From b86b3d10bb2fee1a922b8831e8bb415c339f3d99 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Mon, 4 Mar 2013 07:58:41 +1000 Subject: [PATCH 01/12] dix: don't set non-exisiting flags on touch events Unlike pointer/keyboard events, the flags field for ET_Touch* is a set of server-internal defines that we need to convert to XI protocol defines. Currently only two of those defines actually translate to the protocol, so make sure we don't send internal garbage down the wire. No effect to current clients since they shouldn't look at undefined bits anyway. Signed-off-by: Peter Hutterer --- dix/eventconvert.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/dix/eventconvert.c b/dix/eventconvert.c index 2c411cf40..ebc52c36c 100644 --- a/dix/eventconvert.c +++ b/dix/eventconvert.c @@ -684,17 +684,18 @@ eventToDeviceEvent(DeviceEvent *ev, xEvent **xi) xde->root_x = double_to_fp1616(ev->root_x + ev->root_x_frac); xde->root_y = double_to_fp1616(ev->root_y + ev->root_y_frac); - if (ev->type == ET_TouchUpdate) - xde->flags |= (ev->flags & TOUCH_PENDING_END) ? XITouchPendingEnd : 0; - else + if (IsTouchEvent((InternalEvent *)ev)) { + if (ev->type == ET_TouchUpdate) + xde->flags |= (ev->flags & TOUCH_PENDING_END) ? XITouchPendingEnd : 0; + + if (ev->flags & TOUCH_POINTER_EMULATED) + xde->flags |= XITouchEmulatingPointer; + } else { xde->flags = ev->flags; - if (IsTouchEvent((InternalEvent *) ev) && - ev->flags & TOUCH_POINTER_EMULATED) - xde->flags |= XITouchEmulatingPointer; - - if (ev->key_repeat) - xde->flags |= XIKeyRepeat; + if (ev->key_repeat) + xde->flags |= XIKeyRepeat; + } xde->mods.base_mods = ev->mods.base; xde->mods.latched_mods = ev->mods.latched; From dbba50a1280cbda9ecff6f37884b4c5756c30bab Mon Sep 17 00:00:00 2001 From: Keith Packard Date: Tue, 9 Apr 2013 16:23:19 -0700 Subject: [PATCH 02/12] Xi: Use correct destination when swapping barrier events Write the swapped values to the destination rather than the source. Signed-off-by: Keith Packard Reviewed-by: Jasper St. Pierre Signed-off-by: Peter Hutterer --- Xi/extinit.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/Xi/extinit.c b/Xi/extinit.c index 619d0e468..02fffe574 100644 --- a/Xi/extinit.c +++ b/Xi/extinit.c @@ -848,24 +848,24 @@ SBarrierEvent(xXIBarrierEvent * from, *to = *from; - swaps(&from->sequenceNumber); - swapl(&from->length); - swaps(&from->evtype); - swapl(&from->time); - swaps(&from->deviceid); - swaps(&from->sourceid); - swapl(&from->event); - swapl(&from->root); - swapl(&from->root_x); - swapl(&from->root_y); + swaps(&to->sequenceNumber); + swapl(&to->length); + swaps(&to->evtype); + swapl(&to->time); + swaps(&to->deviceid); + swaps(&to->sourceid); + swapl(&to->event); + swapl(&to->root); + swapl(&to->root_x); + swapl(&to->root_y); - swapl(&from->dx.integral); - swapl(&from->dx.frac); - swapl(&from->dy.integral); - swapl(&from->dy.frac); - swapl(&from->dtime); - swapl(&from->barrier); - swapl(&from->eventid); + swapl(&to->dx.integral); + swapl(&to->dx.frac); + swapl(&to->dy.integral); + swapl(&to->dy.frac); + swapl(&to->dtime); + swapl(&to->barrier); + swapl(&to->eventid); } /** Event swapping function for XI2 events. */ From 7347f39f94d8cebbf73ce1a2f94d1abdaf7ff383 Mon Sep 17 00:00:00 2001 From: Maarten Lankhorst Date: Tue, 9 Apr 2013 11:19:07 +0200 Subject: [PATCH 03/12] Xi: Do not handle ET_TouchOwnership in ProcessTouchEvent The event struct is different, causing memory corruption on 1.13 and 1.14, as can be witnessed in https://bugs.freedesktop.org/show_bug.cgi?id=56578 Signed-off-by: Maarten Lankhorst Reviewed-by: Peter Hutterer Signed-off-by: Peter Hutterer --- Xi/exevents.c | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/Xi/exevents.c b/Xi/exevents.c index 6779139b5..576f0fe42 100644 --- a/Xi/exevents.c +++ b/Xi/exevents.c @@ -1223,9 +1223,16 @@ TouchRejected(DeviceIntPtr sourcedev, TouchPointInfoPtr ti, XID resource, * touchpoint if it is pending finish. */ static void -ProcessTouchOwnershipEvent(DeviceIntPtr dev, TouchPointInfoPtr ti, - TouchOwnershipEvent *ev) +ProcessTouchOwnershipEvent(TouchOwnershipEvent *ev, + DeviceIntPtr dev) { + TouchPointInfoPtr ti = TouchFindByClientID(dev, ev->touchid); + + if (!ti) { + DebugF("[Xi] %s: Failed to get event %d for touchpoint %d\n", + dev->name, ev->type, ev->touchid); + return; + } if (ev->reason == XIRejectTouch) TouchRejected(dev, ti, ev->resource, ev); @@ -1538,10 +1545,7 @@ ProcessTouchEvent(InternalEvent *ev, DeviceIntPtr dev) if (!t) return; - if (ev->any.type == ET_TouchOwnership) - touchid = ev->touch_ownership_event.touchid; - else - touchid = ev->device_event.touchid; + touchid = ev->device_event.touchid; if (type == ET_TouchBegin) { ti = TouchBeginTouch(dev, ev->device_event.sourceid, touchid, @@ -1614,19 +1618,13 @@ ProcessTouchEvent(InternalEvent *ev, DeviceIntPtr dev) (type != ET_TouchEnd && ti->sprite.spriteTraceGood == 0)) return; - /* TouchOwnership events are handled separately from the rest, as they - * have more complex semantics. */ - if (ev->any.type == ET_TouchOwnership) - ProcessTouchOwnershipEvent(dev, ti, &ev->touch_ownership_event); - else { - TouchCopyValuatorData(&ev->device_event, ti); - /* WARNING: the event type may change to TouchUpdate in - * DeliverTouchEvents if a TouchEnd was delivered to a grabbing - * owner */ - DeliverTouchEvents(dev, ti, (InternalEvent *) ev, 0); - if (ev->any.type == ET_TouchEnd) - TouchEndTouch(dev, ti); - } + TouchCopyValuatorData(&ev->device_event, ti); + /* WARNING: the event type may change to TouchUpdate in + * DeliverTouchEvents if a TouchEnd was delivered to a grabbing + * owner */ + DeliverTouchEvents(dev, ti, (InternalEvent *) ev, 0); + if (ev->any.type == ET_TouchEnd) + TouchEndTouch(dev, ti); if (emulate_pointer) UpdateDeviceState(dev, &ev->device_event); @@ -1820,10 +1818,14 @@ ProcessOtherEvent(InternalEvent *ev, DeviceIntPtr device) break; case ET_TouchBegin: case ET_TouchUpdate: - case ET_TouchOwnership: case ET_TouchEnd: ProcessTouchEvent(ev, device); break; + case ET_TouchOwnership: + /* TouchOwnership events are handled separately from the rest, as they + * have more complex semantics. */ + ProcessTouchOwnershipEvent(&ev->touch_ownership_event, device); + break; case ET_BarrierHit: case ET_BarrierLeave: ProcessBarrierEvent(ev, device); From 131f883f85b9b734e5e5652f16ba1d3b5f4de12f Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Fri, 12 Apr 2013 09:14:53 +1000 Subject: [PATCH 04/12] xfree86: change a log message This path is technically executed through config/udev, but having two messages in the form "config/udev: Adding drm device" makes it appear as if the udev filters are wrong and it's trying to add the same device twice. In fact, it's only one device, only added once, but a duplicate log message. Signed-off-by: Peter Hutterer Reviewed-by: Dave Airlie --- hw/xfree86/os-support/linux/lnx_platform.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/hw/xfree86/os-support/linux/lnx_platform.c b/hw/xfree86/os-support/linux/lnx_platform.c index 444f8f5d5..9b92d0cd3 100644 --- a/hw/xfree86/os-support/linux/lnx_platform.c +++ b/hw/xfree86/os-support/linux/lnx_platform.c @@ -140,8 +140,7 @@ xf86PlatformDeviceProbe(struct OdevAttributes *attribs) if (i != xf86_num_platform_devices) goto out_free; - LogMessage(X_INFO, "config/udev: Adding drm device (%s)\n", - path); + LogMessage(X_INFO, "xfree86: Adding drm device (%s)\n", path); ret = get_drm_info(attribs, path); if (ret == FALSE) From d16284687ddeffde32a561b8c67b2e2e3d66aeaa Mon Sep 17 00:00:00 2001 From: Bryce Harrington Date: Wed, 10 Apr 2013 23:05:40 -0700 Subject: [PATCH 05/12] xfree86: Revert workaround for drm race condition. Revert 70739e817b2d64bc020ea491f23a3574bdb6155e and mostly revert c31eac647a9ecf0fb20dc98266cadf0ba923ba14. Further investigation shows the encountered race condition is between lightdm and plymouth-splash, as implemented in the Ubuntu distribution within the limitations of upstart's job coordination logic, and can (and should) be fixed within those limiations. Not in xserver itself. This leaves some of the diagnostic improvements from the recent patch series, in case others run into a similar situation. Signed-off-by: Bryce Harrington Signed-off-by: Peter Hutterer --- hw/xfree86/os-support/linux/lnx_platform.c | 28 ++++------------------ 1 file changed, 5 insertions(+), 23 deletions(-) diff --git a/hw/xfree86/os-support/linux/lnx_platform.c b/hw/xfree86/os-support/linux/lnx_platform.c index 9b92d0cd3..bd060c96e 100644 --- a/hw/xfree86/os-support/linux/lnx_platform.c +++ b/hw/xfree86/os-support/linux/lnx_platform.c @@ -26,35 +26,17 @@ get_drm_info(struct OdevAttributes *attribs, char *path) char *buf; int fd; int err = 0; - int tries = 0; fd = open(path, O_RDWR, O_CLOEXEC); if (fd == -1) return FALSE; - while (tries++ < 200) { - sv.drm_di_major = 1; - sv.drm_di_minor = 4; - sv.drm_dd_major = -1; /* Don't care */ - sv.drm_dd_minor = -1; /* Don't care */ + sv.drm_di_major = 1; + sv.drm_di_minor = 4; + sv.drm_dd_major = -1; /* Don't care */ + sv.drm_dd_minor = -1; /* Don't care */ - err = drmSetInterfaceVersion(fd, &sv); - if (!err) { - if (tries > 1) - LogMessage(X_INFO, "setversion 1.4 succeeded on try #%d\n", tries); - break; - } if (err == -EACCES) { - if (tries % 500 == 0) - LogMessage(X_INFO, "waiting on drm device...\n"); - } else { - break; - } - - usleep(10000); - - if (!drmSetMaster(fd)) - LogMessage(X_INFO, "drmSetMaster succeeded\n"); - } + err = drmSetInterfaceVersion(fd, &sv); if (err) { ErrorF("setversion 1.4 failed: %s\n", strerror(-err)); goto out; From 9003399708936481083424b4ff8f18a16b88b7b3 Mon Sep 17 00:00:00 2001 From: Rui Matos Date: Sat, 13 Apr 2013 04:22:54 +0200 Subject: [PATCH 06/12] Xi: fix swapped grab mode args for keyboard devices in XIGrabDevice The protocol says that the grab_mode argument applies to the device being grabbed and paired_device_mode to the paired master device. GrabDevice() however takes in a pointer mode and a keyboard mode and so we have to swap the values according the type of device being grabbed. Signed-off-by: Rui Matos Reviewed-by: Peter Hutterer Signed-off-by: Peter Hutterer --- Xi/xigrabdev.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c index 09186e84f..63d95bc1c 100644 --- a/Xi/xigrabdev.c +++ b/Xi/xigrabdev.c @@ -67,6 +67,8 @@ ProcXIGrabDevice(ClientPtr client) uint8_t status; GrabMask mask = { 0 }; int mask_len; + unsigned int keyboard_mode; + unsigned int pointer_mode; REQUEST(xXIGrabDeviceReq); REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq); @@ -78,6 +80,15 @@ ProcXIGrabDevice(ClientPtr client) if (!IsMaster(dev)) stuff->paired_device_mode = GrabModeAsync; + if (IsKeyboardDevice(dev)) { + keyboard_mode = stuff->grab_mode; + pointer_mode = stuff->paired_device_mode; + } + else { + keyboard_mode = stuff->paired_device_mode; + pointer_mode = stuff->grab_mode; + } + if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1], stuff->mask_len * 4) != Success) return BadValue; @@ -91,8 +102,8 @@ ProcXIGrabDevice(ClientPtr client) xi2mask_set_one_mask(mask.xi2mask, dev->id, (unsigned char *) &stuff[1], mask_len); - ret = GrabDevice(client, dev, stuff->grab_mode, - stuff->paired_device_mode, + ret = GrabDevice(client, dev, pointer_mode, + keyboard_mode, stuff->grab_window, stuff->owner_events, stuff->time, From 4bff442ec5aa4b93a3f5c11782d4b7b9d1ae13ac Mon Sep 17 00:00:00 2001 From: Knut Petersen Date: Tue, 26 Feb 2013 07:52:59 +0100 Subject: [PATCH 07/12] Never try to execute BellProcPtr NULL. This prevents xts XI/XDeviceBell-2 test from segfaulting the server. Signed-off-by: Knut Petersen Reviewed-by: Peter Hutterer Signed-off-by: Peter Hutterer --- Xi/devbell.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Xi/devbell.c b/Xi/devbell.c index c75b94dee..202c8de18 100644 --- a/Xi/devbell.c +++ b/Xi/devbell.c @@ -142,7 +142,8 @@ ProcXDeviceBell(ClientPtr client) newpercent = base + newpercent; else newpercent = base - newpercent + stuff->percent; + if (proc == NULL) + return BadValue; (*proc) (newpercent, dev, ctrl, class); - return Success; } From 98b94c36d6b1d286bbd4cb414e54b4b95a1484b0 Mon Sep 17 00:00:00 2001 From: Maarten Lankhorst Date: Mon, 15 Apr 2013 16:53:48 +0200 Subject: [PATCH 08/12] dix: copy event in TouchConvertToPointerEvent correctly Fixes reading random memory read beyond the end of original event. sizeof device_event: 424 sizeof internal_event: 2800 Signed-off-by: Maarten Lankhorst Reviewed-by: Peter Hutterer Signed-off-by: Peter Hutterer --- dix/touch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dix/touch.c b/dix/touch.c index 891cc7803..3027bbbf2 100644 --- a/dix/touch.c +++ b/dix/touch.c @@ -620,14 +620,14 @@ TouchConvertToPointerEvent(const InternalEvent *event, BUG_WARN_MSG(!(event->device_event.flags & TOUCH_POINTER_EMULATED), "Non-emulating touch event\n"); - *motion_event = *event; + motion_event->device_event = event->device_event; motion_event->any.type = ET_Motion; motion_event->device_event.detail.button = 0; motion_event->device_event.flags = XIPointerEmulated; if (nevents > 1) { BUG_RETURN_VAL(!button_event, 0); - *button_event = *event; + button_event->device_event = event->device_event; button_event->any.type = ptrtype; button_event->device_event.flags = XIPointerEmulated; /* detail is already correct */ From 27356a45b4f6bad4d0bbf356e6d976d0c8dd257b Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Mon, 27 Feb 2012 17:22:16 +1000 Subject: [PATCH 09/12] dix: only allocate unused classes for master devices Slave devices don't need these and the matching code in CloseDevice() has a IsMaster() condition on freeing these, causing a leak. ==16111== 384 bytes in 4 blocks are definitely lost in loss record 72 of 105 ==16111== at 0x4C28BB4: calloc (vg_replace_malloc.c:467) ==16111== by 0x42AEE2: AllocDevicePair (devices.c:2707) ==16111== by 0x4BAA27: AllocXTestDevice (xtest.c:617) ==16111== by 0x4BA89A: InitXTestDevices (xtest.c:570) ==16111== by 0x425F5E: InitCoreDevices (devices.c:690) ==16111== by 0x5ACB2D: main (main.c:257) Signed-off-by: Peter Hutterer Reviewed-by: Chase Douglas --- dix/devices.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/dix/devices.c b/dix/devices.c index be236dd70..5f98afc42 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -2766,9 +2766,10 @@ AllocDevicePair(ClientPtr client, const char *name, keyboard->type = (master) ? MASTER_KEYBOARD : SLAVE; /* The ClassesRec stores the device classes currently not used. */ - pointer->unused_classes = calloc(1, sizeof(ClassesRec)); - - keyboard->unused_classes = calloc(1, sizeof(ClassesRec)); + if (IsMaster(pointer)) { + pointer->unused_classes = calloc(1, sizeof(ClassesRec)); + keyboard->unused_classes = calloc(1, sizeof(ClassesRec)); + } *ptr = pointer; From ddc149beaf708e84fb5573c4322d4f859c517917 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Mon, 27 Feb 2012 18:50:46 +1000 Subject: [PATCH 10/12] Stop the shouting Meanwhile, here in the future lowercase letters have been invented. Signed-off-by: Peter Hutterer Reviewed-by: Chase Douglas --- Xext/xvmain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Xext/xvmain.c b/Xext/xvmain.c index c2860b86a..0c5dc9bc1 100644 --- a/Xext/xvmain.c +++ b/Xext/xvmain.c @@ -156,8 +156,8 @@ XvExtensionInit(void) if (!dixRegisterPrivateKey(&XvScreenKeyRec, PRIVATE_SCREEN, 0)) return; - /* LOOK TO SEE IF ANY SCREENS WERE INITIALIZED; IF NOT THEN - INIT GLOBAL VARIABLES SO THE EXTENSION CAN FUNCTION */ + /* Look to see if any screens were initialized; if not then + init global variables so the extension can function */ if (XvScreenGeneration != serverGeneration) { if (!CreateResourceTypes()) { ErrorF("XvExtensionInit: Unable to allocate resource types\n"); From 7d722796c678532e8c5897c673c43184da353f44 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Wed, 17 Apr 2013 19:47:42 +1000 Subject: [PATCH 11/12] dix: plug memory leak in freeing TouchClass ==15562== 1,800 bytes in 1 blocks are definitely lost in loss record 298 of 330 ==15562== at 0x4A06B6F: calloc (vg_replace_malloc.c:593) ==15562== by 0x4312C7: InitTouchClassDeviceStruct (devices.c:1644) Signed-off-by: Peter Hutterer Reviewed-by: Alan Coopersmith --- dix/devices.c | 1 + 1 file changed, 1 insertion(+) diff --git a/dix/devices.c b/dix/devices.c index 5f98afc42..fa94a9438 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -795,6 +795,7 @@ FreeDeviceClass(int type, pointer *class) free((*t)->touches[i].valuators); } + free((*t)->touches); free((*t)); break; } From d8d3c78b6ebdf63836951d2dbd2d3d621ff26da2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andreas=20M=C3=BCller?= Date: Tue, 16 Apr 2013 14:30:43 +0200 Subject: [PATCH 12/12] dixstruct.h: fix segfaults - char is unsigned for ARM and PowerPC architectures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit see ARM related bug reports [1-3] [1] https://github.com/archlinuxarm/PKGBUILDs/issues/446I [2] http://www.raspberrypi.org/phpBB3/viewtopic.php?t=38568&p=321673 [3] http://lists.linuxtogo.org/pipermail/openembedded-core/2013-April/037805.html Signed-off-by: Andreas Müller Reviewed-by: Mark Kettenis Signed-off-by: Peter Hutterer --- include/dixstruct.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/dixstruct.h b/include/dixstruct.h index 678481920..aef822ca2 100644 --- a/include/dixstruct.h +++ b/include/dixstruct.h @@ -96,7 +96,7 @@ typedef struct _Client { unsigned int clientGone:1; unsigned int closeDownMode:2; unsigned int clientState:2; - char smart_priority; + signed char smart_priority; short noClientException; /* this client died or needs to be killed */ int priority; ReplySwapPtr pSwapReplyFunc;