A simple hack to accommodate various EDID who have detailed modes that
exceed the EDID's max pixel clock. The pixel clock is only defined in
units of 10MHz and often appears as the maximum pixel code of the
detailed modes, rounded to the nearest 10MHz. Adjusting the max_clock to
include an extra 5MHz prevents the parser from rejecting the detailed
modes.
The kernel uses the same fuzz and by including it in X we can use the
same modes in X as for the console.
Fixes:
Bug 23833 - X uses different refresh rate to that set by kernel module
https://bugs.freedesktop.org/show_bug.cgi?id=23833
In the future, we will want to try harder to keep the KMS modes but at
the same time we need to apply the restrictions as specified by the
user's configuration, and need to fill in modes for fullscreen games on
fixed-mode panels.
Reported-and-tested-by: Fabio Pedretti <fabio.ped@libero.it>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 951605b466)
Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 5725849a1b)
The callback data passed by reference to the hook was allocated on stack
within the scope of the case statement. The compiler is free to reuse
any of that stack space whilst making the function call so we may end up
passing garbage into the callback.
References:
Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
https://bugs.freedesktop.org/show_bug.cgi?id=18451
v2: Drop the unrelated hunk that snuck in when ammending the commit
message.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 6dae7f3792)
Classic strlen/strcpy mistake of
foo = malloc(strlen(bar));
strcpy(foo, bar);
Testcase: valgrind Xephyr :1
==8591== Invalid write of size 1
==8591== at 0x4A0638F: strcpy (mc_replace_strmem.c:311)
==8591== by 0x605593: _XkbCopyGeom (xkbUtils.c:1994)
==8591== by 0x605973: XkbCopyKeymap (xkbUtils.c:2118)
==8591== by 0x6122B3: InitKeyboardDeviceStruct (xkbInit.c:560)
==8591== by 0x4472E2: CoreKeyboardProc (devices.c:577)
==8591== by 0x447162: ActivateDevice (devices.c:530)
==8591== by 0x4475D6: InitCoreDevices (devices.c:672)
==8591== by 0x4449EE: main (main.c:254)
==8591== Address 0x6f96505 is 0 bytes after a block of size 53 alloc'd
==8591== at 0x4A0515D: malloc (vg_replace_malloc.c:195)
==8591== by 0x6054B7: _XkbCopyGeom (xkbUtils.c:1980)
==8591== by 0x605973: XkbCopyKeymap (xkbUtils.c:2118)
==8591== by 0x6122B3: InitKeyboardDeviceStruct (xkbInit.c:560)
==8591== by 0x4472E2: CoreKeyboardProc (devices.c:577)
==8591== by 0x447162: ActivateDevice (devices.c:530)
==8591== by 0x4475D6: InitCoreDevices (devices.c:672)
==8591== by 0x4449EE: main (main.c:254)
Reported-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by-and-apologised-for: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7f19a7a6e9)
Conflicts:
xkb/xkbUtils.c
(cherry picked from commit f85552aa45)
Signed-off-by: Julien Cristau <jcristau@debian.org>
While VT-switched, FB access is disabled and should remain so. Trying to switch
modes in that state would re-enable it, potentially causing crashes if trying
to access it before the driver has recovered from the mode switch.
Signed-off-by: Pierre-Loup A. Griffais <pgriffais@nvidia.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 41bdb6c003)
Signed-off-by: Julien Cristau <jcristau@debian.org>
In case you want to copy a region with source = dest, you have the same pixmap
as source and dest.
At the end of exaPixmapIsOffscreen_classic() the devPrivate.ptr is reset to
NULL (look at the sources).
Now this is what happens in ExaCheckCopyNtoN:
exaPrepareAccess( pDst );
Calls IsOffscreen()
sets devPrivate.ptr to NULL
sets up devPrivate.ptr to real pointer
Everything OK
exaPrepareAccess( pSrc );
Calls IsOffscreen()
sets devPrivate.ptr to NULL
BAILS OUT CAUSE OF NESTED OPERATION SINCE DST EQUALS SRC
We end up with devPrivate.ptr as NULL, and that is clearly wrong.
In particular this fixes a segfault when using the psb driver (bug 28077)
Signed-off-by: Éric Piel <eric.piel@tremplin-utc.net>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7e8f100121)
Upon resume, X may try to dereference a null pointer, which has been
reported in Debian bug #507916 (http://bugs.debian.org/507916).
Jim Paris came up with a patch which solves the problem for him. Here's
a (hopefully) fixed version of his patch (without the typo).
Cc: Jim Paris <jim@jtan.com>
Signed-off-by: Cyril Brulebois <kibi@debian.org>
Reviewed-By: Matthias Hopf <mhopf@suse.de>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit fa6c701257)
GetPairedDevice() may not always return the keyboard, resulting in a
null-pointer dereference when accessing the XKB state.
For floating devices, the GetMaster() returns the device itself.
X.Org Bug 27573 <http://bugs.freedesktop.org/show_bug.cgi?id=27573>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Tested-by: Ben Hutchings <ben@decadent.org.uk>
(cherry picked from commit 10de9e8ee3)
<rdar://problem/7989690>
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Edward Moy <emoy@apple.com>
(cherry picked from commit ecfeabec8d)
The middle mouse clicks return erroneous values after returning from
Fast User Switching.
<rdar://problem/7979468>
http://xquartz.macosforge.org/trac/ticket/389
Signed-off-by: Martin Otte <otte@duke.edu>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Edward Moy <emoy@apple.com>
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit a911292c85)
commit 206531f75c added localization files
for ar, add them to the Makefile.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 72758287f7)
With Xinerama enabled, event coordinates are relative to Screen 0, so
they can be negative. The new DeviceEvent's coordinates are of type
uint16_t, making screens above and to the left of Screen 0 unusable.
X.Org Bug 24986 <https://bugs.freedesktop.org/show_bug.cgi?id=24986>
Signed-off-by: Chris Humbert <freedesktop@mahadri.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 21ed660f30)
A call to miPointerUpdateSprite for the XTEST keyboard may result in a
NULL pointer dereference in miDCPutUpCursor() when the save buffer is NULL.
XTS test case: Xlib 11 KeymapNotify
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit af170a4ab7)
This avoids painting the root window when it isn't actually drawable.
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 7b506fdc84)
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=27380 .
Signed-off-by: Michel Dänzer <daenzer@vmware.com>
Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7b65175266)
If both devices are synchronously grabbed, first with a GrabPointer, then
with a GrabKeyboard (GrabModeSync on both), sync.other of each device points
to the grab of the respective other device.
If the keyboard is then thawed through a AllowSome request, the VCK's
sync.other is reset to NULL. Subsequently, an event on the VCP would crash
the server when dereferencing sync.other on the VCP.
The check's purpose is to compare if the other device is grabbed by the same
client, which should be checked by accessing (dev->deviceGrab->grab->resource).
A check of the server-1.3 sources confirms that.
XTS test case: Xlib13 XAllowEvents 20.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 9ddbb03fa5)
- Pixmaps that are created during a fallback are automatically prepared access.
- During the fallback accelerated ops are blocked to prevent new/scratch gc's
from triggering accelerated ops on mapped pixmaps.
- A few cases of incorrect wrapping (on the top level pointer instead of
between damage and (w)fb) have been removed.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Acked-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 342f3689d1)
Conflicts:
exa/exa_mixed.c
Debian bug#576816 <http://bugs.debian.org/576816>
Tested-by: Arthur Marsh <arthur.marsh@internode.on.net>
Signed-off-by: Cyril Brulebois <kibi@debian.org>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The GenericEvent is a core event, we never send an extension event, so
don't reserve an id for one.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit fc5d767408)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Fixes a crash in XIQueryDevice which calls strlen on a NULL pointer.
#0 strlen () at ../sysdeps/x86_64/strlen.S:31
#1 0x00000000004c16ed in SizeDeviceInfo (dev=0x969bd0)
at ../../Xi/xiquerydevice.c:204
#2 0x00000000004c1a01 in ProcXIQueryDevice (client=0xa57510)
at ../../Xi/xiquerydevice.c:98
Debian bug#575905 <http://bugs.debian.org/575905>
Reported-by: "Bernhard R. Link" <brlink@debian.org>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 0e7703f9b1)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This changes the DC layer to maintain a persistent set of GCs/pixmaps/pictures
for each pScreen instead of failing to thrash between them when changing
screens.
Signed-off-by: Pierre-Loup A. Griffais <pgriffais@nvidia.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 00b8b7ad61)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The de-duplication of CheckPhysLimits 942eae6868 added a
condition that is invalid for a Xinerama setup. pScreen is invalid for the
Xinerama case, so comparing it to anything is a bad idea.
Signed-off-by: Tim Yamin <plasm@roo.me.uk>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 5f31e21961)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
<rdar://problem/7862319>
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Marc Majka <majka@apple.com>
(cherry picked from commit fe7778e58e)
See option_sends_alt in Xquartz(1)
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Kevin Van Vechten <kvv@apple.com>
(cherry picked from commit 840d12c7a6)
vga arbiter will be locked in one device while AbortDDX will call LeaveVT
routines from the other device. Fail!
Signed-off-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit b9ad452ec9)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
A client requesting a GrabModeSync button grab, owner-events true, with only
the ButtonRelease mask set would never receive the press event even if the
grab window had the ButtonPress mask set.
The protocol requires that if owner-events is true, then the delivery mask
is the combination of the grab mask + the window event mask.
X.Org Bug 25400 <http://bugs.freedesktop.org/show_bug.cgi?id=25400>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Jim Ramsay <i.am@jimramsay.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 1c612acca8)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Make sure the reference count of the new cursor is increased before the old
one is decreased, otherwise bad things will happen if they're one and the
same and the reference count is 1 initially. Not sure this can actually happen
here, but better safe than sorry.
Signed-off-by: Michel Dänzer <daenzer@vmware.com>
Reviewed-by: Roland Scheidegger <sroland@vmware.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 3083c5d0c4)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
There are keycodes > 193 in evdev, e.g. KEY_WIMAX which is 246 .
Signed-off-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Adam Jackson <ajax@nwnk.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit e086b99c1f)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This define was removed in e251c9e75a "Remove all traces of #ifdef XINPUT
and the matching bits from the configure.ac". Drivers that support multiple
server versions and still check for ifdef XINPUT now always build without
XINPUT support if they're calling XORG_DRIVER_CHECK_EXT(XINPUT, inputproto).
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dan Nicholson <dbn.lists@gmail.com>
(cherry picked from commit 6389405b56)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
XkbEnableDisableControls set extra garbage bits on the xkbControlsNotify
changedControls mask because it was uninitialized on the stack.
Found by clang
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 8311cd5f89)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
If we run out of opcodes, nothing is print on the log, making the
problem hard to debug. In the current Xserver, if you enable some
extensions like multibuffer (+2 events) and use nvidia binary driver (+5
events) you can run out of opcode numbers.
Signed-off-by: Paulo Ricardo Zanoni <pzanoni@mandriva.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit a9fe7cfa77)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Pierre-Loup A. Griffais <pgriffais@nvidia.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 6b09f66d8c)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This value isn't actually set for normal events but it saves us some work
for the record extension support.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit b4baab90c0)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Fix a regression in 9c9c3a85b0
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Acked-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 28a5f14b40)
This should make 'Unicode Hex Input' work as an input layout.
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Acked-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 339207be6f)
The problem is that the xf86_use_hw_cursor(_argb) functions may get this
correctly now, some drivers will replace these generic versions with their
own functions. It is pretty insane to expect them to do reference counting
of the cursor (as an example, look at driver/xf86-video-vmware to see how
that looks like as a workaround). There are even places in xserver itself
which replace these two functions.
The segfaults if no reference counting is done are caused because the
reference count of the cursor reached zero, hence the cursor was freed,
however xf86CursorEnableDisableFBAccess() brought it back to life from
the dead (from the SavedCursor).
This patch hence adds reference counting in xf86CursorSetCursor. As per Michel
Daenzer's suggestion, also free the cursor upon xf86CursorCloseScreen.
In theory with this it should be possible to remove the reference
counting in the UseHwCursor functions I think, though it should also be
safe to keep them.
Signed-off-by: Roland Scheidegger <sroland@vmware.com>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 67a8c659f2)
This should fix bug #3539.
Signed-off-by: Tomas Carnecky <tom@dbservice.com>
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 0c2fde5c8a)
This is how the crash can be triggered with only two clients on the system:
Client A: (already running)
Client B: Connect
Client B: CreateGlyphSet(depthN)
Client A: Disconnect
Server: free globalGlyphs(depthN)
Client B: AddGlyphs(depthN)
Server: SEGV
This crash was introduced with the FindGlyphsByHash function
in 516b96387b. Before that revision,
ResizeGlyphSet was always called before FindGlyphRef, which would
re-create globalGlyphs(depthN) if necessary.
X.Org Bug 20718 <http://bugs.freedesktop.org/show_bug.cgi?id=20718>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Peter Harris <pharris@opentext.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 185185eeb4)
