summaryrefslogtreecommitdiff
path: root/Xext
AgeCommit message (Collapse)AuthorFilesLines
2014-12-08Xv: unvalidated lengths in XVideo extension swapped procs [CVE-2014-8099]Alan Coopersmith1-0/+20
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08xcmisc: unvalidated length in SProcXCMiscGetXIDList() [CVE-2014-8096]Alan Coopersmith1-0/+1
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-11-24Merge remote-tracking branch 'whot/for-keith'Keith Packard13-50/+50
2014-11-12Drop trailing whitespacesPeter Hutterer13-48/+48
sed -i "s/[ ]\+$//g" **/*.(c|h) happy reviewing... git diff -w is an empty diff. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-11-12Xext: fix clang compiler warningPeter Hutterer1-2/+2
shm.c:1150:24: warning: equality comparison with extraneous parentheses [-Wparentheses-equality] if ((shmdesc->addr == ((char *) -1))) { Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-10-31xv: Add missing gcstruct.h includeThierry Reding1-1/+1
Commit ea3f3b0786d5 (xv: Move xf86 XV color key helper to core.) added code that uses internals of struct _GC. This structure is defined in the include/gcstruct.h header which wasn't included by the source file, only gc.h was. That caused the following build failure: CC xvmain.lo Xext/xvmain.c: In function 'XvFillColorKey': Xext/xvmain.c:1114:13: error: dereferencing pointer to incomplete type (*gc->ops->PolyFillRect) (pDraw, gc, nbox, rects); ^ Fix this by including the correct header file. Signed-off-by: Thierry Reding <treding@nvidia.com> Tested-by: Keith Packard <keithp@keithp.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-27Xext/shm: Detach SHM segment after Pixmap is releasedChris Wilson1-8/+7
The GPU may still have a reference to the SHM segment which would only be finally released when the Pixmap is destroy. So we can only detach the SHM segment (and thereby making the memory unaccessible) after the backend has had a chance to flush any remaining references. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85058 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reported-and-tested-by: gedgon@gmail.com Reviewed-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-23xinerama: Fix access mode in GetImage's drawable lookupAdam Jackson1-1/+1
Signed-off-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-09mi: Move pScreen->SendGraphicsExpose up to dixAdam Jackson1-6/+4
No DDX is overriding this and it's fairly absurd to expose it as a screen operation anyway. Reviewed-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-10-02security: Remove XpExtension from SecurityTrustedExtensionsDaniel Martin1-1/+0
There's no XPrint extension (anymore). Signed-off-by: Daniel Martin <consume.noise@gmail.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-08-07xv: Drop the ClientPtr from the interface to the DDX.Eric Anholt3-26/+24
Nobody was using it. v2: Merge the hunk that was accidentally in the previous commit into this one. Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-07xv: Remove the no-op AllocatePort/FreePort interfaces.Eric Anholt3-88/+3
v2: Fix accidentally squashed-in change for dropping client from the arguments, which should have been in the next commit. Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com> (v2)
2014-08-06xv: Fix malloc-failure cases in the fill color key helper.Eric Anholt1-9/+13
Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2014-08-06xv: Move xf86 XV color key helper to core.Eric Anholt2-0/+33
Color key overlay implementations want to reuse this code, and XF86's had bugs (to be fixed in the next commit). Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06xv: Move CloseScreen setup from a DIX hook to normal wrapping.Eric Anholt2-3/+0
Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06xv: Drop unused XvdiVideoStopped().Eric Anholt2-25/+0
Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06xv: Drop unused XvdiPreemptVideo().Eric Anholt2-23/+0
Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06xv: Move the DDX XV screen private allocation into the DDXes.Eric Anholt1-1/+0
XV was going against convention by having the core infrastructure allocate the private on behalf of the DDX. I was interested in this because I was trying to make multiple pieces of DDX be able to allocate adaptors, and that wasn't going to work if DDX-specific code was hung off of a single global screen private. Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06xv: Drop the ddQueryAdaptors() interface.Eric Anholt2-3/+0
The core was passing pointers to pxvs's nAdaptors and pAdaptors, and the two hardware implementations were copying pxvs's nAdaptors and pAdaptors into those pointers. Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06xv: Move common code for adaptor cleanup to xvmain.cEric Anholt2-0/+40
Since any DDX XV screen cleanup would need this same code for freeing the tree of pointers for xv adaptors, move it to the dix. v2: Unconditionalize the pPorts freeing, to match the block above it. Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Keith Packard <keithp@keithp.com> (v1)
2014-07-29saver: Don't open-code IsMapInstalledAdam Jackson1-15/+1
Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-04-30selinux: don't checkout for AVCs on select() EINTRRay Strode1-2/+2
wakeup handlers are called even when select() returns EINTR, and when they're called the passed fd set is undefined. This commit fixes the selinux wakeup handler to avoid checking for AVCs over the netlink socket spuriously. Reviewed-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Ray Strode <rstrode@redhat.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-04-21xres: Fix size estimation for <8bpp pixmaps (#69057)Adam Jackson1-2/+2
Just use floats, it's not like this is a performance path. Signed-off-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-03-27Build dpmsstubs.c once as a convenience library, rather than once for each ↵Jon TURNEY1-1/+3
DDX which wants to use it Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk> Reviewed-by: Gaetan Nadon <memsize@videotron.ca>
2014-02-09sync: Avoid ridiculously long timeoutsMark Kettenis1-5/+2
On OpenBSD, passing a timeout longer than 100000000 seconds to select(2) will make it fail with EINVAL. As this is original 4.4BSD behaviour it is not inconceivable that other systems suffer from the same problem. And Linux, though not suffering from any 4.4BSD heritage, briefly did something similar: <https://lkml.org/lkml/2012/8/31/263> So avoid calling AdjustWaitForDelay() instead of setting the timeout to (effectively) ULONG_MAX milliseconds. Signed-off-by: Mark Kettenis <kettenis@openbsd.org> Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
2014-01-12Clean up a few function prototypes to not place formals in /**/Keith Packard2-34/+18
This just removes the comment markers from around the formals in several function prototypes near where pointer -> void * changes were made. There are plenty more of these to fix. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-01-12Replace 'pointer' type with 'void *'Keith Packard25-308/+308
This lets us stop using the 'pointer' typedef in Xdefs.h as 'pointer' is used throughout the X server for other things, and having duplicate names generates compiler warnings. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eric Anholt <eric@anholt.net>
2014-01-12Xext: Clean up warnings in hashtable codeKeith Packard2-6/+6
Make keys const void * Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12Xext: Clean up warningsKeith Packard2-4/+2
GC funcs and ops are const. Remove unused variables. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12Clean up warnings in DIXKeith Packard2-4/+4
As usual, mostly const char changes. However, filter_device_events had a potentially uninitialized value, 'raw', which I added a bunch of checks for. I suspect most of those are 'can't happen', but it's hard to see that inside the function. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12Xext: _X_EXPORT DPMSSet and DPMSSupportedKeith Packard1-2/+2
These are needed by drivers, and it's better to export them from here rather than redefining them in hw/xfree86 and exporting them from there. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-12-09damageext: Xineramify (v7)Adam Jackson1-0/+3
v7: Don't bother making resources for the backing listeners. [keithp] This is now slightly unlike how other resources are xineramified. We create N+1 internal damage listeners, one that's a real resource and reflects the protocol view, and then one per backend screen where the report function piles onto the protocol view. The internal listeners are not stored in the resource database directly, they just hang off the xinerama resource. We don't wrap Subtract at the dispatch level, but we do extend it for the Xinerama case to clip to the root window geometry. As a result of the N+1 design here, the damage reports we generate are not quite minimal. However they are indistinguishable from sequential rendering events happening before the client hears damage, and we don't need to add a post-dispatch callback just for this one extension. Add is probably (still) somewhat broken since it will only hit screen 0, but Add really only exists for DRI1's sake, and DRI1 disables itself with Xinerama enabled anyway. In the absence of a use case, I'm leaving it unwrapped under Xinerama; if someone wants to define how it ought to work, be my guest. Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Adam Jackson <ajax@redhat.com>
2013-12-09xinerama: Export the screen regionAdam Jackson2-1/+2
damageext wants this so it can intersect subtract requests against the root window geometry. Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Adam Jackson <ajax@redhat.com>
2013-12-02Xext: Use SHMDIR and O_TMPFILE when creating mapping filesKeith Packard1-3/+31
ShmCreateSegment asks for a file descriptor for a memory mapped file created by the X server. This patch uses O_TMPFILE where available, and also uses the SHMDIR directory to store the files, both for the O_TMPFILE and mkstemp cases. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org>
2013-11-23Xext: Recover from miSyncInitFenceFromFD failure without crashingKeith Packard1-1/+1
miSyncDestroyFence must not be called unless miSyncInitFence has been invoked, so if miSyncInitFenceFromFD fails, we must free the fence manually. Signed-off-by: Keith Packard <keithp@keithp.com> Tested-by: Fredrik Höglund <fredrik@kde.org>
2013-11-14xext: Fix shmint.h to not use headers outside of sdk_HEADERSKeith Packard2-7/+2
shmint.h is part of sdk_HEADERS, and so can't use anything not included in sdk_HEADERS. busfault.h includes dix-config.h which is not. Leave the use of struct busfault in shmint.h and move the include of busfault.h to shm.c. protocol-versions.h is not part of sdk_HEADERS, so instead of using that, just use XTRANS_SEND_FDS to choose whether to expose the fd passing requests directly. Reported-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Keith Packard <keithp@keithp.com> Tested-by: Knut Petersen <Knut_Petersen@t-online.de> Reviewed-by: Julien Cristau <jcristau@debian.org> v2: also avoid using protocol-versions.h
2013-11-11Trap SIGBUS to handle truncated shared memory segmentsKeith Packard2-2/+40
If a client passes a section of memory via file descriptor and then subsequently truncates that file, the underlying pages will be freed and the addresses invalidated. Subsequent accesses to the page will fail with a SIGBUS error. Trap that SIGBUS, figure out which segment was causing the error and then allocate new pages to fill in for that region. Mark the offending shared segment as invalid and free the resource ID so that the client will be able to tell when subsequently attempting to use the segment. Signed-off-by: Keith Packard <keithp@keithp.com> v2: Use MAP_FIXED to simplify the recovery logic (Mark Kettenis) v3: Also catch errors in ShmCreateSegment Conflicts: include/dix-config.h.in include/xorg-config.h.in
2013-11-11Xext: Enable MIT-SHM FD-passing request definitions only when possibleKeith Packard2-2/+29
Check to see if xtrans FD passing is available and use that to advertise the appropriate version of the SHM extension Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-11-04Disable DRI3 and sync fence FD functions if xshmfence isn't availableKeith Packard1-0/+8
Make sure the server can build when the xshmfence library isn't present Signed-off-by: Keith Packard <keithp@keithp.com>
2013-11-01Merge remote-tracking branch 'whot/for-keith'Keith Packard1-1/+10
2013-11-01sync: fix corner-case in triggering idle alarmsPeter Hutterer1-1/+10
ProcessInputEvent() resets the device idle times. If idle time was higher than the lower bracket, this should trigger an event in the idle time wakeup handler. If processing is slow, the idle time may advance past the lower bracket between the reset and the time the BlockHandler is called. In that case, we'd never schedule a wakeup to handle the event, causing us to randomly miss events. Ran tests with a neg transition trigger on 5ms with 200 repeats of the test and it succeeded. Anything below that gets a bit tricky to make sure the server sees the same idle time as the client usleeps for. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-31dri3: Add DRI3 extensionKeith Packard2-2/+43
Adds DRM compatible fences using futexes. Uses FD passing to get pixmaps from DRM applications. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-10-31Add support for MIT-SHM AttachFd requestKeith Packard2-3/+157
This passes a file descriptor from the client to the server, which is then mmap'd Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-10-31Xext: Move MIT-SHM 'ShmDesc' to shmint.hKeith Packard3-21/+10
This data structure is required to use shared memory objects in any extension. That includes the Xv extension, which (before this patch) duplicated the definition of this structure in its own code. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-10-18sync: split updating and triggering a counter upPeter Hutterer1-2/+11
Now that the brackets are always the nearest change points (regardless of transition) we need to update the counters whenever we check for any updates. Otherwise we end up with a situation where counter->value is out of date and an alarm doesn't trigger because we're still using the value from last time something actually triggered. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18sync: always set the brackets (#59644)Peter Hutterer1-0/+20
The current code sets bracket_greater to the first trigger after the current value, and bracket_less to the last trigger before the current value. For example, the idle timer with three negative and three positive transitions would set this: nt1 nt2 nt3 |--------|------|--|------- idle --|---|--|-----> t pt1 pt2 pt3 bracket_less == nt2 bracket_greater == pt2 This is an optimization so we can skip code paths in the block/wakeup handlers if the current value doesn't meet any of the trigger requirements. Those handlers largely do a if (bracket_less is less than current value && bracket_greater is greater than current value) return, nothing to do However, unless the bracket values are updated at the correct time, the following may happen: nt |--------------|---------- idle ------|--------> t pt In this case, neither bracket is set, we're past the pos transition and not yet at the neg transition. idle may now go past nt, but the brackets are not updated. If idle is then reset to 0, no alarm is triggered for nt. Likewise, idle may now go past pt and no alarm is triggered. Changing an alarm or triggering an alarm will re-calculate the brackets, so this bug is somewhat random. If any other client triggers an alarm when the brackets are wrongly NULL, the recalculation will set them this bug may not appear. This patch changes the behavior, so that the brackets are always the nearest positive or negative transitions to the current counter value. In the example above, nt will trigger a wakeup and a re-calculation of the brackets, so that going past it in the negative direction will then cause the proper alarm triggers. Or, in Keith's words: Timer currently past a positive trigger No bracket values, because no trigger in range Timer moves backwards before the positive trigger Brackets not reset, even though there is now a trigger in range Timer moves forward past the positive trigger Trigger doesn't fire because brackets not set Setting the LT bracket in this case will cause everything to get re-evaluated when the sync value moves backwards before the trigger value. X.Org Bug 59644 <http://bugs.freedesktop.org/show_bug.cgi?id=59644> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18sync: if the idle time was reset, force alarms to trigger (#70476)Peter Hutterer1-3/+29
The time between the idle reset and the IdleTimeWakeupHandler to be called is indeterminate. Clients with an PositiveTransition or NegativeTransition alarm on a low threshold may miss an alarm. Work around this by keeping a reset flag for each device. When the WakeupHandler triggers and the reset flag is set, we force a re-calculation of everything and pretend the current idle time is zero. Immediately after is the next calculation with the real idle time. Relatively reproducible test case: Set up a XSyncNegativeTransition alarm for a threshold of 1 ms. May trigger, may not. X.Org Bug 70476 <http://bugs.freedesktop.org/show_bug.cgi?id=70476> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18dix: provide accessor methods for the last device event timePeter Hutterer2-5/+3
And now that we have the accessors, localize it. No functional changes, just preparing for a future change. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18sync: supply the counter from IdleTimeBlockHandlerPeter Hutterer1-1/+1
The main idletime counter has an initialized deviceid, might as well be supplying it properly. Without this, we'd only ever check the XIAllDevices counter, so the wait would never be adjusted for the device-specific triggers. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18sync: always call BracketValues when recalculating upper/lower bracketsPeter Hutterer1-3/+2
Both ServertimeBracketValues and IdleTimeBracketValues copy the value into there SysCounter privates. Call it for a NULL set as well, so we don't end up with stale pointers and we can remove the block/wakeup handlers. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Keith Packard <keithp@keithp.com>