Revision control
++ // Copyright (C) 2018 The Qt Company Ltd.
++ // SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only
++ // Qt-Security score:critical reason:network-protocol
++
++ #include "linuxdmabuf.h"
++ #include "linuxdmabufclientbufferintegration.h"
++
++ #include <QtCore/QStandardPaths>
++
++ #include <QtWaylandCompositor/QWaylandCompositor>
++ #include <QtWaylandCompositor/private/qwltextureorphanage_p.h>
++
++ #include <drm_fourcc.h>
++ #include <drm_mode.h>
++ #include <unistd.h>
++ #include <sys/stat.h>
++
++ #include <fcntl.h>
++ #include <sys/mman.h>
++
++ #ifdef Q_OS_LINUX
++ # include <sys/syscall.h>
++ // from linux/memfd.h:
++ # ifndef MFD_CLOEXEC
++ # define MFD_CLOEXEC 0x0001U
++ # endif
++ # ifndef MFD_ALLOW_SEALING
++ # define MFD_ALLOW_SEALING 0x0002U
++ # endif
++ // from bits/fcntl-linux.h
++ # ifndef F_ADD_SEALS
++ # define F_ADD_SEALS 1033
++ # endif
++ # ifndef F_SEAL_SEAL
++ # define F_SEAL_SEAL 0x0001
++ # endif
++ # ifndef F_SEAL_SHRINK
++ # define F_SEAL_SHRINK 0x0002
++ # endif
++ #endif
++
++ QT_BEGIN_NAMESPACE
++
++ LinuxDmabuf::LinuxDmabuf(int version,
++ wl_display *display,
++ LinuxDmabufClientBufferIntegration *clientBufferIntegration)
++ : zwp_linux_dmabuf_v1(display, version)
++ , m_clientBufferIntegration(clientBufferIntegration)
++ {
++ }
++
++ void LinuxDmabuf::setDrmDevice(const char *drmDevice)
++ {
++ m_drmDevice = drmDevice;
++ }
++
++ void LinuxDmabuf::setSupportedModifiers(const QHash<uint32_t, QList<uint64_t>> &modifiers)
++ {
++ Q_ASSERT(resourceMap().isEmpty());
++ m_modifiers = modifiers;
++ }
++
++ void LinuxDmabuf::zwp_linux_dmabuf_v1_bind_resource(Resource *resource)
++ {
++ if (resource->version() >= ZWP_LINUX_DMABUF_V1_GET_SURFACE_FEEDBACK_SINCE_VERSION)
++ return;
++
++ for (auto it = m_modifiers.constBegin(); it != m_modifiers.constEnd(); ++it) {
++ auto format = it.key();
++ auto modifiers = it.value();
++ // send DRM_FORMAT_MOD_INVALID when no modifiers are supported for a format
++ if (modifiers.isEmpty())
++ modifiers << DRM_FORMAT_MOD_INVALID;
++ for (const auto &modifier : std::as_const(modifiers)) {
++ if (resource->version() >= ZWP_LINUX_DMABUF_V1_MODIFIER_SINCE_VERSION) {
++ const uint32_t modifier_lo = modifier & 0xFFFFFFFF;
++ const uint32_t modifier_hi = modifier >> 32;
++ send_modifier(resource->handle, format, modifier_hi, modifier_lo);
++ } else if (modifier == DRM_FORMAT_MOD_LINEAR || modifier == DRM_FORMAT_MOD_INVALID) {
++ send_format(resource->handle, format);
++ }
++ }
++ }
++ }
++
++ void LinuxDmabuf::zwp_linux_dmabuf_v1_create_params(Resource *resource, uint32_t params_id)
++ {
++ wl_resource *r = wl_resource_create(resource->client(), &zwp_linux_buffer_params_v1_interface,
++ wl_resource_get_version(resource->handle), params_id);
++ new LinuxDmabufParams(m_clientBufferIntegration, r); // deleted by the client, or when it disconnects
++ }
++
++ void LinuxDmabuf::zwp_linux_dmabuf_v1_get_default_feedback(Resource *resource, uint32_t id)
++ {
++ if (resource->version() < ZWP_LINUX_DMABUF_V1_GET_DEFAULT_FEEDBACK_SINCE_VERSION)
++ return;
++
++ wl_resource *r = wl_resource_create(resource->client(),
++ &zwp_linux_dmabuf_feedback_v1_interface,
++ wl_resource_get_version(resource->handle),
++ id);
++ // Deleted by client
++ new LinuxDmabufFeedback(m_modifiers, m_drmDevice, r);
++ }
++
++ void LinuxDmabuf::zwp_linux_dmabuf_v1_get_surface_feedback(Resource *resource, uint32_t id, struct ::wl_resource *surface)
++ {
++ if (resource->version() < ZWP_LINUX_DMABUF_V1_GET_SURFACE_FEEDBACK_SINCE_VERSION)
++ return;
++
++ Q_UNUSED(surface);
++ wl_resource *r = wl_resource_create(resource->client(),
++ &zwp_linux_dmabuf_feedback_v1_interface,
++ wl_resource_get_version(resource->handle),
++ id);
++ // Deleted by client
++ new LinuxDmabufFeedback(m_modifiers, m_drmDevice, r);
++ }
++
++ LinuxDmabufFeedback::LinuxDmabufFeedback(QHash<uint32_t, QList<uint64_t>> modifiers,
++ const char *drmDevice, wl_resource *res)
++ : zwp_linux_dmabuf_feedback_v1(res)
++ , m_modifiers(modifiers)
++ , m_drmDevice(drmDevice)
++ {
++ sendFeedback(resource());
++ }
++
++ LinuxDmabufFeedback::~LinuxDmabufFeedback()
++ {
++ if (m_data)
++ munmap(m_data, m_size);
++ }
++
++ void LinuxDmabufFeedback::zwp_linux_dmabuf_feedback_v1_destroy(Resource *resource)
++ {
++ wl_resource_destroy(resource->handle);
++ }
++
++ void LinuxDmabufFeedback::zwp_linux_dmabuf_feedback_v1_destroy_resource(Resource *resource)
++ {
++ Q_UNUSED(resource);
++ delete this;
++ }
++
++ void LinuxDmabufFeedback::zwp_linux_dmabuf_feedback_v1_bind_resource(Resource *resource)
++ {
++ sendFeedback(resource);
++ }
++
++ QByteArray LinuxDmabufFeedback::sendFormatTable(Resource *)
++ {
++ QList<std::pair<uint32_t, uint64_t> > formatModifierPairs;
++ for (auto it = m_modifiers.constBegin(); it != m_modifiers.constEnd(); ++it) {
++ uint32_t format = it.key();
++ QList<uint64_t> modifiers = it.value();
++
++ if (!modifiers.isEmpty()) {
++ for (uint64_t modifier : modifiers)
++ formatModifierPairs.append(std::make_pair(format, modifier));
++ } else {
++ formatModifierPairs.append(std::make_pair(format, DRM_FORMAT_MOD_INVALID));
++ }
++ }
++
++ if (formatModifierPairs.isEmpty()) {
++ qCWarning(qLcWaylandCompositorHardwareIntegration) << "LinuxDmabufFeedback: No formats";
++ return QByteArray{};
++ }
++
++ int fd = -1;
++ #ifdef SYS_memfd_create
++ fd = syscall(SYS_memfd_create, "wayland-dmabuf", MFD_CLOEXEC | MFD_ALLOW_SEALING);
++ if (fd >= 0)
++ fcntl(fd, F_ADD_SEALS, F_SEAL_SHRINK | F_SEAL_SEAL);
++ #endif
++
++ std::unique_ptr<QFile> filePointer;
++ if (fd == -1) {
++ auto tmpFile =
++ std::make_unique<QTemporaryFile>(QStandardPaths::writableLocation(QStandardPaths::RuntimeLocation) +
++ QLatin1String("/wayland-dmabuf-XXXXXX"));
++ if (tmpFile->open())
++ filePointer = std::move(tmpFile);
++ } else {
++ auto file = std::make_unique<QFile>();
++ if (file->open(fd, QIODevice::ReadWrite | QIODevice::Unbuffered, QFile::AutoCloseHandle))
++ filePointer = std::move(file);
++ }
++
++ m_size = formatModifierPairs.size() * 16;
++ if (!filePointer || !filePointer->resize(m_size)) {
++ qCWarning(qLcWaylandCompositorHardwareIntegration)
++ << "LinuxDmabufFeedback: failed: " << filePointer->errorString();
++ return QByteArray{};
++ }
++
++ fd = filePointer->handle();
++
++ if (m_data)
++ munmap(m_data, m_size);
++ m_data = (uchar *) mmap(nullptr, m_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
++
++ QByteArray indicesArray;
++ indicesArray.resize(formatModifierPairs.size() * 2); // Each index is 2 bytes
++ char *iptr = indicesArray.data();
++
++ // Copy data into array with native endianness
++ for (quint16 i = 0; i < quint16(formatModifierPairs.size()); ++i) {
++ memcpy(iptr, &i, 2);
++ iptr += 2;
++
++ const auto &formatModifierPair = formatModifierPairs.at(i);
++ uint32_t format = formatModifierPair.first;
++ uint64_t modifiers = formatModifierPair.second;
++ memcpy(m_data, &format, 4);
++ m_data += 4;
++
++ m_data += 4; // Padding
++
++ memcpy(m_data, &modifiers, 8);
++ m_data += 8;
++ }
++
++ send_format_table(fd, m_size);
++
++ // Returns indices for convenience
++ return indicesArray;
++ }
++
++ void LinuxDmabufFeedback::sendFeedback(Resource *resource)
++ {
++ if (!m_drmDevice)
++ return;
++
++ QByteArray indices = sendFormatTable(resource);
++
++ // Query main device by getting the device number of the drm device,
++ // granted its still there.
++ struct stat drmDeviceStat;
++ if (stat(m_drmDevice, &drmDeviceStat)) {
++ qCWarning(qLcWaylandCompositorHardwareIntegration)
++ << "Failed to access DRM device in linux-dmabuf-feedback";
++ return;
++ }
++
++ dev_t mainDevice = drmDeviceStat.st_rdev;
++ QByteArray mainDeviceArray;
++ mainDeviceArray.setRawData(reinterpret_cast<const char *>(&mainDevice), sizeof(dev_t));
++ send_main_device(mainDeviceArray);
++
++ // At least one tranche required, we just send one with all formats
++ send_tranche_target_device(mainDeviceArray);
++ send_tranche_flags(0);
++ send_tranche_formats(indices);
++ send_tranche_done();
++
++ send_done();
++ }
++
++ LinuxDmabufParams::LinuxDmabufParams(LinuxDmabufClientBufferIntegration *clientBufferIntegration, wl_resource *resource)
++ : zwp_linux_buffer_params_v1(resource)
++ , m_clientBufferIntegration(clientBufferIntegration)
++ {
++ }
++
++ LinuxDmabufParams::~LinuxDmabufParams()
++ {
++ for (auto it = m_planes.begin(); it != m_planes.end(); ++it) {
++ if (it.value().fd != -1)
++ close(it.value().fd);
++ it.value().fd = -1;
++ }
++ }
++
++ bool LinuxDmabufParams::handleCreateParams(Resource *resource, int width, int height, uint format, uint flags)
++ {
++ if (m_used) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_ALREADY_USED,
++ "Params already used");
++ return false;
++ }
++
++ if (width <= 0 || height <= 0) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_INVALID_DIMENSIONS,
++ "Invalid dimensions in create request");
++ return false;
++ }
++
++ if (m_planes.isEmpty()) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_INCOMPLETE,
++ "Cannot create a buffer with no planes");
++ return false;
++ }
++
++ // check for holes in plane sequence
++ auto planeIds = m_planes.keys();
++ std::sort(planeIds.begin(), planeIds.end());
++ for (int i = 0; i < planeIds.size(); ++i) {
++ if (uint(i) != planeIds[i]) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_INCOMPLETE,
++ "No dmabuf parameters provided for plane %i", i);
++ return false;
++ }
++ }
++
++ // check for overflows
++ for (auto it = m_planes.constBegin(); it != m_planes.constEnd(); ++it) {
++ const auto planeId = it.key();
++ const auto plane = it.value();
++ if (static_cast<int64_t>(plane.offset) + plane.stride > UINT32_MAX) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS,
++ "Size overflow for plane %i",
++ planeId);
++ return false;
++ }
++ if (planeId == 0 && static_cast<int64_t>(plane.offset) + plane.stride * static_cast<int64_t>(height) > UINT32_MAX) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS,
++ "Size overflow for plane %i",
++ planeId);
++ return false;
++ }
++
++ // do not report an error as it might be caused by the kernel not supporting seeking on dmabuf
++ off_t size = lseek(plane.fd, 0, SEEK_END);
++ if (size == -1) {
++ qCDebug(qLcWaylandCompositorHardwareIntegration) << "Seeking is not supported";
++ continue;
++ }
++
++ if (static_cast<int64_t>(plane.offset) >= size) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS,
++ "Invalid offset %i for plane %i",
++ plane.offset, planeId);
++ return false;
++ }
++
++ if (static_cast<int64_t>(plane.offset) + static_cast<int64_t>(plane.stride) > size) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS,
++ "Invalid stride %i for plane %i",
++ plane.stride, planeId);
++ return false;
++ }
++
++ // only valid for first plane as other planes might be sub-sampled
++ if (planeId == 0 && plane.offset + static_cast<int64_t>(plane.stride) * height > size) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS,
++ "Invalid buffer stride or height for plane %i", planeId);
++ return false;
++ }
++ }
++
++ m_size = QSize(width, height);
++ m_drmFormat = format;
++ m_flags = flags;
++ m_used = true;
++
++ return true;
++ }
++
++ void LinuxDmabufParams::zwp_linux_buffer_params_v1_destroy(Resource *resource)
++ {
++ wl_resource_destroy(resource->handle);
++ }
++
++ void LinuxDmabufParams::zwp_linux_buffer_params_v1_destroy_resource(Resource *resource)
++ {
++ Q_UNUSED(resource);
++ delete this;
++ }
++
++ void LinuxDmabufParams::zwp_linux_buffer_params_v1_add(Resource *resource, int32_t fd, uint32_t plane_idx, uint32_t offset, uint32_t stride, uint32_t modifier_hi, uint32_t modifier_lo)
++ {
++ const uint64_t modifiers = (static_cast<uint64_t>(modifier_hi) << 32) | modifier_lo;
++ if (plane_idx >= LinuxDmabufWlBuffer::MaxDmabufPlanes) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_PLANE_IDX,
++ "Plane index %i is out of bounds", plane_idx);
++ return;
++ }
++
++ if (m_planes.contains(plane_idx)) {
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_PLANE_SET,
++ "Plane already set");
++ return;
++ }
++
++ Plane plane;
++ plane.fd = fd;
++ plane.modifiers = modifiers;
++ plane.offset = offset;
++ plane.stride = stride;
++ m_planes.insert(plane_idx, plane);
++ }
++
++ void LinuxDmabufParams::zwp_linux_buffer_params_v1_create(Resource *resource, int32_t width, int32_t height, uint32_t format, uint32_t flags)
++ {
++ if (!handleCreateParams(resource, width, height, format, flags))
++ return;
++
++ auto *buffer = new LinuxDmabufWlBuffer(resource->client(), m_clientBufferIntegration);
++ buffer->m_size = m_size;
++ buffer->m_flags = m_flags;
++ buffer->m_drmFormat = m_drmFormat;
++ buffer->m_planesNumber = m_planes.size(); // it is checked before that planes are in consecutive sequence
++ for (auto it = m_planes.begin(); it != m_planes.end(); ++it) {
++ buffer->m_planes[it.key()] = it.value();
++ it.value().fd = -1; // ownership is moved
++ }
++
++ if (!m_clientBufferIntegration->importBuffer(buffer->resource()->handle, buffer)) {
++ send_failed(resource->handle);
++ } else {
++ send_created(resource->handle, buffer->resource()->handle);
++ }
++ }
++
++ void LinuxDmabufParams::zwp_linux_buffer_params_v1_create_immed(Resource *resource, uint32_t buffer_id, int32_t width, int32_t height, uint32_t format, uint32_t flags)
++ {
++ if (!handleCreateParams(resource, width, height, format, flags))
++ return;
++
++ auto *buffer = new LinuxDmabufWlBuffer(resource->client(), m_clientBufferIntegration, buffer_id);
++ buffer->m_size = m_size;
++ buffer->m_flags = m_flags;
++ buffer->m_drmFormat = m_drmFormat;
++ buffer->m_planesNumber = m_planes.size(); // it is checked before that planes are in consecutive sequence
++ for (auto it = m_planes.begin(); it != m_planes.end(); ++it) {
++ buffer->m_planes[it.key()] = it.value();
++ it.value().fd = -1; // ownership is moved
++ }
++
++ if (!m_clientBufferIntegration->importBuffer(buffer->resource()->handle, buffer)) {
++ // for the 'create_immed' request, the implementation can decide
++ // how to handle the failure by an unknown cause; we decide
++ // to raise a fatal error at the client
++ wl_resource_post_error(resource->handle,
++ ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_INVALID_WL_BUFFER,
++ "Import of the provided DMA buffer failed");
++ }
++ // note: create signal shall not be sent for the 'create_immed' request
++ }
++
++ LinuxDmabufWlBuffer::LinuxDmabufWlBuffer(::wl_client *client, LinuxDmabufClientBufferIntegration *clientBufferIntegration, uint id)
++ : wl_buffer(client, id, 1 /*version*/)
++ , m_clientBufferIntegration(clientBufferIntegration)
++ {
++ }
++
++ LinuxDmabufWlBuffer::~LinuxDmabufWlBuffer()
++ {
++ if (resource())
++ m_clientBufferIntegration->removeBuffer(resource()->handle);
++ deleteTextures();
++ }
++
++ void LinuxDmabufWlBuffer::buffer_destroy(Resource *resource)
++ {
++ m_clientBufferIntegration->removeBuffer(resource->handle);
++ wl_resource_destroy(resource->handle);
++ }
++
++ void LinuxDmabufWlBuffer::deleteTextures()
++ {
++ QMutexLocker locker(&m_texturesLock);
++
++ for (uint32_t i = 0; i < m_planesNumber; ++i) {
++ if (m_textures[i] != nullptr) {
++ QtWayland::QWaylandTextureOrphanage::instance()->admitTexture(m_textures[i],
++ m_texturesContext[i]);
++ m_textures[i] = nullptr;
++ m_texturesContext[i] = nullptr;
++ QObject::disconnect(m_texturesAboutToBeDestroyedConnection[i]);
++ m_texturesAboutToBeDestroyedConnection[i] = QMetaObject::Connection();
++ }
++ if (m_eglImages[i] != EGL_NO_IMAGE_KHR) {
++ m_clientBufferIntegration->deleteImage(m_eglImages[i]);
++ m_eglImages[i] = EGL_NO_IMAGE_KHR;
++ }
++ if (m_planes[i].fd != -1)
++ close(m_planes[i].fd);
++ m_planes[i].fd = -1;
++ }
++ m_planesNumber = 0;
++ }
++
++ void LinuxDmabufWlBuffer::initImage(uint32_t plane, EGLImageKHR image)
++ {
++ Q_ASSERT(plane < m_planesNumber);
++ Q_ASSERT(m_eglImages.at(plane) == EGL_NO_IMAGE_KHR);
++ m_eglImages[plane] = image;
++ }
++
++ void LinuxDmabufWlBuffer::initTexture(uint32_t plane, QOpenGLTexture *texture)
++ {
++ QMutexLocker locker(&m_texturesLock);
++
++ Q_ASSERT(plane < m_planesNumber);
++ Q_ASSERT(m_textures.at(plane) == nullptr);
++ Q_ASSERT(QOpenGLContext::currentContext());
++ m_textures[plane] = texture;
++ m_texturesContext[plane] = QOpenGLContext::currentContext();
++
++ m_texturesAboutToBeDestroyedConnection[plane] =
++ QObject::connect(m_texturesContext[plane], &QOpenGLContext::aboutToBeDestroyed,
++ m_texturesContext[plane], [this, plane]() {
++
++ QMutexLocker locker(&this->m_texturesLock);
++
++ // See above lock - there is a chance that this has already been removed from m_textures[plane]!
++ // Furthermore, we can trust that all the rest (e.g. disconnect) has also been properly executed!
++ if (this->m_textures[plane] == nullptr)
++ return;
++
++ delete this->m_textures[plane];
++
++ qCDebug(qLcWaylandCompositorHardwareIntegration)
++ << Q_FUNC_INFO
++ << "texture deleted due to QOpenGLContext::aboutToBeDestroyed!"
++ << "Pointer (now dead) was:" << (void*)(this->m_textures[plane])
++ << " Associated context (about to die too) is: " << (void*)(this->m_texturesContext[plane]);
++
++ this->m_textures[plane] = nullptr;
++ this->m_texturesContext[plane] = nullptr;
++
++ QObject::disconnect(this->m_texturesAboutToBeDestroyedConnection[plane]);
++ this->m_texturesAboutToBeDestroyedConnection[plane] = QMetaObject::Connection();
++
++ }, Qt::DirectConnection);
++ }
++
++ void LinuxDmabufWlBuffer::buffer_destroy_resource(Resource *resource)
++ {
++ // In most cases this is redundant, but for instance if a buffer has been created,
++ // but not committed and the client disconnects, it is vital
++ m_clientBufferIntegration->removeBuffer(resource->handle);
++ }
++
++ QT_END_NAMESPACE