You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

163 lines
4.2 KiB

#ifndef BACKEND_DRM_DRM_H
#define BACKEND_DRM_DRM_H
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <time.h>
#include <wayland-server-core.h>
#include <wayland-util.h>
#include <wlr/backend/drm.h>
#include <wlr/backend/session.h>
#include <wlr/render/drm_format_set.h>
#include <xf86drmMode.h>
#include "backend/drm/iface.h"
#include "backend/drm/properties.h"
#include "backend/drm/renderer.h"
struct wlr_drm_plane {
uint32_t type;
uint32_t id;
/* Only initialized on multi-GPU setups */
7 years ago
struct wlr_drm_surface mgpu_surf;
/* Buffer submitted to the kernel, will be presented on next vblank */
struct wlr_drm_fb *queued_fb;
/* Buffer currently displayed on screen */
struct wlr_drm_fb *current_fb;
struct wlr_drm_format_set formats;
union wlr_drm_plane_props props;
};
struct wlr_drm_crtc {
uint32_t id;
struct wlr_drm_lease *lease;
// Atomic modesetting only
uint32_t mode_id;
uint32_t gamma_lut;
// Legacy only
int legacy_gamma_size;
struct wlr_drm_plane *primary;
struct wlr_drm_plane *cursor;
union wlr_drm_crtc_props props;
};
struct wlr_drm_backend {
struct wlr_backend backend;
7 years ago
struct wlr_drm_backend *parent;
const struct wlr_drm_interface *iface;
clockid_t clock;
bool addfb2_modifiers;
int fd;
char *name;
struct wlr_device *dev;
size_t num_crtcs;
struct wlr_drm_crtc *crtcs;
struct wl_display *display;
struct wl_event_source *drm_event;
struct wl_listener display_destroy;
backend/drm, backend/libinput: listen to session destroy This fixes a heap-use-after-free when the session is destroyed before the backend during wl_display_destroy: ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80 READ of size 8 at 0x614000000180 thread T0 #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192 #1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204 #2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24 #3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274) #4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d) #5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac) #6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d) #7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130 #8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50 #9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54 #10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107 #11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde) #12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466) #13 0x559fefb52385 in main ../main.c:67 #14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152) #15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d) 0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0) freed by thread T0 here: #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122 #1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270 #2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156 #3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65 #4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde) previously allocated by thread T0 here: #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153 #1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746 #2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91 #3 0x559fefb51ea6 in main ../main.c:20 #4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
5 years ago
struct wl_listener session_destroy;
struct wl_listener session_active;
struct wl_listener parent_destroy;
struct wl_listener dev_change;
struct wl_listener dev_remove;
struct wl_list fbs; // wlr_drm_fb.link
struct wl_list connectors; // wlr_drm_connector.link
/* Only initialized on multi-GPU setups */
struct wlr_drm_renderer mgpu_renderer;
struct wlr_session *session;
uint64_t cursor_width, cursor_height;
struct wlr_drm_format_set mgpu_formats;
};
struct wlr_drm_mode {
struct wlr_output_mode wlr_mode;
drmModeModeInfo drm_mode;
};
struct wlr_drm_connector_state {
const struct wlr_output_state *base;
bool modeset;
bool active;
drmModeModeInfo mode;
struct wlr_drm_fb *primary_fb;
};
struct wlr_drm_connector {
struct wlr_output output; // only valid if status != DISCONNECTED
struct wlr_drm_backend *backend;
char name[24];
drmModeConnection status;
uint32_t id;
uint64_t max_bpc_bounds[2];
struct wlr_drm_lease *lease;
struct wlr_drm_crtc *crtc;
uint32_t possible_crtcs;
union wlr_drm_connector_props props;
8 years ago
bool cursor_enabled;
int cursor_x, cursor_y;
int cursor_width, cursor_height;
int cursor_hotspot_x, cursor_hotspot_y;
/* Buffer to be submitted to the kernel on the next page-flip */
struct wlr_drm_fb *cursor_pending_fb;
struct wl_list link; // wlr_drm_backend.connectors
/* CRTC ID if a page-flip is pending, zero otherwise.
*
5 years ago
* We've asked for a state change in the kernel, and yet to receive a
* notification for its completion. Currently, the kernel only has a
* queue length of 1, and no way to modify your submissions after
* they're sent.
*/
uint32_t pending_page_flip_crtc;
};
struct wlr_drm_backend *get_drm_backend_from_backend(
struct wlr_backend *wlr_backend);
bool check_drm_features(struct wlr_drm_backend *drm);
bool init_drm_resources(struct wlr_drm_backend *drm);
void finish_drm_resources(struct wlr_drm_backend *drm);
void scan_drm_connectors(struct wlr_drm_backend *state,
struct wlr_device_hotplug_event *event);
void scan_drm_leases(struct wlr_drm_backend *drm);
int handle_drm_event(int fd, uint32_t mask, void *data);
void destroy_drm_connector(struct wlr_drm_connector *conn);
bool drm_connector_commit_state(struct wlr_drm_connector *conn,
const struct wlr_output_state *state);
bool drm_connector_is_cursor_visible(struct wlr_drm_connector *conn);
bool drm_connector_supports_vrr(struct wlr_drm_connector *conn);
size_t drm_crtc_get_gamma_lut_size(struct wlr_drm_backend *drm,
struct wlr_drm_crtc *crtc);
void drm_lease_destroy(struct wlr_drm_lease *lease);
struct wlr_drm_fb *get_next_cursor_fb(struct wlr_drm_connector *conn);
#define wlr_drm_conn_log(conn, verb, fmt, ...) \
wlr_log(verb, "connector %s: " fmt, conn->name, ##__VA_ARGS__)
#define wlr_drm_conn_log_errno(conn, verb, fmt, ...) \
wlr_log_errno(verb, "connector %s: " fmt, conn->name, ##__VA_ARGS__)
#endif