xwayland: attach a client's SysV shm segment through the sysvshm server
Problem
Under gamescope, SteamWorld Dig 2 (and any GL game on the xlib software winsys) tears horizontally. Mesa's xlib winsys tries MIT-SHM; Xwayland answers ShmAttach with BadAccess, so every frame goes out as XPutImage, which Xlib splits into 15 row bands of 1280x51 (classic 256 KB request limit). Xwayland commits between bands, so the scanned-out frame is part new, part old.
Measured with a traced Xwayland on a Retroid Pocket 6: 15 PutImage requests per frame, commits landing mid-frame.
Cause
Guest SysV shm is emulated by the app's sysvshm server. Every guest process, Xwayland included, preloads libandroid-sysvshm.so, whose shmat() only resolves ids the calling process created. The game's segment is unknown in Xwayland and ProcShmAttach returns BadAccess. (That library's shmat() also leaves its return register untouched for an unknown id instead of returning -1, so the failure only shows at the IPC_STAT that follows; the import therefore sits in the combined failure branch.)
Fix
When the SysV attach fails and ANDROID_SYSVSHM_SERVER is set, ask the server for the segment's fd (request GET_FD, the same request the client library uses) and attach it like an fd-passed MIT-SHM segment (is_fd, mmap, busfault). shm_tmpfile_size() now matches named ashmem regions (/dev/ashmem/sysvshm-N (deleted)), which the fd-passing path needed too. No change to the container, the client library, or the game process. The server runs under the app's uid, so the SysV permission check does not apply. Outcome is logged at default verbosity.
Verification (RP6, same scripted map-toggle scene, 30 s screenrecord, tear detector, pristine container, shipped client library)
| Xwayland | frames | tears | fps |
|---|---|---|---|
| shipped (payload 20261101.1) | 1803 | 13 | 59.75 |
| this branch (CI 41314597152, sha 4dded856) | 1801 | 0 | 59.73 |
Log: (II) gn: ShmAttach: SysV id 6 (3686400 bytes) attached via the sysvshm server; Xwayland maps the segment (/dev/ashmem/sysvshm-6); recording has the same motion profile as the control (170 vs 187 distinct frames).
Stacked on xwayland-no-implicit-sync-gamenative (#1). Delivery: merge, point gamescope#25's workflow at the merged ref, rebuild the payload.