Also renames a bunch of other variables for better consistency.
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 229323a19b)
Report a fake screen mode that corresponds to the screen mode at startup of the
server excluding the height of the menu bar. If a client requests this mode,
rootless mode is enabled. In all other modes, the root window is shown.
Signed-off-by: Jan Hauffa <hauffa@in.tum.de>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 97b5f53064)
Querying and changing of resolution and refresh rate is supported,
rotation is not implemented yet.
Signed-off-by: Jan Hauffa <hauffa@in.tum.de>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 2d411472c2)
Program received signal SIGSEGV, Segmentation fault.
0x080d4a2d in xf86RandR12ScreenSetSize (pScreen=0x8dca3a0, width=800,
height=600, mmWidth=210, mmHeight=157)
at ../../../../hw/xfree86/modes/xf86RandR12.c:731
731 ../../../../hw/xfree86/modes/xf86RandR12.c: No such file or directory.
in ../../../../hw/xfree86/modes/xf86RandR12.c
(gdb) bt full
height=600, mmWidth=210, mmHeight=157)
at ../../../../hw/xfree86/modes/xf86RandR12.c:731
randrp = 0x8dcae68
pScrn = 0x8dbeb28
config = <value optimized out>
pRoot = 0x8e08e30
pScrnPix = 0xb6d12008
ret = 1
c = <value optimized out>
mmWidth=210, mmHeight=157) at ../../randr/rrscreen.c:185
No locals.
at ../../randr/rrscreen.c:307
pWin = 0x8e08e30
pScreen = 0x8dca3a0
i = <value optimized out>
rc = 0
../../randr/randr.c:485
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Julien Cristau <jcristau@debian.org>
Tested-by: Julien Cristau <jcristau@debian.org>
Cc: Keith Packard <keithp@keithp.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit fdabcec57a)
If a client sends a big request that's too big (i.e. bigger than
maxBigRequestSize << 2 bytes), the server just disconnects it. This makes the
client receive SIGPIPE the next time it tries to send something.
The X Test Suite sends requests that are too big when the test specifies the
TOO_LONG test type. When the client receives SIGPIPE, XTS marks it as
UNRESOLVED, which counts as a failure.
Instead, remember how long the request is supposed to be and then return that
size. Dispatch() checks the length and sends BadLength to the client. Then,
whenever oci->ignoreBytes is nonzero, ignore the data read instead of trying to
process it as a request.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit cf88363db0)
(note that nearly identical patches were proposed by Kristian and Chris)
Signed-off-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 2f0abd7d69)
The drain_console() function will race with new keyboard events being added
by the hardware causing the server to lose keyboard events if the console fd
is used for input.
Only use the drain_console() when AllowEmptyInput is off which is the best
indicator we have for whether the keyboard driver will be used. This patch
will only fix the bug when hotplugging is disabled.
What we really need is a way to figure out either whether we're _not_ using
the keyboard driver (not predictable) or a way for the keyboard driver to
disable drain_console().
X.Org Bug 29969 <http://bugs.freedesktop.org/show_bug.cgi?id=29969>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 71972c2534)
The Irxon Super Mini Bluetooth Wireless Keyboard for PC/PDA/Cell Phones
keyboards have axes but not buttons. The evdev driver doesn't set up a
button class for these keyboards and a motion event handled by
DGAProcessPointerEvent dereferences the dev->button NULL pointer, causing a
server crash.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit e00e2e7b68)
CurrentTime is used by clients to skip setting the time, but not by the
server.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 86560b5d05)
If the master does not have a button class, recalculating the number of
buttons required for this master dereferences a NULL pointer. Guard against
this, if the master pointer doesn't have a button class, it doesn't need to
update it's number of buttons.
Reproducible:
Two devices on the same master, device NB with axes but no buttons, device
A+B with axes and button .
If NB was the last one to send an event through the master when A+B is
removed from the server, master->button is NULL and leads to the above
NULL-pointer dereference.
X.Org Bug 29669 <http://bugs.freedesktop.org/show_bug.cgi?id=29669>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit ff055506f0)
The udev device_added function takes the vendor and model IDs of added
devices and converts them into an attribute that can be matched for by
an InputClass configuration using MatchUSBID. Currently, the udev
mechanism works for USB devices, but fails to work properly for
Bluetooth devices. The product IDs of the event node are actually the
IDs of the Bluetooth receiver instead of the device.
This patch reads the product ID from the PRODUCT property of the parent
of the added device. This tag is set correctly for both USB and
Bluetooth input devices. The following devices have been tested by
specifying individual InputClass sections in xorg.conf:
* Apple Keyboard (Bluetooth)
* Apple Magic Trackpad (Bluetooth)
* Apple Magic Mouse (Bluetooth)
* Microsoft Bluetooth Notebook Mouse 5000 (Bluetooth)
* Microsoft IntelliMouse Optical (USB)
* N-Trig Touchscreen (USB)
* Wacom Bamboo Touch (USB)
Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 7925e89456)
Document that terminate is not mapped to Ctrl+Alt+Backspace by default, to help alleviate some confusion.
Signed-off-by: Jesse Adkins <jesserayadkins@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 4a12aecac6)
Xorg.log shows error: Valuators reported for non-valuator device.
This is caused by uninitialized valuators.mask in _XkbFilterRedirectKey(),
which trigger the error in UpdateDeviceState().
Signed-off-by: David Ge <davidqge@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit a90052ba86)
Signed-off-by: Pauli Nieminen <ext-pauli.nieminen@nokia.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit b5c9953bbf)
map is allocated but not freed if reply length and data don't match.
Signed-off-by: Pauli Nieminen <ext-pauli.nieminen@nokia.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit adc0697cfc)
If fopen fails pointer in buf would be overwriten with a new pointer.
Signed-off-by: Pauli Nieminen <ext-pauli.nieminen@nokia.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 1223340644)
Devices that send motion events with valuators other than x/y get core
motion events with unchanged x/y coordinates. This confuses some
applications.
If the DeviceEvent does not have the x/y valuators set, return BadMatch on
core conversion, thus skipping the event altogether.
Reported-by: Bartosz Brachaczek <b.brachaczek@gmail.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Bartosz Brachaczek <b.brachaczek@gmail.com>
(cherry picked from commit de8be07cc0)
This was already removed for XWin (20701522be)
with no reported side effects. XQuartz seems to be behaving ok without it as
well. While this possibly brings back bug #1168, we don't have any reproduction
steps for that issue, and if it crops up again, we should fix it a real way
rather than this hokey workaround which doesn't even work for COMPOSITE.
This effectively reverts the following two changes:
b2135e589bd7fef52254
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
(cherry picked from commit 4e09a69c5b)
The SELinux extension does store a security label in the screen
devPrivates. Fixes crash caused by overwriting another private.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
Reported-by: Justin Mattock <justinmattock@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 9a1a4ccbe0)
Selection objects were not being allocated with privates, and both
objects had a stray statement that zeroed out the devPrivates field.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
Reported-by: Justin Mattock <justinmattock@gmail.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 9ef6241c23)
A window with either dimension > 32767 can be positioned such that
coordinates > 32767 are visible on the screen. Attempts to draw to
those pixels will generate coordinates wrapped around to negative
values.
The optimized clipping macro, 'isClipped', in fbbits.h, computes
clipping in window space rather than screen space using int16 values,
and so it too has coordinates wrapped around to negative values and
hence ends up accepting the wrapped drawing coordinates.
Two possible fixes for this problem
1) Detect wrapped region coordinates and clip those to 32767.
2) Detect negative incoming coordinates and reject those
This patch takes the second approach as it is much shorter, simply
detecting when either X or Y incoming coordinate is negative, which
can never be 'within' any drawable.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
A simple hack to accommodate various EDID who have detailed modes that
exceed the EDID's max pixel clock. The pixel clock is only defined in
units of 10MHz and often appears as the maximum pixel code of the
detailed modes, rounded to the nearest 10MHz. Adjusting the max_clock to
include an extra 5MHz prevents the parser from rejecting the detailed
modes.
The kernel uses the same fuzz and by including it in X we can use the
same modes in X as for the console.
Fixes:
Bug 23833 - X uses different refresh rate to that set by kernel module
https://bugs.freedesktop.org/show_bug.cgi?id=23833
In the future, we will want to try harder to keep the KMS modes but at
the same time we need to apply the restrictions as specified by the
user's configuration, and need to fill in modes for fullscreen games on
fixed-mode panels.
Reported-and-tested-by: Fabio Pedretti <fabio.ped@libero.it>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
During a SwapBuffers request, we may end up querying an unknown drawable
outside of an active context, and so need to report this error prior to
attempting to dereference the NULL context.
Also fixes:
[Bug 29184] glXSwapBuffers with no GLX context crashes X.
https://bugs.freedesktop.org/show_bug.cgi?id=29184
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Kristian Høgsberg <krh@bitplanet.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
GPE and friends modify the valuators array passed in. Which means any driver
using e.g. xf86PostButtonEventP(..., valuators) twice to emulate a button
click will provide garbage data on the second run.
This is currently affecting the wacom driver, xf86PostButtonEventP() with
valuators is required to have input events with device-specific axis values.
Passing the same valuators in twice, once with press, once with release,
will see the valuators modified in the first call and garbage submitted in
the next one.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
From: Dave Airlie <airlied@linux.ie>
We were seeing a crash in the FreeAllResources codepath,
running valgrind revealed this,
==12536== Invalid read of size 4
==12536== at 0x810BCAB: DeliverPropertyEvent (rrproperty.c:33)
==12536== by 0x80958A4: TraverseTree (window.c:227)
==12536== by 0x809593E: WalkTree (window.c:255)
==12536== by 0x810BC66: RRDeliverPropertyEvent (rrproperty.c:53)
==12536== by 0x810BD5D: RRDeleteProperty.clone.0 (rrproperty.c:76)
==12536== by 0x810BD98: RRDeleteAllOutputProperties (rrproperty.c:88)
==12536== by 0x810A36E: RROutputDestroyResource (rroutput.c:407)
==12536== by 0x808DF4E: FreeClientResources (resource.c:859)
==12536== by 0x808E005: FreeAllResources (resource.c:876)
==12536== by 0x8062300: main (main.c:305)
==12536== Address 0x46ba8ac is 4 bytes inside a block of size 164 free'd
==12536== at 0x40057F6: free (vg_replace_malloc.c:325)
==12536== by 0x8087F1F: _dixFreeObjectWithPrivates (privates.c:357)
==12536== by 0x809832A: DeleteWindow (window.c:926)
==12536== by 0x808DF4E: FreeClientResources (resource.c:859)
==12536== by 0x808E005: FreeAllResources (resource.c:876)
==12536== by 0x8062300: main (main.c:305)
Its a use after free on the root window, since we have already deleted it
at this point. This patch checks if the window we are destroying is the root
window and resets the pointer to NULL if it is.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Tested-by: Dave Airlie <airlied@redhat.com>
We still have the issue with not raising the frontmost window for the case
when spaces is enabled, and the AppleSpacesSwitchOnActivate preference is
disabled.
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
None of them do anything useful now that pointer acceleration is
entirely handled in the server. (Does not completely nuke yet,
since that would be an API/ABI break.)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
When the parser sees the "keyboard" driver, it automatically (and
silently) replaces it with the constant string "kbd".
Everybody else uses malloc'd memory for the driver name, so input
device closure assumes it can use free.
Free val.str, so this crash doesn't turn into a memory leak. Whew.
Signed-off-by: Jesse Adkins <jesserayadkins@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
After copying the unused_classes into the device, reset the original
pointer. Otherwise we have two pointers pointing to the same field and both
get freed on device removal.
Some classes already have this behaviour since 51c8fd69.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
If the button we're about to fake isn't down (or up), don't fake a release
(or press) event for it. Behaviour is the same as before, this just saves
a few cycles.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
commit 1432785839
xkb: release XTEST pointer buttons on physical releases. (#28808)
revealed a bug with the XTEST/PointerKeys interaction.
Events resulting from PointerKeys are injected into the event processing
stream, not appended to the event queue. The events generated for the fake
button press include a DeviceChangedEvent (DCE), a raw button event and the
button event itself. The DCE causes the master to switch classes to the
attached XTEST pointer device.
Once the fake button is processed, normal event processing continues with
events in the EQ. The master still contains the XTEST classes, causing some
events to be dropped if e.g. the number of valuators of the event in the
queue exceeds the XTEST device's number of valuators.
Example: the EQ contains the following events, processed one-by-one, left to
right.
[DCE (dev)][Btn down][Btn up][Motion][Motion][...]
^ XkbFakeDeviceButton injects [DCE (XTEST)][Btn up]
Thus the event sequence processed looks like this:
[DCE (dev)][Btn down][Btn up][DCE (XTEST)][Btn up][Motion][Motion][...]
The first DCE causes the master to switch to the device. The button up event
injects a DCE to the XTEST device, causing the following Motion events to be
processed with the master still being on XTEST classes.
This patch post-fixes the injected event sequence with a DCE to restore the
classes of the original slave device, resulting in an event sequence like
this:
[DCE (dev)][Btn down][Btn up][DCE (XTEST)][Btn up][DCE (dev)][Motion][Motion]
Note that this is a simplified description. The event sequence injected by
the PointerKeys code is injected for the master device only and the matching
slave device that caused the injection has already finished processing on
the slave. Furthermore, the injection happens as part of the the XKB layer,
before the unwrapping of the processInputProc takes us into the DIX where
the DCE is actually handled.
Bug reproducible with a device that reports more than 2 valuators. Simply
cause button releases on the device and wait for a "too many valuators"
warning message.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Keith Packard <keithp@keithp.com>
The callback data passed by reference to the hook was allocated on stack
within the scope of the case statement. The compiler is free to reuse
any of that stack space whilst making the function call so we may end up
passing garbage into the callback.
References:
Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
https://bugs.freedesktop.org/show_bug.cgi?id=18451
v2: Drop the unrelated hunk that snuck in when ammending the commit
message.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
Commit 9de0e31746 changed the signature
of __GLXScreen's createDrawable method.
Update the glxWinCreateDrawable() function in XWin's GLX provider
appropriately.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Tested-by: Colin Harrison <colin.harrison@virgin.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
Recursive alpha maps (where one picture's alpha map is set to a
picture with an external alpha map) would be all fine and dandy,
except for the case where the client constructs a loop. Detecting this
case when setting the alpha map values would be difficult as any time
an alpha map is set, the server would have to check for the looping
case.
Instead, a far simpler fix is to simply disallow recursive alpha maps
in the rendering code, the Render spec is ambiguous in this area and
allows us to to ignore the recursive case.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
IsFramedWindow() is called from miPaintWindow() if the server has
been built with ROOTLESS defined, irrespective of if RootlessInit()
has ever been called, or not.
Add a check to IsFramedWindow() to check if rootlessWindowPrivateKey
has been registered (as a proxy for checking if the rootless extension
has been initialized) so we don't go on to try to use that key,
triggering an assert.
This bug exposes what appears to be a difference in opinion about
the rootless extension between XQuartz and XWin. XQuartz always
initializes the rootless extension, whereas XWin offers several modes
of operation, and the rootless extension is only used for one of them
That probably means that the all code under compile time guard for
ROOTLESS should be carefully checked that it doesn't also need to be
under a run-time guard
(I've reviewed the other ROOTLESS blocks in dix/events.c and
dix/window.c and they look ok -- keithp)
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
When doing Xinerama, we'll dispatch font ops across all backend screens.
If using a font server (such that some operations can sleep), we'll put
the client to sleep once for each screen, but only wake up once, because
we're trying to keep track of the sleep count in _each_ screen's
closure.
Instead, just ask the core whether the client is already asleep.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
The dtrace doc was recently added in commit
9c171d4aee
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Gaetan Nadon <memsize@videotron.ca>
