fb[n] that are fbcon-specific,
'con_rotate' and 'con_rotate_all' are moved to fbcon. They are renamed as
'rotate' and 'rotate_all' respectively.
Overall, this feature is a great help for developers working in the
framebuffer or console layer. There is not need to continually reboot the
kernel for every small change. It is also useful for regular users who wants
to choose between a graphical console or a text console without having to
reboot.
Example usage for x86:
/* start in text mode */
modprobe xxxfb
modprobe fbcon
/* graphical mode with fbcon using xxxfb */
echo 1 > /sys/class/graphics/fbcon/detach
/* back to text mode, will produce corrupt display unless vbetool is used */
rmmod xxxfb
modprobe yyyfb
/* back to graphical mode with fbcon using yyyfb */
Before trying out this feature, please read Documentation/fb/fbcon.txt.
This patch:
In order for fbcon to detach itself from the console layer, vgacon, which is a
boot console driver, must be fixed so it can retake the console multiple
times, not just during init. The following needs to be done:
- remove __init from the vgacon_startup, this is called again by
take_over_console().
- vc->rows and vc->cols are set manually by vgacon during init. After init,
vc_resize() can be used
- make sure the scrollback_buffer is not reallocated
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-26 11:27:02 +04:00
|
|
|
static const char *vgacon_startup(void)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
|
|
|
const char *display_desc = NULL;
|
|
|
|
u16 saved1, saved2;
|
|
|
|
volatile u16 *p;
|
|
|
|
|
2011-01-13 04:00:04 +03:00
|
|
|
if (screen_info.orig_video_isVGA == VIDEO_TYPE_VLFB ||
|
|
|
|
screen_info.orig_video_isVGA == VIDEO_TYPE_EFI) {
|
2005-04-17 02:20:36 +04:00
|
|
|
no_vga:
|
|
|
|
#ifdef CONFIG_DUMMY_CONSOLE
|
|
|
|
conswitchp = &dummy_con;
|
|
|
|
return conswitchp->con_startup();
|
|
|
|
#else
|
|
|
|
return NULL;
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2017-09-04 17:00:50 +03:00
|
|
|
/* boot_params.screen_info reasonably initialized? */
|
|
|
|
if ((screen_info.orig_video_lines == 0) ||
|
2007-10-17 09:36:04 +04:00
|
|
|
(screen_info.orig_video_cols == 0))
|
2007-05-17 09:11:09 +04:00
|
|
|
goto no_vga;
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/* VGA16 modes are not handled by VGACON */
|
2007-10-17 09:36:04 +04:00
|
|
|
if ((screen_info.orig_video_mode == 0x0D) || /* 320x200/4 */
|
|
|
|
(screen_info.orig_video_mode == 0x0E) || /* 640x200/4 */
|
|
|
|
(screen_info.orig_video_mode == 0x10) || /* 640x350/4 */
|
|
|
|
(screen_info.orig_video_mode == 0x12) || /* 640x480/4 */
|
|
|
|
(screen_info.orig_video_mode == 0x6A)) /* 800x600/4 (VESA) */
|
2005-04-17 02:20:36 +04:00
|
|
|
goto no_vga;
|
|
|
|
|
2007-10-17 09:36:04 +04:00
|
|
|
vga_video_num_lines = screen_info.orig_video_lines;
|
|
|
|
vga_video_num_columns = screen_info.orig_video_cols;
|
2014-10-14 15:53:49 +04:00
|
|
|
vgastate.vgabase = NULL;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-17 09:36:04 +04:00
|
|
|
if (screen_info.orig_video_mode == 7) {
|
|
|
|
/* Monochrome display */
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_vram_base = 0xb0000;
|
|
|
|
vga_video_port_reg = VGA_CRT_IM;
|
|
|
|
vga_video_port_val = VGA_CRT_DM;
|
2007-10-17 09:36:04 +04:00
|
|
|
if ((screen_info.orig_video_ega_bx & 0xff) != 0x10) {
|
2005-04-17 02:20:36 +04:00
|
|
|
static struct resource ega_console_resource =
|
2017-12-01 20:06:39 +03:00
|
|
|
{ .name = "ega",
|
|
|
|
.flags = IORESOURCE_IO,
|
|
|
|
.start = 0x3B0,
|
|
|
|
.end = 0x3BF };
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_video_type = VIDEO_TYPE_EGAM;
|
[PATCH] vgacon: make VGA_MAP_MEM take size, remove extra use
VGA_MAP_MEM translates to ioremap() on some architectures. It makes sense
to do this to vga_vram_base, because we're going to access memory between
vga_vram_base and vga_vram_end.
But it doesn't really make sense to map starting at vga_vram_end, because
we aren't going to access memory starting there. On ia64, which always has
to be different, ioremapping vga_vram_end gives you something completely
incompatible with ioremapped vga_vram_start, so vga_vram_size ends up being
nonsense.
As a bonus, we often know the size up front, so we can use ioremap()
correctly, rather than giving it a zero size.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: "Luck, Tony" <tony.luck@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-23 01:47:32 +04:00
|
|
|
vga_vram_size = 0x8000;
|
2005-04-17 02:20:36 +04:00
|
|
|
display_desc = "EGA+";
|
|
|
|
request_resource(&ioport_resource,
|
|
|
|
&ega_console_resource);
|
|
|
|
} else {
|
|
|
|
static struct resource mda1_console_resource =
|
2017-12-01 20:06:39 +03:00
|
|
|
{ .name = "mda",
|
|
|
|
.flags = IORESOURCE_IO,
|
|
|
|
.start = 0x3B0,
|
|
|
|
.end = 0x3BB };
|
2005-04-17 02:20:36 +04:00
|
|
|
static struct resource mda2_console_resource =
|
2017-12-01 20:06:39 +03:00
|
|
|
{ .name = "mda",
|
|
|
|
.flags = IORESOURCE_IO,
|
|
|
|
.start = 0x3BF,
|
|
|
|
.end = 0x3BF };
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_video_type = VIDEO_TYPE_MDA;
|
[PATCH] vgacon: make VGA_MAP_MEM take size, remove extra use
VGA_MAP_MEM translates to ioremap() on some architectures. It makes sense
to do this to vga_vram_base, because we're going to access memory between
vga_vram_base and vga_vram_end.
But it doesn't really make sense to map starting at vga_vram_end, because
we aren't going to access memory starting there. On ia64, which always has
to be different, ioremapping vga_vram_end gives you something completely
incompatible with ioremapped vga_vram_start, so vga_vram_size ends up being
nonsense.
As a bonus, we often know the size up front, so we can use ioremap()
correctly, rather than giving it a zero size.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: "Luck, Tony" <tony.luck@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-23 01:47:32 +04:00
|
|
|
vga_vram_size = 0x2000;
|
2005-04-17 02:20:36 +04:00
|
|
|
display_desc = "*MDA";
|
|
|
|
request_resource(&ioport_resource,
|
|
|
|
&mda1_console_resource);
|
|
|
|
request_resource(&ioport_resource,
|
|
|
|
&mda2_console_resource);
|
|
|
|
vga_video_font_height = 14;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/* If not, it is color. */
|
2016-10-03 12:18:38 +03:00
|
|
|
vga_can_do_color = true;
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_vram_base = 0xb8000;
|
|
|
|
vga_video_port_reg = VGA_CRT_IC;
|
|
|
|
vga_video_port_val = VGA_CRT_DC;
|
2007-10-17 09:36:04 +04:00
|
|
|
if ((screen_info.orig_video_ega_bx & 0xff) != 0x10) {
|
2005-04-17 02:20:36 +04:00
|
|
|
int i;
|
|
|
|
|
[PATCH] vgacon: make VGA_MAP_MEM take size, remove extra use
VGA_MAP_MEM translates to ioremap() on some architectures. It makes sense
to do this to vga_vram_base, because we're going to access memory between
vga_vram_base and vga_vram_end.
But it doesn't really make sense to map starting at vga_vram_end, because
we aren't going to access memory starting there. On ia64, which always has
to be different, ioremapping vga_vram_end gives you something completely
incompatible with ioremapped vga_vram_start, so vga_vram_size ends up being
nonsense.
As a bonus, we often know the size up front, so we can use ioremap()
correctly, rather than giving it a zero size.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: "Luck, Tony" <tony.luck@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-23 01:47:32 +04:00
|
|
|
vga_vram_size = 0x8000;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-17 09:36:04 +04:00
|
|
|
if (!screen_info.orig_video_isVGA) {
|
2017-12-01 20:06:39 +03:00
|
|
|
static struct resource ega_console_resource =
|
|
|
|
{ .name = "ega",
|
|
|
|
.flags = IORESOURCE_IO,
|
|
|
|
.start = 0x3C0,
|
|
|
|
.end = 0x3DF };
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_video_type = VIDEO_TYPE_EGAC;
|
|
|
|
display_desc = "EGA";
|
|
|
|
request_resource(&ioport_resource,
|
|
|
|
&ega_console_resource);
|
|
|
|
} else {
|
2017-12-01 20:06:39 +03:00
|
|
|
static struct resource vga_console_resource =
|
|
|
|
{ .name = "vga+",
|
|
|
|
.flags = IORESOURCE_IO,
|
|
|
|
.start = 0x3C0,
|
|
|
|
.end = 0x3DF };
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_video_type = VIDEO_TYPE_VGAC;
|
|
|
|
display_desc = "VGA+";
|
|
|
|
request_resource(&ioport_resource,
|
|
|
|
&vga_console_resource);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Normalise the palette registers, to point
|
|
|
|
* the 16 screen colours to the first 16
|
|
|
|
* DAC entries.
|
|
|
|
*/
|
|
|
|
|
|
|
|
for (i = 0; i < 16; i++) {
|
|
|
|
inb_p(VGA_IS1_RC);
|
|
|
|
outb_p(i, VGA_ATT_W);
|
|
|
|
outb_p(i, VGA_ATT_W);
|
|
|
|
}
|
|
|
|
outb_p(0x20, VGA_ATT_W);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Now set the DAC registers back to their
|
|
|
|
* default values
|
|
|
|
*/
|
|
|
|
for (i = 0; i < 16; i++) {
|
|
|
|
outb_p(color_table[i], VGA_PEL_IW);
|
|
|
|
outb_p(default_red[i], VGA_PEL_D);
|
|
|
|
outb_p(default_grn[i], VGA_PEL_D);
|
|
|
|
outb_p(default_blu[i], VGA_PEL_D);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
static struct resource cga_console_resource =
|
2017-12-01 20:06:39 +03:00
|
|
|
{ .name = "cga",
|
|
|
|
.flags = IORESOURCE_IO,
|
|
|
|
.start = 0x3D4,
|
|
|
|
.end = 0x3D5 };
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_video_type = VIDEO_TYPE_CGA;
|
[PATCH] vgacon: make VGA_MAP_MEM take size, remove extra use
VGA_MAP_MEM translates to ioremap() on some architectures. It makes sense
to do this to vga_vram_base, because we're going to access memory between
vga_vram_base and vga_vram_end.
But it doesn't really make sense to map starting at vga_vram_end, because
we aren't going to access memory starting there. On ia64, which always has
to be different, ioremapping vga_vram_end gives you something completely
incompatible with ioremapped vga_vram_start, so vga_vram_size ends up being
nonsense.
As a bonus, we often know the size up front, so we can use ioremap()
correctly, rather than giving it a zero size.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: "Luck, Tony" <tony.luck@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-23 01:47:32 +04:00
|
|
|
vga_vram_size = 0x2000;
|
2005-04-17 02:20:36 +04:00
|
|
|
display_desc = "*CGA";
|
|
|
|
request_resource(&ioport_resource,
|
|
|
|
&cga_console_resource);
|
|
|
|
vga_video_font_height = 8;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
[PATCH] vgacon: make VGA_MAP_MEM take size, remove extra use
VGA_MAP_MEM translates to ioremap() on some architectures. It makes sense
to do this to vga_vram_base, because we're going to access memory between
vga_vram_base and vga_vram_end.
But it doesn't really make sense to map starting at vga_vram_end, because
we aren't going to access memory starting there. On ia64, which always has
to be different, ioremapping vga_vram_end gives you something completely
incompatible with ioremapped vga_vram_start, so vga_vram_size ends up being
nonsense.
As a bonus, we often know the size up front, so we can use ioremap()
correctly, rather than giving it a zero size.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: "Luck, Tony" <tony.luck@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-23 01:47:32 +04:00
|
|
|
vga_vram_base = VGA_MAP_MEM(vga_vram_base, vga_vram_size);
|
|
|
|
vga_vram_end = vga_vram_base + vga_vram_size;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Find out if there is a graphics card present.
|
|
|
|
* Are there smarter methods around?
|
|
|
|
*/
|
|
|
|
p = (volatile u16 *) vga_vram_base;
|
|
|
|
saved1 = scr_readw(p);
|
|
|
|
saved2 = scr_readw(p + 1);
|
|
|
|
scr_writew(0xAA55, p);
|
|
|
|
scr_writew(0x55AA, p + 1);
|
|
|
|
if (scr_readw(p) != 0xAA55 || scr_readw(p + 1) != 0x55AA) {
|
|
|
|
scr_writew(saved1, p);
|
|
|
|
scr_writew(saved2, p + 1);
|
|
|
|
goto no_vga;
|
|
|
|
}
|
|
|
|
scr_writew(0x55AA, p);
|
|
|
|
scr_writew(0xAA55, p + 1);
|
|
|
|
if (scr_readw(p) != 0x55AA || scr_readw(p + 1) != 0xAA55) {
|
|
|
|
scr_writew(saved1, p);
|
|
|
|
scr_writew(saved2, p + 1);
|
|
|
|
goto no_vga;
|
|
|
|
}
|
|
|
|
scr_writew(saved1, p);
|
|
|
|
scr_writew(saved2, p + 1);
|
|
|
|
|
|
|
|
if (vga_video_type == VIDEO_TYPE_EGAC
|
|
|
|
|| vga_video_type == VIDEO_TYPE_VGAC
|
|
|
|
|| vga_video_type == VIDEO_TYPE_EGAM) {
|
|
|
|
vga_hardscroll_enabled = vga_hardscroll_user_enable;
|
2007-10-17 09:36:04 +04:00
|
|
|
vga_default_font_height = screen_info.orig_video_points;
|
|
|
|
vga_video_font_height = screen_info.orig_video_points;
|
2005-04-17 02:20:36 +04:00
|
|
|
/* This may be suboptimal but is a safe bet - go with it */
|
|
|
|
vga_scan_lines =
|
|
|
|
vga_video_font_height * vga_video_num_lines;
|
|
|
|
}
|
2006-01-08 12:02:36 +03:00
|
|
|
|
2007-10-17 09:36:04 +04:00
|
|
|
vgacon_xres = screen_info.orig_video_cols * VGA_FONTWIDTH;
|
2006-01-08 12:02:36 +03:00
|
|
|
vgacon_yres = vga_scan_lines;
|
[PATCH] Detaching fbcon: fix vgacon to allow retaking of the console
One of the limitations of the framebuffer console system is its inablity to
unload or detach itself from the console layer. And once it loads, it also
locks in framebuffer drivers preventing their unload. Although the con2fbmap
utility does provide a means to unload individual drivers, it requires that at
least one framebuffer driver is loaded for use by fbcon.
With this change, it is possible to detach fbcon from the console layer. If it
is detached, it will reattach the boot console driver (which is permanently
loaded) back to the console layer so the system can continue to work. As a
consequence, fbcon will also decrement its reference count of individual
framebuffer drivers, allowing all of these drivers to be unloaded even if
fbcon is still loaded.
Unless you use drivers that restores the display to text mode (rivafb and
i810fb, for example), detaching fbcon does require assistance from userspace
tools (ie, vbetools) for text mode to be restored completely. Without the
help of these tools, fbcon will leave the VGA console corrupted. The methods
that can be used will be described in Documentation/fb/fbcon.txt.
Because the vt layer also increments the module reference count for each
console driver, fbcon cannot be directly unloaded. It must be detached first
prior to unload.
Similarly, fbcon can be reattached to the console layer without having to
reload the module. A nice feature if fbcon is compiled statically.
Attaching and detaching fbcon is done via sysfs attributes. A class device
entry for fbcon is created in /sys/class/graphics. The two attributes that
controls this feature are detach and attach. Two other attributes that are
piggybacked under /sys/class/graphics/fb[n] that are fbcon-specific,
'con_rotate' and 'con_rotate_all' are moved to fbcon. They are renamed as
'rotate' and 'rotate_all' respectively.
Overall, this feature is a great help for developers working in the
framebuffer or console layer. There is not need to continually reboot the
kernel for every small change. It is also useful for regular users who wants
to choose between a graphical console or a text console without having to
reboot.
Example usage for x86:
/* start in text mode */
modprobe xxxfb
modprobe fbcon
/* graphical mode with fbcon using xxxfb */
echo 1 > /sys/class/graphics/fbcon/detach
/* back to text mode, will produce corrupt display unless vbetool is used */
rmmod xxxfb
modprobe yyyfb
/* back to graphical mode with fbcon using yyyfb */
Before trying out this feature, please read Documentation/fb/fbcon.txt.
This patch:
In order for fbcon to detach itself from the console layer, vgacon, which is a
boot console driver, must be fixed so it can retake the console multiple
times, not just during init. The following needs to be done:
- remove __init from the vgacon_startup, this is called again by
take_over_console().
- vc->rows and vc->cols are set manually by vgacon during init. After init,
vc_resize() can be used
- make sure the scrollback_buffer is not reallocated
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-26 11:27:02 +04:00
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
return display_desc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void vgacon_init(struct vc_data *c, int init)
|
|
|
|
{
|
2022-06-07 13:49:12 +03:00
|
|
|
struct uni_pagedict *p;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
[PATCH] Detaching fbcon: fix vgacon to allow retaking of the console
One of the limitations of the framebuffer console system is its inablity to
unload or detach itself from the console layer. And once it loads, it also
locks in framebuffer drivers preventing their unload. Although the con2fbmap
utility does provide a means to unload individual drivers, it requires that at
least one framebuffer driver is loaded for use by fbcon.
With this change, it is possible to detach fbcon from the console layer. If it
is detached, it will reattach the boot console driver (which is permanently
loaded) back to the console layer so the system can continue to work. As a
consequence, fbcon will also decrement its reference count of individual
framebuffer drivers, allowing all of these drivers to be unloaded even if
fbcon is still loaded.
Unless you use drivers that restores the display to text mode (rivafb and
i810fb, for example), detaching fbcon does require assistance from userspace
tools (ie, vbetools) for text mode to be restored completely. Without the
help of these tools, fbcon will leave the VGA console corrupted. The methods
that can be used will be described in Documentation/fb/fbcon.txt.
Because the vt layer also increments the module reference count for each
console driver, fbcon cannot be directly unloaded. It must be detached first
prior to unload.
Similarly, fbcon can be reattached to the console layer without having to
reload the module. A nice feature if fbcon is compiled statically.
Attaching and detaching fbcon is done via sysfs attributes. A class device
entry for fbcon is created in /sys/class/graphics. The two attributes that
controls this feature are detach and attach. Two other attributes that are
piggybacked under /sys/class/graphics/fb[n] that are fbcon-specific,
'con_rotate' and 'con_rotate_all' are moved to fbcon. They are renamed as
'rotate' and 'rotate_all' respectively.
Overall, this feature is a great help for developers working in the
framebuffer or console layer. There is not need to continually reboot the
kernel for every small change. It is also useful for regular users who wants
to choose between a graphical console or a text console without having to
reboot.
Example usage for x86:
/* start in text mode */
modprobe xxxfb
modprobe fbcon
/* graphical mode with fbcon using xxxfb */
echo 1 > /sys/class/graphics/fbcon/detach
/* back to text mode, will produce corrupt display unless vbetool is used */
rmmod xxxfb
modprobe yyyfb
/* back to graphical mode with fbcon using yyyfb */
Before trying out this feature, please read Documentation/fb/fbcon.txt.
This patch:
In order for fbcon to detach itself from the console layer, vgacon, which is a
boot console driver, must be fixed so it can retake the console multiple
times, not just during init. The following needs to be done:
- remove __init from the vgacon_startup, this is called again by
take_over_console().
- vc->rows and vc->cols are set manually by vgacon during init. After init,
vc_resize() can be used
- make sure the scrollback_buffer is not reallocated
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-26 11:27:02 +04:00
|
|
|
/*
|
2021-10-26 01:26:22 +03:00
|
|
|
* We cannot be loaded as a module, therefore init will be 1
|
|
|
|
* if we are the default console, however if we are a fallback
|
|
|
|
* console, for example if fbcon has failed registration, then
|
|
|
|
* init will be 0, so we need to make sure our boot parameters
|
|
|
|
* have been copied to the console structure for vgacon_resize
|
|
|
|
* ultimately called by vc_resize. Any subsequent calls to
|
|
|
|
* vgacon_init init will have init set to 0 too.
|
[PATCH] Detaching fbcon: fix vgacon to allow retaking of the console
One of the limitations of the framebuffer console system is its inablity to
unload or detach itself from the console layer. And once it loads, it also
locks in framebuffer drivers preventing their unload. Although the con2fbmap
utility does provide a means to unload individual drivers, it requires that at
least one framebuffer driver is loaded for use by fbcon.
With this change, it is possible to detach fbcon from the console layer. If it
is detached, it will reattach the boot console driver (which is permanently
loaded) back to the console layer so the system can continue to work. As a
consequence, fbcon will also decrement its reference count of individual
framebuffer drivers, allowing all of these drivers to be unloaded even if
fbcon is still loaded.
Unless you use drivers that restores the display to text mode (rivafb and
i810fb, for example), detaching fbcon does require assistance from userspace
tools (ie, vbetools) for text mode to be restored completely. Without the
help of these tools, fbcon will leave the VGA console corrupted. The methods
that can be used will be described in Documentation/fb/fbcon.txt.
Because the vt layer also increments the module reference count for each
console driver, fbcon cannot be directly unloaded. It must be detached first
prior to unload.
Similarly, fbcon can be reattached to the console layer without having to
reload the module. A nice feature if fbcon is compiled statically.
Attaching and detaching fbcon is done via sysfs attributes. A class device
entry for fbcon is created in /sys/class/graphics. The two attributes that
controls this feature are detach and attach. Two other attributes that are
piggybacked under /sys/class/graphics/fb[n] that are fbcon-specific,
'con_rotate' and 'con_rotate_all' are moved to fbcon. They are renamed as
'rotate' and 'rotate_all' respectively.
Overall, this feature is a great help for developers working in the
framebuffer or console layer. There is not need to continually reboot the
kernel for every small change. It is also useful for regular users who wants
to choose between a graphical console or a text console without having to
reboot.
Example usage for x86:
/* start in text mode */
modprobe xxxfb
modprobe fbcon
/* graphical mode with fbcon using xxxfb */
echo 1 > /sys/class/graphics/fbcon/detach
/* back to text mode, will produce corrupt display unless vbetool is used */
rmmod xxxfb
modprobe yyyfb
/* back to graphical mode with fbcon using yyyfb */
Before trying out this feature, please read Documentation/fb/fbcon.txt.
This patch:
In order for fbcon to detach itself from the console layer, vgacon, which is a
boot console driver, must be fixed so it can retake the console multiple
times, not just during init. The following needs to be done:
- remove __init from the vgacon_startup, this is called again by
take_over_console().
- vc->rows and vc->cols are set manually by vgacon during init. After init,
vc_resize() can be used
- make sure the scrollback_buffer is not reallocated
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-26 11:27:02 +04:00
|
|
|
*/
|
2005-04-17 02:20:36 +04:00
|
|
|
c->vc_can_do_color = vga_can_do_color;
|
2021-10-26 01:26:22 +03:00
|
|
|
c->vc_scan_lines = vga_scan_lines;
|
|
|
|
c->vc_font.height = c->vc_cell_height = vga_video_font_height;
|
[PATCH] Detaching fbcon: fix vgacon to allow retaking of the console
One of the limitations of the framebuffer console system is its inablity to
unload or detach itself from the console layer. And once it loads, it also
locks in framebuffer drivers preventing their unload. Although the con2fbmap
utility does provide a means to unload individual drivers, it requires that at
least one framebuffer driver is loaded for use by fbcon.
With this change, it is possible to detach fbcon from the console layer. If it
is detached, it will reattach the boot console driver (which is permanently
loaded) back to the console layer so the system can continue to work. As a
consequence, fbcon will also decrement its reference count of individual
framebuffer drivers, allowing all of these drivers to be unloaded even if
fbcon is still loaded.
Unless you use drivers that restores the display to text mode (rivafb and
i810fb, for example), detaching fbcon does require assistance from userspace
tools (ie, vbetools) for text mode to be restored completely. Without the
help of these tools, fbcon will leave the VGA console corrupted. The methods
that can be used will be described in Documentation/fb/fbcon.txt.
Because the vt layer also increments the module reference count for each
console driver, fbcon cannot be directly unloaded. It must be detached first
prior to unload.
Similarly, fbcon can be reattached to the console layer without having to
reload the module. A nice feature if fbcon is compiled statically.
Attaching and detaching fbcon is done via sysfs attributes. A class device
entry for fbcon is created in /sys/class/graphics. The two attributes that
controls this feature are detach and attach. Two other attributes that are
piggybacked under /sys/class/graphics/fb[n] that are fbcon-specific,
'con_rotate' and 'con_rotate_all' are moved to fbcon. They are renamed as
'rotate' and 'rotate_all' respectively.
Overall, this feature is a great help for developers working in the
framebuffer or console layer. There is not need to continually reboot the
kernel for every small change. It is also useful for regular users who wants
to choose between a graphical console or a text console without having to
reboot.
Example usage for x86:
/* start in text mode */
modprobe xxxfb
modprobe fbcon
/* graphical mode with fbcon using xxxfb */
echo 1 > /sys/class/graphics/fbcon/detach
/* back to text mode, will produce corrupt display unless vbetool is used */
rmmod xxxfb
modprobe yyyfb
/* back to graphical mode with fbcon using yyyfb */
Before trying out this feature, please read Documentation/fb/fbcon.txt.
This patch:
In order for fbcon to detach itself from the console layer, vgacon, which is a
boot console driver, must be fixed so it can retake the console multiple
times, not just during init. The following needs to be done:
- remove __init from the vgacon_startup, this is called again by
take_over_console().
- vc->rows and vc->cols are set manually by vgacon during init. After init,
vc_resize() can be used
- make sure the scrollback_buffer is not reallocated
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-26 11:27:02 +04:00
|
|
|
|
|
|
|
/* set dimensions manually if init != 0 since vc_resize() will fail */
|
|
|
|
if (init) {
|
|
|
|
c->vc_cols = vga_video_num_columns;
|
|
|
|
c->vc_rows = vga_video_num_lines;
|
|
|
|
} else
|
|
|
|
vc_resize(c, vga_video_num_columns, vga_video_num_lines);
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
c->vc_complement_mask = 0x7700;
|
2005-05-01 19:59:07 +04:00
|
|
|
if (vga_512_chars)
|
|
|
|
c->vc_hi_font_mask = 0x0800;
|
2022-06-14 12:05:34 +03:00
|
|
|
p = *c->uni_pagedict_loc;
|
|
|
|
if (c->uni_pagedict_loc != &vgacon_uni_pagedir) {
|
2005-04-17 02:20:36 +04:00
|
|
|
con_free_unimap(c);
|
2022-06-14 12:05:34 +03:00
|
|
|
c->uni_pagedict_loc = &vgacon_uni_pagedir;
|
2014-05-13 14:09:27 +04:00
|
|
|
vgacon_refcount++;
|
|
|
|
}
|
|
|
|
if (!vgacon_uni_pagedir && p)
|
2005-04-17 02:20:36 +04:00
|
|
|
con_set_default_unimap(c);
|
2009-11-13 23:14:11 +03:00
|
|
|
|
2009-11-13 22:57:02 +03:00
|
|
|
/* Only set the default if the user didn't deliberately override it */
|
|
|
|
if (global_cursor_default == -1)
|
|
|
|
global_cursor_default =
|
|
|
|
!(screen_info.flags & VIDEO_FLAGS_NOCURSOR);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
static void vgacon_deinit(struct vc_data *c)
|
|
|
|
{
|
2009-09-23 03:47:53 +04:00
|
|
|
/* When closing the active console, reset video origin */
|
2016-06-23 14:34:35 +03:00
|
|
|
if (con_is_visible(c)) {
|
2005-04-17 02:20:36 +04:00
|
|
|
c->vc_visible_origin = vga_vram_base;
|
|
|
|
vga_set_mem_top(c);
|
|
|
|
}
|
2009-09-23 03:47:53 +04:00
|
|
|
|
2014-05-13 14:09:27 +04:00
|
|
|
if (!--vgacon_refcount)
|
2009-09-23 03:47:53 +04:00
|
|
|
con_free_unimap(c);
|
2022-06-14 12:05:34 +03:00
|
|
|
c->uni_pagedict_loc = &c->uni_pagedict;
|
2005-04-17 02:20:36 +04:00
|
|
|
con_set_default_unimap(c);
|
|
|
|
}
|
|
|
|
|
2020-06-15 10:48:34 +03:00
|
|
|
static u8 vgacon_build_attr(struct vc_data *c, u8 color,
|
|
|
|
enum vc_intensity intensity,
|
2020-06-15 10:48:35 +03:00
|
|
|
bool blink, bool underline, bool reverse,
|
|
|
|
bool italic)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
|
|
|
u8 attr = color;
|
|
|
|
|
|
|
|
if (vga_can_do_color) {
|
2007-05-08 11:38:04 +04:00
|
|
|
if (italic)
|
|
|
|
attr = (attr & 0xF0) | c->vc_itcolor;
|
|
|
|
else if (underline)
|
2005-04-17 02:20:36 +04:00
|
|
|
attr = (attr & 0xf0) | c->vc_ulcolor;
|
2020-06-15 10:48:34 +03:00
|
|
|
else if (intensity == VCI_HALF_BRIGHT)
|
2005-04-17 02:20:36 +04:00
|
|
|
attr = (attr & 0xf0) | c->vc_halfcolor;
|
|
|
|
}
|
|
|
|
if (reverse)
|
|
|
|
attr =
|
|
|
|
((attr) & 0x88) | ((((attr) >> 4) | ((attr) << 4)) &
|
|
|
|
0x77);
|
|
|
|
if (blink)
|
|
|
|
attr ^= 0x80;
|
2020-06-15 10:48:34 +03:00
|
|
|
if (intensity == VCI_BOLD)
|
2005-04-17 02:20:36 +04:00
|
|
|
attr ^= 0x08;
|
|
|
|
if (!vga_can_do_color) {
|
2007-05-08 11:38:04 +04:00
|
|
|
if (italic)
|
|
|
|
attr = (attr & 0xF8) | 0x02;
|
|
|
|
else if (underline)
|
2005-04-17 02:20:36 +04:00
|
|
|
attr = (attr & 0xf8) | 0x01;
|
2020-06-15 10:48:34 +03:00
|
|
|
else if (intensity == VCI_HALF_BRIGHT)
|
2005-04-17 02:20:36 +04:00
|
|
|
attr = (attr & 0xf0) | 0x08;
|
|
|
|
}
|
|
|
|
return attr;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void vgacon_invert_region(struct vc_data *c, u16 * p, int count)
|
|
|
|
{
|
2016-10-03 12:18:38 +03:00
|
|
|
const bool col = vga_can_do_color;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
while (count--) {
|
|
|
|
u16 a = scr_readw(p);
|
|
|
|
if (col)
|
|
|
|
a = ((a) & 0x88ff) | (((a) & 0x7000) >> 4) |
|
|
|
|
(((a) & 0x0700) << 4);
|
|
|
|
else
|
|
|
|
a ^= ((a & 0x0700) == 0x0100) ? 0x7000 : 0x7700;
|
|
|
|
scr_writew(a, p++);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void vgacon_set_cursor_size(int xpos, int from, int to)
|
|
|
|
{
|
|
|
|
unsigned long flags;
|
|
|
|
int curs, cure;
|
|
|
|
|
|
|
|
if ((from == cursor_size_lastfrom) && (to == cursor_size_lastto))
|
|
|
|
return;
|
|
|
|
cursor_size_lastfrom = from;
|
|
|
|
cursor_size_lastto = to;
|
|
|
|
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irqsave(&vga_lock, flags);
|
2006-03-27 13:17:19 +04:00
|
|
|
if (vga_video_type >= VIDEO_TYPE_VGAC) {
|
|
|
|
outb_p(VGA_CRTC_CURSOR_START, vga_video_port_reg);
|
|
|
|
curs = inb_p(vga_video_port_val);
|
|
|
|
outb_p(VGA_CRTC_CURSOR_END, vga_video_port_reg);
|
|
|
|
cure = inb_p(vga_video_port_val);
|
|
|
|
} else {
|
|
|
|
curs = 0;
|
|
|
|
cure = 0;
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
curs = (curs & 0xc0) | from;
|
|
|
|
cure = (cure & 0xe0) | to;
|
|
|
|
|
2006-03-27 13:17:19 +04:00
|
|
|
outb_p(VGA_CRTC_CURSOR_START, vga_video_port_reg);
|
2005-04-17 02:20:36 +04:00
|
|
|
outb_p(curs, vga_video_port_val);
|
2006-03-27 13:17:19 +04:00
|
|
|
outb_p(VGA_CRTC_CURSOR_END, vga_video_port_reg);
|
2005-04-17 02:20:36 +04:00
|
|
|
outb_p(cure, vga_video_port_val);
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irqrestore(&vga_lock, flags);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
static void vgacon_cursor(struct vc_data *c, int mode)
|
|
|
|
{
|
2007-05-08 11:40:06 +04:00
|
|
|
if (c->vc_mode != KD_TEXT)
|
|
|
|
return;
|
|
|
|
|
2006-03-27 13:17:20 +04:00
|
|
|
vgacon_restore_screen(c);
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
switch (mode) {
|
|
|
|
case CM_ERASE:
|
2005-11-06 00:19:50 +03:00
|
|
|
write_vga(14, (c->vc_pos - vga_vram_base) / 2);
|
2006-03-27 13:17:19 +04:00
|
|
|
if (vga_video_type >= VIDEO_TYPE_VGAC)
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x, 31, 30);
|
2006-03-27 13:17:19 +04:00
|
|
|
else
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x, 31, 31);
|
2005-04-17 02:20:36 +04:00
|
|
|
break;
|
|
|
|
|
|
|
|
case CM_MOVE:
|
|
|
|
case CM_DRAW:
|
|
|
|
write_vga(14, (c->vc_pos - vga_vram_base) / 2);
|
2020-06-15 10:48:58 +03:00
|
|
|
switch (CUR_SIZE(c->vc_cursor_type)) {
|
2005-04-17 02:20:36 +04:00
|
|
|
case CUR_UNDERLINE:
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x,
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
c->vc_cell_height -
|
|
|
|
(c->vc_cell_height <
|
2005-04-17 02:20:36 +04:00
|
|
|
10 ? 2 : 3),
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
c->vc_cell_height -
|
|
|
|
(c->vc_cell_height <
|
2005-04-17 02:20:36 +04:00
|
|
|
10 ? 1 : 2));
|
|
|
|
break;
|
|
|
|
case CUR_TWO_THIRDS:
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x,
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
c->vc_cell_height / 3,
|
|
|
|
c->vc_cell_height -
|
|
|
|
(c->vc_cell_height <
|
2005-04-17 02:20:36 +04:00
|
|
|
10 ? 1 : 2));
|
|
|
|
break;
|
|
|
|
case CUR_LOWER_THIRD:
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x,
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
(c->vc_cell_height * 2) / 3,
|
|
|
|
c->vc_cell_height -
|
|
|
|
(c->vc_cell_height <
|
2005-04-17 02:20:36 +04:00
|
|
|
10 ? 1 : 2));
|
|
|
|
break;
|
|
|
|
case CUR_LOWER_HALF:
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x,
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
c->vc_cell_height / 2,
|
|
|
|
c->vc_cell_height -
|
|
|
|
(c->vc_cell_height <
|
2005-04-17 02:20:36 +04:00
|
|
|
10 ? 1 : 2));
|
|
|
|
break;
|
|
|
|
case CUR_NONE:
|
2006-03-27 13:17:19 +04:00
|
|
|
if (vga_video_type >= VIDEO_TYPE_VGAC)
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x, 31, 30);
|
2006-03-27 13:17:19 +04:00
|
|
|
else
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x, 31, 31);
|
2005-04-17 02:20:36 +04:00
|
|
|
break;
|
|
|
|
default:
|
2020-06-15 10:48:33 +03:00
|
|
|
vgacon_set_cursor_size(c->state.x, 1,
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
c->vc_cell_height);
|
2005-04-17 02:20:36 +04:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2005-09-10 00:01:58 +04:00
|
|
|
static int vgacon_doresize(struct vc_data *c,
|
|
|
|
unsigned int width, unsigned int height)
|
|
|
|
{
|
|
|
|
unsigned long flags;
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
unsigned int scanlines = height * c->vc_cell_height;
|
2006-02-25 00:03:59 +03:00
|
|
|
u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan;
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irqsave(&vga_lock, flags);
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2006-01-08 12:02:36 +03:00
|
|
|
vgacon_xres = width * VGA_FONTWIDTH;
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
vgacon_yres = height * c->vc_cell_height;
|
2006-02-25 00:03:59 +03:00
|
|
|
if (vga_video_type >= VIDEO_TYPE_VGAC) {
|
|
|
|
outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
|
|
|
|
max_scan = inb_p(vga_video_port_val);
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2006-02-25 00:03:59 +03:00
|
|
|
if (max_scan & 0x80)
|
|
|
|
scanlines <<= 1;
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2006-02-25 00:03:59 +03:00
|
|
|
outb_p(VGA_CRTC_MODE, vga_video_port_reg);
|
|
|
|
mode = inb_p(vga_video_port_val);
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2006-02-25 00:03:59 +03:00
|
|
|
if (mode & 0x04)
|
|
|
|
scanlines >>= 1;
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2006-02-25 00:03:59 +03:00
|
|
|
scanlines -= 1;
|
|
|
|
scanlines_lo = scanlines & 0xff;
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2006-02-25 00:03:59 +03:00
|
|
|
outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
|
|
|
|
r7 = inb_p(vga_video_port_val) & ~0x42;
|
|
|
|
|
|
|
|
if (scanlines & 0x100)
|
|
|
|
r7 |= 0x02;
|
|
|
|
if (scanlines & 0x200)
|
|
|
|
r7 |= 0x40;
|
|
|
|
|
|
|
|
/* deprotect registers */
|
|
|
|
outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
|
|
|
|
vsync_end = inb_p(vga_video_port_val);
|
|
|
|
outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
|
|
|
|
outb_p(vsync_end & ~0x80, vga_video_port_val);
|
|
|
|
}
|
2005-09-10 00:01:58 +04:00
|
|
|
|
|
|
|
outb_p(VGA_CRTC_H_DISP, vga_video_port_reg);
|
|
|
|
outb_p(width - 1, vga_video_port_val);
|
|
|
|
outb_p(VGA_CRTC_OFFSET, vga_video_port_reg);
|
|
|
|
outb_p(width >> 1, vga_video_port_val);
|
|
|
|
|
2006-02-25 00:03:59 +03:00
|
|
|
if (vga_video_type >= VIDEO_TYPE_VGAC) {
|
|
|
|
outb_p(VGA_CRTC_V_DISP_END, vga_video_port_reg);
|
|
|
|
outb_p(scanlines_lo, vga_video_port_val);
|
|
|
|
outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
|
|
|
|
outb_p(r7,vga_video_port_val);
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2006-02-25 00:03:59 +03:00
|
|
|
/* reprotect registers */
|
|
|
|
outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
|
|
|
|
outb_p(vsync_end, vga_video_port_val);
|
|
|
|
}
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irqrestore(&vga_lock, flags);
|
2005-09-10 00:01:58 +04:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
static int vgacon_switch(struct vc_data *c)
|
|
|
|
{
|
2006-01-08 12:02:36 +03:00
|
|
|
int x = c->vc_cols * VGA_FONTWIDTH;
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
int y = c->vc_rows * c->vc_cell_height;
|
2007-10-17 09:36:04 +04:00
|
|
|
int rows = screen_info.orig_video_lines * vga_default_font_height/
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
c->vc_cell_height;
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* We need to save screen size here as it's the only way
|
|
|
|
* we can spot the screen has been resized and we need to
|
|
|
|
* set size of freshly allocated screens ourselves.
|
|
|
|
*/
|
|
|
|
vga_video_num_columns = c->vc_cols;
|
|
|
|
vga_video_num_lines = c->vc_rows;
|
2005-06-22 04:17:00 +04:00
|
|
|
|
|
|
|
/* We can only copy out the size of the video buffer here,
|
|
|
|
* otherwise we get into VGA BIOS */
|
|
|
|
|
2005-09-10 00:01:58 +04:00
|
|
|
if (!vga_is_gfx) {
|
2005-04-17 02:20:36 +04:00
|
|
|
scr_memcpyw((u16 *) c->vc_origin, (u16 *) c->vc_screenbuf,
|
2005-09-10 00:01:58 +04:00
|
|
|
c->vc_screenbuf_size > vga_vram_size ?
|
|
|
|
vga_vram_size : c->vc_screenbuf_size);
|
2006-01-08 12:02:36 +03:00
|
|
|
|
|
|
|
if ((vgacon_xres != x || vgacon_yres != y) &&
|
|
|
|
(!(vga_video_num_columns % 2) &&
|
2007-10-17 09:36:04 +04:00
|
|
|
vga_video_num_columns <= screen_info.orig_video_cols &&
|
2006-01-08 12:02:36 +03:00
|
|
|
vga_video_num_lines <= rows))
|
2005-10-17 07:29:22 +04:00
|
|
|
vgacon_doresize(c, c->vc_cols, c->vc_rows);
|
2005-09-10 00:01:58 +04:00
|
|
|
}
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
return 0; /* Redrawing not needed */
|
|
|
|
}
|
|
|
|
|
2016-03-31 11:08:16 +03:00
|
|
|
static void vga_set_palette(struct vc_data *vc, const unsigned char *table)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
|
|
|
int i, j;
|
|
|
|
|
2014-10-14 15:53:49 +04:00
|
|
|
vga_w(vgastate.vgabase, VGA_PEL_MSK, 0xff);
|
2005-04-17 02:20:36 +04:00
|
|
|
for (i = j = 0; i < 16; i++) {
|
2014-10-14 15:53:49 +04:00
|
|
|
vga_w(vgastate.vgabase, VGA_PEL_IW, table[i]);
|
|
|
|
vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
|
|
|
|
vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
|
|
|
|
vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-06-23 14:34:27 +03:00
|
|
|
static void vgacon_set_palette(struct vc_data *vc, const unsigned char *table)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
|
|
|
if (vga_video_type != VIDEO_TYPE_VGAC || vga_palette_blanked
|
2016-06-23 14:34:35 +03:00
|
|
|
|| !con_is_visible(vc))
|
2016-06-23 14:34:27 +03:00
|
|
|
return;
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_set_palette(vc, table);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* structure holding original VGA register settings */
|
|
|
|
static struct {
|
|
|
|
unsigned char SeqCtrlIndex; /* Sequencer Index reg. */
|
|
|
|
unsigned char CrtCtrlIndex; /* CRT-Contr. Index reg. */
|
|
|
|
unsigned char CrtMiscIO; /* Miscellaneous register */
|
|
|
|
unsigned char HorizontalTotal; /* CRT-Controller:00h */
|
|
|
|
unsigned char HorizDisplayEnd; /* CRT-Controller:01h */
|
|
|
|
unsigned char StartHorizRetrace; /* CRT-Controller:04h */
|
|
|
|
unsigned char EndHorizRetrace; /* CRT-Controller:05h */
|
|
|
|
unsigned char Overflow; /* CRT-Controller:07h */
|
|
|
|
unsigned char StartVertRetrace; /* CRT-Controller:10h */
|
|
|
|
unsigned char EndVertRetrace; /* CRT-Controller:11h */
|
|
|
|
unsigned char ModeControl; /* CRT-Controller:17h */
|
|
|
|
unsigned char ClockingMode; /* Seq-Controller:01h */
|
|
|
|
} vga_state;
|
|
|
|
|
|
|
|
static void vga_vesa_blank(struct vgastate *state, int mode)
|
|
|
|
{
|
|
|
|
/* save original values of VGA controller registers */
|
|
|
|
if (!vga_vesa_blanked) {
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_state.SeqCtrlIndex = vga_r(state->vgabase, VGA_SEQ_I);
|
|
|
|
vga_state.CrtCtrlIndex = inb_p(vga_video_port_reg);
|
|
|
|
vga_state.CrtMiscIO = vga_r(state->vgabase, VGA_MIS_R);
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
outb_p(0x00, vga_video_port_reg); /* HorizontalTotal */
|
|
|
|
vga_state.HorizontalTotal = inb_p(vga_video_port_val);
|
|
|
|
outb_p(0x01, vga_video_port_reg); /* HorizDisplayEnd */
|
|
|
|
vga_state.HorizDisplayEnd = inb_p(vga_video_port_val);
|
|
|
|
outb_p(0x04, vga_video_port_reg); /* StartHorizRetrace */
|
|
|
|
vga_state.StartHorizRetrace = inb_p(vga_video_port_val);
|
|
|
|
outb_p(0x05, vga_video_port_reg); /* EndHorizRetrace */
|
|
|
|
vga_state.EndHorizRetrace = inb_p(vga_video_port_val);
|
|
|
|
outb_p(0x07, vga_video_port_reg); /* Overflow */
|
|
|
|
vga_state.Overflow = inb_p(vga_video_port_val);
|
|
|
|
outb_p(0x10, vga_video_port_reg); /* StartVertRetrace */
|
|
|
|
vga_state.StartVertRetrace = inb_p(vga_video_port_val);
|
|
|
|
outb_p(0x11, vga_video_port_reg); /* EndVertRetrace */
|
|
|
|
vga_state.EndVertRetrace = inb_p(vga_video_port_val);
|
|
|
|
outb_p(0x17, vga_video_port_reg); /* ModeControl */
|
|
|
|
vga_state.ModeControl = inb_p(vga_video_port_val);
|
|
|
|
vga_state.ClockingMode = vga_rseq(state->vgabase, VGA_SEQ_CLOCK_MODE);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* assure that video is enabled */
|
|
|
|
/* "0x20" is VIDEO_ENABLE_bit in register 01 of sequencer */
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_CLOCK_MODE, vga_state.ClockingMode | 0x20);
|
|
|
|
|
|
|
|
/* test for vertical retrace in process.... */
|
|
|
|
if ((vga_state.CrtMiscIO & 0x80) == 0x80)
|
|
|
|
vga_w(state->vgabase, VGA_MIS_W, vga_state.CrtMiscIO & 0xEF);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Set <End of vertical retrace> to minimum (0) and
|
|
|
|
* <Start of vertical Retrace> to maximum (incl. overflow)
|
|
|
|
* Result: turn off vertical sync (VSync) pulse.
|
|
|
|
*/
|
|
|
|
if (mode & VESA_VSYNC_SUSPEND) {
|
|
|
|
outb_p(0x10, vga_video_port_reg); /* StartVertRetrace */
|
|
|
|
outb_p(0xff, vga_video_port_val); /* maximum value */
|
|
|
|
outb_p(0x11, vga_video_port_reg); /* EndVertRetrace */
|
|
|
|
outb_p(0x40, vga_video_port_val); /* minimum (bits 0..3) */
|
|
|
|
outb_p(0x07, vga_video_port_reg); /* Overflow */
|
|
|
|
outb_p(vga_state.Overflow | 0x84, vga_video_port_val); /* bits 9,10 of vert. retrace */
|
|
|
|
}
|
|
|
|
|
|
|
|
if (mode & VESA_HSYNC_SUSPEND) {
|
|
|
|
/*
|
|
|
|
* Set <End of horizontal retrace> to minimum (0) and
|
|
|
|
* <Start of horizontal Retrace> to maximum
|
|
|
|
* Result: turn off horizontal sync (HSync) pulse.
|
|
|
|
*/
|
|
|
|
outb_p(0x04, vga_video_port_reg); /* StartHorizRetrace */
|
|
|
|
outb_p(0xff, vga_video_port_val); /* maximum */
|
|
|
|
outb_p(0x05, vga_video_port_reg); /* EndHorizRetrace */
|
|
|
|
outb_p(0x00, vga_video_port_val); /* minimum (0) */
|
|
|
|
}
|
|
|
|
|
|
|
|
/* restore both index registers */
|
|
|
|
vga_w(state->vgabase, VGA_SEQ_I, vga_state.SeqCtrlIndex);
|
|
|
|
outb_p(vga_state.CrtCtrlIndex, vga_video_port_reg);
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
static void vga_vesa_unblank(struct vgastate *state)
|
|
|
|
{
|
|
|
|
/* restore original values of VGA controller registers */
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_w(state->vgabase, VGA_MIS_W, vga_state.CrtMiscIO);
|
|
|
|
|
|
|
|
outb_p(0x00, vga_video_port_reg); /* HorizontalTotal */
|
|
|
|
outb_p(vga_state.HorizontalTotal, vga_video_port_val);
|
|
|
|
outb_p(0x01, vga_video_port_reg); /* HorizDisplayEnd */
|
|
|
|
outb_p(vga_state.HorizDisplayEnd, vga_video_port_val);
|
|
|
|
outb_p(0x04, vga_video_port_reg); /* StartHorizRetrace */
|
|
|
|
outb_p(vga_state.StartHorizRetrace, vga_video_port_val);
|
|
|
|
outb_p(0x05, vga_video_port_reg); /* EndHorizRetrace */
|
|
|
|
outb_p(vga_state.EndHorizRetrace, vga_video_port_val);
|
|
|
|
outb_p(0x07, vga_video_port_reg); /* Overflow */
|
|
|
|
outb_p(vga_state.Overflow, vga_video_port_val);
|
|
|
|
outb_p(0x10, vga_video_port_reg); /* StartVertRetrace */
|
|
|
|
outb_p(vga_state.StartVertRetrace, vga_video_port_val);
|
|
|
|
outb_p(0x11, vga_video_port_reg); /* EndVertRetrace */
|
|
|
|
outb_p(vga_state.EndVertRetrace, vga_video_port_val);
|
|
|
|
outb_p(0x17, vga_video_port_reg); /* ModeControl */
|
|
|
|
outb_p(vga_state.ModeControl, vga_video_port_val);
|
|
|
|
/* ClockingMode */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_CLOCK_MODE, vga_state.ClockingMode);
|
|
|
|
|
|
|
|
/* restore index/control registers */
|
|
|
|
vga_w(state->vgabase, VGA_SEQ_I, vga_state.SeqCtrlIndex);
|
|
|
|
outb_p(vga_state.CrtCtrlIndex, vga_video_port_reg);
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
static void vga_pal_blank(struct vgastate *state)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
2005-10-31 02:03:06 +03:00
|
|
|
vga_w(state->vgabase, VGA_PEL_MSK, 0xff);
|
2005-04-17 02:20:36 +04:00
|
|
|
for (i = 0; i < 16; i++) {
|
|
|
|
vga_w(state->vgabase, VGA_PEL_IW, i);
|
|
|
|
vga_w(state->vgabase, VGA_PEL_D, 0);
|
|
|
|
vga_w(state->vgabase, VGA_PEL_D, 0);
|
|
|
|
vga_w(state->vgabase, VGA_PEL_D, 0);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
|
|
|
|
{
|
|
|
|
switch (blank) {
|
|
|
|
case 0: /* Unblank */
|
|
|
|
if (vga_vesa_blanked) {
|
2014-10-14 15:53:49 +04:00
|
|
|
vga_vesa_unblank(&vgastate);
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_vesa_blanked = 0;
|
|
|
|
}
|
|
|
|
if (vga_palette_blanked) {
|
|
|
|
vga_set_palette(c, color_table);
|
2016-10-03 12:18:38 +03:00
|
|
|
vga_palette_blanked = false;
|
2005-04-17 02:20:36 +04:00
|
|
|
return 0;
|
|
|
|
}
|
2016-10-03 12:18:38 +03:00
|
|
|
vga_is_gfx = false;
|
2005-04-17 02:20:36 +04:00
|
|
|
/* Tell console.c that it has to restore the screen itself */
|
|
|
|
return 1;
|
|
|
|
case 1: /* Normal blanking */
|
|
|
|
case -1: /* Obsolete */
|
|
|
|
if (!mode_switch && vga_video_type == VIDEO_TYPE_VGAC) {
|
2014-10-14 15:53:49 +04:00
|
|
|
vga_pal_blank(&vgastate);
|
2016-10-03 12:18:38 +03:00
|
|
|
vga_palette_blanked = true;
|
2005-04-17 02:20:36 +04:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
vgacon_set_origin(c);
|
|
|
|
scr_memsetw((void *) vga_vram_base, BLANK,
|
|
|
|
c->vc_screenbuf_size);
|
|
|
|
if (mode_switch)
|
2016-10-03 12:18:38 +03:00
|
|
|
vga_is_gfx = true;
|
2005-04-17 02:20:36 +04:00
|
|
|
return 1;
|
|
|
|
default: /* VESA blanking */
|
|
|
|
if (vga_video_type == VIDEO_TYPE_VGAC) {
|
2014-10-14 15:53:49 +04:00
|
|
|
vga_vesa_blank(&vgastate, blank - 1);
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_vesa_blanked = blank;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* PIO_FONT support.
|
|
|
|
*
|
|
|
|
* The font loading code goes back to the codepage package by
|
|
|
|
* Joel Hoffman (joel@wam.umd.edu). (He reports that the original
|
|
|
|
* reference is: "From: p. 307 of _Programmer's Guide to PC & PS/2
|
|
|
|
* Video Systems_ by Richard Wilton. 1987. Microsoft Press".)
|
|
|
|
*
|
|
|
|
* Change for certain monochrome monitors by Yury Shevchuck
|
|
|
|
* (sizif@botik.yaroslavl.su).
|
|
|
|
*/
|
|
|
|
|
|
|
|
#define colourmap 0xa0000
|
|
|
|
/* Pauline Middelink <middelin@polyware.iaf.nl> reports that we
|
|
|
|
should use 0xA0000 for the bwmap as well.. */
|
|
|
|
#define blackwmap 0xa0000
|
|
|
|
#define cmapsz 8192
|
|
|
|
|
2016-10-03 12:18:38 +03:00
|
|
|
static int vgacon_do_font_op(struct vgastate *state, char *arg, int set,
|
|
|
|
bool ch512)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
|
|
|
unsigned short video_port_status = vga_video_port_reg + 6;
|
|
|
|
int font_select = 0x00, beg, i;
|
|
|
|
char *charmap;
|
2013-01-24 08:14:19 +04:00
|
|
|
bool clear_attribs = false;
|
2005-04-17 02:20:36 +04:00
|
|
|
if (vga_video_type != VIDEO_TYPE_EGAM) {
|
[PATCH] vgacon: make VGA_MAP_MEM take size, remove extra use
VGA_MAP_MEM translates to ioremap() on some architectures. It makes sense
to do this to vga_vram_base, because we're going to access memory between
vga_vram_base and vga_vram_end.
But it doesn't really make sense to map starting at vga_vram_end, because
we aren't going to access memory starting there. On ia64, which always has
to be different, ioremapping vga_vram_end gives you something completely
incompatible with ioremapped vga_vram_start, so vga_vram_size ends up being
nonsense.
As a bonus, we often know the size up front, so we can use ioremap()
correctly, rather than giving it a zero size.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: "Luck, Tony" <tony.luck@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-23 01:47:32 +04:00
|
|
|
charmap = (char *) VGA_MAP_MEM(colourmap, 0);
|
2005-04-17 02:20:36 +04:00
|
|
|
beg = 0x0e;
|
|
|
|
} else {
|
[PATCH] vgacon: make VGA_MAP_MEM take size, remove extra use
VGA_MAP_MEM translates to ioremap() on some architectures. It makes sense
to do this to vga_vram_base, because we're going to access memory between
vga_vram_base and vga_vram_end.
But it doesn't really make sense to map starting at vga_vram_end, because
we aren't going to access memory starting there. On ia64, which always has
to be different, ioremapping vga_vram_end gives you something completely
incompatible with ioremapped vga_vram_start, so vga_vram_size ends up being
nonsense.
As a bonus, we often know the size up front, so we can use ioremap()
correctly, rather than giving it a zero size.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: "Luck, Tony" <tony.luck@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-23 01:47:32 +04:00
|
|
|
charmap = (char *) VGA_MAP_MEM(blackwmap, 0);
|
2005-04-17 02:20:36 +04:00
|
|
|
beg = 0x0a;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* All fonts are loaded in slot 0 (0:1 for 512 ch)
|
|
|
|
*/
|
|
|
|
|
|
|
|
if (!arg)
|
|
|
|
return -EINVAL; /* Return to default font not supported */
|
|
|
|
|
|
|
|
font_select = ch512 ? 0x04 : 0x00;
|
|
|
|
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
/* First, the Sequencer */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x1);
|
|
|
|
/* CPU writes only to map 2 */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_PLANE_WRITE, 0x04);
|
|
|
|
/* Sequential addressing */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_MEMORY_MODE, 0x07);
|
|
|
|
/* Clear synchronous reset */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x03);
|
|
|
|
|
|
|
|
/* Now, the graphics controller, select map 2 */
|
|
|
|
vga_wgfx(state->vgabase, VGA_GFX_PLANE_READ, 0x02);
|
|
|
|
/* disable odd-even addressing */
|
|
|
|
vga_wgfx(state->vgabase, VGA_GFX_MODE, 0x00);
|
|
|
|
/* map start at A000:0000 */
|
|
|
|
vga_wgfx(state->vgabase, VGA_GFX_MISC, 0x00);
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
if (arg) {
|
|
|
|
if (set)
|
2013-06-21 01:05:56 +04:00
|
|
|
for (i = 0; i < cmapsz; i++) {
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_writeb(arg[i], charmap + i);
|
2013-06-21 01:05:56 +04:00
|
|
|
cond_resched();
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
else
|
2013-06-21 01:05:56 +04:00
|
|
|
for (i = 0; i < cmapsz; i++) {
|
2005-04-17 02:20:36 +04:00
|
|
|
arg[i] = vga_readb(charmap + i);
|
2013-06-21 01:05:56 +04:00
|
|
|
cond_resched();
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
/*
|
|
|
|
* In 512-character mode, the character map is not contiguous if
|
|
|
|
* we want to remain EGA compatible -- which we do
|
|
|
|
*/
|
|
|
|
|
|
|
|
if (ch512) {
|
|
|
|
charmap += 2 * cmapsz;
|
|
|
|
arg += cmapsz;
|
|
|
|
if (set)
|
2013-06-21 01:05:56 +04:00
|
|
|
for (i = 0; i < cmapsz; i++) {
|
2005-04-17 02:20:36 +04:00
|
|
|
vga_writeb(arg[i], charmap + i);
|
2013-06-21 01:05:56 +04:00
|
|
|
cond_resched();
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
else
|
2013-06-21 01:05:56 +04:00
|
|
|
for (i = 0; i < cmapsz; i++) {
|
2005-04-17 02:20:36 +04:00
|
|
|
arg[i] = vga_readb(charmap + i);
|
2013-06-21 01:05:56 +04:00
|
|
|
cond_resched();
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
/* First, the sequencer, Synchronous reset */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x01);
|
|
|
|
/* CPU writes to maps 0 and 1 */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_PLANE_WRITE, 0x03);
|
|
|
|
/* odd-even addressing */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_MEMORY_MODE, 0x03);
|
|
|
|
/* Character Map Select */
|
|
|
|
if (set)
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_CHARACTER_MAP, font_select);
|
|
|
|
/* clear synchronous reset */
|
|
|
|
vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x03);
|
|
|
|
|
|
|
|
/* Now, the graphics controller, select map 0 for CPU */
|
|
|
|
vga_wgfx(state->vgabase, VGA_GFX_PLANE_READ, 0x00);
|
|
|
|
/* enable even-odd addressing */
|
|
|
|
vga_wgfx(state->vgabase, VGA_GFX_MODE, 0x10);
|
|
|
|
/* map starts at b800:0 or b000:0 */
|
|
|
|
vga_wgfx(state->vgabase, VGA_GFX_MISC, beg);
|
|
|
|
|
|
|
|
/* if 512 char mode is already enabled don't re-enable it. */
|
|
|
|
if ((set) && (ch512 != vga_512_chars)) {
|
|
|
|
vga_512_chars = ch512;
|
|
|
|
/* 256-char: enable intensity bit
|
|
|
|
512-char: disable intensity bit */
|
|
|
|
inb_p(video_port_status); /* clear address flip-flop */
|
|
|
|
/* color plane enable register */
|
|
|
|
vga_wattr(state->vgabase, VGA_ATC_PLANE_ENABLE, ch512 ? 0x07 : 0x0f);
|
|
|
|
/* Wilton (1987) mentions the following; I don't know what
|
|
|
|
it means, but it works, and it appears necessary */
|
|
|
|
inb_p(video_port_status);
|
|
|
|
vga_wattr(state->vgabase, VGA_AR_ENABLE_DISPLAY, 0);
|
2013-01-24 08:14:19 +04:00
|
|
|
clear_attribs = true;
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irq(&vga_lock);
|
2013-01-24 08:14:19 +04:00
|
|
|
|
|
|
|
if (clear_attribs) {
|
|
|
|
for (i = 0; i < MAX_NR_CONSOLES; i++) {
|
|
|
|
struct vc_data *c = vc_cons[i].d;
|
|
|
|
if (c && c->vc_sw == &vga_con) {
|
|
|
|
/* force hi font mask to 0, so we always clear
|
|
|
|
the bit on either transition */
|
|
|
|
c->vc_hi_font_mask = 0x00;
|
|
|
|
clear_buffer_attributes(c);
|
|
|
|
c->vc_hi_font_mask = ch512 ? 0x0800 : 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Adjust the screen to fit a font of a certain height
|
|
|
|
*/
|
|
|
|
static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight)
|
|
|
|
{
|
|
|
|
unsigned char ovr, vde, fsr;
|
|
|
|
int rows, maxscan, i;
|
|
|
|
|
|
|
|
rows = vc->vc_scan_lines / fontheight; /* Number of video rows we end up with */
|
|
|
|
maxscan = rows * fontheight - 1; /* Scan lines to actually display-1 */
|
|
|
|
|
|
|
|
/* Reprogram the CRTC for the new font size
|
|
|
|
Note: the attempt to read the overflow register will fail
|
|
|
|
on an EGA, but using 0xff for the previous value appears to
|
|
|
|
be OK for EGA text modes in the range 257-512 scan lines, so I
|
|
|
|
guess we don't need to worry about it.
|
|
|
|
|
|
|
|
The same applies for the spill bits in the font size and cursor
|
|
|
|
registers; they are write-only on EGA, but it appears that they
|
|
|
|
are all don't care bits on EGA, so I guess it doesn't matter. */
|
|
|
|
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
outb_p(0x07, vga_video_port_reg); /* CRTC overflow register */
|
|
|
|
ovr = inb_p(vga_video_port_val);
|
|
|
|
outb_p(0x09, vga_video_port_reg); /* Font size register */
|
|
|
|
fsr = inb_p(vga_video_port_val);
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
vde = maxscan & 0xff; /* Vertical display end reg */
|
|
|
|
ovr = (ovr & 0xbd) + /* Overflow register */
|
|
|
|
((maxscan & 0x100) >> 7) + ((maxscan & 0x200) >> 3);
|
|
|
|
fsr = (fsr & 0xe0) + (fontheight - 1); /* Font size register */
|
|
|
|
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_lock_irq(&vga_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
outb_p(0x07, vga_video_port_reg); /* CRTC overflow register */
|
|
|
|
outb_p(ovr, vga_video_port_val);
|
|
|
|
outb_p(0x09, vga_video_port_reg); /* Font size */
|
|
|
|
outb_p(fsr, vga_video_port_val);
|
|
|
|
outb_p(0x12, vga_video_port_reg); /* Vertical display limit */
|
|
|
|
outb_p(vde, vga_video_port_val);
|
2009-07-25 18:17:02 +04:00
|
|
|
raw_spin_unlock_irq(&vga_lock);
|
[PATCH] vgacon: Fix usage of stale height value on vc initialization
Reported by: Wayne E. Harlan
"[1.] One line summary of the problem:
When the kernel option "vga=1" is used, additional tty's (alt+control+Fx
with x=2,3,4,5, etc) do not provide the full 50 lines of output. The first
one does have 50 lines, however.
[2.] Full description of the problem/report:
These addtitional tty's show only 39 lines plus the top pixel of the 40-th
line. The remaining lines are black and not shown. Kernel version
2.6.13.4 does not show this problem."
This bug is caused by using a stale font height value on vgacon_init.
Booting with vga=1 gives an 80x50 screen with an 8x8 font. Somewhere
during the initialization, the font was changed to 8x9 and the first
vc was correctly resized to 80x44. However, the rest of the vc's were
not allocated yet, and when they were subsequently initialized, they
still used a font height of 8 (instead of 9) causing the mentioned bug.
Fix by saving the new font height to vga_video_font_height.
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-11-22 08:32:26 +03:00
|
|
|
vga_video_font_height = fontheight;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
for (i = 0; i < MAX_NR_CONSOLES; i++) {
|
|
|
|
struct vc_data *c = vc_cons[i].d;
|
|
|
|
|
|
|
|
if (c && c->vc_sw == &vga_con) {
|
2016-06-23 14:34:35 +03:00
|
|
|
if (con_is_visible(c)) {
|
2005-04-17 02:20:36 +04:00
|
|
|
/* void size to cause regs to be rewritten */
|
|
|
|
cursor_size_lastfrom = 0;
|
|
|
|
cursor_size_lastto = 0;
|
|
|
|
c->vc_sw->con_cursor(c, CM_DRAW);
|
|
|
|
}
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
c->vc_font.height = c->vc_cell_height = fontheight;
|
2005-04-17 02:20:36 +04:00
|
|
|
vc_resize(c, 0, rows); /* Adjust console size */
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2018-02-27 03:04:20 +03:00
|
|
|
static int vgacon_font_set(struct vc_data *c, struct console_font *font,
|
|
|
|
unsigned int flags)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
|
|
|
unsigned charcount = font->charcount;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
if (vga_video_type < VIDEO_TYPE_EGAM)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2006-01-08 12:02:36 +03:00
|
|
|
if (font->width != VGA_FONTWIDTH ||
|
|
|
|
(charcount != 256 && charcount != 512))
|
2005-04-17 02:20:36 +04:00
|
|
|
return -EINVAL;
|
|
|
|
|
2014-10-14 15:53:49 +04:00
|
|
|
rc = vgacon_do_font_op(&vgastate, font->data, 1, charcount == 512);
|
2005-04-17 02:20:36 +04:00
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
if (!(flags & KD_FONT_FLAG_DONT_RECALC))
|
|
|
|
rc = vgacon_adjust_height(c, font->height);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int vgacon_font_get(struct vc_data *c, struct console_font *font)
|
|
|
|
{
|
|
|
|
if (vga_video_type < VIDEO_TYPE_EGAM)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2006-01-08 12:02:36 +03:00
|
|
|
font->width = VGA_FONTWIDTH;
|
2005-04-17 02:20:36 +04:00
|
|
|
font->height = c->vc_font.height;
|
|
|
|
font->charcount = vga_512_chars ? 512 : 256;
|
|
|
|
if (!font->data)
|
|
|
|
return 0;
|
2014-10-14 15:53:49 +04:00
|
|
|
return vgacon_do_font_op(&vgastate, font->data, 0, vga_512_chars);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
2005-09-10 00:01:58 +04:00
|
|
|
static int vgacon_resize(struct vc_data *c, unsigned int width,
|
vt/vgacon: Check if screen resize request comes from userspace
Various console drivers are able to resize the screen via the con_resize()
hook. This hook is also visible in userspace via the TIOCWINSZ, VT_RESIZE and
VT_RESIZEX ioctl's. One particular utility, SVGATextMode, expects that
con_resize() of the VGA console will always return success even if the
resulting screen is not compatible with the hardware. However, this
particular behavior of the VGA console, as reported in Kernel Bugzilla Bug
7513, can cause undefined behavior if the user starts with a console size
larger than 80x25.
To work around this problem, add an extra parameter to con_resize(). This
parameter is ignored by drivers except for vgacon. If this parameter is
non-zero, then the resize request came from a VT_RESIZE or VT_RESIZEX ioctl
and vgacon will always return success. If this parameter is zero, vgacon will
return -EINVAL if the requested size is not compatible with the hardware. The
latter is the more correct behavior.
With this change, SVGATextMode should still work correctly while in-kernel and
stty resize calls can expect correct behavior from vgacon.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-16 12:29:35 +04:00
|
|
|
unsigned int height, unsigned int user)
|
2005-09-10 00:01:58 +04:00
|
|
|
{
|
vgacon: Fix a UAF in vgacon_invert_region
When syzkaller tests, there is a UAF:
BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr
ffff880000100000
Read of size 2 by task syz-executor.1/16489
page:ffffea0000004000 count:0 mapcount:-127 mapping: (null)
index:0x0
page flags: 0xfffff00000000()
page dumped because: kasan: bad access detected
CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
Call Trace:
[<ffffffffb119f309>] dump_stack+0x1e/0x20
[<ffffffffb04af957>] kasan_report+0x577/0x950
[<ffffffffb04ae652>] __asan_load2+0x62/0x80
[<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110
[<ffffffffb0a39d95>] invert_screen+0xe5/0x470
[<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0
[<ffffffffb0a3bfae>] tioclinux+0xee/0x490
[<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670
[<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10
[<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40
[<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170
[<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27
Memory state around the buggy address:
ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00
>ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff
It can be reproduce in the linux mainline by the program:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <linux/vt.h>
struct tiocl_selection {
unsigned short xs; /* X start */
unsigned short ys; /* Y start */
unsigned short xe; /* X end */
unsigned short ye; /* Y end */
unsigned short sel_mode; /* selection mode */
};
#define TIOCL_SETSEL 2
struct tiocl {
unsigned char type;
unsigned char pad;
struct tiocl_selection sel;
};
int main()
{
int fd = 0;
const char *dev = "/dev/char/4:1";
struct vt_consize v = {0};
struct tiocl tioc = {0};
fd = open(dev, O_RDWR, 0);
v.v_rows = 3346;
ioctl(fd, VT_RESIZEX, &v);
tioc.type = TIOCL_SETSEL;
ioctl(fd, TIOCLINUX, &tioc);
return 0;
}
When resize the screen, update the 'vc->vc_size_row' to the new_row_size,
but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base'
for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe
smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc
the offset, it maybe larger than the vga_vram_size in vgacon driver, then
bad access.
Also, if set an larger screenbuf firstly, then set an more larger
screenbuf, when copy old_origin to new_origin, a bad access may happen.
So, If the screen size larger than vga_vram, resize screen should be
failed. This alse fix CVE-2020-8649 and CVE-2020-8647.
Linus pointed out that overflow checking seems absent. We're saved by
the existing bounds checks in vc_do_resize() with rather strict
limits:
if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
return -EINVAL;
Fixes: 0aec4867dca14 ("[PATCH] SVGATextMode fix")
Reference: CVE-2020-8647 and CVE-2020-8649
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
[danvet: augment commit message to point out overflow safety]
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20200304022429.37738-1-zhangxiaoxu5@huawei.com
2020-03-04 05:24:29 +03:00
|
|
|
if ((width << 1) * height > vga_vram_size)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2021-05-13 12:51:41 +03:00
|
|
|
if (user) {
|
|
|
|
/*
|
|
|
|
* Ho ho! Someone (svgatextmode, eh?) may have reprogrammed
|
|
|
|
* the video mode! Set the new defaults then and go away.
|
|
|
|
*/
|
|
|
|
screen_info.orig_video_cols = width;
|
|
|
|
screen_info.orig_video_lines = height;
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
vga_default_font_height = c->vc_cell_height;
|
2021-05-13 12:51:41 +03:00
|
|
|
return 0;
|
|
|
|
}
|
2007-10-17 09:36:04 +04:00
|
|
|
if (width % 2 || width > screen_info.orig_video_cols ||
|
|
|
|
height > (screen_info.orig_video_lines * vga_default_font_height)/
|
vt: Fix character height handling with VT_RESIZEX
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.
For framebuffer devices the two values are always the same, because the
former is inferred from the latter one. For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator. One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.
The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within. Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.
This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):
"syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
larger than actual font height calculated by con_font_set() from
ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
minimal amount of memory based on actual font height calculated by
con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
data."
The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:
if (clin)
- video_font_height = clin;
+ vc->vc_font.height = clin;
making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable. Use "cell" in the new struct member then to avoid ambiguity.
References:
[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-13 12:51:50 +03:00
|
|
|
c->vc_cell_height)
|
2021-05-13 12:51:41 +03:00
|
|
|
return -EINVAL;
|
2005-09-10 00:01:58 +04:00
|
|
|
|
2016-06-23 14:34:35 +03:00
|
|
|
if (con_is_visible(c) && !vga_is_gfx) /* who knows */
|
2005-09-10 00:01:58 +04:00
|
|
|
vgacon_doresize(c, width, height);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
static int vgacon_set_origin(struct vc_data *c)
|
|
|
|
{
|
|
|
|
if (vga_is_gfx || /* We don't play origin tricks in graphic modes */
|
|
|
|
(console_blanked && !vga_palette_blanked)) /* Nor we write to blanked screens */
|
|
|
|
return 0;
|
|
|
|
c->vc_origin = c->vc_visible_origin = vga_vram_base;
|
|
|
|
vga_set_mem_top(c);
|
|
|
|
vga_rolled_over = 0;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void vgacon_save_screen(struct vc_data *c)
|
|
|
|
{
|
|
|
|
static int vga_bootup_console = 0;
|
|
|
|
|
|
|
|
if (!vga_bootup_console) {
|
|
|
|
/* This is a gross hack, but here is the only place we can
|
|
|
|
* set bootup console parameters without messing up generic
|
|
|
|
* console initialization routines.
|
|
|
|
*/
|
|
|
|
vga_bootup_console = 1;
|
2020-06-15 10:48:33 +03:00
|
|
|
c->state.x = screen_info.orig_x;
|
|
|
|
c->state.y = screen_info.orig_y;
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
2005-06-22 04:17:00 +04:00
|
|
|
|
2008-10-16 21:02:37 +04:00
|
|
|
/* We can't copy in more than the size of the video buffer,
|
2005-06-22 04:17:00 +04:00
|
|
|
* or we'll be copying in VGA BIOS */
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
if (!vga_is_gfx)
|
|
|
|
scr_memcpyw((u16 *) c->vc_screenbuf, (u16 *) c->vc_origin,
|
2005-06-22 04:17:00 +04:00
|
|
|
c->vc_screenbuf_size > vga_vram_size ? vga_vram_size : c->vc_screenbuf_size);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
2016-10-03 12:18:33 +03:00
|
|
|
static bool vgacon_scroll(struct vc_data *c, unsigned int t, unsigned int b,
|
|
|
|
enum con_scroll dir, unsigned int lines)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
|
|
|
unsigned long oldo;
|
|
|
|
unsigned int delta;
|
|
|
|
|
2007-05-08 11:40:06 +04:00
|
|
|
if (t || b != c->vc_rows || vga_is_gfx || c->vc_mode != KD_TEXT)
|
2016-10-03 12:18:33 +03:00
|
|
|
return false;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
if (!vga_hardscroll_enabled || lines >= c->vc_rows / 2)
|
2016-10-03 12:18:33 +03:00
|
|
|
return false;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2006-03-27 13:17:20 +04:00
|
|
|
vgacon_restore_screen(c);
|
2005-04-17 02:20:36 +04:00
|
|
|
oldo = c->vc_origin;
|
|
|
|
delta = lines * c->vc_size_row;
|
|
|
|
if (dir == SM_UP) {
|
|
|
|
if (c->vc_scr_end + delta >= vga_vram_end) {
|
|
|
|
scr_memcpyw((u16 *) vga_vram_base,
|
|
|
|
(u16 *) (oldo + delta),
|
|
|
|
c->vc_screenbuf_size - delta);
|
|
|
|
c->vc_origin = vga_vram_base;
|
|
|
|
vga_rolled_over = oldo - vga_vram_base;
|
|
|
|
} else
|
|
|
|
c->vc_origin += delta;
|
|
|
|
scr_memsetw((u16 *) (c->vc_origin + c->vc_screenbuf_size -
|
2008-10-14 23:12:02 +04:00
|
|
|
delta), c->vc_video_erase_char,
|
2005-04-17 02:20:36 +04:00
|
|
|
delta);
|
|
|
|
} else {
|
|
|
|
if (oldo - delta < vga_vram_base) {
|
|
|
|
scr_memmovew((u16 *) (vga_vram_end -
|
|
|
|
c->vc_screenbuf_size +
|
|
|
|
delta), (u16 *) oldo,
|
|
|
|
c->vc_screenbuf_size - delta);
|
|
|
|
c->vc_origin = vga_vram_end - c->vc_screenbuf_size;
|
|
|
|
vga_rolled_over = 0;
|
|
|
|
} else
|
|
|
|
c->vc_origin -= delta;
|
|
|
|
c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size;
|
2008-10-14 23:12:02 +04:00
|
|
|
scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char,
|
2005-04-17 02:20:36 +04:00
|
|
|
delta);
|
|
|
|
}
|
|
|
|
c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size;
|
|
|
|
c->vc_visible_origin = c->vc_origin;
|
|
|
|
vga_set_mem_top(c);
|
|
|
|
c->vc_pos = (c->vc_pos - oldo) + c->vc_origin;
|
2016-10-03 12:18:33 +03:00
|
|
|
return true;
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The console `switch' structure for the VGA based console
|
|
|
|
*/
|
|
|
|
|
2018-02-27 03:04:20 +03:00
|
|
|
static void vgacon_clear(struct vc_data *vc, int sy, int sx, int height,
|
|
|
|
int width) { }
|
|
|
|
static void vgacon_putc(struct vc_data *vc, int c, int ypos, int xpos) { }
|
|
|
|
static void vgacon_putcs(struct vc_data *vc, const unsigned short *s,
|
|
|
|
int count, int ypos, int xpos) { }
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
const struct consw vga_con = {
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
.con_startup = vgacon_startup,
|
|
|
|
.con_init = vgacon_init,
|
|
|
|
.con_deinit = vgacon_deinit,
|
2018-02-27 03:04:20 +03:00
|
|
|
.con_clear = vgacon_clear,
|
|
|
|
.con_putc = vgacon_putc,
|
|
|
|
.con_putcs = vgacon_putcs,
|
2005-04-17 02:20:36 +04:00
|
|
|
.con_cursor = vgacon_cursor,
|
|
|
|
.con_scroll = vgacon_scroll,
|
|
|
|
.con_switch = vgacon_switch,
|
|
|
|
.con_blank = vgacon_blank,
|
|
|
|
.con_font_set = vgacon_font_set,
|
|
|
|
.con_font_get = vgacon_font_get,
|
2005-09-10 00:01:58 +04:00
|
|
|
.con_resize = vgacon_resize,
|
2005-04-17 02:20:36 +04:00
|
|
|
.con_set_palette = vgacon_set_palette,
|
|
|
|
.con_scrolldelta = vgacon_scrolldelta,
|
|
|
|
.con_set_origin = vgacon_set_origin,
|
|
|
|
.con_save_screen = vgacon_save_screen,
|
|
|
|
.con_build_attr = vgacon_build_attr,
|
|
|
|
.con_invert_region = vgacon_invert_region,
|
|
|
|
};
|
2014-06-05 18:20:46 +04:00
|
|
|
EXPORT_SYMBOL(vga_con);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
MODULE_LICENSE("GPL");
|