When ResetCurrentRequest is called, or IgnoreClient is called when a
client has input pending, IgnoredClientsWithInput will be set. However,
a subsequent IgnoreClient request will clear the client fd from that fd
set, potentially causing the client to hang.
So add an Ignore/Attend count, and only apply the ignore logic on the
first ignore and the attend logic on the last attend. This is
consistent with the comments for these functions; callers must pair
them.
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=27035.
Reviewed-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
Detect if a drawable has been moved from an original crtc to a new crtc
with a lower current vblank count than the original crtc inbetween
glXSwapBuffers() calls. Reinitialize drawable's last_swap_target
before scheduling next swap if such a move has taken place.
last_swap_target defines the baseline for scheduling the next swap.
If a movement between crtc's is not taken into account, the swap may
schedule for a vblank count on the new crtc far in the future, resulting
in a apparent "hang" of the drawable for a long time.
Fixes Bugzilla bug #28383.
Signed-off-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 75beadd766)
In case you want to copy a region with source = dest, you have the same pixmap
as source and dest.
At the end of exaPixmapIsOffscreen_classic() the devPrivate.ptr is reset to
NULL (look at the sources).
Now this is what happens in ExaCheckCopyNtoN:
exaPrepareAccess( pDst );
Calls IsOffscreen()
sets devPrivate.ptr to NULL
sets up devPrivate.ptr to real pointer
Everything OK
exaPrepareAccess( pSrc );
Calls IsOffscreen()
sets devPrivate.ptr to NULL
BAILS OUT CAUSE OF NESTED OPERATION SINCE DST EQUALS SRC
We end up with devPrivate.ptr as NULL, and that is clearly wrong.
In particular this fixes a segfault when using the psb driver (bug 28077)
Signed-off-by: Éric Piel <eric.piel@tremplin-utc.net>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7e8f100121)
The modifier key count is maintained by the XKB layer and
increased/decreased for all modifiers that set state.
Test case, MD/SD modifier key count in comment:
1. keyboard 1: press and hold Shift_L # SD:1 MD:1
2. keyboard 2: press and release Shift_L # SD:1,0 MD:1,0
<class copy happens> # SD:1 MD:1
3. keyboard 1: release Shift_L # SD:0 MD:1
4. keyboard 1: press and release Shift_L # SD:1,0 MD:2,1
The modifier is now logically down on the MD but not on keyboard 1 or
keyboard 2.
XKB is layered in before the DIX, it increases/decreases the modifier key
count accordingly. In the above example, during (2), the MD gets the key
release and thus clears the modifier bit. (3) doesn't forward the release to
the MD because it is already cleared. The copy of modifierKeysDown when the
lastSlave changes however increases the counter for the held key. On (4),
the press and release are both forwarded to the MD, causing a offset by 1
and thus do not clear the logical modifier state.
X.Org Bug 25480 <http://bugs.freedesktop.org/show_bug.cgi?id=25480>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Daniel Stone <daniel@fooishbar.org>
(cherry picked from commit dc614484f9)
DRI2WaitSBC() didn't block if requested targetSBC wasn't yet reached.
Instead it returned a xreply with uninitialized junk return values, then
blocked the connection until targetSBC was reached.
Therefore the client didn't block, but continued with bogus return
values from glXWaitForSbcOML.
This patch fixes the problem by implementing DRI2WaitSBC similar
to the clean and proven DRI2WaitMSC implementation.
Signed-off-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit b3548612c7)
Conflicts:
hw/xfree86/dri2/dri2ext.c
Classic strlen/strcpy mistake of
foo = malloc(strlen(bar));
strcpy(foo, bar);
Testcase: valgrind Xephyr :1
==8591== Invalid write of size 1
==8591== at 0x4A0638F: strcpy (mc_replace_strmem.c:311)
==8591== by 0x605593: _XkbCopyGeom (xkbUtils.c:1994)
==8591== by 0x605973: XkbCopyKeymap (xkbUtils.c:2118)
==8591== by 0x6122B3: InitKeyboardDeviceStruct (xkbInit.c:560)
==8591== by 0x4472E2: CoreKeyboardProc (devices.c:577)
==8591== by 0x447162: ActivateDevice (devices.c:530)
==8591== by 0x4475D6: InitCoreDevices (devices.c:672)
==8591== by 0x4449EE: main (main.c:254)
==8591== Address 0x6f96505 is 0 bytes after a block of size 53 alloc'd
==8591== at 0x4A0515D: malloc (vg_replace_malloc.c:195)
==8591== by 0x6054B7: _XkbCopyGeom (xkbUtils.c:1980)
==8591== by 0x605973: XkbCopyKeymap (xkbUtils.c:2118)
==8591== by 0x6122B3: InitKeyboardDeviceStruct (xkbInit.c:560)
==8591== by 0x4472E2: CoreKeyboardProc (devices.c:577)
==8591== by 0x447162: ActivateDevice (devices.c:530)
==8591== by 0x4475D6: InitCoreDevices (devices.c:672)
==8591== by 0x4449EE: main (main.c:254)
Reported-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by-and-apologised-for: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7f19a7a6e9)
Conflicts:
xkb/xkbUtils.c
miDbePositionWindow allocates two pixmaps: a front buffer, and a back buffer.
If the buffers are supposed to be initialized, it validates a GC against the
front buffer, then uses it to fill and/or copy both the front buffer *and* the
back buffer, without revalidating. If the acceleration architecture needs
different GC funcs for the two pixmaps -- for example if allocation of the front
buffer exhausted video memory -- then this can cause crashes because the GC is
not validated for the back buffer pixmap.
Fix this by performing the rendering for the front buffer first, then
revalidating against the back buffer before performing the back buffer
rendering.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 1304b8b27c)
We just never initialised the malloced value.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 91a6359caf)
Makes the use of IsMaster in ProcChangeKeyboardControl consistent with other
similar loops.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 968a79dcf5)
Reverts part of the effects of 518f3b189b,
"mi: don't thrash resources when displaying the software cursor across
screens". The per-screen cache is preserved, and the GCs are still
allocated eagerly, but now it doesn't construct pRootPicture until
somebody attempts to draw an ARGB cursor.
I noticed crashes in Xnest, which doesn't support the RENDER extension,
but I suspect other DDXes that support disabling that extension would
have had issues as well.
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Pierre-Loup A. Griffais <pgriffais@nvidia.com>
(cherry picked from commit bf78e11839)
Some pixmaps (window pixmaps and scratch pixmaps) don't have the
drawable->id set and thus DRI2 gets confused when using that field
for looking up the DRI2 drawable. Go back to using privates for getting
at the DRI2 drawable from a DrawablePtr. We need to keep the resource
tracking in place so we can remove the DRI2 drawable when the X resource
it was created for goes away. Additionally, we also now track the DRI2
drawable using a client XID so we can reclaim the DRI2 drawable even if
the client goes before the drawable and doesn't destroy the DRI2 drawable.
Tested-by: Owen W. Taylor <otaylor@fishsoup.net>
Signed-off-by: Kristian Høgsberg <krh@bitplanet.net>
(cherry picked from commit 9de0e31746)
Conflicts:
hw/xfree86/dri2/dri2.c
If we use the #define'd version from dri_interface.h, the server will
require at least that version of the extension. If we're compiling against
a dri_interface.h with a newer version we don't really require, glxdri2
will require a too high version of the extension.
The right approach is to just hard-code the version we need instead of
using the #defines.
Signed-off-by: Kristian Høgsberg <krh@bitplanet.net>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 4a8a615d01)
FreeResource() keeps clientTable[cid].elements up to date with the
number of resources allocated to the client. The other free
resource functions (FreeResourceByType(),
FreeClientNeverRetainResources() and FreeClientResources()) don't
maintain this invariant.
Typically, the only consequence is that the element count is too high
and we end up allocating the hash table bigger than necessary. However,
FreeResource() also relies on the element count to restart the search if
the list of resources has been changed during a resource destruction
callback. Since FreeResourceByType() doesn't update the count, if we call
that from a resource destruction callback from FreeResource(), the
loop isn't restarted and we end up following an invalid next pointer.
Furthermore, LookupClientResourceComplex() and
FreeClientNeverRetainResources() don't use the element count to detect
if a callback deleted a resource and may end up following an invalid
next pointer if the resource system is called into recursively.
Signed-off-by: Kristian Høgsberg <krh@bitplanet.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 6d7ba5e0fc)
attr->tags is an array of strings (null-terminated). When matching, match
against each string instead of each [i,end] substring in the first tag.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit b5e0f6d8f4)
When Xorg is started on display :0, this ioctl is called to grant the
user the rights traditionally associated with /dev/console (before VT
support was added), such as access to local peripheral devices.
Also adds a Solaris-specific -C flag to force starting on /dev/console
instead of /dev/vt*, allowing programs like xterm -C to access the
console device.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 989db930d7)
- Note that -br is now default.
- Move -bs after -br for alphabetical ordering.
- Remove -config option that's been hidden in "ignore" section,
since ajax removed the -config code a couple years back.
- Add -nocursor option.
- Add xinput & xrandr to list of runtime server control programs
- Replace XDarwin with Xquartz in list of Xservers
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7b09335a46)
The code this comment was referring to was removed in
8b5086250a "Eliminate bogus event resizing."
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit cf4f3d0518)
ActivateDevice was ignoring errors from DeviceCursorInitialize, so
cursor-related calls failed later. Jeremy Huddleston saw that crash in
miPointerConstrainCursor, while with Xvfb I saw it in
miSpriteRealizeCursor.
miDCDeviceCleanup frees any non-NULL GCs. miDCDeviceInitialize calls
Cleanup on any failure, but if it failed early then some of the pointers
in the miDCBufferPtr were garbage. Switch from malloc to calloc to
ensure everything's initialized safely first.
With these two fixes, if CreateGC fails then the server gracefully fails
in FatalError instead of segfaulting.
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Cc: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry-picked from commit b9f48d60bc)
Export DDX swap control status from the DRI2 module and check for it in
GLX when initializing extensions.
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit 165a4a9c7d)
If a few swaps were queued leading to a throttle related block on the
client, and then the client submitted an MSC wait, one of the previous
swap wakeups could have caused the MSC wait to complete early. Add a
flag for this to prevent a swap wake from prematurely waking an MSC
waiter.
Reported-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit 5933b0abc6)
Avoid a potential swapsPending underflow by incrementing it before
ScheduleSwap, which may complete it immediately. And be sure to
decrement it again in case the schedule failed.
Reported-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit b00d435ddf)
We need to throttle swaps here in addition to when the context is made
current to avoid causing problems with clients that just swap.
Throttling here also ensures our swaps get ordered as long as we block
the client occasionally.
Reported-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit 0294ff2a5c)
Update our supported DRI2 protocol version as each driver does
DRI2ScreenInit, since depending on available kernel features, each DDX
may support different callbacks and therefore protocol.
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit db1c7cb604)
A 0 swap interval means that swaps shouldn't be sync'd to vblank, so
just complete the swap immediately in that case.
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit 87ca6320f2)
Handle drawable destruction and lifetime correctly.
Check whether the drawable priv is valid in DRI2SwapInterval(),
DRI2WaitSBC() and DRI2WaitMSC(); it may have gone away, so be sure to
check it before using it.
If more than 1 outstanding swap is queued, we may complete several after
an app has exited. If we free it after the first one completes and the
refcount reaches 0, we'll crash the server on subsequent completions.
So delay freeing until all swaps complete and remove the error message
as this is a normal occurence. To do this properly, we must also avoid
destroying drawables in DRI2DestroyDrawable() if a swap or wait event is
pending.
And finally, make sure we free drawables in DRI2WaitMSCComplete() if
necessary (i.e. if the refcount has reached 0 and this MSC was the last
pending event on the object).
Reported-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit 8476d99231)
Returns expected SBC after completion of swap to caller, as required by
OML_sync_control spec, instead of the last_swap_target value.
Passes target_msc, divisor, remainder, correctly for
glXSwapBuffersMscOML() call, while retaining old behaviour for simple
glXSwapBuffers() call.
An OML swap can have a 0 target_msc, which just means it needs to
satisfy the divisor/remainder equation. Pass this down to the driver as
needed so we can support it.
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
(cherry picked from commit b180e43977)
Added implementation for case target_sbc == 0. In that case, the
function shall schedule a wait until all pending swaps for the drawable
have completed.
Fix for non-blocking case. Old implementation returned random,
uninitialized values for (ust,msc,sbc) if it returned immediately
without scheduling a wait due to sbc >= target_sbc.
Now if function doesn't schedule a wait, but returns immediately,
it returns the (ust,msc,sbc) of the most recently completed swap,
i.e., the UST and MSC corresponding to the time when the returned
current SBC was reached.
Signed-off-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
(cherry picked from commit 751e8c09d3)
DRI2SwapComplete(): Increment pPriv->swap_count++; before calling
into callback for INTEL_swap_events extension, so the swap event
contains the current SBC after swap completion instead of the
previous one.
DRI2WakeupClient: Check for pPriv->target_sbc <= pPriv->swap_count,
had wrong comparison pPriv->target_sbc >= pPriv->swap_count for
unblocking of clients of DRI2WaitSBC().
Signed-off-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
(cherry picked from commit 0de4974b90)
We need to track invalid targets as well as 0 targets, so just make it
signed so our comparisons work like they should.
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Reported-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit 4c8ec49826)
We need to initialize the swap target, which is passed to the driver to
schedule events. Rather than using -1 to indicate that the field is
uninitialized, just make sure we initialize it at drawable creation
time.
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
(cherry picked from commit c4d54816f2)
The driver may decide that the pixmap is too large or something and
fail to allocate a pixmap; not checking would lead to a segfault.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
(cherry picked from commit 87ea5760f8)
OpenSolaris recently added support for the getifaddrs() API.
Building with that uncovered two compiler issues (one warning, one error)
in the code that was now being built for the first time in our builds:
"access.c", line 768: warning: argument #1 is incompatible with prototype:
prototype: pointer to struct sockaddr {unsigned short sa_family, array[14] of char sa_data} : "access.c", line 213
argument : pointer to struct sockaddr_storage {unsigned short ss_family, array[6] of char _ss_pad1, double _ss_align, array[240] of char _ss_pad2}
"access.c", line 838: assignment type mismatch:
struct sockaddr {unsigned short sa_family, array[14] of char sa_data} "=" struct sockaddr_storage {unsigned short ss_family, array[6] of char _ss_pad1, double _ss_align, array[240] of char _ss_pad2}
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
(cherry picked from commit e42a29d269)
XInputExtensionInit calls MakeAtom, which doesn't work without the atoms
table initialized.
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Cc: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit c6613cfc26)
Upon resume, X may try to dereference a null pointer, which has been
reported in Debian bug #507916 (http://bugs.debian.org/507916).
Jim Paris came up with a patch which solves the problem for him. Here's
a (hopefully) fixed version of his patch (without the typo).
Cc: Jim Paris <jim@jtan.com>
Signed-off-by: Cyril Brulebois <kibi@debian.org>
Reviewed-By: Matthias Hopf <mhopf@suse.de>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit fa6c701257)
GetPairedDevice() may not always return the keyboard, resulting in a
null-pointer dereference when accessing the XKB state.
For floating devices, the GetMaster() returns the device itself.
X.Org Bug 27573 <http://bugs.freedesktop.org/show_bug.cgi?id=27573>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Tested-by: Ben Hutchings <ben@decadent.org.uk>
(cherry picked from commit 10de9e8ee3)
Currently, SyncComputeBracketValues reuses old values of bracket_greater
and bracket_less when startOver = FALSE. This can result in incorrect bracket
values. To fix this issue, the startOver parameter is removed, and we do not
reuse old values of bracket_greater and bracket_less.
X.Org Bug 27023 <http://bugs.freedesktop.org/show_bug.cgi?id=27023>
Signed-off-by: David James <davidjames@google.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 758b861447)
miPolyPoint ought to leave the GC unchanged even if it fails. ajax says:
> We have a new winner for the oldest-bug competition! It's actually
> been like that since X11R1:
>
> -rw-r--r--. 1 ajax ajax 2817 1987-09-12 01:20 ddx/mi/mipolypnt.c
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 4080cd42fd)
Presumably no implications, especially security-wise.
Signed-off-by: Matthias Hopf <mhopf@suse.de>
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit e2e2747f40)
