Commit Graph

8024 Commits

Author SHA1 Message Date
Adam Jackson
2320fd4b52 mi: Add a default no-op miSourceValidate
Slightly simplifies the callers since they don't need to check for
non-NULL anymore.

I do extremely hate the workarounds here to suppress misprite taking the
cursor down though. Surely there's a better way.

[1.20: Do not in fact simplify the callers as above, since it would
change the ABI. - ajax]

Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
(cherry picked from commit ff310903f3)
2019-11-18 14:23:15 -05:00
Olivier Fourdan
07efd81b81 compiler.h: Do not include sys/io.h on ARM with glibc
<sys/io.h> on ARM hasn't worked for a long, long time, so it was removed
it from glibc upstream.

Remove the include to avoid a compilation failure on ARM with glibc.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/issues/840
(cherry picked from commit fe4cd0e7f5)
2019-11-17 21:22:46 -08:00
Aaron Plattner
03b91e17ce xfree86: Call ScreenInit for protocol screens before GPU screens
During startup, the xfree86 DDX's InitOutput() calls PreInit for
protocol screens first, and then GPU screens. On teardown, dix_main()
calls CloseScreen in the reverse order: GPU screens first starting with
the last one and then working backwards, and then protocol screens also
in reverse order.

InitOutput() calls ScreenInit in the wrong order: for GPU screens first and then
for protocol screens. This causes a problem for drivers that have global state
that is tied to the first screen that calls ScreenInit.

Fix this by simply re-ordering the for loops to call PreInit for
protocol screens first and then for GPU screens second.

(cherry picked from commit e5e9a8ca91)
2019-11-13 10:33:50 -08:00
Alex Goins
325f694e97 modesetting: Implement ms_covering_randr_crtc() for ms_present_get_crtc()
ms_present_get_crtc() returns an RRCrtcPtr, but derives it from a xf86CrtcPtr
found via ms_dri2_crtc_covering_drawable()=>ms_covering_crtc(). As a result, it
depends on all associated DIX ScreenRecs having an xf86CrtcConfigPtr DDX
private.

Some DIX ScreenRecs don't have an xf86CrtcConfigPtr DDX private, but do have an
rrScrPrivPtr DDX private. Given that we can derive all of the information we
need from RandR, we can support these screens by avoiding the use of xf86Crtc.
This change implements an RandR-based path for ms_present_get_crtc(), allowing
drawables to successfully fall back to syncing to the primary output, even if
the slave doesn't have an xf86CrtcConfigPtr DDX private.

Without this change, if a slave doesn't have an xf86CrtcConfigPtr DDX private,
drawables will fall back to 1 FPS if they overlap an output on that slave.

Signed-off-by: Alex Goins <agoins@nvidia.com>
(cherry picked from commit 562c7888be)
2019-11-11 14:46:32 -08:00
Alex Goins
aa43dce15f modesetting: Fix ms_covering_crtc() segfault with non-xf86Crtc slave
DIX ScreenRecs don't necessarily have an xf86CrtcConfigPtr DDX private.
ms_covering_crtc() assumes that they do, which can result in a segfault.

Update ms_covering_crtc() to check the XF86_CRTC_CONFIG_PTR() returned pointer
before dereferencing it. This will still mean that ms_covering_crtc() can't fall
back to the primary output when a drawable overlaps a slave output (going to the
1 FPS default instead), but it won't segfault.

Signed-off-by: Alex Goins <agoins@nvidia.com>
(cherry picked from commit 797e7a0ceb)
2019-11-11 14:46:32 -08:00
Alex Goins
341a478715 modesetting: Fix ms_covering_crtc() segfault with non-modesetting slave primary
ms_covering_crtc() uses RRFirstOutput() to determine a primary output to fall
back to if a drawable is overlapping a slave output.

If the primary output is a slave output, RRFirstOutput() will return a slave
output even if passed a master ScreenPtr. ms_covering_crtc() dereferences the
output's devPrivate, which is invalid for non-modesetting outputs, and can
crash.

Changing RRFirstOutput() could have unintended side effects for other callers,
so this change replaces the call to RRFirstOutput() with ms_first_output().
ms_first_output() ignores the primary output if it doesn't match the given
ScreenPtr, choosing the first connected output instead.

Signed-off-by: Alex Goins <agoins@nvidia.com>
(cherry picked from commit 3ef9029ace)
2019-11-11 14:46:32 -08:00
Hans de Goede
642c1f83b9 glamor/xwayland: Define EGL_NO_X11
Define EGL_NO_X11 everywhere were we also define MESA_EGL_NO_X11_HEADERS,
EGL_NO_X11 is the MESA_EGL_NO_X11_HEADERS equivalent for the egl headers
shipped with libglvnd.

This fixes the xserver not building with the libglvnd-1.2.0 headers:

In file included from /usr/include/EGL/eglplatform.h:128,
                 from /usr/include/epoxy/egl_generated.h:11,
                 from /usr/include/epoxy/egl.h:46,
                 from glamor_priv.h:43,
                 from glamor_composite_glyphs.c:25:
/usr/include/X11/Xlib.h:222:2: error: conflicting types for 'GC'
  222 | *GC;
      |  ^~
In file included from glamor.h:34,
                 from glamor_priv.h:32,
                 from glamor_composite_glyphs.c:25:
../include/gcstruct.h:282:3: note: previous declaration of 'GC' was here
  282 | } GC;
      |   ^~

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
(cherry picked from commit 741bd73429)
2019-11-05 08:12:03 -08:00
Sven Joachim
3491f1dc5c modesetting: Fix broken manpage in autoconf build
The autoconf build for the modesetting driver still relied on
xorg-macros.m4 for string replacements and did not include the
top-level manpages.am.  As a result, no substitutions took place after
commit 2e497bf887.

This should be a candidate for the 1.20 branch.

Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
(cherry picked from commit de0d39f825)
2019-10-30 19:38:30 +00:00
Andres Rodriguez
5aadaac949 xf86: Disable unused crtc functions when a lease is revoked
This fixes 'non-desktop' displays staying powered on after their lease
has been revoked.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111620
Cc: Keith Packard <keithp@keithp.com>
Signed-off-by: Andres Rodriguez <andresx7@gmail.com>
2019-09-23 12:45:53 -04:00
Carlos Garnacho
63346c7439 xwayland: Handle the case of windows being realized before redirection
If Xwayland gets to realize a window meant for composition before the
compositor redirected windows (i.e. redirect mode is not RedirectDrawManual
yet), the window would stay "invisible" as we wouldn't create a
wl_surface/wl_shell_surface for it at any later point.

This scenario may happen if the wayland compositor sets up a X11 socket
upfront, but waits to raise Xwayland until there are X11 clients. In this
case the first data on the socket is the client's, the compositor can hardly
beat that in order to redirect subwindows before the client realizes a
Window.

In order to jump across this hurdle, allow the late creation of a matching
(shell) surface for the WindowPtr on SetWindowPixmapProc, so it is ensured
to be created after the compositor set up redirection.

Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit 78cc8b6f96)
2019-09-10 14:51:00 +02:00
Carlos Garnacho
12db645c7f xwayland: Refactor surface creation into a separate function
This is just called from xwl_window_realize() ATM, but will be useful in
future commits.

Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
(cherry picked from commit c2e8ae9640)
2019-09-10 14:50:57 +02:00
Carlos Garnacho
e0af09061f xwayland: Separate DamagePtr into separate window data
This will be dissociated in future commits to handle the cases
where windows are being realized before there is a compositor
handling redirection.

In that case, we still want the DamagePtr to be registered upfront
on RealizeWindowProc before a corresponding xwl_window might be
created. Most notably, it cannot be lazily created on
SetWindowPixmapProc as damage accounting gets broken.

Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
(cherry picked from commit 4e50440ae2)
2019-09-10 14:50:52 +02:00
Olivier Fourdan
dfd51be3ca xwayland: Do not free a NULL GBM bo
Both `gbm_bo_create()` and `gbm_bo_create_with_modifiers()` can fail and
return `NULL`.

If that occurs, `xwl_glamor_gbm_create_pixmap()` will not create a
pixmap for the (NULL) GBM bo, but would still try to free the bo which
leads to a crash in mesa:

  [...]
  #7  <signal handler called>
  #8  in gbm_bo_destroy (bo=0x0) at ../src/gbm/main/gbm.c:439
  #9  in xwl_glamor_gbm_create_pixmap () at xwayland-glamor-gbm.c:245
  #10 in ProcCreatePixmap () at dispatch.c:1440
  #11 in Dispatch () at dispatch.c:478
  #12 in dix_main () at main.c:276

To avoid the crash, only free the GBM bo if not `NULL`.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Bugzilla: https://bugzilla.redhat.com/1729925
(cherry picked from commit d9ec525059)
2019-07-26 19:44:03 +00:00
Adam Jackson
df7ee10d98 xwayland: Expand the RANDR screen size limits
There's not really a good way to query this from the wayland server, so
just set the maximum to the X11 protocol limits. While we're at it,
lower the minimum screen size to something implausibly small too, just
in case.

Fixes: xorg/xserver#850
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
(cherry picked from commit d0850241c6)
2019-07-26 19:44:03 +00:00
Olivier Fourdan
44c693f45d xwayland: Update screen pixmap on output resize
Running Xwayland non-rootless and resizing the output would lead to a
crash while trying to update the larger areas of the root window.

Make sure we resize the backing pixmap according to the new output size
to avoid the crash.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/issues/834
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
(cherry picked from commit ce9455b5ee)
2019-07-26 19:44:03 +00:00
Matt Roper
1804e73271 dri2: Sync i965_pci_ids.h from mesa
Copied from Mesa with no modifications.

This update brings in a significant number of new platform ID's.

Syncs with mesa up to commit e334a595e ("intel/icl: Add new ICL
PCI-IDs").

Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
(cherry picked from commit a8d9ebeb43)
2019-07-26 19:44:03 +00:00
Carlos Garnacho
c86222d4bd xwayland: Reset scheduled frames after hiding tablet cursor
Hiding the tablet tool cursor results in it being hidden forever after.
This is due to the stale frame callback that will neither be disposed
or replaced. This can be reproduced in krita (X11) as the pointer
cursor is hidden while over the canvas.

Clearing the frame callback ensures the correct behavior in future
xwl_tablet_tool_set_cursor() calls (i.e. a new cursor surface being
displayed, and a new frame callback created), and is 1:1
with xwl_seat_set_cursor() for pointers.

Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
(cherry picked from commit dea4a74621)
2019-06-06 11:48:13 +02:00
Olivier Fourdan
34ad57e570 xwayland: Check status in GBM pixmap creation
The current code in `xwl_glamor_gbm_create_pixmap_for_bo()` may fail in
several cases that are not checked for:

 - `eglCreateImageKHR()` may have failed to create the image,
 - `glEGLImageTargetTexture2DOES()` may fail and set an error,
 - `glamor_set_pixmap_texture()` may fail for very large pixmaps
    because the corresponding FBO could not be created.

Trying to upload content to a pixmap with no texture will crash Mesa,
glamor and Xwayland, e.g.:

  XXX fail to create fbo.
  (EE)
  (EE) Backtrace:
  (EE) 0: Xwayland (OsSigHandler+0x29)
  (EE) 1: libpthread.so.0 (funlockfile+0x50)
  (EE) 2: libc.so.6 (__memmove_avx_unaligned_erms+0x215)
  (EE) 3: dri/i965_dri.so (_mesa_format_convert+0xab3)
  (EE) 4: dri/i965_dri.so (_mesa_texstore+0x205)
  (EE) 5: dri/i965_dri.so (store_texsubimage+0x28c)
  (EE) 6: dri/i965_dri.so (intel_upload_tex+0x13b)
  (EE) 7: dri/i965_dri.so (texture_sub_image+0x134)
  (EE) 8: dri/i965_dri.so (texsubimage_err+0x150)
  (EE) 9: dri/i965_dri.so (_mesa_TexSubImage2D+0x48)
  (EE) 10: Xwayland (glamor_upload_boxes+0x246)
  (EE) 11: Xwayland (glamor_copy+0x4d1)
  (EE) 12: Xwayland (miCopyRegion+0x96)
  (EE) 13: Xwayland (miDoCopy+0x43c)
  (EE) 14: Xwayland (glamor_copy_area+0x24)
  (EE) 15: Xwayland (damageCopyArea+0xba)
  (EE) 16: Xwayland (compCopyWindow+0x31c)
  (EE) 17: Xwayland (damageCopyWindow+0xd3)
  (EE) 18: Xwayland (miResizeWindow+0x7b7)
  (EE) 19: Xwayland (compResizeWindow+0x3a)
  (EE) 20: Xwayland (ConfigureWindow+0xa96)
  (EE) 21: Xwayland (ProcConfigureWindow+0x7d)
  (EE) 22: Xwayland (Dispatch+0x320)
  (EE) 23: Xwayland (dix_main+0x366)
  (EE) 24: libc.so.6 (__libc_start_main+0xf3)
  (EE) 25: Xwayland (_start+0x2e)
  (EE)
  Fatal server error:
  (EE) Caught signal 11 (Segmentation fault). Server aborting
  (EE)

Check for the possible cases of failure above and fallback to the
regular glamor pixmap creation when an error is detected.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/issues/661
(cherry picked from commit fc6380a11b)
2019-06-05 15:12:31 +02:00
Olivier Fourdan
6711b5c6fd xwayland: Avoid a crash on pointer enter with a grab
On pointer enter notification, Xwayland checks for an existing pointer
warp with a `NULL` sprite.

In turn, `xwl_pointer_warp_emulator_maybe_lock()` checks for an existing
grab and the destination window using `XYToWindow()` which does not
check for the actual sprite not being `NULL`.

So, in some cases, when the pointer enters the surface and there is an
existing X11 grab which is not an ownerEvents grab, Xwayland would crash
trying to dereference the `NULL` sprite pointer:

  #0  __GI_raise ()
  #1  __GI_abort () at abort.c:79
  #2  OsAbort () at utils.c:1351
  #3  AbortServer () at log.c:879
  #4  FatalError () at log.c:1017
  #5  OsSigHandler () at osinit.c:156
  #6  OsSigHandler () at osinit.c:110
  #7  <signal handler called>
  #8  XYToWindow (pSprite=0x0, x=0, y=0) at events.c:2880
  #9  xwl_pointer_warp_emulator_maybe_lock () at xwayland-input.c:2673
  #10 pointer_handle_enter () at xwayland-input.c:434

Avoid the crash by simply checking for the sprite being not `NULL` in
`xwl_pointer_warp_emulator_maybe_lock()`

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Bugzilla: https://bugzilla.redhat.com/1708119
(cherry picked from commit 0a07446318)
2019-06-05 15:12:31 +02:00
Peter Hutterer
d0c7483b3e xwayland: fix a realloc OOM error case
Found by coverity

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(Cherry picked from commit 7c25439f0d)
2019-04-05 12:39:00 +02:00
Olivier Fourdan
bb74db6b38 xwayland: search for a render node to use
wl_drm's protocol "device" event provides the path to the DRM device,
which may not be a render node, thus causing Xwayland to fall back to
DRM authentication which may fail if the user has switched to another
VT while Xwayland is starting.

Search for a render node corresponding to the given DRM device and try
to use it instead, as render nodes do not need DRM authentication and
Xwayland can make use of them if it can find one.

Closes: https://bugs.freedesktop.org/108038
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
(Cherry picked from commit 361894497c)
2019-04-05 12:33:28 +02:00
Michel Dänzer
5781563371 xwayland/present: Destroy sync_callback in xwl_present_cleanup
xwl_present_cleanup frees the struct xwl_present_window memory,
so if there's a pending callback, we have to destroy it to prevent
use-after-free in xwl_present_sync_callback.

Should fix issue #645.

Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
(Cherry picked from commit 2e18eec6f0)
2019-03-25 12:45:52 +01:00
Michel Dänzer
fcac9b10c9 glx,xquartz: Fix make distcheck
Guard BUILT_SOURCES and CLEANFILES by XWIN_GLX_WINDOWS/XQUARTZ.

(cherry picked from commit f9bbc9d5ea)
2019-02-25 13:06:58 -05:00
A. Wilcox
013c28a122 DRI2: Add another Coffeelake PCI ID
A user of Adélie Linux reported that modesetting wasn't working properly on
their Intel i7-9700K-integrated UHD 630 GPU.  Xorg.0.log showed:

[   131.902] (EE) modeset(0): [DRI2] No driver mapping found for PCI device 0x8086 / 0x3e98
[   131.902] (EE) modeset(0): Failed to initialize the DRI2 extension.

Indeed, that PCI ID is missing from i965_pci_ids.  Adding it fixed the issue
and allowed the system to work with i965_dri under modesetting.

(cherry picked from commit d3a26bbf61)
2019-02-20 14:26:12 -05:00
Michel Dänzer
59e0b5f041 xfree86/modes: Don't clobber gamma LUT of compatibility output's CRTC
If the driver calls xf86HandleColormaps, CMapChangeGamma updates the HW
gamma LUT of all CRTCs via xf86RandR12LoadPalette. However,
xf86RandR12ChangeGamma was then clobbering the gamma LUT of the RandR
1.2 compatibility output's CRTC with the gamma curves computed from the
screen's global gamma values.

Fix this by bailing if xf86RandR12LoadPalette is installed.

Fixes: 02ff0a5d7e "xf86RandR12: Fix XF86VidModeSetGamma triggering a
                     BadImplementation error"
(cherry picked from commit 30044b2253)
2019-02-20 14:25:49 -05:00
Maya Rashish
712d0e86aa xfree86: Try nouveau on NetBSD as well.
(cherry picked from commit e3fb178617)
2019-02-20 14:25:31 -05:00
Ilia Mirkin
c44eee243e modesetting: fix conn_id termination and potential overrun by 1 byte
Noticed when porting this logic to xf86-video-nouveau, and valgrind
complained about conditional jump based on uninitialized data.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Pekka Paalanen <pekka.paalanen@collabora.com>
(cherry picked from commit 48b1af2718)
2019-02-20 14:23:33 -05:00
Lyude Paul
4e12cba656 modesetting: Actually disable CRTCs in legacy mode
Believe it or not, somehow we've never done this in legacy mode! We
currently simply change the DPMS property on the CRTC's output's
respective DRM connector, but this means that we're just setting the
CRTC as inactive-not disabled. From the perspective of the kernel, this
means that any shared resources used by the CRTC are still in use.

This can cause problems for drivers that are not yet fully atomic,
despite using the atomic helpers internally. For instance: if CRTC-1 and
CRTC-2 are still enabled and use shared resources within the kernel (an
MST topology, for example), and then userspace tries to go enable CRTC-3
on the same topology this might suddenly fail if CRTC-3 needs the shared
resources CRTC-1 and CRTC-2 are using. While I don't know of any
situations in the mainline kernel that actually trigger this, future
plans for reworking the atomic check of MST drivers are absolutely
going to make this into a real issue (they already are in my WIP
branches for the kernel).

So: actually do the right thing here and disable CRTCs when they're not
going to be used anymore, even in legacy mode.

Signed-off-by: Lyude Paul <lyude@redhat.com>
(cherry picked from commit 7a44e8d400)
2019-02-20 14:23:03 -05:00
Olivier Fourdan
a352f97954 xwayland: handle case without any crtc
Xwayland creates and destroys the CRTC along with the Wayland outputs,
so there is possibly a case where the number of CRTC drops to 0.

However, `xwl_present_get_crtc()` always return `crtcs[0]` which is
invalid when `numCrtcs` is 0.

That leads to crash if a client queries the Present capabilities when
there is no CRTC, the backtrace looks like:

  #0  raise() from libc.so
  #1  abort() from libc.so
  #2  OsAbort() at utils.c:1350
  #3  AbortServer() at log.c:879
  #4  FatalError() at log.c:1017
  #5  OsSigHandler() at osinit.c:156
  #6  OsSigHandler() at osinit.c:110
  #7  <signal handler called>
  #8  main_arena() from libc.so
  #9  proc_present_query_capabilities() at present_request.c:236
  #10 Dispatch() at dispatch.c:478
  #11 dix_main() at main.c:276

To avoid returning an invalid pointer (`crtcs[0]`) in that case, simply
check for `numCrtcs` being 0 and return `NULL` in that case.

Thanks to Michel Dänzer <michel.daenzer@amd.com> for pointing this as a
possible cause of the crash.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Bugzilla: https://bugzilla.redhat.com/1609181
(cherry picked from commit e8295c5020)
2019-01-09 15:26:33 +01:00
Michel Dänzer
210cd52906 xwayland: Don't take buffer release queue into account for frame timer
The buffer release queue has two kinds of entries:

* Pending async flips.
* Completed flips waiting for their buffer to be released by the Wayland
  compositor.

xwl_present_timer_callback neither completes async flips nor releases
buffers, so the timer isn't needed for the buffer release queue.

(cherry picked from commit e6cd1c9bde)
2019-01-09 15:26:33 +01:00
Michel Dänzer
7c28b0e34e xwayland: Don't need xwl_window anymore in xwl_present_queue_vblank
Fixes issue #12. Presumably the problem was that Present operations on
unmapped windows were executed immediately instead of only when reaching
the target MSC.

(cherry picked from commit f541615342)
2019-01-09 15:26:33 +01:00
Michel Dänzer
4613595709 xwayland: Add xwl_present_unrealize_window
When a window is unrealized, a pending frame callback may never be
called, which could result in repeatedly freezing until the frame timer
fires after a second.

Fixes these symptoms when switching from fullscreen to windowed mode in
sauerbraten.

(cherry picked from commit 8c9538573c)
2019-01-09 15:26:33 +01:00
Michel Dänzer
98f41563e6 xwayland: Replace xwl_window::present_window with ::present_flipped
There's no need to keep track of the window which last performed a
Present flip. This fixes crashes due to the assertion in
xwl_present_flips_stop failing. Fixes issue #10.

The damage generated by a flip only needs to be ignored once, then
xwl_window::present_flipped can be cleared. This may fix freezing in
the (hypothetical) scenario where Present flips are performed on a
window, followed by other drawing requests using the window as the
destination, but nothing triggering xwl_present_flips_stop. The damage
from the latter drawing requests would continue being ignored.

(cherry picked from commit 6b016d58d2)
2019-01-09 15:26:33 +01:00
Michel Dänzer
f393801dbb xwayland: Complete "synchronous" Present flips from xwl_present_msc_bump
Completing them from xwl_present_sync_callback had at least two issues:

* It was before the MSC was incremented in xwl_present_frame_callback,
  so the MSC value in the completion event could be lower than the
  target specified by the client. This could cause hangs with the Mesa
  Vulkan drivers.
* It allowed clients to run at a frame-rate higher than the Wayland
  compositor's frame-rate, wasting energy on generating frames which
  were never displayed. This isn't expected to happen unless the client
  specified PresentOptionAsync (in which case flips are still completed
  from xwl_present_sync_callback, allowing higher frame-rates).

v2:
* Make xwl_present_has_events return true when there's a pending
  "synchronous" flip, so those complete after at most ~1 second even if
  the Wayland server doesn't send a frame event.

Bugzilla: https://bugs.freedesktop.org/106713
(cherry picked from commit ace551d8a2)
2019-01-09 15:26:33 +01:00
Michel Dänzer
e646e3054a xwayland: Rename xwl_present_events_notify to xwl_present_msc_bump
And consolidate more code from xwl_present_timer_callback and
xwl_present_frame_callback in it.

(cherry picked from commit 2bfc46d414)
2019-01-09 15:26:33 +01:00
Michel Dänzer
47aed554b7 xwayland: Use xwl_present_reset_timer in xwl_present_timer_callback
Apart from simplifying the code, this should also prevent a condition
(which might only be possible with the following fix) reported in
https://gitlab.freedesktop.org/wayland/weston/issues/115#note_52467:

1. xwl_present_timer_callback indirectly calls xwl_present_reset_timer
   -> xwl_present_free_timer
2. xwl_present_timer_callback then returns a non-0 value, so DoTimer
   calls TimerSet with the old xwl_present_window->frame_timer pointer
   which was freed in step 1 => use after free

Calling xwl_present_reset_timer explicitly passes NULL to TimerSet if
step 1 freed xwl_present_window->frame_timer, and it will allocate a new
one.

(cherry picked from commit 5e8b9a3a56)
2019-01-09 15:26:33 +01:00
Olivier Fourdan
cf8e064ec0 xwayland: do not crash if gbm_bo_create() fails
The function `xwl_glamor_gbm_create_pixmap()` first creates a buffer
objects and then creates the xwl_pixmap from it.

However, `xwl_glamor_gbm_create_pixmap_for_bo()` is not called if the
buffer object creation fails, and `xwl_glamor_gbm_create_pixmap()`
simply returns `glamor_create_pixmap()`.

The problem with this is that if `xwl_glamor_gbm_create_pixmap_for_bo()`
is not called then neither is `xwl_pixmap_set_private()` and further
calls to `xwl_pixmap_get()` will return NULL and cause a NULL pointer
dereference if the return value is not checked:

  #0  xwl_glamor_gbm_get_wl_buffer_for_pixmap ()
      at hw/xwayland/xwayland-glamor-gbm.c:248
  #1  xwl_window_post_damage () at hw/xwayland/xwayland.c:697
  #2  xwl_display_post_damage () at hw/xwayland/xwayland.c:759
  #3  block_handler () at hw/xwayland/xwayland.c:890
  #4  BlockHandler () at dix/dixutils.c:388
  #5  WaitForSomething () at os/WaitFor.c:201
  #6  Dispatch () at dix/dispatch.c:421
  #7  dix_main () at dix/main.c:276
  #8  __libc_start_main () at ../csu/libc-start.c:308
  #9  _start ()

  (gdb) print xwl_pixmap
  $1 = (struct xwl_pixmap *) 0x0

Make sure we check for `xwl_pixmap_get()` returned value where relevant
and fail gracefully if this is the case.

See also: https://gitlab.gnome.org/GNOME/mutter/issues/340

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Marco Trevisan <mail@3v1n0.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 036794bebc)
2019-01-09 15:26:33 +01:00
Michel Dänzer
64f5e6ec2d xwayland: Plug leaks in xwl_present_sync_callback
xwl_present_window->sync_callback was leaked.

The event memory was leaked if the corresponding buffer had already been
released.

(cherry picked from commit cb0de153bf)
2019-01-09 15:26:33 +01:00
Matthieu Herrb
8a59e3b7db Disable -logfile and -modulepath when running with elevated privileges
Could cause privilege elevation and/or arbitrary files overwrite, when
the X server is running with elevated privileges (ie when Xorg is
installed with the setuid bit set and started by a non-root user).

CVE-2018-14665

Issue reported by Narendra Shinde and Red Hat.

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 50c0cf885a)
2018-10-25 09:18:06 -04:00
Peter Hutterer
cfc3dec09e xfree86: fix readlink call
Misplaced parenthesis caused us to compare the sizeof, not the readlink return
value.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit bd5fe7593f)
2018-10-16 10:22:05 -04:00
Adam Jackson
f5dc787fc9 fbdevhw: Refuse to touch PCI devices on the fallback probe path
Fixes: https://gitlab.freedesktop.org/xorg/driver/xf86-video-fbdev/issues/9
Signed-off-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit fc78bcca21)
2018-10-12 11:35:42 -04:00
Adam Jackson
4795c069a5 glamor/egl: Avoid crashing on broken configurations
0a9415cf apparently can tickle bugs in the GL stack where glGetString
returns NULL, presumably because the eglMakeCurrent() didn't manage to
actually install a dispatch table and you're hitting a stub function.
That's clearly not our bug, but if it happens we should at least not
crash. Notice this case and fail gently.

Signed-off-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit af151895f3)
2018-10-12 11:35:07 -04:00
Adam Jackson
1e3c5d614e glamor_egl: Don't initialize on llvmpipe
Mesa started supporting GL_OES_EGL_image on llvmpipe in 17.3, after this
commit:

    commit bbdeddd5fd0b797e1e281f058338b3da4d98029d
    Author: Gurchetan Singh <gurchetansingh@chromium.org>
    Date:   Tue Aug 1 14:49:33 2017 -0700

        st/dri: add drisw image extension

That's pretty cool, but it means glamor now thinks it can initialize on
llvmpipe. This is almost certainly not what anyone wants, as glamor on
llvmpipe is pretty much uniformly slower than fb.

This fixes both Xorg and Xwayland to refuse glamor in such a setup.
Xephyr is left alone, both because glamor is not the default there and
because Xephyr+glamor+llvmpipe is one of the easier ways to get xts to
exercise glamor.

The (very small) downside of this change is that you lose DRI3 support.
This wouldn't have helped you very much (since an lp glamor blit is
slower than a pixman blit), but it would eliminate the PutImage overhead
for llvmpipe's glXSwapBuffers. A future change should add DRI3 support
for the fb-only case.

Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 0a9415cf79)
2018-10-12 11:35:00 -04:00
Adam Jackson
a41b6ef224 modesetting: Don't free(dst) in drmmode_prop_info_copy
The destination is always either on the stack or in the middle of some
struct.

Signed-off-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 43a0f9a5db)
2018-10-05 09:14:18 +02:00
Olivier Fourdan
c26a47b4f2 xwayland: Use double for xwl_tablet_tool
So we do not lose subpixel precision in Xwayland.

Suggested-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Closes: https://gitlab.freedesktop.org/libinput/libinput/issues/138
(cherry picked from commit 734b2d6907)
2018-10-04 17:27:08 +02:00
Adam Jackson
fb01b238c6 xfree86: Fix Option "MaxClients" validation
The old code would not in fact validate the option value, though it
might complain about it in the log. It also didn't let you set some
legal values that the -maxclients command line option would.

Signed-off-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 7d689f049c)
2018-10-04 17:27:03 +02:00
Dave Airlie
83ef02839c posix_tty: free leak of xf86SetStrOption return value.
Pointed out by coverity.

Signed-off-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit cad3a1a82d)
2018-10-04 17:26:26 +02:00
Dave Airlie
66d36010a3 modesetting: get pEnt after error checks
This saves us having to make sure we clean it up.

Pointed out by coverity.

Signed-off-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit b6c29a881e)
2018-10-04 17:26:20 +02:00
Adam Jackson
8e646ca985 modesetting: Document Option "DoubleShadow" in the man page
Signed-off-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit c4f3e42fe3)
2018-10-04 17:25:52 +02:00
Adam Jackson
fdb80a327c modesetting: Lie less in the man page
We don't support 8bpp, and we do have acceleration.

Signed-off-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 0dc2c419e1)
2018-10-04 17:25:30 +02:00