geode: Avoid reading /dev/cpu/0/msr, which does not exist.

This is another sneaky patch posted online by RVP.

XXX it should be verified whether changing _PATH_MSRDEV to /dev/cpuctl
works on NetBSD (instead of this patch), but for now this is known to
work. I don't have access to the hardware to test an alternative
solution (neither does RVP).

revert previous, fixed in the Makefile (we don't want to change 3rd party
code)

gcc 14 thinks that needed is 0x7fffffffffffffff and bails out.

pixman: fix debug build

Following a suggestion by mrg.

Provide a fallback timercmp() definition (PR misc/59543)

timercmp() isn't a standard function (macro in this case)
so isn't guaranteed to exist on some random system that
we need to be able to build this on (since it is part of
the NetBSD tools setup).

So just provide a local copy of the definition, used in
the event that nothing else has already defined it.

merge pixman 0.46.4.

initial import of pixman-0.46.4

fix compilation

merge twm 1.0.13.1.

initial import of twm-1.0.13.1

merge sessreg 1.1.4.

initial import of smproxy-1.0.8

initial import of showfont-1.0.7

initial import of sessreg-1.1.4

initial import of libXft-2.3.9

Register XFree86 DDX specific "XFree86_VT" Atom to appease xinit(1).

Make sure to initialize default XKB rules earlier for Core Keyboard.

merge xorg-server 21.1.18.

initial import of xorg-server-21.1.18

Make sure the keyboard device is actually enabled in DDXRingBell().

Also use consistent variable names for readability.

Allocate keyboard and mouse event buffers in the device private structures.

Also simplify GetEvents functions.

Allocate X68kKbdPriv dynamically to make it really private.

DEVICE_OFF and DEVICE_CLOSE operations are adjusted accordingly.
x68kGetKbdType() function is also added to get keyboard map type
specified in the config file.

Allocate X68kMousePriv dynamically to avoid static buffers.

DEVICE_OFF and DEVICE_CLOSE operations are also adjusted.

Reduce references to x68kKbdPriv and x68kMousePriv for readability.

Refactor X68k input device handling to remove SIGIO based event processing.

The keyboard and pointer input events are now processed directly
using fd event notifications registered via DIX SetNotifyFd(),
instead of the legacy SIGIO-based asynchronous I/O.

Use consistent name for DeviceIntPtr variables among keyboard and mouse.

Make sure the keyboard device is actually enabled in DDXRingBell().

Also use consistent variable names for readability.

No need to check if the device is enabled in event handler functions.

These event handlers are activated by SetNotifyFd() only after
DXX deviceProc() functions are called with DEVICE_ON from
DIX EnableDevice() function.

Remove unused variables.

Add a static function declaration in sunMouse.c.

Add and sort static function declarations in sunKbd.c.

Allocate keyboard and mouse event buffers in the device private structures.

Also simplify GetEvents functions.

Tested on Sun 3/60 with bwtwo.

Replace old FNDELAY for fcntl(2) with O_NONBLOCK defined in POSIX.

Also Refactor sunKbdPrivRec in sunKbd.c to make it private.

Now the keyboard device is opened and sunKbdPrivRec is dynamically
allocated within the DEVICE_INIT phase of sunKbdProc().
DEVICE_OFF and DEVICE_CLOSE operations are also adjusted accordingly.

Tested on Sun 3/60.

Refactor sunPtrPrivRec in sunMouse.c to make it really private.

The mouse device is now opened and sunPtrPrivRec is allocated
within the DEVICE_INIT phase of sunMouseProc(). DEVICE_OFF and
DEVICE_CLOSE operations are also adjusted accordingly.

Tested on Sun 3/60.

Reduce global references to sunPtrPriv, as sunKbd.c does.

Refactor Xsun input device handling to remove SIGIO based event processing.

The keyboard and pointer input events are now processed directly
using fd event notifications registered via DIX SetNotifyFd(),
instead of the legacy SIGIO-based asynchronous I/O.

This refactoring improves the maintainability and portability of
the code by aligning with modern Xorg server practices.

Tested on Sun 3/60 with bwtwo, Type-4 keyboard and mouse.

Initialize DDX pointer valuators consistently with other drivers/servers.

This may not be strictly necessary, since InitValuatorAxisStruct()
for all axes is also called from the DIX InitPointerDeviceStruct()
via InitValuatorClassDeviceStruct() with default values.

However, for future X.Org updates, it is beneficial to keep the
DIX-DDX interface implementation in MouseProc's DEVICE_INIT operation
consistent with the official xf86-input-mouse driver, xquartz DDX server,
and others.

Properly apply DIX locking to input events in NetBSD-specific DDX servers.

This thread-based DIX locking approach using input_lock() and
input_unlock() has been available since X.Org 1.19.0:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/30ac7567980a1eb79d084a63e0e74e1d9a3af673

All xfree86 DDX implementations have switched to using these new
DIX locks instead of the old OsBlockSIGIO() / OsReleaseSIGIO() methods:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/6a5a4e60373c1386b311b2a8bb666c32d68a9d99

The xquartz DDX (an official X.Org server implementation) also uses
these locks for input events:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/7d6ebf3f4e4d517bb846d15a5deb131da19a267c

This should resolve occasional SIGSEGVs in the Xsun server caused
by NULL pointer dereferences around the event queue handlers
under heavy load.

Should be pulled up to netbsd-10.

Xorg removed the ramdac module and related stuff, but the only part of this
driver that depends on it is support for older GLINTs, and what we're
interested in is permedia2 ( for sparc64, aka Sun PGX32 ) and permedia3.
Therefore, disable all the old GLINT support, only leave permedia 2/3 support,
and we have working X on PGX32 again.

xf86-input-keyboard: add DEC LK401 keyboard map and WSKBD_TYPE_LK401

xf86-input-keyboard: fix DEC LK201 layout

On the LK201, the F11 serves as Escape by default. The key that's
currently defined as Escape is actually grave/tilde. Also, the Delete
key above Enter is actually a Backspace.

merge xterm 397.

initial import of xterm-397

merge xf86-video-nouveau 1.0.18

initial import of xf86-video-nouveau-1.0.18

bump versions in fake configure.

merge libdrm 2.4.124.

initial import of libdrm-2.4.124

revert a portion of the previous, which ends up failing with our
MK_COOKIE definition now being a variable instead of cpp expanded
directly into the script.

startx now starts up the X server again.

XXX.

initial import of util-macros-1.20.2

merge xauth-1.1.4, xdm-1.1.17, xinit-1.4.3, and xtrans-1.6.0.

initial import of xtrans-1.6.0

initial import of xinit-1.4.3

initial import of xdm-1.1.17

initial import of xauth-1.1.4

merge oclock 1.0.6.

initial import of xkbevd-1.1.6

initial import of transset-1.0.4

initial import of oclock-1.0.6

initial import of fslsfonts-1.0.7

initial import of libxshmfence-1.3.3

initial import of libxcvt-0.1.3

initial import of libXxf86vm-1.1.6

initial import of libXv-1.0.13

initial import of libXau-1.0.12

initial import of libSM-1.2.6

initial import of libICE-1.1.2

merge libXrender 0.9.12.

initial import of libXrender-0.9.12

merge libX11 1.8.12.

initial import of libX11-1.8.12

drop the rectangle fill workaround here as well

merge xorg-server 21.1.16.

initial import of xorg-server-21.1.16

- properly clip glyphs drawn into off-screen memory
- when drawing glyphs skip pixels with zero alpha

remove unintended duplicate

this should have went in with the previous commit

Fix the build. Commented out code that is missing #defines

use the hardware to draw anti-aliased text
visible speedup
The problem is that HP didn't implement full alpha blending support on the FX4,
just what's needed to draw anti-aliased lines and edges, and no upper byte in
32bit buffers, which means we can't have anything with alpha in video memory
but we can apply alpha blending when scribbling into video memory using BINC,
therefore we do *not* want out glyph sources in VRAM...

adjust FIFO slots in SummitWaitFifo() calls

some updates:
- turn pixel processing off for GXcopy - small speedup
- remove unnecessary exaMarkSync() calls
- set prefetch hint in SummitDownloadFromScreen() - *big* speedup

add direct support for hardware cursor on Summit

some udates:
- don't use hwmode, just track read- and write mode directly
- use FIFO pacing now that we know how, only stall the engine if we need to
access video memory or change buffer access modes
- use a back buffer as off-screen memory, modify Prepare*() etc. accordingly

twm: fix sub-menu handling

Patch from RVP.

Fixes PR 58979.

this should have went in with the last summit_accel.c commit..

use ROPs now that we know how

support 24bit

make sure we log a found message for every device:
[ 2209.958] (II) NGLEPreInit: found Visualize FX 2/4/6 ( GID 2fc1066b )
[ 2209.971] (II) NGLEPreInit: found HCRX ( GID 2bcb015a )

allow more than one device section

add *very* experimental Visualize FX support

merge libX11 1.8.10

initial import of libX11-1.8.10

merge libXt 1.3.1.

initial import of libXt-1.3.1

merge xkbprint 1.0.7.

initial import of xkbprint-1.0.7

initial import of fonttosfnt-1.2.4

initial import of bdftopcf-1.1.2

merge x11perf 1.7.0, xfs 1.2.2, xrandr 1.5.3, and xtrans 1.5.2.

initial import of xtrans-1.5.2

initial import of xrandr-1.5.3

initial import of xfs-1.2.2

initial import of xcmsdb-1.0.7

initial import of x11perf-1.7.0

merge xclipboard 1.1.5, xlogo 1.0.7, xmag 1.0.8, and xprop 1.2.8.

initial import of xwud-1.0.7

initial import of xprop-1.2.8

initial import of xmag-1.0.8

initial import of xlogo-1.0.7

initial import of xclipboard-1.1.5

merge libXcursor 1.2.3, libXi 1.8.2, libFS 1.0.10, libXfont2 2.0.7, and
libXtst 1.2.5.

initial import of libXtst-1.2.5

initial import of libXi-1.8.2

initial import of libXfont2-2.0.7

initial import of libXcursor-1.2.3

initial import of libFS-1.0.10

port xorg-server change 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8

there are two chunks in this change, and while they apply fine to the old
xorg-server 1.10 tree (unlike _most_), they do not build due to using new
identifiers.

the first chunk uses a new MASTER_ATTACHED argument to GetMaster(), which
avoids finding paired devices. the only answer it can give with the setup
of already testing !IsMaster(other) is "other->u.master", so just use that
directly instead if calling GetMaster().

the second chunk uses a new single-line IsFloating() function, and if you
expand it's use here to the full expression, it ends up just being:

if (!IsMaster(dev) && dev->u.master)

(which just happens to match the same line a few above, for the loop of
not-off "devices".)


testing this code path is a little tricky.


Subject: [PATCH] dix: when disabling a master, float disabled slaved devices
too

Disabling a master device floats all slave devices but we didn't do this
to already-disabled slave devices. As a result those devices kept their
reference to the master device resulting in access to already freed
memory if the master device was removed before the corresponding slave
device.

And to match this behavior, also forcibly reset that pointer during
CloseDownDevices().

Related to CVE-2024-21886, ZDI-CAN-22840

apply upstream change 3e77295f888c67fc7645db5d0c00926a29ffecee

Subject: [PATCH] Xi: ProcXIPassiveGrabDevice needs to use unswapped length to
send reply

CVE-2024-31081

apply upstream change 96798fc1967491c80a4d0c8d9e0a80586cb2152b


Subject: [PATCH] Xi: ProcXIGetSelectedEvents needs to use unswapped length to
send reply

CVE-2024-31080

merge upstream change bc1fdbe46559dd947674375946bbef54dd0ce36b


Subject: [PATCH] Xi: do not keep linked list pointer during recursion

The `DisableDevice()` function is called whenever an enabled device
is disabled and it moves the device from the `inputInfo.devices` linked
list to the `inputInfo.off_devices` linked list.

However, its link/unlink operation has an issue during the recursive
call to `DisableDevice()` due to the `prev` pointer pointing to a
removed device.

This issue leads to a length mismatch between the total number of
devices and the number of device in the list, leading to a heap
overflow and, possibly, to local privilege escalation.

Simplify the code that checked whether the device passed to
`DisableDevice()` was in `inputInfo.devices` or not and find the
previous device after the recursion.

CVE-2024-21886, ZDI-CAN-22840

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1


Subject: [PATCH] Xi: flush hierarchy events after adding/removing master
devices

The `XISendDeviceHierarchyEvent()` function allocates space to store up
to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`.

If a device with a given ID was removed and a new device with the same
ID added both in the same operation, the single device ID will lead to
two info structures being written to `info`.

Since this case can occur for every device ID at once, a total of two
times `MAXDEVICES` info structures might be written to the allocation.

To avoid it, once one add/remove master is processed, send out the
device hierarchy event for the current state and continue. That event
thus only ever has exactly one of either added/removed in it (and
optionally slave attached/detached).

CVE-2024-21885, ZDI-CAN-22744

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change e5e8586a12a3ec915673edffa10dc8fe5e15dac3


Subject: [PATCH] glx: Call XACE hooks on the GLX buffer

The XSELINUX code will label resources at creation by checking the
access mode. When the access mode is DixCreateAccess, it will call the
function to label the new resource SELinuxLabelResource().

However, GLX buffers do not go through the XACE hooks when created,
hence leaving the resource actually unlabeled.

When, later, the client tries to create another resource using that
drawable (like a GC for example), the XSELINUX code would try to use
the security ID of that object which has never been labeled, get a NULL
pointer and crash when checking whether the requested permissions are
granted for subject security ID.

To avoid the issue, make sure to call the XACE hooks when creating the
GLX buffers.

Credit goes to Donn Seeley <donn@xmission.com> for providing the patch.

CVE-2024-0408

merge upstream change ece23be888a93b741aa1209d1dbf64636109d6a5 but into
Xi/exevents.c instead of dix/enterleave.c.


Subject: [PATCH] dix: Allocate sufficient xEvents for our DeviceStateNotify

If a device has both a button class and a key class and numButtons is
zero, we can get an OOB write due to event under-allocation.

This function seems to assume a device has either keys or buttons, not
both. It has two virtually identical code paths, both of which assume
they're applying to the first event in the sequence.

A device with both a key and button class triggered a logic bug - only
one xEvent was allocated but the deviceStateNotify pointer was pushed on
once per type. So effectively this logic code:

int count = 1;
if (button && nbuttons > 32) count++;
if (key && nbuttons > 0) count++;
if (key && nkeys > 32) count++; // this is basically always true
// count is at 2 for our keys + zero button device

ev = alloc(count * sizeof(xEvent));
FixDeviceStateNotify(ev);
if (button)
FixDeviceStateNotify(ev++);
if (key)
FixDeviceStateNotify(ev++); // santa drops into the wrong chimney here

If the device has more than 3 valuators, the OOB is pushed back - we're
off by one so it will happen when the last deviceValuator event is
written instead.

Fix this by allocating the maximum number of events we may allocate.
Note that the current behavior is not protocol-correct anyway, this
patch fixes only the allocation issue.

Note that this issue does not trigger if the device has at least one
button. While the server does not prevent a button class with zero
buttons, it is very unlikely.

CVE-2024-0229, ZDI-CAN-22678

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 though the
enterleave.c portion msut be applied to Xi/exevents.c:DeviceFocusEvent().


Subject: [PATCH] dix: allocate enough space for logical button maps

Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
each logical button currently down. Since buttons can be arbitrarily mapped
to anything up to 255 make sure we have enough bits for the maximum mapping.

CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change 14f480010a93ff962fef66a16412fafff81ad632:

Subject: [PATCH] randr: avoid integer truncation in length check of
ProcRRChange*Property

Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty.
See also xserver@8f454b79 where this same bug was fixed for the core
protocol and XI.

This fixes an OOB read and the resulting information disclosure.

Length calculation for the request was clipped to a 32-bit integer. With
the correct stuff->nUnits value the expected request size was
truncated, passing the REQUEST_FIXED_SIZE check.

The server then proceeded with reading at least stuff->num_items bytes
(depending on stuff->format) from the request and stuffing whatever it
finds into the property. In the process it would also allocate at least
stuff->nUnits bytes, i.e. 4GB.

CVE-2023-6478, ZDI-CAN-22561

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change 8f454b793e1f13c99872c15f0eed1d7f3b823fe8:

Subject: [PATCH] Xi: avoid integer truncation in length check of
ProcXIChangeProperty

This fixes an OOB read and the resulting information disclosure.

Length calculation for the request was clipped to a 32-bit integer. With
the correct stuff->num_items value the expected request size was
truncated, passing the REQUEST_FIXED_SIZE check.

The server then proceeded with reading at least stuff->num_items bytes
(depending on stuff->format) from the request and stuffing whatever it
finds into the property. In the process it would also allocate at least
stuff->num_items bytes, i.e. 4GB.

The same bug exists in ProcChangeProperty and ProcXChangeDeviceProperty,
so let's fix that too.

CVE-2022-46344, ZDI-CAN 19405

merge xorg-server 21.1.14.

initial import of xorg-server-21.1.14

due to the strange way colour maps and cursor bitmaps are accessed on at least
some cards, make sure we do not skip the PrepareAccess() dance after those.

Set S bit in IBOvals in NGLEPrepareCopy_EG() - without it we get garbage on the
right border. Don't seem to need it on HCRX.
While there, don't blindly assume 8bit colour when accessing off-screen memory.
Shouldn't make a difference now but we may eventually support 24bit devices that
have off-screen memory ( or figure out how to access it on HCRX )

set the right visual type for 8bit colour

comment cleanup, magic number reduction

add HCRX support

some cleanup:
- consistetly use buffer 0 - makes no difference when double buffering is
disabled ( which it should be ) but may bite us if it isn't
- add some comments on why we do what we do

sort-of-fix Mesa on most 32-bit platforms.

the new sparse_array implementation in Mesa 21 (not present in Mesa 19,
as shipped with netbsd-10) triggers it asking for an __atomic_load_8()
function, alongside it's __atomic_fetch_add_8/__atomic_fetch_sub_8/
__sync_val_compare_and_swap_8 versions on 32-bit platforms, so add a
__atomic_load_8() workaround that uses the same method as the others
to provide sync. (i did check, and almost the accesses in mesa that
this accessor is used with do go via the API, the only ones not used
are as part setup/clean up.

tested by rin@ on macppc.

add acceleration, Visualize EG only for now

very humble beginnings of a native driver for HP's NGLE family of graphics
devices

initial import of font-xfree86-type1-1.0.5

initial import of font-winitzki-cyrillic-1.0.4

initial import of font-sun-misc-1.0.4

initial import of font-screen-cyrillic-1.0.5

initial import of font-schumacher-misc-1.1.3

initial import of font-misc-cyrillic-1.0.4

initial import of font-micro-misc-1.0.4

initial import of font-cronyx-cyrillic-1.0.4

initial import of font-arabic-misc-1.0.4

we need NVDMA*() even when building without XAA support

don't run on netbsd if booted from UEFI. it doesn't work, and genfb should.

XXX: pullup-10, maybe pullup-9

apply some ugly (char *) cast when calling vgaHWSetMmioFuncs().

merge xorg-server 21.1.13.

initial import of xorg-server-21.1.13

re-turn off NLS and a couple of other things here (also used by tools build.)

add new generated files.

merge fontconfig 2.15.0.

initial import of fontconfig-2.15.0

merge libdrm 2.4.122

initial import of libdrm-2.4.122

merge xterm 392.

initial import of xterm-392

merge xauth 1.1.3, and xdm 1.1.16.

initial import of xdm-1.1.16

initial import of xauth-1.1.3

initial import of encodings-1.1.0

re-merge properly

pkgconfig hack.

merge fonttosfnt 1.2.3, and libpciaccess 0.18.1.

initial import of libpciaccess-0.18.1

initial import of fonttosfnt-1.2.3

avoid a redefinition error.

merge imake 1.0.10, mkfontscale 1.2.3, and xkbcomp 1.4.7.

initial import of xkbutils-1.0.6

initial import of xkbcomp-1.4.7

initial import of mkfontscale-1.2.3

initial import of imake-1.0.10

initial import of font-util-1.4.1