Xext/shm.c

@@ -834,6 +834,19 @@ ProcPanoramiXShmGetImage(ClientPtr client)
             return BadMatch;
     }
 
+    if (format == ZPixmap) {
+        widthBytesLine = PixmapBytePad(w, pDraw->depth);
+        length = widthBytesLine * h;
+    }
+    else {
+        widthBytesLine = PixmapBytePad(w, 1);
+        lenPer = widthBytesLine * h;
+        plane = ((Mask) 1) << (pDraw->depth - 1);
+        length = lenPer * Ones(planemask & (plane | (plane - 1)));
+    }
+
+    VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client);
+
     drawables = calloc(PanoramiXNumScreens, sizeof(DrawablePtr));
     if (!drawables)
         return BadAlloc;
@@ -856,18 +869,6 @@ ProcPanoramiXShmGetImage(ClientPtr client)
         .depth = pDraw->depth
     };
 
-    if (format == ZPixmap) {
-        widthBytesLine = PixmapBytePad(w, pDraw->depth);
-        length = widthBytesLine * h;
-    }
-    else {
-        widthBytesLine = PixmapBytePad(w, 1);
-        lenPer = widthBytesLine * h;
-        plane = ((Mask) 1) << (pDraw->depth - 1);
-        length = lenPer * Ones(planemask & (plane | (plane - 1)));
-    }
-
-    VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client);
     xgi.size = length;
 
     if (length == 0) {          /* nothing to do */

Xi/xipassivegrab.c

@@ -88,7 +88,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     };
     int i, ret = Success;
     uint32_t *modifiers;
-    xXIGrabModifierInfo *modifiers_failed;
+    xXIGrabModifierInfo *modifiers_failed = NULL;
     GrabMask mask = { 0 };
     GrabParameters param;
     void *tmp;
@@ -232,8 +232,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     if (rep.num_modifiers)
         WriteToClient(client, rep.length * 4, modifiers_failed);
 
-    free(modifiers_failed);
  out:
+    free(modifiers_failed);
     xi2mask_free(&mask.xi2mask);
     return ret;
 }

composite/compalloc.c

@@ -47,24 +47,18 @@
 
 #include "compint.h"
 
-static void
-compScreenUpdate(ScreenPtr pScreen)
-{
-    compCheckTree(pScreen);
-    compPaintChildrenToWindow(pScreen->root);
-}
-
-static void
-compBlockHandler(ScreenPtr pScreen, void *pTimeout)
+static Bool
+compScreenUpdate(ClientPtr pClient, void *closure)
 {
+    ScreenPtr pScreen = closure;
     CompScreenPtr cs = GetCompScreen(pScreen);
 
-    pScreen->BlockHandler = cs->BlockHandler;
-    compScreenUpdate(pScreen);
-    (*pScreen->BlockHandler) (pScreen, pTimeout);
+    compCheckTree(pScreen);
+    compPaintChildrenToWindow(pScreen->root);
 
-    /* Next damage will restore the block handler */
-    cs->BlockHandler = NULL;
+    /* Next damage will restore the worker */
+    cs->pendingScreenUpdate = FALSE;
+    return TRUE;
 }
 
 void
@@ -87,9 +81,9 @@ compReportDamage(DamagePtr pDamage, RegionPtr pRegion, void *closure)
     CompScreenPtr cs = GetCompScreen(pScreen);
     CompWindowPtr cw = GetCompWindow(pWin);
 
-    if (!cs->BlockHandler) {
-        cs->BlockHandler = pScreen->BlockHandler;
-        pScreen->BlockHandler = compBlockHandler;
+    if (!cs->pendingScreenUpdate) {
+        QueueWorkProc(compScreenUpdate, serverClient, pScreen);
+        cs->pendingScreenUpdate = TRUE;
     }
     cw->damaged = TRUE;
 

composite/compinit.c

@@ -387,6 +387,8 @@ compScreenInit(ScreenPtr pScreen)
     cs->pOverlayWin = NULL;
     cs->pOverlayClients = NULL;
 
+    cs->pendingScreenUpdate = FALSE;
+
     cs->numAlternateVisuals = 0;
     cs->alternateVisuals = NULL;
     cs->numImplicitRedirectExceptions = 0;
@@ -442,8 +444,6 @@ compScreenInit(ScreenPtr pScreen)
     cs->ChangeWindowAttributes = pScreen->ChangeWindowAttributes;
     pScreen->ChangeWindowAttributes = compChangeWindowAttributes;
 
-    cs->BlockHandler = NULL;
-
     cs->CloseScreen = pScreen->CloseScreen;
     pScreen->CloseScreen = compCloseScreen;
 

composite/compint.h

@@ -156,7 +156,8 @@ typedef struct _CompScreen {
      */
     ChangeWindowAttributesProcPtr ChangeWindowAttributes;
 
-    ScreenBlockHandlerProcPtr BlockHandler;
+    Bool pendingScreenUpdate;
+
     CloseScreenProcPtr CloseScreen;
     int numAlternateVisuals;
     VisualID *alternateVisuals;

configure.ac

@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.20.1, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2018-08-07"
-RELEASE_NAME="Kale Salad"
+AC_INIT([xorg-server], 1.20.2, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2018-10-15"
+RELEASE_NAME="Tofu Biryani"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])

debian/changelog

+xorg-server (2:1.20.2-1) UNRELEASED; urgency=medium
+
+  * New upstream release.
+    - Fixes various crashes with xwayland (Closes: #777625, #881891,
+      #911146).
+    - Fixes a crash when running the X server inside virtualbox
+      (Closes: #911680).
+  * Drop 08_dont-init-glamor-on-llvmpipe.diff, upstream.
+
+ -- Andreas Boll <aboll@debian.org>  Wed, 24 Oct 2018 13:32:00 +0200
+
 xorg-server (2:1.20.1-5) unstable; urgency=medium
 
   [ Timo Aaltonen ]

debian/patches/08_dont-init-glamor-on-llvmpipe.diff

-commit 0a9415cf793babed1f28c61f8047d51de04f1528
-Author: Adam Jackson <ajax@redhat.com>
-Date:   Fri Sep 14 11:33:43 2018 -0400
-
-    glamor_egl: Don't initialize on llvmpipe
-    
-    Mesa started supporting GL_OES_EGL_image on llvmpipe in 17.3, after this
-    commit:
-    
-        commit bbdeddd5fd0b797e1e281f058338b3da4d98029d
-        Author: Gurchetan Singh <gurchetansingh@chromium.org>
-        Date:   Tue Aug 1 14:49:33 2017 -0700
-    
-            st/dri: add drisw image extension
-    
-    That's pretty cool, but it means glamor now thinks it can initialize on
-    llvmpipe. This is almost certainly not what anyone wants, as glamor on
-    llvmpipe is pretty much uniformly slower than fb.
-    
-    This fixes both Xorg and Xwayland to refuse glamor in such a setup.
-    Xephyr is left alone, both because glamor is not the default there and
-    because Xephyr+glamor+llvmpipe is one of the easier ways to get xts to
-    exercise glamor.
-    
-    The (very small) downside of this change is that you lose DRI3 support.
-    This wouldn't have helped you very much (since an lp glamor blit is
-    slower than a pixman blit), but it would eliminate the PutImage overhead
-    for llvmpipe's glXSwapBuffers. A future change should add DRI3 support
-    for the fb-only case.
-    
-    Reviewed-by: Eric Anholt <eric@anholt.net>
-    Signed-off-by: Adam Jackson <ajax@redhat.com>
-
-diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c
-index df278b1a1..9b930d603 100644
---- a/glamor/glamor_egl.c
-+++ b/glamor/glamor_egl.c
-@@ -898,6 +898,7 @@ Bool
- glamor_egl_init(ScrnInfoPtr scrn, int fd)
- {
-     struct glamor_egl_screen_private *glamor_egl;
-+    const GLubyte *renderer;
- 
-     glamor_egl = calloc(sizeof(*glamor_egl), 1);
-     if (glamor_egl == NULL)
-@@ -992,6 +993,14 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
-                    "Failed to make EGL context current\n");
-         goto error;
-     }
-+
-+    renderer = glGetString(GL_RENDERER);
-+    if (strstr((const char *)renderer, "llvmpipe")) {
-+        xf86DrvMsg(scrn->scrnIndex, X_INFO,
-+                   "Refusing to try glamor on llvmpipe\n");
-+        goto error;
-+    }
-+
-     /*
-      * Force the next glamor_make_current call to set the right context
-      * (in case of multiple GPUs using glamor)
-@@ -1005,7 +1014,7 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
-     }
- 
-     xf86DrvMsg(scrn->scrnIndex, X_INFO, "glamor X acceleration enabled on %s\n",
--               glGetString(GL_RENDERER));
-+               renderer);
- 
- #ifdef GBM_BO_WITH_MODIFIERS
-     if (epoxy_has_egl_extension(glamor_egl->display,
-diff --git a/hw/xwayland/xwayland-glamor-gbm.c b/hw/xwayland/xwayland-glamor-gbm.c
-index 06fcf5239..25a354bf7 100644
---- a/hw/xwayland/xwayland-glamor-gbm.c
-+++ b/hw/xwayland/xwayland-glamor-gbm.c
-@@ -843,6 +843,11 @@ xwl_glamor_gbm_init_egl(struct xwl_screen *xwl_screen)
-         goto error;
-     }
- 
-+    if (strstr((const char *)glGetString(GL_RENDERER), "llvmpipe")) {
-+        ErrorF("Refusing to try glamor on llvmpipe\n");
-+        goto error;
-+    }
-+
-     if (!epoxy_has_gl_extension("GL_OES_EGL_image")) {
-         ErrorF("GL_OES_EGL_image not available\n");
-         goto error;

debian/patches/series

@@ -6,4 +6,3 @@
 05_Revert-Unload-submodules.diff
 06_use-intel-only-on-pre-gen4.diff
 07_use-modesetting-driver-by-default-on-GeForce.diff
-08_dont-init-glamor-on-llvmpipe.diff

dix/devices.c

@@ -1177,6 +1177,7 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
             flags[tmp->id] = IsMaster(tmp) ? XIMasterRemoved : XISlaveRemoved;
             CloseDevice(tmp);
             ret = Success;
+            break;
         }
     }
 
@@ -1193,6 +1194,7 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
                 prev->next = next;
 
             ret = Success;
+            break;
         }
     }
 

dix/inpututils.c

@@ -282,7 +282,7 @@ change_modmap(ClientPtr client, DeviceIntPtr dev, KeyCode *modkeymap,
     else if (!IsFloating(dev) &&
              GetMaster(dev, MASTER_KEYBOARD)->lastSlave == dev) {
         /* If this fails, expect the results to be weird. */
-        if (check_modmap_change(client, dev->master, modmap))
+        if (check_modmap_change(client, dev->master, modmap) == Success)
             do_modmap_change(client, dev->master, modmap);
     }
 

fb/fboverlay.c

@@ -279,11 +279,11 @@ fbOverlayFinishScreenInit(ScreenPtr pScreen,
         (&fbOverlayScreenPrivateKeyRec, PRIVATE_SCREEN, 0))
         return FALSE;
 
-    pScrPriv = malloc(sizeof(FbOverlayScrPrivRec));
-    if (!pScrPriv)
+    if (bpp1 == 24 || bpp2 == 24)
         return FALSE;
 
-    if (bpp1 == 24 || bpp2 == 24)
+    pScrPriv = malloc(sizeof(FbOverlayScrPrivRec));
+    if (!pScrPriv)
         return FALSE;
 
     if (!fbInitVisuals(&visuals, &depths, &nvisuals, &ndepths, &depth1,

glamor/glamor_egl.c

@@ -892,6 +892,7 @@ Bool
 glamor_egl_init(ScrnInfoPtr scrn, int fd)
 {
     struct glamor_egl_screen_private *glamor_egl;
+    const GLubyte *renderer;
 
     glamor_egl = calloc(sizeof(*glamor_egl), 1);
     if (glamor_egl == NULL)
@@ -986,6 +987,19 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
                    "Failed to make EGL context current\n");
         goto error;
     }
+
+    renderer = glGetString(GL_RENDERER);
+    if (!renderer) {
+        xf86DrvMsg(scrn->scrnIndex, X_ERROR,
+                   "glGetString() returned NULL, your GL is broken\n");
+        goto error;
+    }
+    if (strstr((const char *)renderer, "llvmpipe")) {
+        xf86DrvMsg(scrn->scrnIndex, X_INFO,
+                   "Refusing to try glamor on llvmpipe\n");
+        goto error;
+    }
+
     /*
      * Force the next glamor_make_current call to set the right context
      * (in case of multiple GPUs using glamor)
@@ -999,7 +1013,7 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
     }
 
     xf86DrvMsg(scrn->scrnIndex, X_INFO, "glamor X acceleration enabled on %s\n",
-               glGetString(GL_RENDERER));
+               renderer);
 
 #ifdef GBM_BO_WITH_MODIFIERS
     if (epoxy_has_egl_extension(glamor_egl->display,

glamor/glamor_gradient.c

@@ -38,7 +38,7 @@
 #define RADIAL_SMALL_STOPS (6 + 2)
 #define RADIAL_LARGE_STOPS (16 + 2)
 
-static const char *
+static char *
 _glamor_create_getcolor_fs_source(ScreenPtr screen, int stops_count,
                                   int use_array)
 {
@@ -310,7 +310,7 @@ _glamor_create_radial_gradient_program(ScreenPtr screen, int stops_count,
 	    "}\n"\
 	    "\n"\
             "%s\n" /* fs_getcolor_source */
-    const char *fs_getcolor_source;
+    char *fs_getcolor_source;
 
     glamor_priv = glamor_get_screen_private(screen);
 
@@ -343,6 +343,7 @@ _glamor_create_radial_gradient_program(ScreenPtr screen, int stops_count,
     fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, gradient_fs);
 
     free(gradient_fs);
+    free(fs_getcolor_source);
 
     glAttachShader(gradient_prog, vs_prog);
     glAttachShader(gradient_prog, fs_prog);
@@ -493,7 +494,7 @@ _glamor_create_linear_gradient_program(ScreenPtr screen, int stops_count,
 	    "}\n"\
 	    "\n"\
             "%s" /* fs_getcolor_source */
-    const char *fs_getcolor_source;
+    char *fs_getcolor_source;
 
     glamor_priv = glamor_get_screen_private(screen);
 
@@ -522,6 +523,7 @@ _glamor_create_linear_gradient_program(ScreenPtr screen, int stops_count,
 
     fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, gradient_fs);
     free(gradient_fs);
+    free(fs_getcolor_source);
 
     glAttachShader(gradient_prog, vs_prog);
     glAttachShader(gradient_prog, fs_prog);

glx/createcontext.c

@@ -28,6 +28,7 @@
 #include "glxserver.h"
 #include "glxext.h"
 #include "indirect_dispatch.h"
+#include "opaque.h"
 
 #define ALL_VALID_FLAGS \
     (GLX_CONTEXT_DEBUG_BIT_ARB | GLX_CONTEXT_FORWARD_COMPATIBLE_BIT_ARB \
@@ -320,6 +321,17 @@ __glXDisp_CreateContextAttribsARB(__GLXclientState * cl, GLbyte * pc)
         err = BadAlloc;
     }
     else {
+        /* Only allow creating indirect GLX contexts if allowed by
+         * server command line.  Indirect GLX is of limited use (since
+         * it's only GL 1.4), it's slower than direct contexts, and
+         * it's a massive attack surface for buffer overflow type
+         * errors.
+         */
+        if (!enableIndirectGLX) {
+            client->errorValue = req->isDirect;
+            return BadValue;
+        }
+
         ctx = glxScreen->createContext(glxScreen, config, shareCtx,
                                        req->numAttribs, (uint32_t *) attribs,
                                        &err);

hw/xfree86/common/xf86Config.c

@@ -939,11 +939,13 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
 	from = X_CMDLINE;
     i = -1;
     if (xf86GetOptValInteger(FlagOptions, FLAG_MAX_CLIENTS, &i)) {
-	if (i != 64 && i != 128 && i != 256 && i != 512)
-		ErrorF("MaxClients must be one of 64, 128, 256 or 512\n");
+        if (Ones(i) != 1 || i < 64 || i > 2048) {
+	    ErrorF("MaxClients must be one of 64, 128, 256, 512, 1024, or 2048\n");
+        } else {
             from = X_CONFIG;
             LimitClients = i;
         }
+    }
     xf86Msg(from, "Max clients allowed: %i, resource mask: 0x%x\n",
 	    LimitClients, RESOURCE_ID_MASK);
 }

hw/xfree86/drivers/modesetting/driver.c

@@ -640,8 +640,9 @@ ms_dirty_update(ScreenPtr screen, int *timeout)
     xorg_list_for_each_entry(ent, &screen->pixmap_dirty_list, ent) {
         region = DamageRegion(ent->damage);
         if (RegionNotEmpty(region)) {
+            if (!screen->isGPU) {
                    msPixmapPrivPtr ppriv =
-                msGetPixmapPriv(&ms->drmmode, ent->slave_dst);
+                    msGetPixmapPriv(&ms->drmmode, ent->slave_dst->master_pixmap);
 
                 if (ppriv->notify_on_damage) {
                     ppriv->notify_on_damage = FALSE;
@@ -653,6 +654,7 @@ ms_dirty_update(ScreenPtr screen, int *timeout)
                 /* Requested manual updating */
                 if (ppriv->defer_dirty_update)
                     continue;
+            }
 
             redisplay_dirty(screen, ent, timeout);
             DamageEmpty(ent->damage);
@@ -898,8 +900,6 @@ PreInit(ScrnInfoPtr pScrn, int flags)
     if (pScrn->numEntities != 1)
         return FALSE;
 
-    pEnt = xf86GetEntityInfo(pScrn->entityList[0]);
-
     if (flags & PROBE_DETECT) {
         return FALSE;
     }
@@ -908,6 +908,8 @@ PreInit(ScrnInfoPtr pScrn, int flags)
     if (!GetRec(pScrn))
         return FALSE;
 
+    pEnt = xf86GetEntityInfo(pScrn->entityList[0]);
+
     ms = modesettingPTR(pScrn);
     ms->SaveGeneration = -1;
     ms->pEnt = pEnt;
@@ -1251,8 +1253,8 @@ msStartFlippingPixmapTracking(RRCrtcPtr crtc, DrawablePtr src,
     ScreenPtr pScreen = src->pScreen;
     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
 
-    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1),
-                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2);
+    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1->master_pixmap),
+                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2->master_pixmap);
 
     if (!PixmapStartDirtyTracking(src, slave_dst1, x, y,
                                   dst_x, dst_y, rotation)) {
@@ -1280,10 +1282,10 @@ msStartFlippingPixmapTracking(RRCrtcPtr crtc, DrawablePtr src,
 static Bool
 msPresentSharedPixmap(PixmapPtr slave_dst)
 {
-    ScreenPtr pScreen = slave_dst->drawable.pScreen;
+    ScreenPtr pScreen = slave_dst->master_pixmap->drawable.pScreen;
     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
 
-    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, slave_dst);
+    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, slave_dst->master_pixmap);
 
     RegionPtr region = DamageRegion(ppriv->dirty->damage);
 
@@ -1304,8 +1306,8 @@ msStopFlippingPixmapTracking(DrawablePtr src,
     ScreenPtr pScreen = src->pScreen;
     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
 
-    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1),
-                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2);
+    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1->master_pixmap),
+                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2->master_pixmap);
 
     Bool ret = TRUE;
 
@@ -1471,7 +1473,7 @@ msRequestSharedPixmapNotifyDamage(PixmapPtr ppix)
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
     modesettingPtr ms = modesettingPTR(scrn);
 
-    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, ppix);
+    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, ppix->master_pixmap);
 
     ppriv->notify_on_damage = TRUE;
 

hw/xfree86/drivers/modesetting/drmmode_display.c

@@ -398,7 +398,6 @@ drmmode_prop_info_copy(drmmode_prop_info_ptr dst,
 err:
     while (i--)
         free(dst[i].enum_values);
-    free(dst);
     return FALSE;
 }
 

hw/xfree86/drivers/modesetting/modesetting.man

@@ -14,10 +14,13 @@ modesetting \- video driver for framebuffer device
 .fi
 .SH DESCRIPTION
 .B modesetting
-is an @xservername@ driver for KMS devices.  This is a non-accelerated
-driver, the following framebuffer depths are supported: 8, 15, 16, 24.
-All visual types are supported for depth 8, and TrueColor visual is
-supported for the other depths.  RandR 1.2 is supported.
+is an @xservername@ driver for KMS devices.  This driver supports
+TrueColor visuals at framebuffer depths of 15, 16, 24, and 30. RandR
+1.2 is supported for multi-head configurations. Acceleration is available
+through glamor for devices supporting at least OpenGL ES 2.0 or OpenGL 2.1.
+If glamor is not enabled, a shadow framebuffer is configured based on the
+KMS drivers' preference (unless the framebuffer is 24 bits per pixel, in
+which case the shadow framebuffer is always used).
 .SH SUPPORTED HARDWARE
 The 
 .B modesetting
@@ -51,8 +54,18 @@ The framebuffer device to use. Default: /dev/dri/card0.
 .BI "Option \*qShadowFB\*q \*q" boolean \*q
 Enable or disable use of the shadow framebuffer layer.  Default: on.
 .TP
+.BI "Option \*qDoubleShadow\*q \*q" boolean \*q
+Double-buffer shadow updates. When enabled, the driver will keep two copies of
+the shadow framebuffer. When the shadow framebuffer is flushed, the old and new
+versions of the shadow are compared, and only tiles that have actually changed
+are uploaded to the device. This is an optimization for server-class GPUs with
+a remote display function (typically VNC), where remote updates are triggered
+by any framebuffer write, so minimizing the amount of data uploaded is crucial.
+This defaults to enabled for ASPEED and Matrox G200 devices, and disabled
+otherwise.
+.TP
 .BI "Option \*qAccelMethod\*q \*q" string \*q
-One of \*qglamor\*q or \*qnone\*q.  Default: glamor
+One of \*qglamor\*q or \*qnone\*q.  Default: glamor.
 .TP
 .BI "Option \*qPageFlip\*q \*q" boolean \*q
 Enable DRI3 page flipping.  The default is

hw/xfree86/fbdevhw/fbdevhw.c

@@ -329,6 +329,22 @@ fbdev_open(int scrnIndex, const char *dev, char **namep)
         return -1;
     }
 
+    /* only touch non-PCI devices on this path */
+    {
+        char buf[PATH_MAX];
+        char *sysfs_path = NULL;
+        char *node = strrchr(dev, '/') + 1;
+
+        if (asprintf(&sysfs_path, "/sys/class/graphics/%s", node) < 0 ||
+            readlink(sysfs_path, buf, sizeof(buf) < 0) ||
+            strstr(buf, "devices/pci")) {
+            free(sysfs_path);
+            close(fd);
+            return -1;
+        }
+        free(sysfs_path);
+    }
+
     if (namep) {
         if (-1 == ioctl(fd, FBIOGET_FSCREENINFO, (void *) (&fix))) {
             *namep = NULL;