connection.c 28.4 KB
Newer Older
1 2
/*
 * Copyright © 2008 Kristian Høgsberg
3
 * Copyright © 2013 Jason Ekstrand
4
 *
5 6 7 8 9 10 11
 * Permission is hereby granted, free of charge, to any person obtaining
 * a copy of this software and associated documentation files (the
 * "Software"), to deal in the Software without restriction, including
 * without limitation the rights to use, copy, modify, merge, publish,
 * distribute, sublicense, and/or sell copies of the Software, and to
 * permit persons to whom the Software is furnished to do so, subject to
 * the following conditions:
12
 *
13 14 15 16 17 18 19 20 21 22 23 24
 * The above copyright notice and this permission notice (including the
 * next paragraph) shall be included in all copies or substantial
 * portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT.  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
25 26
 */

27 28
#define _GNU_SOURCE

29
#include <math.h>
30 31 32 33 34 35
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <stdio.h>
#include <errno.h>
#include <sys/uio.h>
36
#include <fcntl.h>
37
#include <unistd.h>
38 39
#include <sys/types.h>
#include <sys/socket.h>
40
#include <time.h>
41
#include <ffi.h>
42

43
#include "wayland-util.h"
44
#include "wayland-private.h"
45
#include "wayland-os.h"
46

47 48 49 50 51 52 53 54 55
static inline uint32_t
div_roundup(uint32_t n, size_t a)
{
	/* The cast to uint64_t is necessary to prevent overflow when rounding
	 * values close to UINT32_MAX. After the division it is again safe to
	 * cast back to uint32_t.
	 */
	return (uint32_t) (((uint64_t) n + (a - 1)) / a);
}
56

57 58
struct wl_buffer {
	char data[4096];
59
	uint32_t head, tail;
60 61
};

62 63
#define MASK(i) ((i) & 4095)

64 65 66
#define MAX_FDS_OUT	28
#define CLEN		(CMSG_LEN(MAX_FDS_OUT * sizeof(int32_t)))

67 68
struct wl_connection {
	struct wl_buffer in, out;
69
	struct wl_buffer fds_in, fds_out;
70
	int fd;
71
	int want_flush;
72 73
};

74
static int
75 76
wl_buffer_put(struct wl_buffer *b, const void *data, size_t count)
{
77
	uint32_t head, size;
78

79 80 81 82 83 84 85
	if (count > sizeof(b->data)) {
		wl_log("Data too big for buffer (%d > %d).\n",
		       count, sizeof(b->data));
		errno = E2BIG;
		return -1;
	}

86 87 88 89 90 91 92 93 94 95
	head = MASK(b->head);
	if (head + count <= sizeof b->data) {
		memcpy(b->data + head, data, count);
	} else {
		size = sizeof b->data - head;
		memcpy(b->data + head, data, size);
		memcpy(b->data, (const char *) data + size, count - size);
	}

	b->head += count;
96 97

	return 0;
98 99 100 101 102
}

static void
wl_buffer_put_iov(struct wl_buffer *b, struct iovec *iov, int *count)
{
103
	uint32_t head, tail;
104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126

	head = MASK(b->head);
	tail = MASK(b->tail);
	if (head < tail) {
		iov[0].iov_base = b->data + head;
		iov[0].iov_len = tail - head;
		*count = 1;
	} else if (tail == 0) {
		iov[0].iov_base = b->data + head;
		iov[0].iov_len = sizeof b->data - head;
		*count = 1;
	} else {
		iov[0].iov_base = b->data + head;
		iov[0].iov_len = sizeof b->data - head;
		iov[1].iov_base = b->data;
		iov[1].iov_len = tail;
		*count = 2;
	}
}

static void
wl_buffer_get_iov(struct wl_buffer *b, struct iovec *iov, int *count)
{
127
	uint32_t head, tail;
128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150

	head = MASK(b->head);
	tail = MASK(b->tail);
	if (tail < head) {
		iov[0].iov_base = b->data + tail;
		iov[0].iov_len = head - tail;
		*count = 1;
	} else if (head == 0) {
		iov[0].iov_base = b->data + tail;
		iov[0].iov_len = sizeof b->data - tail;
		*count = 1;
	} else {
		iov[0].iov_base = b->data + tail;
		iov[0].iov_len = sizeof b->data - tail;
		iov[1].iov_base = b->data;
		iov[1].iov_len = head;
		*count = 2;
	}
}

static void
wl_buffer_copy(struct wl_buffer *b, void *data, size_t count)
{
151
	uint32_t tail, size;
152 153 154 155 156 157 158 159 160 161 162

	tail = MASK(b->tail);
	if (tail + count <= sizeof b->data) {
		memcpy(data, b->data + tail, count);
	} else {
		size = sizeof b->data - tail;
		memcpy(data, b->data + tail, size);
		memcpy((char *) data + size, b->data, count - size);
	}
}

163
static uint32_t
164 165 166 167 168
wl_buffer_size(struct wl_buffer *b)
{
	return b->head - b->tail;
}

169
struct wl_connection *
170
wl_connection_create(int fd)
171 172 173
{
	struct wl_connection *connection;

174
	connection = zalloc(sizeof *connection);
175 176
	if (connection == NULL)
		return NULL;
177

178 179 180 181 182
	connection->fd = fd;

	return connection;
}

183
static void
184
close_fds(struct wl_buffer *buffer, int max)
185
{
186
	int32_t fds[sizeof(buffer->data) / sizeof(int32_t)], i, count;
187 188
	size_t size;

189
	size = wl_buffer_size(buffer);
190 191 192 193 194
	if (size == 0)
		return;

	wl_buffer_copy(buffer, fds, size);
	count = size / sizeof fds[0];
195 196
	if (max > 0 && max < count)
		count = max;
197
	size = count * sizeof fds[0];
198 199 200 201 202
	for (i = 0; i < count; i++)
		close(fds[i]);
	buffer->tail += size;
}

203 204 205 206 207 208
void
wl_connection_close_fds_in(struct wl_connection *connection, int max)
{
	close_fds(&connection->fds_in, max);
}

209
int
210 211
wl_connection_destroy(struct wl_connection *connection)
{
212 213
	int fd = connection->fd;

214
	close_fds(&connection->fds_out, -1);
215
	close_fds(&connection->fds_in, -1);
216
	free(connection);
217 218

	return fd;
219 220 221 222 223
}

void
wl_connection_copy(struct wl_connection *connection, void *data, size_t size)
{
224
	wl_buffer_copy(&connection->in, data, size);
225 226 227 228 229
}

void
wl_connection_consume(struct wl_connection *connection, size_t size)
{
230
	connection->in.tail += size;
231 232
}

233 234 235 236 237 238
static void
build_cmsg(struct wl_buffer *buffer, char *data, int *clen)
{
	struct cmsghdr *cmsg;
	size_t size;

239
	size = wl_buffer_size(buffer);
240 241 242
	if (size > MAX_FDS_OUT * sizeof(int32_t))
		size = MAX_FDS_OUT * sizeof(int32_t);

243 244 245 246 247 248 249 250 251 252 253 254
	if (size > 0) {
		cmsg = (struct cmsghdr *) data;
		cmsg->cmsg_level = SOL_SOCKET;
		cmsg->cmsg_type = SCM_RIGHTS;
		cmsg->cmsg_len = CMSG_LEN(size);
		wl_buffer_copy(buffer, CMSG_DATA(cmsg), size);
		*clen = cmsg->cmsg_len;
	} else {
		*clen = 0;
	}
}

255
static int
256 257 258
decode_cmsg(struct wl_buffer *buffer, struct msghdr *msg)
{
	struct cmsghdr *cmsg;
259 260
	size_t size, max, i;
	int overflow = 0;
261 262 263

	for (cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL;
	     cmsg = CMSG_NXTHDR(msg, cmsg)) {
264 265 266 267 268 269 270 271 272
		if (cmsg->cmsg_level != SOL_SOCKET ||
		    cmsg->cmsg_type != SCM_RIGHTS)
			continue;

		size = cmsg->cmsg_len - CMSG_LEN(0);
		max = sizeof(buffer->data) - wl_buffer_size(buffer);
		if (size > max || overflow) {
			overflow = 1;
			size /= sizeof(int32_t);
273
			for (i = 0; i < size; i++)
274
				close(((int*)CMSG_DATA(cmsg))[i]);
275 276
		} else if (wl_buffer_put(buffer, CMSG_DATA(cmsg), size) < 0) {
				return -1;
277 278
		}
	}
279 280 281 282 283 284 285

	if (overflow) {
		errno = EOVERFLOW;
		return -1;
	}

	return 0;
286 287 288
}

int
289
wl_connection_flush(struct wl_connection *connection)
290 291
{
	struct iovec iov[2];
292
	struct msghdr msg;
293
	char cmsg[CLEN];
294 295 296 297 298
	int len = 0, count, clen;
	uint32_t tail;

	if (!connection->want_flush)
		return 0;
299

300 301
	tail = connection->out.tail;
	while (connection->out.head - connection->out.tail > 0) {
302 303 304
		wl_buffer_get_iov(&connection->out, iov, &count);

		build_cmsg(&connection->fds_out, cmsg, &clen);
305 306 307 308 309

		msg.msg_name = NULL;
		msg.msg_namelen = 0;
		msg.msg_iov = iov;
		msg.msg_iovlen = count;
310
		msg.msg_control = (clen > 0) ? cmsg : NULL;
311
		msg.msg_controllen = clen;
312
		msg.msg_flags = 0;
313

314
		do {
315 316
			len = sendmsg(connection->fd, &msg,
				      MSG_NOSIGNAL | MSG_DONTWAIT);
317
		} while (len == -1 && errno == EINTR);
318

319
		if (len == -1)
320
			return -1;
321

322
		close_fds(&connection->fds_out, MAX_FDS_OUT);
323

324 325
		connection->out.tail += len;
	}
326

327
	connection->want_flush = 0;
328

329 330
	return connection->out.head - tail;
}
331

332 333 334 335 336 337
uint32_t
wl_connection_pending_input(struct wl_connection *connection)
{
	return wl_buffer_size(&connection->in);
}

338 339 340 341 342 343
int
wl_connection_read(struct wl_connection *connection)
{
	struct iovec iov[2];
	struct msghdr msg;
	char cmsg[CLEN];
344
	int len, count, ret;
345

346 347 348 349 350
	if (wl_buffer_size(&connection->in) >= sizeof(connection->in.data)) {
		errno = EOVERFLOW;
		return -1;
	}

351 352 353 354 355 356 357 358 359
	wl_buffer_put_iov(&connection->in, iov, &count);

	msg.msg_name = NULL;
	msg.msg_namelen = 0;
	msg.msg_iov = iov;
	msg.msg_iovlen = count;
	msg.msg_control = cmsg;
	msg.msg_controllen = sizeof cmsg;
	msg.msg_flags = 0;
360

361
	do {
362
		len = wl_os_recvmsg_cloexec(connection->fd, &msg, MSG_DONTWAIT);
363
	} while (len < 0 && errno == EINTR);
364

365 366 367
	if (len <= 0)
		return len;

368 369 370
	ret = decode_cmsg(&connection->fds_in, &msg);
	if (ret)
		return -1;
371 372

	connection->in.head += len;
373

374
	return wl_connection_pending_input(connection);
375 376
}

377
int
378 379
wl_connection_write(struct wl_connection *connection,
		    const void *data, size_t count)
380
{
381
	if (connection->out.head - connection->out.tail +
382 383 384
	    count > ARRAY_LENGTH(connection->out.data)) {
		connection->want_flush = 1;
		if (wl_connection_flush(connection) < 0)
385
			return -1;
386
	}
387

388 389 390
	if (wl_buffer_put(&connection->out, data, count) < 0)
		return -1;

391
	connection->want_flush = 1;
392 393

	return 0;
394 395
}

396
int
397 398 399 400
wl_connection_queue(struct wl_connection *connection,
		    const void *data, size_t count)
{
	if (connection->out.head - connection->out.tail +
401 402 403
	    count > ARRAY_LENGTH(connection->out.data)) {
		connection->want_flush = 1;
		if (wl_connection_flush(connection) < 0)
404
			return -1;
405
	}
406

407
	return wl_buffer_put(&connection->out, data, count);
408
}
409

410
int
411
wl_message_count_arrays(const struct wl_message *message)
412
{
413
	int i, arrays;
414

415 416
	for (i = 0, arrays = 0; message->signature[i]; i++) {
		if (message->signature[i] == 'a')
417
			arrays++;
418 419
	}

420
	return arrays;
421 422
}

423 424 425 426 427 428
int
wl_connection_get_fd(struct wl_connection *connection)
{
	return connection->fd;
}

429 430 431
static int
wl_connection_put_fd(struct wl_connection *connection, int32_t fd)
{
432 433 434
	if (wl_buffer_size(&connection->fds_out) == MAX_FDS_OUT * sizeof fd) {
		connection->want_flush = 1;
		if (wl_connection_flush(connection) < 0)
435
			return -1;
436
	}
437

438
	return wl_buffer_put(&connection->fds_out, &fd, sizeof fd);
439 440
}

441
const char *
442 443
get_next_argument(const char *signature, struct argument_details *details)
{
444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460
	details->nullable = 0;
	for(; *signature; ++signature) {
		switch(*signature) {
		case 'i':
		case 'u':
		case 'f':
		case 's':
		case 'o':
		case 'n':
		case 'a':
		case 'h':
			details->type = *signature;
			return signature + 1;
		case '?':
			details->nullable = 1;
		}
	}
461
	details->type = '\0';
462
	return signature;
463 464
}

465
int
466 467 468
arg_count_for_signature(const char *signature)
{
	int count = 0;
469 470 471 472 473 474 475 476 477 478 479 480
	for(; *signature; ++signature) {
		switch(*signature) {
		case 'i':
		case 'u':
		case 'f':
		case 's':
		case 'o':
		case 'n':
		case 'a':
		case 'h':
			++count;
		}
481 482 483 484
	}
	return count;
}

485 486 487 488 489 490 491 492 493 494 495 496 497
int
wl_message_get_since(const struct wl_message *message)
{
	int since;

	since = atoi(message->signature);

	if (since == 0)
		since = 1;

	return since;
}

498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540
void
wl_argument_from_va_list(const char *signature, union wl_argument *args,
			 int count, va_list ap)
{
	int i;
	const char *sig_iter;
	struct argument_details arg;

	sig_iter = signature;
	for (i = 0; i < count; i++) {
		sig_iter = get_next_argument(sig_iter, &arg);

		switch(arg.type) {
		case 'i':
			args[i].i = va_arg(ap, int32_t);
			break;
		case 'u':
			args[i].u = va_arg(ap, uint32_t);
			break;
		case 'f':
			args[i].f = va_arg(ap, wl_fixed_t);
			break;
		case 's':
			args[i].s = va_arg(ap, const char *);
			break;
		case 'o':
			args[i].o = va_arg(ap, struct wl_object *);
			break;
		case 'n':
			args[i].o = va_arg(ap, struct wl_object *);
			break;
		case 'a':
			args[i].a = va_arg(ap, struct wl_array *);
			break;
		case 'h':
			args[i].h = va_arg(ap, int32_t);
			break;
		case '\0':
			return;
		}
	}
}

541 542 543
static void
wl_closure_clear_fds(struct wl_closure *closure)
{
544 545
	const char *signature = closure->message->signature;
	struct argument_details arg;
546 547
	int i;

548 549 550
	for (i = 0; i < closure->count; i++) {
		signature = get_next_argument(signature, &arg);
		if (arg.type == 'h')
551 552 553 554
			closure->args[i].h = -1;
	}
}

555 556 557
static struct wl_closure *
wl_closure_init(const struct wl_message *message, uint32_t size,
                int *num_arrays, union wl_argument *args)
558
{
559
	struct wl_closure *closure;
560
	int count;
561

562 563
	count = arg_count_for_signature(message->signature);
	if (count > WL_CLOSURE_MAX_ARGS) {
564
		wl_log("too many args (%d)\n", count);
565
		errno = EINVAL;
566
		return NULL;
567
	}
568

569 570 571 572 573 574 575 576 577
	if (size) {
		*num_arrays = wl_message_count_arrays(message);
		closure = malloc(sizeof *closure + size +
				 *num_arrays * sizeof(struct wl_array));
	} else {
		closure = malloc(sizeof *closure);
	}

	if (!closure) {
578 579 580
		errno = ENOMEM;
		return NULL;
	}
581

582 583 584 585 586 587
	if (args)
		memcpy(closure->args, args, count * sizeof *args);

	closure->message = message;
	closure->count = count;

588 589 590 591 592 593 594 595
	/* Set these all to -1 so we can close any that have been
	 * set to a real value during wl_closure_destroy().
	 * We may have copied a bunch of fds into the closure with
	 * memcpy previously, but those are undup()d client fds
	 * that we would have replaced anyway.
	 */
	wl_closure_clear_fds(closure);

596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614
	return closure;
}

struct wl_closure *
wl_closure_marshal(struct wl_object *sender, uint32_t opcode,
		   union wl_argument *args,
		   const struct wl_message *message)
{
	struct wl_closure *closure;
	struct wl_object *object;
	int i, count, fd, dup_fd;
	const char *signature;
	struct argument_details arg;

	closure = wl_closure_init(message, 0, NULL, args);
	if (closure == NULL)
		return NULL;

	count = closure->count;
615

616 617
	signature = message->signature;
	for (i = 0; i < count; i++) {
618 619 620
		signature = get_next_argument(signature, &arg);

		switch (arg.type) {
621
		case 'f':
622
		case 'u':
623 624
		case 'i':
			break;
625
		case 's':
626
			if (!arg.nullable && args[i].s == NULL)
627
				goto err_null;
628 629
			break;
		case 'o':
630
			if (!arg.nullable && args[i].o == NULL)
631
				goto err_null;
632
			break;
633
		case 'n':
634
			object = args[i].o;
Daniel Stone's avatar
Daniel Stone committed
635 636 637
			if (!arg.nullable && object == NULL)
				goto err_null;

638
			closure->args[i].n = object ? object->id : 0;
639
			break;
640
		case 'a':
641
			if (!arg.nullable && args[i].a == NULL)
642
				goto err_null;
643
			break;
644
		case 'h':
645
			fd = args[i].h;
646
			dup_fd = wl_os_dupfd_cloexec(fd, 0);
647 648
			if (dup_fd < 0)
				wl_abort("dup failed: %s\n", strerror(errno));
649
			closure->args[i].h = dup_fd;
650
			break;
651
		default:
652
			wl_abort("unhandled format code: '%c'\n", arg.type);
653 654 655 656
			break;
		}
	}

657 658
	closure->sender_id = sender->id;
	closure->opcode = opcode;
659

660
	return closure;
661

662
err_null:
663 664 665
	wl_closure_destroy(closure);
	wl_log("error marshalling arguments for %s (signature %s): "
	       "null value passed for arg %i\n", message->name,
666 667 668
	       message->signature, i);
	errno = EINVAL;
	return NULL;
669 670
}

671 672 673 674 675 676 677 678 679 680 681 682
struct wl_closure *
wl_closure_vmarshal(struct wl_object *sender, uint32_t opcode, va_list ap,
		    const struct wl_message *message)
{
	union wl_argument args[WL_CLOSURE_MAX_ARGS];

	wl_argument_from_va_list(message->signature, args,
				 WL_CLOSURE_MAX_ARGS, ap);

	return wl_closure_marshal(sender, opcode, args, message);
}

683
struct wl_closure *
684 685
wl_connection_demarshal(struct wl_connection *connection,
			uint32_t size,
686
			struct wl_map *objects,
687 688
			const struct wl_message *message)
{
689
	uint32_t *p, *next, *end, length, length_in_u32, id;
690 691
	int fd;
	char *s;
692
	int i, count, num_arrays;
693
	const char *signature;
694
	struct argument_details arg;
695
	struct wl_closure *closure;
696
	struct wl_array *array_extra;
697

698
	closure = wl_closure_init(message, size, &num_arrays, NULL);
699 700
	if (closure == NULL) {
		wl_connection_consume(connection, size);
701
		return NULL;
702
	}
703

704 705
	count = closure->count;

706 707 708 709 710 711 712 713 714 715
	array_extra = closure->extra;
	p = (uint32_t *)(closure->extra + num_arrays);
	end = p + size / sizeof *p;

	wl_connection_copy(connection, p, size);
	closure->sender_id = *p++;
	closure->opcode = *p++ & 0x0000ffff;

	signature = message->signature;
	for (i = 0; i < count; i++) {
716 717
		signature = get_next_argument(signature, &arg);

718
		if (arg.type != 'h' && p + 1 > end) {
719
			wl_log("message too short, "
720
			       "object (%d), message %s(%s)\n",
721 722
			       closure->sender_id, message->name,
			       message->signature);
723
			errno = EINVAL;
724
			goto err;
725 726
		}

727
		switch (arg.type) {
728
		case 'u':
729
			closure->args[i].u = *p++;
730
			break;
731
		case 'i':
732
			closure->args[i].i = *p++;
733
			break;
734
		case 'f':
735
			closure->args[i].f = *p++;
736
			break;
737 738
		case 's':
			length = *p++;
739

740 741 742 743 744
			if (length == 0) {
				closure->args[i].s = NULL;
				break;
			}

745 746
			length_in_u32 = div_roundup(length, sizeof *p);
			if ((uint32_t) (end - p) < length_in_u32) {
747
				wl_log("message too short, "
748
				       "object (%d), message %s(%s)\n",
749 750
				       closure->sender_id, message->name,
				       message->signature);
751
				errno = EINVAL;
752
				goto err;
753
			}
754
			next = p + length_in_u32;
755

756
			s = (char *) p;
757

758
			if (length > 0 && s[length - 1] != '\0') {
759
				wl_log("string not nul-terminated, "
760 761 762 763
				       "message %s(%s)\n",
				       message->name, message->signature);
				errno = EINVAL;
				goto err;
764
			}
765 766

			closure->args[i].s = s;
767
			p = next;
768 769
			break;
		case 'o':
770 771 772 773
			id = *p++;
			closure->args[i].n = id;

			if (id == 0 && !arg.nullable) {
774
				wl_log("NULL object received on non-nullable "
Daniel Stone's avatar
Daniel Stone committed
775 776 777 778 779
				       "type, message %s(%s)\n", message->name,
				       message->signature);
				errno = EINVAL;
				goto err;
			}
780 781
			break;
		case 'n':
782 783 784 785
			id = *p++;
			closure->args[i].n = id;

			if (id == 0 && !arg.nullable) {
786
				wl_log("NULL new ID received on non-nullable "
Daniel Stone's avatar
Daniel Stone committed
787 788 789 790 791 792
				       "type, message %s(%s)\n", message->name,
				       message->signature);
				errno = EINVAL;
				goto err;
			}

793
			if (wl_map_reserve_new(objects, id) < 0) {
794
				wl_log("not a valid new object id (%u), "
795
				       "message %s(%s)\n",
796
				       id, message->name, message->signature);
797
				errno = EINVAL;
798
				goto err;
799
			}
800

801
			break;
802 803
		case 'a':
			length = *p++;
804

805 806
			length_in_u32 = div_roundup(length, sizeof *p);
			if ((uint32_t) (end - p) < length_in_u32) {
807
				wl_log("message too short, "
808
				       "object (%d), message %s(%s)\n",
809 810
				       closure->sender_id, message->name,
				       message->signature);
811
				errno = EINVAL;
812
				goto err;
813
			}
814
			next = p + length_in_u32;
815

816 817 818
			array_extra->size = length;
			array_extra->alloc = 0;
			array_extra->data = p;
819

820
			closure->args[i].a = array_extra++;
821
			p = next;
822
			break;
823
		case 'h':
824
			if (connection->fds_in.tail == connection->fds_in.head) {
825
				wl_log("file descriptor expected, "
826 827 828 829 830 831 832
				       "object (%d), message %s(%s)\n",
				       closure->sender_id, message->name,
				       message->signature);
				errno = EINVAL;
				goto err;
			}

833 834 835
			wl_buffer_copy(&connection->fds_in, &fd, sizeof fd);
			connection->fds_in.tail += sizeof fd;
			closure->args[i].h = fd;
836
			break;
837
		default:
838
			wl_abort("unknown type\n");
839 840 841 842
			break;
		}
	}

843
	wl_connection_consume(connection, size);
844

845
	return closure;
846 847 848

 err:
	wl_closure_destroy(closure);
849
	wl_connection_consume(connection, size);
850

851
	return NULL;
852 853
}

854 855 856
bool
wl_object_is_zombie(struct wl_map *map, uint32_t id)
{
857
	uint32_t flags;
858

859 860 861 862 863 864 865 866 867 868
	/* Zombie objects only exist on the client side. */
	if (map->side == WL_MAP_SERVER_SIDE)
		return false;

	/* Zombie objects can only have been created by the client. */
	if (id >= WL_SERVER_ID_START)
		return false;

	flags = wl_map_lookup_flags(map, id);
	return !!(flags & WL_MAP_ENTRY_ZOMBIE);
869 870
}

871 872 873
int
wl_closure_lookup_objects(struct wl_closure *closure, struct wl_map *objects)
{
874
	struct wl_object *object;
875 876 877 878 879 880 881 882
	const struct wl_message *message;
	const char *signature;
	struct argument_details arg;
	int i, count;
	uint32_t id;

	message = closure->message;
	signature = message->signature;
883 884
	count = arg_count_for_signature(signature);
	for (i = 0; i < count; i++) {
885 886 887
		signature = get_next_argument(signature, &arg);
		switch (arg.type) {
		case 'o':
888 889 890 891
			id = closure->args[i].n;
			closure->args[i].o = NULL;

			object = wl_map_lookup(objects, id);
892
			if (wl_object_is_zombie(objects, id)) {
893 894
				/* references object we've already
				 * destroyed client side */
895 896
				object = NULL;
			} else if (object == NULL && id != 0) {
897
				wl_log("unknown object (%u), message %s(%s)\n",
898 899 900 901 902
				       id, message->name, message->signature);
				errno = EINVAL;
				return -1;
			}

903
			if (object != NULL && message->types[i] != NULL &&
904 905
			    !wl_interface_equal((object)->interface,
						message->types[i])) {
906
				wl_log("invalid object (%u), type (%s), "
907
				       "message %s(%s)\n",
908
				       id, (object)->interface->name,
909 910 911 912
				       message->name, message->signature);
				errno = EINVAL;
				return -1;
			}
913
			closure->args[i].o = object;
914 915 916 917 918 919
		}
	}

	return 0;
}

920
static void
921 922
convert_arguments_to_ffi(const char *signature, uint32_t flags,
			 union wl_argument *args,
923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954
			 int count, ffi_type **ffi_types, void** ffi_args)
{
	int i;
	const char *sig_iter;
	struct argument_details arg;

	sig_iter = signature;
	for (i = 0; i < count; i++) {
		sig_iter = get_next_argument(sig_iter, &arg);

		switch(arg.type) {
		case 'i':
			ffi_types[i] = &ffi_type_sint32;
			ffi_args[i] = &args[i].i;
			break;
		case 'u':
			ffi_types[i] = &ffi_type_uint32;
			ffi_args[i] = &args[i].u;
			break;
		case 'f':
			ffi_types[i] = &ffi_type_sint32;
			ffi_args[i] = &args[i].f;
			break;
		case 's':
			ffi_types[i] = &ffi_type_pointer;
			ffi_args[i] = &args[i].s;
			break;
		case 'o':
			ffi_types[i] = &ffi_type_pointer;
			ffi_args[i] = &args[i].o;
			break;
		case 'n':
955 956 957 958 959 960 961
			if (flags & WL_CLOSURE_INVOKE_CLIENT) {
				ffi_types[i] = &ffi_type_pointer;
				ffi_args[i] = &args[i].o;
			} else {
				ffi_types[i] = &ffi_type_uint32;
				ffi_args[i] = &args[i].n;
			}
962 963 964 965 966 967 968 969 970 971
			break;
		case 'a':
			ffi_types[i] = &ffi_type_pointer;
			ffi_args[i] = &args[i].a;
			break;
		case 'h':
			ffi_types[i] = &ffi_type_sint32;
			ffi_args[i] = &args[i].h;
			break;
		default:
972
			wl_abort("unknown type\n");
973 974 975 976 977
			break;
		}
	}
}

978
void
979
wl_closure_invoke(struct wl_closure *closure, uint32_t flags,
980
		  struct wl_object *target, uint32_t opcode, void *data)
981
{
982 983 984 985
	int count;
	ffi_cif cif;
	ffi_type *ffi_types[WL_CLOSURE_MAX_ARGS + 2];
	void * ffi_args[WL_CLOSURE_MAX_ARGS + 2];
986
	void (* const *implementation)(void);
987 988 989 990 991 992 993 994

	count = arg_count_for_signature(closure->message->signature);

	ffi_types[0] = &ffi_type_pointer;
	ffi_args[0] = &data;
	ffi_types[1] = &ffi_type_pointer;
	ffi_args[1] = &target;

995
	convert_arguments_to_ffi(closure->message->signature, flags, closure->args,
996
				 count, ffi_types + 2, ffi_args + 2);
997

998 999
	ffi_prep_cif(&cif, FFI_DEFAULT_ABI,
		     count + 2, &ffi_type_void, ffi_types);
1000

1001
	implementation = target->implementation;
1002
	if (!implementation[opcode]) {
1003 1004
		wl_abort("listener function for opcode %u of %s is NULL\n",
			 opcode, target->interface->name);
1005
	}
1006
	ffi_call(&cif, implementation[opcode], NULL, ffi_args);
1007 1008

	wl_closure_clear_fds(closure);
1009 1010
}

1011 1012 1013 1014 1015 1016
void
wl_closure_dispatch(struct wl_closure *closure, wl_dispatcher_func_t dispatcher,
		    struct wl_object *target, uint32_t opcode)
{
	dispatcher(target->implementation, target, opcode, closure->message,
		   closure->args);
1017 1018

	wl_closure_clear_fds(closure);
1019 1020
}

1021 1022 1023 1024 1025 1026
static int
copy_fds_to_connection(struct wl_closure *closure,
		       struct wl_connection *connection)
{
	const struct wl_message *message = closure->message;
	uint32_t i, count;
1027 1028
	struct argument_details arg;
	const char *signature = message->signature;
1029
	int fd;
1030

1031 1032
	count = arg_count_for_signature(signature);
	for (i = 0; i < count; i++) {
1033 1034
		signature = get_next_argument(signature, &arg);
		if (arg.type != 'h')
1035 1036
			continue;

1037 1038
		fd = closure->args[i].h;
		if (wl_connection_put_fd(connection, fd)) {
1039 1040
			wl_log("request could not be marshaled: "
			       "can't send file descriptor");
1041 1042
			return -1;
		}
1043
		closure->args[i].h = -1;
1044 1045 1046 1047 1048
	}

	return 0;
}

1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080

static uint32_t
buffer_size_for_closure(struct wl_closure *closure)
{
	const struct wl_message *message = closure->message;
	int i, count;
	struct argument_details arg;
	const char *signature;
	uint32_t size, buffer_size = 0;

	signature = message->signature;
	count = arg_count_for_signature(signature);
	for (i = 0; i < count; i++) {
		signature = get_next_argument(signature, &arg);

		switch (arg.type) {
		case 'h':
			break;
		case 'u':
		case 'i':
		case 'f':
		case 'o':
		case 'n':
			buffer_size++;
			break;
		case 's':
			if (closure->args[i].s == NULL) {
				buffer_size++;
				break;
			}

			size = strlen(closure->args[i].s) + 1;
1081
			buffer_size += 1 + div_roundup(size, sizeof(uint32_t));
1082 1083 1084 1085 1086 1087 1088 1089
			break;
		case 'a':
			if (closure->args[i].a == NULL) {
				buffer_size++;
				break;
			}

			size = closure->args[i].a->size;
1090
			buffer_size += (1 + div_roundup(size, sizeof(uint32_t)));
1091 1092 1093 1094 1095 1096 1097 1098 1099
			break;
		default:
			break;
		}
	}

	return buffer_size + 2;
}

1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151
static int
serialize_closure(struct wl_closure *closure, uint32_t *buffer,
		  size_t buffer_count)
{
	const struct wl_message *message = closure->message;
	unsigned int i, count, size;
	uint32_t *p, *end;
	struct argument_details arg;
	const char *signature;

	if (buffer_count < 2)
		goto overflow;

	p = buffer + 2;
	end = buffer + buffer_count;

	signature = message->signature;
	count = arg_count_for_signature(signature);
	for (i = 0; i < count; i++) {
		signature = get_next_argument(signature, &arg);

		if (arg.type == 'h')
			continue;

		if (p + 1 > end)
			goto overflow;

		switch (arg.type) {
		case 'u':
			*p++ = closure->args[i].u;
			break;
		case 'i':
			*p++ = closure->args[i].i;
			break;
		case 'f':
			*p++ = closure->args[i].f;
			break;
		case 'o':
			*p++ = closure->args[i].o ? closure->args[i].o->id : 0;
			break;
		case 'n':
			*p++ = closure->args[i].n;
			break;
		case 's':
			if (closure->args[i].s == NULL) {
				*p++ = 0;
				break;
			}

			size = strlen(closure->args[i].s) + 1;
			*p++ = size;

1152
			if (p + div_roundup(size, sizeof *p) > end)
1153 1154 1155
				goto overflow;

			memcpy(p, closure->args[i].s, size);
1156
			p += div_roundup(size, sizeof *p);
1157 1158 1159 1160 1161 1162 1163 1164 1165 1166
			break;
		case 'a':
			if (closure->args[i].a == NULL) {
				*p++ = 0;
				break;
			}

			size = closure->args[i].a->size;
			*p++ = size;

1167
			if (p + div_roundup(size, sizeof *p) > end)
1168 1169 1170
				goto overflow;

			memcpy(p, closure->args[i].a->data, size);
1171
			p += div_roundup(size, sizeof *p);
1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189
			break;
		default:
			break;
		}
	}

	size = (p - buffer) * sizeof *p;

	buffer[0] = closure->sender_id;
	buffer[1] = size << 16 | (closure->opcode & 0x0000ffff);

	return size;

overflow:
	errno = ERANGE;
	return -1;
}

1190
int
1191 1192
wl_closure_send(struct wl_closure *closure, struct wl_connection *connection)
{
1193
	int size;
1194 1195 1196
	uint32_t buffer_size;
	uint32_t *buffer;
	int result;
1197

1198 1199 1200
	if (copy_fds_to_connection(closure, connection))
		return -1;

1201
	buffer_size = buffer_size_for_closure(closure);
1202
	buffer = zalloc(buffer_size * sizeof buffer[0]);
1203 1204 1205 1206 1207 1208
	if (buffer == NULL)
		return -1;

	size = serialize_closure(closure, buffer, buffer_size);
	if (size < 0) {
		free(buffer);
1209
		return -1;
1210 1211 1212 1213
	}

	result = wl_connection_write(connection, buffer, size);
	free(buffer);
1214

1215
	return result;
1216 1217
}

1218
int
1219 1220
wl_closure_queue(struct wl_closure *closure, struct wl_connection *connection)
{
1221
	int size;
1222 1223 1224
	uint32_t buffer_size;
	uint32_t *buffer;
	int result;
1225

1226 1227 1228
	if (copy_fds_to_connection(closure, connection))
		return -1;

1229 1230 1231 1232 1233 1234 1235 1236
	buffer_size = buffer_size_for_closure(closure);
	buffer = malloc(buffer_size * sizeof buffer[0]);
	if (buffer == NULL)
		return -1;

	size = serialize_closure(closure, buffer, buffer_size);
	if (size < 0) {
		free(buffer);
1237
		return -1;
1238 1239 1240 1241
	}

	result = wl_connection_queue(connection, buffer, size);
	free(buffer);
1242

1243
	return result;
1244 1245
}

1246
void
1247
wl_closure_print(struct wl_closure *closure, struct wl_object *target, int send)
1248 1249
{
	int i;
1250 1251
	struct argument_details arg;
	const char *signature = closure->message->signature;
1252 1253
	struct timespec tp;
	unsigned int time;
1254

1255 1256 1257
	clock_gettime(CLOCK_REALTIME, &tp);
	time = (tp.tv_sec * 1000000L) + (tp.tv_nsec / 1000);

1258
	fprintf(stderr, "[%10.3f] %s%s@%u.%s(",
1259
		time / 1000.0,
1260
		send ? " -> " : "",
1261 1262 1263
		target->interface->name, target->id,
		closure->message->name);

1264
	for (i = 0; i < closure->count; i++) {
1265
		signature = get_next_argument(signature, &arg);
1266
		if (i > 0)
1267
			fprintf(stderr, ", ");
1268

1269
		switch (arg.type) {
1270
		case 'u':
1271
			fprintf(stderr, "%u", closure->args[i].u);
1272 1273
			break;
		case 'i':
1274
			fprintf(stderr, "%d", closure->args[i].i);
1275 1276
			break;
		case 'f':
1277 1278
			fprintf(stderr, "%f",
				wl_fixed_to_double(closure->args[i].f));
1279 1280
			break;
		case 's':
1281
			fprintf(stderr, "\"%s\"", closure->args[i].s);
1282 1283
			break;
		case 'o':
1284
			if (closure->args[i].o)
1285
				fprintf(stderr, "%s@%u",
1286 1287
					closure->args[i].o->interface->name,
					closure->args[i].o->id);
1288 1289
			else
				fprintf(stderr, "nil");
1290 1291
			break;
		case 'n':
Daniel Stone's avatar
Daniel Stone committed
1292
			fprintf(stderr, "new id %s@",
1293 1294
				(closure->message->types[i]) ?
				 closure->message->types[i]->name :
Daniel Stone's avatar
Daniel Stone committed
1295
				  "[unknown]");
1296 1297
			if (closure->args[i].n != 0)
				fprintf(stderr, "%u", closure->args[i].n);
Daniel Stone's avatar
Daniel Stone committed
1298 1299
			else
				fprintf(stderr, "nil");
1300 1301 1302 1303 1304
			break;
		case 'a':
			fprintf(stderr, "array");
			break;
		case 'h':
1305
			fprintf(stderr, "fd %d", closure->args[i].h);
1306 1307 1308 1309 1310 1311 1312
			break;
		}
	}

	fprintf(stderr, ")\n");
}

1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328
static int
wl_closure_close_fds(struct wl_closure *closure)
{
	int i;
	struct argument_details arg;
	const char *signature = closure->message->signature;

	for (i = 0; i < closure->count; i++) {
		signature = get_next_argument(signature, &arg);
		if (arg.type == 'h' && closure->args[i].h != -1)
			close(closure->args[i].h);
	}

	return 0;
}

1329 1330 1331
void
wl_closure_destroy(struct wl_closure *closure)
{
1332