2003-11-14 15:54:54 +00:00
|
|
|
/*
|
|
|
|
|
* Copyright 1992 by Orest Zborowski <obz@Kodak.com>
|
|
|
|
|
* Copyright 1993 by David Wexelblat <dwex@goblin.org>
|
|
|
|
|
*
|
|
|
|
|
* Permission to use, copy, modify, distribute, and sell this software and its
|
|
|
|
|
* documentation for any purpose is hereby granted without fee, provided that
|
|
|
|
|
* the above copyright notice appear in all copies and that both that
|
|
|
|
|
* copyright notice and this permission notice appear in supporting
|
|
|
|
|
* documentation, and that the names of Orest Zborowski and David Wexelblat
|
|
|
|
|
* not be used in advertising or publicity pertaining to distribution of
|
|
|
|
|
* the software without specific, written prior permission. Orest Zborowski
|
|
|
|
|
* and David Wexelblat make no representations about the suitability of this
|
|
|
|
|
* software for any purpose. It is provided "as is" without express or
|
|
|
|
|
* implied warranty.
|
|
|
|
|
*
|
|
|
|
|
* OREST ZBOROWSKI AND DAVID WEXELBLAT DISCLAIMS ALL WARRANTIES WITH REGARD
|
|
|
|
|
* TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
|
|
|
* FITNESS, IN NO EVENT SHALL OREST ZBOROWSKI OR DAVID WEXELBLAT BE LIABLE
|
|
|
|
|
* FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
|
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
|
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
|
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
|
2005-07-03 07:02:09 +00:00
|
|
|
#ifdef HAVE_XORG_CONFIG_H
|
|
|
|
|
#include <xorg-config.h>
|
|
|
|
|
#endif
|
|
|
|
|
|
2005-08-26 06:48:24 +00:00
|
|
|
#include <errno.h>
|
|
|
|
|
#include <string.h>
|
2024-03-15 18:32:39 +01:00
|
|
|
#include <sys/mman.h>
|
2005-04-20 12:25:48 +00:00
|
|
|
#include <X11/X.h>
|
2024-03-15 18:32:39 +01:00
|
|
|
|
2003-11-14 15:54:54 +00:00
|
|
|
#include "input.h"
|
|
|
|
|
#include "scrnintstr.h"
|
|
|
|
|
|
|
|
|
|
#include "xf86.h"
|
2024-03-14 13:14:43 +01:00
|
|
|
#include "xf86_os_support.h"
|
2003-11-14 15:54:54 +00:00
|
|
|
#include "xf86Priv.h"
|
|
|
|
|
#include "xf86_OSlib.h"
|
|
|
|
|
|
2003-11-14 16:49:22 +00:00
|
|
|
static Bool ExtendedEnabled = FALSE;
|
|
|
|
|
|
|
|
|
|
#ifdef __ia64__
|
|
|
|
|
|
|
|
|
|
#include "compiler.h"
|
|
|
|
|
#include <sys/io.h>
|
|
|
|
|
|
|
|
|
|
#elif !defined(__powerpc__) && \
|
|
|
|
|
!defined(__mc68000__) && \
|
|
|
|
|
!defined(__sparc__) && \
|
2007-06-18 12:05:55 -04:00
|
|
|
!defined(__mips__) && \
|
2010-09-21 15:13:31 +08:00
|
|
|
!defined(__nds32__) && \
|
2013-08-15 12:03:42 +02:00
|
|
|
!defined(__arm__) && \
|
2014-05-01 15:39:29 +03:00
|
|
|
!defined(__aarch64__) && \
|
2014-06-02 01:17:31 +04:00
|
|
|
!defined(__arc__) && \
|
|
|
|
|
!defined(__xtensa__)
|
2003-11-14 15:54:54 +00:00
|
|
|
|
|
|
|
|
/*
|
2003-11-14 16:49:22 +00:00
|
|
|
* Due to conflicts with "compiler.h", don't rely on <sys/io.h> to declare
|
|
|
|
|
* these.
|
2003-11-14 15:54:54 +00:00
|
|
|
*/
|
2003-11-14 16:49:22 +00:00
|
|
|
extern int ioperm(unsigned long __from, unsigned long __num, int __turn_on);
|
|
|
|
|
extern int iopl(int __level);
|
2003-11-14 15:54:54 +00:00
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
/***************************************************************************/
|
2003-11-14 16:49:22 +00:00
|
|
|
/* Video Memory Mapping section */
|
2003-11-14 15:54:54 +00:00
|
|
|
/***************************************************************************/
|
|
|
|
|
|
2003-11-14 16:49:22 +00:00
|
|
|
void
|
|
|
|
|
xf86OSInitVidMem(VidMemInfoPtr pVidMem)
|
|
|
|
|
{
|
|
|
|
|
pVidMem->initialised = TRUE;
|
2003-11-14 15:54:54 +00:00
|
|
|
}
|
|
|
|
|
|
2003-11-14 16:49:22 +00:00
|
|
|
/***************************************************************************/
|
|
|
|
|
/* I/O Permissions section */
|
|
|
|
|
/***************************************************************************/
|
|
|
|
|
|
|
|
|
|
#if defined(__powerpc__)
|
Rework symbol visibility for easier maintenance
Save in a few special cases, _X_EXPORT should not be used in C source
files. Instead, it should be used in headers, and the proper C source
include that header. Some special cases are symbols that need to be
shared between modules, but not expected to be used by external drivers,
and symbols that are accessible via LoaderSymbol/dlopen.
This patch also adds conditionally some new sdk header files, depending
on extensions enabled. These files were added to match pattern for
other extensions/modules, that is, have the headers "deciding" symbol
visibility in the sdk. These headers are:
o Xext/panoramiXsrv.h, Xext/panoramiX.h
o fbpict.h (unconditionally)
o vidmodeproc.h
o mioverlay.h (unconditionally, used only by xaa)
o xfixes.h (unconditionally, symbols required by dri2)
LoaderSymbol and similar functions now don't have different prototypes,
in loaderProcs.h and xf86Module.h, so that both headers can be included,
without the need of defining IN_LOADER.
xf86NewInputDevice() device prototype readded to xf86Xinput.h, but
not exported (and with a comment about it).
2008-12-03 05:43:34 -02:00
|
|
|
volatile unsigned char *ioBase = NULL;
|
2003-11-14 16:49:22 +00:00
|
|
|
|
|
|
|
|
#ifndef __NR_pciconfig_iobase
|
|
|
|
|
#define __NR_pciconfig_iobase 200
|
2003-11-14 15:54:54 +00:00
|
|
|
#endif
|
|
|
|
|
|
2012-06-26 13:12:45 -04:00
|
|
|
static Bool
|
|
|
|
|
hwEnableIO(void)
|
2003-11-14 16:49:22 +00:00
|
|
|
{
|
|
|
|
|
int fd;
|
2012-06-26 13:12:45 -04:00
|
|
|
unsigned int ioBase_phys = syscall(__NR_pciconfig_iobase, 2, 0, 0);
|
2003-11-14 16:49:22 +00:00
|
|
|
|
|
|
|
|
fd = open("/dev/mem", O_RDWR);
|
|
|
|
|
if (ioBase == NULL) {
|
|
|
|
|
ioBase = (volatile unsigned char *) mmap(0, 0x20000,
|
2003-11-25 19:29:01 +00:00
|
|
|
PROT_READ | PROT_WRITE,
|
|
|
|
|
MAP_SHARED, fd, ioBase_phys);
|
2003-11-14 15:54:54 +00:00
|
|
|
}
|
2003-11-14 16:49:22 +00:00
|
|
|
close(fd);
|
2012-06-26 13:12:45 -04:00
|
|
|
|
|
|
|
|
return ioBase != MAP_FAILED;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
hwDisableIO(void)
|
|
|
|
|
{
|
|
|
|
|
munmap(ioBase, 0x20000);
|
|
|
|
|
ioBase = NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#elif defined(__i386__) || defined(__x86_64__) || defined(__ia64__) || \
|
|
|
|
|
defined(__alpha__)
|
|
|
|
|
|
|
|
|
|
static Bool
|
|
|
|
|
hwEnableIO(void)
|
|
|
|
|
{
|
2019-05-02 16:25:50 -05:00
|
|
|
short i;
|
|
|
|
|
size_t n=0;
|
|
|
|
|
int begin, end;
|
xfree86: NUL-terminate strings in hwEnableIO
The Linux version of xf86EnableIO calls a helper function called hwEnableIO().
Except on Alpha, this function reads /proc/ioports looking for the 'keyboard'
and 'timer' ports, extracts the port ranges, and enables access to them. It does
this by reading 4 bytes from the string for the start port number and 4 bytes
for the last port number, passing those to atoi(). However, it doesn't add a
fifth byte for a NUL terminator, so some implementations of atoi() read past the
end of this string, triggering an AddressSanitizer error:
==1383==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff71fd5b74 at pc 0x7fe1be0de3e0 bp 0x7fff71fd5ae0 sp 0x7fff71fd5288
READ of size 5 at 0x7fff71fd5b74 thread T0
#0 0x7fe1be0de3df in __interceptor_atoi /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:520
#1 0x564971adcc45 in hwEnableIO ../hw/xfree86/os-support/linux/lnx_video.c:138
#2 0x564971adce87 in xf86EnableIO ../hw/xfree86/os-support/linux/lnx_video.c:174
#3 0x5649719f6a30 in InitOutput ../hw/xfree86/common/xf86Init.c:439
#4 0x564971585924 in dix_main ../dix/main.c:190
#5 0x564971b6246e in main ../dix/stubmain.c:34
#6 0x7fe1bdab6b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#7 0x564971490e9d in _start (/home/aaron/git/x/xserver/build.asan/hw/xfree86/Xorg+0xb2e9d)
Address 0x7fff71fd5b74 is located in stack of thread T0 at offset 100 in frame
#0 0x564971adc96a in hwEnableIO ../hw/xfree86/os-support/linux/lnx_video.c:118
This frame has 3 object(s):
[32, 40) 'n' (line 120)
[64, 72) 'buf' (line 122)
[96, 100) 'target' (line 122) <== Memory access at offset 100 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:520 in __interceptor_atoi
Shadow bytes around the buggy address:
0x10006e3f2b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10006e3f2b60: 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2[04]f3
0x10006e3f2b70: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b80: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x10006e3f2b90: f1 f1 f8 f2 00 f2 f2 f2 f8 f3 f3 f3 00 00 00 00
0x10006e3f2ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
0x10006e3f2bb0: f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1383==ABORTING
Fix this by NUL-terminating the string.
Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1193#note_1053306
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
2021-09-10 11:02:00 -07:00
|
|
|
char *buf=NULL, target[5];
|
2019-05-02 16:25:50 -05:00
|
|
|
FILE *fp;
|
|
|
|
|
|
2025-08-09 20:22:56 +09:00
|
|
|
if (ioperm(0, 1024, 1) || iopl(3)) {
|
|
|
|
|
ErrorF("xf86EnableIO: failed to enable I/O ports access (%s)\n",
|
2012-06-26 13:15:45 -04:00
|
|
|
strerror(errno));
|
2005-01-28 16:13:00 +00:00
|
|
|
return FALSE;
|
2005-08-26 06:48:24 +00:00
|
|
|
}
|
2019-05-02 16:25:50 -05:00
|
|
|
|
2003-11-14 16:49:22 +00:00
|
|
|
#if !defined(__alpha__)
|
xfree86: NUL-terminate strings in hwEnableIO
The Linux version of xf86EnableIO calls a helper function called hwEnableIO().
Except on Alpha, this function reads /proc/ioports looking for the 'keyboard'
and 'timer' ports, extracts the port ranges, and enables access to them. It does
this by reading 4 bytes from the string for the start port number and 4 bytes
for the last port number, passing those to atoi(). However, it doesn't add a
fifth byte for a NUL terminator, so some implementations of atoi() read past the
end of this string, triggering an AddressSanitizer error:
==1383==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff71fd5b74 at pc 0x7fe1be0de3e0 bp 0x7fff71fd5ae0 sp 0x7fff71fd5288
READ of size 5 at 0x7fff71fd5b74 thread T0
#0 0x7fe1be0de3df in __interceptor_atoi /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:520
#1 0x564971adcc45 in hwEnableIO ../hw/xfree86/os-support/linux/lnx_video.c:138
#2 0x564971adce87 in xf86EnableIO ../hw/xfree86/os-support/linux/lnx_video.c:174
#3 0x5649719f6a30 in InitOutput ../hw/xfree86/common/xf86Init.c:439
#4 0x564971585924 in dix_main ../dix/main.c:190
#5 0x564971b6246e in main ../dix/stubmain.c:34
#6 0x7fe1bdab6b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#7 0x564971490e9d in _start (/home/aaron/git/x/xserver/build.asan/hw/xfree86/Xorg+0xb2e9d)
Address 0x7fff71fd5b74 is located in stack of thread T0 at offset 100 in frame
#0 0x564971adc96a in hwEnableIO ../hw/xfree86/os-support/linux/lnx_video.c:118
This frame has 3 object(s):
[32, 40) 'n' (line 120)
[64, 72) 'buf' (line 122)
[96, 100) 'target' (line 122) <== Memory access at offset 100 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:520 in __interceptor_atoi
Shadow bytes around the buggy address:
0x10006e3f2b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10006e3f2b60: 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2[04]f3
0x10006e3f2b70: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006e3f2b80: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x10006e3f2b90: f1 f1 f8 f2 00 f2 f2 f2 f8 f3 f3 f3 00 00 00 00
0x10006e3f2ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
0x10006e3f2bb0: f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1383==ABORTING
Fix this by NUL-terminating the string.
Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1193#note_1053306
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
2021-09-10 11:02:00 -07:00
|
|
|
target[4] = '\0';
|
|
|
|
|
|
2019-05-02 16:25:50 -05:00
|
|
|
/* trap access to the keyboard controller(s) and timer chip(s) */
|
|
|
|
|
fp = fopen("/proc/ioports", "r");
|
|
|
|
|
while (getline(&buf, &n, fp) != -1) {
|
|
|
|
|
if ((strstr(buf, "keyboard") != NULL) || (strstr(buf, "timer") != NULL)) {
|
|
|
|
|
for (i=0; i<4; i++)
|
|
|
|
|
target[i] = buf[i+2];
|
|
|
|
|
begin = atoi(target);
|
|
|
|
|
|
|
|
|
|
for (i=0; i<4; i++)
|
|
|
|
|
target[i] = buf[i+7];
|
|
|
|
|
end = atoi(target);
|
|
|
|
|
|
|
|
|
|
ioperm(begin, end-begin+1, 0);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
free(buf);
|
|
|
|
|
fclose(fp);
|
2003-11-14 16:49:22 +00:00
|
|
|
#endif
|
|
|
|
|
|
2005-01-28 16:13:00 +00:00
|
|
|
return TRUE;
|
2003-11-14 15:54:54 +00:00
|
|
|
}
|
|
|
|
|
|
2012-06-26 13:12:45 -04:00
|
|
|
static void
|
|
|
|
|
hwDisableIO(void)
|
|
|
|
|
{
|
|
|
|
|
iopl(0);
|
|
|
|
|
ioperm(0, 1024, 0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#else /* non-IO architectures */
|
|
|
|
|
|
|
|
|
|
#define hwEnableIO() TRUE
|
|
|
|
|
#define hwDisableIO() do {} while (0)
|
|
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
Bool
|
|
|
|
|
xf86EnableIO(void)
|
|
|
|
|
{
|
|
|
|
|
if (ExtendedEnabled)
|
|
|
|
|
return TRUE;
|
|
|
|
|
|
|
|
|
|
ExtendedEnabled = hwEnableIO();
|
|
|
|
|
|
|
|
|
|
return ExtendedEnabled;
|
|
|
|
|
}
|
|
|
|
|
|
Rework symbol visibility for easier maintenance
Save in a few special cases, _X_EXPORT should not be used in C source
files. Instead, it should be used in headers, and the proper C source
include that header. Some special cases are symbols that need to be
shared between modules, but not expected to be used by external drivers,
and symbols that are accessible via LoaderSymbol/dlopen.
This patch also adds conditionally some new sdk header files, depending
on extensions enabled. These files were added to match pattern for
other extensions/modules, that is, have the headers "deciding" symbol
visibility in the sdk. These headers are:
o Xext/panoramiXsrv.h, Xext/panoramiX.h
o fbpict.h (unconditionally)
o vidmodeproc.h
o mioverlay.h (unconditionally, used only by xaa)
o xfixes.h (unconditionally, symbols required by dri2)
LoaderSymbol and similar functions now don't have different prototypes,
in loaderProcs.h and xf86Module.h, so that both headers can be included,
without the need of defining IN_LOADER.
xf86NewInputDevice() device prototype readded to xf86Xinput.h, but
not exported (and with a comment about it).
2008-12-03 05:43:34 -02:00
|
|
|
void
|
2003-11-14 16:49:22 +00:00
|
|
|
xf86DisableIO(void)
|
2003-11-14 15:54:54 +00:00
|
|
|
{
|
2003-11-14 16:49:22 +00:00
|
|
|
if (!ExtendedEnabled)
|
|
|
|
|
return;
|
|
|
|
|
|
2012-06-26 13:12:45 -04:00
|
|
|
hwDisableIO();
|
|
|
|
|
|
|
|
|
|
ExtendedEnabled = FALSE;
|
2003-11-14 15:54:54 +00:00
|
|
|
}
|