cog: fix drm platform for kiosk use; pin meson options

Six upstream-ready patches against 0.18.5 (developed and verified on a
Dell Wyse 5010: radeon PALM/DCE4.1, both llvmpipe/SHM and r600/dmabuf
paths):

- 001: cold-start initialization. CRTC selection required an existing
  encoder binding (none exists without a prior fbcon/firmware modeset),
  kms_screen_create crashed on modeless connectors, init_cursor used
  the possibly-dead screens[0]. The incomplete display setup from the
  old CRTC selection is also what left DCE4.1's cursor fetch
  uninitialized - initially misdiagnosed as a hardware/kernel bug.
- 002: SHM exported-buffer handling. Root cause of a crash family: the
  renderer stored itself in the buffer resource's user_data, which for
  SHM buffers IS libwayland's wl_shm_buffer - from the second attach
  on, wl_shm_buffer_get() returned the renderer as buffer metadata.
  Plus early buffer release (avoids deferred pool-resize stale
  mappings) and copy hardening.
- 003: legacy hardware cursor (drmModeSetCursor) for non-atomic drivers
  without a universal cursor plane, with correct 64x64 tightly-packed
  premultiplied cursor image.
- 004: software cursor option (COG_PLATFORM_DRM_CURSOR=sw), composited
  into SHM frames with in-place motion updates; dmabuf-safe.
- 005: cursor.x/y are unsigned, so the existing 'if (cursor.x < 0)'
  lower clamp was dead code; moving past the top/left edge wrapped the
  position around and the upper clamp teleported the cursor to the
  opposite edge. Clamp in floating point before the unsigned store.
  Present upstream (master) as well.
- 006: scale the 16x16 cursor artwork by the view's device scale factor
  (nearest neighbour; up to 4x within the 64x64 hardware cursor buffer,
  same factor for the modeset renderer's software cursor), so the
  pointer keeps its apparent size next to a --device-scale'd UI.

Makefile: pin the complete meson option set of 0.18.5 (platforms
drm/headless/wayland, wpe_api 2.0, libmanette, plugin path).
PKG_RELEASE 9.

Patchset already proposed upstream:
Igalia/cog#794

Assisted-By: Claude Fable + Opus

Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>

Author: mirko

libs/cog/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cog
 PKG_VERSION:=0.18.5
-PKG_RELEASE:=1
+PKG_RELEASE:=9
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://wpewebkit.org/releases
@@ -44,7 +44,18 @@ libcogcore is a library with ready-to-use components typically needed
 for implementing applications which use the WPE WebKit API.
 endef
 
+# every meson option of this release pinned explicitly, so a version
+# bump cannot silently change the platform set or defaults
 MESON_ARGS += \
+	-Dplugin_path=/usr/lib/cog/modules \
+	-Dplatforms=drm,headless,wayland \
+	-Dprograms=true \
+	-Dwpe_api=2.0 \
+	-Dlibmanette=enabled \
+	-Dwayland_weston_direct_display=false \
+	-Dwayland_weston_content_protection=false \
+	-Dcog_appid=com.igalia.Cog \
+	-Dcog_home_uri= \
 	-Dcog_dbus_control=system \
 	-Dcog_dbus_system_owner=cog \
 	-Ddocumentation=false \

libs/cog/patches/001-drm-fix-cold-start-initialization.patch

@@ -0,0 +1,183 @@
+From 27f9125b3975310b19a78b6b86801ce557a216ba Mon Sep 17 00:00:00 2001
+From: Mirko Vogt <foss@mirko.in>
+Date: Sat, 18 Jul 2026 21:58:17 +0000
+Subject: [PATCH 1/6] drm: fix cold-start initialization
+
+On a display with no prior modeset (no fbcon/fbdev emulation, no
+firmware POST pass - e.g. a bootloader handing straight over to bare
+KMS), the drm platform failed to initialize:
+
+- The CRTC was picked only by matching an encoder's CURRENT binding
+  (encoder->crtc_id), which is 0 on cold start, aborting with "no crtc
+  for encoder found". Prefer the target connector's own encoders and
+  fall back to the first CRTC an encoder can drive (possible_crtcs).
+  This also fixes picking another output's encoder whose CRTC cannot
+  drive the chosen connector. Note that the incomplete display setup
+  resulting from the old selection is also what left e.g. radeon
+  DCE4.1's hardware cursor fetch uninitialized (cursor rendered as
+  garbage) - a full cold-start modeset cures that as well.
+
+- kms_screen_create() dereferenced con->modes[0] unconditionally; it
+  is NULL for disconnected/modeless connectors (any dual-output card
+  with one output unused), crashing at startup when the cursor is
+  enabled. A zeroed mode now marks the screen unusable.
+
+- init_cursor() used screens[0], which may be that dead connector;
+  pick the first usable screen. The initial cursor plane set may fail
+  while the CRTC is still off (first modeset happens at first frame
+  commit) - treat that as non-fatal, the pointer-motion handler
+  retries.
+
+Signed-off-by: Mirko Vogt <foss@mirko.in>
+---
+ platform/drm/cog-platform-drm.c | 75 ++++++++++++++++++++++++++-------
+ platform/drm/kms.c              | 12 ++++--
+ 2 files changed, 69 insertions(+), 18 deletions(-)
+
+diff --git a/platform/drm/cog-platform-drm.c b/platform/drm/cog-platform-drm.c
+index b9f28a8..da2c639 100644
+--- a/platform/drm/cog-platform-drm.c
++++ b/platform/drm/cog-platform-drm.c
+@@ -362,6 +362,15 @@ find_crtc_for_encoder(const drmModeRes *resources, const drmModeEncoder *encoder
+         }
+     }
+ 
++    /* Cold start: with no prior modeset (no fbcon/firmware POST) the
++     * encoder is bound to no CRTC yet (crtc_id == 0), so the match on
++     * the CURRENT binding above finds nothing. Fall back to the first
++     * CRTC this encoder can physically drive. */
++    for (int i = 0; i < resources->count_crtcs; i++) {
++        if (encoder->possible_crtcs & (1 << i))
++            return resources->crtcs[i];
++    }
++
+     /* no match found */
+     return -1;
+ }
+@@ -508,21 +517,35 @@ init_drm(void)
+             (long)((drm_data.mode - drm_data.connector.obj->modes) / sizeof(drmModeModeInfo *)), drm_data.mode->name,
+             drm_data.mode->vrefresh);
+ 
+-    /* Try the currently connected encoder+crtc */
+-    for (int i = 0; i < drm_data.base_resources->count_encoders; ++i) {
+-        drm_data.encoder = drmModeGetEncoder(drm_data.fd, drm_data.base_resources->encoders[i]);
+-        if (!drm_data.encoder) {
+-            /* cannot retrieve encoder, ignoring... */
++    /* Prefer THIS connector's own encoders: scanning all encoders can
++     * pick another output's encoder whose CRTC does not drive our
++     * connector. find_crtc_for_encoder() handles the cold-start case
++     * (no active CRTC binding yet) via its possible_crtcs fallback. */
++    for (int i = 0; i < drm_data.connector.obj->count_encoders && !drm_data.encoder; ++i) {
++        drmModeEncoder *enc = drmModeGetEncoder(drm_data.fd, drm_data.connector.obj->encoders[i]);
++        if (!enc)
+             continue;
++        const int32_t crtc_id = find_crtc_for_encoder(drm_data.base_resources, enc);
++        if (crtc_id != -1) {
++            drm_data.encoder = enc;
++            drm_data.crtc.obj_id = crtc_id;
++            break;
+         }
++        drmModeFreeEncoder(enc);
++    }
+ 
+-        const int32_t crtc_id = find_crtc_for_encoder(drm_data.base_resources, drm_data.encoder);
++    /* Last resort: any encoder that yields a CRTC. */
++    for (int i = 0; i < drm_data.base_resources->count_encoders && !drm_data.encoder; ++i) {
++        drmModeEncoder *enc = drmModeGetEncoder(drm_data.fd, drm_data.base_resources->encoders[i]);
++        if (!enc)
++            continue;
++        const int32_t crtc_id = find_crtc_for_encoder(drm_data.base_resources, enc);
+         if (crtc_id != -1) {
++            drm_data.encoder = enc;
+             drm_data.crtc.obj_id = crtc_id;
+             break;
+         }
+-
+-        g_clear_pointer (&drm_data.encoder, drmModeFreeEncoder);
++        drmModeFreeEncoder(enc);
+     }
+ 
+     if (!drm_data.encoder) {
+@@ -623,8 +646,10 @@ init_cursor (void)
+     }
+ 
+     cursor.device = kms_device_open(drm_data.fd);
+-    if (!cursor.device)
++    if (!cursor.device) {
++        g_warning("cursor: kms_device_open failed");
+         return FALSE;
++    }
+ 
+     cursor.plane = kms_device_find_plane_by_type(cursor.device, DRM_PLANE_TYPE_CURSOR, 0);
+     if (!cursor.plane) {
+@@ -640,21 +665,41 @@ init_cursor (void)
+ 
+     cursor.cursor = create_cursor_framebuffer(cursor.device, format);
+     if (!cursor.cursor) {
++        g_warning("cursor: framebuffer creation failed");
+         g_clear_pointer(&cursor.device, kms_device_free);
+         return FALSE;
+     }
+ 
+-    cursor.x = (cursor.device->screens[0]->width - cursor.cursor->width) / 2;
+-    cursor.y = (cursor.device->screens[0]->height - cursor.cursor->height) / 2;
+-    cursor.screen_width = cursor.device->screens[0]->width;
+-    cursor.screen_height = cursor.device->screens[0]->height;
+-
+-    if (kms_plane_set(cursor.plane, cursor.cursor, cursor.x, cursor.y)) {
++    /* screens[0] may be a disconnected/modeless connector (e.g. the
++     * unused second output of a dual-output card) - pick the first
++     * usable screen instead. */
++    struct kms_screen *cursor_screen = NULL;
++    for (unsigned int i = 0; i < cursor.device->num_screens; i++) {
++        if (cursor.device->screens[i]->connected && cursor.device->screens[i]->width > 0) {
++            cursor_screen = cursor.device->screens[i];
++            break;
++        }
++    }
++    if (!cursor_screen) {
++        g_warning("cursor: no usable screen (num_screens %u)", cursor.device->num_screens);
+         g_clear_pointer(&cursor.device, kms_device_free);
+         g_clear_pointer(&cursor.cursor, kms_framebuffer_free);
+         return FALSE;
+     }
+ 
++    cursor.x = (cursor_screen->width - cursor.cursor->width) / 2;
++    cursor.y = (cursor_screen->height - cursor.cursor->height) / 2;
++    cursor.screen_width = cursor_screen->width;
++    cursor.screen_height = cursor_screen->height;
++
++    /* The CRTC is usually not lit yet at platform setup time - the
++     * renderer performs the first modeset on the first frame commit -
++     * so this initial cursor upload may fail (display still off). Not
++     * fatal: the pointer-motion handler retries on every move and
++     * succeeds once a mode is active. */
++    if (kms_plane_set(cursor.plane, cursor.cursor, cursor.x, cursor.y))
++        g_message("cursor plane not set yet (display off?) - will appear on first pointer motion");
++
+     cursor.enabled = TRUE;
+ 
+     return TRUE;
+diff --git a/platform/drm/kms.c b/platform/drm/kms.c
+index 7b6d894..fe742f5 100644
+--- a/platform/drm/kms.c
++++ b/platform/drm/kms.c
+@@ -361,9 +361,15 @@ static void kms_screen_probe(struct kms_screen *screen)
+     else
+         screen->connected = false;
+ 
+-    memcpy(&screen->mode, &con->modes[0], sizeof(drmModeModeInfo));
+-    screen->width = screen->mode.hdisplay;
+-    screen->height = screen->mode.vdisplay;
++    /* Disconnected connectors (or connected ones without EDID) have no
++     * mode list - con->modes is NULL and count_modes 0. screen is
++     * calloc'd, so leaving mode/width/height zeroed marks the screen
++     * unusable instead of reading address 0. */
++    if (con->count_modes > 0 && con->modes) {
++        memcpy(&screen->mode, &con->modes[0], sizeof(drmModeModeInfo));
++        screen->width = screen->mode.hdisplay;
++        screen->height = screen->mode.vdisplay;
++    }
+ 
+     drmModeFreeConnector(con);
+ }

libs/cog/patches/002-drm-modeset-fix-shm-exported-buffer-handling.patch

@@ -0,0 +1,174 @@
+From 4cf80725cde25abc4b0c2751ad72e659d98ae858 Mon Sep 17 00:00:00 2001
+From: Mirko Vogt <foss@mirko.in>
+Date: Sat, 18 Jul 2026 21:58:17 +0000
+Subject: [PATCH 2/6] drm: modeset: fix SHM exported buffer handling
+
+Three related fixes for the modeset renderer's SHM path, found running
+WPE on software rendering (llvmpipe/kms_swrast):
+
+- Never store the renderer in the buffer resource's user_data: for SHM
+  buffers user_data is owned by libwayland's shm implementation - it IS
+  the wl_shm_buffer. Overwriting it made wl_shm_buffer_get() return the
+  renderer object from the second attach onwards: garbage width/stride,
+  spurious "deferred resize pending" warnings, and a crashing copy
+  loop. Keep the owning renderer in the buffer_object instead.
+
+- Release the exported SHM buffer right after copying it into the dumb
+  buffer instead of parking it until the frame retires: holding it
+  keeps an external reference on the wl_shm pool, deferring client-side
+  pool resizes into stale mappings.
+
+- Harden the copy: bail out on a NULL data pointer, clamp to the bo's
+  dimensions, and skip frames whose exported buffer carries impossible
+  geometry (dispatching frame-complete so the client's pacing
+  survives). Persistently bogus exports terminate the process for a
+  clean supervisor restart rather than continuing on corrupted state.
+
+Signed-off-by: Mirko Vogt <foss@mirko.in>
+---
+ platform/drm/cog-drm-modeset-renderer.c | 72 ++++++++++++++++++++-----
+ 1 file changed, 59 insertions(+), 13 deletions(-)
+
+diff --git a/platform/drm/cog-drm-modeset-renderer.c b/platform/drm/cog-drm-modeset-renderer.c
+index c1c91c2..dbaf2c4 100644
+--- a/platform/drm/cog-drm-modeset-renderer.c
++++ b/platform/drm/cog-drm-modeset-renderer.c
+@@ -74,6 +74,7 @@ struct buffer_object {
+     uint32_t            fb_id;
+     struct gbm_bo      *bo;
+     struct wl_resource *buffer_resource;
++    void               *renderer; /* owning CogDrmModesetRenderer */
+ 
+     struct {
+         struct wl_resource                 *resource;
+@@ -137,14 +138,13 @@ static void
+ destroy_buffer_notify(struct wl_listener *listener, void *data)
+ {
+     struct buffer_object  *buffer = wl_container_of(listener, buffer, destroy_listener);
+-    CogDrmModesetRenderer *renderer = wl_resource_get_user_data(buffer->buffer_resource);
++    CogDrmModesetRenderer *renderer = buffer->renderer;
+ 
+     if (renderer->committed_buffer == buffer)
+         renderer->committed_buffer = NULL;
+ 
+     wl_list_remove(&buffer->link);
+ 
+-    wl_resource_set_user_data(buffer->buffer_resource, NULL);
+     destroy_buffer(renderer, buffer);
+ }
+ 
+@@ -216,7 +216,7 @@ drm_create_buffer_for_bo(CogDrmModesetRenderer *self,
+     wl_list_insert(&self->buffer_list, &buffer->link);
+     buffer->destroy_listener.notify = destroy_buffer_notify;
+     wl_resource_add_destroy_listener(buffer_resource, &buffer->destroy_listener);
+-    wl_resource_set_user_data(buffer_resource, self);
++    buffer->renderer = self;
+ 
+     buffer->fb_id = fb_id;
+     buffer->bo = bo;
+@@ -271,7 +271,7 @@ drm_create_buffer_for_shm_buffer(CogDrmModesetRenderer *self,
+     wl_list_insert(&self->buffer_list, &buffer->link);
+     buffer->destroy_listener.notify = destroy_buffer_notify;
+     wl_resource_add_destroy_listener(buffer_resource, &buffer->destroy_listener);
+-    wl_resource_set_user_data(buffer_resource, self);
++    buffer->renderer = self;
+ 
+     buffer->fb_id = fb_id;
+     buffer->bo = bo;
+@@ -287,6 +287,19 @@ drm_copy_shm_buffer_into_bo(struct wl_shm_buffer *shm_buffer, struct gbm_bo *bo)
+     int32_t height = wl_shm_buffer_get_height(shm_buffer);
+     int32_t stride = wl_shm_buffer_get_stride(shm_buffer);
+ 
++    /* Never write past the bo - clamp and report a size mismatch
++     * (stale buffer_object?) instead of crashing. */
++    uint32_t pre_bo_width = gbm_bo_get_width(bo);
++    uint32_t pre_bo_height = gbm_bo_get_height(bo);
++    if ((uint32_t) width > pre_bo_width || (uint32_t) height > pre_bo_height) {
++        g_warning("SHM->bo size mismatch: shm %dx%d (stride %d) vs bo %ux%u - clamping",
++                  width, height, stride, pre_bo_width, pre_bo_height);
++        if ((uint32_t) width > pre_bo_width)
++            width = pre_bo_width;
++        if ((uint32_t) height > pre_bo_height)
++            height = pre_bo_height;
++    }
++
+     uint32_t bo_stride = 0;
+     void    *map_data = NULL;
+     gbm_bo_map(bo, 0, 0, width, height, GBM_BO_TRANSFER_WRITE, &bo_stride, &map_data);
+@@ -296,6 +309,11 @@ drm_copy_shm_buffer_into_bo(struct wl_shm_buffer *shm_buffer, struct gbm_bo *bo)
+     wl_shm_buffer_begin_access(shm_buffer);
+ 
+     uint8_t *src = wl_shm_buffer_get_data(shm_buffer);
++    if (!src) {
++        wl_shm_buffer_end_access(shm_buffer);
++        gbm_bo_unmap(bo, map_data);
++        return;
++    }
+     uint8_t *dst = map_data;
+ 
+     uint32_t bo_width = gbm_bo_get_width(bo);
+@@ -522,6 +540,8 @@ on_export_dmabuf_resource(void *data, struct wpe_view_backend_exportable_fdo_dma
+     }
+ }
+ 
++static unsigned bogus_streak = 0;
++
+ static void
+ on_export_shm_buffer(void *data, struct wpe_fdo_shm_exported_buffer *exported_buffer)
+ {
+@@ -530,20 +550,46 @@ on_export_shm_buffer(void *data, struct wpe_fdo_shm_exported_buffer *exported_bu
+     struct wl_resource   *exported_resource = wpe_fdo_shm_exported_buffer_get_resource(exported_buffer);
+     struct wl_shm_buffer *exported_shm_buffer = wpe_fdo_shm_exported_buffer_get_shm_buffer(exported_buffer);
+ 
+-    struct buffer_object *buffer = drm_buffer_for_resource(self, exported_resource);
+-    if (buffer) {
+-        drm_copy_shm_buffer_into_bo(exported_shm_buffer, buffer->bo);
+-
+-        buffer->export.shm_buffer = exported_buffer;
+-        drm_commit_buffer(self, buffer);
+-        return;
++    /* Never touch buffers with impossible geometry (a stale or dangling
++     * wl_shm_buffer, e.g. exported by a buggy backend): skip the frame
++     * instead of copying from/into wild memory. Do NOT release the
++     * wrapper - that would poke the possibly-dangling resource; leaking
++     * it is the lesser evil in an already-broken session. */
++    {
++        int32_t w = exported_shm_buffer ? wl_shm_buffer_get_width(exported_shm_buffer) : -1;
++        int32_t h = exported_shm_buffer ? wl_shm_buffer_get_height(exported_shm_buffer) : -1;
++        int32_t st = exported_shm_buffer ? wl_shm_buffer_get_stride(exported_shm_buffer) : -1;
++        g_debug("shm export: resource %p shm %p %dx%d stride %d",
++                (void *) exported_resource, (void *) exported_shm_buffer, w, h, st);
++        if (!exported_resource || w <= 0 || h <= 0 || w > 16384 || h > 16384 || st < w * 4) {
++            g_warning("shm export with bogus geometry (resource %p, shm %p, %dx%d stride %d) - frame skipped (streak %u)",
++                      (void *) exported_resource, (void *) exported_shm_buffer, w, h, st, ++bogus_streak);
++            if (bogus_streak >= 4) {
++                g_critical("persistent bogus SHM exports - exiting for a clean respawn");
++                exit(70);
++            }
++            /* keep the frame pacing alive - without this WebKit waits
++             * for the frame callback of the skipped frame forever */
++            wpe_view_backend_exportable_fdo_dispatch_frame_complete(self->exportable);
++            return;
++        }
++        bogus_streak = 0;
+     }
+ 
+-    buffer = drm_create_buffer_for_shm_buffer(self, exported_resource, exported_shm_buffer);
++    struct buffer_object *buffer = drm_buffer_for_resource(self, exported_resource);
++    if (!buffer)
++        buffer = drm_create_buffer_for_shm_buffer(self, exported_resource, exported_shm_buffer);
+     if (buffer) {
+         drm_copy_shm_buffer_into_bo(exported_shm_buffer, buffer->bo);
+ 
+-        buffer->export.shm_buffer = exported_buffer;
++        /* The dumb buffer owns the pixels now: release the client's SHM
++         * buffer right away instead of parking it until the frame retires.
++         * Holding it keeps an external reference on the wl_shm pool, which
++         * turns client-side pool resizes into deferred remaps - the next
++         * copy would then use a stale mapping (libwayland warns "Buffer
++         * address requested when its parent pool has an external reference
++         * and a deferred resize pending.") and walk off its end. */
++        wpe_view_backend_exportable_fdo_dispatch_release_shm_exported_buffer(self->exportable, exported_buffer);
+         drm_commit_buffer(self, buffer);
+     }
+ }